Threat Intelligence Bulletin: 09/04/2020

Alpha Team Threat Actor Update: Gorka9 and US Election Databases

On September 1, 2020, Russian newspaper Kommersant published an article detailing a leak of US voter databases on an underground darknet forum. The Washington Post published an article covering the event later that day. The actor leaking the databases goes by the alias “Gorka9” and the forum in mention was xss[.]is. Since June 11, 2020, Gorka9 created 5 threads providing direct downloads to “Voter Registration Databases” from Florida, Arkansas, Connecticut, Michigan, and North Carolina. Based on Gorka9’s participation within XSS, we assess with high confidence that Gorka9 is a data broker, and although they have been highlighted to have a focus on databases containing voter data, Gorka9 deals and will continue to deal large databases for monetary gain.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If not already enabled, turn on the dark web chatter rule to search for terms related to your organization on the dark web

Details

Data brokers participate in obtaining databases, combolists, and target lists within the community through buying, selling, trading, or stealing this data. Although US-based voter databases were the highlight of the Kommersant article, Gorka9 also leaked data from multiple countries and products, including Russia, China, Indonesia, UK, Ukraine and has commented on or created 109 threads since June 11 2020 pertaining to obtaining these large datasets. Some of these threads include leaking or looking to obtain databases related to the Catho breach from Brazil, a Facebook-related data breach for users from Indonesia, a Chinese shoppers database, a Vologda-based Russian registration dataset, and a large Ukrainian voter registration database.

Gorka9 has become a topic of interest on XSS, with a thread being posted on 2 September 2020 by XSS user fedor007 discussing the article and the unwanted attention on the forum. An admin replied early in the thread (the thread, as of 4 September 2020, is now up to 3 pages), commenting on how the article brings unwanted attention to the forum, as well as criticizing the article for creating drama about the US elections.

Figure 1: Admin responding to the spotlight on XSS and Gorka9

Gorka9 responded on 3 September 2020, where they commented on how they shouldn’t post anything related to “Pindos” (pejorative slang for Americans) at the request of XSS admins.

Figure 2: Gorka9’s response to fedor007’s thread detailing the story

Based on the notoriety of the voter database story pinning Gorka9 and XSS, as well as the response from the forum community and the XSS admin, it is almost certain that the exchange of these datasets from Gorka9 and other brokers will be moved away from XSS and into other forums or private chats such as Jabber. We assess that it is probable that XSS will change its model of membership to reduce the risk of exposure to journalists and “unwanted attention”.

Why trade voter registration databases?

The reason voter registration databases were highlighted in this particular story is probably due to the upcoming American elections. XSS is a Russian-based cybercrime forum, and so highlighting the connection between Russian-speaking actors and the trading of voter registration databases can yield an alarming response from readers. Although the databases were from applications or open-source datasets, the intent of the database does not matter as much as the contents it contains. For example, many of these databases contain full names, dates of birth, addresses, and phone numbers. This is useful information for targeting victims for fraud or for phishing. These databases also contain demographic details, so they can also be used for setting up pretexts for scams. Alpha Team assesses that the reason these were probably for fraud-related purposes, rather than trying to influence elections, especially since Gorka9 and other actors trade datasets that have nothing to do with elections.

Patch Tuesday 09/09/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information
Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for September 2020 contained 129 vulnerabilities in total, with:

3 vulnerabilities rated as Critical
68 vulnerabilities rated as High
58 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2020-16875, CVE-2020-1210, and CVE-2020-1595.

CVE-2020-16875 CVE-2020-16875 is a Memory Corruption Vulnerability impacting Microsoft Exchange. According to Microsoft, the memory corruption vulnerability is a result of a remote code execution vulnerability that exists in Microsoft Exchange software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. An attacker could then install programs; view, change, or delete data; or create new accounts. The exploitation of the vulnerability requires that a specially crafted email be sent to a vulnerable Exchange server. The following products are affected by CVE-2020-16875:

Microsoft Exchange Server 2016 Cumulative Update 16
Microsoft Exchange Server 2016 Cumulative Update 17
Microsoft Exchange Server 2019 Cumulative Update 5
Microsoft Exchange Server 2019 Cumulative Update 6

Microsoft’s security update addresses the vulnerability by correcting how Microsoft Exchange handles objects in memory.

CVE-2020-1210 CVE-2020-1210 is a Remote Code Execution Vulnerability affecting Microsoft SharePoint. According to Microsoft, the vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. The exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. CVE-2020-1210 is reminiscent of CVE-2019-0604, another remote code execution vulnerability that exists in Microsoft SharePoint when the software fails to check the source markup of an application package. The following products are affected by CVE-2020-1210:

Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Server 2019

Microsoft’s security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.

CVE-2020-1595 CVE-2020-1595 is also a Remote Code Execution Vulnerability residing in Microsoft SharePoint. According to Microsoft, the vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. The exploitation of this vulnerability requires that a user access a susceptible API on an affected version of SharePoint with specially-formatted input. The following products are affected by CVE-2020-1595:

Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2019

Microsoft’s security update addresses the vulnerability by correcting how SharePoint handles the deserialization of untrusted data.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-0922 and CVE-2020-0908 which affects the Microsoft COM for Windows and Windows Text Service Module.

CVE-2020-0922 CVE-2020-0922 is a Remote Code Execution Vulnerability impacting Microsoft COM for Windows. According to Microsoft, the remote code execution vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafted file or lure the target to a website hosting malicious JavaScript. This vulnerability affects the following Microsoft products:

Windows 10 Version 1809 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 8.1 for x64-based systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1903 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2012
Windows 10 Version 1709 for ARM64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server version 1903 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows Server version 2004 (Server Core installation)
Windows Server 2012 R2
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server version 1909 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows RT 8.1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 10 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1909 for x64-based Systems

Microsoft’s latest security update addresses the vulnerability by correcting how Microsoft COM for Windows handles objects in memory.

CVE-2020-0908 CVE-2020-0908 is a Remote Code Execution Vulnerability affecting Windows Text Service Module. According to Microsoft, the remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability would gain execution on a victim system. This vulnerability impacts the following Microsoft products:

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server version 1903 (Server Core installation)
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows Server version 2004 (Server Core installation)
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server version 1909 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016 (Server Core installation)
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems

Microsoft’s latest security update addresses the vulnerability by correcting how the Windows Text Service Module handles memory.

Other Microsoft Vulnerabilities Other notable Microsoft vulnerabilities are remote code execution vulnerabilities tracked as CVE-2020-16857, CVE-2020-16862, CVE-2020-1285, CVE-2020-1210, CVE-2020-1200, CVE-2020-1576, CVE-2020-1452, CVE-2020-1453, and CVE-2020-1460, impacting Microsoft Dynamics 365 for Finance and Operations (on-premises), Microsoft Dynamics 365 (on-premises), GDI+, Microsoft SharePoint, Windows Media Audio Decoder, Windows, Windows Codecs Library, Windows Camera Codec Pack, and Visual Studio. CVE-2020-0878, CVE-2020-1057, and CVE-2020-1172 are memory corruption vulnerabilities impacting Microsoft Browser and Scripting Engine.

The latest Microsoft Security Update did not contain any zero-days and, as of now, there are no vulnerabilities found to be exploited in the wild.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2020-09-04 - 2020-09-10

Evilnum APT Group Employs New Python RAT

The Evilnum Advanced Persistent Threat (APT) group has adopted a new Python remote access Trojan (RAT) to target FinTech organizations with well-crafted spear-phishing attacks. The APT group appears to be improving its process to conceal its activity. The new PyVil RAT tool can steal credentials, deliver more malware and executables, run commands on the system, perform keylogging, take screenshots, and collect information such as the antivirus products on the machine, USB devices connected, and version of Chrome running. It is obfuscated within layers of code to evade detection while performing functions in the background.

See the full report here: https://www.darkreading.com/threat-intelligence/evilnum-apt-group-employs-new-python-rat/d/d-id/1338843

European ISPs report mysterious wave of DDoS attacks

More than a dozen Internet Service Providers (ISPs) across Europe have reported DDoS attacks that targeted their DNS infrastructure. The list of ISPs that suffered attacks over the past week includes Belgium's EDP, France's Bouygues Télécom, FDN, K-net, SFR, and the Netherlands' Caiway, Delta, FreedomNet, Online[.]nl, Signet, and Tweak[.]nl. The DDoS attacks against European ISPs all took place starting with August 28 and most of them were DNS amplification and LDAP-type of attacks.

See the full report here: https://www.zdnet.com/article/european-isps-report-mysterious-wave-of-ddos-attacks/

Warner Music Group finds hackers compromised its online stores - BleepingComputer

Warner Music Group (WMG), a music recording company, has disclosed a data breach affecting customers' personal and financial information after several of its US-based e-commerce stores were hacked in April 2020. On August 5, 2020, an unauthorized third party had compromised several US-based e-commerce websites WMG operates, but are hosted and supported by an external service provider. This allowed the criminals to acquire a copy of the users' personal information entered into one or more of the affected website(s)between April 25, 2020, and August 5, 2020. The stolen information could include the customers' names, email addresses, telephone numbers, billing addresses, shipping addresses, and payment card details. WMG offers 12 months of free identity monitoring services to those affected and encourages them to remain vigilant for any unauthorized use of your payment cards or suspicious email communications, particularly those purporting to come from Warner Music Group or any WMG-related websites.

See the full report here: https://www.bleepingcomputer.com/news/security/warner-music-group-finds-hackers-compromised-its-online-stores/

New Email-Based Malware Campaigns Target Businesses

Researchers have discovered a series of email-based malware distribution campaigns that are targeting businesses with multiple malware payloads that include Gozi ISFB, ZLoader, SmokeLoader, and AveMaria. In most instances, attackers initiate the attack by using contact forms on the target organization's website, which results in email communications that appear to originate from legitimate sources. The attackers claim to be the copyright owner of images they found on the target website. The emails are somewhat customized and include the organization's domain as the website with copyrighted content, as well as a hyperlink the victim is prompted to click. In most emails, this redirects to a malicious file hosted on Google Drive. These documents contain macros that start the infection process, in which a malicious payload is executed on the target system. While the attackers have delivered several different malware families in each campaign, all have the same crypter in each initial payload.

See the full report here: https://www.darkreading.com/threat-intelligence/new-email-based-malware-campaigns-target-businesses/d/d-id/1338838

China-based APT Debuts Sepulcher Malware in Spear-Phishing Attacks

A China-based APT has been sending organizations spear-phishing emails that distribute an intelligence-collecting RAT dubbed Sepulcher. Sepulcher is a basic RAT payload that can carry out reconnaissance functionality within the infected host, collects information about the drives, file information, directory statistics, directory paths, directory content, running processes, and services. It is being distributed through two separate campaigns. The first campaign was observed in March where the attackers impersonated the World Health Organization’s guidance on COVID-19 critical preparedness and embedded the emails with a weaponized RTF attachment. On clicking, the attachment exploits a Microsoft Equation Editor flaw to install an embedded malicious RTF object, in the form of a Windows meta-file (WMF) to a file directory. The WMF file’s execution then results in the delivery and installation of the Sepulcher malware. The second phishing campaign starting at the end of July targeted Tibetan dissidents. The emails, which purported to come from the “Women’s Association Tibetan,” included a malicious PowerPoint attachment, that when executed, calls out to the IP 118[.]99[.]13[.]4 to download a Sepulcher malware payload named “file.dll.”

See the full report here: https://threatpost.com/chinese-apt-sepulcher-malware-phishing-attacks/158871/

Attackers abuse Google DNS over HTTPS to download malware - BleepingComputer

Security researchers at Huntress Labs have noticed a suspicious URL in the PowerShell code that they had previously analyzed. While Google DNS is being used to resolve the suspicious domain, the response returned via Google DNS contains the malicious payload in an encoded form. Hackers employed a deceptive trick to obfuscate the payload. While the value appears to be a base64 encoded string, the base64 decoder produced gibberish data. This was because the "/" character serves as a separator, and that was not part of the payload. After several attempts of decoding, the decoded value revealed the decimal representations of valid IP addresses. The innocuous-looking DNS lookup query provided flexibility to the attackers to make the Command and Control (C&C) infrastructure dynamic. They could change the C&C server IP list at will, by simply updating the DNS responses. DNS over HTTPS(DoH) is becoming a more viable option for attackers as it provides multiple defensive protections and exfiltration techniques.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-abuse-google-dns-over-https-to-download-malware/

Phishing adds overlay on official company page to steal logins - BleepingComputer

A phishing campaign deployed recently at various businesses uses the company's home page to disguise the attack and trick potential victims into providing login credentials. According to researchers, this is a new tactic that loads the legitimate page of the business and applies a fake login box on top of it. The attack starts with an email purporting to be from the company technical support team informing that some messages were blocked from reaching the inbox because they were quarantined. To create a sense of urgency, the message from the attacker states that the emails are scheduled for deletion unless the recipient reviews them and takes action to recover them. A link in the email body takes the potential victim to the phishing page, where the company's home page is loaded automatically based on the domain name in the address. However, the fraudsters added an overlay with a fake login panel, making sure not to cover the entire page. The fake login overlay has the recipient's email address typed into the username field, making everything appear more legitimate.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-adds-overlay-on-official-company-page-to-steal-logins/

WhatsApp Discloses 6 Bugs via Dedicated Security Site

Facebook-owned WhatsApp has fixed six previously undisclosed vulnerabilities in its chat platform, revealing the move on a new dedicated security advisory site. Some of the bugs could have been triggered remotely. One, CVE-2020-1890, was a URL-validation issue in Android versions of WhatsApp and WhatsApp Business for Android that could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction. Other bugs required user interaction, such as CVE-2019-11928, an input-validation issue in some WhatsApp Desktop versions that could have allowed cross-site scripting if a user clicked on a link from a specially-crafted live location message. WhatsApp stated that it will continue to disclose and patch issues as quickly as possible, revealing that five of the six bugs were patched on the same day they were discovered.

See the full report here: https://threatpost.com/whatsapp-discloses-6-bugs-dedicated-security-site/158962/

U.S. Department of Defense discloses critical and high severity bugs - BleepingComputer

The U.S. Department of Defense has disclosed details about four security vulnerabilities on its infrastructure. Two of them have a high severity rating, while the other two received a critical score. One of the critical vulnerabilities is a subdomain takeover because of an unclaimed Amazon S3 bucket. It could be exploited to host malicious content on a legitimate domain. Visitors of the website could then be targeted with phishing and cross-site scripting attacks. The second glitch with a critical severity rating is a remote code execution on a DoD server running Apache Solr that had been left unpatched since August 2019. Another flaw stemming from unpatched software is a read-only path traversal that could have given an attacker access to arbitrary sensitive files on the system in a Cisco product. The second less severe bug is a code injection on a DoD host that may lead to arbitrary code execution.

See the full report here: https://www.bleepingcomputer.com/news/security/us-department-of-defense-discloses-critical-and-high-severity-bugs/

SunCrypt Ransomware shuts down North Carolina school district - BleepingComputer

A school district in North Carolina has suffered a data breach after having unencrypted files stolen during an attack by the SunCrypt Ransomware operators. The Haywood County School district in North Carolina announced that they had suffered a ransomware attack on August 24th, 2020. This attack caused the district to shut down its network and halt remote learning, which had started on August 17th. The hackers stored a PowerShell script on the network's Windows domain controller. To launch the script in every computer, the attackers pushed a batch file to each Windows device on the network. When executed, this batch file ran the script stored on the domain controller and encrypted the computer. The ransomware operators have published a 5GB archive containing data stolen from the school district, on their leak site. This leaked data contains numerous sensitive documents and personal information related to the school district, students, and teachers.

See the full report here: https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-shuts-down-north-carolina-school-district/

Microsoft to finally kill Adobe Flash support by January 2021 - BleepingComputer

Microsoft has announced to end support for Adobe Flash Player in its web browsers by January 2021. The decision was taken because of the dwindling numbers of people still using Flash Player, and due to more secure and better-performing open tech such as HTML5, WebGL, and WebAssembly. Microsoft also stated that after December 2020, users will no longer receive 'Security Update for Adobe Flash Player' from Microsoft that applies to Microsoft Edge Legacy and Internet Explorer 11. Beginning in January 2021, Adobe Flash Player will be disabled by default, and all versions older than KB4561600 released in June 2020 will be blocked. Microsoft will also remove Flash-related downloadable resources from all its download platforms once Flash reaches its end of support. However, according to an Adobe announcement, enterprise users who still use internal business systems requiring Flash Player commercial licensing and support to function can reach out to the company's official distribution licensing partner. Microsoft also says that customers will still be able to run such software solutions in an enterprise environment with the help of dedicated Microsoft Edge and Internet Explorer plug-ins.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-to-finally-kill-adobe-flash-support-by-january-2021/

FBI issues second alert about ProLock ransomware stealing data - BleepingComputer

The FBI has issued a second warning to alert US companies of ProLock ransomware operators stealing data from compromised networks before encrypting their victims' systems. FBI's previous alert also warned private industry partners about the malfunctioning of the ProLock's decryptor. According to the FBI, the ProLock ransomware has been harvesting and exfiltrating information from their victims' devices before deploying their payloads since March 2020. The stolen data is later used by the threat actors as leverage in persuading the victim organizations into paying ransoms. The FBI encourages private industry partners affected by ProLock ransomware attacks not to give in to the threat actors' demands and pay the ransoms.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-issues-second-alert-about-prolock-ransomware-stealing-data/

Visa warns of new Baka credit card JavaScript skimmer - BleepingComputer

Visa warns about a new JavaScript e-commerce skimmer called Baka that can remove itself from memory after exfiltrating stolen data. Baka was discovered by researchers with Visa's Payment Fraud Disruption (PFD) initiative in February 2020 while examining a command and control (C2) server that previously hosted an ImageID web skimming kit. The skimmer is being added to merchants' checkout pages using a script tag and its loader will download the skimming code from the C2 server and execute it in memory, allowing the attackers to make sure that the skimming code used to harvest the customers' data isn't found while analyzing files hosted on the merchant’s server or the customer’s computer. The skimming payload decrypts to JavaScript written to resemble code that would be used to render pages dynamically. Once executed, the skimmer captures the payment data from the checkout form.

See the full report here: https://www.bleepingcomputer.com/news/security/visa-warns-of-new-baka-credit-card-javascript-skimmer/

Thanos Ransomware adds Windows MBR locker that fails every time - BleepingComputer

Researchers have discovered a new variant of Thanos ransomware, which fails to deliver the ransom note onto compromised systems by overwriting the computers' Windows master boot record (MBR). The code responsible for overwriting the MBR caused an exception because the ransom message contained invalid characters, which left the MBR intact and allowed the system to boot correctly. Even though the ransomware failed to overwrite the compromised computers' MBRs, the Thanos operators still dropped ransom note by creating HOW_TO_DECIPHER_FILES.txt text files and asking the victims to pay $20,000 to recover their data. The threat actors also used multiple layers of PowerShell scripts, inline C# code, and shellcode in order to load Thanos into memory and to run it on the local system. Thanos ransomware is a Ransomware-as-a-Service (RaaS) operation advertised on several Russian-speaking hacker forums since February 2020 that enables affiliates to create custom ransomware payloads with the help of a builder provided by the developer.

See the full report here: https://www.bleepingcomputer.com/news/security/thanos-ransomware-adds-windows-mbr-locker-that-fails-every-time/

Data Breach At Northwestern Medicine Affects 56,000 Patients, Donors - CBS Chicago

Northwestern Memorial Hospital has suffered a data breach, impacting over 56,000 patients and donors. The healthcare center has notified the impacted individuals that their records were accessed early this year. Northwestern Memorial said the incident was not targeted at the health system and did not involve access to its electronic medical systems. The hospital has reported the breach to the United States Department of Health and Human Services and is investigating the issue further.

See the full report here: https://chicago.cbslocal.com/2020/09/04/northwestern-memorial-hospital-data-breach/

Ransomware attack halts Argentinian border crossing for four hours - BleepingComputer

Argentina's official immigration service, the Dirección Nacional de Migraciones, was attacked by Netwalker ransomware, which temporarily stopped crossing the country's borders. According to a complaint published by Argentina's cybercrime agency, Unidad Fiscal Especializada en Ciberdelincuencia, the government learned of the ransomware attack after receiving numerous technical support calls from points control at 7 AM around August 27th. In response to the infection, Argentina’s official immigration agency shut down its network to prevent the ransomware from spreading to other systems, which led to a temporary suspension of border crossings for four hours. Government sources confirmed that they will not be negotiating with the Netwalker operators, which demanded a $4 million ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-halts-argentinian-border-crossing-for-four-hours/

Attackers Steal Outlook Credentials Via Overlay Screens on Legitimate Sites

In a new phishing campaign, attackers are using overlay screens and email ‘quarantine’ policies to steal targets’ Microsoft Outlook credentials. The phishing emails imitate the technical-support team of the employee’s company (with “Support” in the sender title and “Action Required” in the subject line) and claim that the company’s email-security service had quarantined three valid email messages, blocking them from entering the inbox. The attackers create a false emergency by asking the target to review the messages and recover their lost mail in the inbox folder, or they will be automatically deleted after three days. If the target clicks on the link in the phishing email, it redirects to the employee’s legitimate company website with an Outlook email login screen. While the company webpage is legitimate, researchers found that attackers had added on an overlay screen with the credential request. The fake login panel said the employee’s Outlook sign-in timed out and asked them to input their credentials.

See the full report here: https://threatpost.com/attackers-steal-outlook-credentials-overlay-screens/158969/

Service NSW reveals hackers stole 738GB of data in email compromise - iTnews

Service NSW has revealed that hackers behind an email compromise attack against 47 staff members earlier this year stole 738GB of data, encompassing 3.8 million documents. The exposed data included handwritten notes and forms, scans, and records of transaction applications of over 186,000 customers. Service NSW stated that customers impacted by the breach will be notified using “personalised letters” that offer bespoke support services, including individual case managers for complex circumstances.

See the full report here: https://www.itnews.com.au/news/service-nsw-reveals-hackers-stole-738gb-of-data-in-email-compromise-552932

Epic Manchego gang uses Excel docs that avoid detection

A recently discovered cybercrime gang, tracked as Epic Manchego, is using a new technique to create weaponized Excel files that can bypass security checks. The group is actively targeting companies across the world with phishing emails since June 2020. Upon opening the Excel files, the embedded malicious script is executed after the victims click on the “enable editing” button. The macros would then download and install the malicious code and a data stealer on the victim's systems. Threat actors stored their malicious code in a custom VBA code format, which was also password-protected to prevent researchers from analyzing it. The trick used by the Epic Macnchego gang consists of compiling the documents with a .NET library called EPPlus, instead of the standard Microsoft Office software. Since the first attack, experts have detected more than 200 malicious documents over 2 months. The cybercrime gang has increased its activity in the last weeks. Researchers have spotted more than 10 new malicious documents in recent days.

See the full report here: https://securityaffairs.co/wordpress/107973/hacking/epic-manchego-excel-trick.html

France, Japan, New Zealand warn of sudden spike in Emotet attacks

Cyber-security agencies from France, Japan, and New Zealand have published security alerts warning about a large uptick in Emotet malware attacks targeting their respective countries. According to a security researcher, in recent weeks, Emotet botnet has been particularly active in the three countries. Emotet has features that allow it to spread laterally to the entire network, and can often download other malware, including ransomware.

See the full report here: https://www.zdnet.com/article/france-japan-new-zealand-warn-of-sudden-spike-in-emotet-attacks/

Chilean bank shuts down all branches following ransomware attack

BancoEstado, one of Chile's three biggest banks, was forced to shut down all branches on Monday following a ransomware attack that took place over the weekend. The bank launched an investigation into the incident and reported it to the Chilean police. Details about the attack have not been made public. According to ZDNet, the Chilean bank was attacked by the REvil ransomware operators. Threat actors used the malicious Office file to deliver a backdoor on the bank’s infrastructure and use it as the entry point. It seems that the attack vector was a series of spam messages using weaponized Office documents. According to the bank, its website, the banking portal, mobile apps, and the ATM network were not impacted.

See the full report here: https://www.zdnet.com/article/chilean-bank-shuts-down-all-branches-following-ransomware-attack/

Academics find crypto bugs in 306 popular Android apps, none get patched

Academics from Columbia University have developed a custom tool called CRYLOGGER, which dynamically analyzes Android applications to check if they're using cryptographic code in an unsafe way. The tool was used to test 1,780 Android applications, representing the most popular apps across 33 different Play Store categories, in September and October 2019. The academics said that after they tested the apps, they also contacted all the developers of the 306 Android applications found to be vulnerable, and only a few developers followed up. Since none of the developers fixed their apps and libraries, researchers refrained from publishing the names of the vulnerable apps and libraries, citing possible exploitation attempts against the apps' users.

See the full report here: https://www.zdnet.com/article/academics-find-crypto-bugs-in-306-popular-android-apps-none-get-patched/

Windows 10 themes can be abused to steal Windows accounts - BleepingComputer

Security researchers have found that specially crafted Windows 10 themes and theme packs can be used in 'Pass-the-Hash' attacks to steal Windows account credentials by tricking users into accessing a remote SMB share that requires authentication. An attacker can create a specially crafted .theme file and change the desktop wallpaper setting to use a remote authentication-required resource and when Windows tries to access the remote authentication-required resource, it will automatically try to log into the share by sending the NTLM hash and login name for the logged into an account. The attacker can then harvest the credentials and dehash the password using special scripts, so it's in its clear text form. As Pass-the-Hash attacks will send the account used to login to Windows, including a Microsoft account, attackers can potentially access email, Azure, or accessible corporate networks remotely. According to the researcher, blocking or re-associating the .theme, .themepack, and .desktopthemepackfile extensions to a different program can protect against malicious theme files.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-themes-can-be-abused-to-steal-windows-accounts/

Ransomware gang says they are behind Newcastle University attack - BleepingComputer

UK research university Newcastle University suffered a serious cyber incident, which is causing operational disruption across its networks and IT systems. All University systems, with the exceptions of those listed in the communications (Office365, including email and Teams, Canvas, and Zoom) are either unavailable or available but with limitations. The DoppelPaymer ransomware operators are claiming to be responsible for this attack. To support their claims, they have shared 750Kb worth of stolen data from the university as proof on their data leak site. Newcastle University stated that the investigations are ongoing and it will take several weeks to address to issue.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-are-behind-newcastle-university-attack/

Intel fixes critical flaw in corporate remote management platform - BleepingComputer

Intel has addressed nine security vulnerabilities with the release of the September 2020 Platform Update. The update contained a critical flaw tracked as CVE-2020-8758, impacting the Active Management Technology (AMT) and Intel Standard Manageability (ISM) platforms. CVE-2020-8758 is rated by Intel as a critical severity security issue with a CVSS base score of 9.8 and, it may allow escalation of privilege on vulnerable systems following successful exploitation. All Intel AMT and Intel ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68, and 14.0.39 are vulnerable to CVE-2020-8758 attacks. Intel stated that they are not aware of any of the issues addressed in the September 2020 Platform Update being actively exploited in the wild. However, to prevent future attacks, customers are advised to install the latest security updates as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-fixes-critical-flaw-in-corporate-remote-management-platform/

Netwalker ransomware hits Pakistan's largest private power utility - BleepingComputer

K-Electric, the sole electricity provider for Karachi, Pakistan, has suffered a Netwalker ransomware attack that led to the disruption of billing and online services. The cyberattack occurred on the morning of September 7th, 2020, and is disrupting K-Electric's online billing services and not the supply of power. K-Electric customers have been unable to access the online services for their account. In a TOR payment page, the ransomware operators demanded a $3,850,000 ransom payment, and if a ransom is not paid within another seven days, the ransom will increase to $7.7 million. The Tor payment site also includes a 'Stolen data' page that states the Netwalker operator stole unencrypted files from K-Electric before performing the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-pakistans-largest-private-power-utility/

Bug in Google Maps Opened Door to Cross-Site Scripting Attacks

An Israel-based security researcher Zohar Shachar discovered a cross-site scripting (XSS) vulnerability in Google Maps. The flaw was in the Google Maps function that allows users to create their own map. These maps can be exported in various formats, including Keyhole Markup Language (KML), a format that is used to display geographic data in Google Earth and other similar applications. An analysis of the server response when exporting a map using KML revealed an XML response containing, among other things, a CDATA tag. The CDATA section contains text that is not rendered by the browser. The security researcher found a way to escape the CDATA section and add arbitrary XML content that would be rendered by the browser, which resulted in an XSS vulnerability. Google initially awarded a $5,000 bounty for the security hole, but Shachar earned an additional $5,000 after finding a way to bypass the initial fix.

See the full report here: https://threatpost.com/bug-in-google-maps-opened-door-to-cross-site-scripting-attacks/159006/

Google Chrome starts blocking ads that slow down the browser

Google is rolling out a new feature that allows the Google Chrome web browser to automatically unload web ads that use a disproportionate amount of system resources as part of an effort to reduce the browser's network and CPU footprint. Chrome's new anti-heavy ad intervention system includes mining cryptocurrency in-browser, loading large and poorly compressed images, and loading large video files before a user gesture. It will also automatically unload ads that perform resource-intensive JavaScript operations including CPU timing attacks and video decoding.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-starts-blocking-ads-that-slow-down-the-browser/

Adobe fixes critical vulnerabilities in InDesign and Framemaker

Adobe has released security updates to address 12 critical vulnerabilities in Adobe InDesign, Adobe Framemaker, and Adobe Experience Manager. The company also addressed 18 important severity bugs that could lead to arbitrary JavaScript execution in the browser via stored cross-site scripting vulnerabilities or disclosure of sensitive information via execution with unnecessary privileges. Adobe recommends users update their product installations to the latest versions.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-vulnerabilities-in-indesign-and-framemaker/

Hackers use legit tool to take over Docker, Kubernetes platforms

The cybercrime group TeamTNT has been tracked by various research groups observed using a new technique by abusing Weave Scope, a trusted open-source tool which gives the user full access to their cloud environment, and can be integrated with Docker, Kubernetes, the Distributed Cloud Operating System (DC/OS), and AWS Elastic Compute Cloud (ECS). The attackers install this tool to map the cloud environment of the victim and execute system commands without deploying malicious code on the server.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-legit-tool-to-take-over-docker-kubernetes-platforms/

Data center giant Equinix discloses ransomware incident

Equinix, one of the world's largest providers of on-demand colocation data centers, has disclosed today a security breach. According to the official statement, the company found ransomware on its internal systems, but that the main core of its customer-facing services remained unaffected. All the data centers and service offerings, including managed services, remain fully operational. The company is currently investigating the incident and is yet to disclose details of the breach.

See the full report here: https://www.zdnet.com/article/data-center-giant-equinix-discloses-ransomware-incident/

Raccoon attack allows hackers to break TLS encryption 'under certain conditions'

Researchers have disclosed a theoretical attack on the TLS cryptographic protocol that can be used to decrypt the HTTPS connection between users and servers and read sensitive communications. Named Raccoon, the attack targets the Diffie-Hellman key exchange process, which helps the attacker to construct a set of equations, and use a solver for the Hidden Number Problem (HNP) to compute the original premaster secret established between the client and the server. All servers that use the Diffie-Hellman key exchange in setting up TLS connections are vulnerable to attacks. This is a server-side attack and cannot be performed on a client, such as browsers. The attack also needs to be executed for each client-server connection in part, and cannot be used to recover the server's private key and decrypt all connections at once. While the attack has been deemed hard to exploit, Microsoft, OpenSSL, Mozilla, and F5 have released security updates to block Raccoon attacks.

See the full report here: https://www.zdnet.com/article/raccoon-attack-allows-hackers-to-break-tls-encryption-under-certain-conditions/

Spyware Labeled ‘TikTok Pro’ Exploits Fears of US Ban

Researchers have discovered a new Android spyware campaign pushing a “Pro” version of the TikTok app that is exploiting fears among its young and gullible users that the popular social media app is on the cusp of being banned in the United States. The app is being distributed via SMS and WhatsApp messages to download the latest version of TikTok from a specific web address. Once installed and opened, the spyware launches a fake notification which then disappears along with the app’s icon to divert the user’s attention. The malware also has another anti-detection capability where an additional payload stored is stored inside the android package. In addition to taking over the smartphone and performing functions such as capturing photos, sending SMS messages, executing commands, capturing screenshots, calling phone numbers, and launching other apps on the device, the spyware also has a unique feature it uses to steal Facebook credentials. “Tik Tok Pro” launches a fake Facebook login page that, as soon as the victim tries to log in, stores the victim’s credentials and executes an additional command to send the stolen credentials to the malware’s command and control server. Users are advised to download apps from the trusted app stores and keep the “Unknown Sources” option disabled in the Android device.

See the full report here: https://threatpost.com/spyware-labeled-tiktok-pro-exploits-fears-of-us-ban/159050/

BLURtooth vulnerability lets attackers overwrite Bluetooth authentication keys

The organizations behind the Bluetooth wireless technology has published guidance on how device vendors can mitigate a new attack on Bluetooth capable devices. Named BLURtooth, this is a vulnerability in a component of the Bluetooth standard named Cross-Transport Key Derivation (CTKD) that is used for negotiating and setting up authentication keys when pairing two Bluetooth-capable devices. According to Bluetooth Special Interest Group (SIG) and the CERT Coordination Center at the Carnegie Mellon University (CERT/CC), an attacker can manipulate the CTKD component to overwrite other Bluetooth authentication keys on a device and grant an attacker connecting via Bluetooth access to other Bluetooth-capable services/apps on the same device. In some versions of the BLURtooth attack, the authentication keys can be overwritten completely, while in other authentication keys can be downgraded to use weak encryption. All devices using the Bluetooth standard 4.0 through 5.0 are vulnerable. The Bluetooth 5.1 standard comes with features that can be activated and prevent BLURtooth attacks.

See the full report here: https://www.zdnet.com/article/blurtooth-vulnerability-lets-attackers-overwrite-bluetooth-authentication-keys/

Slovak cryptocurrency exchange ETERBASE discloses $5.4 million hack

ETERBASE, a Bratislava-based cryptocurrency exchange, disclosed a security breach wherein hackers breached its internal network and stole cryptocurrency funds worth $5.4 million. The incident involved the theft of various cryptocurrencies from the company's hot wallets. Hot wallets are cryptocurrency accounts that are actively connected to the internet and which ETERBASE was using to power its inter- and intra-currency exchange operations. Funds were stolen from six hot wallets, storing Bitcoin, Ether, ALGO, Ripple, Tezos, and TRON assets. The company is currently tracing the stolen funds and all transactions on ETERBASE have been suspended until September 10.

See the full report here: https://www.zdnet.com/article/slovak-cryptocurrency-exchange-eterbase-discloses-5-4-million-hack/

Weave Scope is now being exploited in attacks against cloud environments

According to new research published by cybersecurity firm Intezer and Microsoft, TeamTNT has added the legitimate Weave Scope software to its attack toolkit in the quest to infiltrate cloud environments. Weave Works' Weave Scope is an open-source visualization and monitoring software for Docker, Kubernetes, Distributed Cloud Operating System (DC/OS), and AWS Elastic Compute Cloud (ECS), allowing users to watch running processes and network connections of containers in cloud environments via a dedicated interface. While a valuable and legitimate tool, the hacker group is taking advantage of cloud service misconfiguration and open access granted via port 4040 to deploy the software as a form of backdoor. In order to install Weave Scope, the group searches for an exposed Docker API and creates a new privilege container using a clean Ubuntu image, together with instructions to mount via the main file system and to both load and execute cryptocurrency miners. The tool acts as a backdoor into cloud installations and grants attackers the ability to monitor systems, install applications, use compute resources, and start, stop, or open shells in containers.

See the full report here: https://www.zdnet.com/article/weave-scope-is-now-being-exploited-in-attacks-against-cloud-environments/

Inova Suffers Third-Party Data Breach

Inova Health Systems has notified customers that it was hit by a ransomware attack through a third-party vendor. Blackbaud, a vendor that provides fundraising support to nonprofit organizations, was hit by an attack that resulted in Inova data being exfiltrated from the Blackbaud servers. According to Blackbaud, the data was exfiltrated between February 7, 2020, and May 20, 2020. The exfiltrated data included personally identifiable information on patients and donors to Inova, though it did not include Social Security numbers or payment information. Blackbaud stated that it remediated the vulnerability that allowed the attack and that its data is now safe.

See the full report here: https://www.darkreading.com/attacks-breaches/inova-suffers-third-party-data-breach/d/d-id/1338872