zerofox logo
Advisories

Threat Intelligence Bulletin: 09/18/2020 - 09/24/2020

|by Alpha Team

banner image

Voter Registration Database for Sale on Dark Web

The ZeroFOX Alpha Team observed a posting on the popular hacking forum RaidForums advertising "Voters Affiliation 2020 - 186Million Records" by the user "greenmoon2019" on September 21, 2020. The seller provided a small sample of records in the listing containing information for voters in a variety of US states. This database is particularly noteworthy at the moment due to the upcoming election and the potential for misuse of this data. In addition, this data can be used for a number of malicious activites by threat actors looking to scam, steal from, or otherwise impact voters contained in the database. The ZeroFOX Alpha Team assesses that databases will probably increase in popularity in the time leading up to the US election.

Recommendations

  • Be vigilant when responding to or engaging with political emails or ads that you receive, especially ones requesting donations.
  • Be cautious taking unsolicited calls (cold callers) where they provide your personal information in order to verify their identity. Always ask to call the company back on a publicly listed number to verify the caller.

Details

On September 21, 2010, the user "greenmoon2019" posted on RaidForums advertising a database of 186 million voter registration records, with 60 million entries containing phone numbers. The seller provided a small snippet of data containing 20 users data from all over the United States with information including the following:

  • First Name
  • Middle Initial
  • Last Name
  • Address
  • City
  • County
  • State
  • Zip
  • Phone
  • Gender
  • Age/Year
  • Party affiliation

The account selling the data has been active since January 2019 and during that time has obtained a reputable data breach broker within the marketplace, selling multiple databases and records containing sensitive data.

The data "greenmoon2019" has for sale includes sensitive information of customers from multiple verticals across multiple geographical locations, which could indicate they do not target a particular sector to resell data on.

The ZeroFOX Alpha Team was able to obtain another sample from the seller with 5,000 voter registration records. There were records for each state including in the sample, with the top 5 states being:

  • PA - 211 records
  • NY - 271 records
  • FL - 417 records
  • CA - 478 records
  • TX - 497 records

The data contained data on the following party affiliations:

  • 183 - Liberal
  • 1098 - Independent
  • 1470 - Republican
  • 2233 - Democrat

Due to a warning from government agencies of potential political interference from other countries attempting to spread disinformation, voter registration databases have become more popular for abuse by threat actors. The Alpha Team has observed an increase of voter registration databases being sold on the dark web, which could indicate the amount of interest in this data along with the potential for malicious activity is also increasing. There are approximately 120 postings on RaidForums alone advertising some form of voter registration data.

Entities attempting to sow discord in the 2020 election can use this data in a variety of ways and could use the data in these dumps to target specific political parties. In addition, non-political based attackers could use this information as pretext for phishing campaigns, for instance, targeting users in a given political party for donations to their candidate and stealing financial data or funds intended for their party candidate. This data could also be used to perform targeted Vishing, where the attacker may impersonate a company and gain the victim’s trust by using knowledge of their address, date of birth and other personal information in order to verify the caller’s identity.

Sensitive information contained within the records, combined with OSINT, could be used by determined attackers in order to impersonate or harass potential victims. For example, using the victims name, address and phone number could allow an attacker to locate the individuals date of birth, which could potentially lead to identity theft, SIM swapping and other attacks. It is also not uncommon for this type of data to be sold to marketing firms or advertising networks for targeted advertisements.

Breaking News: 2020-09-18 - 2020-09-24

Google 'formally' bans stalkerware apps from the Play Store

Google has updated its Play Store rules to impose a formal ban on stalkerware apps. Stalkerware is a term used to describe apps that track a user's movements, snoop on calls and messages, and record other apps' activity. The primary feature of all stalkerware apps, regardless if they are intended to be used on smartphones or laptops, is that these apps can be installed and run without the device owner's knowledge, operating in the operating system's background. In an update to its Developer Program Policy, Google said that all apps that track users and send their data to another device must include an "adequate notice or consent" and show a "persistent notification" that the user's actions are being tracked by the app. These rules will come into effect next month, on 1st October. If user-tracking apps don't add these required UI changes, they won't pass the approval process to be listed on the Play Store.

See the full report here: https://www.zdnet.com/article/google-formally-bans-stalkerware-apps-from-the-play-store/

UK warns of surge in ransomware threats against education sector - BleepingComputer

The U.K. National Cyber Security Centre (NCSC) has issued an alert about a surge in ransomware incidents targeting educational institutions, urging them to follow the recently updated recommendations for mitigating malware attacks. A recent study conducted in the UK found that a third of all universities suffered a ransomware attack. The government organization also provided the common initial infection vectors seen for this type of cyber attack that includes: insecure Remote Desktop Protocol (RDP) configurations, vulnerabilities in unpatched software, and hardware devices, especially equipment on the network edge, such as firewalls and VPNs. Once on the network, the attackers seek to move laterally searching for high-value machines to encrypt, targeting backups, network shares, servers, and auditing devices.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-warns-of-surge-in-ransomware-threats-against-education-sector/

Drug spammers start using new technique to bypass spam filters - BleepingComputer

Actors behind a pill scam campaign are trying a new technique to keep them undetected by email protection systems and URL blocklists. The spammers combined convincing messages with IP addresses encoded in the hexadecimal numeral system that lead to fake pharma sites after a few redirects. Web browsers accept and decode this format along with others (octal, integer, or DWORD). The chain of events after clicking the hex-encoded IP address goes through several intermediate HTTP 301 and HTTP 302 redirects before landing on the final page that integrates legitimate, third-party payment gateways to process transactions via credit card or PayPal. Another interesting aspect is the spammers use the infrastructure of ClickBank, a legitimate retail and affiliate link service, to proxy to the final landing page. There is no malware involved in the scam campaign. The purpose of the operation is to convince recipients to buy fake drugs, sugar pills, snake oil products, and items of doubtful quality. Users should be wary of marketing messages popping in their inboxes out of the blue and promising products for various problems of a medical nature.

See the full report here: https://www.bleepingcomputer.com/news/security/drug-spammers-start-using-new-technique-to-bypass-spam-filters/

Hands on with iOS 14's new data breach notification feature - BleepingComputer

With the release of iOS 14, Apple has introduced a new feature that warns users when their stored passwords have been compromised in data breaches. iOS includes the Keychain password manager that allows users to save credentials and automatically fill them into login forms on sites and apps. When performing this check, iOS uses strong cryptographic techniques to regularly check derivations of passwords against a list of breached passwords securely and privately that doesn’t reveal password information even to Apple. If an account has been detected as breached or uses an easy to guess the password, a 'Security Recommendations' option will appear. If you click on the 'Security Recommendations' button, you will be brought to another page that lists all of your insecure passwords. Clicking on a password will either tell you if its easily guessed, compromised in some manner, or been found as part of a data breach. The keychain will then prompt you to change your password, which will open the site to either the password reset page or its homepage.

See the full report here: https://www.bleepingcomputer.com/news/apple/hands-on-with-ios-14s-new-data-breach-notification-feature/

Drupal addressed XSS and information disclosure flaws

Drupal maintainers addressed several vulnerabilities in the popular content management system (CMS). The most severe issue, tracked as CVE-2020-13668, is a critical reflected XSS issue affecting Drupal 8 and 9. The remaining flaws addressed in the CMS are rated moderately critical. The information disclosure flaw tracked is as CVE-2020-13670 and the moderately-critical XSS vulnerability tracked as CVE-2020-13669 impacts versions 8 and 9 of the CMS. A Cross-site scripting flaw tracked as CVE-2020-13669 that affects Drupal 7 and 8 and resides the CKEditor image caption feature of the Drupal core. Users are advised to update to the latest versions.

See the full report here: https://securityaffairs.co/wordpress/108411/hacking/drupal-xss-information-disclosure-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=drupal-xss-information-disclosure-flaws

Source code of Cerberus banking Trojan leaked on underground forums

The author of the Cerberus banking Trojan has released the source code of the malware on underground hacking forums following a failed auction. The malware-as-a-service Cerberus has emerged in the threat landscape in August 2019, it is an Android RAT developed from scratch that doesn’t borrow the code from other malware. The overall project includes the source code of the components (the malicious APK, the admin panel, and C2 code), the installation guide, a collection of scripts for the setup, and a customer list with an active license, along with contacts for customers and potential buyers. Before the auction of the code, the maintainers of the Cerberus Trojan were offering their bot for rent for up to $12,000 per year, while they also offered a license for $4,000/3 months and $7,000/6 months.

See the full report here: https://securityaffairs.co/wordpress/108373/cyber-crime/cerberus-source-code-leaked.html?utm_source=rss&utm_medium=rss&utm_campaign=cerberus-source-code-leaked

Maze ransomware uses Ragnar Locker virtual machine technique

The Maze ransomware operators have adopted a tactic previously used by the Ragnar Locker gang, to encrypt a computer from within a virtual machine. Ragnar Locker was deploying Windows XP virtual machines to encrypt victim’s files while bypassing security measures. Now Maze ransomware operators are using the same technique, deploying an MSI file that installed the VirtualBox VM software on the server along with a customized Windows 7 virtual machine, according to researchers from Sophos. The malware leverages a VirtualBox feature that allows the host operating system to share folders and drives as a network share inside a virtual machine. The virtual machine mounts the shared path as a network drive from the \VBOXSVR virtual computer to access their content. The virtual machine then runs the ransomware in the virtual machine to encrypt the share’s files. The Ragnar Locker attack used a VM containing a Windows XP image that was 404 MB in size. As Maze used Windows 7 image, the size of the file employed was of 2.6 GB.

See the full report here: https://securityaffairs.co/wordpress/108420/malware/maze-ransomware-vm.html?utm_source=rss&utm_medium=rss&utm_campaign=maze-ransomware-vm

Leading U.S. laser developer IPG Photonics hit with ransomware - BleepingComputer

IPG Photonics, a leading U.S. developer of fiber lasers for cutting, welding, medical use, and laser weaponry, has suffered a ransomware attack that is disrupting their operations. Due to the attack, IPG Photonics IT systems are shutdown worldwide, affecting email, phones, and network connectivity in the offices. A partial ransom note seen by BleepingComputer indicates that the RansomExx ransomware operation conducted the attack. RansomExx is a rebranded version of the Defray777 ransomware and has seen increased activity since June. The ransom note states the victim not to contact law enforcement as ransom payments could be blocked. It also claims to have stolen data from "TFS repositories."

See the full report here: https://www.bleepingcomputer.com/news/security/leading-us-laser-developer-ipg-photonics-hit-with-ransomware/

Rampant Kitten ‘s arsenal includes Android malware that bypasses 2FA

Security researchers from Check Point have discovered an Android malware, developed by an Iran-linked group dubbed Rampant Kitten, that can bypass 2FA. The arsenal of the group included several strains of malware, including an Android backdoor disguised inside malicious apps and four variants of Windows info stealers that were also able to access victims’ Telegram Desktop and KeePass account information. The Android backdoor developed by the group could steal the victim’s contacts list and SMS messages, record surroundings via the microphone, and show phishing pages. It can forward any SMS starting with the prefix 'G-' (The prefix of Google's two-factor authentication codes) to an attacker-controlled phone number. The feature is also able to automatically send all incoming SMS messages from Telegram, and other social network apps, to a phone number under the control of the attackers. According to the experts, this feature could be used by Rampant Kitten to show a Google phishing page and steal user’s account credentials to access the victim’s account.

See the full report here: https://securityaffairs.co/wordpress/108467/malware/rampant-kitten-android-malware.html?utm_source=rss&utm_medium=rss&utm_campaign=rampant-kitten-android-malware

Firefox bug lets you hijack nearby mobile browsers via WiFi

Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same WiFi network and force users to access malicious sites, such as phishing pages. The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network to share or receive content. A hacker connected to the WiFi network can launch a script on his system to spam the network with malformed SSDP packets. Any Android owner using a Firefox browser to navigate the web during this kind of attack would have his mobile browser hijacked and taken to a malicious site, or forced to install a malicious Firefox extension. The bug was fixed in Firefox 79. Firefox for desktop versions was not impacted. Users are recommended to upgrade to the latest version of Firefox for Android to be safe.

See the full report here: https://www.zdnet.com/article/firefox-bug-lets-you-hijack-nearby-mobile-browsers-via-wifi/

Microsoft removes Windows Defender ability after security concerns - BleepingComputer

Microsoft has removed the ability to download files using Windows Defender after it was demonstrated how it could be used by attackers to download malware onto a computer. The ability to download files using Defender could be abused by attackers as a LOLBIN. LOLBINs, or living-off-the-land binaries, are legitimate operating system files that can be abused for malicious purposes. To download a file, users could run the Microsoft Antimalware Service Command Line Utility (MpCmdRun[.]exe) with the -DownloadFile argument. However, using these features, it is possible to download any file, including ransomware, to the systems. If active, Windows Defender would quickly detect the malware, but other security software may allow Windows programs to bypass detections. The release of the Windows Defender Antimalware Client version 4.18.2009.2-0 removed the ability to download files via the MpCmdRun[.]exe command-line utility.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-removes-windows-defender-ability-after-security-concerns/

Tutanota encrypted email service suffers DDoS cyberattacks - BleepingComputer

Tutanota, end-to-end encrypted email software and freemium hosted secure email service, has experienced a series of DDoS attacks, targeting its website and further its DNS providers, causing downtime for several hours for millions of users. DDoS attacks directly targeting Tutanota surfaced on the weekend before September 14th, causing issues for a few hundred users, but was remedied shortly by restricting an "overreacting IP-block" responsible for the attack. The second iteration of the DDoS attack hit the DNS provider which hosts records for Tutanota. Tutanota's administrators were able to re-map the DNS entries for the domain to another DNS provider which could withstand the continued attacks. The company confirmed that the service to their email service had been restored as of Thursday, September 17th at 7:30 CET. Tutanota reassured its users that no user data was compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/tutanota-encrypted-email-service-suffers-ddos-cyberattacks/

Stubborn WooCommerce Plugin Bugs Get Third Patch

WordPress plugin, Discount Rules for WooCommerce, is vulnerable to two flaws, identified by the researchers as an “authorization bypass leading to stored cross-site scripting” bugs. The flaws could give hackers a springboard to an eventual compromise of a targeted site. Additionally, the flaw “allowed any site visitor to add, modify, and delete” AJAX rules, allowing them to view any existing coupons. After two fixes for the flaws, first available on Aug. 22 and second on Sept. 2, failed to patch the problem, the third round of patches for these bugs became available to customers on September 09, 2020. E-commerce sites using the WordPress plugin Discount Rules for WooCommerce are urged to patch the flaws to prevent an attacker from hijacking a targeted site.

See the full report here: https://threatpost.com/woocommerce-plugin-bug-allows-site-takeover/159364/

ATO declines to fix code replay flaw within myGovID

myGovID is the Australian government's digital identity credential, handled by the Australian Taxation Office (ATO) to access ATO services. The default login option for agents used by ATO is vulnerable to a code replay attack. When a myGovID user attempts to log in to a site, they are asked to input a four-digit code into the myGovID smartphone app to verify the login. According to security researchers Ben Frengley and Vanessa Teague, when a non-technical user tries to use the myGovID scheme to log in to a website under the attacker's control, the attacker can capture an email address, log into another myGovID service and replay the generated code to the user to enter into the myGovID app. While the user is not alerted to the other login taking place. ATO declines to fix the code replay flaw within myGovID. Users are advised to ensure they only receive codes from the mygovid[.]gov[.]au.

See the full report here: https://www.zdnet.com/article/ato-declines-to-fix-code-replay-flaw-within-mygovid/

MU Health Care reports data breach - ABC17News.com

University of Missouri Health Care has reported a data breach after an email phishing incident during which an unauthorized party may have accessed its patients' information. Investigations have revealed that the hackers accessed the accounts between May 4 and May 6. The exposed information may have included names, dates of birth, medical record or patient account numbers, health insurance information, limited treatment, or clinical information. For some patients, a Social Security number was also identified. MU Health Care has notified the impacted individuals and has offered complimentary credit monitoring and identity protection services for individuals whose Social Security number was identified.

See the full report here: https://abc17news.com/news/2020/09/20/mu-health-care-reports-data-breach-2/

Hackers leak details of 1,000 high-ranking Belarus police officers

Hackers have leaked personal information of over 1,000 high-ranking Belarusian police officers in response to violent police crackdowns against anti-government demonstrations. Information including names, dates of birth, and the officers' departments and job titles was leaked via a Google spreadsheet, with most of the entries being for high-ranking officers, such as lieutenants, majors, and captains. A spokesperson for the Belarusian Ministry of Internal Affairs has confirmed the leak, but also warned that they plan to find and prosecute the hackers and leakers. The hackers threaten to leak more data if police crackdown against anti-government protesters continues.

See the full report here: https://www.zdnet.com/article/hackers-leak-details-of-1000-high-ranking-belarus-police-officers/

US govt orders federal agencies to patch dangerous Zerologon bug by Monday

The Department of Homeland Security's (DHS) cybersecurity division has ordered federal civilian agencies to install a security patch for Windows Servers to protect against a vulnerability CVE-2020-1472, also known as Zerologon. CVE-2020-1472 can allow threat actors that have a foothold on an internal network to hijack Windows Servers running as domain controllers and effectively take over the entire network. Microsoft included fixes for the Zerologon vulnerability in the August 2020 Microsoft Patch Tuesday, published on August 11. However, many Windows Servers are yet to be patched. Due to the ease of exploitation and severe consequences of a successful Zerologon attack, DHS CISA officials have given federal system administrators until Monday (11:59 PM EDT, Monday, September 21, 2020) to patch all their Windows Servers configured as domain controllers. The DHS also ordered that unpatched Windows Servers are to be taken offline and removed from the network.

See the full report here: https://www.zdnet.com/article/us-govt-orders-federal-agencies-to-patch-dangerous-zerologon-bug-by-monday/

Microsoft explains why Windows 10 is crashing on Lenovo laptops - BleepingComputer

Lenovo has issued an advisory warning that ThinkPad models from 2019 and 2020 with Virtualization enabled in the Enhanced Windows Biometric Security setting, could encounter Blue Screen of Death and other bugs. After users installed the July's Windows 10 2004 KB4568831 update, Lenovo ThinkPad users found that their laptops would crash with SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (in the Stop error message screen) and 0xc0000005 Access Denied errors. These issues are caused by incompatible drivers conflicting with the virtualization features of Windows 10. Microsoft has acknowledged that changes introduced in recent Windows 10 2004 updates cause crashes on Lenovo ThinkPad laptops and has offered a workaround. Microsoft states that they are currently working on a fix with Lenovo to prevent these crashes in Windows 10 2004.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-explains-why-windows-10-is-crashing-on-lenovo-laptops/

Details of 540,000 sports referees taken in failed ransomware attack

ArbiterSports, the official software provider for the NCAA (National Collegiate Athletic Association), and other US leagues have announced it fended off a ransomware attack. The ransomware attack took place on July 15, 2020. In a data breach notification letter filed with multiple states across the US, the company said that despite detecting and blocking the hackers from encrypting its files, the intruders managed to steal a copy of its backups. This backup contained data from ArbiterGame, ArbiterOne, and ArbiterWorks, three of the web applications used by schools and sports leagues to assign and manage the schedules and training programs of referees and game officials. The data backups contained sensitive information such as account usernames and passwords, as well as social security numbers and addresses. Around 540,000 of its registered members, who are referees, leagues officials, and school representatives were impacted.

See the full report here: https://www.zdnet.com/article/details-of-540000-sports-referees-taken-in-failed-ransomware-attack/

Texas business targeted in Department of State Health RFQ phishing

Scammers have tried to rip off computer equipment suppliers with a targeted email that impersonated the Commissioner of the Texas Department of State Health Services (DSHS). In an email sent to a company’s sales department, the fraudsters requested a price quote for 20 touchscreen laptops and 200 portable hard drives. The sender’s email impersonated John William Hellerstedt, the acting Commissioner of Texas DSHS since January 2016, and appeared to come from the legitimate domain of the agency, according to Abnormal Security. A different email address in the ‘reply-to’ field, from a domain pretending to belong to the City of New York and registered two months ago, was used by the impersonators. In the fake attachment, the scammers did not disclose a shipment address but gave the recipient a 30-day deadline to respond to the bid invitation. The fraudsters also dropped a phone number that shows the Texas DSHS as the first result on Google.

See the full report here: https://www.bleepingcomputer.com/news/security/texas-business-targeted-in-department-of-state-health-rfq-phishing/

Microsoft secures backend server that leaked Bing data

Microsoft has suffered a rare cyber-security lapse earlier this month when the company's IT staff accidentally left one of Bing's backend servers exposed online. The server was exposed online from September 10 to September 16 and was discovered by Ata Hakcil, a security researcher. According to his investigation, the server is believed to have exposed more than 6.5 TB of log files containing 13 billion records originating from the Bing search engine. The server exposed technical details, such as search queries, details about the user's system (device, OS, browser, etc.), geo-location details (where available), and various tokens, hashes, and coupon codes. The researcher was able to verify his findings by locating search queries he performed in the Bing Android app in the server's logs. Post reporting, Microsoft Security Response Center (MSRC) has secured the server with a password.

See the full report here: https://www.zdnet.com/article/microsoft-secures-backend-server-that-leaked-bing-data/

University of Tasmania leaks data of 19900 students - ACS

The University of Tasmania (UTAS) has reported a data breach that leaked the personal information of nearly 20,000 students through a misconfigured Office365 Sharepoint site. UTAS stated that the leak was caused by an error and there was no evidence this data breach was a result of malicious activity. The leaked files included personally identifiable information such as full names, email addresses, phone numbers, and dates of birth. Information that would be classed as 'sensitive' under Tasmanian privacy legislation, such as country of birth, or Indigenous or Torres Straight Islander status, was also leaked. The University of Tasmania confirmed that no banking or credit card details were exposed in the misconfiguration. Following the leak, UTAS updated its Sharepoint permissions, disabled the Delve feature, and has migrated its internal sites Sharepoint to Microsoft Teams.

See the full report here: https://ia.acs.org.au/article/2020/university-of-tasmania-leaks-data-of-19-900-students.html

Dutch police hacked criminals' encrypted devices only to find rampant cop corruption - TechRadar UK

The police in Europe arrested hundreds of people on suspicion of drug trafficking and other crimes after successfully hacking into an encrypted phone network being used by organized criminals around the world. The authorities said that by hacking into the EncroChat devices, the police were able to monitor criminal activity and communication as it was happening, allowing them to stop drug deals and even to prevent murder. Encrochat smartphones were particularly popular with criminals for hire and drug traffickers who used them to communicate securely with customers and partners without fear that law enforcement authorities could be intercepting their conversations. However, the law enforcement managed to install malware on them capable of disabling their factory reset feature, recording screen lock passwords, and cloning app data.

See the full report here: https://www.techradar.com/uk/news/mysterious-encrypted-phones-reveal-police-leaked-intelligence-to-criminals

CISA warns of notable increase in LokiBot malware

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory today warning federal agencies and the private sector about "a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020. LokiBot is one of today's most dangerous and widespread malware strains. Also known as Loki or Loki PWS, the trojan is a so-called "information stealer." It works by infecting computers and then using its built-in capabilities to search for locally installed apps and extract credentials from their internal databases. The malware mainly target browsers, email clients, FTP apps, and cryptocurrency wallets. The credentials stolen via LokiBot usually end up on multiple underground marketplaces. The advisory also contains detection and mitigation advice on dealing with LokiBot attacks and infections.

See the full report here: https://www.zdnet.com/article/cisa-warns-of-notable-increase-in-lokibot-malware/

Emotet double blunder: fake ‘Windows 10 Mobile’ and outdated messages - BleepingComputer

Researchers have discovered a new Emotet campaign that is heavily distributing password-protected archives to bypass email security gateways. This campaign started on Friday with documents claiming to be created on the expired Windows 10 Mobile and continued with a large volume of messages pretending to be made on Android. Microsoft announced early today that Emotet targeted various regions of the world with localized emails. Some of the languages used are English, French, and Italian. The theme varies from invitations to meetings and order confirmations to reports, all of them being compressed into a password-protected archive. After recipients extracted the attached document using the password provided in the email body and open it, they launch the embedded malicious macro that downloads the Emotet payload.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-double-blunder-fake-windows-10-mobile-and-outdated-messages/

Google Chrome Bugs Open Browsers to Attack

Google’s new release of Chrome 85.0.4183.121 for Windows, Mac, and Linux fixes ten security flaws. To exploit the flaw, an attacker would merely need to convince a target to visit a specially crafted webpage via phishing or other social-engineering lures. Depending on the privileges associated with the application, an attacker could view, change, or delete data. The successful exploitation of the most severe of these could allow an attacker to execute arbitrary code in the context of the browser. Google Chrome versions before 85.0.4183.121 are affected.

See the full report here: https://threatpost.com/google-chrome-attack/159466/

Russian hackers use fake NATO training docs to breach govt networks

In a new campaign, A Russian hacker group known by names, APT28, Fancy Bear, Sofacy, Sednit, and STRONTIUM, is behind a targeted attack campaign aimed at government bodies. The group delivered a hard-to-detect strand of Zebrocy Delphi malware under the pretense of providing NATO training materials. The malicious file distributed by APT28 titled, "Course 5 – 16 October 2020.zipx” would appear to be a ZIP bundle containing course materials. The file metadata and properties also show an image/jpeg MIME type with references to JPEG image data. When extracted the ZIP contains a corrupted Excel (.xls) file and another file with the same name "Course 5 - 16 October 2020" but an EXE extension. Researchers suspect that this malware targeted Azerbaijan government bodies.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-nato-training-docs-to-breach-govt-networks/

Known Citrix Workspace Bug Open to New Attack Vector

A Citrix Workspace vulnerability that was fixed in July has been found to have a secondary attack vector, which would allow cybercriminals to elevate privileges and remotely execute arbitrary commands under the SYSTEM account. The security flaw tracked as CVE-2020-8207 exists in the automatic update service of the Citrix Workspace application for Windows. According to the Citrix advisory, it could allow local privilege-escalation as well as remote compromise of a computer running the app when Windows file sharing (SMB) is enabled. Citrix Workspace for Windows users should update their applications to the latest version to eliminate this vulnerability.

See the full report here: https://threatpost.com/citrix-workspace-new-attack/159459/

A New Hacking Group Hitting Russian Companies With Ransomware

Cybersecurity researchers have uncovered a new entrant that has been actively trying to conduct multistage attacks on large corporate networks of medical labs, banks, manufacturers, and software developers in Russia. The ransomware gang, codenamed OldGremlin, believed to be a Russian-speaking threat actor, has been linked to a series of campaigns. The operators used COVID-Themed phishing and Russia's RBC Group, a Moscow-based major media group emails to download custom backdoors & malware. TinyCryptor ransomware (aka decr1pt) is used to encrypt files in the infected system and holding it hostage for about $50,000.

See the full report here: https://thehackernews.com/2020/09/russian-ransomware-hack.html

Google deprecates Web Store Payments API, effectively nuking Chrome paid extensions

Google is planning to permanently shut down the Chrome Web Store Payments API. Google was using this system to handle payments on the Web Store, such as one-time fees, monthly subscriptions, and free trials for commercial Chrome extensions. Responding to fraudulent transactions reported on paid extensions, the company suspended the ability to publish and update Chrome paid extensions in January, and later temporarily disabled the entire Payments API in March. Google is asking extension developers to migrate their extensions to use a third-party, non-Web Store payments processor.

See the full report here: https://www.zdnet.com/article/google-deprecates-web-store-payments-api-effectively-nuking-chrome-paid-extensions/

New 'Alien' malware can steal passwords from 226 Android apps

Security researchers have discovered and analyzed a new strain of Android malware that comes with a wide array of features allowing it to steal credentials from 226 applications. Named Alien, this new trojan has been active since the start of the year and has been offered as a Malware-as-a-Service (MaaS) offering on underground hacking forums. According to ThreatFabric researchers, Alien is based on an older Cerberus version and has integrated remote-access features into their codebases. The trojan can show fake login screens and collect passwords for various apps and services and also grant access to devices and perform other actions. Most of these fake login pages were aimed at intercepting credentials for e-banking apps. Most of the banking apps targeted by Alien developers were for financial institutions based mostly in Spain, Turkey, Germany, the US, Italy, France, Poland, Australia, and the UK.

See the full report here: https://www.zdnet.com/article/new-alien-malware-can-steal-passwords-from-226-android-apps/

Zerologon Patches Roll Out Beyond Microsoft

Samba and 0patch have issued fixes for CVE-2020-1472, which stems from the Netlogon Remote Protocol, available on Windows domain controllers used for various tasks related to the user- and machine-authentication. Exploiting the bug allows an unauthenticated attacker with network access to a domain controller to compromise all Active Directory identity services. A proof-of-concept exploit is released for the issue, which is a critical flaw rating 10 out of 10 on the CvSS severity scale. Microsoft did issue a patch for the flaw in August. However, not all the systems were not compatible with the fix. 0patch issued a “micropatch” of its own for the bug that was made available for Windows Server 2008 R2, which reached end-of-support this January and stopped receiving Windows updates. Meanwhile, it turns out that Samba, a file-sharing utility for swapping materials between Linux and Windows systems, also relies on the Netlogon protocol and thus suffers from this vulnerability.

See the full report here: https://threatpost.com/zerologon-patches-beyond-microsoft/159513/

AgeLocker ransomware targets QNAP NAS devices, steals data - BleepingComputer

QNAP NAS devices are being targeted in attacks by the AgeLocker ransomware, which encrypts the device's data, and in some cases, steal files from the victim. AgeLocker is ransomware that utilizes an encryption algorithm called Age (Actually Good Encryption) designed to replace GPG for encrypting files, backups, and streams. When encrypting files, it would prepend a text header to the encrypted data that starts with the URL 'age-encryption[.]org.' It then drops a ransom note named HOW_TO_RESTORE_FILES.txt that tells the victim that their QNAP device specifically targeted in the attack. Since the end of August 2020, AgeLocker, or another ransomware utilizing the same encryption, has been targeting publicly exposed QNAP NAS devices and encrypting their files. Unfortunately, there is no way to recover files encrypted by AgeLocker for free.

See the full report here: https://www.bleepingcomputer.com/news/security/agelocker-ransomware-targets-qnap-nas-devices-steals-data/

Hackers sell access to your network via remote management apps - BleepingComputer

Remote monitoring and management (RMM) software is starting to get attention from hackers as these types of tools provide access to multiple machines across the network. At least one network access broker has been advertising access to the networks of organizations on a major Russian-speaking forum since at least July 2020. Cyber intelligence company KELA was able to determine that the offer was for Zoho's ManageEngine Desktop Central, a management platform that lets administrators deploy patches and software automatically on network machines, as well as troubleshoot them through remote desktop sharing. KELA identified multiple victims, one company in Turkey and one in Canada. The prices asked for these two were 1.5BTC and 1BTC. Furthermore, the seller hints that the network access they are selling is suitable for ransomware attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-sell-access-to-your-network-via-remote-management-apps/

Shopify discloses security incident caused by two rogue employees

Online e-commerce giant Shopify is working with the FBI and other law enforcement agencies to investigate a security breach caused by two of its employees. The company stated that the member of its support team accessed and tried to obtain customer transaction details from Shopify shop owners (merchants). The transaction data that the rogue employees might have gained access to includes basic contact information, such as email, name, and address, as well as order details, like products and services purchased. They also confirmed that payment card numbers or other sensitive personal or financial information were not accessed.

See the full report here: https://www.zdnet.com/article/shopify-discloses-security-incident-caused-by-two-rogue-employees/

U.S. fitness chains suffer data breach affecting 600K customers - BleepingComputer

Town Sports International, a well-known United States fitness centers and gyms, suffered a data breach after a database containing the personal information of over 600,000 people was exposed on the Internet. Comparitech discovered a database with the user records for almost 600,000 members or staff and contained personal information, including names, addresses, phone numbers, email addresses, last four digits of credit cards, credit card expiration dates, and a member's billing history. The database was secured and the information is no longer accessible. It is not known if any unauthorized persons with malicious intent had accessed this database in the past. Town Sports did not respond to the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/us-fitness-chains-suffer-data-breach-affecting-600k-customers/

Government software provider Tyler Technologies hit by ransomware - BleepingComputer

Leading government technology services provider Tyler Technologies has suffered a ransomware attack that has disrupted its operations. Tyler Technologies' website displays a maintenance message, and their Twitter account tweeted that they were having technical difficulties. BleepingComputer found an encrypted file uploaded to VirusTotal related to this attack. The encrypted file has an extension of '.tylertech911-f1e1a2ac,' which includes Tyler Technologies' name and is the same format used in other RansomExx attacks. RansomExx is a rebranded version of the Defray777 ransomware and does not have a ransomware data leak site. The company is investigating the cyberattack and has notified law enforcement.

See the full report here: https://www.bleepingcomputer.com/news/security/government-software-provider-tyler-technologies-hit-by-ransomware/

Tags: weekly bulletin, all industries, global