Threat Intelligence Bulletin: 09/25/2020 - 10/01/2020

Attacks on the Healthcare Industry

This past week, the US-based healthcare company Universal Health Services (UHS) experienced a suspected ransomware attack that forced the IT network across its many facilities and hospitals to be shut down. This advisory addresses the current ransomware threats posed to healthcare based companies and how ransomware can leverage the current pandemic to force companies into paying the ransomware operators more money at the risk of not being able to provide healthcare services.

Recommendations

• Always verify the sender of suspicious or unexpected emails and messages
• Never download or execute attachments from unknown senders or suspicious emails
• If you are in the healthcare industry, ensure you have proper disaster recovery processes and procedures in place
• Talk with your account manager about ZeroFOX’s Advanced Email Protection services to ensure suspicious or malicious emails are identified
• ZeroFOX customers are advised to closely monitor their darkweb alerts for indications that threat actors could be targeting them

Details

While UHS has not confirmed the cause of the outage to be ransomware and described the event as an “IT security issue”, there are some signs that point to ransomware, more specifically, Ryuk ransomware.

Ryuk is a popular type of crypto-ransomware used by many threat actors and ransomware groups which uses encryption to prevent access to files, systems or devices until a ransom is paid. Typically, ransomware such as Ryuk is deployed using other malware such as TrickBot or Emotet.

While the initial attack vector is unknown, it is assumed by security researchers that the initial infection was delivered through malicious emails. In addition, a news outlets have reported that the files were encrypted with a “.ryk” extension, which would indicate Ryuk.

Attacks like this on hospitals are worrying for countless reasons, especially with the current COVID-19 pandemic. This attack on UHS is also troubling due to the recent incident where a patient died after ransomware crippled a hospital located in Dusseldorf, Germany and forced the patient to travel about 20 miles, resulting in a one-hour delay in treatment.

Many of the ransomware groups tracked by the ZeroFOX Alpha Team on the dark web have specifically stated they would not target hospitals or healthcare providers when the COVID-19 pandemic started. However, several ransomware groups have singled-out pharmaceutical companies saying they wouldn’t exclude them from their targeted sectors meaning healthcare supply chains can also be indirectly impacted by their activities.

Figure 1: Ransomware group stating they will not attack hospitals

So far, 2020 has seen an increase in ransomware attacks targeting the healthcare sector with many threat actors using the current pandemic as leverage, knowing the facilities will need to restore operational capabilities as soon as possible in order to effectively care for their patients. Attacks like these at a larger scale against hospitals and healthcare providers could have severe implications and all due care should be taken to maintain network security for those within this sector.

Breaking News: 2020-09-25 - 2020-10-01

Microsoft confirms Group Policy Editor bug in Windows Server 2016 - BleepingComputer

Microsoft has confirmed that a bug in Windows 10 version 1607 and Windows Server 2016 is causing the Group Policy Editor to display errors. The bug was introduced in September's KB4577015 cumulative update, and Microsoft is working on a fix. Accessing the 'Security Options data view' in the Group Policy Management Editor (gpedit[.]msc) or Local Security Policy Editor (secpol[.]msc) might fail with the error. This occurs from the MMC window when the console tree is expanded in a particular sequence. For now, users can bypass this bug by installing the Remote Administrative tools on Windows 10 v1709 or later, and remotely edit the group policy.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-group-policy-editor-bug-in-windows-server-2016/

Microsoft removed 18 Azure AD apps used by Chinese state-sponsored hacker group

Microsoft said that it removed 18 Azure Active Directory applications from its Azure portal that were created and abused by a Chinese state-sponsored hacker group named Gadolinium (aka APT40, or Leviathan). The Azure apps were part of the group's 2020 attack routine. These attacks began with spear-phishing emails aimed at the target organizations, carrying malicious documents, usually PowerPoint files with a COVID-19 theme. Victims who opened one of these documents would be infected with PowerShell-based malware payloads. On infected computers, the Gadolinium hackers used the PowerShell malware to install one of the 18 Azure AD apps. The role of these apps was to automatically configure the victim's endpoint with the permissions needed to exfiltrate data to the attacker's own Microsoft OneDrive storage. Microsoft said it also worked to take down a GitHub account that the same Gadolinium group had used as part of its 2018 attacks.

See the full report here: https://www.zdnet.com/article/microsoft-removed-18-azure-ad-apps-used-by-chinese-state-sponsored-hacker-group/

Mount Locker ransomware joins the multi-million dollar ransom game - BleepingComputer

​A new ransomware operation named Mount Locker is underway stealing victims' files before encrypting and then demanding multi-million dollar ransoms. Starting around the end of July 2020, Mount Locker began breaching corporate networks and deploying their ransomware. According to a security researcher at Malwarehunter, Mount Locker uses ChaCha20 to encrypt the files and an embedded RSA-2048 public key to encrypt the encryption key. When encrypting files, the ransomware will add an extension in the format [.]ReadManual[.]ID. The ransomware will then register the extension in the Registry so that when clicked on an encrypted file, it will automatically load the ransom note. It contains instructions on how to access the Tor site to communicate with the ransomware operators. The data leak site associated with the ransomware currently lists four victims, with only one having files leaked.

See the full report here: https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/

CISA says a hacker breached a federal agency

According to the Cybersecurity and Infrastructure Security Agency (CISA), a hacker has gained access and exfiltrated data from a federal agency. The analysis revealed that the intruder gained access to the federal agency's internal networks through different channels, such as leveraging compromised credentials for Microsoft Office 365 (O365) accounts, domain administrator accounts, and credentials for the agency's Pulse Secure VPN server. To have a quick way back into the federal agency's network, the hackers installed an SSH tunnel and reverse SOCKS proxy, custom malware, and connected a hard drive they controlled to the agency's network as a locally mounted remote share. Furthermore, the attacker also created a local account on the network and used this account to browse the local network, run PowerShell commands, and gather important files into ZIP archives. The officials have not disclosed the name of the hacked federal agency, the date of the intrusion, or any details about the intruder.

See the full report here: https://www.zdnet.com/article/cisa-says-a-hacker-breached-a-federal-agency/

The Windows XP source code was allegedly leaked online

The source code for Windows XP SP1 and other versions of the operating system was allegedly leaked online. The leaker claims to have spent the last two months compiling a collection of leaked Microsoft source code. This 43GB collection was then released as a torrent on the 4chan forum. Included in this torrent is the alleged source code for Windows XP and Windows Server 2003, as well as an assortment of even older versions of the operating system. The torrent also includes a media folder containing a bizarre collection of conspiracy theory videos about Bill Gates. In addition to the torrent, a smaller 2.9GB 7zip file containing only the source code for Windows XP and Windows Server 2003 is being distributed online as well. Microsoft has yet to confirm the leak.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/the-windows-xp-source-code-was-allegedly-leaked-online/

Instagram RCE gave hackers remote access to your device

Facebook has addressed a critical vulnerability in Instagram that could lead to remote code execution and turn the smartphone into a spying device. The vulnerability, tracked as CVE-2020-1895, was discovered by Check Point, which is a heap overflow issue that resides in Instagram’s image processing. This affects versions before 128.0.0.26.128. An attacker could trigger the vulnerability by sending a crafted malicious image to the victim, then saved to a victim’s device, could hijack smartphone cameras, microphones, contacts, GPS data, and files stored into the device. Researchers discovered that the function handling image sizes when parsing JPEG images was flawed and caused a memory overflow during the decompression process. The flaw could also allow to intercept direct messages, delete or post photos without permission, and change the account settings. Users are advised to update the app to the latest version.

See the full report here: https://securityaffairs.co/wordpress/108709/hacking/instagram-rce-flaw.html?utm_source=rss&utm_medium=rss&utm_campaign=instagram-rce-flaw

Phishing attacks are targeting your social network accounts

Scammers are targeting your social network accounts with phishing emails that pretend to be copyright violations or promises of a 'blue checkmark' next to the name. These stolen accounts are then used for disinformation campaigns, cryptocurrency scams, or sold on underground markets. MalwareHunterTeam has been tracking numerous phishing campaigns that target social network accounts. The most common social networks targeted with this scam are Twitter and Instagram and will prompt users to enter their login and password to get verified. Another widespread social network phishing campaign pretends to be a copyright violation for a user post. These phishing pages state that your Twitter or Instagram account will be suspended in 24 hours unless you log in and dispute the copyright infringement claim. Users are recommended to enable multi-factor authentication.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-attacks-are-targeting-your-social-network-accounts/

KuCoin cryptocurrency exchange hacked for $150 million

Singapore-based cryptocurrency exchange KuCoin disclosed a mega hack. In a statement posted on its website, the company confirmed that a threat actor breached its systems and emptied its hot wallets of all funds. Hot wallets are cryptocurrency management apps that are connected to the internet. Cold wallets are stored offline. Cryptocurrency exchanges like KuCoin use hot wallets as their temporary storage systems for assets that are currently being exchanged on the platform, and they are used for power conversion operations and funds transfers. The firm detected the hack after observing some large withdrawals from its hot wallets on September 26, 2020. The hacker managed to steal Bitcoin assets, ERC-20-based tokens, along with other types of tokens. KuCoin promised to reimburse users who lost funds in the hack using its cold wallets. Deposits and withdrawals have been temporarily suspended while the company's security team investigates the incident.

See the full report here: https://www.zdnet.com/article/kucoin-cryptocurrency-exchange-hacked-for-150-million/

You can bypass TikTok's MFA by logging in via a browser

A security lapse in TikTok's MFA implementation could allow a malicious threat actor to bypass MFA by logging into an account with compromised credentials via its website, rather than the mobile app. Last month, the company rolled out multi-factor authentication (MFA) for its users. Later it was discovered that this feature was only enabled for the mobile app but not its website. Attackers could exploit this flaw to upload & post a video, deface the user's account or promote scams. However, while this is technically an MFA bypass, the issue is also not as dangerous as it sounds due to the limited options available to TikTok users in the web dashboard. Even if an attacker manages to guess or phish a TikTok user to obtain their account credentials, the attacker can't change the user's password via the web dashboard to fully hijack an account. There is another bug in the TikTok mobile app that doesn't show sessions taking place in real-time from the web dashboard. TikTok has plans to release a fix to address these security issues.

See the full report here: https://www.zdnet.com/article/you-can-bypass-tiktoks-mfa-by-logging-in-via-a-browser/

Louis Vuitton fixes data leak and account takeover vulnerability - BleepingComputer

Louis Vuitton has patched a security vulnerability on its website that allowed for user account enumeration and even allowed account takeover via password resets. Louis Vuitton is a prominent luxury French fashion brand and merchandise company with over 121,000 employees. A security researcher discovered an exploitable flaw that resided within the MyLV account section of the website. Creating a MyLV account lets a Louis Vuitton shopper track online orders, access purchase history, obtain e-receipts, manage personal information, and receive company announcements. An attacker can potentially obtain email addresses of multiple Louis Vuitton's members without their knowledge or consent by simply enumerating their account ID in the URL. Additionally, they could take over the member’s account and access the user's shopping history and other sensitive data.

See the full report here: https://www.bleepingcomputer.com/news/security/louis-vuitton-fixes-data-leak-and-account-takeover-vulnerability/

Twitter is warning devs that API keys and tokens may have leaked - BleepingComputer

Twitter is emailing developers stating that their API keys, access tokens, and access token secrets may have been exposed in a browser's cache. Twitter has resolved the issue by not allowing this data to be cached in the browser. Before the fix, if a developer used a public or shared computer to view its developer app keys and tokens on developer[.]twitter[.]com, they may have been temporarily stored in the browser’s cache on that computer. Security tokens and API keys allow an app to access various permissions and data for a particular Twitter account. If an unauthorized user can access the API key or security tokens, they will also gain full access to the same permissions and data as the app. Twitter has stated there is no evidence that the developer app keys and tokens were compromised. However, it may be safer to regenerate API keys and access tokens to be safe. This can be done by going into the app on developer[.]twitter[.]com, selecting details, and then 'Keys and tokens.'

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-is-warning-devs-that-api-keys-and-tokens-may-have-leaked/

FortiGate VPN Default Config Allows MitM Attacks

According to security researchers, the default configurations of Fortinet’s FortiGate VPN appliance could open organizations to man-in-the-middle (MitM) attacks, where threat actors could intercept important data. The FortiGate SSL-VPN client only verifies that the certificate used for client authentication was issued by Fortinet or another trusted certificate authority. Therefore, an attacker can easily present a certificate issued to a different FortiGate router without raising any flags and implement a man-in-the-middle attack. A proof-of-concept (POC) was published showing how an attacker could easily re-route the traffic to a malicious server, displaying his or her certificate, and then decrypt the traffic. While the issue exists in the default configuration of the FortiGard SSL-VPN client, Fortinet does not consider the issue to be a vulnerability, because users can manually replace the certificate to secure their connections appropriately. Fortinet strongly recommends adhering to its provided installation documentation and process, paying close attention to warnings throughout that process to avoid exposing the organization to risk.

See the full report here: https://threatpost.com/fortigate-vpn-default-config-mitm-attacks/159586/

Tyler Technologies warns clients to change remote support passwords - BleepingComputer

Tyler Technologies warns its clients to change the passwords for their remote access accounts after the reporting of suspicious logins. The warning comes following the ransomware attack that Tyler Technologies suffered. Tyler Technology CIO Matt Bieri notified clients warning that they recently learned that two clients had reported suspicious logins to their systems using Tyler credentials. The company also stated that they did not find any evidence of malicious activity on client systems. However, as a precautionary measure, the company strongly recommends its clients to change all passwords for accounts used by Tyler Technologies.

See the full report here: https://www.bleepingcomputer.com/news/security/tyler-technologies-warns-clients-to-change-remote-support-passwords/

ThunderX ransomware silenced with release of a free decryptor - BleepingComputer

A cybersecurity firm has released a free decryptor for the ThunderX ransomware that allows victims to recover their files. ThunderX is a relatively new ransomware that became active towards the end of August 2020. Researchers were able to find a flaw in the ransomware's encryption so that victims can decrypt their files without paying a ransom. This decryptor can recover the files encrypted by the current version of the ThunderX ransomware that appends the .tx_locked extension to the filename of the encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/thunderx-ransomware-silenced-with-release-of-a-free-decryptor/

REvil ransomware deposits $1 million in hacker recruitment drive - BleepingComputer

The REvil Ransomware group announced today that they are once again recruiting new affiliates to distribute their ransomware. As part of this recruitment drive, REvil is looking for teams of skilled hackers at penetration testing or experienced individuals. To show potential affiliates that they mean business, REvil has deposited approximately $1 million on a Russian-speaking hacker forum. This hacker forum allows members to deposit bitcoins into a wallet hosted by the site. Members can see each other's deposits, and the deposited bitcoins can be used to privately buy and sell illicit services or data through the forum.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-deposits-1-million-in-hacker-recruitment-drive/

Google removes 17 Android apps caught engaging in WAP billing fraud

Google has removed 17 Android applications from its official Play Store. These 17 apps, spotted by security researchers from Zscaler, were infected with the Joker (aka Bread) malware. The Joker spyware is capable of stealing SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services. The malicious apps were uploaded on the Play Store this month and were downloaded more than 120,000 times before being detected. Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users must manually intervene and remove the apps from their devices.

See the full report here: https://www.zdnet.com/article/google-removes-17-android-apps-doing-wap-billing-fraud-from-the-play-store/

A powerful DDoS attack hit Hungarian banks and telecoms services

A powerful distributed denial of service (DDoS) attack hit some Hungarian banking and telecommunication services that briefly disrupted them. According to telecoms firm Magyar Telekom, the attack took place on Thursday and was launched from servers in Russia, China, and Vietnam. The DDoS attack was able to disrupt the services of some of the banks in the country causing temporary interruptions in Magyar Telekom’s services in certain parts of the capital, Budapest. The cyberattack was also confirmed by the Hungarian bank OTP Bank in a statement.

See the full report here: https://securityaffairs.co/wordpress/108788/hacking/ddos-attack-hungarian-orgs.html

Unknown FinSpy Mac and Linux versions found in Egypt

Researchers at Amnesty International have uncovered a new surveillance campaign targeting Egyptian civil society organizations with previously undisclosed versions of the infamous FinSpy surveillance spyware that allows its operators to spy on both Linux and macOS systems. FinSpy can spy on the most popular desktop and mobile operating systems, including Android, iOS, Windows, macOS, and Linux. It can allow using the victims’ devices as a spying tool and can control both webcam and microphone, to spy on communications and exfiltrate data stored on the infected systems. The new versions of FinSpy spyware were used by a new unknown hacking group, which the researchers came across while investigating the activities of another hacking group, tracked as NilePhish, which was involved in the past in attacks aimed at Egyptian NGOs. According to the researchers, NilePhish distributed samples of FinSpy for Microsoft Windows through a fake Adobe Flash Player download website.

See the full report here: https://securityaffairs.co/wordpress/108827/malware/finspy-spyware-target-egypt.html

QNAP tells NAS users to update firmware to avoid new type of ransomware

QNAP is urging its customers to update the firmware and apps installed on their network-attached storage (NAS) devices to avoid infections with a new strain of ransomware named AgeLocker, active since June this year. Last week, QNAP identified two sources of how AgeLocker gains access to QNAP devices. The first is the QNAP device firmware (known as QTS), while the second is one of the default apps that come preinstalled with recent QNAP systems (named PhotoStation). According to QNAP, no unpatched vulnerabilities were found in QTS, and all known [AgeLocker-]affected NAS are running older, unpatched QTS versions. The QNAP Product Security Incident Response Team (PSIRT) has found evidence that the ransomware may attack earlier versions of Photo Station. Hence, the company is now recommending and providing instructions on how users can update both QTS and the PhotoStation app. QNAP also urges users to periodically check and install product software updates to keep their devices protected from malicious attacks.

See the full report here: https://www.zdnet.com/article/qnap-tells-nas-users-to-update-firmware-to-avoid-new-type-of-ransomware/

Universal Health Services Ransomware Attack Impacts Hospitals Nationwide

Universal Health Services has suffered a ransomware attack, impacting many UHS locations that were shut down to contain the spread of the malware and required to return to manual processes. UHS stated that "The IT Network across Universal Health Services (UHS) facilities is currently offline, due to an IT security issue. We implement extensive IT security protocols and are working diligently with our IT security partners to restore IT operations as quickly as possible. In the meantime, our facilities are using their established back-up processes including offline documentation methods. Patient care continues to be delivered safely and effectively.” UHS claims that no patient or employee data appears to have been accessed, copied or compromised. According to BleepingComputer, an employee has stated that the encrypted files were appended with the .RYK extension and ransom note that showed up on all affected computers referenced the phrase “Shadow of the Universe,” which is known to be included in Ryuk ransom notes. However, UHS is yet to confirm the nature of the ransomware.

See the full report here: https://threatpost.com/universal-health-ransomware-hospitals-nationwide/159604/

FBI warns of disinformation campaigns about hacked voter systems - BleepingComputer

The Federal Bureau of Investigation (FBI) and the US Cybersecurity and Infrastructure Security Agency (CISA) has warned about the threat of disinformation campaigns targeting the 2020 US election season, stating that, the threat actors are actively spreading false information about successfully compromised voting systems and voter registration databases to manipulate public opinion, sow discord, discredit the electoral process, and to weaken the public's trust in US institutions. Along with the many recommendations listed by the FBI and CISA regarding the 2020 US election disinformation, people are urged to report potential election crimes, such as disinformation about the manner, time, or place of voting.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-disinformation-campaigns-about-hacked-voter-systems/

Windows 7 ‘Upgrade’ Emails Steal Outlook Credentials

In an ongoing phishing campaign, attackers are using Windows 7 Upgrade lures to redirect victims to a fake Outlook login page that steals their credentials. The phishing emails are entitled “Re: Microsoft Windows Upgrade,” which may make users believe they have missed a prior communication about the upgrade. The email tells recipients, “Your Office Windows computer is Outdated, and an Upgrade is scheduled for replacement Today,” and includes a schedule (of note, some strange capitalization and spacing is utilized, serving as red flags that the email is not legitimate). It further directs users “To Upgrade your Windows 10, please open your browser to the Windows 10 Upgrade Project Site,” pointing to a URL. If recipients click on the URL in the email, they are taken to the phishing landing page, which appears to be an Outlook Web App (OWA) login page asking for their email address, domain/username, and password.

See the full report here: https://threatpost.com/windows-7-outlook/159621/

All four of the world's largest shipping companies have now been hit by cyber-attacks

The world's four biggest Maritime shipping companies CMA CGM, APM-Maersk, Mediterranean Shipping Company, and COSCO, have been hit by cyber-attacks in the past four years since 2017. Over the past year, the incidents where malware landed on the ship's network have intensified. This included sightings of ransomware, USB malware, and worms spotted aboard a ship's IT systems. Maritime industry groups have responded to these increasing reports of malware aboard ships by publishing two sets of IT security guidelines to address Maritime security aboard ocean-bound vessels. But despite all the efforts, the Maritime industry has failed to protect its shore-based systems.

See the full report here: https://www.zdnet.com/article/all-four-of-the-worlds-largest-shipping-companies-have-now-been-hit-by-cyber-attacks/

UHS hospitals hit by reported country-wide Ryuk ransomware attack

Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider, confirmed that it was the victim of a security incident. The systems at healthcare facilities around the US are shut down after a cyber-attack that hit its network during early Sunday morning. According to UHS' employees, during the attack, multiple antivirus programs were disabled, hard drives began to lit-up with activity, and computers logged out and shut down. Security researchers suspect that both the Emotet and TrickBot are behind this attack. UHS says no patient or employee data was impacted in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/

Microsoft Office 365 is down in the USA, shows 'transient' error

Office 365 is currently suffering an outage in the United States and Australia that does not allow users to log in to their accounts. When attempting to login to their accounts, users are shown an error stating "AADSTS90033: A transient error has occurred. Please try again" or other error messages. This outage prevents users from logging into their email and accessing Microsoft Teams, Office.com, Power Platform, and Dynamics365. Microsoft has started to reroute traffic through different servers and some users have reported being able to log in again. Microsoft is working on mitigation.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-is-down-in-the-usa-shows-transient-error/

These hackers have spent months hiding out in company networks undetected - ZDNet

Security researchers from Symantec have uncovered the attacks against organizations in the US, Japan, Taiwan, and China, conducted to steal information and have been linked to an espionage group known as Palmerworm(BlackTech), which has a history of campaigns going back to 2013. In some cases, Palmerworm maintained a presence on compromised networks for a year or more. Researchers were not able to determine how hackers gain access to the network in this latest round of Palmerworm attacks. In the case of previous campaigns, they have deployed spear-phishing emails to compromise victims. Palmerworm's malware also uses stolen code-signing certificates in the payloads to make them look more legitimate and more difficult for security software to detect. The trojan malware provides attackers with a secret backdoor into the network, and that access is maintained with the use of several legitimate tools including, PSExec and SNScan that are exploited to move around the network undetected. Meanwhile, WinRar is used to compress files, making them easier for the attackers to extract from the network.

See the full report here: https://www.zdnet.com/article/these-hackers-have-spent-months-hiding-out-in-company-networks-undetected/

Fake software crack sites used to push Exorcist 2.0 Ransomware

The threat actors behind the Exorcist 2.0 ransomware are using malicious advertising to redirect victims to fake software crack sites that distribute their malware. According to security researcher Nao_Sec, PopCash malvertising is redirecting users from legitimate sites to a fake software crack site. This crack site pretends to offer download links for the programs that break copyright protection on commercial software so that it can be used for free. When user downloads, it is capable of bypassing detections by Google Safe Browsing, Microsoft SmartScreen, or installed security software. Once the file is executed, data is encrypted, including ransom notes that contain unique links to a Tor payment site where a victim can get information on how to pay a ransom. When visiting the Excorcist Tor payment site, victims can get free decryption of one file, a way to chat with the threat actors, and the ransom amount that they need to pay. Users are recommended to use trusted sources.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-software-crack-sites-used-to-push-exorcist-20-ransomware/

Microsoft clarifies patch confusion for Windows Zerologon flaw

Microsoft clarified the steps customers should take to make sure that their devices are protected against ongoing attacks using Windows Server Zerologon (CVE-2020-1472) exploits. This critical security flaw, when exploited, enables attackers to elevate privileges to a domain administrator. The company revised the advisory after customers found Microsoft's original guidance confusing and were unsure if applying the patch was enough to protect vulnerable Windows Server devices from attacks. In a step-by-step approach, the updated KB article now explains the exact actions that Windows administrators need to follow when applying The Netlogon Elevation of Privilege Vulnerability' security update issued as part of the August 2020 Patch Tuesday. Microsoft warned admins to apply security updates on priority, after discovering threat actors actively using CVE-2020-1472 exploits during attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-clarifies-patch-confusion-for-windows-zerologon-flaw/

Ransomware hits US-based Arthur J. Gallagher insurance giant - BleepingComputer

US-based insurance brokerage firm Arthur J. Gallagher & Co has confirmed that it was the target of a ransomware attack on September 26, 2020. AJG is one of the largest insurance brokers in the world, with more than 33,300 employees and operations in 49 countries. The company is ranked 429 on the Fortune 500 list and it provides insurance services to customers in over 150 countries. Initial investigation revealed that the incident appears to have impacted only a limited portion of its systems. At this point, AFG does not expect it to have a material impact on its operations or financial condition and has restarted most of its business systems.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-hits-us-based-arthur-j-gallagher-insurance-giant/

Over 247K Exchange servers unpatched for actively exploited flaw - BleepingComputer

More than 247,000 Microsoft Exchange servers are to be patched against the CVE-2020-0688 post-auth remote code execution (RCE) vulnerability impacting all Exchange Server versions under support. The CVE-2020-0688 RCE flaw exists in the Exchange Control Panel (ECP) component that enables potential attackers to remotely take over vulnerable Exchange servers using any valid email credentials. Microsoft addressed the security issue as part of the February 2020 Patch Tuesday and tagged it with an 'Exploitation More Likely' exploitability index assessment, suggesting that the vulnerability is an attractive target for attackers. Proof-of-concept exploits are available to take advantage of unpatched servers. Approximately, 16,577 Exchange 2007 servers have an unsupported Exchange version that did not receive security updates to protect against CVE-2020-0688 attacks. It is advised to patch vulnerable Microsoft Exchange Server versions immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/over-247k-exchange-servers-unpatched-for-actively-exploited-flaw/

Swiss watchmaker Swatch shuts down IT systems to stop cyberattack - BleepingComputer

Swiss watchmaker Swatch Group shut down its IT systems over the weekend after identifying a cyberattack targeting its organization. The company immediately assessed and analyzed the nature of the attack, took appropriate measures, and implemented the necessary corrections. The company has not disclosed the type and source of attack, but it was likely a ransomware attack. Swatch group is likely to resume its operations and return to normal as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/swiss-watchmaker-swatch-shuts-down-it-systems-to-stop-cyberattack/

Cisco fixes actively exploited bugs in carrier-grade routers - BleepingComputer

Cisco warned its customers on August 29, 2020, of ongoing attacks targeting carrier-grade routers running vulnerable Cisco IOS XR software versions after the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of two high severity memory exhaustion DoS vulnerabilities in the wild on August 28, 2020. The two denial-of-service (DoS) security flaws, tracked as CVE-2020-3566 and CVE-2020-3569, exist in the Distance Vector Multicast Routing Protocol (DVMRP) feature of the IOS XR software. Cisco has fixed these two actively exploited vulnerabilities and urges the users to apply the patches to protect from future attacks. For vulnerable devices where admins cannot immediately apply the security fixes, Cisco recommends implementing "an access control entry (ACE) to an existing interface access control list (ACL)" or a new ACL to deny inbound DVRMP traffic to interfaces with multicast routing enabled. Admins are also advised to disable IGMP routing on interfaces where processing IGMP traffic is not necessary.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-actively-exploited-bugs-in-carrier-grade-routers/

Las Vegas Students’ Personal Data Leaked, Post-Ransomware Attack

Personal information for students in the Clark County School District, which includes Las Vegas, has reportedly turned up on an underground forum, following a Maze ransomware attack. In retaliation for CCSD not paying the ransom of an undisclosed amount, the attackers have reportedly released a non-sensitive file to show that they had data access. According to a security researcher, nearly 25GB of sensitive information, including employee Social Security numbers, addresses, and retirement paperwork, and student data such as names, grades, birth dates, addresses, and the school attended, was leaked by the attackers. The hackers also announced that the data reveal represents all of the information that it stole from CCSD’s network. CCSD is currently investigating to determine the full nature and scope of the incident and is yet to notify affected individuals.

See the full report here: https://threatpost.com/las-vegas-students-data-leaked-ransomware/159645/

OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks

An APT known as TA2552 has been spotted using OAuth2 or other token-based authorization methods to access Office 365 accounts, to steal users’ contacts and mail. OAuth is an open standard for access delegation, used as a way for people to sign in to services without entering a password using signed-in status on another, trusted service, or website. The targets receive well-crafted lures asking them to click a link that directs them to the legitimate Microsoft third-party apps consent page and prompts them to grant permissions to the actor’s application. If the browser is not already authenticated to Office 365, the user is sent to the official Office 365 login page to sign in, and then are asked to grant permissions again. The malicious apps ask to grant read-only access to the user’s contacts, profile, and mail – all of which could be used to snoop around accounts, steal data, or even intercept password reset messages from other accounts, like online banking. If consent is granted, the third-party application will be allowed to access the currently authenticated Office 365 account and if denied, the browser is still redirected to an attacker-controlled page, allowing the actor to try again with a different tactic.

See the full report here: https://threatpost.com/oauth-phishing-microsoft-o365-attacks/159713/

Android Spyware Variant Snoops on WhatsApp, Telegram Messages

Researchers have uncovered a new Android spyware variant with an updated command-and-control communication strategy and extended surveillance capabilities that snoop on social media apps WhatsApp and Telegram. The malware, Android/SpyC32.A, is a new variant of an existing malware operated by threat group APT-C-23 also known as Two-Tailed Scorpion and Desert Scorpion and is currently being used in active campaigns targeting victims in the Middle East. The malware samples were disguised as a legitimate messaging app offered through Google Play. The app, WeMessage does not have any real functionality and only served as bait for installing the spyware. The spyware can record victims’ screens and take screenshots, record incoming and outgoing calls in WhatsApp and read the text of notifications from social media apps, including WhatsApp, Facebook, Skype, and Messenger. The malware also leverages a tactic where it creates a blank screen overlay to put on the Android screen while it makes calls to hide its call activity. The C2 is well hidden using various techniques and can be remotely changed by the attacker, making detection much more difficult.

See the full report here: https://threatpost.com/new-android-spyware-whatsapp-telegram/159694/

Linkury adware caught distributing full-blown malware

An adware family known primarily for distributing browser hijackers has been caught distributing a full-blown malware named Linkury. The most highlighting feature about Linkury is that it uses its adware front as a gateway to propagate malware. According to K7 Computing researchers, it walks a very fine line between typical adware and malware, and can switch sides based on geolocale. Linkury was primarily known as an adware operation. Its main method of distribution is the SafeFinder widget, a browser extension ironically advertised as a way to perform safe searches on the internet. After installation, the SafeFinder extension changes a user's default browser search and home tab settings and additionally installs binaries, different based on the user's country. The recent cases reveal that the SafeFinder widget has now also begun installing full-blown legitimate malware, such as the Socelars and Kpot infostealer trojans. The widget contained many features specific to malware, such as PowerShell scripts to disable Windows Defender, and functions to detect when the installer was executed inside virtual machines and sandboxes, environments usually used for malware analysis.

See the full report here: https://www.zdnet.com/article/linkury-adware-caught-distributing-full-blown-malware/

$15 million business email scam campaign in the US exposed

The FBI is investigating a global business email compromise (BEC) campaign that has netted cybercriminals at least $15 million in illicit proceeds. BEC scams focus on targeting businesses and organizations through email fraud, often with financial gain in mind. According to the cybersecurity researchers at Mitiga, the ongoing campaign uses social engineering techniques to impersonate senior executives using Microsoft Office 365 email services. When conversations were intercepted via compromised accounts, the attackers used a forwarding rule to bounce all communication back to another attacker-controlled account. This provided the threat actor with full visibility of the transaction and allowed for the introduction of the fake domain. Approximately, 150 organizations, ranging from law, construction, finance, and retail, have been identified as victims worldwide. The majority of those tracked so far are in the United States.

See the full report here: https://www.zdnet.com/article/15-million-business-email-scam-exposed-in-the-us/

This worm phishing campaign is a game-changer in password theft, account takeovers

A security researcher outlined a phishing attack taking place against an organization that used a crafty method to bounce between victims. The response team of an organization received an alert when a user fell prey to a phishing attack. By the time the team had conducted an initial damage assessment and two accounts had been recovered, they faced a huge wave of account takeovers. All of the accounts were being accessed from strange locations all over the globe and sending out a large number of emails. The sign-in timestamps revealed that phishing emails were being sent as replies to genuine emails. Once an email account was compromised, the credentials for the account were sent to a remote bot. The bot would then sign into the account and analyze emails sent within the past several days. For each unique email chain it found, it replied to the most recent email with a link to a phishing page to capture credentials. This resulted in worm-like mass takeovers within a few hours. The team was able to clamp down on it by finding a pattern in the URL of the phishing pages and adding it to the quarantine rule. The goal for this attacker was probably to harvest credentials to sell on the dark web, which they achieved successfully.

See the full report here: https://www.zdnet.com/article/this-worm-phishing-campaign-is-a-game-changer-in-password-theft-account-takeovers/

Microsoft pulls SQL Server 2019 update due to snapshot issues

Microsoft pulled the Cumulative Update package 7 (CU7) for SQL Server 2019 released on September 2 after confirming a known reliability issue impacting customers who used the database snapshot feature. The database snapshot feature impacted by this issue is used implicitly when running DBCC CHECKDB and its subset commands, except when used with the TABLOCK option. Microsoft confirms that the issue does not result in a memory dump or an SQL service crash when generating snapshots. KB4570012 was removed from the Microsoft Download Center, the Microsoft Update Catalog, and Linux repositories, with the download links now directing users to KB4563110, the previous cumulative update, released on August 26. Microsoft is planning to include a fix for this known issue in the SQL Server 2019 CU8 scheduled to be released next month and advice users not to install the CU7 package file if downloaded before Sep-23 2020.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-pulls-sql-server-2019-update-due-to-snapshot-issues/

Windows XP and Server 2003 compiled from leaked source code

The source code for Microsoft’s Windows XP and Windows Server 2003 operating systems was published as a torrent file on the bulletin board website 4chan. A Windows developer that goes online with the moniker ‘NTDEV‘ announced to have successfully compiled both Windows XP and Windows Server 2003 using the leaked source code. NTDEV also published a video to show how to compile both Windows operating systems, explained that the source code for Windows XP doesn’t contain critical files, including the Winlogon.exe. The developer has no problem while compiling the source code for Windows server 2003. NTDEV provided multiple updates on its attempts and successes through its Twitter account. The availability of the source code of the Windows XP could allow threat actors to search for zero-day issues that could be exploited in attacks against the tens of millions of PCs are still based on the popular Microsoft OS.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-xp-and-server-2003-compiled-from-leaked-source-code/