Threat Intelligence Bulletin: 10/02/2020 - 10/08/2020

Breach Disclosure: Chowbus

The Asian food delivery service, Chowbus, experienced a data breach sometime before October 5, 2020. On October 5th, the hackers sent all customers an email containing two CSV files containing user and restaurant data. The exposed data included names, phone numbers, commission rates, and addresses for 4,300 restaurants that partner with Chowbus, along with email addresses, names, phone numbers, and addresses of 803,350 Chowbus users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Sometime before the hackers sent out the email containing the restaurant and customer data on October 5th, hackers were able to compromise Chowbus and download both the user and restaurant data from their systems. The hackers then sent an email out from Chowbus email accounts (Analyst Note: it is unknown if this email was sent from a legitimate Chowbus account or spoofed since we do not have an original copy of the email sent to victims) to all customers with links to the restaurant and user data.

Figure 1: Email sent from hackers to Chowbus customers

Below are screenshots for samples of data uploaded by a user on Reddit who had identified the hack before news outlets picked the breach up.

Figure 2: Sample of restaurant data

Figure 3: Sample of Chowbus user data

Luckily for users of the service, no financial information was contained in the user database as all payments and processing are handled by Stripe. In a message from the CEO of Chowbus, they acknowledged the breach and stated that they immediately started to work to resolve the issues, however, no statement as to how the breach happened.

Breach Disclosure: WiziShop

The French e-commerce platform WiziShop experienced a data breach on July 14th 2020, which exposed 18GB of data including names, phone numbers, birthdates, physical and IP Addresses, and SHA-1 password hashes. WiziShop acknowledged this breach on Twitter and stated they communicated this breach with their clients and reported through the appropriate means.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

While this breach impacted around 3 million unique email addresses, there is very little information out there about this breach at this time. The ZeroFOX Alpha Team has researched various forums and marketplaces for actors selling this data, however, there has been no mention of this breach being for sale on many of the popular hacking forums.

Breaking News: 2020-10-02 - 2020-10-08

Ransomware gangs add DDoS attacks to their extortion arsenal - BleepingComputer

A ransomware operation has started to utilize a new tactic to extort their victims. The hackers DDoS a victim's website until they return to the negotiation table. In a recent ransomware attack, after the negotiations were stalled, a SunCrypt ransomware affiliate DDoSed a victim's website. When the victim logged back into the ransomware's Tor payment site, they were greeted by a message stating that SunCrypt was responsible for the DDoS and will continue the attack if negotiations do not continue. After the victim began ransom negotiations again, the ransomware operator agreed to stop the DDoS attack. This tactic ultimately led to the victim paying the ransom. This tactic was particularly effective for a smaller organisation as it could have their operation completely shut down.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gangs-add-ddos-attacks-to-their-extortion-arsenal/

Hackers leak files stolen in Pakistan's K-Electric ransomware attack - BleepingComputer

The Netwalker ransomware operators have published the stolen data for K-Electric, Pakistan's largest private power company after a ransom was not paid. On September 7th, 2020, K-Electric suffered a Netwalker ransomware attack that disrupted online billing services, but not the supply of power. Netwalker has released an 8.5 GB archive of files allegedly stolen from K-Electric during the September ransomware attack. According to the researchers of the cybersecurity firm Rewterz, the published contents include sensitive information like financial data, customer information, engineering reports, maintenance logs, and more. The company has denied that any data was stolen from the company.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-files-stolen-in-pakistans-k-electric-ransomware-attack/

IPStorm botnet expands from Windows to Android, Mac, and Linux

IPStorm, a malware botnet that was first spotted last year targeting Windows systems, has evolved to infect other types of platforms, such as Android, Linux, and Mac devices. According to Bitdefender and Barracuda security firms, the new version of IPStorm targets and infects Android systems by scanning the internet for devices that had left their ADB (Android Debug Bridge) port exposed online. On the other hand, Linux and Mac devices are infected after the IPStorm gang performs dictionary attacks against SSH services to guess their username and passwords. After IPStorm gains an initial foothold on these systems, the malware usually checks for the presence of honeypot software, gains boot persistence on the device then kills a list of processes that may pose a threat to its operations. Security researchers say that IPStorm drops a reverse shell on all infected devices but then leaves these systems alone. However, they have not seen the IPStorm operators doing anything nefarious, such as installing crypto-mining apps, performing DDoS attacks, relaying malicious traffic as part of a proxy network, or sell access to infected systems.

See the full report here: https://www.zdnet.com/article/ipstorm-botnet-expands-from-windows-to-android-mac-and-linux/

NVIDIA fixes high severity flaws in Windows display driver - BleepingComputer

NVIDIA has released security updates to address high severity vulnerabilities in the Windows GPU display driver that could lead to code execution, escalation of privileges, information disclosure, and denial of service. The bugs in GPU display driver require local user access which means that attackers will need to first get a foothold on the systems to exploit these vulnerabilities. Once achieved, they could exploit them by remotely planting malicious tools or running code designed to target one of the fixed issues on devices running unpatched NVIDIA GPU drivers. The security updates also fix high severity flaws in the NVIDIA Virtual GPU Manager which may lead to denial of service, code execution, and information disclosure when successfully exploited. NVIDIA urges customers to update their GeForce, Quadro, NVS, and Tesla GPU display drivers, as well as Virtual GPU Manager and guest driver software to eliminate these vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-fixes-high-severity-flaws-in-windows-display-driver/

Critical Flaws Discovered in Popular Industrial Remote Access Systems

Cybersecurity researchers have found critical security flaws in two popular industrial remote access systems that can be exploited to ban access to industrial production floors, hack into company networks, tamper with data, and even steal sensitive business secrets. The flaws were identified in B&R Automation's SiteManager and GateManager, and MB Connect Line's mbCONNECT24, two of the popular remote maintenance tools used in automotive, energy, oil & gas, metal, and packaging sectors to connect to industrial assets from anywhere across the world. By exploiting six vulnerabilities - CVE-2020-11641 through CVE-2020-11646, an authenticated attacker with access to the solution via a general license could view sensitive information about other users, their assets, and their processes, even when they belong to a different organization from that of the adversary. Additionally, hackers can fool users into malicious foreign sites through fake system messages and alerts. The attacker can also trigger a repeated restart of both the GateManager and the SiteManager, leading eventually to a loss of availability and halt production. Users are recommended to upgrade to the latest version.

See the full report here: https://thehackernews.com/2020/10/industrial-remote-access.html

Spammers Smuggle LokiBot Via URL Obfuscation Tactic

Security researchers have discovered a campaign wherein spammers use tricky URL obfuscation techniques that sidestep detection and ultimately infect victims with the LokiBot trojan. The tactic was uncovered in recent spear-phishing emails with PowerPoint attachments containing a malicious macro. When opened, the document attempts to access a URL via a Windows binary (mshta.exe). The first URL, accessed by the PowerPoint attachment, redirects to an obfuscated VBScript hosted on Pastebin. A second URL contains VBScript, which is a dropper that writes a PowerShell downloader into the registry and sets up persistence. This PowerShell then downloads and processes the raw data on two more Pastebin URLs, and then executes the output binaries. The content at the third URL meanwhile contains an obfuscated PowerShell code, which then executes two DotNet compiled Dynamic Link Libraries (DLLs). These DLLs bypass the Windows Anti-Malware Scan Interface (AMSI) on the machine and loads a DLL injector into the memory. Finally, the last URL contains an obfuscated malware LokiBot sample, which is injected into a legitimate process (notedpad[.]exe) by the aforementioned DLL injector.The new tactic comes just a week after The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that LokiBot is seeing a surge across the enterprise landscape.

See the full report here: https://threatpost.com/lokibot-url-obfuscation/159729/

Microsoft explains the cause of the recent Office 365 outage - BleepingComputer

A preliminary report by Microsoft states that a bug in the deployment of an Azure AD service update caused Monday's Office 365 outage. From September 28 2020, users worldwide were unable to login to Office 365 and other related services, including Microsoft Teams, Office.com, Power Platform, and Dynamics365. According to a preliminary post-incident report from Microsoft, a service update for Azure AD mistakenly hit the production environment and caused service availability to degrade. After learning of the issues, Microsoft tried to perform an automated rollback of the change, but a bug in their Safe Deployment Process (SDP) corrupted metadata and required a much longer manual rollback. A final report from Microsoft should become available by the end-of-day on October 3rd.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-explains-the-cause-of-the-recent-office-365-outage/

Researchers track hacking ‘fingerprints,’ link Russian attackers to Windows exploit sellers

Researchers have developed a new technique to "fingerprint" cybercriminals, including two prolific sellers of Windows exploits. According to Check Point researchers, the fingerprinting technique has been used to link Windows local privilege escalation (LPE) exploits to two different authors who are believed to have sold their creations previously to Russian advanced persistent threat (APT) groups as well as other clients. After analyzing the file, the team found unusual debug strings that pointed to an attempt to exploit a vulnerability on one of the target machines. The researchers used unique identifiers to "fingerprint" specific exploit developers by securing another 32-bit file which showed compilation at the same time, indicating the handiwork of the same individual. This research methodology can be adopted as an additional tool to identify exploit writers.

See the full report here: https://www.zdnet.com/article/researchers-track-hacking-fingerprints-link-russian-group-to-windows-exploits/

HP Device Manager backdoor lets attackers take over Windows systems - BleepingComputer

HP released a security advisory detailing three critical and high severity vulnerabilities in the HP Device Manager that could lead to system takeover. HP Device Manager is used by admins to remotely manage HP thin clients, devices that use resources from a central server for various tasks. The three HP Device Manager security vulnerabilities are tracked as CVE-2020-6925, CVE-2020-6926, and CVE-2020-6927. When chained together, the security flaws could allow attackers to remotely gain SYSTEM privileges on targeted devices running vulnerable versions of HP Device Manager that would allow for full system takeover. Customers can download HP Device Manager 5.0.4 to secure their systems against potential attacks that could exploit the CVE-2020-6927 elevation of privilege weakness. HP is yet to publish security updates to address the CVE-2020-6925 and CVE-2020-6926 security issues affecting the HP thin client management software. However, the company provides customers with remediation steps that should at least partially mitigate the security risks.

See the full report here: https://www.bleepingcomputer.com/news/security/hp-device-manager-backdoor-lets-attackers-take-over-windows-systems/

ESET discovers a rare APT that stayed undetected for nine years

ESET researchers have discovered a new state-sponsored hacking group (also known as an APT), named XDSpy that has managed to remain undetected for nearly nine years before its hacking spree was discovered earlier this year. The group's primary focus has been reconnaissance and document theft and has been targeting government agencies and private companies in Eastern Europe and the Balkans. The group used spear-phishing email campaigns with lures related to lost and found objects and the COVID-19 pandemic. These contain malicious email attachments as Powerpoint, JavaScript, ZIP, or shortcut (LNK) files. Upon downloading and running any of these files a malware named, XDDown, is dropped that acts as a "downloader" to infect a victim and then download secondary modules that would perform various specialized tasks. The targeted countries are usually in the focus area of both Russian and NATO countries.

See the full report here: https://www.zdnet.com/article/eset-discovers-a-rare-apt-that-stayed-undetected-for-nine-years/

A security flaw in Grindr let anyone easily hijack user accounts

Grindr, one of the world’s largest dating and social networking apps for gay, bi, trans, and queer people, has fixed a security vulnerability that allowed anyone to hijack and take control of any user’s account using only their email address. To reset a password, Grindr sends the user an email with a clickable link containing an account password reset token. Once clicked, the user can change their password. However, it was found that secret tokens used to reset Grindr account passwords, which are only supposed to be sent to a user’s inbox, were leaking to the browser. The clickable link that Grindr generates for a password reset is formatted the same way, meaning a malicious user could easily craft their clickable password reset link. This could lead to access to users' account and the personal data stored within, including account photos, messages, sexual orientation and HIV status and last test date. A French security researcher discovered this vulnerability and reported it to Grindr, following which the company addressed the flaw.

See the full report here: https://techcrunch.com/?p=2055534

Google now discloses Android vulnerabilities for 3rd-party devices - BleepingComputer

Google announced the launch of a new program named Android Partner Vulnerability Initiative (APVI) specifically designed to deal with security vulnerabilities the company finds in third-party Android devices and software serviced by Android OEMs. Issues affecting the Android Open Source Project (AOSP) impact all Android devices and are disclosed through ASR reports released via Android Security Bulletins (ASB) each month. However, vulnerabilities Google discovers outside of the Android Open Source Project (AOSP) based code that only affect a small subset of Android OEM devices were not previously disclosed via a public program. The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks, and generation of unencrypted backups.

See the full report here: https://www.bleepingcomputer.com/news/security/google-now-discloses-android-vulnerabilities-for-3rd-party-devices/

Egregor Ransomware Threatens ‘Mass-Media’ Release of Corporate Data

A freshly discovered family of ransomware called Egregor has been spotted in the wild, using a tactic of siphoning off corporate information and threatening a mass media release of it before encrypting all files. According to an analysis from Appgate, the code seems to be a spinoff of the Sekhmet ransomware. However, Egregor implements a high number of anti-analysis techniques, such as code obfuscation and payload encryption. The Egregor operators threaten to distribute stolen via “mass media,” so that a victim company’s partners and clients will know that the company was attacked. The ransomware group has a a website, hosted on the deep web, which is used to leak stolen data. Currently, there are at least 13 different companies listed in their "hall of shame." The Egregor ransom note also says that aside from decrypting all the files in the event the company pays the ransom, the operators will provide recommendations for securing the company’s network, “helping” them to avoid being breached again.

See the full report here: https://threatpost.com/egregor-ransomware-mass-media-corporate-data/159816/

US govt warns of sanction risks for facilitating ransomware payments - BleepingComputer

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has warned organizations that assist ransomware victims in ransom payments would face sanctions risks as their actions could violate OFAC regulations. OFAC has also issued contact information to be used when dealing with threat actors asking for ransomware payments who might be sanctioned or have a sanctions nexus. As companies prefer to avoid legal issues and negative publicity, many ransomware attacks go unreported to law enforcement. Hence, OFAC reassures companies that get hit by a ransomware attack to disclose the incident to law enforcement and to collaborate during the investigation as it would be considered when evaluating future sanction risks they may face after a ransomware payment. By reducing the potential risks of sanctions violations if reported to law enforcement, OFAC's guidance could allow an increase of disclosures to the FBI.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-of-sanction-risks-for-facilitating-ransomware-payments/

Online avatar service Gravatar allows mass collection of user info - BleepingComputer

Gravatar, an online avatar service that lets users set and use a profile picture (avatar) across multiple websites that support Gravatar, could be abused for mass data collection of its profiles by web crawlers and bots. Italian security researcher Carlo Di Dato discovered a user enumeration technique, using which he was able to demonstrate and retrieve user data querying Gravatar in a way that should not be possible. Using the enumeration technique, a malicious user could download a huge amount of data and perform any kind of social engineering attack against legit users. Users who create public profiles on Gravatar consent to making this data publicly available. However, an issue like this can be dangerous because any web crawler or bot can sequentially query virtually the entire Gravatar database, and harvest public user data very easily.

See the full report here: https://www.bleepingcomputer.com/news/security/online-avatar-service-gravatar-allows-mass-collection-of-user-info/

H&M fined £32 million for intrusive employee surveillance

A German data regulator has fined fashion giant H&M with approximately €35 million for violating the privacy of its employees by exploiting their personal data. H&M employees working at a Nuremberg-based operations center were subject to the extensive recording of details about their private lives since 2014, actions that have been found in breach of GDPR. The regulator became aware of this practice in October 2019 after a configuration error made the 60GB dataset available to the entire company. The organization ordered the contents of the network drive to be frozen, and for the data to be handed over in full for evaluation. The managers of H&M explain that the data collection was done to improve the way staff profiles were constructed and to help with measures and decisions regarding their employment. However, the Hamburg commissioner for data protection and freedom of information stated that this case documents a serious disregard for employee data protection at the H&M site in Nuremberg.

See the full report here: https://www.itpro.co.uk/policy-legislation/general-data-protection-regulation-gdpr/357315/hm-fined-ps32-million

Two North American hospitality merchants hacked in May and June

In a security alert published on Thursday, US payments processor Visa revealed that two North American hospitality merchants were hacked and had their system infected with point-of-sale (POS) malware earlier this year. POS malware is specially designed for point-of-sale (POS) terminals and systems to steal payment card data. In May and June 2020, Visa Payment Fraud Disruption (PFD) analyzed malware samples recovered from the independent compromises of two North American merchants. The first attack infected the systems with a malware variant TinyPOS, and the second to a mix of POS malware families, including RtPOS, MMon (aka Kaptoxa), and PwnPOS. Visa said that the recent attacks exemplify threat actors continued interest in targeting merchant POS systems to harvest card-present payment account data.

See the full report here: https://www.zdnet.com/article/two-north-american-hospitality-merchants-hacked-in-may-and-june/

Microsoft fixes Windows 10 Internet connection issues in new update - BleepingComputer

Around July this year, Windows 10 users were reportedly receiving a No Internet message in the Network Connectivity Status Indicator (NCSI), even though their Internet worked fine. Also, a few users were facing an issue with some WWAN LTE modems that might show no internet connection in the notification area after waking from sleep or hibernation. Microsoft has released an optional update that fixes these two bugs that prevented Windows 10 2003 users from connecting to the Internet. If users choose not to install the optional update, these fixes will be available in the mandatory cumulative updates released as a part of the October 2020 Patch Tuesday updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-10-internet-connection-issues-in-new-update/

PUBG Mobile hit by waves of DDoS attacks, players complain of sudden disconnection - Moneycontrol

PUBG Mobile is suffering a swarm of DDoS (Distributed Denial of Service) attacks that are causing active players to disconnect from the game globally. The attackers used a new hacking trick, known as server freeze, wherein several players freeze at their respective in-game positions, unable to interact with the game. The developers posted a tweet highlighting that they are working on the resolution to DDoS attacks. A detailed statement by the developers appeared on Facebook, asserting that the PUBG Mobile team is working closely with local service providers to bring back the smooth gaming experience. Additionally, the team is preparing to roll-out a new anti-cheat patch to stop hackers and cheaters from spoiling the game.

See the full report here: https://www.moneycontrol.com/news/technology/pubg-mobile-hit-by-waves-of-ddos-attacks-players-complain-of-sudden-disconnection-5919561.html

Emotet Emails Strike Thousands of DNC Volunteers - Threatpost

In a new Emotet spear-phishing campaign, attackers are targeting U.S. organizations with thousands of emails purporting to be from the Democratic National Committee and recruiting potential Democratic volunteers. The phishing email had the subject line “Team Blue Take Action,” with a message body fetched directly from a page on the Democratic National Committee’s (DNC) website. This message body describes Team Blue, which is the DNC’s 2018 volunteer recruitment program, and announces the relaunching of Team Blue for the 2020 campaign. The email then asks the recipient to open the attached document containing macros, which, if enabled, will download and install Emotet. According to the researchers, there is a second stage payload following Emotet infections within this campaign, which either comes in the form of the Qbot trojan or The Trick.

See the full report here: https://threatpost.com/emotet-email-dnc-volunteers/159758/

New ransomware vaccine kills programs wiping Windows shadow volumes

A security researcher Florian Roth released the 'Raccine' ransomware vaccine that will monitor for the deletion of shadow volume copies using the vssadmin.exe command. Windows will create backups of your system and data files and store them in Shadow Volume Copy snapshots. These snapshots can then be used to recover files if they are mistakenly changed or deleted. As ransomware infections do not want victims to use this feature to recover files for free, one of the first things they do when executed is to delete all Shadow Volume copies on the computer. Raccine works by registering the raccine.exe executable as a debugger for vssadmin.exe using the Image File Execution Options Windows registry key. Once raccine.exe is registered as a debugger, every time vssadmin.exe is executed, it will also launch Raccine, which will check to see if vssadmin is trying to delete shadow copies. If it detects a process is using 'vssadmin delete,' it will automatically terminate the process. While this method will prevent encryption by a large amount of ransomware, currently, Raccine will not block the ransomware which does not use vssadmin.exe. It should also be noted that Raccine may terminate legitimate software that uses vssadmin.exe as part of their backup routines.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomware-vaccine-kills-programs-wiping-windows-shadow-volumes/

Post Grid WordPress Plugin Flaws Allow Site Takeovers

According to security researchers, two high-severity flaws in Post Grid, a WordPress plugin with more than 60,000 installations, opens the door to site takeovers. The vulnerabilities are a cross-web page scripting (XSS) flaw as well as a PHP item-injection issue. Both bugs are pending CVE numbers, rating 7.5 out of 10 on the CvSS vulnerability rating scale. Team Showcase, a sister plugin, is also vulnerable to the XSS and PHP object-injection bugs. The plugins’ developer, PickPlugins, has issued the patches. Web admins should upgrade the affected plugins to eliminate these vulnerabilities.

See the full report here: https://threatpost.com/wordpress-plugin-flaws/159856/

Hackers claim they can now jailbreak Apple's T2 security chip

Security researchers have claimed that by combining two exploits, initially developed to jailbreak iPhones can also jailbreak Macs and MacBooks that come with Apple’s latest T2 security chips. T2 is a special co-processor chip that is installed alongside the main Intel CPU on modern Apple desktops to function as a separate CPU. The process is admittedly complex, but the technique of combining the two exploits has been mentioned on Twitter and Reddit over the past few weeks, having been tested and confirmed by several top Apple security and jailbreaking experts. Since this jailbreak is hardware-related, all T2 chips are considered unpatchable. The only way to deal with the aftermath of this is to reinstall BridgeOS, the operating system that runs in T2 chips.

See the full report here: https://www.zdnet.com/article/hackers-claim-they-can-now-jailbreak-apples-t2-security-chip/

Five bar and cafe owners arrested in France for running no-log WiFi networks

Five bar owners in Grenoble, France were taken into custody for providing WiFi at their businesses without keeping the logs. The bar owners were arrested under a 2006 law that technically classifies WiFi hotspot providing establishments as ISPs, and requires them to store one year’s worth of logs or connection records for anti-terrorism purposes. This requirement is in place even if the WiFi network is password protected. According to local media reports, the bar and cafe owners claimed they were not aware that such a law even existed, let alone that it applied to them as they had not received notifications from their union, which usually sends alerts of industry-wide legal requirements.

See the full report here: https://www.zdnet.com/article/five-bar-and-cafe-owners-arrested-in-france-for-running-no-log-wifi-networks/

Hacker group compromises mobile provider to steal credit cards

Credit card skimming group Fullz House has compromised and injected the website of US mobile virtual network credit card skimming group Fullz House has compromised and injected the website of US mobile virtual network operator (MVNO) Boom! Mobile with a credit card stealer script. Boom! Mobile provides US-based customers with post-paid and prepaid no-contract wireless service plans that work on the nation's largest cellular networks including AT&T, Verizon, and T-Mobile. According to Malwarebytes, the attackers injected a single line of code that loads an external JavaScript library from paypal-debit[.]com/cdn/ga.js, camouflaged as a Google Analytics script. The card skimmer works by collecting payment card information from input fields every time it detects any changes, immediately exfiltrating the harvested data as a Base64 encoded GET request. They observed that the company site runs PHP version 5.6.40, a version unsupported since January 2019.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-group-compromises-mobile-provider-to-steal-credit-cards/

Microsoft: Iranian hackers actively exploiting Windows Zerologon flaw

Microsoft warned that the Iranian-backed MuddyWater cyber-espionage group was observed using ZeroLogon exploits in multiple attacks during the last two weeks. The ongoing attacks exploiting the critical rated CVE-2020-1472 security flaw. Zerologon is a critical security flaw that enables attackers to elevate privileges to a domain administrator when successfully exploited, enabling them to take control over the entire domain, to change any user's password, and to execute any command. Microsoft is rolling out the fix for Zerologon two stages since it can cause some of the affected devices to experience authentication issues. The first one, released as part of the August 2020 Patch Tuesday, blocks Windows Active Directory Domain controllers from using unsecured RPC communication and logs auth requests from non-Windows devices that don't use secure RPC channels to allow admins to fix or replace affected devices. Starting with the February 2021 Patch Tuesday updates, Microsoft will release another update to enable enforcement mode which requires all network devices to use secure-RPC, unless specifically allowed by admins. Microsoft strongly recommends the IT admins to apply security updates on priority.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-iranian-hackers-actively-exploiting-windows-zerologon-flaw/

Chowbus delivery service breached, hacker emails data to users - BleepingComputer

A threat actor has hacked into the Chowbus food delivery service and emailed links to the stolen data to all customers. Chowbus is a mobile-based Asian food delivery service that allows customers to order food from local restaurants in cities around the USA, Australia, and Canada. Chowbus customers began receiving mysterious emails titled "Chowbus data," which simply stated, "Download Chowbus data here." The email contained download links to both a user and restaurant database used by the food delivery service. The first CSV contained the names, phone numbers, commission rates, and addresses for 4,300 restaurants that work with the food delivery service. The second database contained 803,350 Chowbus users' information, including their email address, name, phone number, and address. The company is investigating the breach and has assured that none of the exposed data contained financial information or passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/chowbus-delivery-service-breached-hacker-emails-data-to-users/

COVID-19 Clinical Trials Slowed After Ransomware Attack

A ransomware attack has hit eResearchTechnology, a medical software company that supplies pharma companies with tools for conducting clinical trials, including trials for COVID-19 vaccines. This has potentially slowed down coronavirus research worldwide, and researchers suggest a nation-state actor could be behind the incident. ERT’s vice president of marketing, has confirmed to the media that the attacks started on Sept. 20, after which systems were taken offline. The company is now in recovery mode and they are slowly bringing systems back into operation.

See the full report here: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/

APT Attack Injects Malware into Windows Error Reporting

Researchers at Malwarebytes have discovered a phishing campaign that injects malware into the Windows Error Reporting (WER) service. WER is the crash-reporting tool of the Microsoft Windows OS that is usually invoked when an error related to the operating system, Windows features or applications happens The threat actors compromised a website to host its payload and used the CactusTorch framework to perform a fileless attack, followed by several anti-analysis techniques. The technique suggests a connection to the Vietnamese APT32 group, also known as OceanLotus. APT32 is known to use CactusTorch HTA to drop variants of the Denis RAT. Also, the domains used to host malicious archives and documents are registered in Ho Chi Minh City, Vietnam, which also points to APT32.

See the full report here: https://threatpost.com/apt-attack-malware-windows-error-reporting/159861/

Malware campaigns deliver payloads via obscure paste service - BleepingComputer

Security researchers from Juniper Threat Labs have identified malware campaigns relying on legitimate paste services like paste[.]nrecom[.]net to host the malicious payload. This service is based on an open-source Pastebin implementation called Strikked and has been operating since 2014. The paste site only supports plaintext files and not binary. Any binary data can be represented as a text file by encoding it. The common encoding method is using base64. That is exactly what the threat actors did in this case. Before being base64-encoded, the binary payload underwent an XOR encryption to add a layer of obfuscation. The malware campaigns leveraging the paste service to distribute encrypted payload include Agent Tesla, W3Cryptolocker Ransomware, Redline Stealer, and LimeRAT. The attack usually starts with a phishing email that includes an attachment, such as a document, archive, or executable. When a user is tricked into installing the malicious attachment (first stage), it downloads the next stages from paste[.]nrecom[.]net. Using Pastebin-style services to host encrypted malicious code in plain sight works in the attacker's favor as these sites cannot be easily blocked by policy due to their legitimate use-cases. The researchers have advised monitoring traffic corresponding to the paste[.]nrecom website.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-campaigns-deliver-payloads-via-obscure-paste-service/

New HEH botnet can wipe routers and IoT devices

Security researchers from Netlab have discovered a botnet that contains code to wipe all data from infected systems, such as routers, servers, and Internet of Things (IoT) devices. Named HEH, the botnet spreads by launching brute-force attacks against any internet-connected system that has its SSH ports (23 and 2323) exposed online. If the device uses a default or easy-to-guess SSH credentials, the botnet gains access to the system, where it immediately downloads one of seven binaries that install the HEH malware. The HEH malware features include a function that ensnares infected devices and coerces them to perform SSH brute-force attacks across the internet to help amplify the botnet; a feature that lets attackers run Shell commands on the infected device; and a variation of this second feature that executes a list of predefined Shell operations that wipe all the device's partitions. Because this is a relatively new botnet, researchers can not tell if the device-wiping operation is intentional or if it's just a poorly coded self-destruction routine. But regardless of its purpose, if this feature ever gets triggered, it could result in hundreds or thousands of bricked and non-functioning devices.

See the full report here: https://www.zdnet.com/article/new-heh-botnet-can-wipe-routers-and-iot-devices/

Mozilla shares fix for Twitter not working on Firefox

Mozilla published a support document with a quick fix for a widely reported known issue causing Twitter not to load on the Firefox web browser. On devices where Firefox fails to load Twitter's website, users would see "The site at https://twitter.com/ has experienced a network protocol violation that cannot be repaired" error, while some might see blank pages or errors when trying to visit the social network's website. Users say that the loading errors have started to appear on both mobile and desktop devices after updating to Firefox 81.0 last month. Mozilla has been tracking and working on a fix and shared a process to open Twitter. As a workaround, users can hard reload Twitter's site using CTRL+F5 to temporarily allow open Twitter pages. Additionally, going to about: config and disabling dom.serviceWorkers.enabled will also remove the network violation errors.

See the full report here: https://www.bleepingcomputer.com/news/technology/mozilla-shares-fix-for-twitter-not-working-on-firefox/

MosaicRegressor: Second-ever UEFI rootkit found in the wild - BleepingComputer

Cybersecurity researchers have spotted a rare kind of potentially dangerous malware that targets a machine's booting process to drop persistent malware. The campaign involved the use of a compromised UEFI (Unified Extensible Firmware Interface) containing a malicious implant, making it the second known public case where a UEFI rootkit has been used in the wild. UEFI is a firmware interface and a replacement for BIOS that improves security, ensuring that no malware has tampered with the boot process. Because UEFI facilitates the loading of the operating system itself, such infections are resistant to OS reinstallation or replacement of the hard drive. The UEFI bootkit, dubbed MosaicRegressor by Kaspersky researchers who discovered it, is a modular and multi-stage malware framework used by Chinese-speaking hackers in data theft and espionage operations. Kaspersky found a C2 address in one of MosaicRegressor's variants that have been observed in connection with Chinese hacker groups broadly known as Winnti (aka APT41). The telemetry analysis revealed several dozen victims between 2017 and 2019, all of whom had some ties to North Korea.

See the full report here: https://www.bleepingcomputer.com/news/security/mosaicregressor-second-ever-uefi-rootkit-found-in-the-wild/

New Flaws in Top Antivirus Software Could Make Computers More Vulnerable

Cybersecurity researchers discovered the majority of security tools that organizations use to defend against malware attacks are themselves vulnerable to exploits that allow attackers to escalate privileges on a compromised system. The bugs impact a wide range of antivirus solutions, including those from Kaspersky, McAfee, Symantec, Fortinet, Check Point, Trend Micro, Avira, and Microsoft Defender, each of which has been fixed by the respective vendor. According to a report published by researchers, the vulnerabilities result from default DACLs (Discretionary Access Control Lists) for the ProgramData folder of Windows, which are by applications to store data for standard users without requiring additional permissions. Given that every user has both write and delete permission on the base level of the directory, it raises the likelihood of a privilege escalation when a non-privileged process creates a new folder in ProgramData that could be later accessed by a privileged process. While these issues may have been addressed, the report serves as a reminder that weaknesses in software, including those that aim to offer antivirus protection, can be a conduit for malware.

See the full report here: https://thehackernews.com/2020/10/antivirus-software-vulnerabilities.html

'Bahamut' Threat Group Targets Government & Industry in Middle East

A hack-for-hire cyberespionage group named Bahamut is involved in advanced attacks targeting government officials and organizations with sophisticated credential harvesting attacks and phishing campaigns, new Windows malware samples, zero-day exploits, and other techniques. According to BlackBerry researchers, the Bahamut group is politically motivated and has historically targeted people and entities in South Asia, particularly India and Pakistan, as well as the Middle East, primarily the UAE and Qatar. Researchers discovered phishing attempts designed to spoof government agency logins, private email accounts, and account portals from Microsoft Live, Gmail, Apple ID, Yahoo!, Twitter, Facebook, Telegram, OneDrive, and ProtonMail. Its spear-phishing operations ranged from a few hours to multiple months, depending on the success rates. The group monitors information published about them in the security community. When exposed, it changes its strategy quickly. It is known to reuse tools and infrastructure of other APT groups and builds anti-analysis features into its exploits and shellcode. BlackBerry's research uncovered nine malicious iOS applications and several Android apps that experts attribute to the group based on configuration and unique network service fingerprints.

See the full report here: https://www.darkreading.com/threat-intelligence/bahamut-threat-group-targets-government-and-industry-in-middle-east/d/d-id/1339114

US brokerage firms warned of widespread survey phishing attacks - BleepingComputer

The U.S. Financial Industry Regulatory Authority (FINRA) has issued a notice, warning member brokerage firms of widespread phishing attacks using surveys to harvest information. FINRA is a non-profit organization and self-regulatory body authorized by the U.S. government to regulate exchange markets and brokerage firms. FINRA stated that phishing messages were being sent from a fake FINRA domain '@regulation-finra[.]org' preceded by 'info' followed by a number, e.g., info5@regulation-finra[.]org. Member firms were asked to fill a survey by October 13, with the information needed to FINRA would need to "update its conduct and supervisory rules." Since the regulation-finra[.]org domain is not connected in any way with FINRA, member firms are urged to immediately delete any emails they received from this domain. FINRA has also requested NameCheap, the Internet domain registrar used to register this domain four days ago, to suspend services for regulation-finra[.]org. FINRA reminds firms to verify the legitimacy of any suspicious email before responding to it, opening any attachments, or any embedded links.

See the full report here: https://www.bleepingcomputer.com/news/security/us-brokerage-firms-warned-of-widespread-survey-phishing-attacks/

Chrome 86 rolls out with massive user security enhancements - BleepingComputer

Google has released Chrome 86 to the Stable desktop channel, and it includes numerous security enhancements, features, and APIs for developers. The latest version brings many security enhancements to both desktop and mobile users in the form of increased password security, protection from insecure downloads and form submissions, and biometric protection when auto-filling saved passwords. Google also added new flags that allow it to test experimental features, such as the ability to edit saved passwords, disable autofill in mixed-content forms, and view AVIF images. The latest version can automatically be updated via browser.

See the full report here: https://www.bleepingcomputer.com/news/google/chrome-86-rolls-out-with-massive-user-security-enhancements/

PoetRAT Resurfaces in Attacks in Azerbaijan Amid Escalating Conflict

A new iteration of the PoetRAT spyware is making the rounds in Azerbaijan, targeting the public sector and other key organizations as the country’s conflict with Armenia over disputed territory intensifies. PoetRAT scurried onto the scene in April as a region-specific backdoor that acted as the tip of the spear for a greater espionage framework. The recent attacks use Microsoft Word documents alleged to be from the Azerbaijan government, with the National Emblem of Azerbaijan, to install PoetRAT in two separate files on victims’ machines. The documents included in the spear-phishing emails drops PoetRAT, that target victims including Azerbaijani VIPs and organizations in the public sector, with attackers demonstrating access to sensitive information, such as diplomatic passports belonging to some of the country’s citizens.

See the full report here: https://threatpost.com/poetrat-resurfaces-azerbaijan-conflict/159917/

Phishing emails lure victims with inside info on Trump's health

A new phishing campaign is pushing a network-compromising backdoor that pretends to have the inside scoop on President Trump's health after being infected with COVID-19, spotted by Proofpoint. The spam email lure victims by pretending to have new insider information regarding Trump's health which requires downloading a document using an embedded link. When a recipient clicks on the link they are redirected to a Google Document stating that Google has scanned the file and it is safe. On clicking on the download link, instead of downloading a Word doc, a backdoor trojan is downloaded. These attacks ultimately lead to the deployment of the Ryuk Ransomware on a victim's network, which turns the breach of a single computer into a corporate-wide attack.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-emails-lure-victims-with-inside-info-on-trumps-health/

Microsoft adds consent phishing protection to Office 365

Microsoft is rolling out three updates designed to bolster the security of the Office 365 app ecosystem including, the general availability of publisher verification, user consent updates for unverified publishers, and general availability of app consent policies. These protections are designed to defend Office 365 users from an application-based phishing attack variant known as consent phishing. In this type of phishing attack, targets are tricked into providing access to their Office 365 accounts by granting permissions to malicious Office 365 OAuth apps (web apps attackers register with an OAuth 2.0 provider). All Office 365 users will be protected from app-based attacks as publisher verification coming from unverified publishers will no longer be able to consent to new multi-tenant apps registered after November 8th, 2020. Such apps will be automatically flagged as risky and tagged as unverified on all consent screens, except for apps that request consent within their tenants and of those only asking for basic sign-in and permissions to read user profiles.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-adds-consent-phishing-protection-to-office-365/