Threat Intelligence Bulletin: 10/23/2020

FTC Report on Scams in 2020

On October 21, 2020, the Federal Trade Commission (FTC) posted a data spotlight blog about scams on social media. In the post, the FTC discusses a trend in submissions to their Consumer Sentinel Network, where victims of scams have increased since the onset of the pandemic. When comparing the FTC report to ZeroFOX data, we’ve seen a positive correlation between the increase in reported scams to the FTC and an increase to scams found across all of our data sources. ZeroFOX Alpha Team has found a 519% year over year increase in scam-related activity targeting our customers' brands, with Financial Services and Retail customers being affected the most. Alpha Team assesses with HIGH confidence that to increase their efficacy, scams will continue their cadence throughout the pandemic and will take advantage of the fog of war associated with the pandemic and the social network’s slowing response times.

Recommendations

Be mindful of any opportunity for financial gain proposed on social media
If you are skeptical of a business, research it on Google and the FTC website for scam complaints
To protect your brand and customers, enable the Fraud, Scams & Piracy rules for your ZeroFOX platform. Reach out to [email protected] for assistance

Details

On October 21, 2020, the Federal Trade Commission (FTC) posted a data spotlight blog about scams on social media. In the post, the FTC discusses a trend in submissions to their Consumer Sentinel Network, where victims of scams have increased since the onset of the pandemic. The Consumer Sentinel Network is a cyber investigative tool made available to US government agencies to gain access to reports made by consumers to the FTC regarding a plethora of reports related to scams, fraud, identity theft, and any type of crime related to improper business practices and schemes. Within this tool, investigators can measure losses based on the reports, which is an important investigative measurement to quantify the impact on American citizens.

In 2019, reports of losses from fraud originating on social media reached $134 million. Within the first 6 months of 2020, this reported number rocketed to $117 million.

Figure 1: FTC Scam Report Detailing Loss for Consumers

FTCs Top Scams

According to the FTC, the 4 most reported types of scams are online shopping, romance, income opportunity, and social relief scams. Online shopping scams usually refer to an illegitimate shop that is being operated on social media, such as one that sells desirable brand products, and the fraudster tricks the victim into sending money without the product being delivered, or the product delivered is fake and low quality. For example, a naive consumer can order a designer purse at a low price and then receive a cheap knock-off.

Figure 2: Online Shopping Scam Example

Another type of online shopping scam is called dropshipping scams. Dropshipping is a legitimate business model, where online retailers can be a middle man and sell items that they don’t have in store. Dropship scam stores can sell a product to the victim at low prices without ever fulfilling their obligation to ship the victim their inventory. In one FTC complaint, a charge was brought to a Dropship coaching company for faulty business practices.

The next scam, Romance scams, have been plaguing the US for years. Romance scams have caused a loss of $475 million to consumers in 2019 alone. They are so effective that the FBI has a page dedicated to educating people about them, and it also serves as a portal to report potential romance scams. According to the FTC report, most romance scams reported to their agency started with a Friend Request or a message on social media. Romance scams typically target people who are on dating sites, and they have been effective against seniors (55+).

Income opportunity and relief scams have been around for a number of years on social media and have been widely reported by ZeroFOX . In these scams, posts on social media are made to hashtags and profiles that promise a “quick turnaround” of money for an initial deposit. For example, Money Flipping scams promise victims quick returns on their deposits to the scammer, but once the deposit is made the scammer disappears or blocks the victim.

Figure 3: MoneyFlipping Scam on Instagram

Income opportunity and relief scams can also result in a victim falling prey to a 419 or Advanced Fee scam. In this example, fraudsters send a wire transfer or an invalid check to a victim and ask the victim to route a portion of the money to an attacker-controlled account. Within days, the wire transfer bounces, and the victim loses the money they routed afterward. Sugar baby scams, for example, are a combined income opportunity and advanced fee scam.

Figure 4: Sugar Baby Scam

ZeroFOX Data

When comparing the FTC report to ZeroFOX data, we’ve seen a positive correlation between the increase in reported scams to the FTC and an increase in scams found across all of our data sources.

Across industries in the ZeroFOX ecosystem, we’ve seen a 519% year over year increase in security incidents specifically related to scams. Some individual breakdowns of customer cohort scams include:

423% increase in Financial Services alone (scammers/money mulers targeting banking customers)
1579% increase in Retail scams
226% increase in Consumer Goods scams

Specific scams:

295% increase in HR scams, which could align with scammers looking to capitalize on work from home opportunities and lay-off/furloughs due to the pandemic
164% increase in Crypto Giveaway scams, where an account is taken over or an impersonator profile is created to look like an influencer to peddle the scam
609% increase in Money Flipping Scams
100% increase in Impersonating profiles that have someone who claims to work for a company in HR, but does not

Across all industries, Alpha Team has seen a 94% YoY increase in scam takedowns submitted and then subsequently removed.

ZeroFOX Alpha Team assesses that scammers will likely continue to use the pandemic as an opportunity to take advantage of desperate consumers. Emotional and economic distress can leave victims vulnerable to these scams, especially ones designed to alleviate stress and reduce the impact of the pandemic. Alpha Team also assesses that the scam types will remain constant and we will not see many new scams, mostly due to the years of experience and resources available for tried and tested scams.

Breach Disclosure: Reincubate

The London, England based technology firm, Reincubate, has disclosed a data breach which occurred some time before October 18th 2020 which exposed approximately 616,000 unique records. The data includes names, email addresses, PBKDF2 hashed passwords and for some users billing information such as addresses and metadata on usage of Reincubate apps and products. Reincubate have acknowledged the breach and released a public statement along with contacting affected customers and performing password resets.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The company was contacted by an anonymous individual reporting to have obtained a copy of their backup data from November 2017 and demanding payment in bitcoin. From further investigation into the data the threat actor had obtained it was identified the source of the breach came from a set of leaked AWS credentials which were exposed in a separate data incident at DataDog. Internal processes to revoke these keys failed which resulted in the keys still being usable after exposure. These keys provided access to an AWS S3 bucket which contained backup data from November 2017. Reincubate have confirmed that they have updated their internal processes and responsible disclosure policies to align with their security standards and UK law enforcement is investigating the incident.

On 25 October 2020, an actor on the vetted Russian cybercrime forum Exploit posted the data for free to forum users.

Figure 1: Buffer posts the Reincubate data on Exploit[.]in

Breaking News: 2020-10-23 - 2020-10-29

Botnet Infects Hundreds of Thousands of Websites

A botnet, dubbed KashmirBlack, has been targeting popular content management systems (CMSes), such as WordPress, Joomla, and Drupal, and using Dropbox and GitHub for communication to hide its presence. The botnet uses a modular infrastructure that includes features such as load balancing communications with C&C servers and storing files on cloud storage services such as Dropbox and GitHub to speed access to any new code updates for the systems infected with the software. The botnet uses two clusters of infected systems as repositories for code and exploits. It divides compromised systems into those actively seeking new bots and a larger group waiting for instructions. Load-balancing features were added to the repositories to increase responsiveness and availability. The botnet activity is dynamic, and it deploys new evasion techniques frequently. Most servers are tasked with either crypto mining or spamming, but in some cases, the botnet appears to be used in defacements.

See the full report here: https://www.darkreading.com/attacks-breaches/botnet-infects-hundreds-of-thousands-of-websites/d/d-id/1339258

Microsoft Teams Phishing Attack Targets Office 365 Users

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams wherein the attack aims to steal Office 365 recipients’ login credentials. According to researchers at Abnormal Security, this particular campaign was sent to between 15,000 to 50,000 Office 365 users. The initial phishing email displays the name “There’s new activity in Teams,” making it appear like an automated notification from Microsoft Teams. The email tells the recipient that their teammates are trying to reach them, warning them they have missed Microsoft Team chats and urges them to respond by clicking on the “Reply in Teams” button. Within the body of the email, three links appear as ‘Microsoft Teams,’ ‘(contact) sent a message in instant messenger,’ and ‘Reply in Teams.’ Clicking on any of these leads to a fake website that impersonates the Microsoft login page. The phishing page asks the recipient to enter their email and password. The entered credentials will be sent to attackers that can be further used for malicious purposes including, account takeover.

See the full report here: https://threatpost.com/microsoft-teams-phishing-office-365/160458/

Lightning Network discloses "concerning" crypto vulnerabilities - BleepingComputer

The team behind Lightning Network has released extensive details on the vulnerabilities that were discovered in the cryptocurrency protocol and its software implementations. Lightning Network is a payment protocol that runs on top of blockchain-based cryptocurrencies like Bitcoin, Ethreum, etc. The vulnerabilities are tracked as CVE-2020-26895 and CVE-2020-26896 that could have exploited by an attacker to cause DoS and to disrupt crypto transactions by intercepting "smart contracts" made between two parties. Both vulnerabilities were patched in versions 0.11.0 and above of lnd, the open-source implementation of Lightning Network.

See the full report here: https://www.bleepingcomputer.com/news/security/lightning-network-discloses-concerning-crypto-vulnerabilities/

MobileIron enterprise MDM servers under attack from DDoS gangs, nation-states

A month after details were published about three severe vulnerabilities in a type of server used to manage fleets of mobile devices, multiple threat actors are now exploiting MDM server bugs to take over crucial enterprise servers and even orchestrate intrusions inside company networks. MDM systems are used inside enterprises to allow companies to manage employees' mobile devices, by allowing system administrators to deploy certificates, apps, access-control lists, and wipe stolen phones from a central server. A proof-of-concept is available for CVE-2020-15505, the most dangerous of the three bugs. The US National Security Agency (NSA) has listed the MobileIron CVE-2020-15505 as one of the top vulnerabilities exploited by Chinese state-sponsored hackers in recent months. Organizations are urged to apply the patch immediately.

See the full report here: https://www.zdnet.com/article/mobileiron-enterprise-mdm-servers-under-attack-from-ddos-gangs-nation-states/

FBI, CISA: Russian hackers breached US government networks, exfiltrated data

The US government released a joint advisory to disclose a hack by a Russian state-sponsored group. The US officials identified the Russian hacker group as Energetic Bear that has been targeting dozens of US state, local, territorial, and tribal (SLTT) government networks since at least February 2020. According to the technical advisory, the hackers used publicly known vulnerabilities to breach networking gear, pivot to internal networks, elevate privileges, and steal sensitive data. Targeted devices included Citrix access gateways (CVE-2019-19781), Microsoft Exchange email servers (CVE-2020-0688), Exim mail agents (CVE 2019-10149), and Fortinet SSL VPNs (CVE-2018-13379). The Zerologon vulnerability in Windows Servers (CVE-2020-1472) was also used for lateral movement across the network.

See the full report here: https://www.zdnet.com/article/fbi-cisa-russian-hackers-breached-us-government-networks-exfiltrated-data/

Nvidia Warns Gamers of Severe GeForce Experience Flaws

Nvidia has disclosed two high-severity bugs in GeForce Experience for Windows that could enable code execution, denial of service and more. GeForce Experience is a supplemental application to the GeForce GTX graphics card that keeps users’ drivers up-to-date, automatically optimizes their game settings and is installed by default on systems running NVIDIA GeForce products. The flaw specifically stems from the Nvidia Web Helper NodeJS Web Server. When users install GeForce Experience, Node.js runs on startup and provides a web server connection with Nvidia. The issue here is that an uncontrolled search path is used to load a node module, which occurs when an application uses fixed search paths to find resources but one or more locations of the path are under control of malicious users. Attackers can leverage tactics like DLL preloading, binary planting and insecure library loading in order to exploit this vulnerability. Users are urged to update to version 3.20.5.70 to fix these bugs.

See the full report here: https://threatpost.com/nvidia-gamers-geforce-experience-flaws/160487/

HPE fixes maximum severity remote auth bypass bug in SSMC console - BleepingComputer

Hewlett Packard Enterprise (HPE) has fixed a remote authentication bypass vulnerability affecting the company's HPE StoreServ Management Console (SSMC) data center storage management solution. HPE SSMC is a management and reporting console for HPE Primera (data storage for mission-critical apps) and HPE 3PAR StoreServ systems (AI-powered storage cloud service providers) data center arrays. The vulnerability is tracked as CVE-2020-7197, which affects HPE 3PAR StoreServ Management and Core Software Media before 3.7.0.0. The flaw was rated by HPE as a maximum severity (10/10) vulnerability that allows threat actors with no privileges to exploit it as part of low complexity attacks that don't require user interaction. To mitigate the flaw, HPE recommends upgrading the HPE 3PAR StoreServ Management Console (SSMC) to 3.7.1.1 or later.

See the full report here: https://www.bleepingcomputer.com/news/security/hpe-fixes-maximum-severity-remote-auth-bypass-bug-in-ssmc-console/

Mozilla slows Firefox 82 updates due to printing issues, crashes - BleepingComputer

Mozilla has slowed the rollout of Firefox 82 just two days after its release due to printing bugs and crashes in the new version. Mozilla Firefox 82 was released on October 20th, with only a few improvements in performance and its Picture-in-Picture feature. However, since the release of Firefox 82, there have been numerous bug reports stating that the browser is printing blank receipts to receipt printers. A fix for this issue is currently being tested in Firefox 83 Beta. In addition to the printing issues, Mozilla is investigating crashes when Firefox is started that appear to be related to conflicts with installed AV software. There are no immediate plans to release a new version yet or information on when Firefox 82's rollout will continue.

See the full report here: https://www.bleepingcomputer.com/news/software/mozilla-slows-firefox-82-update-due-to-printing-issues-crashes/

WastedLocker ransomware hits Boyne Resorts ski resort operator - BleepingComputer

US-based ski and golf resort operator Boyne Resorts has suffered a cyberattack by WastedLocker ransomware that has impacted company-wide reservation systems. According to BleepingComputer, an alleged Boyne Resorts employee who stated that the company suffered an undisclosed ransomware attack last weekend. The attack allegedly affected their corporate offices and then spread to IT systems of the resorts they operate, forcing them to shut down portions of their network to prevent the ransomware spread. Due to this attack, it is not possible to book lodging at the resort as the company-wide reservation systems are impacted by the attack, including the online reservation systems at each hotel's website. The company is yet to confirm the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/wastedlocker-ransomware-hits-boyne-resorts-ski-resort-operator/

Ransomware Takes Down Network of French IT Giant

French IT giant Sopra Steria was hit with a cyberattack this week that disrupted the business of the firm and is widely believed to be the work of the threat actors behind Ryuk ransomware. The company detected the attack on October 20 2020 which encrypted parts of its network. The company is currently working with authorities to restore the affected systems. The customers are yet to be notified about the incident.

See the full report here: https://threatpost.com/ransomware-french-it-giant/160484/

Microsoft is investigating these known Windows 10 20H2 issues - BleepingComputer

Microsoft is investigating errors and issues affecting Windows 10 devices with certain versions of Conexant or Synaptics audio device drivers, Microsoft IME (Input Method Editor), and third-party drivers. Computers with certain Conexant, Synaptics, or Conexant ISST audio drivers are currently experiencing issues with the May 2020 and October 2020 Windows 10 updates. Impacted Windows 10 devices include both client (Windows 10 2004 and 20H2) and server (Windows Server 2004 and 20H2) platforms. Users of such devices might experience blue screens or errors during or while updating the OS on computers. Because of this, Microsoft has added two compatibility holds to block Windows 10 2004 and later from being offered to systems with the problematic Conexant audio drivers. Microsoft and Synaptics are currently working on a resolution for these issues and plan to provide a fix with an upcoming release. Microsoft is also investigating and working on a possible fix for Windows 20H2 devices that are plagued by four other issues with Microsoft IME for Japanese or Chinese languages.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-is-investigating-these-known-windows-10-20h2-issues/

Apple notarizes six malicious apps posing as Flash installers

Apple's app notarization process that requires Mac app developers to submit their apps to Apple for a series of automated security scans that check for malware or other malicious code patterns has been bypassed by the Malware authors for the second time this year. In a report published this week, Chief Security Analyst for Mac security software maker Intego discovered six new malicious apps, posed as Flash installers, that passed through the notarization process. Once installed, these apps would download and install the OSX/MacOffers adware. The six apps have now been de-notarized. Experts urge users to stop downloading and installing Flash installers as Adobe is all set to retire Flash at the end of the year.

See the full report here: https://www.zdnet.com/article/apple-notarizes-six-malicious-apps-posing-as-flash-installers/

JavaScript-based address bar spoofing vulns patched in Safari, Yandex, Opera

Security researchers have found Apple’s Safari browser, Opera Mini, and Yandex browsers to be vulnerable to JavaScript-based address bar spoofing. These vulnerabilities could allow the software to trick into displaying the URL of one website while loading and displaying content from another. Researchers have also published proof-of-concept code for exploiting the vulnerabilities in Yandex Browser, Safari, and Opera. Patches have been made available for UCWeb (CVE-2020-7363 and 7364), Opera Touch, Yandex Browser (CVE-2020-7369), Safari (CVE-2020-9987), and RITS Browser (CVE-2020-7371). Users are urged to update to the latest fixed versions to protect from imminent attacks. Opera Mini is expected to be patched on November 11.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/10/24/browser_address_spoofing/

US sanctions Russian institute linked to dangerous malware - iTnews

Washington imposed sanctions on a Russian research institute tied to the development of a dangerous computer program capable of causing catastrophic industrial damage, a move that Russia called illegitimate. The U.S. Treasury Department alleged that the Russian government-backed Central Scientific Research Institute of Chemistry and Mechanics was responsible for building customized tools that enabled the attack on an unidentified petrochemical facility in the Middle East in 2017. Treasury also said last year the attackers behind the malware were reported to be scanning and probing at least 20 electric utilities in the United States for vulnerabilities. Experts see the activity as the United States warning hostile powers to not interfere in its elections, less than two weeks away.

See the full report here: https://www.itnews.com.au/news/us-sanctions-russian-institute-linked-to-dangerous-malware-555121

Finland shocked by therapy center hacking, client blackmail - ABC News

Finland’s interior minister summoned key Cabinet members into an emergency meeting Sunday after thousands of patient records at Vastaamo, a private Finnish psychotherapy center accessed by hackers now demanding ransoms. Vastaamo, which has branches throughout the Nordic country of 5.5 million and operates as a sub-contractor for Finland’s public health system. The client registers with private patients record likely accessed by the hackers during two attacks that started almost two years ago. It was not immediately clear if the stolen data included diagnoses, notes from therapy sessions, or other potentially damaging information. Vastaamo urged clients who receive demands to pay money in exchange for keeping their information private should immediately contact Finnish police.

See the full report here: https://abcnews.go.com/Health/wireStory/finland-shocked-therapy-center-hacking-client-blackmail-73817011

LGBT+ group targeted by hackers - Kent Online

Margate Pride, an arts-led organization that hosts events all over the seaside town, informed its followers of the security breach. The group claiming responsibility for the attack is believed to be the UMCA, a homophobic religious extremist network accused of spreading fake news and hate speech. Neighboring LGBT organizations and allies posted on social media to share their support for Margate Pride.

See the full report here: https://www.kentonline.co.uk/thanet/news/lgbt-group-targeted-by-hackers-236177/

Hackers Hit Yorktown & Croton School Districts - Yonkers Times

The Yorktown and Croton-Harmon school districts in Westchester County recently had their computer systems hacked by a cybersecurity attack coming from someone seeking to get a payment to remove the ransomware that froze both systems. The ransomware attack encrypted data on the Yorktown Central School District’s networks, forcing officials to restore servers from backups and go room-to-room to reimage devices, Superintendent Ron Hattar said in an email to the parents. The Croton-Harmon school district also faced a similar attack this month. In a message to parents and students, Croton-Harmon Superintendent Deborah O’Connell said the incident was a ransomware attack. Both superintendents told their communities there was no evidence of any personal data was compromised.

See the full report here: http://yonkerstimes.com/hackers-hit-yorktown-croton-school-districts/

Sopra Steria confirms being hit by Ryuk ransomware attack - BleepingComputer

Sopra Steria, a European information technology company, has confirmed that they were hit with a Ryuk ransomware attack. Investigations have revealed that the attackers compromised their network over the weekend and then deployed the ransomware on October 20th. The virus that infected Sopra Steria is a new version of the Ryuk ransomware, previously unknown to antivirus software providers and security agencies. The company further states that currently, their investigation does not indicate that any customer data was leaked. Sopra Steria has started restoring devices and expects a few weeks to recover before the company is fully operational.

See the full report here: https://www.bleepingcomputer.com/news/security/sopra-steria-confirms-being-hit-by-ryuk-ransomware-attack/

Hacker steals $24 million from cryptocurrency service 'Harvest Finance'

Harvest Finance, a web portal that lets users invest cryptocurrencies and then farm the price variations for small profit yields, has been hacked. The hacker invested large quantities of cryptocurrency assets in its service and then used a cryptographic exploit to siphon the platform's funds to their own wallets. In total, the hacker stole $13 million worth of USD Coin (USDC) and $11 million worth of Tether (USDT), according to a transaction ID singled out by Harvest Finance administrators in a subsequent post-mortem investigation. In a message posted on its Discord channel, Harvest Finance claimed the attack left a significant amount of personally identifiable information on the attacker and described them as well-known in the crypto community. Harvest Finance admitted that the attack took place because of a mistake and is now offering a $400,000 bounty to anyone who finds a way to return the stolen funds. After the first 36 hours, the bounty will be lowered to $100,000.

See the full report here: https://www.zdnet.com/article/hacker-steals-24-million-from-cryptocurrency-service-harvest-finance/

Containerd Bug Exposes Cloud Account Credentials

Containerd, a runtime tool that manages the complete container lifecycle of its host system, contains a security vulnerability that could be exploited to coerce the Containerd cloud platform into exposing the host’s registry or users’ cloud-account credentials. Tracked as CVE-2020-15157, the bug is located in the container image-pulling process, according to Gal Singer, a researcher at Aqua. Adversaries can exploit this vulnerability by building dedicated container images designed to steal the host’s token, then using the token to take over a cloud project, he explained. Researchers have also put together a proof-of-concept exploit for a related attack vector. Containerd has patched the bug, which is listed as medium severity, in version 1.2.4, and Containerd 1.3.x is not vulnerable.

See the full report here: https://threatpost.com/containerd-bug-cloud-account-credentials/160546/

The Russian Hackers Playing 'Chekhov's Gun' With US Targets

The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency published an advisory warning that a group known as Berserk Bear had carried out a broad hacking campaign against US state, local, territorial, and tribal government agencies, as well aviation sector targets. Since 2012, cybersecurity researchers have been shocked to repeatedly find the group's fingerprints deep inside infrastructure around the globe, from electric distribution utilities to nuclear power plants. Researchers also say they have never seen Berserk Bear use that access to cause disruption. They believe that Berserk Bear breaches might be that type of preparation, Hultquist warns, for coming assaults on the state, municipal, and different native governments accountable for administering the present election.

See the full report here: https://www.wired.com/story/berserk-bear-russia-infrastructure-hacking/

Angry YouTube-dl users flood GitHub with new repos after takedown

On October 23, 2020, GitHub took down YouTube-dl's repositories due to a DMCA (Digital Millennium Copyright Act) infringement notice filed by the Recording Industry Association of America (RIAA), an organization that represents the recording industry in the U.S. YouTube-dl is a command-line program that can be used to download multimedia content from YouTube and several other sites. Before being removed, YouTube-dl used GitHub to host source code and compiled executables and was in the top 40 most starred GitHub repositories with more than 72,000 stars, between Node.js and Kubernetes. Users of the YouTube-dl YouTube media downloader have flooded GitHub with new repositories containing the tool's source code after the takedown. A copy of YouTube-dl's source code was also added to an official GitHub repository used for hosting received DMCA takedown notices. The user who committed the source code used a bug, allowing anyone to attach commits to repos they don't control.

See the full report here: https://www.bleepingcomputer.com/news/software/angry-youtube-dl-users-flood-github-with-new-repos-after-takedown/

Nitro PDF data breach might impact major companies, including Microsoft, Google, and Apple

Australian document productivity company Nitro Software Inc. has suffered a data breach with customer data being leaked and offered for sale on the dark web. The company stated that they had been impacted by a low impact security incident involving limited access to a Nitro database by an unauthorized third party. The data stolen included the company’s user and document databases along with 1 terabyte in documents created by Nitro’s customers. According to Cyble, the data is offered at a starting price of $80,000 on a dark web site is said to include 70 million user records containing email addresses, full names, bcrypt hashed passwords, titles, company names, IP addresses, and other system-related data. Cyble claims these databases contain a considerable amount of records related to well-known companies, including Google, Apple, Microsoft, Chase, and Citibank.

See the full report here: https://securityaffairs.co/wordpress/110025/data-breach/nitro-pdf-data-breach.html

Google Removes 21 Malicious Android Apps from Play Store

Google has stepped in to remove several Android applications from the official Play Store following the disclosure that the apps in question were found to serve intrusive ads. According to the Czech cybersecurity firm Avast, the malicious apps were downloaded nearly eight million times from Google's app marketplace. The apps masqueraded as harmless gaming apps and came packed with HiddenAds malware, a notorious Trojan known for its capabilities to serve intrusive ads outside of the app. The group behind the operation relies on social media channels to lure users into downloading the apps. Once installed, the apps not only hide their icons to prevent deletion but also hide behind relevant-looking advertisements, making them hard to identify. The apps also can draw over other apps to show timed ads that cannot be skipped, and in some cases, even open the browser to bombard users with ads.

See the full report here: https://thehackernews.com/2020/10/google-android-malwar.html

FBI: Hackers stole government source code via SonarQube instances - BleepingComputer

The Federal Bureau of Investigation (FBI) issued an alert warning of hackers stealing data from U.S. government agencies and enterprise organizations via internet-exposed and insecure SonarQube instances. SonarQube is an open-source platform for automated code quality auditing and static analysis to discover bugs and security vulnerabilities in projects using 27 programming languages. Vulnerable SonarQube servers have been actively exploited by attackers since April 2020 to gain access to data source code repositories owned by both government and corporate entities, later exfiltrating it and leaking it publicly. The FBI has provided mitigation measures to block these attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-hackers-stole-government-source-code-via-sonarqube-instances/

Enel Group hit by ransomware again, Netwalker demands $14 million - BleepingComputer

Multinational energy company Enel Group has been hit by Netwalker ransomware. Enel has been attacked for the second time this year. Enel was attacked earlier this year by Snake ransomware, but the attempt was caught before the malware could spread. The Netwalker ransomware gang added Enel Group to their data leak site and shared screenshots of unencrypted files from the company during this month's cyberattack. The ransomware gang claims to have stolen about 5 terabytes of data from Enel and are threatening to make the data public. Netwalker is demanding a $14 million ransom for the decryption key. Enel is yet to respond to the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million/

Mozilla rolls out new Firefox version to fix Windows reboot bug - BleepingComputer

Mozilla has rolled out Firefox 82.0.1, a new version that fixes a known bug where the Windows installer displays unnecessary reboot prompts on some systems after it finishes the installation. Firefox 82.0.1 also uplifts a fix to the stable version for a known stability issue that has affected the web browser's users during the last two months. Firefox 82.0.1 also includes fixes for printing issues and WebDriver bug in the marionette testing framework. Users can update to Firefox 82.0.1 by going to Options -> Help -> About Firefox, the browser will automatically check for the new version and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/software/mozilla-rolls-out-new-firefox-version-to-fix-windows-reboot-bug/

Steelcase furniture giant hit by Ryuk ransomware attack

Office furniture giant Steelcase has disclosed that they were the victim of a cyberattack on October 22nd, 2020, that forced them to shut down their network to contain the attack's spread. According to BleepingComputer, Steelcase's devices were encrypted by Ryuk ransomware. The attacks utilized either the BazarLoader or TrickBot infections, which ultimately provide remote access to the Ryuk Ransomware threat actors, who then compromise the rest of the network and deploy Ryuk. The scope of the attack is yet to be determined.

See the full report here: https://www.bleepingcomputer.com/news/security/steelcase-furniture-giant-hit-by-ryuk-ransomware-attack/

Microsoft releases update to remove Adobe Flash from Windows

Microsoft has released the "Update for the removal of Adobe Flash Player: October 27, 2020" KB4577586 Update to remove Adobe Flash from all versions of Windows 10 and Windows Server. Once installed, Microsoft states that Adobe Flash Player will be automatically removed by the update, but is not clear as to what exactly is removed. Any standalone versions of Adobe Flash Player that users have installed will not be removed by this update. Microsoft aims to roll out the update via WSUS and Windows Update to perform wide-scale removal of Flash Player in early 2021 after Flash reaches the end of life.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-update-to-remove-adobe-flash-from-windows/

Sky Lakes Medical Center targeted in ransomware attack - KDRV

Sky Lakes Medical Center issued a public statement that the facility attacked by ransomware, described by medical center officials as an organization or individual that threatened to encrypt the facility’s data. The cyberattack compromised computer systems at the main facility and could delay procedures that require imaging services. Sky Lakes says currently, they see no evidence of compromised patient data. A Facebook message on the organization’s site stated that the medical center’s IT team is working to counter the attack and keep the public updated on the outcome.

See the full report here: https://www.kdrv.com/content/news/Sky-Lakes-Medical-Center-targeted-in-ransomware-attack-572890331.html

North Korea-Backed Spy Group Poses as Reporters in Spearphishing Attacks, Feds Warn

The North Korean advanced persistent threat (APT) group known as Kimsuky is actively attacking commercial-sector businesses, according to an alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Kimsuky (a.k.a. Hidden Cobra) has been active since 2012 and is known for its global intelligence gathering mission. In recent campaigns, they posed as South Korean reporters and sent malicious attachments embedded in spear phishing emails to gain initial access to victim organizations. After gaining initial access, the group ultimately deployed the BabyShark malware and PowerShell or the Windows Command Shell for execution. Individuals and organizations within the target profile are recommended to increase their defenses and adopt a heightened state of awareness.

See the full report here: https://threatpost.com/north-korea-spy-reporters-feds-warn/160622/

Trump Campaign Website Defaced by Cryptocurrency Scam

Hackers took over President Trump’s 2020 election campaign website late Tuesday, replacing parts of the site with a cryptocurrency scam before returning it to its original content several minutes later. They claim to have access to classified information linking the president to the origin of the coronavirus and criminal collusion with foreign actors. The team acknowledged the hack and is working with law enforcement to investigate the source of the attack and asserting that the attackers had zero access to classified data.

See the full report here: https://threatpost.com/trump-website-defaced/160634/

Microsoft Defender ATP adds vulnerable Windows device tracking - BleepingComputer

The Microsoft Defender Advanced Threat Protection (ATP) endpoint security platform is providing users with a new report designed to help them keep track of vulnerable Windows and macOS devices within their organization's environment. The vulnerable devices report displays graphs with statistics and details on currently vulnerable device trends, making it easier for IT administrators to grasp the scope and breadth of device exposure within the organization. The report is in public preview starting today and admins can access the reports from the Microsoft Defender Security Center.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-atp-adds-vulnerable-windows-device-tracking/

QNAP warns of new QTS bugs that allow take over of devices - BleepingComputer

QNAP today announced two vulnerabilities affecting QTS, the operating system powering its network-attached storage devices that could allow running arbitrary commands. The vulnerabilities are tracked as CVE-2020-2490 and CVE-2020-2492 and classified as command injection vulnerabilities. The bugs are remotely exploitable and have been reported in versions of the software released before September 8, 2020. QNAP has fixed the issue in QTS 4.4.3.1421 build 20200907 and later versions.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-of-new-qts-bugs-that-allow-take-over-of-devices/

Maze ransomware is shutting down its cybercrime operation - BleepingComputer

The Maze cybercrime gang is shutting down its operations after rising to become one of the most prominent players performing ransomware attacks. The Maze ransomware began operating in May 2019 but became more active in November. Soon after, Maze launched a 'Maze News' site that they use to publish non-paying victims' data. The closing of operations was confirmed by a threat actor involved in the Barnes and Noble ransomware attack. As part of the conversation, he stated that Maze had stopped encrypting new victims in September 2020 and are trying to squeeze the last ransom payments from victims. This week, Maze has started to remove victims that they had listed on their data leak site. All that is left on the site are two victims and those who previously and had all of their data published.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/

Home Depot blunder emails customer order info to strangers - BleepingComputer

Multiple reports have emerged from Home Depot customers in Canada, stating that the company had sent them hundreds of emails containing order information of strangers. Multiple users received upwards of 600 "order ready for pick up" reminder emails, each on different orders. The retreived emails reveal information such as the customer's name, order number (with QR code), pick-up store address, items in the order, the payment amount, and the last four digits of the payment card number. The director of Home Depot Canada stated that they discovered a systems error on select "Homedepot[.]ca" due to which some customers received multiple emails for orders they did not place. Ths issue is now fixed and none of the emails contained passwords or un-hashed payment card information.

See the full report here: https://www.bleepingcomputer.com/news/security/home-depot-blunder-emails-customer-order-info-to-strangers/

Microsoft: Iranian attackers hacked security conference attendees - BleepingComputer

Microsoft disclosed today that Iranian state-sponsored hackers successfully hacked into the email accounts of multiple high-profile individuals and potential attendees at this year's Munich Security Conference and the Think 20 (T20) summit. Microsoft's Threat Intelligence Center (MSTIC) has linked the attacks to the Iranian-backed hacking group tracked as Phosphorus, also known as Charming Kitten, APT 35, and Magic Hound. The Phosphorus actors sent spoofed email invitations to former government officials, policy experts, academics, and leaders from non-governmental organizations by masquerading as organizers of the Munich Security or the Think 20 (T20) conferences. The attacks were part of a cyber-espionage campaign designed to collect intelligence by exfiltrating the victims' mailbox contents and contact list to the de-ma[.]online, g20saudi.000webhostapp[.]com, and ksat20.000webhostapp[.]com domains used for data harvesting. Individuals who might have been targeted in these attacks are advised to review any email-forwarding rules to find any out-of-place ones that might have been set during a successful hack of their email accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-iranian-attackers-hacked-security-conference-attendees/