Threat Intelligence Bulletin: 10/30/2020 - 11/05/2020

Breach Disclosure: Promofarma

A Spanish online pharmacy chain, Promofarma, has suffered a data breach, impacting millions of customers. This data breach was put up for sale on popular hacker forums. The leaked data contains approximately 1.3 million unique customer email addresses and names. Promofarma has yet to acknowledge the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have stolen the customer data belonging to Promofarma and posted it for sale on hacker forums for an undisclosed price. According to an ad placed on a popular hacker forum the leaked data was obtained directly from the Vinny Troia servers that appeared for sale on a dark web marketplace in August last year. The leaked data consists of email addresses and md5 hashed passwords. The leaked data exposed the information of nearly 2.7 million Promofarma customers with almost 1.3 million unique customer email addresses and names.

Figure 1: Promofarma database ad on a popular hacker forum.

The leaked information includes:

• First name
• Last name
• Email addresses
• Passwords (md5 hashed)

Figure 2: Sample data from the Promofarma breach posted in an ad on a hacker forum.

Breach Disclosure: Star Tribune

The prolific hacking group ShinyHunters has compromised the newspaper Star Tribune, the largest newspaper in Minnesota. This breach contained around 1.8 million records contained in it, containing emails, usernames, passwords, birth dates, addresses and phone numbers.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

ShinyHunters continue their breach spree with the latest compromise of Star Tribune adding to their ever growing collection. Star Tribune has acknowledged this supposed breach in their newspaper and addressed customers stating that this did not contain financial information.

While Star Tribune acknowledged this breach, they stated that they are still working to confirm whether a hack took place, “We haven’t been able to verify that it happened, but we’re acting though it has. The information that the hackers alleged to have accessed is simply used by our subscribers to log on to startribune.com and read the news.”

The full schema for the data compromised is detailed below, along with ShinyHunters stating the password algorithm used by Star Tribune is bcrypt.

Figure 1: Posting of Star Tribune listing

The database has been posted for any user to download on popular hacking forums as of October 29th.

Threat Actor Update: Maze Ransomware Shuts Down Operations

On November 1, 2020, the Maze ransomware operators announced on their website that they are shutting down their ransomware operations. The news of the shutdown appeared shortly after the United States government officials warned the public about Ryuk ransomware attacks on hospitals and other healthcare providers. Since mid-September, the Maze team slowly tapered off publishing stolen data to their website, suggesting the actors were taking a break from distributing attacks, publishing stolen data, or updating the malware to handle more capabilities and functions. While the announcement indicated that Maze does not have any successors, and the so-called Maze Cartel never existed, it is rumored that affiliates of Maze are reportedly joining the Egregor ransomware operations likely suggesting that the group is merely shifting its operations elsewhere.

Alpha Team assesses that there most likely will be more consolidation of ransomware gangs within the next year, either to cash out or because they got better opportunities at larger operations. These larger operations will likely have a better Ransomware-as-a-Service (RaaS) affiliate model or require more vetting to join.

Recommendations

• In the ZeroFOX platform, enabling the Cyber Attack Chatter Rule, implementing a custom rule to monitor for any company-specific leaked technical information, adding unique domains as Independent Search Terms under relevant entities, and adding verified accounts that you would like to monitor for mentions related to cyber reconnaissance
• Keeping your security systems up to date with the latest detections
• Maintaining secure backups of all business-critical information
• Creating a robust network segmentation to help prevent lateral movement of hackers between business units

Details

On November 1, 2020, the Maze ransomware operators announced that they have completely shut down their website and attempted to dispel rumors that the "Maze Cartel" never existed, at the same time warning that any future links to their operations would be considered a scam. The official announcement also indicated that Maze’s operations were merely a demonstration of lax cyber security practices, reminding organizations to stay secure when handling clients' personal and financial data (Figure 1).

Figure 1: Maze press release. Source: Alpha Team/Cyveillance Research

Since the beginning of its almost year-long operation, Maze ransomware posed a serious threat to organizations and individuals. First discovered in late 2019 and previously known as the ChaCha ransomware, Maze initially infected victims through exploit kits and phishing campaigns before utilizing vulnerable software, such as remote desktop protocol (RDP) exploits, to distribute the malware. Most notably, Maze pioneered the use of novel extortion tactics in which it threatened to publish victims' information (or partially published such data) if they chose not to comply with the ransom demands. Such tactics have since been adopted by other ransomware families, such as Sodinokibi, Conti, Ragnar Locker, and SunCrypt and completely altered the ransomware threat landscape, making it more difficult for ransomware victims to recover from an attack.

Thus far in 2020, Maze has published stolen data from over 300 successful infections on its dedicated website. In March 2020, in light of the COVID-19 pandemic, several ransomware groups, including Maze, vowed not to target healthcare organizations until the pandemic was over. In light of the shutdown of Maze’s operations, its affiliates are reportedly joining the Egregor ransomware operations. Egregor emerged o in September 2020, and is allegedly based on the Sekhmet ransomware.

How it works

The Maze ransomware targets machines running Windows environments and is spread through infection vectors like exploited RDP endpoints, phishing emails, and exploit kits. In general, when Maze runs on a Windows machine, the malware will attempt to establish communication with a command and control location while encrypting all files on the machine using RSA-2048 encryption. Once the encryption process completes, the victim is presented with a ransom note containing instructions on how to contact the ransomware actors to pay the ransom demands. A screenshot of the Maze ransom note is displayed in Figure 2.

Figure 2: Maze ransom note. Source: Alpha Team/Cyveillance Research

Maze Cartel

In June 2020, the Maze team reportedly introduced a partnership program with other ransomware teams to publish stolen information from ransomware attacks dubbed the "Maze Cartel." The groups included within this program were LockBit ransomware, Ragnar Locker ransomware, and later SunCrypt ransomware. The launch of such partnership suggested that these ransomware groups could potentially increase profits from their attacks by working with the Maze team, who had established their ransomware as a prominent and sophisticated threat. In August 2020 security journalists interviewed members of the SunCrypt ransomware who claimed they joined the Maze Cartel because Maze operators allegedly could not handle the volume of victim extortions and needed assistance from other actors, indicating that they shared revenue from successful infections with Maze. However, according to the recent announcement by Maze, the Maze Cartel never existed claiming it was created by journalists who wrote about it.

Alpha Team Assessment

Since September, Maze has been removing victim lists from their website and closing their operations. There could be a number of factors going into their decision to close. With the security community and the news cycle being hyper-focused on ransomware infections, this could be an opportune time for some operators to jump ship with their earnings. According to Maze, some of their operators moved to other ransomware gangs. Alpha Team assesses that there most likely will be more consolidation of ransomware gangs within the next year, either to cash out or because they got better opportunities at larger operations. These larger operations will likely have a better Ransomware-as-a-Service (RaaS) affiliate model or require more vetting to join.

A recent video emerged where an alleged member of the REvil gang was interviewed by a Youtube channel.

Figure 3: Video Screenshot of Interview with Supposed REvil Member. Source: Youtube

In the video, the REvil member tells the interviewer that they have noticed the increased attention from the media and the security researcher community. This has caused them to have a more thorough vetting process for members, where they would ask questions only a native from a CIS country would know the answer to. Alpha Team has also observed potential recruiters for these gangs on vetted cybercrime forums, where they set up interviews based on toolsets used extensively by these gangs. They are also cognizant that law enforcement officials and security researchers are trying to infiltrate their group to collect information.

If this interviewer indeed found a member of the REvil gang, it has given valuable insight into the modus operandi of the REvil gang as well as other ransomware gangs. Maze most likely shares the same paranoia that REvil has, due to their common threat models.

Breach Disclosure: Minted

Minted, the US-based marketplace for independent artists experienced a data breach back in May of this year, exposing the data of 5 million user records. As with numerous breaches lately, ShinyHunters was the group responsible for this breach and posted it to a popular hacking forum for free on October 29th.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Minted had acknowledged this data breach back in May, around the time when this breach happened, which according to Minted's data breach notification occurred on May 6th, 2020. Minted stated that the information disclosed included customer names, email addresses, hashed and salted passwords using bcrypt, telephone numbers, billing addresses, shipping addresses, and in some cases date of birth.

Figure 1: Schema and samples of Minted user data

Earlier this week, ShinyHunters uploaded two other breaches, PromoFarma.com and Star Tribune to add to their ever-growing collection of breaches collected from earlier this year.

Breach Disclosure: Wongnai

A Thailand based hospitality and restaurant discovery service suffered a data breach earlier this year, impacting millions of customers. This breach was published for sale on a popular hacker forum by a data broker along with other breached databases. The leaked data contains names, phone numbers, social media IDs and MD5 password hashes.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have stolen the customer data belonging to Wongnai and posted it for sale on a popular hacker forum via a data broker under the alias of ExpertData. The price is undisclosed and marked as "Limited sales" in order to drive interest. There is currently no indication as to how this data was obtained but the leak contains 4.3 million records of customer information. Wongnai have acknowledged the data leak and have confirmed that impacted customers have been contacted via email.

Figure 1: Wongnai database advertised for sale on a popular hacker forum.

The leaked information includes:

• Full name
• Phone number
• Email addresses
• Passwords (md5 hashed)
• Facebook ID's
• Twitter ID's
• Google ID's
• Zip codes
• Gender
• Date of birth
• IP Addresses

Figure 2: Sample data obtained by Alpha Team containing customer PII.

The author of the thread, ExpertData, has previously sold other databases on the hacker forum targeting GoNitro and HelloTravel and has also obtained a reputabe data broker status within the community.

Figure 3: Other threads from ExpertData.

Breach Disclosure: James Delivery

A Brazilian delivery service, "James Delivery", has suffered a data breach, impacting over a million customers. This data breach was put up for sale on a popular hacker forum. The leaked data contains approximately 1.5 million unique customer email addresses and BCRYPT hashed passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The hacker under the alias of ShinyHunters has stolen the customer data belonging to James Delivery and posted it for sale on a popular hacker forum. According to the ad placed on the hacker forum, there are over 1.6 million rows of data including customer email address, backup email address, device information and the BCRYPT hash of their password.

Figure 1: JamesDelivery database ad on a popular hacker forum.

Figure 2: Sample data from the JamesDelivery breach posted in an ad on a hacker forum.

The threat actor which authored the thread known as "ShinyHunters" has recently been involved in multiple other data breaches and subsequent selling of customer data and has gathered a reputable status within the marketplace.

Figure 3: Profile of the threat actor known as ShinyHunters

Figure 4: Some recent threads by ShinyHunters

Breaking News: 2020-10-30 - 2020-11-05

Firestarter Android Malware Abuses Google Firebase Cloud Messaging

The DoNot APT threat group is leveraging the legitimate Google Firebase Cloud Messaging server as a command-and-control (C2) communication mechanism. It uses a new Android malware loader, dubbed Firestarter which uses Firebase Cloud Messaging (FCM), a cross-platform cloud solution for messages and notifications for Android, iOS, and web applications, to bypass detection. Users are lured to install a malicious app on their mobile device, likely done via direct messages that utilize social engineering. Once the application is downloaded and installed, users are prompted with a message that the application is not supported, and that uninstallation is in progress. After uninstalling, the icon is removed from the user interface, but the app runs in the background to download a payload using FCM. The APT is focused mainly on India and Pakistan and is known for targeting Pakistani government officials and Kashmiri non-profit organizations.

See the full report here: https://threatpost.com/firestarter-android-malware-google-firebase-cloud/160800/

FBI: How Iranian hackers stole voter info from state election sites - BleepingComputer

DHS CISA and the FBI have shared detailed information on the tactics and techniques Iranian state-sponsored hacking group used to harvest voter registration info from U.S. state websites, including election sites. According to the advisory, the attempts to download voter info from election websites took place between September 29 and October 17, 2020. This included exploitation of known vulnerabilities such as directory traversal, Structured Query Language (SQL) injection, web shell uploads, and leveraging unique flaws in websites. The harvested data was later used fake Proud Boys voter intimidation emails that targeted Democratic voters attempting to convince them to vote for President Trump. Further evaluation revealed that the attacks on U.S. state election websites were an intentional effort to influence and interfere with the 2020 U.S. presidential election.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-how-iranian-hackers-stole-voter-info-from-state-election-sites/

Microsoft warns of ongoing attacks using Windows Zerologon flaw - BleepingComputer

Microsoft today warned that threat actors are continuing to actively exploit systems unpatched against the ZeroLogon privilege escalation vulnerability in the Netlogon Remote Protocol (MS-NRPC). Microsoft has received a small number of reports from customers and others about continued activity exploiting a vulnerability CVE-2020-1472 that was previously addressed in security updates starting on August 11, 2020. Microsoft has recommended customers to apply the update and follow the original guidance as described in KB4557222 to ensure they are fully protected from this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-ongoing-attacks-using-windows-zerologon-flaw/

Google discloses Windows zero-day exploited in the wild

Security researchers from Google have disclosed today a zero-day vulnerability in the Windows operating system that is currently under active exploitation. The Windows zero-day tracked as CVE-2020-17087 was used as part of a two-punch attack, together with another a Chrome zero-day tracked as CVE-2020-15999. The Chrome zero-day was used to allow attackers to run malicious code inside Chrome, while the Windows zero-day was the second part of this attack, allowing threat actors to escape Chrome's secure container and run code on the underlying operating system. The Windows zero-day is a bug in the Windows kernel that can be exploited to elevate an attacker's code with additional permissions. Per the report, the vulnerability impacts all Windows versions between Windows 7 and the most recent Windows 10 release. Proof of concept code to reproduce attacks is also available. The Chrome zero-day was patched in Chrome version 86.0.4240.111. The Windows zero-day is expected to be patched on November 10, which is the date of Microsoft's next Patch Tuesday.

See the full report here: https://www.zdnet.com/article/google-discloses-windows-zero-day-exploited-in-the-wild/

New Wroba Campaign Is Latest Sign of Growing Mobile Threats

Kaspersky's threat-monitoring systems had detected malware known as the Wroba Trojan, which targets Android and iOS device owners in the US with a fake package delivery notification. Android device users who click on a link in the notification are taken to a malicious site with an alert that warns users about their mobile browser being out of date and needing to be updated. Users who tricked into clicking the "OK" button end up installing the malware on their device. This download does not work on iPhones. So, iPhone users are redirected to a phishing page designed to look like Apple's login page, which attempts to steal their Apple ID credentials. Once Wroba is installed on a device, it carries out various malicious activities. That includes sending fake SMS messages, checking installed packages, accessing financial transaction data, stealing the user's contact list, and serving up phishing pages for stealing credentials, including those associated with bank accounts. It utilizes unusual techniques to hide its communication with its C2 server, like using MessagePack format and DES encryption to send the data. Wroba can also update its list of C2 servers with the help of the information in social media accounts.

See the full report here: https://www.darkreading.com/mobile/new-wroba-campaign-is-latest-sign-of-growing-mobile-threats/d/d-id/1339339

Emotet malware wants to invite you to a Halloween party - BleepingComputer

In a new Emotet campaign, the attackers are targeting potential victims with emails purporting to be an invitation to a Halloween party. The subjects and text of the Halloween-themed emails vary but, the general idea is inviting the targets to a Halloween party, with all the details in the attached malicious document. If a user opens the attachment, the "Enable Editing" and "Enable Content" options are prompted, and when clicked, will install the Emotet Trojan on the victim's computer. People are urged to remain vigilant and verify their emails before interacting with them as attackers attempt to take advantage of the trick-or-treating festivities.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-wants-to-invite-you-to-a-halloween-party/

Over 1M Lazada RedMart accounts sold online after data breach - BleepingComputer

Singapore's largest online grocery store Lazada Redmart has suffered a data breach impacting 1.1 million user accounts. The hackers claim to have obtained Lazada's MongoDB-based data set with data from over 1.1 million RedMart accounts. The database dump, containing sensitive customer information, including email addresses, SHA-1 hashed passwords, first and last name, phone numbers, mailing addresses, billing addresses, partial credit card numbers, and expiration dates, is put up for sale on a hacker forum, priced at $1,500. On October 29th, Lazada notified the impacted customers and claims that the data exposed in the breach is 18 months old. As a safety precaution, RedMart has reset the passwords on all accounts and will prompt the users to change it the next time they login. RedMart users are urged to change their password on any other sites utilizing the same one as used on RedMart.

See the full report here: https://www.bleepingcomputer.com/news/security/over-1m-lazada-redmart-accounts-sold-online-after-data-breach/

CERT/CC launches Twitter bot to give security bugs random names

The CERT/CC team has launched a Twitter bot that will assign random and neutral names to every security bug that receives a CVE identifier. The bot named Vulnonym, operated by the CERT Coordination Center (CERT/CC) at the Carnegie Mellon University, is the first-ever CERT team created, and now a collaborator and partner of the DHS' official US-CERT team. In a blog post on Friday, the CERT/CC team decided to put forward a solution to set some order in vulnerability naming. The Vulnonym bot will assign a two-word codename in the format of adjective-noun to every newly named CVE ID. Leigh Metcalf, a member of the CERT/CC team, said that their goal is to create neutral names that provide a means for people to remember vulnerabilities without implying how scary (or not scary) the particular vulnerability in question is.

See the full report here: https://www.zdnet.com/article/certcc-launches-twitter-bot-to-give-security-bugs-random-names/

NetMarketShare ends browser war reports due to Google Chrome changes - BleepingComputer

Starting November 1, NetMarketShare plans to shut down its public browser share reporting tool following a recent change proposed by Google. On its website, the company stated that Google's "User Agent Client Hints" will break NetMarketShare's device detection technology, causing inaccuracies for a long period. Google stated that moving Chrome to a new system will reduce the complexity of updating User-Agent strings and improve the privacy of users. User Agent is a string that is used to find out information about your browser and operating system for statistical purposes. Net Applications, the owners of NetMarketShare, has promised that NetMarketShare will re-emerge at some point with a focus on e-commerce trends and verifiable user data, but for now, no new data will be released and October 2020 stats are the final numbers.

See the full report here: https://www.bleepingcomputer.com/news/software/netmarketshare-ends-browser-war-reports-due-to-google-chrome-changes/

Beware a New Google Drive Scam Landing in Inboxes

In a new phishing campaign, the attackers are using Google Drive lures to trick victims into visiting malicious sites. The attackers are exploiting flaws in Google Drive to send out legitimate emails and push notifications from Google. On mobile, the scam uses the collaboration feature in Google Drive to generate a push notification inviting people to collaborate on a document. If tapped, the notification redirects to a document that contains a large, tempting link. An email notification created by the scam, which comes from Google, also contains potentially malicious links. People targeted by the scam receive Google Drive notifications and emails in Russian or broken English asking them to collaborate on documents that contain malicious links. A Google spokesperson stated that Google is working on new measures to make it harder for Google Drive spam to evade its systems. Anyone targeted by the scam can report it to Google via the company’s support page.

See the full report here: https://www.wired.co.uk/article/google-drive-spam-comments-phishing

US Cyber Command exposes new Russian malware

US Cyber Command has exposed eight new malware samples, six of which are for the ComRAT malware (used by the Turla hacking group), while the other two are samples for the Zebrocy malware (used by the APT28 hacking group), that were developed and deployed by Russian hackers in recent attacks. US Cyber Command's Cyber National Mission Force (CNMF) has uploaded samples of the new ComRAT and Zebrocy versions on its VirusTotal account. The Cybersecurity and Infrastructure Security Agency (CISA), in cooperation with the Federal Bureau of Investigation's CyWatch have published two security advisories describing ComRAT and Zebrocy's inner workings. The joint US government advisory was published on Halloween. The purpose of this recent US government exposé is to share recent versions of these hacking tools with the general public so system administrators and other defenders can add detection rules and update protective measures.

See the full report here: https://www.zdnet.com/article/us-cyber-command-exposes-new-russian-malware/

Gold seller JM Bullion hacked to steal customers' credit cards

Precious metal online retailer JM Bullion has disclosed a data breach after their site was hacked to include malicious scripts that stole customers' credit card information. On July 6, 2020, JM Bullion was alerted to suspicious activity on its website. The company worked with a third-party forensic specialist and determined that malicious code was present on the website. This type of compromise is known as a MageCart attack and consists of hackers compromising a website to inject malicious JavaScript scripts into various web site sections. These scripts wait for payment information to be entered by the customer, which is then stolen and sent to a remote server under the hacker's control. As part of this breach, attackers could steal customers' names, addresses, and payment card information, including the account number, expiration date, and security codes. The malicious code was removed from the site on July 17th, 2020, and JM Bullion notified law enforcement, their credit card processor, and all impacted credit card brands. All customers who made purchases on JM Bullion's site between February 18th, 2020, to July 17th, 2020, should monitor their credit card statements for fraudulent activity.

See the full report here: https://www.bleepingcomputer.com/news/security/gold-seller-jm-bullion-hacked-to-steal-customers-credit-cards/

Malicious npm package opens backdoors on programmers' computers

A malicious JavaScript library, named Twilio-npm, has been removed by the npm security team as it contained malicious code for opening backdoors on programmers' computers. According to Sonatype, who discovered the malicious library, the code found in the fake Twilio library opened a TCP reverse shell on all computers where the library was downloaded and imported inside JavaScript/npm/Node.js projects. The reverse shell opened a connection to "4.tcp.ngrok[.]io:11425" from where it waited to receive new commands to run on the infected users' computers. The npm security team stated that any computer that has this package installed or running should be considered fully compromised. the npm team also added that all secrets and keys stored on the compromised computer should be rotated immediately from a different computer.

See the full report here: https://www.zdnet.com/article/malicious-npm-package-opens-backdoors-on-programmers-computers/

Google patches second Chrome zero-day in two weeks

Google has released a security update for its Chrome web browser that addresses ten security bugs, including one zero-day vulnerability. Identified as CVE-2020-16009, the zero-day was discovered by Google's Threat Analysis Group (TAG) and is currently actively exploited in the wild. Chrome users are advised to update their browser to version 86.0.4240.183 or later as soon as possible to eliminate future risks.

See the full report here: https://www.zdnet.com/article/google-patches-second-chrome-zero-day-in-two-weeks/

GitHub threatens to ban users who bypass YouTube-dl takedown - BleepingComputer

On October 23rd, 2020, GitHub removed the source code repositories for YouTube-dl after the Recording Industry Association of America, Inc. (RIAA) filed a DMCA infringement notice. Since then, annoyed users have been creating new repositories containing the YouTube-dl source code. Hence, GitHub has issued a notice warning users that their accounts could be banned if they continue to upload content that was removed due to DMCA takedown notices. GitHub's warning notice reads, "Please note that re-posting the exact same content that was the subject of a takedown notice without following the proper process (outlined below) is a violation of GitHub’s DMCA Policy and Terms of Service. If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well."

See the full report here: https://www.bleepingcomputer.com/news/software/github-threatens-to-ban-users-who-bypass-youtube-dl-takedown/

Hacker group uses Solaris zero-day to breach corporate networks

A threat actor called UNC1945 used a zero-day vulnerability in the Oracle Solaris operating system as part of its intrusions into corporate networks. According to FireEye, the threat actors compromise telecommunications companies and operate against a tailored set of targets within the financial and professional consulting industries by leveraging access to third-party networks. FireEye Mandiant believes that UNC1945 bought the EVILSUN tool to exploit the Solaris zero-day and plant the SLAPSTICK backdoor from a public hacking forum. Tracked as CVE-2020-14871, the group targeted a zero-day vulnerability in the Solaris Pluggable Authentication Module (PAM)to bypass authentication procedures and install a backdoor named SLAPSTICK on internet-exposed Solaris servers. The hackers then used this backdoor as an entry point to launch reconnaissance operations inside corporate networks and move laterally to other systems. To avoid detection, the group downloaded and installed a QEMU virtual machine running a version of the Tiny Core Linux OS. This custom-made Linux VM came pre-installed with several hacking tools that allowed them to scan a company's internal network for weaknesses and move laterally to multiple systems, regardless of Windows or NIX-based systems. CVE-2020-14871 was patched last month in Oracle's October 2020 security patches.

See the full report here: https://www.zdnet.com/article/hacker-group-uses-solaris-zero-day-to-breach-corporate-networks/

Russian jailed for eight years in the US for writing code that sifted botnet logs for web banking creds for fraudsters

A Russian programmer was sentenced to eight years in prison in the United States for joining a large cybercrime network that hacked and leaked victims’ bank accounts. Alexandre Brofko, 36, was arrested in the Czech Republic in 2019 and handed over to the United States after a lengthy investigation of Russia’s hacking ring. According to the US government, he was a member of an elite online forum designed for Russian-speaking cybercriminals to collect and exchange tools and services for the crime. Brofko accessed thousands of hacked PCs, all remotely controlled by malware, and also collected user usernames and passwords from those computers. Brovko was tasked with sieving these botnet logs for malware-vacuated internet banking credentials. These credentials were then used by fellow conspirators to steal millions of dollars from American accounts in fraudulent transfers.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/11/02/botnet_brovko_jailed/

Oracle publishes rare out-of-band security update for WebLogic servers

Oracle has published a rare out-of-band security update to address an incomplete patch for a recently disclosed vulnerability in Oracle WebLogic servers that is currently being actively exploited in real-world attacks. The new patch addressing CVE-2020-14750 adds additional fixes to a first bug, tracked as CVE-2020-14882, patched with Oracle's standard quarterly October 2020 security updates. CVE-2020-14882 is a dangerous vulnerability that allows attackers to execute malicious code on an Oracle WebLogic server with elevated privileges before the server's authentication. An attacker only needs to send a booby-trapped HTTP GET request to the WebLogic server's management console to exploit the vulnerability. Companies that run WebLogic servers are advised to install the additional CVE-2020-14750 patch to protect from both the original CVE-2020-14882 exploit and its bypass.

See the full report here: https://www.zdnet.com/article/oracle-publishes-rare-out-of-band-security-update-for-weblogic-servers/

Toy maker Mattel discloses ransomware attack

US toymaker Mattel disclosed a ransomware attack that impacted some of its business functions. The cyberattack took place on July 28, according to a 10-Q quarterly form the company filed with the US Securities Exchange Commission. Mattel stated that the ransomware attack was initially successful and resulted in the successful encryption of some of its systems. After discovering the attack, Mattel immediately took measures to stop the attack and restore impacted systems. The company says it recovered from the attack with no significant financial losses.

See the full report here: https://www.zdnet.com/article/toy-maker-mattel-discloses-ransomware-attack/

New RegretLocker ransomware targets Windows virtual machines - BleepingComputer

RegretLocker, a new ransomware that uses a variety of advanced features that allows it to encrypt virtual hard drives and close open files for encryption, was discovered in October 2020. RegretLocker is a simple ransomware that uses email for communication rather than a Tor payment site. The virtual hard disk files contain a raw disk image, including a drive's partition table and partitions, and like regular disk drives, can range in size from a few gigabytes to terabytes. When the ransomware encrypts files on a computer, it is not efficient to encrypt a large file as it slows down the entire encryption process's speed. RegretLocker uses an intriguing technique of mounting a virtual disk file so that it can encrypt each of the files individually. To do this, RegretLocker uses the Windows Virtual Storage API OpenVirtualDisk, AttachVirtualDisk, and GetVirtualDiskPhysicalPath functions to mount virtual disks. According to the researchers, RegretLocker is not very active at this point.

See the full report here: https://www.bleepingcomputer.com/news/security/new-regretlocker-ransomware-targets-windows-virtual-machines/

WordPress Pushes Out Multiple Flawed Security Updates

The day after WordPress pushed out a critical 5.5.2 security update, patching a remote code execution bug and nine additional flaws, it was forced to push out a second update and then a third 5.5.3 update. The hiccup is tied to the WordPress auto-update feature that accidentally started sending 455 million websites a WordPress update (5.5.2) that caused new WordPress installs to fail. After realizing the error, it put the brakes on the rollout and inadvertently triggered an Alpha version of WordPress to be downloaded to some customers.

See the full report here: https://threatpost.com/wordpress-flawed-security-updates/160849/

Folksam data breach leaks info of 1M Swedes to Google, Facebook, more - BleepingComputer

Swedish insurance company Folksam has reported a data breach impacting approximately one million Swedes after sharing customers' personal information with multiple technology giants, including Facebook, Google, Microsoft, Linkedin, and Adobe. The company shared customer data to analyze what information logged-in customers and other visitors searched for on Folksam's website. Analysis results of shared data were used by the tech giants to provide customers with custom offers through Folksam's and other companies' communication channels. The sensitive personal data shared by Folksam includes various types of info such as social security numbers or that an individual purchased union or pregnancy insurance. The breach was identified after an internal audit, following which Folksam immediately stopped sharing the sensitive information with its digital partners and requested the information be deleted by the companies which received it. Folksam says that there is no evidence of misuse of the shared data by any third parties.

See the full report here: https://www.bleepingcomputer.com/news/security/folksam-data-breach-leaks-info-of-1m-swedes-to-google-facebook-more/

SaltStack reveals new critical vulnerabilities, patch now - BleepingComputer

SaltStack, a VMware-owned company, has revealed critical vulnerabilities impacting Salt versions 3002 and prior. Salt is an open-source IT infrastructure management solution written in Python that is widely used by data centers around the world. The three vulnerabilities are tracked as CVE-2020-16846, CVE-2020-25592, and CVE-2020-17490. Two of these vulnerabilities are rated as high/critical and the other is rated low based on the Common Vulnerability Scoring System (CVSS). Shodan results reveal that over 6,000 Salt Master nodes exposed to the internet, not all of which may be running the latest, patched versions. The vulnerabilities are fixed in versions 3002.1, 3001.3, and 3000.5. The patches are also made available for older versions, such as 2019.x.

See the full report here: https://www.bleepingcomputer.com/news/security/saltstack-reveals-new-critical-vulnerabilities-patch-now/

Configuration snafu exposes passwords for two million marijuana growers

GrowDiaries, an online community where marijuana growers can blog about their plants and interact with other farmers, has suffered a security breach in September 2020. The breach occurred after the company left two Kibana apps exposed on the internet without administrative passwords. The two exposed Kibana apps granted attackers access to two sets of Elasticsearch databases, with one storing 1.4 million user records and the second holding more than two million user data points. The first exposed usernames, email addresses, and IP addresses, while the second database exposed user articles posted on the GrowDiaries site and users' account passwords stored in an MD5 hash format, a hashing function known to be insecure and trackable. A security researcher has reported the exposed Kibana apps to GrowDiaries, following which the company secured its infrastructure.

See the full report here: https://www.zdnet.com/article/configuration-snafu-exposes-passwords-for-two-million-marijuana-growers/

After two zero-days in Chrome desktop, Google patches a third zero-day in the Android version

Google has released security updates for the Chrome for Android browser to fix a zero-day vulnerability that is currently exploited in the wild. The vulnerability tracked as CVE-2020-16010, a heap buffer overflow vulnerability in the Chrome for Android user interface (UI) component. According to Google, the bug exploited to allow attackers to bypass and escape the Chrome security sandbox on Android devices and run code on the underlying OS. Chrome for Android version 86.0.4240.185 fixes this vulnerability.

See the full report here: https://www.zdnet.com/article/after-two-zero-days-in-chrome-desktop-google-patches-a-third-zero-day-in-the-android-version/

REvil ransomware gang 'acquires' KPOT malware

The operators of the REvil ransomware strain have acquired the source code of the KPOT trojan in an auction held on a hacker forum last month. According to a researcher, the sale was organized as a public auction on a private underground hacking forum for Russian-speaking cybercriminals. The only bidder was UNKN, a well-known member of the REvil (Sodinokibi) ransomware gang who paid the initial asking price of $6,500, while other forum members declined to participate, citing the steep asking price. The KPOT trojan was first spotted in 2018, is a classic information stealer that can extract and steal passwords from various apps on infected computers. This includes web browsers, instant messengers, email clients, VPNs, RDP services, FTP apps, cryptocurrency wallets, and gaming software.

See the full report here: https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/

Cisco discloses AnyConnect VPN zero-day with public PoC exploits - BleepingComputer

Cisco has disclosed a zero-day vulnerability in the Cisco AnyConnect Secure Mobility Client software with the public availability of proof-of-concept exploit code. The high severity vulnerability tracked as CVE-2020-3556 exists in the interprocess communication (IPC) channel of the Cisco AnyConnect Client, and it may allow authenticated local attackers to execute malicious scripts via a targeted user. The vulnerability affects all AnyConnect client versions for Windows, Linux, and macOS with vulnerable configurations. A vulnerable configuration requires both the Auto Update setting and Enable Scripting setting to be enabled. Successful exploitation also requires active AnyConnect sessions and valid credentials on the targeted device. Cisco is working on addressing the zero-day, with a fix coming in a future AnyConnect client release. However, the vulnerability can be mitigated by disabling the Auto-Update feature.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-discloses-anyconnect-vpn-zero-day-exploit-code-available/

23,600 hacked databases have leaked from a defunct 'data breach index' site

More than 23,000 hacked databases have been made available for download on several hacking forums and Telegram channels. The database collection is said to have originated from Cit0Day[.]in, a private service advertised on hacking forums to other cybercriminals. It is unclear if the site creator, Xrenovi4 leaked the data themselves or if the data was hacked by a rival gang, wherein Cit0day's entire collection of hacked databases was provided as a free download on a well-known forum for Russian-speaking hackers last month. In total, 23,618 hacked databases were provided for download via the MEGA file-hosting portal. The link was live only for a few hours before being taken down following an abuse report. Most of the hacked databases included in the Cit0day dump are old and come from sites that have been hacked years ago.

See the full report here: https://www.zdnet.com/article/23600-hacked-databases-have-leaked-from-a-defunct-data-breach-index-site/

Japanese game dev Capcom hit by cyberattack, business impacted

Japanese game developer Capcom has disclosed that they suffered a cyberattack over the weekend that is impacting business operations, including email systems. Capcom stated that they began experiencing issues with their file and mail servers on the morning of November 2nd, 2020. After determining it was a cyberattack, they halted portions of their corporate network to prevent the attack's spread. The company has confirmed that the attack was due to unauthorized access carried out by a third party. The attack has not affected connections for playing the company's games online or access to its various websites.

See the full report here: https://www.bleepingcomputer.com/news/security/japanese-game-dev-capcom-hit-by-cyberattack-business-impacted/

Police launch pilot program to tap resident Ring camera live streams

Law enforcement in Jackson, Mississippi has launched a pilot program that allows officers to tap into private surveillance devices during criminal investigations. The pilot program uses technology provided by Pileum and Fusus, an IT consultancy firm and a provider of a cloud-based video, sensor, and data feed platform for the law enforcement market. However, if the scheme is considered successful, residents could then be encouraged to submit their own cameras to the pool, drastically expanding the surveillance capabilities of local law enforcement. Once a crime is reported, police will be able to "access cameras in the area" to examine elements such as potential escape routes or in order to track getaway vehicles. Although this trial is made available free of cost, it may raise privacy concerns.

See the full report here: https://www.zdnet.com/article/police-launch-pilot-program-to-tap-ring-smart-camera-live-streams/

QBot phishing lures victims using US election interference emails - BleepingComputer

The Qbot botnet is now spewing U.S. election-themed phishing emails used to infect victims with malicious payloads designed to harvest user data and emails for use in future campaigns. Malwarebytes Labs' Threat Intelligence Team spotted malspam emails that are camouflaged as replies in previously stolen email threads a tactic used to add legitimacy in the targets' eyes. Each of the phishing messages come with malicious Excel spreadsheet attachments disguised as secure DocuSign file allegedly containing information related to election interference. This new template has been adopted to abuse the public's concerns regarding the 2020 US elections' outcome and to make it easier for the threat actors to lure potential victims into opening bait documents and enabling macros used to drop malware payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-phishing-lures-victims-using-us-election-interference-emails/

As Maze retires, clients turn to Sekhmet ransomware spin-off Egregor

As the developers of the Maze ransomware announce their exit from the malware scene, clients are now thought to be turning to Egregor as a substitute. According to an analysis conducted by Appgate, Egregor has been active since mid-September this year, and in this time, has been linked to alleged attacks against organizations including GEFCO and Barnes & Noble. Egregor has also been associated with the Ransomware-as-a-Service (RaaS) model, in which customers can subscribe for access to the malware. According to sample ransom notes, once a victim has been infected and their files encrypted, operators demand that they establish contact over Tor or a dedicated website to organize payment. Furthermore, the note threatens that if a ransom is not paid within three days, stolen data will be made public.

See the full report here: https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/