Threat Intelligence Bulletin: 11/13/2020 - 11/19/2020

Breach Disclosure: 123RF

The stock photo site, 123RF, has suffered a data breach containing 8.3 million user records. This data was advertised for sale on a popular hacker forum. The customer records within the breached data contain full name, email address, MD5 hashed passwords, company name, phone number, address, PayPal email if used, and IP address. There is no financial data in the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A known data broker under the alias of "ExpertData" placed an ad on a popular hacker forum, offering the breached data for sale. Inmagine group, the owner of 123RF, have acknowledged the breach and stated that a server located at their data center was breached and the hackers "proceeded to copy the membership data." Inmagine group have also stated the database is outdated and not the latest version from 2020, however, the data does contain records dated from October 27th 2020 which could indicate the breach is recent.

Figure 1: Original post from ExpertData selling the data

Since selling the database it appears ExpertData has removed their account from the hacker forum along with all their posts. Subsequently, another user known as Gamer29 is now offering the data for sale attributing the breach to ShinyHunters, another well known hacker which has recently been selling databases for multiple companies.

Figure 2: The recent post from Gamer29 reselling the same data

Figure 3: Schema of the SQL dump from the breached database

Breach Disclosure: Cit0day

Around 23,600 databases have been leaked online from a defunct "data breach index" site after the site shut down in September of this year. The database breach data was originally served on the site Cit0day.in, which was a private service often advertised on underground forums. This site operated similar to the now shut-down sites LeakedSource and WeLeakInfo, which contained breached data of usernames and passwords and provided that to users for a small monthly fee. In total, there are around 226,883,414 unique email addresses contained in all the breached data.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This data first appeared on a popular Russian-speaking cybercrime forum, and has since been shared on other popular cybercrime forums for users to freely download. While there are millions of emails and passwords included in this dump, it appears that of the 23,000 leaked databases included, there are many small unknown sites included with most of them being a few years old. In addition, many of the sites in question contained little to no security when it comes to password hashing, with a large portion of credentials being in plaintext.

A well-known security researcher analyzed the dataset and uncovered that around 65% of the email addresses in the breach have been seen before in breached data, which results in a large number that have been compromised previously, but are just now finding out they have been compromised.

There are been collections of breached data like this shared before, with a recent notable example being the "Collection #1" dump, which included usernames and passwords from around 2000 previous data breaches, compromising of about 773 million unique email addresses and 21 million unique passwords. Collections like this can be extremely valuable to attackers for credential stuffing attacks and depending on the type of other information included, could lead to more advanced social engineering attacks.

Figure 1: Posting on Raidforums advertising dump

Figure 2: Posting on Russian hacking forum advertising dump

HiPro: Analysis of a Phishing Kit targeting Apple

HiPro is a prolific and elusive phishing kit from a group called Hijaiyh that is used to steal credentials and financial data of customers from a number of brands. The kit authors and operators are based out of South East Asia. It is hard to find HiPro kits due to a feature within the kit to self delete itself once deployed. Recently, Alpha Team obtained a fresh copy of HiPro targeting Apple. Phishing Kits targeting Apple are often used to obtain Apple ID as well as credit card information to commit fraud, utilising fake login pages and messages to create a sense of urgency of action from the potential victim. This phishing kit utilises bot/crawler detection mechanisms to avoid detection as well as its own dedicated API endpoints, and command line tool for deploying the kit. The increased complexity of this new kit evidences considerable time and resources are being put into creating them, and that production and distribution is still profitable for threat actors which further incentivises the authors to add more targets.

Recommendations

• Where possible, use conditional or risk based access policies to restrict MFA authentication to specific geo-locations
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

HiPro is a new kit authored by the same individual (under the alias of jstxx) which previously sold phishing kits titled “Hijaiyh.” Hijaiyh was sold and distributed up until early-mid 2020 at which point the authors closed their online shop and foreshadowed the release of their new kit, Hijaiyh:Pro.

Alpha Team located the new storefront for the authors of HiPro. This is where threat actors which have purchased the kit can log in to administer their deployment, or new customers can register to buy kits along with an invite code.

Figure 1: The new Hi:Pro store front

Figure 2: HiPro “ToS”

The kit contains a handful of directories and a PHP file within the root directory called “holla.” This PHP file is a command line tool for HiPro deployments, providing options to deploy the kit, view configuration, remove all traces of it from a host, upload files or even passing commands directly to the system shell such as bash.

Figure 3: “holla” CLI

HiPro loads its configuration details from the file “HiSys/config/hiconfig.ini”. The configuration options include the targeted brand, version, HiPro API servers and the mode of deployment.

Figure 4: HiPro kit configuration file

As evidenced within the source code of the kit, current targets appear to be Amazon, Apple and Spotify, with this particular kit targeting Apple.

Figure 5: Code showing current target options for Amazon, Apple and Spotify

The kit contains several PHP files with API calls to verify whether visitors are human and not automated scanners. This is done to reduce the likelihood of detection and subsequent takedown of the domain.

Figure 6: Excerpt from PHP file responsible for detecting and blocking bots or scanners

For the operator of the kit, there is an administrative panel which can be accessed via a specific URL. The panel has a login page that prompts for the operator’s HiPro store email and password in order to confirm the deployment is licensed by HiPro. Once logged in, operators can view a dashboard of the deployment along with statistics on visitors and victims.

Figure 7: HiPro admin panel login screen

Figure 8: Admin dashboard showing statistics of the deployment

The administrative panel allows actors to view victim logs, blocked IP addresses, hostnames, and user agents, as well as view their phishing site in a testing mode.

Victim workflow

When potential victims visit the site, they must both pass antibot checks which block IP addresses or user agents associated with bots/crawlers, as well as provide a specific parameter in the URL which the operator of the kit configures (e.g. hxxps://example[.]com/?signin). If these checks are passed the potential victim is presented with an identical copy of Apple’s own login portal.

Figure 9: HiPro Apple victim login portal

The first step of the phish requires site visitors to enter their Apple email address and corresponding password to proceed to the next page. If the visitor enters their credentials to the login prompt, their username and password are emailed directly to a dropper address configured by the threat actor operating the kit.

Figure 10: Code responsible for sending mail to dropper email address

The victim is then prompted with a fake security warning.

Figure 11: Possible warning messages the victim can receive after entering credentials

The next step requires the victim to enter a large amount of sensitive information including:

• Full name
• Date of birth
• Phone number
• Address
• Credit card number
• Expiry information and security code

Figure 12: Phishing page requested further PII and card details

The kit also performs localisation of verbiage based on the location of the victim. For example, site visitors from the United States, Switzerland, and Canada are required to provide their social security number in order to proceed to the next step in the victim workflow.

Figure 13: Possible wording based on visitors geographical location

If the victim clicks continue, their submitted details are checked against various APIs to ensure the card details are correct. If not, they are asked to confirm details again. If these checks pass, the data is collated and emailed to the dropper address.

Figure 14: Sample output of the email content sent to the dropper email address

The victim is then informed their “verification” is complete, before being redirected to the legitimate Apple ID login portal.

Figure 15: Final page presented to the victim before being redirected to a legitimate Apple domain

Conclusion

Phishing is a serious threat and phishing kit operators and authors are deploying new tactics to steal sensitive financial and personal information from unsuspecting victims. HiPro is currently sold and distributed via a closed marketplace. However, based on the popularity of Hijaiyh’s previous project, Alpha Team assesses with HIGH confidence that previous customers will convert to the new kit and distribution will increase over the coming months. ZeroFOX recommends implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of cyberattacks.

Breaking News: 2020-11-13 - 2020-11-19

New Jupyter malware steals browser data, opens backdoor - BleepingComputer

Russian-speaking hackers have been using new malware, named Jupyter, which is used for stealing data from Chromium, Mozilla Firefox, and Google Chrome web browsers: cookies, credentials, certificates, autocomplete information. A variant of the malware emerged during an incident response engagement in October at a University in the U.S. According to Morphisec researchers, the delivery of the stealer starts with downloading an installer (Inno Setup executable) in a ZIP archive that poses as legitimate software like Docx2Rtf and Magix Photo Manager. The installer leverages the process hollowing technique to inject into the memory of a process a .NET loader acting as the client for the command and control server. The client then downloads the next stage, a PowerShell command that executes the in-memory Jupyter .NET module. All these capabilities enable extended backdoor functions to the malware. The attack kit is highly active and the threat actors constantly add new elements to the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-jupyter-malware-steals-browser-data-opens-backdoor/

Credential-Stuffing Attack Hits The North Face

The North Face has reset its customers’ passwords after attackers launched a credential-stuffing attack against the popular outdoor outfitter’s website. In a recent data-breach notification, the company alerted the customers about an unusual activity involving its website, thenorthface.com, on October 9. Further investigation revealed that the attacker previously gained access to the email address and password from another source and subsequently used those same credentials to access the account on thenorthface.com. The exposed data included email addresses, passwords, details on purchased products, items saved to “favorites,” as well as customers’ billing addresses, shipping addresses, loyalty point totals, email preferences, first and last names, birthdays, and telephone numbers. The company has disabled all passwords from affected accounts and erased all payment-card tokens.

See the full report here: https://threatpost.com/credential-stuffing-attack-north-face/161190/

Biotech research firm Miltenyi Biotec hit by ransomware, data leaked - BleepingComputer

Biomedical and clinical research company Miltenyi Biotec suffered a malware attack that affected the firm's global IT infrastructure. Miltenyi Biotec's 2,500 employees from 28 countries are developing cell research and therapy products for clinicians and researchers who are working on covid-19 vaccines and treatments. The malware attack took place last month that disrupted the operations of the firm. The Mount Locker ransomware gang has claimed the attack earlier this month, where they leaked 5% out of the 150 GB of the company’s data on their data leak site. The company has confirmed the attack and has fully restored all the affected systems. They also informed that the customers should expect order delays caused by the temporary operational issues affecting systems during the last two weeks.

See the full report here: https://www.bleepingcomputer.com/news/security/biotech-research-firm-miltenyi-biotec-hit-by-ransomware-data-leaked/

Hacker shares 3.2 million Pluto TV accounts for free on forum - BleepingComputer

A threat actor shared the Pluto TV user database on a hacking forum containing 3.2 million user records, which has stolen during a data breach. Pluto TV is an Internet television service that lets you stream free TV shows with advertisements. The service has over 28 million members, and its mobile apps have been installed over 10 million times. The samples of the database contain a display name, email address, bcrypt hashed password, birthday, device platform, and IP address of the members. This data breach is attributed to ShinyHunters, who has been responsible for numerous data breaches and the hack of Microsoft's private GitHub repository in the past. Pluto TV has suggested its users immediately change their passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-shares-32-million-pluto-tv-accounts-for-free-on-forum/

IRS announces move to protect businesses from identity theft - BleepingComputer

Moving to protect business taxpayers from identity theft, the Internal Revenue Service (IRS) has announced that starting from December 13, it will begin masking sensitive data on business tax transcripts. Business identity theft happens when company owners or employees get impersonated by third parties in the process of committing fraud, such as illegally obtaining cash, credit, and loans, leaving the business to deal with the resulting debts. This type of identity theft occurs after fraudsters gain access to business bank accounts and credit cards or following sensitive company information theft, including but not limited to tax identification numbers (TIN) and the owners’ info. Tax professionals were informed by the IRS about this incoming identity theft protection measure beginning as part of the Nationwide Tax Forums this summer. Taxpayers were also urged by the IRS to enable multi-factor authentication (MFA) in tax preparation software to defend against data theft and hacker takeover attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/irs-announces-move-to-protect-businesses-from-identity-theft/

Retail giant Cencosud hit by Egregor Ransomware attack, stores impacted - BleepingComputer

Cencosud, one of the largest retail chains in Latin America, was hit by a ransomware attack. Cencosud is a multinational company based in Chile, having branches in Columbia, Peru, Brazil, and Argentina. With over 140,000 employees and $15 billion in revenue (2019). The perpetrators behind the attack were the Egregor ransomware group, who encrypted the devices throughout the retail outlets and impacted the operations of Cencosud. The attack caused the electronic services at Easy store in Buenos Aires, part of Cencosud, stopped accepting Cencosud Card, pickup of web purchases, and product returns. Also, printers in several stores of Easy home goods in Chile and Argentina were compromised, as they began printing out ransom notes of the attack. As of now, it’s unknown what data got stolen and how much ransom they’re demanding.

See the full report here: https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/

DarkSide ransomware's Iranian hosting raises U.S. sanction concerns - BleepingComputer

DarkSide ransomware group is building a distributed and sustainable storage system in Iran and other unrecognized republics to prevent their data leak service from being taken down. With this system, if one server gets taken down, the data will remain and be available on the other servers. In October, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) issued an advisory that warned ransomware negotiators and U.S. businesses that paying ransom could lead to sanction violations and fines. In addition to sanctions against the hacking groups, the U.S. government has sanctions against Iran. As ransom payments to DarkSide could be used to pay Iranian hosting providers for this new data leak system, the ransomware negotiation firm Coveware has placed DarkSide ransomware on an internal restricted list and will no longer facilitate ransom payments with them.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-ransomwares-iranian-hosting-raises-us-sanction-concerns/

Researchers break Intel SGX by creating $30 device to control CPU voltage

Researchers at the University of Birmingham developed a CPU voltage control tool worth $30 named VoltPillager, which could be used to break Intel Software Guard Extensions (SGX). By controlling CPU voltage using the new VoltPillager tool, researchers at the university‘s School of Computer Science were able to sidestep the security provided by Intel SGX. This research leveraged the presence of a separate voltage regulator chip to control the CPU voltage, with VoltPillager connecting to the unprotected interface and precisely controlling the voltage. The attack was found to require physical access to computer hardware and allows an attacker, if they have control of the hardware, to breach SGX security.

See the full report here: https://www.helpnetsecurity.com/2020/11/16/break-intel-sgx/

Researcher Discloses Critical RCE Flaws In Cisco Security Manager

Cisco has published multiple security advisories addressing critical flaws in Cisco Security Manager (CSM) after a security researcher publicly disclosed the proof-of-concept (PoC) code for as many as 12 security vulnerabilities. However, Cisco stated that it hasn't so far found any evidence that the flaws were exploited in the wild. These flaws affect the web interface of CSM that makes it possible for an unauthenticated attacker to achieve remote code execution (RCE) attacks. Cisco has released the 4.22 version of CSM on November 9 with many security enhancements, including support for AnyConnect Web Security WSO along with deprecating MD5 hash algorithm and DES and 3DES encryption algorithms. Users are advised to upgrade to the latest fixed versions to protect from future attacks emanating from these vulnerabilities.

See the full report here: https://thehackernews.com/2020/11/researcher-discloses-critical-rce-flaws.html

Dating Site Bumble Leaves Swipes Unsecured for 100M Users

Independent Security Evaluators researcher Sanjana Sarda has found vulnerabilities in a popular dating site and app, Bumble. The flaws allowed her to bypass paying for Bumble Boost premium services and also to access personal information for the platform’s entire user base of nearly 100 million. User information including, political leanings, astrological signs, education, and even height and weight, and their distance away in miles could be exposed by the flaws. According to the researcher, as of November 11, 2020, certain issues had been partially mitigated.

See the full report here: https://threatpost.com/dating-site-bumble-swipes-unsecured-100m-users/161276/

Attackers Target Porn Site Goers in ‘Malsmoke’ Zloader Attack

Adult website visitors are targeted in malvertising attacks that redirect them to malicious websites serving up malware. This campaign is part of a larger malvertising effort dubbed as Malsmoke. When victims click to play an adult video clip, a new browser window pops up with a grainy video, and they are redirected to various malicious pages, such as landingmonster[.]online until they land on a “decoy” porn site. The movies play for a few seconds with audio until suddenly an overlay message tells users that the “Java Plug-in 8.0 was not found.” According to the researchers, the threat actors could have designed this fake plugin update in any shape or form and developed their own utility to download a remote payload. The fake Java update (called JavaPlug-in.msi) is a digitally signed Microsoft installer, which contains several libraries and executables. An executable (lic_service.exe) is installed, which then loads HelperDll.dll. This module uses the curl library present in the MSI archive, to then download an encrypted payload (from moviehunters[.]site). That final payload Zloader injects itself into a new msiexec.exe process to contact its command and control (C2) server using a Domain Generation Algorithm (DGA). After identifying a domain that responds, the malware starts downloading additional malicious modules.

See the full report here: https://threatpost.com/attackers-porn-malsmoke-zloader-attack/161277/

Unprotected database exposed a scam targeting 100K+ Facebook accounts

Security researchers at vpnMentor discovered an ElasticSearch database exposed online that contained an archive of over 5.5 GB with information of at least 100,000 Facebook users. According to the researchers, the archive was used by crooks as part of a global hacking campaign to trick Facebook users into providing login credentials for their private accounts via a tool pretending to reveal who was visiting their profiles. The archive included emails, names, and phone numbers of the victims who had registered at a fraudulent Bitcoin site also run by the fraudsters. The fraudsters used the stolen login credentials to access Facebook accounts and share spam comments on posts. The comments all eventually led to a fake Bitcoin trading platform used to scam people out of deposits of at least €250. The day after the discovery of the unsecured database, it was likely targeted by a Meow attack, which wiped its data, and the database went offline. However, it is not clear if the exposed data was accessed or leaked by other third parties.

See the full report here: https://securityaffairs.co/wordpress/111018/cyber-crime/100k-facebook-accounts-scam.html?utm_source=rss&utm_medium=rss&utm_campaign=100k-facebook-accounts-scam

Ransomware attack forces web hosting provider Managed.com to take servers offline

Managed.com, one of the biggest providers of managed web hosting solutions, has taken down all its servers in order to deal with a ransomware attack. The attack took place on Monday, November 16, and the ransomware impacted the company's public-facing web hosting systems, resulting in some customer sites having their data encrypted. Hours after the attack, managed.com took down all its entire web hosting infrastructure, including WordPress and DotNetNuke managed hosting solutions, email servers, DNS servers, RDP access points, FTP servers, and online databases. The company is now working to identify the source of the attack and restore the affected systems.

See the full report here: https://www.zdnet.com/article/web-hosting-provider-managed-shuts-down-after-ransomware-attack/

Hackers are actively probing millions of WordPress sites - BleepingComputer

Unknown threat actors are scanning for WordPress websites with Epsilon Framework themes installed on over 150,000 sites and vulnerable to Function Injection attacks that could lead to full site takeovers. The security flaws found in themes using the Epsilon Framework could allow for site takeover through an exploit chain ending in remote code execution (RCE). These attacks use POST requests to admin-ajax.php and as such do not leave distinct log entries, though they will be visible in Wordfence Live Traffic. The vulnerable Epsilon Framework themes include Shapely, NewsMag, Activello, Illdy, Allegiant, Newspaper X, Pixova Lite, Brilliance, MedZone Lite, Regina Lite, Transcend, Affluent, Bonkers, Antreas and NatureMag Lite. Owners and admins of websites vulnerable versions of these themes are recommended to immediately update to a patched version if available. If no patch is currently available, they should switch to another theme as soon as possible to block attack attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-are-actively-probing-millions-of-wordpress-sites/

Chrome 87 released with fix for NAT Slipstream attacks, broader FTP deprecation

Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. The release fixes a new attack named NAT Slipstream that allows attackers to bypass firewalls and make connections to internal networks by tricking users into accessing malicious sites - effectively turning Chrome into a proxy for attackers. Chrome 87 will be the first browser to block NAT Slipstream attacks by blocking access to ports 5060 and 5061, which the attacker uses to bypass firewalls and network address translation (NAT) schemes. With Chrome 87, Google will now remove FTP support for half of Chrome's userbase, and the browser maker plans to disable support for FTP links altogether next year, in January, with the release of Chrome 88. The Chrome 87 release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS, and the users can update to the new version via Chrome's built-in update utility.

See the full report here: https://www.zdnet.com/article/chrome-87-released-with-fix-for-nat-slipstream-attacks-broader-ftp-deprecation/

Firefox 83 boosts security with HTTPS-Only mode, zero-day fix - BleepingComputer

Mozilla Firefox 83 was released today with a new feature called 'HTTPS-Only Mode' that secures your browsing sessions by rewriting URLs to secure HTTPS versions. If HTTPS-Only mode is enabled, Firefox will rewrite any http:// URLs that you are visiting, to their secure https:// equivalent. If Firefox cannot connect to the rewritten secure URL, it will display a "Secure Connection Not Available" error, which asks if you would like to continue to the insecure site. Mozilla has also fixed 21 vulnerabilities in Firefox 83, including a zero-day discovered by Google Project Zero. The zero-day vulnerability in Freetype used in active attacks against Google Chrome. With this release, Mozilla has fixed the "CVE-2020-15999: Heap buffer overflow in freetype" vulnerability in Firefox Linux and Android versions. Windows, Mac, and Linux desktop users can upgrade to Firefox 83 by going to Options -> Help -> About Firefox. The browser will automatically check for the new update and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-83-boosts-security-with-https-only-mode-zero-day-fix/

Coil payments platform leaks user emails in 'Privacy Policy' update - BleepingComputer

Coil, a micropayments platform used by writers and popular blogging sites to monetize content, has inadvertently exposed some of its users' email addresses in a mass email announcement. Users' email addresses were likely seen by other people listed in the To or CC fields. Coil spotted the data leak and explained the issue was due to a human error related to how they interface with their mailing list provider. Impacted customers have received an apology from the company.

See the full report here: https://www.bleepingcomputer.com/news/security/coil-payments-platform-leaks-user-emails-in-privacy-policy-update/

Cold storage giant Americold hit by cyberattack, services impacted - BleepingComputer

Americold, a leading temperature-controlled warehouses operator, has suffered a cyberattack impacting their operations, including phone systems, email, inventory management, and order fulfillment. The company determined that its computer network was affected by a cybersecurity incident on November 16, 2020, and shut down their computer systems to prevent the spread of the attack. Americold is currently investigating the issue to determine the nature and scope of the cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/cold-storage-giant-americold-hit-by-cyberattack-services-impacted/

More than 200 systems infected by new Chinese APT 'FunnyDream'

A new Chinese state-sponsored hacking group has infected more than 200 systems across Southeast Asia with malware over the past two years as part of a widespread cyber-espionage campaign carried out by a group dubbed FunnyDream. According to Bitdefender, most of these attacks have combined three malware payloads, Chinoxy, PCShare, and FunnyDream (malware after which the group was named). Chinoxy was deployed as the initial malware, acting as a simple backdoor for initial access. PCShare, a known Chinese open-source remote access trojan, was deployed via Chinoxy and was used for exploring infected hosts FunnyDream was deployed with the help of PCShare, and had advanced persistence and communication capabilities, and was used for data gathering and exfiltration. Kaspersky Lab has identified FunnyDream targets in Malaysia, Taiwan, the Philippines, and Vietnam. Both Bitdefender and Kaspersky stated that the group is still active even today and appears to be primarily interested in cyber-espionage, concentrating on stealing sensitive documents from infected hosts, focussing on national security and industrial espionage.

See the full report here: https://www.zdnet.com/article/more-than-200-systems-infected-by-new-chinese-apt-funnydream/

Chaes malware strikes customers of Latin America’s largest e-commerce platform

Security researchers have discovered a new malware, named Chaes, that is being deployed by a threat actor across the Latin American region. Researchers have stated that Brazilian customers of the area's largest e-commerce company, MercadoLivre, are the target of the info stealing malware. MercadoLivre is an Argentine company that operates online marketplaces dedicated to e-commerce and online auctions. First detected in late 2020, Chaes is spread via phishing campaigns, in which emails claim that a MercadoLivre purchase has been successful. To increase the legitimacy of the emails, the threat actors also appended a "scanned by Avast" footnote in the emails. Chaes is actively developed as the revised version of the malware more directly targets the MercadoLivre page related to e-commerce purchases. Researchers are currently exploring whether or not the Chaes malware is used in campaigns against other e-commerce companies.

See the full report here: https://www.zdnet.com/article/chaes-malware-strikes-customers-of-latin-americas-largest-e-commerce-platform/

Chinese APT10 hackers use Zerologon exploits against Japanese orgs - BleepingComputer

A Chinese state-sponsored hacking group has been observed while attempting to exploit the Windows Zerologon vulnerability in attacks against Japanese companies and subsidiaries from multiple industry sectors in 17 regions around the globe. The campaign has been attributed to the APT10 state-backed hackers based on information collected by Symantec's Threat Hunter Team after the detection of suspicious DLL side-loading activity on a customer's network. The APT10 hackers have been running this campaign for roughly an entire year, from at least mid-October 2019 to the start of October 2020. They used Zerologon exploits to steal domain credentials and take full control over the entire domain following the successful exploitation of vulnerable devices. They mainly targeted Japanese entities to steal military, intelligence, and business information.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-apt10-hackers-use-zerologon-exploits-against-japanese-orgs/

Liquid crypto-exchange says hacker accessed internal network, stole user data

Liquid, one of today's top 20 cryptocurrency exchange portals, has disclosed a security breach on Wednesday. The company said that on November 13 that a hacker managed to breach employee email accounts and pivot to its internal network. Although the intrusion was detected before the hacker stole any funds, a subsequent investigation revealed that the attacker was able to collect personal information from Liquid's database that stored user details. The stolen information included real name, home address, emails, and encrypted passwords. The company is investigating the incident and has recommended all Liquid customers to change their password and 2FA credentials at the earliest convenience.

See the full report here: https://www.zdnet.com/article/liquid-crypto-exchange-says-hacker-accessed-internal-network-stole-user-data/

Cisco fixes WebEx bugs allowing 'ghost' attackers in meetings - BleepingComputer

Cisco has fixed today three Webex Meetings security vulnerabilities that would have allowed unauthenticated remote attackers to join ongoing meetings as ghost participants. The three vulnerabilities are tracked as CVE-2020-3419, CVE-2020-3471, and CVE-2020-3441. Threat actors could leverage this flaw to become 'ghost' users that are capable of joining a meeting without being detected. The three bugs also enabled attackers to remain in the Webex meeting and maintain a bidirectional audio connection even after admins would remove them and access Webex users' information like email addresses and IP addresses from the meeting room lobby. Cisco has addressed the vulnerabilities by patching cloud-based Cisco Webex Meetings sites and releasing security updates for on-premises software such as the Cisco Webex Meetings mobile app and the Cisco Webex Meetings Server software.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-webex-bugs-allowing-ghost-attackers-in-meetings/

Egregor ransomware bombards victims' printers with ransom notes - BleepingComputer

The Egregor ransomware uses a novel approach to get a victim's attention after an attack - shoot ransom notes from all available printers. To increase public awareness of the attack and pressure a victim into paying, the Egregor operation is known to repeatedly print ransom notes from all available network and local printers after an attack. It is believed that the ransomware attackers utilize a script at the end of an attack to print out ransom notes to all available printers. This script has not been found as of yet.

See the full report here: https://www.bleepingcomputer.com/news/security/egregor-ransomware-bombards-victims-printers-with-ransom-notes/

Google Chrome bug leads to crashes on Macs with Apple CPUs - BleepingComputer

Google is currently working on fixing a known issue that causes a Google Chrome web browser version for Apple processors, to suddenly crash. Earlier today Chrome download page updated to include a new version of Chrome optimized for new macOS devices featuring an Apple processor. However, it was discovered that the version of Chrome made available for download might crash unexpectedly. This known issue should only impact Google Chrome users who have downloaded and installed the web browser today on macOS devices with an Apple M1 processor. Google has already identified a fix for this issue and is currently working on releasing a fixed Google Chrome version that will work without crashing out of the blue.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-bug-leads-to-crashes-on-macs-with-apple-cpus/

Microsoft fixes Windows Kerberos authentication issues in OOB update - BleepingComputer

Microsoft has released out-of-band optional updates to fix a known issue that causes Kerberos authentication problems on enterprise domain controllers after installing security updates released earlier this month to address CVE-2020-17049. CVE-2020-17049 is a remotely exploitable Kerberos Constrained Delegation (KCD) security feature bypass bug that exists in the way KDC determines if service tickets can be used for delegation. This issue only affects Windows Servers and Windows 10 devices and applications in enterprise environments. This OOB update can be used to mitigate the known issue on Windows Server versions 2012, 2012 R2, 2019, and 1809. IT admins are recommended to install the optional updates on Domain Controllers only if they are affected by this known issue. This out-of-band optional update is designed to address these Kerberos authentication and ticket renewal issues in Windows 10 versions in the near term.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-kerberos-authentication-issues-in-oob-update/