Threat Intelligence Bulletin: 11/27/2020 - 12/03/2020

Post-Black Friday Phishing Continues Targeting Postal Services

Black Friday and holiday sales periods continue to be a popular time for phishing scams, with a spike in mail delivery or redirection type scams in the months of November through December. Alpha Team has been tracking active phishing campaigns targeting mail delivery services and their customers. Common tactics include confirming a mail redirection request and demanding a fee to be paid before delivery can continue. It is likely that the uptick of these scams will continue through December due to the increased reliance on mail delivery during the holidays and the pandemic.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Postal delivery services and couriers such as DHL, DPD and Royal Mail have seen a large spike in phishing campaigns targeting their brands over the month of November 2020. With an increase in people ordering online due to the pandemic, phishing attacks have been even more focused this year. Over the month of November, Alpha Team collected dozens of unique phishing kits and hundreds of URLs targeting these brands to analyse their contents and identify TTPs being used by threat actors performing this type of phishing scam.

Figure 1: Phishing page targeting DHL

E-mail remains the primary method of distributing phishing domains and luring victims, with senders consisting of a mix of commercial mailing list providers, compromised accounts and specially created email addresses from free mailbox providers. Phishing threat actors will often change the accounts display name to try and fool potential victims.

Figure 2: A compromised hotmail account sent mail as “DPD Local”

These types of phishing attacks will often pressure victims into clicking links and entering their bank details by informing them a package is unable to be delivered until they pay a fee, and their package will be returned unless they comply quickly.

Figure 3: DHL phishing page asking for a fee to be paid

Attackers are also using sophisticated techniques to ensure their phishing page is undetected for as long as possible. Alpha Team has observed multiple phishing campaigns using services such as Cloudflare and CAPTCHA forms, alongside PHP scripts designed to detect and block web crawlers.

Figure 4: Excerpt of “anti-bot” code designed to block specific IP ranges

With multi-factor authentication becoming more common, attackers are adapting their phishing kits and techniques to try and capture this information for fraudulent purposes.

Figure 5: Phishing page asking for SMS codes sent to the victims mobile

Attackers exfiltrate victim information using several different methods including the use of dropper e-mail addresses, log files and Telegram bots in order to provide redundancy, just in case their e-mail or website are banned before they collect victim data.

Figure 6: PHP function designed to save victim data to a local file and post to a Telegram channel

These types of phishing attacks are very common for the Black Friday and holiday season, continuing into the New Year sales season. Victims of these campaigns quickly fall victim to fraud as operators react swiftly to compromised details. With the added stress of a pandemic, fraudsters will likely continue to abuse mail courier companies to take advantage of the sense of urgency when delivering packages and goods.

Breaking News: 2020-11-27 - 2020-12-03

CBS Last.fm fixes admin password leakage via Symfony profiler - BleepingComputer

This week, British music streaming service Last.fm fixed a credential leakage issue that revealed admin username and password and allowed an attacker to access user account details. The leak had occurred due to a misconfigured PHP Symfony app running in "debug" mode and exposing profiler logs. When running in debug mode, apps exposed data that should remain hidden from the public view, to make troubleshooting easier for developers. If misused, these leaked credentials could allow attackers to query each and every Last.fm user for critical information. The Last.fm's Symfony Profiler logs exposed multiple administrator usernames, passwords, and secret tokens.

See the full report here: https://www.bleepingcomputer.com/news/security/cbs-lastfm-fixes-admin-password-leakage-via-symfony-profiler/

Phishing lures employees with fake 'back to work' internal memos - BleepingComputer

Scammers are trying to steal email credentials from employees by impersonating their organization's human resources (HR) department in phishing emails camouflaged as internal 'back to work' company memos. Security researchers at Abnormal Security have uncovered this phishing campaign wherein phishing messages have managed to land in thousands of targeted individuals' mailboxes after bypassing G Suite email defenses. Phishing emails spoof the victims' company mail service and are designed to look like automated internal company memos with attached voicemails. The emails come with custom HTML attachments with each employee's name, that when opened, the targets are sent to a Sharepoint document with details about remote working policy changes and an acknowledgment link at the bottom. If the recipients fall victim to this attack, the login credentials for their email account will be compromised, and the attackers will gain access to sensitive corporate and personal information.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-lures-employees-with-fake-back-to-work-internal-memos/

Drupal issues emergency fix for critical bug with known exploits - BleepingComputer

Drupal has released emergency security updates to address a critical vulnerability with known exploits that could allow for arbitrary PHP code execution on some CMS versions. The vulnerability is caused by two bugs in the PEAR Archive_Tar library used by the content management system (CMS) tracked as CVE-2020-28948 and CVE-2020-28949. The critical Drupal code execution vulnerability can be exploited if the CMS is configured to allow and process .tar, .tar.gz, .bz2, or .tlz file uploads. Multiple Drupal security updates were issued to fix the bug and to allow admins to quickly patch their servers to protect them from potential attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/drupal-issues-emergency-fix-for-critical-bug-with-known-exploits/

MasterChef, Big Brother producer hit by DoppelPaymer ransomware - BleepingComputer

French multinational production and distribution firm Banijay Group SAS was hit earlier this month by a DoppelPaymer ransomware attack and had sensitive information stolen by the ransomware operators during the incident. The company acquired Endemol Shine Group in July 2020 and has now become home to more than 120 production companies across 22 territories. Banijay's brand list includes MasterChef, Survivor, Big Brother, The Kardashians, Mr. Bean, Black Mirror, Extreme Makeover: Home Edition, and Deal or No Deal among many others. The company is currently investigating the incident involving the pre-existing Endemol Shine Group and Endemol Shine International networks. It is believed that certain personal data of current and ex-employees may have been compromised, as well as commercially sensitive information. The DopplePaymer ransomware group has claimed responsibility for the attack and has also shared stolen documents on their leak site.

See the full report here: https://www.bleepingcomputer.com/news/security/masterchef-big-brother-producer-hit-by-doppelpaymer-ransomware/

Office 365 phishing abuses Oracle and Amazon cloud services - BleepingComputer

A phishing scheme for stealing Office 365 credentials from small and medium-sized businesses in the U.S. and Australia combines cloud services from Oracle and Amazon into its infrastructure. The campaign has been active for more than half a year and uses a network of legitimate websites that have been compromised to work as a proxy chain. The threat actor sends phishing messages from compromised email accounts and uses Amazon Web Services (AWS) and Oracle Cloud in the redirect chain. Once the link was clicked, the user is redirected through several proxies, including AWS load balancers, all the way to a legitimate but compromised website. Later, victims are redirected to a hacked website that takes them to the fake Office 365 page hosted mostly on Oracle Cloud computing service. In some cases, the actor used Amazon Simple Storage Service (Amazon S3). The credentials entered on this page are automatically delivered to another hacked website.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-abuses-oracle-and-amazon-cloud-services/

A hacker is selling access to the email accounts of hundreds of C-level executives

A threat actor is selling passwords for the email accounts of hundreds of C-level executives at companies across the world on a closed-access underground forum for Russian-speaking hackers. The threat actor is selling email and password combinations for Office 365 and Microsoft accounts, which he claims belongs to high-level executives. Access to these executive accounts is sold for prices ranging from $100 to $1,500, depending on the company size and user's role. An anonymous person who obtained the samples has confirmed the validity of the data and obtained valid credentials for two accounts, the CEO of a US medium-sized software company and the CFO of an EU-based retail store chain, and is in the process of notifying the two companies, and also two other companies for which the seller published account passwords as public proof that they had valid data to sell.

See the full report here: https://www.zdnet.com/article/a-hacker-is-selling-access-to-the-email-accounts-of-hundreds-of-c-level-executives/

Digitally Signed Bandook Malware Once Again Targets Multiple Sectors

A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan. The hackers aim to deploy dozens of digitally signed variants of the Bandook Windows Trojan over the past year. The infection chain is a three-stage process that begins with a fake Microsoft Word document delivered inside a ZIP file that, when opened, downloads malicious macros, which subsequently proceeds to drop and execute a second-stage PowerShell script encrypted inside the original Word document. In the last phase of the attack, this PowerShell script downloads encoded executable parts from cloud storage services like Dropbox or Bitbucket to assemble the Bandook loader, which then takes the responsibility of injecting the RAT into a new Internet Explorer process. According to Check Point, the new variant of Bandook is a slimmed-down version of the malware with support for only 11 commands, while prior versions were known to feature as many as 120 commands, suggesting the operators' desire to reduce the malware's footprint and evade detection against high-profile targets.

See the full report here: https://thehackernews.com/2020/11/digitally-signed-bandook-malware-once.html

IIoT chip maker Advantech hit by ransomware, $12.5 million ransom - BleepingComputer

Industrial IoT (IIoT) chip maker Advantech has suffered a ransomware attack. According to BleepingComputer, the Conti ransomware is behind the attack on Advantech's network and are demanding a ransom of 750 BTC for full data decryption and for removing stolen data from their servers. The ransomware operators threatened on November 21, 2020, that they would leak part of the stolen data if there was no reply from the company within the next day. On November 26, the Conti group began publishing Advantech's data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive. Advantech is yet to respond to the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/iiot-chip-maker-advantech-hit-by-ransomware-125-million-ransom/

Nigerian hackers behind extensive BEC scams arrested - TEISS

Three prolific Nigerian hackers were arrested following a joint investigation by Interpol’s Cybercrime Directorate, Group-IB’s APAC Cyber Investigations Team, and the Nigerian Police Force into the use of extensive Business Email Compromise scams and phishing campaigns organized by cybercrime groups, targeting over 50,000 victims worldwide. According to experts, the hackers used Gammadyne Mailer and Turbo-Mailer to send out phishing emails, used MailChimp to track if a recipient opened a message, sent out emails in English, Russian, Spanish, and other languages depending on target lists, and used earlier compromised email accounts to push a new round of phishing attempts. To avoid detection and tracking by traditional security tools, the hackers used public crypters, communicated with deployed malware via SMTP, FTP, HTTP protocols, and made extensive use of publicly available Spyware and Remote Access Trojans (RATs), such as AgentTesla, Loky, AzoRult, Pony, NetWire, and others. According to Group-IB, the arrested hackers are members of a large and organized cybercrime group called TMT.

See the full report here: https://www.teiss.co.uk/nigerian-hackers-bec-scams/

Sopra Steria estimates financial Impact of ransomware attack could reach €50 Million

Sopra Steria, a French IT outsourcer, had fallen victim to a ransomware attack in October this year. The company confirmed that the ransomware group behind this attack is the Ryuk ransomware. Their internal cybersecurity staff rapidly blocked the threat and took measures to contain the virus to only a limited part of the Group’s infrastructure. According to Sopra Steria, the secure remediation plan launched on 26 October is nearly complete, leaving a financial impact ranging between €40 million ($48 million) and €50 million ($60 million). Access has progressively been restored to workstations, R&D and production servers, and in-house tools and applications. Customer connections have also been gradually restored.

See the full report here: https://securityaffairs.co/wordpress/111632/malware/sopra-steria-ransomware-losses.html?utm_source=rss&utm_medium=rss&utm_campaign=sopra-steria-ransomware-losses

COVID vaccine maker AstraZeneca targeted by suspected North Korean hackers - Medical Dialogues

British drugmaker AstraZeneca is facing hacking attempts from suspected North Korean hackers who tried to break into AstraZeneca's systems in recent weeks. According to sources, the hackers posed as recruiters on networking sites such as LinkedIn and WhatsApp to approach AstraZeneca staff with fake job offers. They then sent documents purporting to be job descriptions that were laced with malicious code designed to gain access to a victim's computer. Fortunately, these hacking attempts targeting staff working on Covid-19 research are not thought to have been successful. The experts believe that the tools and techniques used in the attacks showed they were part of an ongoing hacking campaign that U.S. officials and cybersecurity researchers have attributed to North Korea. Microsoft had warned this month that it had observed two North Korean hacking groups targeting vaccine developers in multiple countries, including by "sending messages with fabricated job descriptions" but, Microsoft did not name any of the targeted organizations.

See the full report here: https://medicaldialogues.in/news/industry/pharma/covid-vaccine-maker-astrazeneca-targeted-by-suspected-north-korean-hackers-71900

Healthcare provider AspenPointe data breach affects 295K patients - BleepingComputer

AspenPointe, a US-based healthcare provider, has suffered a data breach stemming from a September 2020 cyberattack that enabled attackers to steal protected health information (PHI) and personally identifiable information (PII). AspenPointe stated that the incident exposed patient information including, full name and one or more of the following, date of birth, Social Security number, Medicaid ID number, date of the last visit (if any), admission date, discharge date, and/or diagnosis code. While the organization did not disclose the number of patients affected in this incident, according to a report filed with the HHS, the incident impacted nearly 295,617 AspenPointe clients. The organization also stated that there is no evidence of misuse of stolen data. AspenPointe has notified the impacted patients, urges them to safeguard themselves against potential fraud attempts, and is providing the impacted patients IDX identity theft protection services including, 12 months of credit and CyberScan monitoring.

See the full report here: https://www.bleepingcomputer.com/news/security/healthcare-provider-aspenpointe-data-breach-affects-295k-patients/

Gootkit malware returns to life alongside REvil ransomware - BleepingComputer

In a new malicious campaign targeting Germany, the Gootkit information-stealing Trojan has returned to life alongside REvil Ransomware. The Gootkit Trojan is a Javascript-based malware that performs various malicious activities. In this new campaign, threat actors are hacking WordPress sites and utilizing SEO poisoning to display fake forum posts to visitors. These posts pretend to be a question and answers with a link to bogus forms or downloads. When the user clicks on the link, they end up downloading a ZIP file containing an obfuscated JS file that will install either the Gootkit malware or the REvil ransomware. According to researchers, the malicious JavaScript payloads will perform fileless attacks of either Gootkit or REvil. When launched, the JavaScript script will connect to its command and control server and downloads another script that contains the malicious malware payload, which is usually Gootkit but can also be REvil ransomware in some cases.

See the full report here: https://www.bleepingcomputer.com/news/security/gootkit-malware-returns-to-life-alongside-revil-ransomware/

Credit card skimmer fills fake PayPal forms with stolen order info - BleepingComputer

In an attempt to harvest the payment and personal information, attackers are using an innovative card skimmer technique to inject highly convincing PayPal iframes and hijack the checkout process on compromised online stores. According to the researcher who discovered the skimmer, the malicious script was hidden inside an image hosted on the compromised store's server using steganography. The skimmer parses the order info before using it to fill the PayPal forms, and if the data is no good, it sends a message back to the page on the victim's site. If the parsed data passes the checks, the __activatePg call takes the passed data and uses it to prefill the fake PayPal form. The victim is then redirected to the PayPal order page, where the form is already partially filled out, making it convincing enough to successfully capture their payment data. It even passes along the items in the cart and the accurate Total, Taxes, and Shipping costs. Once the victim enters their payment information and hits the submit button, the skimmer exfiltrates all information. After stealing the victims' payment data, the skimmer will click the order button behind the malicious iframe sending the victim back to the legitimate checkout process.

See the full report here: https://www.bleepingcomputer.com/news/security/credit-card-skimmer-fills-fake-paypal-forms-with-stolen-order-info/

MacOS Users Targeted By OceanLotus Backdoor

Security researchers have discovered a new macOS backdoor variant linked to the OceanLotus advanced persistent threat group, aka APT32. The backdoor consists of multi-stage payloads and various updated anti-detection techniques. According to researchers, the malware is packed in an app, bundled in a .zip archive, attempts to pass itself off as a Microsoft Word document. The app bundle contains two notable files, the shell script containing the main malicious processes and the Word file displayed during execution. The original .zip file that contains the folder shows three unexpected bytes, which are special Unicode control characters that don’t change the visual appearance of the file. The OS sees this app bundle as an unsupported directory type due to these special characters. Therefore, as a default action, the “open” command is used to execute the malicious app. Once the app is executed, the malware launches a second-stage payload, which in turn drops a third-stage payload before deleting itself. The third-stage payload uses custom encryption, with base64 encoding and byte manipulation, capable of collecting operating system information and submitting the data to its command-and-control (C2) servers, as well as receiving additional C2 communication information.

See the full report here: https://threatpost.com/macos-users-targeted-oceanlotus-backdoor/161655/

Malicious NPM packages used to install njRAT remote access trojan - BleepingComputer

New malicious NPM packages have been discovered that install the njRAT remote access trojan that allows hackers to gain control over a computer. NPM is a JavaScript package manager that allows developers and users to download packages and integrate them into their projects. These packages were masqueraded as a legitimate tool to make databases out of JSON files. One of the packages named jdb[.]js included a module[.]js, package[.]json, and a patch[.]exe executable. When installed, NPM automatically executed the module[.]js, which then launched the njRAT malware. When installed, the malware gave full remote access to a victim's computer and allowed the threat actors to modify the Windows Registry, create and delete files, upload files, execute commands, get information about the computer, take control over the computer, log keystrokes, steal passwords, kill processes and take screenshots. The packages have now been removed by NPM.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

FBI warns of email forwarding rules being abused in recent hacks

The US Federal Bureau of Investigation stated that cyber-criminals are increasingly relying on email forwarding rules to disguise their presence inside hacked email accounts. In a PIN (Private Industry Notification) alert, the FBI stated that the technique has been seen & abused in recent BEC (Business Email Compromise) attacks. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules" that allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criterion is met. It allows the threat actors to receive copies of all incoming emails without having to log into an account each day — and be at risk of triggering a security warning for a suspicious login. The FBI PIN contains a series of basic mitigations and solutions for system administrators to address this particular attack vector and prevent future abuse.

See the full report here: https://www.zdnet.com/article/fbi-warns-of-email-forwarding-rules-being-abused-in-recent-hacks/

Misconfigured Docker Servers Under Attack by Xanthe Malware

Researchers have discovered a Monero crypto-mining botnet named Xanthe, which has been exploiting incorrectly configured Docker API installations in order to infect Linux systems. Xanthe was first discovered targeting a honeypot, which they created with the aim of discovering Docker threats. First, an initial downloader script (pop.sh) is used to download and run its main bot module (xanthe.sh). This module then downloads and runs four additional modules with various anti-detection and persistence functionalities. Once downloaded, the malware utilizes various methods to spread across the network, including harvesting client-side certificates for spreading to known hosts via Secure Shell (SSH). According to Shodan, there are more than 6,000 incorrectly-configured Docker implementations exposed to the internet. As seen in the case of Xanthe, attackers are actively finding ways to exploit those exposed servers.

See the full report here: https://threatpost.com/misconfigured-docker-servers-xanthe-malware/161732/

Alabama school district shut down by ransomware attack - BleepingComputer

Ransomware operators have attacked the Huntsville City Schools district in Alabama, forcing them to shut down schools for the rest of the week and possibly next week. The Huntsville City Schools district is the sixth-largest school district in Alabama, with almost 24,000 students, 2,300 employees, and thirty-seven schools. On November 30th, the school district performed an early dismissal of students after a cyberattack disrupted their IT systems. To prevent the ransomware from spreading to devices loaned to students and faculties, the district asked that all district-issued devices be shut down and remain off until told otherwise. Students and parents are advised to be extra cautious of any emails from the Huntsville City Schools district requesting student information as it could be phishing attacks from the ransomware threat actors. At the moment, the source of the ransomware operation is unknown.

See the full report here: https://www.bleepingcomputer.com/news/security/alabama-school-district-shut-down-by-ransomware-attack/

Critical Oracle WebLogic flaw actively exploited by DarkIRC malware - BleepingComputer

According to a security researcher at Juniper Networks, hackers are actively using five different attack variations to exploit servers that remain vulnerable to a recently patched critical Oracle WebLogic vulnerability, tracked as CVE-2020-14882. Among the variations is one that installs the DarkIRC botnet. Once infected, servers become part of a botnet that can install malware of its choice, mine cryptocurrency, steal passwords, and perform denial-of-service attacks. DarkIRC malware was available for purchase in underground markets for $75 in October. Almost 3,000 Oracle WebLogic servers are reachable over the Internet based on Shodan stats and allow unauthenticated attackers to execute remote code on targeted servers, according to a Juniper Threat Labs report. The Cybersecurity and Infrastructure Security Agency (CISA) urged administrators to immediately install the patch Oracle issued in October to block the incoming attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-oracle-weblogic-flaw-actively-exploited-by-darkirc-malware/

Russian hacking group uses Dropbox to store malware-stolen data - BleepingComputer

Russian backed hacking group Turla has used a previously undocumented malware toolset to deploy backdoors and steal sensitive documents in targeted cyberespionage campaigns directed at high-profile targets. The malware framework named Crutch, crafted for mixing up its communications in Dropbox’s legitimate traffic over HTTPS, thus not suspected by malware detecting software. It can also store and exfiltrate the stolen data from victims in the Dropbox account handled by malware operators. The Crutch is a second-stage backdoor malware used by the Turla group after using the Skipper like malware in the initial compromising attacks. The new version of this malware capable of uploading files automatically from local and removable drives to its Dropbox account using the Windows Wget utility.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hacking-group-uses-dropbox-to-store-malware-stolen-data/

Xerox DocuShare Bugs Allows Data Leaks

Xerox issued a fix for two vulnerabilities impacting its market-leading DocuShare enterprise document management platform. The bugs, if exploited, could expose DocuShare users to an attack resulting in the loss of sensitive data. On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) issued a security bulletin urging users and administrators to apply a patch that plugged two security holes in recently released versions (6.6.1, 7.0, and 7.5) of Xerox’s DocuShare. Tracked as CVE-2020-27177, the vulnerabilities open Solaris, Linux and Windows DocuShare users up to both a server-side request forgery (SSRF) attack and an unauthenticated external XML entity injection attack (XXE). The company has offered hotfix links to tarball files addressing bugs in affected versions of Solaris, Linux and Windows DocuShare.

See the full report here: https://threatpost.com/xerox-docushare-bugs/161791/

Think-Tanks Under Attack by Foreign APTs, CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have issued a warning on persistent, continued cyberattacks by advanced persistent threat (APT) actors targeting U.S. think-tanks. The attackers are looking to steal sensitive information, acquire user credentials, and gain persistent access to victim networks. The cyber-intrusions are especially directed at those that focus on international affairs or national security policy. Think-tank organizations are recommended to apply a range of critical best practices to protect themselves, including implementing social-engineering and phishing training.

See the full report here: https://threatpost.com/think-tanks-attack-apts-cisa/161807/

HMRC phishing scam abuses mail service to bypass detection - BleepingComputer

Threat actors are exploiting legitimate SendGrid mailing service to spoof HMRC phishing emails that bypass spam filters. SendGrid is an email delivery company providing infrastructure for sending out newsletters, promotional emails, and operational business emails such as shipping notifications. The "legacy" accounts provided by SendGrid made the platform open to abuse by threat actors. The ongoing campaign contained actual phishing webpages linked to in the email imitating the HMRC and GOV.UK design. These pages consisted of forms collecting sensitive user information, including Unique Taxpayer Reference (UTR) number, National Insurance Number (NINo), passport number and expiry dates, driving license number with issue and expiry dates, name, date of birth, and address information. Recipients of phishing emails with any mention of SendGrid are advised to report such emails and to not click any links within them.

See the full report here: https://www.bleepingcomputer.com/news/security/hmrc-phishing-scam-abuses-mail-service-to-bypass-detection/

Cyberespionage APT group hides behind cryptomining campaigns - BleepingComputer

An advanced threat group called Bismuth used cryptocurrency mining as a way to hide the purpose of their activity and to avoid triggering high-priority alerts. In recent campaigns, Bismuth launched Monero coin miners on compromised systems belonging to private and government organizations in France and Vietnam. The hackers used Gmail accounts specifically created for each recipient to send spear-phishing emails. Bismuth used DLL side-loading, a widely used technique that takes advantage of how Windows applications handle these file types to load a malicious DLL that spoofs a legitimate one. Bismuth also used a custom malware named KerrDown dropped during the infection chain. The malware impersonated a DLL from Microsoft Word 2007 and executed in the context of the application. While scanning the network, the hackers collected details about the domain and local administrators, checked user privileges on local machines, and pulled device information. The attackers used PowerShell to execute multiple cmdlets that helped with moving across the network and carry out the attack. Installing the coin miners preceded credential theft efforts on local systems via Mimikatz. They hid this activity by registering under a legitimate service name.

See the full report here: https://www.bleepingcomputer.com/news/security/cyberespionage-apt-group-hides-behind-cryptomining-campaigns/

Absa bank embroiled in data leak, rogue employee accused of theft

According to a local publication, Absa, a South African-based financial services group, has suffered a data breach affecting a number of its clients, exposing their personal information to external parties. The bank has notified its customers of a data breach potentially compromising their personal information via email. The bank confirmed that ID numbers, contact details, physical home addresses, and account numbers might be exposed. Absa has not revealed if any other sensitive, financial data was involved in the data leak. The bank searched and seizure operations at various premises and secured all devices containing the data.

See the full report here: https://www.zdnet.com/article/absa-bank-embroiled-in-data-leak-rogue-employee-accused-of-theft/