Threat Intelligence Bulletin: 12/11/2020 - 12/17/2020

Alpha Team Flash Report: SolarWinds Breach

On 13 December 2020, Reuters reported that Solarwinds, a large IT and software firm, was compromised in what appears to be a highly sophisticated and targeted attack by a nation-state. According to Kevin Thompson, CEO of SolarWinds, the update mechanism for the company’s monitoring product Orion was vulnerable and tampered with from March to June of this year. While the investigation is still ongoing, FireEye has attributed the attack to a threat actor group under a neutral codename, UNC2452, reportedly the same group that breached FireEye this year. According to Reuters' sources, UNC2452 is APT29.

Recommendations

• If possible, ensure any SolarWinds servers are isolated until a forensic investigation has taken place. Block all internet egress from the hosts.
• Update Orion to the latest release 2020.2.1 HF1 Download and review the publicly accessible ClamAV, snort, Yara and HXIOC rules released by FireEye at https://github.com/fireeye/sunburst_countermeasures/tree/main/rules
• Perform continuous monitoring of news related to this breach for associated indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs)

Details

According to FireEye, UNC2452, a neutral codename given to the group by the company, is reportedly the same highly-evasive threat actor that breached FireEye, gained access to SolarWinds infrastructure, and added malicious code to a DLL used by Orion, a product used by enterprises for infrastructure monitoring. The backdoor added to the DLL files has been named “SUNBURST.” When a user downloads or updates Orion, the trojanized DLL is loaded, and the backdoor beacons out to a Command and Control (C2) server to retrieve additional payloads and get commands. This supply-chain attack is designed to exfiltrate data from the targeted company, and the actors employ multiple TTPs to mask their actions on the compromised network.

The listed C2 domain, avsvmcloud[.]com, is currently registered on GoDaddy and has been since December 2019.

Multiple trojanized updates were digitally signed and deployed from March - May 2020 and posted to the SolarWinds updates website, including:

hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20574/SolarWinds-Core-v2019.4.5220-Hotfix5.msp

The backdoor, SUNBURST, injects itself into legitimate background jobs and scheduled tasks which Orion employs. This remains inactive for up to two weeks in order to avoid detection. Once activated, the backdoor contacts the C2 infrastructure and executes commands that include functions to transfer files, execute files, profile the system, reboot the machine, and disable services. The backdoor uses multiple blocklists to prevent detection from forensic and anti-virus tools. Attackers also renamed C2 infrastructure to align with hostnames found within the compromised network in order to mask malicious activity to observers and blend in with legitimate HTTP traffic.

In a leaked Microsoft advisory about the same attack, researchers indicated that the attackers compromised signed libraries to circumvent trust chain controls. Microsoft subsequently removed the certificate from their trust chain.

Figure 1: Digital signature on the software containing the SUNBURST backdoor

Once the attackers have compromised a target network, they maintain access through captured credentials and compromised accounts for lateral movement, however, malware has been deployed using SUNBURST, including a dropper called TEARDROP which deploys Cobalt Strike.

Activity indicating compromise has been detected at multiple entities worldwide, across multiple verticals. Victims include government agencies, consulting, telcos, and technology firms. Targeted geolocations include North America, Europe, Asia, and the Middle East.

Countermeasures and detection rules have been developed and made available for threat hunters and analysts to monitor internal networks. These have been released via GitHub.

Indicators

Multiple Indicators of Compromise (IoC’s) have been made publicly available by FireEye, Microsoft and the security research community to allow businesses to detect and mitigate potential malicious activity.

ZeroFOX Threat Feed users can access the indicators via campaign ID 125

SHA256:
d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
53f8dfc65169ccda021b72a62e0c22a4db7c4077f002fa742717d41b3c40f2c7
019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
292327e5c94afa352cc5a02ca273df543f2020d0e76368ff96c84f4e90778712
c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71

SHA1:
76640508b1e7759e548771a5359eaed353bf1eec
1acf3108bf1e376c8848fbb25dc87424f2c2a39c
e257236206e99f5a5c62035c9c59c57206728b28
bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
5fdd82b7ca1c1f0ec67c05b36d14c9517065353b
2f1a5a7411d015d01aaee4535835400191645023
d130bd75645c2433f88ac03e73395fba172ef676
1b476f58ca366b54f34d714ffce3fd73cc30db1a
47d92d49e6f7f296260da1af355f941eb25360c4
C2c30b3a287d82f88753c85cfb11ec9eb1466bad
75af292f34789a1c782ea36c7127bf6106f595e8

md5:

02af7cec58b9a5da1c542b5a32151ba1
08e35543d6110ed11fdf558bb093d401
2c4a910a1299cdae2a4e55988a2f102e
846e27a652a5e1bfbd0ddd38a16dc865
b91ce2fa41029f6955bff20079468448
4f2eb62fa529c0283b28d05ddd311fae
56ceb6d0011d87b6e4d7023d7ef85676


C2 and Beacon Indicators:

6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud[.]com
freescanonline[.]com
7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud[.]com
deftsecurity[.]com
gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud[.]com
54.193.127.66
ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud[.]com
thedoccloud[.]com
k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud[.]com
mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud[.]com
13.59.205.66
54.215.192.52
websitetheme[.]com
34.203.203.23
highdatabase[.]com
139.99.115.204
incomeupdate[.]com
5.252.177.25
databasegalore[.]com
5.252.177.21
panhardware[.]com
204.188.205.176
zupertech[.]com
51.89.125.18
167.114.213.199

Breaking News: 2020-12-11 - 2020-12-17

Zero-day in WordPress SMTP plugin abused to reset admin account passwords

Security researchers have discovered a zero-day vulnerability in Easy WP SMTP, which can be exploited by hackers to reset passwords for admin accounts on WordPress sites Easy WP SMTP is a plugin that lets site owners configure the SMTP settings for their website's outgoing emails. Easy WP SMTP 1.4.2 and older versions are vulnerable to this issue. Users are recommended to upgrade to Easy WP SMTP 1.4.4 to mitigate the vulnerability.

See the full report here: https://www.zdnet.com/article/zero-day-in-wordpress-smtp-plugin-abused-to-reset-admin-account-passwords/

MountLocker ransomware gets slimmer, now encrypts fewer files - BleepingComputer

MountLocker ransomware received an update recently that cut its size by half but preserves a weakness that could potentially allow learning the random key used to encrypt files. The technical analysis revealed that the malware developers reduced the size of the 64-bit malware variant to 46KB. It now targets a much smaller list of targeted file extensions that excludes easily replaceable file types.

See the full report here: https://www.bleepingcomputer.com/news/security/mountlocker-ransomware-gets-slimmer-now-encrypts-fewer-files/

Security Issues in PoS Terminals Open Consumers to Fraud

Researchers disclosed security issues in point-of-sale (PoS) terminals of three terminal device families manufactured by vendors Verifone and Ingenico. The primary issue is that they ship with default manufacturer passwords, which a Google search can easily reveal. Those credentials provide access to special ‘service modes,’ where hardware configuration and other functions are available, which could enable execution of arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows). Affected devices include Verifone VX520, Verifone MX series, and the Ingenico Telium 2 series. Both the vendors have issued mitigations to patch this issue.

See the full report here: https://threatpost.com/security-issues-pos-terminals-fraud/162210/

Samsung fixes critical Android bugs in December 2020 updates - BleepingComputer

Samsung has rolled out Android's December security updates to mobile devices to patch critical security vulnerabilities in the operating system and related components. The most notable and critical vulnerability is tracked as CVE-2020-0458 lurking in the Android Media Framework arising from a buffer overflow, which has been fixed by this update. This vulnerability could let an attacker perform remote code execution (RCE) attacks using a specially crafted file within the context of a privileged process. Users are advised to update their Android devices to the latest fixed version as soon as possible to keep their devices protected.

See the full report here: https://www.bleepingcomputer.com/news/security/samsung-fixes-critical-android-bugs-in-december-2020-updates/

Adobe releases final Flash Player update, warns of 2021 kill switch - BleepingComputer

Adobe will no longer support Flash Player after December 31, 2020, and Adobe will block Flash content from running in Flash Player beginning January 12, 2021, when all browser developers will remove Adobe Flash entirely from their browser or have already done so. This removal includes Google Chrome, Safari, Mozilla Firefox, Microsoft Edge, Internet Explorer 11, and other Chromium-based browsers. For Internet Explorer, Microsoft has already released the optional KB4577586 update that removes the 32-bit Flash Player plugin built into the browser and Windows. Adobe strongly recommends all users to immediately uninstall Flash Player to help protect their systems.

See the full report here: https://www.bleepingcomputer.com/news/software/adobe-releases-final-flash-player-update-warns-of-2021-kill-switch/

Subway marketing system hacked to send TrickBot malware emails - BleepingComputer

Subway UK has disclosed that a hacked system used for marketing campaigns is responsible for the malware-laden phishing emails sent to customers after the customers began reporting strange emails from 'Subcard' about a Subway order that was placed. Investigations have revealed that the emails were distributing malicious Excel documents that would install the latest version of the TrickBot malware. Subway stated that they have no evidence that guest accounts have been hacked. Subway has also started to send disclosure emails to affected customers that states that the customer's first name and last name were exposed in the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/subway-marketing-system-hacked-to-send-trickbot-malware-emails/

Hacking group’s new malware abuses Google and Facebook services - BleepingComputer

In a new phishing campaign targeting Arabic-speaking users, the Molerat cyberespionage group is using Dropbox and Facebook services to steal data and receive instructions from the operators. In an attempt to avoid detection and takedown efforts, the threat actors are using two new backdoors called SharpStage and DropBook, and one previously undocumented malware downloader named MoleNet. The hackers control the backdoor through commands published in a post on Facebook, DropBook checks installed programs and file names for reconnaissance, executing shell commands received from Facebook or Simplenote, and fetching additional payloads from Dropbox and running them. MoleNet runs WMI commands to profile the operating system, check for debuggers, restart the machine from the command line, upload details about the OS, fetch new payloads, and create persistence.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/

Hands on with Windows 10's built-in Pktmon network monitor - BleepingComputer

Pktmon, a Windows 10 built-in command-line network packet sniffer receives new features to make the tool much easier to use. A packet monitor, or network sniffer, is a program that lets you monitor the network traffic flowing over a computer's network devices down to the individual packet level. When Pktmon was first released as part of the October 2018 Update, it only supported the event trace log (ETL) format, a proprietary log format created by Microsoft. Microsoft has added new features including, PCAPNG log file support and real-time monitoring to make Pktmon an extremely powerful tool that allows users to get an insight into the type of traffic running over your network.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/hands-on-with-windows-10s-built-in-pktmon-network-monitor/

PgMiner botnet attacks weakly secured PostgreSQL databases

Security researchers have discovered a botnet operation that targets PostgreSQL databases to install a cryptocurrency miner. Codenamed by researchers as PgMiner, the botnet operates by performing brute-force attacks against internet-accessible PostgreSQL databases. The botnet randomly picks a public network range and then iterates through all IP addresses part of that range, searching for systems that have the PostgreSQL port (5432) exposed online. Once they have a more solid hold on the infected system, the PgMiner crew deploys a coin-mining application and attempt to mine as much Monero cryptocurrency before they get detected. The operators of the PgMiner botnet have been controlling infected bots via a command and control (C2) server hosted on the Tor network, and its botnet's codebase appears to resemble the SystemdMiner botnet.

See the full report here: https://www.zdnet.com/article/pgminer-botnet-attacks-weakly-secured-postgresql-databases/

Intel's Habana Labs hacked by Pay2Key ransomware, data stolen

​Intel-owned AI processor developer Habana Labs has suffered a cyberattack where data was stolen and leaked by threat actors. On Twitter, Pay2key ransomware operators claim to have stolen sensitive data, including Windows domain account information, DNS zone information for the domain, and a file listing from its Gerrit development code review system. The hacked shared a link to a leak directory and images of the source code and internal processes belonging to the hacked company. Researchers from Profero and Israeli cybersecurity firm Security Joes have linked IOCs from these attacks to those discovered in previous Pay2Key attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/

Microsoft, FireEye confirm SolarWinds supply chain attack

According to FireEye, hackers believed to be operating on behalf of a foreign government have breached software provider SolarWinds and then deployed a malware-laced update for its Orion software to infect the networks of multiple US companies and government networks. SolarWinds published a press release on Sunday admitting to the breach of Orion, a software platform for centralized monitoring and management, usually employed in large networks to keep track of all IT resources, such as servers, workstations, mobiles, and IoT devices. The software firm said that Orion update versions 2019.4 through 2020.2.1, released between March 2020 and June 2020, have been tainted with malware.

See the full report here: https://www.zdnet.com/article/microsoft-fireeye-confirm-solarwinds-supply-chain-attack/

Major leak ‘exposes’ members and ‘lifts the lid’ on the Chinese Communist Party

Nearly two million Chinese Communist Party (CCP) members have had their information leaked in a major data breach. According to the experts, the leak consists of a register with the details of Communist Party members, including their names, party position, birthday, national ID number, and ethnicity. The database was originally leaked on Telegram and passed in September by a Chinese dissident to the Inter-Parliamentary Alliance on China.

See the full report here: https://www.databreaches.net/major-leak-exposes-members-and-lifts-the-lid-on-the-chinese-communist-party/

Russian hackers potentially spied on U.S. Treasury emails

Russian hackers have reportedly been monitoring the internal email traffic of U.S. Treasury and Commerce departments. The Commerce Department has confirmed the breach and asked for the Cybersecurity and Infrastructure Security Agency and the FBI to investigate the incident. However, the insight information currently remains undisclosed to the public.

See the full report here: https://www.itsecurityguru.org/2020/12/14/russian-hackers-potentially-spied-on-u-s-treasury-emails/

Cisco re-patches wormable Jabber RCE flaw

Watchcom researchers discovered and disclosed the incompleteness of three of the patches released by Cisco for their Jabber vulnerabilities in September 2020 (including one wormable RCE flaw). The three vulnerabilities with an incomplete fix have received new CVEs tracked as CVE-2020-2608, Cisco Jabber Cross-Site Scripting leading to RCE, CVE-2020-27132, Cisco Jabber Password Hash Stealing Information Disclosure, and CVE-2020-27127, Cisco Jabber Custom Protocol Handler Command Injection. Cisco has pushed out security updates for the Windows, macOS, Android, and iOS clients/apps and is urging users to implement them as there are no workarounds available.

See the full report here: https://www.helpnetsecurity.com/2020/12/14/wormable-jabber-rce/

Critical Golang XML parser bugs can cause SAML authentication bypass - BleepingComputer

Go language's XML parser contains critical vulnerabilities that can impact multiple Go-based SAML implementations and lead to a complete bypass of SAML authentication. The vulnerabilities are tracked as CVE-2020-29509, CVE-2020-29510, and CVE-2020-29511 and reside in Golang's XML language parser encoding/xml which doesn't return reliable results when encoding and decoding XML input. There is currently no patch available to adequately patch these vulnerabilities. However, fixed versions have been released for some of the individual Go-based SAML projects, including Dex IDP version 2.27.0, github.com/crewjam/saml version 0.4.3, and github.com/russellhaering/gosaml2 version 0.6.0.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-golang-xml-parser-bugs-can-cause-saml-authentication-bypass/

Ex-Cisco Employee Convicted for Deleting 16K Webex Accounts

U.S. District Court in California has sentenced Ex-Cisco employee for two years after being convicted of hacking Cisco’s Webex collaboration platform. He broke into Cisco’s cloud infrastructure in 2018, hosted on Amazon Web Services, and deployed a code from his Google Cloud Project account, which shut down 16,000 WebEx Teams accounts. The incident has cost Cisco about $1.4 million in remediation costs, including refunding $1 million to affected customers, according to a court announcement.

See the full report here: https://threatpost.com/cisco-employee-convicted-deleting-webex-accounts/162246/

SolarWinds confirmes 18,000 customers may have been impacted

SolarWinds revealed that 18,000 customers might have been impacted by the cyber attack against its supply chain. The alarming data emerged in a filing with the Securities and Exchange Commission (SEC) on Monday. The company notified roughly 33,000 Orion customers of the incident, but it stated that fewer than 18,000 customers may have used the backdoored version of its products. The company is still investigating the incident to determine if some data was stolen and if other products might have been impacted.

See the full report here: https://securityaffairs.co/wordpress/112294/hacking/solarwinds-sec-filing.html?utm_source=rss&utm_medium=rss&utm_campaign=solarwinds-sec-filing

Firefox Patches Critical Mystery Bug, Also Impacting Google Chrome

Mozilla Foundation releases Firefox 84 browser, fixing several flaws and delivering performance gains and Apple processor support. In total, six high-severity flaws were fixed, in addition to the critical bug, tracked as CVE-2020-16042. It is a flaw in the JavaScript component called BigInt that could have caused uninitialized memory to be exposed. Earlier this month in Chrome browser security update, Google also highlighted this bug that was impacting Chrome’s V8 JavaScript engine.

See the full report here: https://threatpost.com/firefox-patches-critical-mystery-bug-also-impacting-google-chrome/162294/

Gitpaste-12 Worm Widens Set of Exploits in New Attacks

The Gitpaste-12 worm has returned in new attacks targeting web applications, IP cameras and routers, this time with an expanded set of exploits for initially compromising devices. The new wave of attacks used payloads from yet another GitHub repository and leveraged at least 31 known vulnerabilities. It also attempted to compromise open Android Debug Bridge connections and existing malware backdoors.

See the full report here: https://threatpost.com/gitpaste-12-worm-widens-exploits/162290/

New Windows malware may soon target Linux, macOS devices - BleepingComputer

The new trojan, dubbed PyMICROPSIA by Unit 42, was discovered while investigating AridViper activity (also tracked as Desert Falcon and APT-C-23), a group of Arabic speaking cyberspies focusing their attacks on Middle Eastern targets since at least 2011. The python-based malware has multiple capabilities, including data theft, device control, and additional payload delivery features. The malware has the potential to infect computers running Linux and macOS.

See the full report here: https://www.bleepingcomputer.com/news/security/new-windows-malware-may-soon-target-linux-macos-devices/

45 million medical images left exposed online

Security researchers discovered openly available medical images, including up to 200 lines of metadata per record with PII (personally identifiable information; name, birth date, address, etc.) and PHI (height, weight, diagnosis, etc.), that could be accessed without username or password. It is a concerning discovery and proves that more stringent security processes must be put in place to protect how sensitive medical data is shared and stored by healthcare professionals.

See the full report here: https://www.helpnetsecurity.com/2020/12/16/45-million-medical-images-left-exposed-online/

New Goontact spyware discovered targeting Android and iOS users

Security researchers have discovered new spyware dubbed Goontact targeting Android and iOS users. The Goontact malware is currently distributed via third-party sites promoting free instant messaging apps dedicated to reaching escort services. The researchers notified both Google and Apple of this threat and are actively collaborating with them to protect all Android and iOS users from Goontact.

See the full report here: https://www.zdnet.com/article/new-goontact-spyware-discovered-targeting-android-and-ios-users/

Sonoma Valley Hospital notifies patients affected by ransomware attack - Sonoma Valley Sun

Sonoma Valley Hospital suffered a ransomware attack in October that led to the exposure of nearly 65,000 patients' medical information. The affected patient records include health claims data sent to insurers electronically, including patient name, address, birthdate, insurer group number, and subscriber number, as well as diagnosis or procedure codes, date of service, place of service, amount of claim, and secondary payer information. Investigations have revealed that no financial information such as credit card or social security numbers was accessed, nor was patient information in the hospital’s electronic health record system. SVH stated that it is not aware of any misuse of patient health information. The hospital has notified the impacted patients.

See the full report here: https://sonomasun.com/2020/12/15/sonoma-valley-hospital-notifies-patients-affected-by-ransomware-attack/

Agent Tesla Keylogger Gets Data Theft and Targeting Update

The six-year-old keylogger malware called Agent Tesla has shifted its targeting tactics and now collects stored credentials for less-popular web browsers and email clients. The malware also now can use TOR with a key to help bypass content and network security filters. The update includes new networking capabilities that create a robust set of exfiltration methods, including the use of the Telegram messaging service. The new version is primarily focused on India. Internet service providers (ISPs) are the major target of threat actors.

See the full report here: https://threatpost.com/agent-tesla-targeting-data-tactics/162268/

SolarWinds Issues Second Hotfix for Orion Platform Supply Chain Attack

SolarWinds has officially released a second hotfix to address a critical vulnerability in its Orion platform that was exploited to insert malware and breach public and private entities in a wide-ranging espionage campaign. SolarWinds estimates that as many as 18,000 of its customers may have been impacted by the supply chain attack. But indications are that the operators of the campaign leveraged this flaw to only hit select high-profile targets. The company is urging its customers to update Orion Platform to version 2020.2.1 HF 2 as soon as possible to secure their environments.

See the full report here: https://thehackernews.com/2020/12/solarwinds-issues-second-hotfix-for_15.html

Millions of Unpatched IoT, OT Devices Threaten Critical Infrastructure

Researchers have found that thousands of organizations remain at risk from the URGENT/11 and CDPwn collections of vulnerabilities, which affect operational technology (OT) gear and internet of things (IoT), due to lack of patching. URGENT/11 is a collection of 11 different bugs that can affect any connected device leveraging Wind River’s VxWorks that includes an IPnet stack (CVEs from Wind River available here). CDPwn encompasses five critical vulnerabilities discovered in February in the Cisco Discovery Protocol (CDP), the info-sharing layer that maps all Cisco equipment on a network. Organizations are urged to patch these flaws as soon as possible to protect themselves from future risk.

See the full report here: https://threatpost.com/unpatched-iot-ot-devices-threaten-critical-infrastructure/162275/

Ryuk, Egregor Ransomware Attacks Leverage SystemBC Backdoor

In the past few months researchers have detected hundreds of attempted SystemBC deployments globally, as part of recent Ryuk and Egregor ransomware attacks. SystemBC is a proxy and remote administrative tool that has recently evolved to use the Tor anonymizing network to encrypt and conceal the destination of command and control traffic. The backdoor has been utilized in recent Ryuk and Egregor ransomware attacks, and has also often been leveraged in combination with post-exploitation tools such as Cobalt Strike.

See the full report here: https://threatpost.com/ryuk-egregor-ransomware-systembc-backdoor/162333/

FBI says DoppelPaymer ransomware gang is harassing victims who refuse to pay

The FBI says it is aware of incidents where the DoppelPaymer ransomware gang has resorted to cold-calling companies in order to intimidate and coerce victims into paying ransom demands. As of February 2020, in multiple instances, DoppelPaymer actors had followed ransomware infections with calls to the victims to extort payments through intimidation or threatening to release exfiltrated data. The victims are recommended to secure their networks to prevent intrusions in the first place, and in the case of an attack,it is recommended to notify authorities and try to avoid paying the ransom.

See the full report here: https://www.zdnet.com/article/fbi-says-doppelpaymer-ransomware-gang-is-harassing-victims-who-refuse-to-pay/

FireEye, Microsoft create kill switch for SolarWinds backdoor - BleepingComputer

Microsoft, FireEye, and GoDaddy have collaborated to create a kill switch for the SolarWinds Sunburst backdoor that forces the malware to terminate itself. This killswitch will affect new and previous SUNBURST infections by disabling SUNBURST deployments that are still beaconing to avsvmcloud[.]com. GoDaddy has created a wildcard DNS resolution so that any subdomain of avsvmcloud[.]com resolves to 20.140.0.1. This IP address is part of the 20.140.0.0/15 range that is on the malware block list. This blocklist causes the malware to terminate and prevent itself from executing again.

See the full report here: https://www.bleepingcomputer.com/news/security/fireeye-microsoft-create-kill-switch-for-solarwinds-backdoor/

New IRS Form Fraud Campaign Targets G Suite Users

A new scam using an IRS form as its mechanism was found targeting users of Google's G Suite. At least 50,000 executives have been affected so far. The campaign claims to contain an IRS W-8BEN form in PDF format that asks for far more personal information than required on the actual W-8BEN. While there is no malware payload attached to the email, providing all the requested information could result in identity theft and other fraud.

See the full report here: https://www.darkreading.com/attacks-breaches/new-irs-form-fraud-campaign-targets-g-suite-users/d/d-id/1339743

Attackers Leverage IMAP to Infiltrate Email Accounts

A newly detected wave of spam emails is bypassing transport layers and landing in mailboxes. The campaign has been seen in France, Italy, Denmark, and the United States. The researchers suspect that attackers are using a tool dubbed Email Appender, which is available on the Dark Web - to directly connect with compromised email accounts via IMAP. Attackers can use the tool to configure a proxy to avoid IP detection, draft a malicious email, and deliver spam straight into a user's account.

See the full report here: https://www.darkreading.com/attackers-leverage-imap-to-infiltrate-email-accounts/d/d-id/1339747

Three million users installed 28 malicious Chrome or Edge extensions

According to security firm Avast, more than three million internet users are believed to have installed 15 Chrome and 13 Edge extensions that contain malicious code that could perform several malicious operations. The primary objective of this campaign was to hijack user traffic for monetary gains. Avast reported its findings to both Google and Microsoft and that both companies are still investigating the extensions. Until then, Avast has recommended the users to uninstall and remove the extensions from their browsers.

See the full report here: https://www.zdnet.com/article/three-million-users-installed-28-malicious-chrome-or-edge-extensions/