Weekly Threat Intelligence Bulletin: 12/25/2020 - 12/30/2020

Breaking News: 2020-12-25 - 2020-12-31

FreePBX developer Sangoma hit with Conti ransomware attack - BleepingComputer

Sangoma, a provider of hardware and software for voice over IP based in Canada, has disclosed a data breach after files were stolen during a recent Conti ransomware attack and published online. Conti ransomware gang published over 26 GB of data on their data leak site that contains files related to the company's accounting, financials, acquisitions, employee benefits and salary, and legal documents.

See the full report here: https://www.bleepingcomputer.com/news/security/freepbx-developer-sangoma-hit-with-conti-ransomware-attack/

Amazon Gift Card Scam Delivers Dridex This Holiday Season

The operators behind Dridex have launched a widespread phishing scam that promises victims a $100 Amazon gift card but instead delivers the prolific banking Trojan to target machines. The phishing email claims to deliver a gift from Amazon with a message that says, "We are delighted to enclose a $100 Amazon gift card as our way of saying Thank You". The email prompts the victim to download a gift card, which leads to Dridex infection through one of three different methods. Most targets are from the United States and Western Europe, where Amazon is very popular.

See the full report here: https://www.darkreading.com/threat-intelligence/amazon-gift-card-scam-delivers-dridex-this-holiday-season/d/d-id/1339810

Russian crypto-exchange Livecoin hacked after it lost control of its servers

Russian cryptocurrency exchange Livecoin announced on its official website that it was hacked and lost control of some of its servers, warning customers to stop using its services. The attack seems to have happened on the night between December 23 and December 24, wherein hackers appear to have taken control of the Livecoin infrastructure and then proceeded to modify the exchange rates to gigantic and unrealistic values. Once the exchange rates were modified, the attackers began cashing out accounts, generating gigantic profits.

See the full report here: https://www.zdnet.com/article/russian-crypto-exchange-livecoin-hacked-after-it-lost-control-of-its-servers/

NetGalley discloses data breach after website was hacked - BleepingComputer

The NetGalley book promotion site has suffered a data breach that allowed threat actors to access a database with members' personal information. On Monday, December 21st, NetGalley's website was hacked and defaced. Following this, threat actors also accessed a backup for the site's database containing members' data that included NetGalley members' personal information, including their login name, password, name, and email address. Other optional information that could have been in the database includes users' mailing address, birthday, company name, and Kindle email address. NetGalley has requested all users to reset their password when they next log in.

See the full report here: https://www.bleepingcomputer.com/news/security/netgalley-discloses-data-breach-after-website-was-hacked/

CrowdStrike releases free Azure tool to review assigned privileges

While investigating the impact of the recent SolarWind hack, Microsoft reported to CrowdStrike that threat actors attempted to read CrowdStrike’s emails by using a compromised Microsoft Azure reseller’s account. As CrowdStrike does not use Office 365, the attack failed. During this analysis, CrowdStrike found it challenging to use Azure's administrative tools to enumerate privileges assigned to third-party resellers and partners in their Azure tenant. For this purpose and to help administrators, CrowdStrike has released a free CrowdStrike Reporting Tool for Azure (CRT) tool.

See the full report here: https://securityaffairs.co/wordpress/112628/security/crowdstrike-azure-tool.html?utm_source=rss&utm_medium=rss&utm_campaign=crowdstrike-azure-tool

Police accuse BitGrail of 'hacking itself' to steal $120 million - CoinGeek

The individual who ran a cryptocurrency exchange that was declared bankrupt last year presumed of being responsible for a series of hacks that caused losses of 120 million euros, Italian police said on Monday. More than 230,000 account holders at BitGrail were affected in the attack, which honed in on the platform’s reserves of Nano cryptocurrency.

See the full report here: https://coingeek.com/police-accuse-bitgrail-of-hacking-itself-to-steal-120-million/

Vermont Hospital confirmed the ransomware attack

The Burlington-based University of Vermont Health Network suffered a ransomware attack in late October, costing the hospital about $1.5 million a day. The malware employed in the attack infected all 5,000 computers on the hospital’s network. The hospital notified federal police that they are still investigating the security breach.

See the full report here: https://securityaffairs.co/wordpress/112694/malware/vermont-hospital-ransomware-attack.html?utm_source=rss&utm_medium=rss&utm_campaign=vermont-hospital-ransomware-attack

Vietnam targeted in complex supply chain attack

A group of mysterious hackers has carried out a supply chain attack against Vietnamese private companies and government agencies by inserting malware inside an official government software toolkit. The security firm ESET named the attack "Operation SignSight," which targeted the Vietnam Government Certification Authority (VGCA). The VGCA doesn't only issue these digital certificates but also provides ready-made and user-friendly "client apps" that citizens, private companies, and government workers can install on their computers and automate the process of signing a document. VGCA has published a tutorial on how users could remove the malware from their systems.

See the full report here: https://www.zdnet.com/article/vietnam-targeted-in-complex-supply-chain-attack/

Law enforcement take down three bulletproof VPN providers

Law enforcement agencies from the US, Germany, France, Switzerland, and the Netherlands have seized the web domains and server infrastructure of three VPN services that provided a haven for cybercriminals to attack their victims. The three services were active at insorg[.]org [2014 snapshot], safe-inet[.]com [2013 snapshot], and safe-inet[.]net before the domains were seized across five countries and replaced with law enforcement banners. According to the US Department of Justice and Europol, the three companies' servers were often used to mask the real identities of ransomware gangs, web skimmer (Magecart) groups, online phishers, and hackers involved in account takeovers, allowing them to operate from behind a proxy network up to five layers deep. The investigation, codenamed "Operation Nova," was coordinated by Europol officials, and led by officers from the German Reutlingen Police Headquarters. No charges were announced against the individuals behind the three VPN services.

See the full report here: https://www.zdnet.com/article/law-enforcement-take-down-three-bulletproof-vpn-providers/

HackerOne announces first bug hunter to earn more than $2M in bug bounties

HackerOne announced that the bug bounty hunter Cosmin Lordache was the first to earn more than $2,000,000 in bounty awards. Cosmin has already submitted 468 vulnerabilities through bug bounty programs. He has reported security flaws in the systems and services of prominent organizations, including Verizon Media, PayPal, Dropbox, Facebook, Spotify, AT&T, TikTok, Twitter, Uber, GitHub, and multiple flaws to the U.S. Department of Defense.

See the full report here: https://securityaffairs.co/wordpress/112678/hacking/hackerone-bug-bounty-hunter-2m.html?utm_source=rss&utm_medium=rss&utm_campaign=hackerone-bug-bounty-hunter-2m

Citrix confirms ongoing DDoS attack impacting NetScaler ADCs

Citrix has confirmed an ongoing ‘DDoS attack pattern’ using DTLS as an amplification vector affecting Citrix Application Delivery Controller (ADC) networking appliances with Enlightened Data Transport UDP Protocol (EDT) enabled. As part of this attack, an attacker or bots can overwhelm the Citrix ADC DTLS network throughput, potentially leading to outbound bandwidth exhaustion. Citrix is working on a feature enhancement in DTLS to eliminate the susceptibility to this attack. Customers impacted by this DDoS attack can temporarily mitigate it by disabling DTLS, the amplification vector used by the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/citrix-confirms-ongoing-ddos-attack-impacting-netscaler-adcs/

Finnish Parliament attackers hack lawmakers’ email accounts - BleepingComputer

The Finnish Parliament suffered a data breach that exposed the email accounts of multiple members of parliament (MPs). The malicious activity was detected by the parliament's security team during the fall of 2020. Finland's Central Criminal Investigation Department has begun investigating the suspected espionage incident.

See the full report here: https://www.bleepingcomputer.com/news/security/finnish-parliament-attackers-hack-lawmakers-email-accounts/

Home appliance giant Whirlpool hit in Nefilim ransomware attack - BleepingComputer

Home appliances giant Whirlpool has suffered a ransomware attack by the Nefilim ransomware gang. The ransomware operators published files including, documents related to employee benefits, accommodation requests, medical information requests, background checks, and more, stolen from Whirlpool during the ransomware attack. According to BleepingComputer, Whirlpool confirmed the attack and that their systems have been fully restored from the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/home-appliance-giant-whirlpool-hit-in-nefilim-ransomware-attack/

GitHub-based malware calculates Cobalt Strike payload from Imgur pic

Security researchers discovered a new strand of malware that uses Word files with macros to download a PowerShell script from GitHub. This PowerShell script further downloads a legitimate image file from image hosting service Imgur to decode a Cobalt Strike script on Windows systems. The single-line PowerShell script, encoded within the pixels, has instructions to download a real PNG file from the image hosting service Imgur. While this image itself may be benign, its pixel values are used by the PowerShell script in calculating the next stage payload. The decoded script obtained from manipulating the PNG's pixel values is a Cobalt Strike script. Multiple researchers have potentially linked this strain to MuddyWater, aka SeedWorm and TEMP[.]Zagros. The Indicators of Compromise (IOCs) and Yara rules associated with this malware were released.

See the full report here: https://www.bleepingcomputer.com/news/security/github-based-malware-calculates-cobalt-strike-payload-from-imgur-pic/

Multi-platform card skimmer found on Shopify, BigCommerce stores

Researchers discovered a new type of payment skimmer that can harvest payment information on compromised stores powered by Shopify, BigCommerce, Zencart, and Woocommerce. This new malware can take over the checkout process on shops using multiple online store management systems by injecting a malicious checkout page. It evades blocking custom Javascript on checkout pages by showing a fake payment form and recording customer keystrokes. Once the data is intercepted, the skimmer displays an error message, and the customer is redirected to the legitimate checkout process and payment form. The data is exfiltrated to automatically generated domains based on a counter and encoded using base64 encoding.

See the full report here: https://www.bleepingcomputer.com/news/security/multi-platform-card-skimmer-found-on-shopify-bigcommerce-stores/

Threat actor is selling a dump allegedly including 2,5M customers of service provider Ho Mobile

A security researcher has spotted a threat actor on a popular hacking forum allegedly selling the database of the Italian mobile service provider Ho mobile. The dump reportedly includes 2,500,000 customers’ records and other data that could be exploited by hackers for SIM swapping attacks. Ho mobile, an Italian mobile telephone service offered by Vodafone Enabler Italia, is yet to respond to the incident.

See the full report here: https://securityaffairs.co/wordpress/112740/data-breach/ho-mobile-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=ho-mobile-data-leak

UK NCA visits WeLeakInfo users to warn of using stolen data

Following an operation coordinated by the UK National Crime Agency (NCA), 21 WeLeakInfo customers have been arrested across the UK for using stolen credentials downloaded from WeLeakInfo. The users were also warned in person not to use stolen credentials downloaded from WeLeakInfo to avoid being arrested and prosecuted. NCA officers seized over £41,000 worth of bitcoin and they also served 60 more individuals from England, Wales, and Northern Ireland with cease and desist notices. WeLeakInfo was used by cybercriminals to gain access to illegally collected information. The site was taken down and the domain was seized in January 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-nca-visits-weleakinfo-users-to-warn-of-using-stolen-data/

Japanese Aerospace Firm Kawasaki Warns of Data Breach

Japanese aerospace company Kawasaki Heavy Industries has warned of a security incident that may have led to unauthorized access of customer data. According to the company's breach notification, an unauthorized access was detected to a server in Japan, from an overseas office in Thailand, on June 11, 2020. The company has not yet found evidence of leaking information to the external network. However, it is currently notifying the affected customers and has enhanced monitoring operations to accesses from overseas offices and tightened access restrictions.

See the full report here: https://threatpost.com/japanese-aerospace-firm-kawasaki-warns-of-data-breach/162642/

AutoHotkey-Based Password Stealer Targeting US, Canadian Banking Users

As part of an ongoing campaign, threat actors were seen distributing a new credential stealer written in AutoHotkey (AHK) scripting language. The multi-stage infection chain commences with a malware-laced Excel file that is embedded with a Visual Basic for Applications (VBA) AutoOpen macro, subsequently used to drop and execute the downloader client script via a legitimate portable AHK script compiler executable. Chief among them is a credential stealer that targets browsers. Once installed, it attempts to download an SQLite module on the infected machine and uses it to perform SQL queries against the SQLite databases within browsers' app folders. It then collects and decrypts credentials from browsers and exfiltrates the information to the C&C server.

See the full report here: https://thehackernews.com/2020/12/autohotkey-based-password-stealer.html

Wasabi cloud storage service knocked offline for hosting malware - BleepingComputer

Cloud storage provider Wasabi suffered an outage after a domain used for storage endpoints was suspended for hosting malware. Wasabi stated that their domain registrar attempted to contact them about malicious content hosted on the wasabisys[.]com domain. When sending the abuse report, the registrar forwarded it to the wrong email, and Wasabi was never notified. This mishap led to the registrar suspending the domain, effectively knocking the storage service offline as almost all of their storage buckets utilize the wasabisys[.]com domain. After learning of the abuse report, Wasabi suspended the client hosting the malicious content and asked the registrar to reactivate the domain that took thirteen hours to complete.

See the full report here: https://www.bleepingcomputer.com/news/security/wasabi-cloud-storage-service-knocked-offline-for-hosting-malware/

Voyager cryptocurrency broker halted trading due to cyberattack - BleepingComputer

The Voyager cryptocurrency brokerage platform halted trading yesterday after suffering a cyberattack targeting their DNS configuration. An attack was conducted against the platform that caused them to temporarily halt trading and cancel all limit orders. The attempted intrusion was caught and the Voyager app has since been brought back online, and trading has resumed. As a security precaution, the company logged all users out of the app and suggested they reset their password and configure 2-factor authentication (2FA).

See the full report here: https://www.bleepingcomputer.com/news/security/voyager-cryptocurrency-broker-halted-trading-due-to-cyberattack/

FBI Warn Hackers are Using Hijacked Home Security Devices for ‘Swatting’

The FBI has warned about incidents where stolen email passwords are being used to hijack smart home security systems to “swat” unsuspecting users. Swatting is a dangerous prank where police are called to a home with a fake emergency. It may be motivated by revenge, used as a form of harassment, or used as a prank, but it is a serious crime that may have potentially deadly consequences. By accessing a targeted home security device an attacker can initiate a call for help to authorities and watch remotely as the swat occurs.

See the full report here: https://threatpost.com/fbi-warn-home-security-devices-swatting/162678/

T-Mobile data breach exposed phone numbers, call records - BleepingComputer

T-Mobile has announced a data breach exposing customers' proprietary network information (CPNI), including phone numbers and call records. The security team recently discovered malicious, unauthorized access to their systems. The information exposed in this breach includes phone numbers, call records, and the number of lines on an account.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-data-breach-exposed-phone-numbers-call-records/

New worm turns Windows, Linux servers into Monero miners - BleepingComputer

A newly discovered and self-spreading Golang-based malware has been actively dropping XMRig cryptocurrency miners on Windows and Linux servers since early December. It is capable of spreading to other systems by brute-forcing public-facing services with weak passwords. The malware is being actively updated via the command and control server. To defend against brute force attacks, users are advised to limit logins and use hard to guess passwords on all Internet-exposed services, as well as two-factor authentication whenever possible.

See the full report here: https://www.bleepingcomputer.com/news/security/new-worm-turns-windows-linux-servers-into-monero-miners/

Emotet malware hits Lithuania's National Public Health Center - BleepingComputer

The internal networks of Lithuania's National Center for Public Health (NVSC) and several municipalities have been infected with Emotet malware following a large campaign targeting the country's state institutions. The Emotet emails sent as replies to previous conversations distributed malicious code using password-protected archives as attachments, with the password shared in the email body. This prevented anti-malware solutions from detecting the malicious emails which made it possible for the targeted individuals to open the attachment and infect themselves. The NVSC e-mail systems have been temporarily shut down to stop the further spread of the virus.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-hits-lithuanias-national-public-health-center/

Adobe now shows alerts in Windows 10 to uninstall Flash Player - BleepingComputer

With the Flash Player officially reaching the end of life, Adobe has started to display alerts on Windows computers recommending that users uninstall Flash Player. This alert thanks users for using Adobe Flash Player and says Adobe will stop supporting Flash Player after December 31, 2020. To help secure your system, Adobe will block Flash content from running in Flash Player beginning January 12, 2021. Adobe strongly recommends removing Flash Player from your system by clicking the uninstall button.

See the full report here: https://www.bleepingcomputer.com/news/software/adobe-now-shows-alerts-in-windows-10-to-uninstall-flash-player/