Threat Intelligence Bulletin: 01/01/2021 - 01/07/2021

Alpha Team Flash Report: JetBrains Implicated in SolarWinds Breach

On 6 January 2021, The New York Times reported that JetBrains, a software company that builds tools for developers and project managers, was allegedly used to gain access to the SolarWinds supply chain. According to the report, private companies and US intelligence agencies are investigating whether JetBrains was breached and used as a stepping stone into the SolarWinds build environment. JetBrains’ product, TeamCity, which is a Continuous Integration/Continuous Deployment (CI/CD) server, was apparently the target of the actors who breached SolarWinds.

The article contained no tactics, techniques, and procedures (TTPs) or indicators of compromise (IOCs) that described the attack in detail. Furthermore, the CEO of JetBrains has since indicated the company is unaware of any ongoing investigations but expressed his intention to cooperate if such investigations were to be undertaken. ZeroFOX Alpha Team assesses that, due to the lack of clarity in The New York Times report on the details of the JetBrains compromise and the lack of any additional IOCs, more details need to be publicized to implicate the company as having had a role in the larger SolarWinds hack.

Recommendations

• If applicable, update TeamCity servers to the latest version

• Perform continuous monitoring of news related to this breach for associated IOCs and TTPs. The CISA Alert website has up to date information on the SolarWinds breach https://us-cert.cisa.gov/ncas/alerts/aa20-352a, as well as tools and IOCs

Details

After the article by The New York Times was published, JetBrains CEO Maxim Shafirov posted a response on the company’s website denying the allegations. The CEO confirmed that SolarWinds is a customer of JetBrains and that “...JetBrains has not taken part or been involved in this attack in any way.” He also stated that neither SolarWinds nor law enforcement has contacted his company to discuss the attack or to coordinate disclosures in any way but expressed that, if such an investigation were to be undertaken, JetBrains would cooperate.

Open-source research on the compromise did not return any reliable IOCs or TTPs related to the attack. According to The New York Times, by “..compromising TeamCity, or exploiting gaps in how customers use the tool, cybersecurity experts say the Russian hackers could have inconspicuously planted back doors in an untold number of JetBrains’ clients.” This can be interpreted as either JetBrains itself was compromised, which then resulted in a supply chain infection that made its way into SolarWinds, or JetBrains’ TeamCity was used as a vector for entry into SolarWinds itself. Alpha Team assesses that, although The New York Times is a reliable source, without further details, there is no way to tell from the article which route was taken by the actors behind SolarWinds.

A HackerNews post is circulating in which a supposed employee of JetBrains speculated that the breach was the result of an on-premises installation of TeamCity. This comment aligns with The New York Times statement about TeamCity being compromised at SolarWinds; although the HackerNews account is aged and comments frequently, the reliability of the information is low.

ZeroFOX Intelligence has a total of 40 TeamCity vulnerabilities listed. Of these vulnerabilities, three are listed as critical: CVE-2019-18364, CVE-2019-15039, and CVE-2019-12157.

As of 7 January 2021, CVE-2019-15039 has one publicly listed exploit, while the others do not. Given that multiple US intelligence agencies attributed the SolarWinds breach to a nation-state, exploiting an exposed TeamCity server should be trivial for this actor group.

Breaking News: 2021-01-01 - 2021-01-07

IndiGo says some of its ‘servers were hacked in early December’ - Times of India

IndiGo, an Indian airline company stated that they suffered a cyber incident earlier in December, following which, some of their servers were hacked. The airlines alerted some internal documents may get uploaded by the hackers on public websites and platforms. IndiGo stated that they were able to restore their systems in a very short span of time with minimal impact and is currently investigating the incident.

See the full report here: https://timesofindia.indiatimes.com/business/india-business/our-servers-were-hacked-internal-documents-may-get-uploaded-on-public-websites-indigo/articleshow/80050460.cms

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways

Security researchers have discovered a hardcoded admin-level backdoor account in more than 100,000 Zyxel firewalls, VPN gateways, and access point controllers that can grant attackers root access to devices via either the SSH interface or the web administration panel. Affected models include many of Zyxel's top products such as the Advanced Threat Protection (ATP) series, the Unified Security Gateway (USG) series, the USG FLEX series, the VPN series, and the NXC series. Patches are currently available only for the ATP, USG, USG Flex, and VPN series, and the patches for NXC series are expected in April 2021, according to a Zyxel security advisory. Device owners are advised to update systems as soon as possible.

See the full report here: https://www.zdnet.com/article/backdoor-account-discovered-in-more-than-100000-zyxel-firewalls-vpn-gateways/

Ransomware attack cripples NYC DOE's teacher disciplinary system - New York Post

The Ubiqus Group, a contractor that provides hearing transcripts for the city Department of Education, suffered a ransomware attack in December 2020. As a precautionary measure, the company has shut down its IT systems across all operating sites.

See the full report here: https://nypost.com/2021/01/02/cyberattack-cripples-nyc-does-teacher-disciplinary-system/

Ticketmaster will pay $10 Million fine over hacking a competitor

Ticketmaster has agreed to pay a $10 million criminal fine to avoid prosecution over charges that it illegally accessed a rival’s computer system. The sum is part of a three-year deferred prosecution agreement between Ticketmaster and the U.S. Department of Justice, which was disclosed at a Wednesday hearing before U.S. District Judge Margo Brodie in Brooklyn federal court.

See the full report here: https://securityaffairs.co/wordpress/112927/cyber-crime/ticketmaster-10m-fine.html?utm_source=rss&utm_medium=rss&utm_campaign=ticketmaster-10m-fine

Sabre Settles for $2.4 Million Over 2017 Breach - BankInfoSecurity.com

Sabre Corp reached a settlement deal with the attorneys general in 28 states over the 2017 data breach of Sabre Hospitality Solutions' hotel booking system. Sabre agreed to pay $2.4 million for the data breach, which compromised 1.3 million credit cards.

See the full report here: https://www.bankinfosecurity.com/sabre-settles-states-for-24-million-over-2017-breach-a-15689

Facebook ads used to steal 615000+ credentials in a phishing campaign

Security researchers have spotted a new large-scale campaign abusing Facebook ads. Threat actors are using Facebook ads to redirect users to Github accounts hosting phishing pages used to steal victims’ login credentials. Once the victims provided the credentials, they will be sent to the attackers through a Firestore database and a domain hosted on GoDaddy. Experts are working with relevant authorities to take down the phishing infrastructure used in this campaign.

See the full report here: https://securityaffairs.co/wordpress/112882/hacking/facebook-phishing-campaign-2.html?utm_source=rss&utm_medium=rss&utm_campaign=facebook-phishing-campaign-2

Alleged docs relating to Covid-19 vaccine leaked in darkweb

Security researchers have found several documents relating to the Covid-19 vaccine allegedly stolen from the European Medicines Agency (EMA) leaked in the Darkweb. The links to the documents have been shared by a newly created profile which was used only for the alleged data leak. During the analysis, the researchers noticed that multiple confidential files, including MoMs, assessment reports, confidential emails, login portal links, and images of its internal pages were accessed and leaked.

See the full report here: https://securityaffairs.co/wordpress/112856/data-breach/covid-19-ema-docs-dark-web.html?utm_source=rss&utm_medium=rss&utm_campaign=covid-19-ema-docs-dark-web

Over 200 million records of Chinese Citizens for Sale on the Darkweb

Security researchers have found multiple posts where threat actors are offering for sale alleged data leaks related to Chinese citizens. Data might have been stolen from multiple popular Chinese services, including Gongan County, Weibo, and QQ. The overall availability of records related to Chinese citizens is over 200 million.

See the full report here: https://securityaffairs.co/wordpress/112966/deep-web/chinese-citizens-data-darkweb.html?utm_source=rss&utm_medium=rss&utm_campaign=chinese-citizens-data-darkweb

Beware: PayPal phishing texts state your account is 'limited' - BleepingComputer

A new SMS text phishing (smishing) campaign pretends to be from PayPal, stating that your account has been permanently limited unless you verify your account by clicking on a link. Clicking on the enclosed link lands you on a phishing page that prompts you to log in to your account that tries to collect details, including your name, date of birth, address, bank details, and more. The collected information is used to conduct identity theft attacks, gain access to your other accounts, or perform targeted spear-phishing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-paypal-phishing-texts-state-your-account-is-limited/

Google Chrome fixes antivirus 'file locking' bug on Windows 10 - BleepingComputer

Google Chrome has fixed a bug that enabled antivirus programs on Windows 10 to lock newly created files. The patching of the bug means antivirus programs running on Windows would no longer block new files generated by the Chrome web browser, such as bookmarks. Since the fix has been merged into the repository as of December 30, 2020, it is expected the next version of Google Chrome will come shipped with it.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-fixes-antivirus-file-locking-bug-on-windows-10/

GenRx Pharmacy Ransomware Attack Resulted In Data Breach - Cyber Security News

GenRx Pharmacy, a Scottsdale, Arizona-based healthcare organization, has warned hundreds of thousands of patients over a potential data breach following a ransomware attack earlier this year. Although the incident response team was quick to remove the unauthorized access, GenRx said it later discovered that the malicious hackers were able to remove a small number of files that included healthcare information the pharmacy used to process and ship prescribed products to patients.

See the full report here: https://latesthackingnews.com/2021/01/04/genrx-pharmacy-ransomware-attack-resulted-in-data-breach/

Employee credentials from top gaming companies found for sale on the dark web - SiliconANGLE News

Security researchers have found more than 500,000 leaked credentials tied to leading gaming companies for sale on the dark web. The leaked credentials is related to the employees at leading games companies along with nearly 1 million accounts of both internal gaming clients and employees.

See the full report here: https://siliconangle.com/2021/01/04/employee-credentials-top-gaming-companies-found-sale-dark-web/

Citrix adds NetScaler ADC setting to block recent DDoS attacks - BleepingComputer

Citrix has released a feature enhancement designed to block attackers from using the Datagram Transport Layer Security (DTLS) feature of Citrix ADC and Gateway devices as an amplification vector in DDoS attacks. DTLS feature enhancement adds a "HelloVerifyRequest" setting that will address the susceptibility to this attack vector and will block attempts made by attackers to abuse them in future DDoS attacks. The new builds with DTLS enhancement are available on the Citrix downloads page.

See the full report here: https://www.bleepingcomputer.com/news/security/citrix-adds-netscaler-adc-setting-to-block-recent-ddos-attacks/

Malware uses WiFi BSSID for victim identification

A security researcher has discovered a new malware strain that uses a technique that relies on grabbing the infected user's Basic Service Set Identifier (BSSID). BSSID is the MAC physical address of the wireless router or access point the user is using to connect via WiFi. The malware was collecting the BSSID and then checking it against a free BSSID-to-geo database maintained by Alexander Mylnikov. This database is a collection of known BSSIDs and the last geographical location they have been spotted at.

See the full report here: https://www.zdnet.com/article/malware-uses-wifi-bssid-for-victim-identification/

Zend Framework remote code execution vulnerability revealed - BleepingComputer

According to a recent report, malicious hacking groups may abuse a deserialization vulnerability in Zend Framework to run remote code on PHP sites. Identified as CVE-2021-3007, this flaw could also occur in some Laminas Project implementations. If exploited, the bug can allow remote attackers to conduct remote code execution (RCE) attacks on vulnerable PHP applications under certain circumstances.

See the full report here: https://www.bleepingcomputer.com/news/security/zend-framework-remote-code-execution-vulnerability-revealed/

China's APT hackers move to ransomware attacks - BleepingComputer

Researchers have discovered that the Chinese espionage group APT27 has moved into more financially-motivated cybercrimes, using ransomware to encrypt core servers at major gaming companies worldwide. The attacks happened in 2020 and directly targeted at least five companies in the online gambling sector that operate globally and successfully encrypted several core servers.

See the full report here: https://www.bleepingcomputer.com/news/security/chinas-apt-hackers-move-to-ransomware-attacks/

Ransomware Gang Collects Data from Blood Testing Lab

At-home laboratory services provider Apex Laboratory said hackers stole some patient data during a ransomware attack that took place several months ago. In its data breach notification, Apex Laboratory said it ensured that the data was removed from the hacker’s blog, without providing further details on whether that involved paying the attackers or whether the hackers continue to be in the possession of stolen data.

See the full report here: https://threatpost.com/ransomware-gang-data-blood-testing-lab/162721/

RT @UnderTheBreach: Breaking news: governments cannot be trusted

Singapore's contact tracing app, TraceTogether, is under scrutiny after the country revealed the app's data could be accessed in criminal investigations by local police. An update to TraceTogther's privacy policy on Monday now allows Singapore Police to access app data, whether on a government-issued wearable or a user's device.

See the full report here: https://www.zdnet.com/article/singapore-police-can-access-covid-19-contact-tracing-data-for-criminal-investigations/

Cross-platform ElectroRAT malware drains cryptocurrency wallets - BleepingComputer

Security researchers have discovered a new remote access trojan, named ElectroRAT that is used to empty the cryptocurrency wallets of thousands of Windows, Linux, and macOS users. It is a cross-platform RAT malware, written in Golang, and has a large assortment of capabilities including keylogging, taking screenshots, uploading files from disk, downloading files, and executing commands on the victim's console. The RAT is injected into custom Electron applications that behaved like cryptocurrency trade management tools (Jamm​ and eTrade​) and as a cryptocurrency poker app (DaoPoker).

See the full report here: https://www.bleepingcomputer.com/news/security/cross-platform-electrorat-malware-drains-cryptocurrency-wallets/

Australian cybersecurity agency used as cover in malware campaign - BleepingComputer

In an ongoing campaign, scammers are impersonating the Australian Cyber Security Centre (ACSC) to infect targets with malware by convincing potential victims to install remote administration and desktop sharing software with the end goal of stealing the targets' banking information. Once the victims download and launch the software on their computers, the victims will infect themselves with an undisclosed malicious software that could potentially allow the scammers to take over their computers and steal sensitive information. The Australian government has warned of this campaign and urges people to remain vigilant of such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/australian-cybersecurity-agency-used-as-cover-in-malware-campaign/

Babuk Locker is the first new enterprise ransomware of 2021 - BleepingComputer

A new ransomware called Babuk Locker is targeting corporate victims in human-operated attacks. According to security researcher Chuong Dong who also analyzed the new ransomware, Babuk Locker includes secure encryption that prevents victims from recovering their files for free. Once launched, the ransomware will terminate various Windows services and processes known to keep files open and prevent encryption. After encrypting, a ransom note is dropped in each file containing basic information on what happened during the attack and a link to a Tor site where the victim can negotiate with the ransomware operators.

See the full report here: https://www.bleepingcomputer.com/news/security/babuk-locker-is-the-first-new-enterprise-ransomware-of-2021/

Telegram Triangulation Pinpoints Users’ Exact Locations

According to a security researcher, the “People Nearby,” a feature that allows Telegram users to see who’s nearby can be abused to pinpoint your exact distance to other users – by spoofing one’s latitude and longitude. The “People Nearby” feature could allow an attacker to triangulate the location of unsuspecting Telegram users. The company stated that it doesn’t regard the issue as a bug as users in the People Nearby section intentionally share their location and this feature is disabled by default.

See the full report here: https://threatpost.com/telegram-triangulation-users-locations/162762/

Google Warns of Critical Android Remote Code Execution Bug

Google’s Android security update addressed 43 bugs overall affecting Android handsets, including Samsung phones. Google has fixed two critical bugs affecting its Android handsets. The more serious flaws exist in the Android System component and allow remote attackers to execute arbitrary code.

See the full report here: https://threatpost.com/google-warns-of-critical-android-remote-code-execution-bug/162756/

Vodafone's ho. Mobile admits data breach, 2.5m users impacted - BleepingComputer

Vodafone owned company, ho. Mobile confirmed a massive data breach and is now taking the unprecedented step of offering to replace the SIM cards of all 2.5 million affected customers. The massive breach was discovered on December 28 by a security analyst who noticed the company’s user database on offer for sale on a darknet forum.

See the full report here: https://www.bleepingcomputer.com/news/security/vodafones-ho-mobile-admits-data-breach-25m-users-impacted/

Juspay Data Breach: 'Customers' card details and passwords are secure' - ETRetail.com

The data of 10 Crore cardholders leaked on the dark web. The leaked data, which is in the form of a data dump, appears to have been stolen through a compromised server of Bengaluru-headquartered mobile payment solutions company Juspay.

See the full report here: https://retail.economictimes.indiatimes.com/news/e-commerce/e-tailing/juspay-data-breach-customers-card-details-and-passwords-are-secure/80126071

NSA Urges SysAdmins to Replace Obsolete TLS Protocols

The National Security Agency (NSA) has released new guidance and tools urging companies and system administrators to replace insecure and outdated Transport Layer Security (TLS) protocol instances. The National Security Agency stated that network connections employing obsolete protocols are at an elevated risk of exploitation by adversaries. Hence, all systems should avoid using obsolete configurations for TLS and SSL protocols. NSA advises users to replace insecure and outdated versions of TLS (TLS 1.0 and TLS 1.1) with newer versions of the protocol (TLS 1.2 or TLS 1.3) to avoid future risks.

See the full report here: https://threatpost.com/nsa-urges-sysadmins-to-replace-obsolete-tls-protocols/162814/

Fake Trump sex video used to spread QNode RAT

Security researchers uncovered a malspam campaign that spreads the QNode remote access Trojan (RAT) using fake Trump’s sex scandal video as bait. The spam messages use the subject “GOOD LOAN OFFER!!” and have attached to the email an archive containing a Java Archive (JAR) file called “TRUMP_SEX_SCANDAL_VIDEO[.]jar.” Upon executing the attachment, the malicious code attempts to install the QNode RAT on the recipient’s machine. QRAT supports multiple RAT features, including obtaining system information, performing file operations, and acquiring credentials of certain applications. This new variant supports multiple applications, including Chrome, Firefox, Thunderbird, and Outlook. Email administrators are advised to block inbound JARs in their email security gateways.

See the full report here: https://securityaffairs.co/wordpress/113088/cyber-crime/qnode-rat-attack.html?utm_source=rss&utm_medium=rss&utm_campaign=qnode-rat-attack

Nissan source code leaked online after Git repo misconfiguration

The source code of mobile apps and internal tools developed and used by Nissan North America has leaked online after the company misconfigured one of its Git servers. The leak originated from a Git server, which was left exposed on the internet with its default username and password combo of admin and admin. The repository reportedly contained Nissan NA mobile apps, parts of the Nissan ASIST diagnostics tool, Nissan's internal core mobile library, Dealer Business Systems and Dealer Portal, client acquisition and retention tools, market research tools and data, vehicle logistics portal, vehicle connected services, and various other back ends and internal tools. The Git server was taken offline after the data started circulating on Telegram and hacking forums. Nissan has confirmed the incident and launched an investigation.

See the full report here: https://www.zdnet.com/article/nissan-source-code-leaked-online-after-git-repo-misconfiguration/