Threat Intelligence Bulletin: 01/08/2021 - 01/14/2021

Breach Disclosure: GeniusU

GeniusU, the "Entepreneur Success Platform" experienced a data breach in October 2020, resulting in the exposure of 1.3 million user accounts. This data included names, email address, IP address, gender, social media profile links, and bcrypt password hashes. This breach has been attributed to ShinyHunters, which continue to release their breach data for free, which are typically after any sales of the data have been made.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Reportedly breached on 2 October 2020, a user by the name of "Hater" posted the breached data for users to download on Raidforums on 12 November 2020.

Figure 1: Raidforums posting of GeniusU breach data

This breach was part of a larger ShinyHunters effort which included sites such as Animal Jam, Eatigo, Peatix, Redmart, Pluto.tv, Storybird, Homechef, and many others.

Breach Disclosure: Glofox

Glofox, a gym management software company, had 2.3 million accounts breached in March, 2020. This breach has been attributed to ShinyHunters, which are continously uploading breaches to various hacking forums. While no financial information or credit card details have been exposed, personal information such as names, addresses, phone numbers, passwords and birthdays may have been included in the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On March 27 2020, Glofox had reportedly been breached by ShinyHunters, with the data making rounds in November of 2020 on various forums and marketplaces. A user known as "Hater" posted the data to RaidForums on November 11 2020 and stated that there were 5.2 million users information (as opposed to the 2.3 million stated in numerous news articles).

In addition to the PII referenced above (names, emails, phone numbers), the activity of the users breached was also included in some cases, which included the gym they are a member of, which could possibly be used by threat actors for pretext in phishing attacks.

Figure 1: Screenshot of Glofox breach listing on Raidforums

Microsoft Patch Tuesday 01/13/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Highlights: Microsoft's Patch Tuesday update for January 2021 contained 83 vulnerabilities in total, with: 63 vulnerabilities rated as High 20 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified the proofs-of-concept for CVE-2021-1647, CVE-2021-1643, CVE-2021-1648, and CVE-2021-1705. However, at the time of reporting, no publicly available proofs-of-concept were found.

CVE-2021-1647 CVE-2021-1647 is a remote code execution (RCE) bug in Microsoft Defender that could allow threat actors to execute code on vulnerable devices by tricking a user into opening a malicious document on the target system. The vulnerability is rated high and has received a severity score of 7.8 (CVSS v3). According to Microsoft, CVE-2021-1647 is a zero-day vulnerability that is being actively exploited in the wild.

The following products are impacted by CVE-2021-1647:

Microsoft Security Essentials Microsoft System Center 2012 Endpoint Protection Microsoft System Center 2012 R2 Endpoint Protection Windows Defender Microsoft System Center Endpoint Protection

CVE-2021-1643 CVE-2021-1643 is a remote code execution vulnerability in HEVC Video Extensions that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2021-1648 CVE-2021-1648 is an elevation of privilege vulnerability in Microsoft splwow64 that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the splwow64. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted by CVE-2021-1648:

Windows 8.1 for x64-based systems Windows Server 2012 Windows 10 Version 1809 for ARM64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server 2019 Windows 10 Version 1803 for x64-based Systems Windows Server 2012 R2 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows RT 8.1 Windows 8.1 for 32-bit systems Windows Server 2019 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 1607 for x64-based Systems Windows Server 2012 (Server Core installation) Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 10 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server version 1909 (Server Core installation) Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server 2016 (Server Core installation) Windows 10 Version 20H2 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems

CVE-2021-1705 CVE-2021-1705 is a code execution vulnerability in Microsoft Edge (HTML-based) that could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption vulnerability. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

Other Microsoft Vulnerabilities Other notable Microsoft vulnerabilities include CVE-2021-1709, an elevation of privilege vulnerability in Microsoft Windows Win32k that could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k. CVE-2021-1707 is a remote code execution vulnerability in Microsoft SharePoint Server that could allow a remote authenticated attacker to execute arbitrary code on the system.

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2021-01-08 - 2021-01-14

Microsoft fixes Windows 10 crash issue causing forced reboots - BleepingComputer

Microsoft has addressed a known issue causing Windows 10 20H2 devices to force restart due to the Local Security Authority Subsystem Service (LSASS) system process crashing. LSASS is a Windows process responsible for security policy enforcing and updating the security log, as well as for handling user logins, password changes, and access token creation. Whenever LSASS fails, logged in users immediately lose access to the accounts, with the device force restarting after displaying an error. The known issue fixed on Thursday affects both client and server Windows devices where local built-in accounts such as Guest or Administrator have been renamed.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-10-crash-issue-causing-forced-reboots/

Dassault Falcon Jet reports data breach after ransomware attack

Dassault Falcon Jet, the US subsidiary of French aerospace company Dassault Aviation, has disclosed a data breach that may have led to the exposure of personal information belonging to current and former employees, as well as their spouses and dependents. According to media reports and the dates of breach reported by the company, the attackers maintained access to Dassault Falcon Jet's systems for roughly six months, between June 6th and December 7th. The Ragnar Locker operators who infiltrated the company's systems were also able to infiltrate the network of several Dassault Falcon Jet subsidiaries.

See the full report here: https://www.bleepingcomputer.com/news/security/dassault-falcon-jet-reports-data-breach-after-ransomware-attack/

A crypto-mining botnet is now stealing Docker and AWS credentials

Security researchers from Trend Micro have spotted a malware botnet that collects and steals Docker and AWS credentials. Researchers have linked the botnet to a cybercrime operation known as TeamTNT. Researchers said the TeamTNT group would access exposed Docker containers, install a crypto-mining malware, and also steal credentials for Amazon Web Services (AWS) servers to pivot to a company's other IT systems to infect more servers and deploy more crypto-miners.

See the full report here: https://www.zdnet.com/article/a-crypto-mining-botnet-is-now-stealing-docker-and-aws-credentials/

Google bans Parler app from Play Store for threats of violence - BleepingComputer

Google bans the Parler app from its Play Store after repeated violations of policies that require Google Play apps to moderate user-generated content. Parler is a microblogging and social networking service. Parler failed to remove posts that incite violence in the US. Google states that they have repeatedly contacted Parler about these policy violations. After the action was not taken to resolve the violations, Google removed the app from Google Play until they are addressed.

See the full report here: https://www.bleepingcomputer.com/news/software/google-bans-parler-app-from-play-store-for-threats-of-violence/

North Korea-linked APT37 targets South with RokRat Trojan

Experts spotted the RokRat Trojan being used by North Korea-linked threat actors in attacks aimed at the South Korean government. The malicious file contains a macro that uses a VBA self decoding technique to decode itself directly into the memory of the victim’s machine. The technique acts as an unpacker stub that is executed upon opening the document, it unpacks the macro and injects it into the memory of Microsoft Office to avoid detection. The stub then embeds a variant of the RokRat into Notepad. The shellcode injected into Notepad[.]exe process downloads an encrypted payload from xxp://bit[.]ly/2Np1enh which is a link to a Google Drive containing RokRat.

See the full report here: https://securityaffairs.co/wordpress/113134/malware/apt37-rokrat-trojan.html?utm_source=rss&utm_medium=rss&utm_campaign=apt37-rokrat-trojan

Linux malware authors use Ezuri Golang crypter for zero detection - BleepingComputer

Multiple threat actors are using the Ezuri crypter to pack their malware and evade antivirus detection. Written in Go, Ezuri acts both as a crypter and loader for ELF (Linux) binaries. Using AES, it encrypts the malware code and, on decryption, executes the malicious payload directly within memory without generating any files on the disk.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-malware-authors-use-ezuri-golang-crypter-for-zero-detection/

Apple removed Parler from the App Store for inciting violence - BleepingComputer

Apple Inc suspended Parler from their respective App Store, saying the social networking service popular with many right-leaning social media users has not taken adequate measures to prevent the spread of posts inciting violence. The action by Apple follows a similar move by Alphabet Inc’s Google on Friday.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-removed-parler-from-the-app-store-for-inciting-violence/

Hacker used ransomware to lock victims in their IoT chastity belt - BleepingComputer

A security flaw in an internet-connected male chastity device could allow hackers to lock it remotely, leaving users trapped. The security researchers have found multiple flaws in Bluetooth controlled Qiui Cellmate chastity device that leave it vulnerable to hacking.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-used-ransomware-to-lock-victims-in-their-iot-chastity-belt/

Some ransomware gangs are going after top execs to pressure companies into paying

Some ransomware groups are searching for workstations inside a breached company that are used by its top managers. The groups sift through manager's files and emails and exfiltrates data that they think might be useful in threatening, embarrassing, or putting pressure on a company's management, the same people who'd most likely be in charge of approving their ransom demand days later.

See the full report here: https://www.zdnet.com/article/some-ransomware-gangs-are-going-after-top-execs-to-pressure-companies-into-paying/

New Zealand central bank hit by cyberattack - Deutsche Welle

New Zealand’s central bank, the Reserve Bank of New Zealand, has suffered a cyber attack. According to the reports, Governor Adrian Orr has admitted that the bank faced an indirect security breach. The attackers potentially accessed a third-party file-sharing service that the bank used for storing and sharing data. The bank is continuing with the investigations of the matter.

See the full report here: https://www.dw.com/en/new-zealand-central-bank-hit-by-cyberattack/a-56184575

Ransomware attack hits short line rail operator OmniTRAX - FreightWaves

Colorado-based short line rail operator and logistics provider OmniTRAX was hit by a recent ransomware attack and data theft that targeted its corporate parent, Broe Group. The cyberattack had occurred after the Conti ransomware gang posted stolen data from a leak site. The company, however, provided no details about the incident and whether it impacted any operations.

See the full report here: https://www.freightwaves.com/news/ransomware-attack-hits-short-line-rail-operator-omnitrax

Delaware County paid $25,000 in ransom during cyberattack - WHYY

Delaware County has resolved a cyberattack on its government computer network by paying the hacker $25,000. The threat actor early on indicated that it intended to hold the County's system for ransom, accompanied by a threat to release data, including potentially personal information unless the ransom was paid.

See the full report here: https://whyy.org/articles/delaware-county-paid-25000-in-ransom-during-cyberattack/

Ransomware attack forces three-week shutdown of NT Government IT system - ABC News

The Northern Territory Government has revealed the supplier of one of its cloud-based IT systems was targeted in a ransomware attack, forcing the system offline for three weeks. In 2020, a supplier to NT Government was compromised and subsequently ransomwared. The firm worked with the Australian Cyber Security Centre and NT Government officials, who took the system offline and restored it from backup copies.

See the full report here: https://www.abc.net.au/news/2021-01-11/ransomware-attack-nt-government-phishing-attempts/13036472

United Nations data breach exposed over 100k UNEP staff records - BleepingComputer

Security researchers have disclosed their findings on a vulnerability that let them access over 100,000 private employee records of the United Nations Environmental Programme (UNEP). The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to clone Git repositories and gather a large amount of personally identifiable information (PII) associated with over 100k employees.

See the full report here: https://www.bleepingcomputer.com/news/security/united-nations-data-breach-exposed-over-100k-unep-staff-records/

Third malware strain discovered in SolarWinds supply chain attack

Cyber-security firm CrowdStrike, one of the companies directly involved in investigating the SolarWinds supply chain attack, has identified a third malware strain directly involved in the recent hack. Named Sunspot, the malware was installed on the SolarWinds build server. Once a build command was detected, the malware would silently replace source code files inside the Orion app with files that loaded the Sunburst malware, resulting in Orion app versions that also installed the Sunburst malware.

See the full report here: https://www.zdnet.com/article/third-malware-strain-discovered-in-solarwinds-supply-chain-attack/

Hacked Aurora Cannabis data for sale after Christmas Day attack - Yahoo India News

Aurora Cannabis stated that it had suffered a cybersecurity incident on Christmas Day. The firm is consulting with security experts and authorities as a hacker solicits online bids for data allegedly belonging to the Canadian pot company. The data appears to include copies of passports, driver’s licenses, credit card information, and other business documents. The company said that no patient data was compromised and that Aurora’s network of operations was unaffected.

See the full report here: https://in.news.yahoo.com/hacked-aurora-cannabis-data-for-sale-after-christmas-day-attack-202058896.html

Millions of Social Profiles Leaked by Chinese Data-Scrapers

A misconfigured ElasticSearch database owned by Chinese social-media management company SocialArks has leaked personally identifiable information (PII) from users of Facebook, Instagram, LinkedIn, and other platforms. The server was found to be publicly exposed without password protection or encryption during routine IP-address checks on potentially unsecured databases. It contained more than 318 million records in total. The database was secured by SocialArks the same day that researchers alerted the company to the issue.

See the full report here: https://threatpost.com/social-profiles-leaked-chinese-data-scrapers/162936/

Typeform fixes Zendesk Sell form data hijacking vulnerability - BleepingComputer

Online surveys and form building software as a service Typeform has patched an information hijacking vulnerability. The flaw which existed in Typeform's Zendesk Sell app integration could let attackers quietly redirect form submissions with potentially sensitive data to themselves.

See the full report here: https://www.bleepingcomputer.com/news/security/typeform-fixes-zendesk-sell-form-data-hijacking-vulnerability/

DarkSide ransomware decryptor recovers victims' files for free - BleepingComputer

Antivirus company BitDefender has released a decryptor for victims of the DarkSide ransomware gang. The decryptor was publicly posted on the BitDefender website on Jan. 11 and is available for download to all. According to a short blog included with the release, the tool automatically scans and searches for file extensions associated with the encrypted files and decrypts them.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-ransomware-decryptor-recovers-victims-files-for-free/

Mac malware uses 'run-only' AppleScripts to evade analysis - BleepingComputer

An effort to reverse-engineer malicious AppleScript has led to the creation of a tool to analyze run-only malware targeting the Mac operating system, undermining a common attacker approach to obfuscating code on the platform. According to SentinelOne, the script is intended to prevent analysis and evade detection.

See the full report here: https://www.bleepingcomputer.com/news/security/mac-malware-uses-run-only-applescripts-to-evade-analysis/

Networking giant Ubiquiti alerts customers of potential data breach - BleepingComputer

Networking equipment and IoT device vendor Ubiquiti Networks has sent out notification emails to its customers informing them of a recent security breach. According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/networking-giant-ubiquiti-alerts-customers-of-potential-data-breach/

Researcher Builds Parler Archive Amid Amazon Suspension

A security researcher said she has scraped and archived Parler’s public posts, as the social-media network goes offline following suspensions from Amazon, Apple, and Google. Archived content includes public posts from the social media site. These posts reportedly include Parler video URLs made up of raw video files with associated embedded metadata and precise GPS coordinates of where the videos were taken, sparking privacy concerns about the service’s data collection.

See the full report here: https://threatpost.com/parler-archive-amazon-suspension/162928/

Hackers Steal Mimecast Certificate Used to Securely Connect with Microsoft 365

Mimecast confirmed a security breach, where a sophisticated threat actor had compromised a digital certificate that is provided to certain customers to securely connect its products to Microsoft 365 (M365) Exchange. The company didn't elaborate on what type of certificate was compromised, but Mimecast offers seven different digital certificates based on the geographical location that must be uploaded to M365 to create a server Connection in Mimecast. The compromised certificate can be used to verify and authenticate Mimecast Sync and Recover, Continuity Monitor, and Internal Email Protect (IEP) products to M365 Exchange Web Services.

See the full report here: https://thehackernews.com/2021/01/hackers-steal-mimecast-certificate-used.html

Authorities Take Down World's Largest Illegal Dark Web Marketplace

Europol on Tuesday said it has shut down DarkMarket, the world's largest online marketplace for illicit goods, as part of an international operation involving Germany, Australia, Denmark, Moldova, Ukraine, the U.K.'s National Crime Agency (NCA), and the U.S. Federal Bureau of Investigation (FBI). The market specialized in the sales of drugs, counterfeit money, stolen or forged credit card information, anonymous SIM cards, and off-the-shelf malware. The law enforcement also seized the criminal infrastructure, including more than 20 servers in Moldova and Ukraine, that was used to facilitate the operations.

See the full report here: https://thehackernews.com/2021/01/authorities-take-down-worlds-largest.html

Hackers leak stolen Pfizer COVID-19 vaccine data online - BleepingComputer

The European Medicines Agency (EMA) revealed that some of the Pfizer/BioNTech COVID-19 vaccine data stolen from its servers in December were leaked online. On December 31st, threat actors leaking what they claimed was the stolen EMA data on several hacker forums. The leaked data includes email screenshots, EMA peer review comments, Word documents, PDFs, and PowerPoint presentations.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-stolen-pfizer-covid-19-vaccine-data-online/

Capcom: 390,000 people may be affected by ransomware data breach - BleepingComputer

Capcom has released a new update for their data breach investigation and state that up to 390,000 people may now be affected by their November ransomware attack. On November 2nd, Capcom suffered a cyberattack by the Ragnar Locker ransomware operation who stated they stole 1TB of data from the company.

See the full report here: https://www.bleepingcomputer.com/news/security/capcom-390-000-people-may-be-affected-by-ransomware-data-breach/

Google reveals sophisticated Windows and Android hacking operation

Google has revealed a highly sophisticated hacker targeted owners of Android and Windows devices in the first quarter of 2020, carrying out hacking via watering hole attacks. One server targeted Windows users while the other targeted Android. Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices.

See the full report here: https://www.zdnet.com/article/google-reveals-sophisticated-windows-android-hacking-operation/

Adobe Fixes 7 Critical Flaws, Blocks Flash Player Content

Adobe has patched seven critical vulnerabilities, which affect Windows, macOS, and Linux end users. The impact of the serious flaws ranges from arbitrary code execution to sensitive information disclosure.

See the full report here: https://threatpost.com/adobe-critical-flaws-flash-player/162958/

SolarLeaks site claims to sell data stolen in SolarWinds attacks - BleepingComputer

A website named SolarLeaks, claims to be selling the stolen data from companies breached in the SolarWinds attack. According to a joint statement issued by the FBI, CISA, and the NSA, this attack was likely conducted by a Russian state-sponsored hacking group who wanted to steal cloud data such as email and files from its victims.

See the full report here: https://www.bleepingcomputer.com/news/security/solarleaks-site-claims-to-sell-data-stolen-in-solarwinds-attacks/

Microsoft Issues Patches for Defender Zero-Day and 82 Other Windows Flaws

With the January 2021 Patch Tuesday security updates release, Microsoft has released fixes for 83 vulnerabilities, with ten classified as Critical and 73 as Important. Microsoft states that they have fixed a zero-day Microsoft Defender remote code execution vulnerability tracked as CVE-2021-1647. Microsoft also patched a publicly disclosed Microsoft splwow64 Elevation of Privilege vulnerability tracked as CVE-2021-1648. Google Project Zero previously disclosed this vulnerability in September 2020 under CVE-2020-0986.

See the full report here: https://thehackernews.com/2021/01/microsoft-issues-patches-for-defender.html

Ledger discovers new security breach - CoinGeek

Ledger disclosed that 20,000 new customer records were leaked and are now out in the wild. Ledger claims that they were unaware of the 20,000 additional customer records until it was brought to their attention by Shopify on December 23. Previously, the company suffered a security breach in June that led to the theft of 1 million customer email addresses and other identification information.

See the full report here: https://coingeek.com/ledger-discovers-new-security-breach/

Intel Adds Hardware-Enabled Ransomware Detection to 11th Gen vPro Chips

Intel and Cybereason have partnered to build anti-ransomware defenses into the chipmaker's newly announced 11th generation Core vPro business-class processors. The hardware-based security enhancements are baked into Intel's vPro platform via its Hardware Shield and Threat Detection Technology (TDT), enabling profiling and detection of ransomware and other threats that have an impact on the CPU performance.

See the full report here: https://thehackernews.com/2021/01/intel-adds-hardware-enabled-ransomware.html

Google cracks down on personal loan apps in India following abuse and outcry

Users and government agencies in India recently flagged several personal loan apps targeting vulnerable borrowers in the country and then going to extreme lengths to recover their money. Google reviewed hundreds of apps and identified several apps that violated the Play Store’s safety policies and they were removed from the PlayStore. The company implementing stronger measures to prevent abuse.

See the full report here: https://techcrunch.com/?p=2096279

Google discloses hacking campaign targeting Windows, Android users

The Project Zero team, in collaboration with the Google Threat Analysis Group (TAG), revealed a hacking campaign coordinated by a highly sophisticated actor targeting Windows and Android users with zero-day and n-day exploits. The attackers used Chrome exploits to remotely execute malicious code on the targets' devices remote code execution, zero-days for Windows devices, and n-day ones for Android. The four zero-days, exploited in these attacks and patched last year.

See the full report here: https://www.bleepingcomputer.com/news/security/google-discloses-hacking-campaign-targeting-windows-android-users/

New Zealand Reserve Bank suffers data breach via hacked storage partner - BleepingComputer

On January 10th, the Reserve Bank of New Zealand, known as Te Pūtea Matua, suffered a data breach after threat actors hacked a third-party hosting partner. According to the bank, the breach has been contained but may have exposed commercially and personally sensitive information. Currently, the relevant authorities are investigating the incident to determine the nature and extent of the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-suffers-data-breach-via-hacked-storage-partner/

Iranian cyberspies behind major Christmas SMS spear-phishing campaign

An Iranian cyber-espionage group known as Charming Kitten, aka APT35 or Phosphorus, has used the recent winter holiday break to attack targets from all over the world using a very sophisticated spear-phishing campaign that involved not only email attacks but also SMS messages. CERTFA detected attacks targeting members of think tanks, political research centers, university professors, journalists, and environmental activists. According to them, the legitimate Google URL would end up bouncing the user through different websites and eventually bring him to a phishing page, where they'd be asked for login credentials for personal email services like Gmail, Yahoo, and Outlook, but also business emails. The victims were located in countries around the Persian Gulf, Europe, and the US.

See the full report here: https://www.zdnet.com/article/iranian-cyberspies-behind-major-christmas-sms-spear-phishing-campaign/