Threat Intelligence Bulletin: 01/22/2021

Alpha Team Flash Report: Emotet Campaign Disruption

On January 27th 2021, Europol announced that Emotet, a botnet that has existed since 2014, was disrupted by a multi-country law enforcement effort. This was a joint effort between authorities ranging from Germany, Netherlands, United States, United Kingdom, France, Canada, and others, coordinated by Europol, which was able to take control of the infrastructure used by this botnet. The effort injected sinkhole IP addresses into the botnet to neuter infections from the command and control (C2) level, as well as resulted in the arrests of multiple botnet operators across the world.

Recommendations

Review network logs for communication between internal devices and IP addresses listed in the Indicators of Compromise section of this report.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Discovered in 2014, and believed to be based in Russia, Emotet started as a banking trojan targeting hosts for banking credentials. From there, it pivoted into becoming a well-known “loader,” which would be used as an initial infection to gain access to systems, and then allowing operators to download additional payloads, like TrickBot, Ryuk, and Qbot.

Emotet used phishing emails with malicious Microsoft Office documents to infect machines, with lures including invoices, shipping notices, and more recently COVID-19 information. Once these documents were opened, users were instructed to “enable macros” which would allow the malware to run on the victim’s machine.

At its peak, there were three active botnets categorized as Epoch 1, Epoch 2, and Epoch 3 which were active simultaneously that involved hundreds of machines all over the world performing various functions to continue operations. These Epochs had multiple redundancies in place, where a failure in one C2 node along the chain could be compensated for by other C2 nodes.

Due to the coordinated efforts by Europol and the countries involved, authorities were able to route infected machines to law enforcement controlled infrastructure, effectively neutering the malware service.

Infection Vector

In 2020, Emotet distributed two types of phishing emails: short and simple messages and sophisticated templates exploiting popular brands and current events. Examples of the latter category involved the actors spreading phishing emails using COVID-19 and US presidential election-themed lures. The actors also incorporated social engineering techniques in their lures to make the phish more enticing to their targets.

When a target receives an Emotet-delivered spam message, it typically contains a malicious link or attachment that downloads a Microsoft Office file, usually a Word document or an Excel spreadsheet. The file contains a malicious macro script that is responsible for downloading additional malware binaries to the target device--a machine running a Microsoft Windows operating system. When the victim opens the Office file, they are instructed to enable macros that allow the malware to proceed with the infection process in the background of the environment.

One of the more common malware pairings is Emotet and Trickbot. Trickbot was commonly delivered via Emotet, and in 2020 the malware went through a brief takedown disruption period. During this time, Trickbot threat actors attempted to restore the malware after Microsoft and US Cyber Command disrupted parts of the malware’s infrastructure. In order to keep Trickbot operations running, the threat actors substituted Trickbot for other information-stealing malware, such as QBot, while leveraging Emotet capabilities to distribute their malware. In terms of ransomware, Emotet and Trickbot distributed the Ryuk ransomware in phishing campaigns from 2019 to 2020. By leveraging a botnet malware, information stealer, and ransomware in a single infection chain, threat actors can extract copious amounts of sensitive data that result in lasting consequences for victims.

Emotet exhibited some notable characteristics that make the botnet incredibly sophisticated, yet destructive. This is due to the threat actors constantly updating Emotet’s codebase and using creative techniques to distribute the malware to their victims. Emotet is highly evasive and can bypass some security technologies and gateways in order to infect its targets. It also has spamming features that allow the malware to traverse through networks to target more machines. The group has also been involved with injecting malicious links into old email threads to trick victims into believing they are responding to a legitimate email.

Summary

While this takedown has most likely disrupted this crimeware operation, it is not fully known how much damage this did to the operators managing the malware service. In addition, since Emotet was used to install other malware on systems, simply removing the infrastructure will still lead to more cleanup efforts to remove any additional malware that was installed on victim machines.

However, law enforcement officials in the Netherlands plan to release an Emotet update in March 2021 that removes the malware from infected computers. According to Europol officials involved with the disruption effort, the takedown prevents Emotet threat actors from selling access to Emotet-infected machines to other [threat actor groups].

There are a lot of unknowns left after this takedown, and it begs the question if any other “Malware-as-a-Service” (MaaS) steps in to fill the void left by Emotet. We assess that this won’t have any impact on current malware operations, due to these groups already knowing potential risks, and a large takedown effort of this scale will likely not prevent other MaaS actor groups from suspending operations.

Indicators of Compromise

ZeroFOX Threat Feed users can access URL's and SHA256 hashes related to Emotet via campaign ID 125

Sinkhole C2s, TLP:AMBER
hxxp://80[.]158[.]3[.]161:443/
hxxp://80[.]158[.]51[.]209:8080/
hxxp://80[.]158[.]35[.]51:80/
hxxp://80[.]158[.]63[.]78:443/
hxxp://80[.]158[.]53[.]167:80/
hxxp://80[.]158[.]62[.]194:443/
hxxp://80[.]158[.]59[.]174:8080/
hxxp://80[.]158[.]43[.]136:80/

SHA256 Hashes (Active as of 2021-01-26)
Epoch 1
bdfd63fb6d6470c88f4ff16afa74f98393ca081c8cad43286638346ad3d37dfe
fced3c3da291ca9404e83af3c9e214acf637bd382a0643d3fc0a6403207df233
8f93c092f73d368e551f6fa2fad40c4b0e759fcce89f919855eaa12a0c96948e
3e4d9a83ec504d8bf7a9e0ee976882d0c396e7913b9b08f65e7b9ca498439cdf
c18cf81874fe28d89c845b79794f5152f5e3914a2b276c030b791f109de7bb00
b37bbe424c878e7047e7f227e453a0dd116a379e3226087eef20c9cb58188804
bfd2a05d9bba662abd1f15084a932ee50bd29accf3534488a512e8c7b4956a69
0b3c8c9ad07157288b7851fbffcdcd85e6a318c7f441be2515589d76b9b9676a
93d6e0b5fd29d5ef1e0457c1b2010dc1aeb0ee1bd672a0321f6b714eb55d42f8
db23db5467dc8f0b0dfa39f89ec46943411b27a5e9c0357bd78bfb32eb6144cd
e7d3602f502eb0b1618429930e75760d0ca115a7be49ed069f5aea689af57870
5c18dc90343e1af8e62053f589532a19eddb42396190daea82ea44318943bce1
30b93281763e90d47ec2469ed87c93fcfc59d03a34af07fe760b9a3df0a9702f
3957fd94a8b63c71ad84cc6e2529ff230647e36a96dcc4e982b3855206d12e52
74072d7cebb5704cf2205d4afa1eaaa622676a333102ba5469ca92891e759d95
3d95011a36db23b18ec2ddb0540a1af69ca088cec1c1b8f4fc9641c0c5043560
a1fe19eb6ef590d2ee2b509c6f6c7964698ec54e14f73ca299336b6bf5a6d536
73cb07c945fe2014e0aed0369079ef95cc5cd405077eb94136336e8c49231153
7b355bdfe4419b5379936b0ddee4462836a3330ccf3e8d6f851faeed4b86ee48
558999ed36a39090301c915e39a8861f3bc59a5ae9ecb614ad436ae83f2a6f54
c4b56cb3c89d0194d42bb138911e1276b376c620c2d464a71294e01c4b99f29f
a3fd7815ab8c3c107e7993ce7c50636dffb66001c018b7f1d9fcb4603e8151f9
9bb67a3f2f140f5db086ffe00f5d27e6631448120d7f5d59cbea007bf27650fa
e16a8492c827219bb6f429bd94afff7de6eb383327c9f7215ff591664e6f6c07
fa227d10a96ea2b203f0a6ab52e44a90ee12cb681dd56263232badf9eb4f24d2
0fd81fb31ab99b116414a03092687e7d98d057387727460e0bbe809a6178b62d
485227bce45c59eb878b808df89e60f342215d39ac186c773dba884cdda21ace
70f22c98469ee47b713d7ccb0cf17dc230fbca10aa6af35aa44eca2c126b840b
b40a891aad0a37d88117eb4480acfb36628179af43625cd8b67c1ce000fc8fe9
63dfe037c27b99d0e56f885c19def87a04eb29bdd85de70182a940c0d62713a2
e312abff480a58178f098de492fdb0634856aa6da02f7c32863ec1db1199cefa
e6c0002126693ce3c1b1e34428af32ece371f29030ec7ed7fff6d65c1a64f13d
31407577ae4fd9871ac493ede06c060d96b1525e582498bbfd3c94fa2c3b2148
6f0661474263dea4b546d44d806919a70169dc9d0e2eb129773836df22174d0a
56d68f25e8675636723f8623aa9abde0a363238cb3d09e842507ebc0584c8d6e
96d6da85365ea8b3f051b8284be5972daf06a060cdb8bf7f7dc97c5ae4ec95b2
40072de5b1f4daed12a0ebc7514cbb754bbb927e572fe6cd747074b686b2d3e4
91cf53eef169ffa1e27e2ddc66979a3b5c2659ec618c4be4553bb2f538929071
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f
4759eabd2d5136021aea2257a0f203f7090c71e38d437af6eac36c17ea5e8b44

Epoch 2
1eecf0f725c19ee52789332964557e750eb40e2cc5a3166089f476bab7ec5d79
3363cb87e794a733304d0f6ed7819d08a9e2947239fc978bc17bcaa213134146
871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91
325c5b9a249e2e4131303027a1102e3aaacd213ef52ba776ef87cb721f3ed307
7f1845b6f27576b8d3f2b8123777a77ecdd388de19baff31bc5e069880f0cfb7
8a5c1b7bf29060ea596ae0d4bc8a0eac1b104c76ed8b9959bdade8df4344ff4f
1f6567578ef58c6be2d7113ab9abc2c487952fe073cdb2e0132497d35983c4e2
ca16433c97c81cf22d66e943e2cdce89c8453b87a84b1ce4405e98c1d934339c
e603608b774f1c3144afdfd7b959d3ca2ed3d7932d6e7d7908287e4a0da5964e
d4827ee5203aa425a265c49fa198539f7f46ae8ad97bdfe4dba1f17ac7799bb1
8603132f260f7dce47ec17236cd9b08a0281e9948fd50524386dcad8f7f72d01
2a17871c84820e097714859d00c7c11c94a72e5d8e0cd93c8448c2fd8417d03c
d603c358137a2762592f6850b64bb320415dacf2376539aa720f67e23b4bc207
e1770a9b08a9d0b4a254aa19132456a7f1e6892ff2f101979df4853f76ede7a6
6fce1a4c1c50d35994f12e833875d2aba80323a6a18d5408fbdb7ffb80102b28
b141e8279f594c1413a637d8de3abcb903ace6bccf76399a3ca4e80c4b10d41e
09c323bde291f47a0feac6e7938518e96a575104e4297dba15698e96392c4b8e
3a13de32c429219e409ac71af00840ea3f8e3f3c87d8e75feffacdef3672479f
0e6668dea63b61ccbdb65b0c984a1ade5928b81e782601a6b77fb8fbfc278d96
1783449ae781d4e24576a7bd6112ae484829d1d1e943dba9c5b13788f96eb486
70b90abd981e7c31337c04cea5ddc5676ec936161843434417aa7d6e11a0a34e
2a1ed9f5aeb88d0d024933eeae53d3a60214ca13c01fa9b2b08e0ab4fab91160
b81c0e488cca63029b6008973ca3b54982fff870b154c4a84072456f53d7502f
7e7cf37c9525c9c82f8035769a2d9d14b005f332e21b9e2843c7be75f5fd8ae2
5d9e2ea94a0f57bee2dadf402627db9213c91854f499b396d792663c543654c9
60a0bcffdff92533c3529262360c17138a6f9451f37d6283cf321ea66d88e158
52533fe21e7a85f9321fb7d464b50aeae8be6ae9e4603001df6b50b1b6f228c5
fbc2e951a30038ec41d7e370de3dc8a4c0c27d84ba21faf33c1062277c8c90b2
5540f38d5aea762d495d7090dc1a89da722637c111890448571ad163419d234e
630a9699821f02c51a0205d8e9910aeb3a6341b655d3f55bedc147cbe2adeef4
53a00c2701b169ca12685b3f0647f23d75365004a0ac2c8760a610a0fc0e106f
1a44fbce4b150cde78f67e05e58c027f7212a12bd351ac54c8e2b3f9eb870d5d
8c11a8e253bd5e4525de774fc67962bb8e51078385ec92c5547312a3b8bd88e2
ead9c2e5d425e25f650963bcbb68a544e073ac50938b75d37d1aebd1df4a9397
e153901bfef45c34c87d3d182bba6ef158e46464280a921f69efc5c11c2c765a
c5018a296b4e0faf02bfee3e646353a51f3aa6a6185d8db3823e9a73fbdb287b
7e77d551f616709105f92fce7f58f3db11b028eb743bff971f704e332675094e
41c719ec86b80b28e20279ac8d291fc3f883435de594d37740716033b03c3e9d
ab5f36ac16b675411be665102e9073fe0c57744ccdbd490002969c1429a63a39
8f976592470a09993e8612e18d59afd863606baa36553aa73894327373050098
cfcb4ad1df695d4a7ab66751f34997776408c4f6f91b8b869d979d3e544cf782
4e0b12e7331e1adadce11cadd640c84698e619718bf9387d3177862a8cb13213
ec19c82129441903ebcef964fee4f5f61e98b0eaa528cb2ac786c5ff68bcac99
71bc19b3748ecda9ccc9c76ff6317d38bdacc55a3537b377b260ffac52c73a07
52d1df6fe5d4369e5369eb2095161974d726b4b2e636544201c204528bad571d
5ee83f8fd3dac967ce5eb4e06f4d4762b3c0a832bc5d276dbea72871651c3514
ab7eca2bed6ca9975ca0ac4f817ebe1911374ee93420b020eb1e48b77514211d
734bf5656c8b2d19692fc207cdd23471910411fd166165e33094c71c4728158d
f643c19b061911b8ddb5653bdab6e6e1b561ae776083405c001180a92e3cb085
2672e9cc9cd038327a7147b6d791468e7fff4ded6bf145550e12588d95a15ce4
0d4dcf25c93fba0975709ae6566f223c9e50410cdb97f068fbdac6571d42be07

Epoch 3
3690f38b8bf113ce747f3b1d39ee0013fa56a525a7c87287ae72544819413f13
2cd1c91d8bfd268fba4471ca4cbc1415eb61b4c76832ebd99a2cbee452f9d1dd
9ecf542f504924626c0f18758a259f50e4e2f02d74c9b940bf291d4887bde56d

URLs (Active as of 2021-01-26)
Epoch 1
hxxp://shannared[.]com/content/lhALeS/

Epoch 2
hxxp://haumaguerraevoceoalvo[.]com[.]br/wp-includes/0Hm
hxxp://paulomarciotrp[.]com/z/y/

Breaking News: 2021-01-22 - 2021-01-28

SAP SolMan exploit released for max severity pre-auth flaw - BleepingComputer

A fully-functional exploit code is now publicly available for a maximum severity pre-auth vulnerability impacting default configurations of an SAP Solution Manager (SolMan) component. SAP SolMan is an application lifecycle manager designed to help unify the management of all SAP and non-SAP systems within a single interface. This critical security flaw is tracked as CVE-2020-6207 and it is caused by a missing authentication check in the EEM Manager Solman component that could lead to the takeover of connected SAP systems. To fully mitigate attacks attempting to exploit CVE-2020-6207 on their SAP systems, organizations are recommended to apply the security update released by SAP in March 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-solman-exploit-released-for-max-severity-pre-auth-flaw/

Amazon Kindle RCE Attack Starts with an Email

The “KindleDrip” attack would have allowed attackers to siphon money from unsuspecting victims. Three vulnerabilities in the Amazon Kindle e-reader would have allowed a remote attacker to execute code and run it as root, paving the way for siphoning money from unsuspecting users. The attackers leveraged the obscure image format called JPEG XR that is supported by the Kindle web browser. It is possible to trigger a buffer overflow while parsing JPEG XR with the Kindle, with controlled bytes from an JPEG XR image file. The attack works on Kindles with firmware version 5.13.2 or below. Amazon has fixed KindleDrip in the latest update, firmware version 5.13.4.

See the full report here: https://threatpost.com/amazon-kindle-attack-email/163282/

Bonobos clothing store suffers a data breach, hacker leaks 70GB database - BleepingComputer

Bonobos men's clothing store has suffered a massive data breach exposing millions of customers' personal information after a cloud backup of their database was downloaded by a threat actor. The threat actor known as ShinyHunters, posted a monstrous 70 GB SQL file containing various internal tables used by the Bonobos website. The database also includes various data, such as customers' addresses, phone numbers, partial credit card numbers (last four digits), order information, password histories. Though the database did not include full payment information in the database, threat actors can use the partial data in targeted phishing attacks. Bonobos has confirmed the data breach and requested all the users to immediately change their passwords on the site.

See the full report here: https://www.bleepingcomputer.com/news/security/bonobos-clothing-store-suffers-a-data-breach-hacker-leaks-70gb-database/

Facebook users were mass-logged out Friday by configuration change - BleepingComputer

According to reports, Facebook blamed a configuration change for logouts and confirmed that some users had experienced problems. On January 22, some people logged out of their Facebook accounts due to a configuration change. Facebook investigated and fixed this issue.

See the full report here: https://www.bleepingcomputer.com/news/technology/facebook-users-were-mass-logged-out-friday-by-configuration-change/

Rogue CCTV technician spied on hundreds of customers during intimate moments

A home security technician was found guilty for illegally accessing cameras he installed and viewed customers engaging in intimate acts. Telesforo Aviles, a 35-year-old former employee of home and small office security company ADT, said that over five years, he accessed the cameras of roughly 200 customer accounts on more than 9,600 occasions, all without the permission or knowledge of customers.

See the full report here: https://www.zdnet.com/article/rogue-cctv-technician-spied-on-hundreds-of-customers-during-intimate-moments/

Experts Detail A Recent Remotely Exploitable Windows Vulnerability

More details have emerged about a security feature bypass vulnerability in Windows NT LAN Manager (NTLM) addressed by Microsoft as part of its monthly Patch Tuesday updates earlier this month. The flaw tracked as CVE-2021-1678 (CVSS score 4.3) could allow attackers to relay NTLM authentication sessions to an attacked machine and use a printer spooler MSRPC interface to remotely execute the code.

See the full report here: https://thehackernews.com/2021/01/experts-detail-recent-remotely.html

FSB warns of US cyberattacks after Biden administration comments

The Russian government has issued a security warning to organizations in Russia about possible retaliatory cyberattacks by the USA for the SolarWinds breach. In responses to questions about the cyberattack, White House press secretary Jen Psaki indicated that the USA might retaliate in kind to whoever has conducted the attacks.

See the full report here: https://www.zdnet.com/article/fsb-warns-of-us-cyberattacks-after-biden-administration-comments/

Intel: Hackers stole unpublished earnings info from corporate site - BleepingComputer

Intel disclosed on Thursday that unknown threat actors stole an infographic containing info on the company's fourth-quarter and full-year 2020 financial results. The data was part of Intel's yet unpublished quarterly earnings the company was planning to publish and file with the U.S. Securities and Exchange Commission after the stock market closed on Thursday. The infographic was accessed and exfiltrated from Intel's corporate PR newsroom website. However, after discovering the incident, Intel published the quarterly earnings report minutes before the market's closure.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-hackers-stole-unpublished-earnings-info-from-corporate-site/

Discord-Stealing Malware Invades npm Packages

Three malicious software packages named an0n-chat-lib, discord-fix, and sonatype have been published to npm, a code repository for JavaScript developers to share and reuse code blocks. These packages leveraged brandjacking and typosquatting techniques. According to the researchers, the actor(s) who authored these packages are the authors of the CursedGrabber Discord malware family that was discovered earlier. The packages represent a supply-chain threat given that they may be used as building blocks in various web applications; any applications corrupted by the code can steal tokens and other information from Discord users.

See the full report here: https://threatpost.com/discord-stealing-malware-npm-packages/163265/

SonicWall firewall maker hacked using zero-day in its VPN device - BleepingComputer

Security hardware manufacturer SonicWall has issued an urgent security notice about threat actors exploiting a zero-day vulnerability in their VPN products to perform attacks on their internal systems. SonicWall has stated that hackers used a zero-day vulnerability in their Secure Mobile Access (SMA) VPN device and its NetExtender VPN client in a "sophisticated" attack on their internal systems. SonicWall has not released detailed information about the zero-day vulnerabilities. Based on the mitigation steps, they appear to be pre-auth vulnerabilities that can be remotely exploited on publicly accessible devices.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-firewall-maker-hacked-using-zero-day-in-its-vpn-device/

New website launched to document vulnerabilities in malware strains

A security researcher has launched a web portal that lists vulnerabilities in the code of common malware strains. The new MalVuln portal is available at malvuln[.]com. It lists the software's name (in this case, the malware's name), describes the vulnerability in technical detail, and provides proof-of-concept (PoC) exploit code so others can reproduce the issue. Currently, MalVuln lists 45 security flaws.

See the full report here: https://www.zdnet.com/article/new-website-launched-to-document-vulnerabilities-in-malware-strains/

Hacker leaks data of 2.28M users of dating site MeetMindful

A well-known threat actor ShinyHunters has leaked the data of more than 2.28 million users registered on the dating site MeetMindful on a publicly accessible hacking forum. The leaked data, a 1.2 GB file, appears to be a dump of the site’s users database. It contains real names, email addresses, city, state, and ZIP details, body details, dating preferences, marital status, birth dates, latitude and longitude, IP addresses, bcrypt-hashed account passwords, Facebook user IDs, and Facebook authentication tokens. MeetMindful is yet to confirm the alleged data breach.

See the full report here: https://securityaffairs.co/wordpress/113803/uncategorized/meetmindful-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=meetmindful-data-leak

Chipmaker Intel reveals that an internal error caused a data leak

The computer chipmaker Intel Corp. earlier stated that a threat actor stole financially sensitive information from its site and for this reason, it anticipated the release of a quarterly earnings report to avoid that attackers could use this data for operations on the stock market. However, the company confirmed that attackers did not compromise the corporate network. The company excluded the hack and confirmed the incident was caused by an internal error.

See the full report here: https://securityaffairs.co/wordpress/113794/data-breach/intel-data-leak-2.html?utm_source=rss&utm_medium=rss&utm_campaign=intel-data-leak-2

Indian Crypto Exchange Buyucoin Hacked, Sensitive Data of 325K Users Reportedly Leaked – Exchanges Bitcoin News - Bitcoin News

Sensitive data of nearly 3.25 lakh users of India-based global cryptocurrency exchange and wallet, BuyUcoin, have been exposed on the Dark Web. The data leaked included names, e-mails, mobile numbers, encrypted passwords, user wallet details, order details, bank details, KYC details (PAN number, passport numbers), and deposit history. According to an independent cybersecurity researcher, the 6GB file on the MongoDB database contains three backup files containing BuyUcoin data.

See the full report here: https://news.bitcoin.com/indian-cryptocurrency-exchange-buyucoin-hacked-data-users-leaked/

Another ransomware now uses DDoS attacks to force victims to pay - BleepingComputer

The Avaddon ransomware gang now uses DDoS attacks to take down a victim's site or network until the victim contacts them and begins negotiating. A distributed denial of service (DDoS) attack is when a threat actor floods a website or a network connection with more requests than it can handle, making the service inaccessible.

See the full report here: https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/

Windows 10 NTFS corruption bug gets unofficial temporary fix - BleepingComputer

OSR, a software development company specializing in Windows internals, has released an open-source filter driver that prevents the NTFS bug from being abused while waiting for an official fix from Microsoft. This filter driver, called i30Flt, will monitor for attempts to access streams beginning with “:$i30:", and if detected, block them before they can trigger the bug.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-ntfs-corruption-bug-gets-unofficial-temporary-fix/

Australian securities regulator discloses security breach - BleepingComputer

The Australian Securities and Investments Commission (ASIC) has revealed that one of its servers has been accessed by an unknown threat actor following a security breach. In response to the security breach, ASIC has disabled access to the impacted server and is working on providing an alternative credit application submission channel.

See the full report here: https://www.bleepingcomputer.com/news/security/australian-securities-regulator-discloses-security-breach/

Cisco DNA Center Bug Opens Enterprises to Remote Attack

A cross-site request forgery (CSRF) vulnerability in the Cisco Digital Network Architecture (DNA) Center could open enterprise users to remote attack and takeover. The flaw, tracked as CVE-2021-1257, exists in the web-based management interface of the Cisco DNA Center, which is a centralized network-management and orchestration platform for Cisco DNA.

See the full report here: https://threatpost.com/cisco-dna-center-bug-remote-attack/163302/

Google: North Korean hackers have targeted security researchers via social media

Google disclosed a North Korean government-backed hacking group targeting security researchers who focus on vulnerability and exploit development via social networks. According to a report released by Google's Threat Analysis Group, a North Korean government-backed hacking group uses social networks to target security researchers and infect their computers with a custom backdoor malware.

See the full report here: https://www.zdnet.com/article/google-north-korean-hackers-have-targeted-security-researchers-via-social-media/

Beware of active UK NHS COVID-19 vaccination phishing campaign - BleepingComputer

A very active phishing campaign is underway pretending to be from the UK's National Health Service (NHS), alerting recipients that they are eligible to receive the COVID-19 vaccine. To help people spot NHS COVID-19 phishing scams, the NHS tweeted today that the vaccine is free of charge and that they will never ask for bank account info or copies of personal identification documents.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-of-active-uk-nhs-covid-19-vaccination-phishing-campaign/

Leading crane maker Palfinger hit in global cyberattack - BleepingComputer

Leading crane and lifting manufacturer Palfinger has been targeted in an ongoing global cyberattack, disrupting IT systems and business operations. Palfinger is an Austrian company with over 11,000 employees over 35 locations and generated €1.75 billion in revenue for 2019.

See the full report here: https://www.bleepingcomputer.com/news/security/leading-crane-maker-palfinger-hit-in-global-cyberattack/

ProtonVPN causes Windows BSOD crashes due to antivirus conflicts - BleepingComputer

ProtonVPN is working on fixing a bug causing Windows blue screen crashes affecting customers using the latest versions of the company's Windows client software. The BSOD crashes don't affect all users and are caused due to conflicts with unnamed antivirus software solutions.

See the full report here: https://www.bleepingcomputer.com/news/software/protonvpn-causes-windows-bsod-crashes-due-to-antivirus-conflicts/

Outgoing FCC Chair Issues Final Security Salvo Against China

Outgoing Federal Communications Chair Ajit Pai has issued a final warning about Chinese telcos at the end of a tenure spent cracking down on companies like Huawei, ZTE, and China Telecom. Pai, a former telecommunications industry lobbyist and in-house counsel for Verizon, told Reuters that managing security threats against U.S. networks from Chinese espionage will be the biggest national security issue that regulators will face in the next four years.

See the full report here: https://threatpost.com/outgoing-fcc-chair-security-china/163318/

Dutch COVID-19 patient data sold on the criminal underground

Dutch police have arrested two individuals on Friday for allegedly selling data from the Dutch health ministry's COVID-19 systems on the criminal underground. The arrests came after an investigation by RTL Nieuws reporter Daniel Verlaan who discovered ads for Dutch citizen data online, advertised on instant messaging apps like Telegram, Snapchat, and Wickr.

See the full report here: https://www.zdnet.com/article/dutch-covid-19-patient-data-sold-on-the-criminal-underground/

Man arrested after UK school finds wiped hard drives on devices connected to network

A 28-year-old was arrested for allegedly performing what police labeled the school as a sophisticated cyberattack. The police officers received a report of a major IT outage at the school on Monday, January 18, 2021, that prevented the school from delivering remote learning and accessing material to support the children of keyworkers and vulnerable children attending school.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/01/25/leicestershire_school_computer_misuse/

Tesla sues ex-employee over alleged 'brazen' theft of confidential code, files

American electric vehicle company Tesla has sued one of its former employees for allegedly stealing company information. According to the reports, Tesla stated that software engineer Alex Khatilov stole files from the internal network related to its Warp Drive software.

See the full report here: https://www.zdnet.com/article/tesla-sues-ex-employee-over-alleged-code-file-theft/

Beware — A New Wormable Android Malware Spreading Through WhatsApp

Android users are being warned against a wormable strain of malware that spreads itself by automatically replying to victims' WhatsApp messages with a malicious link. This Android malware connects its victim with a convincing web page resembling Google Play Store and a request to install a fake Huawei Mobile app onto a user's device.

See the full report here: https://thehackernews.com/2021/01/beware-new-wormable-android-malware.html

DanaBot Malware Roars Back into Relevancy

Researchers are warning that a new fourth version of the DanaBot banking trojan has surfaced after months of mysteriously going quiet. The latest variant, still under analysis by researchers, is raising concerns given the number of past DanaBot effective campaigns. DanaBot is a banking trojan that first targeted users in Australia via emails containing malicious URLs. Reports suggest that the new variant has a similar set of tools as the previous versions. One of the main features includes a ToR component to anonymize communications between the bad-guys and infected hardware. With this new variant, researchers identified several new Affiliate IDs, suggesting that the malware-as-a-service component to DanaBot was very much active and growing.

See the full report here: https://threatpost.com/danabot-malware-roars-back/163358/

Firefox 85 adds supercookie protection, removes Flash support - BleepingComputer

Mozilla Firefox 85 was released today with supercookie protection to block hidden trackers from tracking Firefox users' activity while browsing the Internet. Supercookies are trackers that can stay hidden in a browser and track the user online, even after the cookies are cleared. The new version isolate caches and network connections for each visited website. This makes supercookies useless for tracking users while browsing between sites. Firefox 85 also addresses multiple security vulnerabilities with severity ratings ranging from low to high severity.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-85-adds-supercookie-protection-removes-flash-support/

Ransomware Disrupts Operations at Packaging Giant WestRock

Operations at $17 billion packaging firm WestRock were disrupted by a ransomware attack that impacted both its IT and operational technology (OT) networks. WestRock is working with security vendors on system recovery efforts and on minimizing the impact on customers.

See the full report here: https://www.darkreading.com/attacks-breaches/ransomware-disrupts-operations-at-packaging-giant-westrock/d/d-id/1339990

23M Gamer Records Exposed in VIPGames Leak

Casual gaming provider VIPGames[.]com has suffered a data breach, exposing millions of records relating to users of the service. In all, more than 23 million records for more than 66,000 users were left exposed due to cloud misconfiguration. The exposed data included usernames, emails, IP addresses, hashed passwords, Facebook, Twitter, and Google IDs, bets, and even data on players who were banned from the platform.

See the full report here: https://threatpost.com/gamer-records-exposed-vipgames-leak/163352/

Google fixes severe Golang Windows RCE vulnerability - BleepingComputer

Google has addressed a severe remote code execution (RCE) vulnerability tracked as CVE-2021-3115 in the Go language (Golang), mainly impacting Windows users of Go running the go get command, due to the default behavior of Windows PATH lookups. The vulnerability stems from how the compile process works when a user runs the "go get" command to fetch a repository. The Golang team at Google has fixed the vulnerability and users are advised to upgrade to the recently released Go versions 1.14.14 (for 1.14.x and earlier) and 1.15.7 (for users of 1.15.x) to mitigate this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/google-fixes-severe-golang-windows-rce-vulnerability/

Nvidia Squashes High-Severity Jetson DoS Flaw

Nvidia has patched three vulnerabilities affecting its Jetson lineup, a series of embedded computing boards designed for machine-learning applications, in things like autonomous robots, drones, and more. A successful exploit could potentially cripple any such gadgets leveraging the affected Jetson products.

See the full report here: https://threatpost.com/nvidia-squashes-high-severity-jetson-dos-flaw/163360/

Apple fixes another three iOS zero-days exploited in the wild

Apple released patches for three zero-day vulnerabilities that were exploited in the wild. The first zero-day impacts the iOS operating system kernel (CVE-2021-1782), and the other two were discovered in the WebKit browser engine (CVE-2021-1870 and CVE-2021-1871).

See the full report here: https://www.zdnet.com/article/apple-fixes-another-three-ios-zero-days-exploited-in-the-wild/

Nefilim Ransomware Gang Hits Jackpot with Ghost Account

A Nefilim ransomware attack that locked up more than 100 systems stemmed from the compromise of an unmonitored account belonging to an employee who had died three months previously. According to a Sophos researcher, the gang compromised the victim by exploiting security flaws of Citrix software, after which they gained access to an admin account. From there, it stole the credentials for a domain admin account using Mimikatz.

See the full report here: https://threatpost.com/nefilim-ransomware-ghost-account/163341/

TikTok Flaw Lay Bare Phone Numbers, User IDs For Phishing Attacks

A vulnerability identified in the popular video-sharing app TikTok exposed users to having personal information scraped from their profile, including their phone number and profile settings. There's no evidence that the vulnerability was ever exploited, and the flaw has reportedly been patched.

See the full report here: https://threatpost.com/tiktok-flaw-phishing-attacks/163322/

Verizon Fios fiber cut causes Internet outage in Northeastern US - BleepingComputer

Verizon says that it has resolved issues with Fios, its fiber-optic network, that affected many locations in the Northeastern US for hours on Tuesday. The company says things should be returning to normal, but a fiber cut in Brooklyn may mean that some might still be without service.

See the full report here: https://www.bleepingcomputer.com/news/technology/verizon-fios-fiber-cut-causes-internet-outage-in-northeastern-us/

US and Bulgarian authorities disrupt NetWalker ransomware operation

Law enforcement agencies from Bulgaria and the US have disrupted this week the infrastructure of NetWalker, one of 2020's most active ransomware gangs. Bulgarian officials seized a server used to host dark web portals for the NetWalker gang, while officials in the US indicted a Canadian national, Sebastien Vachon-Desjardins, who allegedly made at least $27.6 million from infecting companies with the NetWalker ransomware. It is currently unclear if he is the creator of the NetWalker ransomware or one of its "affiliates" who rented the ransomware code from the original creator.

See the full report here: https://www.zdnet.com/article/us-and-bulgarian-authorities-dirsupt-netwalker-ransomware-operation/

Emotet botnet disrupted after global takedown operation - BleepingComputer

Following an international coordinated action organized by Europol and Eurojust, the infrastructure of today's most dangerous botnet built by cybercriminals using the Emotet malware was taken down from the inside after gaining control of its servers earlier this week and the infected machines of victims have been redirected towards this law enforcement-controlled infrastructure. The infrastructure used by EMOTET involved several hundreds of servers located across the world, all of these having different functionalities to manage the computers of the infected victims, to spread to new ones, to serve other criminal groups, and to ultimately make the network more resilient against takedown attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-botnet-disrupted-after-global-takedown-operation/

Remote Attackers Can Now Reach Protected Network Devices via NAT Slipstreaming

A new version of a known network-address translation (NAT) slipstreaming attack has been uncovered, which would allow remote attackers to reach multiple internal network devices, even if those devices don’t have access to the internet. According to researchers, the attackers can now fool the NAT in such a way that it will create incoming paths to any device on the internal network, and not only to the victim device that clicked on the link. This issue can be mitigated by applying browser patches including, Chrome v87.0.4280.141, Firefox v85.0, and Safari v14.0.3, and Microsoft’s Edge browser is also now patched since it relies on the Chromium source code.

See the full report here: https://threatpost.com/remote-attackers-internal-network-devices-nat-slipstreaming/163400/

Microsoft rolls out Application Guard for Office to all customers - BleepingComputer

Microsoft has announced that Application Guard for Office is now generally available for all Microsoft 365 users with supported licenses. Application Guard for Office blocks files downloaded from untrusted sources from gaining access to trusted resources by opening them in sandboxes. Application Guard for Office works with Word, Excel, and PowerPoint for Microsoft 365 and it will be toggled off by default. Admins can only deploy it on endpoints running at least Windows 10 Enterprise edition, version 2004 (20H1), with the cumulative monthly security update KB4571756 installed.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-rolls-out-application-guard-for-office-to-all-customers/

TeamTNT Cloaks Malware With Open-Source Tool

The TeamTNT threat group has added a new detection-evasion tool, libprocesshider, to hide its crypto mining malware from process-information programs. The tool is copied from open-source repositories located on Github, and is described as having capabilities to hide a process under Linux using the ld preloader. The new tool is delivered within a base64-encoded script, hidden in the TeamTNT cryptominer binary, or via its Internet Relay Chat (IRC) bot, called TNTbotinger, which is capable of distributed denial of service (DDoS) attacks.

See the full report here: https://threatpost.com/teamtnt-cloaks-malware-open-source-tool/163414/

Critical Vulnerability Patched in 'sudo' Utility for Unix-Like OSes

Sudo has patched a critical buffer overflow vulnerability that could allow unauthenticated local users to gain root privileges on a host system. Tracked as CVE-2021-3156, the flaw impacts all versions of sudo from 1.8.2 to 1.8.31p2 and 1.9.0 through 1.9.5p1. Researchers recommend that all organizations using Unix and Linux distributions with sudo-enabled in them immediately implement vendor supplied patches or upgrade to sudo 1.9.5p2, the latest version of the utility.

See the full report here: https://www.darkreading.com/application-security/critical-vulnerability-patched-in-sudo-utility-for-unix-like-oses/d/d-id/1339996