Threat Intelligence Bulletin: 01/29/2021 - 02/04/2021

LogoKit: Analysis of dynamic phishing kit targeting Microsoft customers

The phishing kit targeting Microsoft customers, LogoKit, has recently been highlighted within several articles citing it’s capability to dynamically load in company logos depending on the email address provided by the potential victim. This technique is especially effective in getting victims to trust the legitimacy of the web page as this event is also present on Office 365’s own login workflow.

This technique of dynamically loading in assets however is not recent, and the code within LogoKit has been altered, reused and integrated within similar phishing kits since at least early 2020.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

LogoKit refers to a type of phishing kit currently being used in a very active phishing campaign targeting Office 365 users. It utilises JavaScript within it’s source files to pull in company logos from clearbit[.]com based on the email address provided. Clearbit is a marketing firm which also provides a free service and API endpoint to retrieve logos for many companies across the globe. The default landing page is a copy of an older version of Microsoft’s Office 365 login portal.

Figure 1: LogoKit phishing page (left), Legitimate Microsoft login page (right)

When an email address is populated within the login form, or appended to the phishing pages URL an AJAX call is made to clearbit[.]com to pull in a logo associated with the email addresses domain.

Figure 2: Logo populated based on provided email address domain

Figure 3: AJAX code calling logo.clearbit[.]com for the email address domain

Upon entering an email address and password, the information is submitted to a dropper email address configured by the threat actor deploying the kit. The victim is prompted for their password twice before the site then redirects them to a concatenation of www. + email address domain.

Figure 4: JavaScript code responsible for redirecting the victim at the end of the phishing workflow

ZeroFOX Alpha Team have analysed multiple variants of this kit, with most of the source code remaining intact between versions, including spelling errors. The main difference found within these kits is the wording of emails sent to the threat actors dropper mailbox, where various threat actors have updated the “created by” line within the template.

Figure 5: Aliases claiming ownership of creation differ between copies of the kit

The primary TTP of note for this kit however is not a new concept. Phishing kits utilising clearbit to retrieve brand logos based on input is present within hundreds of separate families of kits, with targets ranging from retail and banking, to document sharing platforms and technology companies.

Figure 6: Source code of other kits utilising similar functionality

During tracking of this campaign ZeroFOX Alpha Team obtained several copies of LogoKit which contained a hidden .git directory. Git is a distributed version-control system for tracking changes in files, and is used with providers such as Github to host and manage project source code. Within this directory there are multiple files containing compressed copies of files, metadata and other artifacts. The compressed source code, once expanded, contains PHP code designed to phish for Sharepoint online and Office 365 credentials, similar to LogoKit. Comparing the source code to that within LogoKit shows the JavaScript code has likely originated from this original project.

Figure 7: Original code within .git directory (left), LogoKit source code (right)

Additional data included within the hidden directory provides information about the original repository for the project including the author and email address associated with the Github account. Timestamps also indicate this project was originally created on Thursday, 16 January 2020.

Figure 8: Repo and commit history exposing the account name and email address of the owner

Conclusion

Phishing is a serious threat and phishing kit operators and authors are consistently changing tactics to steal sensitive financial and personal information from unsuspecting victims. Due to the lack of any form of obfuscation, DRM or controls within LogoKit’s source code Alpha Team assesses with HIGH likelihood that the kit will continue to be altered and redistributed over time. ZeroFOX advises implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of cyberattacks.

Indicators

[email protected]
[email protected],
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

1d4cff66d95060a01ee2a7dc659018163085a992e8609e37d5a906d72b66411d
4ac7c82865cf478c2e1a19f97b3a011d5699fa9657d1323eac4417d7c3cfafbc
6bc6e1a35fe651adcd99c693c2eb20011518857691e9f4b51023e581a9c51810
6d1f3f87a2013fe5c8d7090a7250d6bf031e364b7fcd47fd119872dfc9630f31
875d805c9fabc210f3aa5757491c1bae0eba690a328e9c0ddcf7626fa3053c71
9e2dafc31bcd2c4ec74b240b02dc4d5f6af66b5dee850f8882b351f7119c816f
a9735703836fd821b2984324a28be4a4311407b33f81ea6638d124e67900b441
e6134584b5140e10d6fde2f23901bcc0ff3f54adeaca2f68c91dc313f753ca7f
e6567c475b4ca98a5310cb1b07ca854511919a8347d10ba4848a02b86fdf1e58

Breach Disclosure: Bonobos

Bonobos, the popular men's clothing store, suffered a data breach in January 2021 exposing the records of over 7 million customers. The data includes shipping addresses, phone numbers, partial credit card numbers, order information and password history (hashed with SHA-256). This breach has been attributed to ShinyHunters, which continues to release breached data and databases for free after they appear for sale in hacker forums.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The hacker under the alias of ShinyHunters posted the breached Bonobos database data for free on a popular hacking forum, providing download links for a 70GB SQL file containing a dump of data from the breached database. This SQL file can be used to recreate internal databases used by Bonobos website, including customer information which could be used for fraudulent purposes or targeted phishing attacks.

Figure 1: Post from ShinyHunters advertising Bonobos breach data

The breached data contains 7 million shipping addresses, 1.8 million records of account information and 3.5 million partial credit card numbers. Passwords are also contained in the data and are salted and hashed using SHA-256. Other users of the hacker forum are also posting cracked email and password combinations for sale from the data breach.

Figure 2: Other users advertising cracked passwords for sale

Breach Disclosure: MeetMindful

MeetMindful, the online dating site has reportedly experienced a data breach impacting the PII of over 2.28 million members. This breach has been attributed to Shiny Hunters, who continue their spree of compromising companies and releasing the data on popular hacking fofurms.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Reports have said this breach happened one year ago, with breach data just now surfacing on hacker forums. Included in this breach was PII for over 2.28 million members, including:

• Real names
• Email addresses
• City, state, and ZIP details
• Body details
• Dating preferences
• Marital status
• Birth dates
• Latitude and longitude
• IP addresses
• Bcrypt-hashed account passwords
• Facebook user IDs
• Facebook authentication tokens

This breach is particularly valuable since it provides so much personal information about victims, that can be used for pretexting and in phishing campaigns against these users. In addition, depending on who was on the site, the information can be used for blackmail or for "sextortion" campaigns against these victims as well.

Figure 1: Breach advertisement on RaidForums

Breach Disclosure: Pixlr

On 20 January 2021, BleepingComputer published an article detailing the breach of free online photo editing application, Pixlr. The breach contains 1.9 million rows of names, e-mail addresses, social media profiles, the user's country and SHA-512 password hashes. This is 1 of the many breaches leaked by ShinyHunters in January.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

ShinyHunters posted the breach data for free in a thread on RaidForums on 16 January, 2021. As of the writing of this advisory, Pixlr has not acknowledged the breach. According to the post by ShinyHunters, the company was breached at the same time as 123RF. Both companies are owned by Inmagine, a company that owns a number of subsidiaries that are rooted in design and media.

Figure 1: ShinyHunters post. Source: BleepingComputer

Breaking News: 2021-01-29 - 2021-02-04

Perl.com domain stolen, now using IP address tied to malware - BleepingComputer

The domain name perl.com was stolen this week and now points to an IP address associated with malware campaigns. On January 27th, the Perl NOC site posted that the perl.com domain was hijacked and is now pointing users to a different IP address. The IP address that perl.com is now hosted has a long history of being used in older malware campaigns and more recent ones. For now, it is strongly advised not to visit perl.com until the domain is restored back, as attackers could very easily switch it to a site for more malicious purposes.

See the full report here: https://www.bleepingcomputer.com/news/security/perlcom-domain-stolen-now-using-ip-address-tied-to-malware/

New Pro-Ocean malware worms through Apache, Oracle, Redis servers - BleepingComputer

The financially-motivated Rocke hackers are using a new piece of cryptojacking malware called Pro-Ocean to target vulnerable instances of Apache ActiveMQ, Oracle WebLogic, and Redis. They are targeting cloud applications and leverage known vulnerabilities to take control of unpatched Oracle WebLogic (CVE-2017-10271) and Apache ActiveMQ (CVE-2016-3088) servers and unsecured Redis instances. The new malware is a step up from the previous threat used by the group in that it comes with self-spreading capabilities, blindly throwing exploits at discovered machines.

See the full report here: https://www.bleepingcomputer.com/news/security/new-pro-ocean-malware-worms-through-apache-oracle-redis-servers/

WordPress Pop-Up Builder Plugin Flaw Plagues 200K Sites

WordPress plugin, Popup Builder – Responsive WordPress Pop up – Subscription & Newsletter, contains a vulnerability that could be exploited by attackers to send out newsletters with custom content or to delete or import newsletter subscribers. The flaw impacts versions 3.71 and below and stems from a lack of authorization for AJAX methods in the plugin. The flaw is fixed in version 3.72 of the plugin where the AJAX actions now have an authorization check barring attackers from exploiting the flaw. Users are urged to apply the patches to defend themselves from attacks emanating from the flaw.

See the full report here: https://threatpost.com/wordpress-pop-up-builder-plugin-flaw-plagues-200k-sites/163500/

Google deploys Chrome mitigations against new NAT Slipstreaming attack

Google has blocked eight additional ports inside the Chrome web browser to prevent the new variant of NAT Slipstreaming attacks that replace SIP and piggybacks on the H.323 multimedia protocol to open the same tunnels inside internal networks and bypass firewalls and NAT tables. Google has blocked connections to port 1720, used by the H.323 protocol, and has also blocked seven other ports, including 69, 137, 161, 1719, 1723, 6566, and 10080. Any HTTP, HTTPS, or FTP connections via these ports will now fail. The block is already active for users of Chrome version 87.0.4280.117 and later.

See the full report here: https://www.zdnet.com/article/google-deploys-new-chrome-mitigations-against-new-nat-slipstreaming-attack/

Industrial Gear at Risk from Fuji Code-Execution Bugs

Fuji Electric’s Tellus Lite V-Simulator and V-Server Lite contain multiple vulnerabilities that could allow attackers to take advantage of operational technology (OT)-IT convergence on factory floors, at utility plants, and more. The bugs include multiple stack-based buffer overflow issues, out-of-bounds read issues, out-of-bounds write issues collectively tracked as CVE-2021-22637, CVE-2021-22655, CVE-2021-22653, an uninitialized-pointer issue CVE-2021-22639, and a heap-based buffer overflow issue CVE-2021-22641. Successful exploitation of these vulnerabilities could allow an attacker to execute code under the privileges of the application. Administrators are urged to apply available patches as soon as possible.

See the full report here: https://threatpost.com/industrial-gear-fuji-code-execution-bugs/163490/

Fonix ransomware shuts down and releases master decryption key - BleepingComputer

The Fonix Ransomware operators have shut down their operation and released the master decryption allowing victims to recover their files for free. Fonix Ransomware, also known as Xinof and FonixCrypter, began operating in June 2020 and has been steadily encrypting victims since. A Twitter user claiming to be a Fonix ransomware admin announced that the ransomware had shut down. In a different tweet, the Fonix admin shared a link to a RAR archive named 'Fonix_decrypter[.]rar' containing both a decryptor and the master private decryption key.

See the full report here: https://www.bleepingcomputer.com/news/security/fonix-ransomware-shuts-down-and-releases-master-decryption-key/

UK Research and Innovation (UKRI) suffers ransomware attack - BleepingComputer

The UK Research and Innovation (UKRI) has suffered a ransomware attack that encrypted data and impacted two of its services, one offering information to subscribers and the platform for peer review of various parts of the agency. Furthermore, the UKRO subscription service has 13,000 users and the hackers may have taken data belonging to them - non-sensitive, personal information. Should the investigation reveal a data theft, UKRI will contact affected individuals.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-research-and-innovation-ukri-suffers-ransomware-attack/

Vovalex is likely the first ransomware written in D - BleepingComputer

New ransomware called Vovalex is being distributed through fake pirated software that impersonates popular Windows utilities, such as CCleaner. Vovalex may be the first ransomware written in D. The sample is distributed as a warez copy of the CCleaner Windows utility. When executed, the ransomware will launch a legitimate CCleaner installer and copy itself to the random file name in the %Temp%folder. The ransomware will begin to encrypt files on the drive and append the .vovalex extension to encrypted file's names. It then drops a ransom note named README.VOVALEX.txt on the desktop.

See the full report here: https://www.bleepingcomputer.com/news/security/vovalex-is-likely-the-first-ransomware-written-in-d/

Ransomware attack temporarily shuts down Georgia hospital's phone lines, computer systems - Becker's Hospital Review

Crisp Regional Health Services was recently the victim of a ransomware attack, which affected some of its systems and encrypted their files. Officials said they found out about the attack Wednesday morning when nurses started seeing encrypted files. The hospital immediately initiated an internal investigation and engaged data security professionals to assist.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/ransomware-attack-temporarily-shuts-down-georgia-hospital-s-phone-lines-computer-systems.html

Ramsey Co. ransomware attack exposes personal data of thousands - Bring Me The News

Ramsey County officials are releasing details of a data security incident where hackers may have gained access to the personal information of thousands of residents. On Friday, the province announced that one of its technical service providers, Netgain Technology LLC, was hacked on December 2, 2020, by an outside malicious hacker who attempted to extort payment from the company. A technical analysis found that as many as 8,700 people had access to their data. All are customers of one of the county’s public health programs.

See the full report here: https://bringmethenews.com/minnesota-news/ramsey-co-ransomware-attack-exposes-personal-data-of-thousands

Ransomware attack targets major US logistics firm DSC - FreightWaves

DSC Logistics, a third-party logistics provider and supply chain management firm near Chicago, was targeted in a ransomware attack. DSC, which is owned by South Korean supply chain management conglomerate CJ Logistics, disclosed the cyberattack after a ransomware gang threatened to expose stolen data on a leak site. The firm specializes in consumer packaged goods and food logistics and helps large corporations manage internal supply chains.

See the full report here: https://www.freightwaves.com/news/ransomware-attack-targets-major-us-logistics-firm-dsc

Police to probe hacker group 'Anonymous Malaysia' - Malaysiakini

Police have opened an investigation paper on the hacker group Anonymous Malaysia, which issued a second warning today that it would launch a cyber attack. Bukit Aman Commercial Crime Investigation Department director Datuk Zainuddin Yaacob said its cybercrime division received a report regarding the hackers’ threat and would conduct an investigation on public mischief and criminal intimidation.

See the full report here: https://www.malaysiakini.com/news/560975

Exploiting a bug in Azure Functions to escape Docker

A security researcher has disclosed an unpatched vulnerability in Microsoft Azure Functions that could be exploited by an attacker to escalate privileges and escape the Docker container that hosts them. The experts published a PoC exploit code to set up a reverse shell with the squashfs to escalate privileges in Azure Function and escape the Docker environment. However, after an internal assessment, Microsoft has determined that the vulnerability has no security impact on Function users as the Docker host itself is protected by a Hyper-V boundary.

See the full report here: https://securityaffairs.co/wordpress/114061/hacking/azure-functions-escape-docker.html?utm_source=rss&utm_medium=rss&utm_campaign=azure-functions-escape-docker

Google Discloses Severe Bug in Libgcrypt Encryption Library—Impacting Many Projects

A severe vulnerability in GNU Privacy Guard (GnuPG)'s Libgcrypt encryption software could have allowed an attacker to write arbitrary data to the target machine, potentially leading to remote code execution. The flaw, which affects version 1.9.0 of libgcrypt, was discovered on January 28 by a Project Zero researcher.

See the full report here: https://thehackernews.com/2021/01/google-discloses-severe-bug-in.html

Oscorp, a new Android malware targets Italian users

Researchers from security firm AddressIntel spotted a new Android malware dubbed Oscorp. The malware tricks users into granting them access to the Android Accessibility Service. Once the access is provisioned, the malware exploits the permissions to log keystrokes, uninstall apps on the device, make calls, send SMS messages, steal cryptocurrency by redirecting payments made via Blockchain[.]com Wallet app, and access two-factor authentication codes from the Google Authenticator app.

See the full report here: https://securityaffairs.co/wordpress/113983/malware/oscorp-android-malware.html

Trickbot is back again - with fresh phishing and malware attacks https://t.co/881emWXifL #CyberSecurityNews #Cyber #CyberSecurity #CyberAttacks #CyberWar #APT #SecurityBreach #Malware #ZeroDay #Hacker #Breach Please Retweet

Security researchers have identified an ongoing malware campaign that has the hallmarks of previous Trickbot activity. These attacks appear to be exclusively targeting legal and insurance companies in North America, with phishing emails encouraging potential victims to click on a link that will redirect them to a server that downloads a malicious payload. The download is a zip archive that contains a malicious Javascript file that connects to a server to download the final malware payload. Analysis of this payload indicates that it connects to domains that are known to distribute Trickbot malware.

See the full report here: https://www.zdnet.com/article/trickbot-is-back-again-with-fresh-phishing-and-malware-attacks/

Malware attack forces Victor Central Schools to close Monday - 13WHAM-TV

The Victor Central School District will be closed to in-person classes Monday after a ransomware attack struck servers in the district. According to an e-mail sent to parents and guardians of district students, the ransomware attack has caused all internet services in the district, including phones, to stop operating. No personal or financial information has been compromised.

See the full report here: https://13wham.com/news/local/victor-central-school-district-to-close-monday-due-to-malware-attack

SpamCop anti-spam service suffers outage after its domain expired - BleepingComputer

Cisco's SpamCop anti-spam service suffered an outage Sunday after its domain mistakenly was allowed to expire. SpamCop provides a Real-time Blackhole List (RBL) that mail servers can use to determine if incoming mail should be marked as spam.

See the full report here: https://www.bleepingcomputer.com/news/security/spamcop-anti-spam-service-suffers-an-outage-after-its-domain-expired/

Apple’s New BlastDoor Feature Protects You From iMessage Attacks - MakeUseOf

To prevent attacks from being launched via its iMessage feature, Apple has debuted a security service called BlastDoor in iOS 14, its current mobile operating system version. First detailed in an analysis this week by Google Project Zero’s Samuel Groß, BlastDoor acts as a tightly sandboxed service that is responsible for almost all of the parsing of untrusted data in iMessages.

See the full report here: https://www.makeuseof.com/ios-14-blast-door-imessage-sandbox/

Wind River Security Incident Affects SSNs, Passport Numbers

Wind River Systems, which develops embedded system software, on Friday warned of a security incident that had exposed personnel records. Affected data included information maintained within the company’s personnel records, including critical data like Social-Security numbers, driver’s license numbers, and passport numbers. The company is working with law enforcement and outside experts to investigate a security incident toward the end of September.

See the full report here: https://threatpost.com/wind-river-security-incident-ssns-passport-numbers/163550/

Ransomware gangs are abusing VMWare ESXi exploits to encrypt virtual hard disks

Ransomware gangs are abusing vulnerabilities in the VMWare ESXi product to take over virtual machines deployed in enterprise environments and encrypt their virtual hard drives. According to the security researchers, the attackers used CVE-2019-5544 and CVE-2020-3992, two vulnerabilities in VMware ESXi. The attacks, first seen last October, have been linked to intrusions carried out by a criminal group that deployed the RansomExx ransomware. In a recent update, the operator of the Babuk Locker ransomware has also announced an eerily similar feature although successful attacks have not yet been confirmed.

See the full report here: https://www.zdnet.com/article/ransomware-gangs-are-abusing-vmware-esxi-exploits-to-encrypt-virtual-hard-disks/

Experts discovered a new Trickbot module used for lateral movement

Security researchers have discovered a new module of the Trickbot malware, dubbed ‘masrv' that is used to scan a local network and make lateral movement inside the target organization. The masrv module leverage the Masscan open-source utility for local network scanning. It is used to search for other devices with open ports that can be compromised. Once the device gets infected, the masrv is used to drop the component and send a series of Masscan commands to scan the local network and send the scan results back to the C2 server.

See the full report here: https://securityaffairs.co/wordpress/114103/malware/trickbot-new-module.html?utm_source=rss&utm_medium=rss&utm_campaign=trickbot-new-module

Libgcrypt developers release urgent update to tackle severe vulnerability

The developers of Libgcrypt have issued an urgent update to tackle a critical vulnerability reported in a recent version of the software. On Thursday, a Google Project Zero researcher publicly disclosed a heap buffer overflow vulnerability in libgcrypt due to an incorrect assumption in the block buffer management code.

See the full report here: https://www.zdnet.com/article/libgcrypt-developers-release-urgent-update-to-tackle-severe-vulnerability/

Data breach exposes 1.6 million Washington unemployment claims - BleepingComputer

The Office of the Washington State Auditor is investigating a security incident that has compromised the personal information of more than 1.6 million people who filed for unemployment claims in the state in 2020. They suffered a data breach after a threat actor exploited a vulnerability in a secure file transfer service from Accellion.

See the full report here: https://www.bleepingcomputer.com/news/security/data-breach-exposes-16-million-washington-unemployment-claims/

Scammers posing as FBI agents threaten targets with jail time - BleepingComputer

The U.S. Federal Bureau of Investigation (FBI) is warning of scammers actively posing as FBI representatives and threatening targets with fines and jail time unless they don't hand out personal and financial information. As the FBI warns, the agency has received multiple reports of such scam attempts where the fraudsters are targeting North Florida residents attempting to steal their info.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-posing-as-fbi-agents-threaten-targets-with-jail-time/

A New Software Supply‑Chain Attack Targeted Millions With Spyware

A mysterious hacking group has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a highly-targeted supply chain attack. The attack was discovered by Slovak security firm ESET on January 25, last week, and targeted BigNox, a company that makes NoxPlayer, a software client for emulating Android apps on Windows or macOS desktops.

See the full report here: https://thehackernews.com/2021/02/a-new-software-supplychain-attack.html

New Linux malware steals SSH credentials from supercomputers - BleepingComputer

A new backdoor, Kobalos, has been targeting supercomputers across the world, often stealing the credentials for secure network connections by using a trojanized version of the OpenSSH software. Kobalos has a small but complex codebase that can execute on other UNIX platforms (FreeBSD, Solaris). Some artifacts discovered during the analysis indicate that there may also be variants for AIX and Windows operating systems. The malware provides remote access to the file system that can spawn terminal sessions and allow attackers to run arbitrary commands.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-malware-steals-ssh-credentials-from-supercomputers/

Agent Tesla Trojan ‘Kneecaps’ Microsoft’s Anti-Malware Interface

Researchers have identified new versions of the Agent Tesla remote access trojan (RAT) that target the Windows anti-malware software interface (ASMI) used by security vendors to protect PCs from attacks. The malware also now has the added capability of deploying a Tor client to conceal its communications, as well as using the Telegram chat application to exfiltrate data. The new obfuscation techniques make both static analysis and endpoint detection of the malware more difficult. In the new Agent Telsa version, the developers can now capture data from the Windows clipboard. This data could include anything from sensitive copied data from emails or documents to passwords, which can be sent back to the command-and-control (C2) server.

See the full report here: https://threatpost.com/agent-tesla-microsoft-asmi/163581/

US federal payroll agency hacked using SolarWinds software flaw - BleepingComputer

The FBI has discovered that the National Finance Center (NFC), a U.S. Department of Agriculture (USDA) federal payroll agency, was compromised by exploiting a SolarWinds Orion software flaw. According to Reuters sources, the threat actors behind the USDA agency hack are suspected to be part of a Chinese-backed hacking group. The USDA stated that it notified all customers (including individuals and organizations) whose data has been affected.

See the full report here: https://www.bleepingcomputer.com/news/security/us-federal-payroll-agency-hacked-using-solarwinds-software-flaw/

Volleyball players exposed in cloud security error (Includes interview) - Digital Journal

Security researchers have discovered an Azure cloud storage bucket that was publicly exposed by the European Volleyball Confederation, containing images of passports, drivers licenses, and identity documents. It is unclear when or how the data was finally secured, however, it was confirmed on January 29, 2021, that the exposed bucket is now closed.

See the full report here: http://www.digitaljournal.com/tech-and-science/technology/volleyball-players-exposed-in-cloud-security-error/article/584825

Magento Web Skimmers Piggyback in Ongoing Costway Website Compromise

Security researchers have discovered two web skimmers on the payment webpages of Costway targeting consumers’ credit-card payment details. According to researchers, one of these web skimmers is piggybacking on top of the other, to take over the fake forms that had previously been injected onto Costway’s site. The website under attack runs on the no-longer-maintained Magento 1 e-commerce software branch. Retailers worldwide operating on the Magento platform are urged to update to Magento 2.

See the full report here: https://threatpost.com/magento-web-skimmers-costway/163593/

Critical Bugs Found in Popular Realtek Wi-Fi Module for Embedded Devices

Realtek RTL8195A Wi-Fi module contains vulnerabilities that could be exploited to gain root access and take complete control of a device's wireless communications. The flaws concern a mix of stack overflow, and out-of-bounds reads that stem from the Wi-Fi module's WPA2 four-way handshake mechanism during authentication. According to the researchers, other modules including RTL8711AM, RTL8711AF, and RTL8710AF could also be impacted. Realtek has released Ameba Arduino 2.0.8 with patches. However, firmware versions released after April 21, 2020, already come with the necessary protections.

See the full report here: https://thehackernews.com/2021/02/critical-bugs-found-in-popular-realtek.html

New Malware Hijacks Kubernetes Clusters to Mine Monero

Researchers have discovered a new malware named Hildegard that is being used by the TeamTNT threat group to target Kubernetes clusters. Detected in January 2021, the new malware is still in the development stage and is being used to launch cryptojacking operations. The cryptojacking operation can quickly drain the entire system’s resources and disrupt every application in the cluster. This new TeamTNT malware campaign is one of the most complicated attacks targeting Kubernetes.

See the full report here: https://threatpost.com/new-malware-hijacks-kubernetes-clusters-to-mine-monero/163629/

SonicWall fixes actively exploited SMA 100 zero-day vulnerability - BleepingComputer

SonicWall has released a patch for the zero-day vulnerability used in attacks against the SMA 100 series of remote access appliances. The patch addresses security bugs tracked under the SNWLID-2021-0001 advisory. The vulnerabilities allow attackers to gain admin credentials and remotely execute arbitrary code on successfully exploited devices. Users are recommended to upgrade to SMA 10.2.0.5-29sv firmware to mitigate the vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-fixes-actively-exploited-sma-100-zero-day-vulnerability/

Oxfam Australia investigates data breach after database sold online - BleepingComputer

A threat actor is selling Oxfam Australia's database on a hacker forum. According to BleepingComputer, the threat actor claiming to sell the database has contact and donor information belonging to nearly 1.7 million Oxfam Australia users, including names, email addresses, addresses, phone numbers, and donation amounts. Oxfam Australia is investigating the issue and has reported it to the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC). All donors and registered members are urged to change their passwords on the Oxfam Australia site.

See the full report here: https://www.bleepingcomputer.com/news/security/oxfam-australia-investigates-data-breach-after-database-sold-online/