zerofox logo
Advisories

Threat Intelligence Bulletin: 02/19/2021 - 02/25/2021

|by Alpha Team

banner image

Breach Disclosure: NetGalley

On December 21, 2020, NetGalley's website was hacked and defaced, along with hackers accessing a database backup containing user's data. NetGalley is a book promotion site, that seeks recommendations from readers on authors and publishers books in the hopes of generating more recommendations and a wider audience.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Initially thought to just be a defacement of the NetGalley website, the NetGalley team soon realized that one of their backups had been accessed, which included the following details about users:

  • Login name
  • Password
  • Name
  • Email Address
  • Mailing Address (potentially included)
  • Birthday (potentially included)
  • Company Name (potentially included)
  • Kindle Email Address (potentially included)

NetGalley had stated that there was no financial information stored in the database, and has reset everyone's password as a precautionary measure. It is unknown at this time if the passwords stored were hashed, and NetGalley has not responded to questions concerning this as of yet.

According to the Have I Been Pwned service, this breach requested attribution to the user pompompurin@riseup[.]net, which the username pompompurin is an active data broker on RaidForums, however, this user has not posted about the NetGalley breach on their account. It is unknown currently if this user is responsible for the breach, or if someone is attributing it to their name for other reasons.

Breach Disclosure: Filmai.in

Filmai.in, a popular illegal movie streaming platform experienced a data breach between 2019 and 2020, with the data now being publicly available for users to download on popular hacker forums. The breached data contains over 640,000 unique email addresses, along with usernames and passwords.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The breach was listed for download on a well known hacker forum by the user Slaap on February 19th 2021. They list the estimated time of the breach along with the total number of compromised credentials.

imgur
Figure 1: Breach advertisement on RaidForums

In total the breach contains 645,974 records containing:

  • Email addresses
  • Usernames
  • Clear-text passwords

Due to the nature of this service, users' personal information could be used in subsequent spear-phishing attacks extorting them with this data or impersonating law enforcement. However, some users on the forum have noted that some of the data appears to be older than 2019, and due to decreasing traffic to the site many accounts are no longer in use or hold out of date email addresses and passwords.

Breach Disclosure: People's Energy

On December 16, 2020, a database containing the details of 270,000 customers of the energy company People's Energy was stolen, which included names, addresses, birthdates, phone numbers, tariff and energy meter IDs. People's Energy is an energy supplier based in Scotland, which was founded in 2017 with around 270,000 customers (all of whom were included in the data breach).

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On December 16, 2020, People's Energy was breached due to an unauthorized third party gaining access to one of the systems used to store member data. Included in the compromised data was:

  • Names
  • Addresses
  • Phone Numbers
  • Data of Birth
  • Email Addresses
  • People's Energy Account Numbers
  • Tariff Details
  • Gas and Electricity Meter Identification Numbers

For a small number of members (0.1%), some partial financial data was disclosed. This data contained user information for both current and former members of People's Energy.

This breach was found on RaidForums being advertised by a user known as "pompompurin" who stated in the listing that they were responsible for the breach and have posted it for free on RaidForums.

Raidforums Figure 1: Breach advertisement on RaidForums

Breach Disclosure: NurseryCam

NurseryCam, a daycare video monitoring product, was highlighted by a security researcher to be insecure, according to a blog post made on 12 February 2021. The product had a number of vulnerabilities that affected the security of the product, and the researcher obtained a list of usernames from this service. Approximately 10,000 records were exposed, and the service subsequently shut down as a result of this disclosure.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to a report by The Register, the researcher disclosed a number of vulnerabilities related to how the service stored and transmitted it's data, as well as privacy issues related to the service. The disclosure came after the same researcher, Cybergibbons, reported vulnerabilities in a separate service owned by a company that owns NurseryCam.

As of the time of writing of this advisory, there is no indication of malicious activity surrounding the data being used maliciously, rather the researcher enumerated this data set and disclosed it to the security community.

Breaking News: 2021-02-19 - 2021-02-25

Brave privacy bug exposes Tor onion URLs to your DNS provider - BleepingComputer

Brave Browser is fixing a privacy issue that leaks the visited Tor onion URL addresses to the locally configured DNS server, exposing the dark web websites. Brave is a Chromium-based browser that has a built-in Tor browser mode to browse the web anonymously. The issue is caused due to the CNAME ad-blocking feature that performs DNS lookups to prevent first-party tracking scripts from bypassing filters utilizing DNS CNAME records. To prevent Tor URLs from being sent to configured DNS servers, Brave has disabled the CNAME adblocking feature when in the Tor browsing mode and is expected to roll it out in the next version of Brave Browser 1.21.x.

See the full report here: https://www.bleepingcomputer.com/news/security/brave-privacy-bug-exposes-tor-onion-urls-to-your-dns-provider/

Mysterious Silver Sparrow Malware Found Nesting on 30K Macs

A new family of malware dubbed Silver Sparrow has been targeting Apple’s in-house M1 chip. According to analysts at Red Canary, the malware has been executing on victim machines with the final payload yet to be determined and appears to be lying in wait for further instructions. As of February 17, the malware has already infected 29,139 macOS endpoints across 153 countries, primarily in Canada, France, Germany, the United Kingdom, and the United States.

See the full report here: https://threatpost.com/silver-sparrow-malware-30k-macs/164121/

Underwriters Laboratories (UL) certification giant hit by ransomware - BleepingComputer

Underwriters Laboratories (UL) suffered a ransomware attack last weekend that encrypted devices in their data center, states BleepingComputer. To prevent the spread of the attack, the company shut down its systems. According to sources, UL has decided not to pay the ransom and is restoring from backups instead. The nature and scope of the ransomware attack currently remain undisclosed. In a statement to BleepingComputer, UL confirmed that the attack occurred on February 13th and is currently investigating the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/underwriters-laboratories-ul-certification-giant-hit-by-ransomware/

Microsoft: Solorigate attackers grabbed Azure, Intune, Exchange component source code

Microsoft's investigation on the Solorigate (SolarWinds) security incident, has revealed that the attackers managed to download source code from a “small number of repositories,” including the code for some important Microsoft Azure components (subsets of service, security, identity), as well as Intune and Exchange components. However, Microsoft stated that they have no evidence concerning attackers accessing production services or customer data, or of them having managed to use systems at Microsoft to mount attacks against other targets, gain access to privileged credentials or leverage the SAML techniques against the company’s corporate domains. Attackers might use the stolen information gleaned from these files to discover potential vulnerabilities, craft future attack methods, exploits, or avenues.

See the full report here: https://www.helpnetsecurity.com/2021/02/19/microsoft-solorigate-attackers-grabbed-azure-intune-exchange-component-source-code/

Kia Motors America: Ransomware Not Behind Extended Systems Outage - Security Boulevard

Kia Motors America stated that a ransomware attack was not the apparent cause of an extended systems outage affecting the automobile dealer’s IT systems. The outage started on February 13 when the Kia Owners Portal went offline and displayed an error message.

See the full report here: https://securityboulevard.com/2021/02/kia-motors-america-ransomware-not-behind-extended-systems-outage/

Microsoft Edge is crowdsourcing whether to show notification prompts - BleepingComputer

Microsoft is now using crowdsourcing to determine whether to show a site's website subscription dialog prompt in the Microsoft Edge web browser. Websites have increasingly started to show prompts to sign up for browser notifications subscriptions that deliver the site's new content, even when a subscriber does not have a browser open. Using this new feature, if enough people subscribe to a site's notification dialog prompts, it indicates that the site is well-liked, and Microsoft Edge will show the full notification subscription dialog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-is-crowdsourcing-whether-to-show-notification-prompts/

Recently fixed Windows zero-day actively exploited since mid-2020 - BleepingComputer

Microsoft says that a high-severity Windows zero-day vulnerability patched during the February 2021 Patch Tuesday was exploited in the wild since at least the summer of 2020 according to its telemetry data. The actively exploited zero-day bug is tracked as CVE-2021-1732, Windows Win32k Elevation of Privilege Vulnerability. According to their report, the zero-day was being actively used in targeted attacks by an advanced persistent threat (APT) group tracked as Bitter (Forcepoint) and T-APT-17 (Tencent).

See the full report here: https://www.bleepingcomputer.com/news/security/recently-fixed-windows-zero-day-actively-exploited-since-mid-2020/

Sequoia Capital Venture Capital firm discloses a data breach

Sequoia Capital, one of the most prominent venture capital firms that focus on the technology industry, discloses a data breach. The company informed its investors that an unauthorized third party had access to their personal and financial information. The intrusion is the result of a successful phishing attack against one of its employees.

See the full report here: https://securityaffairs.co/wordpress/114831/hacking/sequoia-capital-data-breach.html?utm_source=rss&utm_medium=rss&utm_campaign=sequoia-capital-data-breach

New Mexico hospital's computer network hacked - Becker's Hospital Review

Rehoboth McKinley Christian Health Care Services recently suffered a cyberattack that let unauthorized actors access its computer network. After discovering the security breach, the hospital took certain systems offline as a precautionary measure but did not experience any interruptions to patient care. Rehoboth also tapped a third-party cybersecurity organization to investigate the incident.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/new-mexico-hospital-s-computer-network-hacked.html

Kroger data breach exposes pharmacy and employee data - BleepingComputer

Supermarket giant Kroger has suffered a data breach after a service used to transfer files securely was hacked, and threat actors stole files. The company was affected by a security vulnerability in the Accellion FTA software that allowed hackers to steal data from companies utilizing the service. As part of their investigation into the attack, Kroger has determined that no grocery store data, including payment information, was impacted by the breach. However, the breach did expose human resources data and pharmacy records.

See the full report here: https://www.bleepingcomputer.com/news/security/kroger-data-breach-exposes-pharmacy-and-employee-data/

Nvidia announces official “anti-cryptomining” software drivers

Nvidia, the graphics chip company, is about to launch its latest GeForce GPU (graphics processing unit) chip, the RTX 3060. The chip is tailored to meet the needs of gamers and those who create digital experiences. However, the new GPU is also pretty good at performing cryptographic calculations, like computing hashes such as SHA-2 and SHA-3 at high speed, used for many cryptocurrency mining calculations.

See the full report here: https://nakedsecurity.sophos.com/2021/02/22/nvidia-announces-official-anti-cryptomining-software-drivers/

Researchers uncovered a new Malware Builder dubbed APOMacroSploit

Researchers from security firm Check Point uncovered a new Office malware builder called APOMacroSploit, which was employed in attacks that targeted more than 80 customers worldwide. APOMacroSploit is a macro builder that was to create weaponized Excel documents used in multiple phishing attacks. Excel documents created with the APOMacroSploit builder are capable of bypassing antivirus software, Windows Antimalware Scan Interface (AMSI), and even Gmail and other email-based phishing detection.

See the full report here: https://securityaffairs.co/wordpress/114880/cyber-crime/apomacrosploit-macro-builder.html?utm_source=rss&utm_medium=rss&utm_campaign=apomacrosploit-macro-builder

Scottish Borders Council suffers data breach - UKAuthority.com

Scottish Borders Council has acknowledged a digital data breach that it says has affected around 600 customers. The local authority has issued a statement indicating that, while alerting 1,300 residents that they are eligible for a payment, it accidentally sent three emails to multiple individuals in which all the recipients’ addresses were visible. Those customers who have received an email that includes others’ email addresses are asked to delete it.

See the full report here: https://www.ukauthority.com/articles/scottish-borders-council-suffers-data-breach/

Lakehead University shuts down campus network after cyberattack - BleepingComputer

Canadian undergraduate research university Lakehead has been dealing with a cyberattack that forced the institution earlier this week to cut off access to its servers. The school's services, including its website, have been down since Tuesday, with personnel shutting down computers on the Thunder Bay and Orillia campuses to stop the attack from spreading. An investigation is underway, trying to determine what servers and information have been impacted by the security incident.

See the full report here: https://www.bleepingcomputer.com/news/security/lakehead-university-shuts-down-campus-network-after-cyberattack/

Chrome for iOS will let you lock Incognito mode with Face ID - BleepingComputer

Google Chrome for iOS is getting a new privacy feature that lets users lock their opened Incognito tabs behind iPhone's Face ID or Touch ID biometric authentication features. Once enabled, when users close Chrome for iOS and then open it again, they will not be allowed to see any opened Incognito tabs without first unlocking them with Face ID or Touch ID.

See the full report here: https://www.bleepingcomputer.com/news/google/chrome-for-ios-will-let-you-lock-incognito-mode-with-face-id/

Warning: Google Alerts abused to push fake Adobe Flash updater - BleepingComputer

Threat actors are using Google Alerts to promote a fake Adobe Flash Player updater that installs other unwanted programs on unsuspecting users' computers. The threat actors create fake stories with titles containing popular keywords that Google Search then indexes. Once indexed, Google Alerts will alert people who are following those keywords. When visiting the fake stories using a Google redirect link, the visitor will be redirected to the threat actor's malicious site.

See the full report here: https://www.bleepingcomputer.com/news/security/warning-google-alerts-abused-to-push-fake-adobe-flash-updater/

Researcher Reports Vulnerability in Apple iCloud Domain

Apple has reportedly fixed a stored cross-site scripting (XSS) vulnerability in the iCloud domain following its discovery by a security researcher. The bug was found in the Page/Keynotes feature of the iCloud website. To exploit this vulnerability, an attacker would have to create new content in either Pages or Keynote and enter their XSS payload into the name field. They would have to save this and send it to or collaborate with, another user. The XSS would trigger after "Browse All Versions" was clicked.

See the full report here: https://www.darkreading.com/threat-intelligence/researcher-reports-vulnerability-in-apple-icloud-domain/d/d-id/1340225

Assume Clubhouse Conversations Are Being Recorded, Researchers Warn

At nearly a year old, the invitation-only, audio-based social-media platform ClubHouse is grappling with security issues on multiple fronts. The company confirmed that a user was able to breach “multiple” ClubHouse room audio feeds and stream them on a third-party website. In response to this, the company permanently banned the account used by the attacker. Another user, located in mainland China, meanwhile wrote code that allows anyone to listen in on ClubHouse conversations without the required invitation code and posted it on GitHub.

See the full report here: https://threatpost.com/clubhouse-conversations-recorded/164158/

Powerhouse VPN products can be abused for large-scale DDoS attacks

Botnet operators are abusing VPN servers from VPN provider Powerhouse Management as a way to bounce and amplify junk traffic part of DDoS attacks. According to a researcher, the root cause of this new DDoS vector is a yet-to-be-identified service that runs on UDP port 20811 on Powerhouse VPN servers. Until Powerhouse fixes this leak, the researcher has recommended that companies block any traffic that comes from the VPN provider's networks (AS21926 and AS22363) or block any traffic where "srcport" is 20811.

See the full report here: https://www.zdnet.com/article/powerhouse-vpn-products-can-be-abused-for-large-scale-ddos-attacks/

Hackers expose Hyundai logistics data after apparent ransomware attack - FreightWaves

Hackers leaked data related to Hyundai Motor America’s logistics operations on Monday and claimed responsibility for an apparent ransomware attack targeting the automaker and subsidiary Kia Motors America. Files posted by the DoppelPaymer ransomware gang contain information about Hyundai Glovis, the automaker’s global logistics firm, as well as documents related to a trucking partner, in addition to other data. Hyundai Motor America acknowledged that it had experienced an IT outage but would not confirm that it had been targeted in a ransomware attack.

See the full report here: https://www.freightwaves.com/news/hackers-expose-hyundai-logistics-data-after-apparent-ransomware-attack

Texas electric company warns of scammers threatening to cut power - BleepingComputer

Texas electric utility Austin Energy today warned of unknown individuals impersonating the company and threatening customers over the phone that their power will be cut off unless they pay fictitious overdue bills. Austin Energy says that they will never call their residential customers to inform them of urgent cut-off deadlines, ask them for information on credit cards or wire transfers, or ask them to pay late bills using untraceable forms of payment like cryptocurrency or gift cards.

See the full report here: https://www.bleepingcomputer.com/news/security/texas-electric-company-warns-of-scammers-threatening-to-cut-power/

TDoS Attacks Take Aim at Emergency First-Responder Services

Telephony denial-of-service (TDoS) attacks, which affect the availability and readiness of call centers, are hitting critical first-responder facilities, according to the Federal Bureau of Investigation (FBI). A TDoS attack is designed to prevent incoming and outgoing calls by flooding a target with junk calls. The objective is to keep the distraction calls active for as long as possible to overwhelm the victim’s telephone system, which may delay or block legitimate calls for service.

See the full report here: https://threatpost.com/tdos-attacks-emergency-first-responder/164176/

Chinese hackers cloned attack tool belonging to NSA’s Equation Group - ZDNet

Chinese state hackers cloned and started using an NSA zero-day exploit almost three years before the Shadow Brokers hacker group publicly leaked it in April 2017. EpMe is the original exploit created by Equation Group around 2013 for a Windows zero-day bug tracked as CVE-2017-2005. The vulnerability was used for escalating Windows user privileges after gaining access to targeted devices since it's a local privilege escalation (LPE) bug affecting devices running Windows XP up to Windows 8. Microsoft patched this security bug in March 2017 and attributed active exploitation to the Chinese-backed APT31 hacking group.

See the full report here: https://www.zdnet.com/article/chinese-hackers-cloned-attack-tools-belonging-to-nsas-equation-group/

SHAREit fixes security bugs three months after initial report - BleepingComputer

Singapore-based Smart Media4U Technology said today that it fixed SHAREit vulnerabilities that may have allowed attackers to execute arbitrary code remotely on users' devices. The security bugs impact the company's SHAREit Android app, an application that downloaded more than 1 billion times, according to Google Play Store statistics.

See the full report here: https://www.bleepingcomputer.com/news/security/shareit-fixes-security-bugs-three-months-after-initial-report/

Airplane maker Bombardier data posted on ransomware leak site following FTA hack

Bombardier, a Canadian airplane manufacturer, has disclosed a security breach after some of its data was published on a dark web portal operated by the Clop ransomware gang. The stolen data shared on the dark web included design documents for various Bombardier airplanes and plane parts. However, no personal data was shared. Bombardier stated that an unauthorized party accessed and extracted data by exploiting a vulnerability affecting a third-party file-transfer application, which was running on purpose-built servers isolated from the main Bombardier IT network.

See the full report here: https://www.zdnet.com/article/airplane-maker-bombardier-data-posted-on-ransomware-leak-site-following-fta-hack/

10K Targeted in Phishing Attacks Spoofing FedEx, DHL Express

Two large phishing attacks, aimed at a combined 10,000 victims, spoofed emails from FedEx and DHL Express in an attempt to steal their targets' business email account credentials. The attackers' techniques included social engineering, brand impersonation, and link redirects, They also hosted phishing pages on Quip and Google Firebase as these domains are considered reputable and malicious emails may bypass security filters configured to block bad links and files.

See the full report here: https://www.darkreading.com/threat-intelligence/10k-targeted-in-phishing-attacks-spoofing-fedex-dhl-express/d/d-id/1340236

Finnish IT Giant Hit with Ransomware Cyberattack

Finnish IT provider TietoEVRY has been hit with a ransomware attack that has forced the company to turn off some services and infrastructure. However, a company spokesperson stated that no evidence of any critical or personal data loss has been identified yet. The nature and scope of the attack are currently unknown. The company has informed its customers of the incident and is investigating the issue while also taking recovery measures.

See the full report here: https://threatpost.com/finnish-it-giant-ransomware-cyberattack/164193/

Twitter removes accounts of Russian government-backed actors - BleepingComputer

Twitter has removed dozens of accounts connected to Russian government-backed actors disseminating disinformation and targeting the European Union, the United States, and the NATO alliance. These accounts were part of two separate networks with Russian links, each of them specialized in targeting different entities.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-removes-accounts-of-russian-government-backed-actors/

Google's Password Checkup feature coming to Android

On Android, the Password Checkup feature is now part of the "Autofill with Google" mechanism, which the OS uses to select text from a cache and fill in forms. The idea is that the Password Checkup feature will take passwords stored in the Android OS password manager and check them against a database containing billions of records from public data breaches and see if the password has been previously leaked online. If it has, a warning is shown to the user. The Password Checkup feature is rolling out today for all Android 9+ users.

See the full report here: https://www.zdnet.com/article/googles-password-checkup-feature-coming-to-android/

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs

Researchers have demonstrated a novel class of attacks called "Shadow attacks" that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. 16 of the 29 PDF viewers tested including Adobe Acrobat, Foxit Reader, Perfect PDF, and Okular found vulnerable to shadow attacks. The flaws tracked as CVE-2020-9592 and CVE-2020-9596 — have been since addressed by Adobe in an update released on May 12, 2020. As of December 17, 2020, 11 of the 29 tested PDF applications remain unpatched.

See the full report here: https://thehackernews.com/2021/02/shadow-attacks-let-attackers-replace.html

Keybase patches bug that kept pictures in cleartext storage on Mac, Windows clients

Keybase has resolved a security flaw in the messaging client that preserved image content in the cache for cleartext viewing. The bug tracked as CVE-2021-23827 is an issue that allows an attacker to obtain potentially sensitive media in the cache and uploadtemps directories.

See the full report here: https://www.zdnet.com/article/keybase-patches-bug-that-kept-pictures-in-cleartext-storage-on-mac-windows-clients/

IBM issues patches for Java Runtime, Planning Analytics Workspace, Kenexa LMS

IBM has issued security patches designed to resolve high and medium severity bugs impacting the tech giant's enterprise software solutions. The tech giant published a set of security advisories laying out fixes for vulnerabilities that affects IBM Java Runtime, IBM Planning Analytics Workspace, and IBM Kenexa LMS On-Premise.

See the full report here: https://www.zdnet.com/article/ibm-patches-vulnerabilities-in-java-runtime-planning-analytics-kenexa-lms/

Firefox 86 gets a privacy boost with Total Cookie Protection - BleepingComputer

Mozilla Firefox 86 was released today with Total Cookie Protection, a new privacy feature that prevents web trackers from keeping tabs on your activity while browsing the web. Also, Total Cookie Protection makes a limited exception for cross-site cookies for non-tracking purposes, such as those used by popular third-party login providers.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-86-gets-a-privacy-boost-with-total-cookie-protection/

VMware warns of critical remote code execution flaw in vSphere HTML5 client

VMware has revealed a critical-rated bug in the HTML5 client for its flagship vSphere hybrid cloud suite. The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. VMware has issued a fix to address this issue.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/02/23/vmware_vsphere_critical_bugs/

Microsoft starts pushing the revamped Windows 10 cumulative update - BleepingComputer

Microsoft has released a Windows 10 cumulative update that is combined with a servicing stack update for ease of installation. With this release, Microsoft delivers the first combined LCU/SSU update to the general public via Windows Update. From now on, for all future updates, Microsoft will combine the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-starts-pushing-the-revamped-windows-10-cumulative-update/

More than 6,700 VMware servers exposed online and vulnerable to major new bug

More than 6,700 VMware vCenter servers are currently exposed online and vulnerable to a new attack that can allow hackers to take over unpatched devices and effectively take over companies' entire networks. The vulnerability tracked as CVE-2021-21972, which impacts vSphere Client (HTML5), a plugin of VMware vCenter, a type of server usually deployed inside large enterprise networks as a centralized management utility through which IT personnel manage VMware products installed on local workstations. A security researcher has published a proof of concept that could be utilized by hackers to perform a mass scan for vulnerable vCenter systems left connected online. Users are strongly advised to update their systems as soon as possible.

See the full report here: https://www.zdnet.com/article/more-than-6700-vmware-servers-exposed-online-and-vulnerable-to-major-new-bug/

Ukraine: DDoS attacks on govt sites originated from Russia - BleepingComputer

The National Security and Defense Council (NSDC) of Ukraine is accusing threat actors located on Russian networks of performing DDoS attacks on Ukrainian government websites since February 18th. The investigations uncovered a new malware planted on vulnerable Ukrainian government servers that adds the devices into an attacker-controlled botnet. These devices are then reportedly used to perform further DDoS attacks on other Ukrainian sites. While Ukraine did not directly accuse Russia of the denial of service attacks, they stated that the attackers' IP addresses were located on Russian networks.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-ddos-attacks-on-govt-sites-originated-from-russia/

Cisco fixes maximum severity MSO auth bypass vulnerability - BleepingComputer

A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. Successful exploitation can allow the attackers to get an authentication token with admin-level privileges for authenticating to the API on affected MSO and managed Cisco Application Policy Infrastructure Controller (APIC) devices. The vulnerability is tracked as CVE-2021-1388 is fixed in Cisco ACI MSO 3.0(3m). Cisco has also patched more security vulnerabilities affecting Cisco Application Services Engine, Cisco FXOS Software, Cisco NX-OS Software, and Cisco UCS Software. All customers are advised to immediately upgrade to fixed releases.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-maximum-severity-mso-auth-bypass-vulnerability/

Heavily used Node.js package has a code injection vulnerability - BleepingComputer

"systeminformation", a lightweight Node.js library contains a high severity command injection vulnerability that could allow an attacker to execute system commands by injecting payload within the unsanitized parameters used by the component. The vulnerability is tracked as CVE-2021-21315 and impacts the "systeminformation" npm component which gets about 800,000 weekly downloads and has scored close to 34 million downloads to date since its inception. Users of "systeminformation" are recommended to upgrade to versions 5.3.1 and above to resolve the CVE-2021-21315 vulnerability in their application.

See the full report here: https://www.bleepingcomputer.com/news/security/heavily-used-nodejs-package-has-a-code-injection-vulnerability/

Tags: weekly bulletin, all industries, global