Threat Intelligence Bulletin: 02/26/2021 - 03/04/2021

Breach Disclosure: Ticketcounter

Ticketcounter, a Dutch e-ticketing platform recently experienced a data breach impacting 1.9 million users. Included in the data were full names, email addresses, phone numbers, IP Addresses, and hashed passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The actual breach date of Ticketcounter is not known, however, the threat actor responsible for the breach initiall listed it on a popular hacking forum on February 21st, 2021, however, was quickly removed. The initial breach appears to be the result of an unsecured Microsoft Azure server which was used to test data anomyization.

The threat actor reached out to Ticketcounter and demanded seven Bitcoins (approximately $337,000) to not release the data. Included in the demands, the threat actor stated that if they did not recieve payment, they would release the data as well as notify all the partners of Ticketcounter. Ticketcounter mitigated some impact by preemptively notifying their customers and clients that a breach has taken place and to perform breach notifications to those affected.

Once the threat actor did not receive their payment, they released it for free on various hacking forums for anyone to download.

Figure 1: Another user posting the data for free since the original was taken down

Breach Disclosure: Oxfam Australia

On January 20th, 2021 Oxfam Australia had identified an unauthorized user gained access to one of its databases containing data on 1.8 million users. Information included names, email addresses, phone numbers, genders, birthdays, and in some cases, partial credit card numbers or banking data.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Oxfam Australia stated that the database included information about supporters who may have signed a petition, taken part in a campaign, or made donations or purchases through their shops. The data contained no passwords, however, for the majority of users contained the following:

• Names
• Addresses
• Date of birth
• Emails
• Phone Numbers
• Gender
• Donation history

The Oxfam database has been posted to hacking forums for free as of February 27th, 2021.

Figure 1: Database listing for free on hacking forum

HAFNIUM Group Microsoft Targeting Exchange Servers

On March 2nd, 2021, Microsoft released seven out-of-band security patches for Microsoft Exchange Server to address zero-day flaws that have been used in limited targeted attacks. Microsoft attributes the campaign to a new state-sponsored APT group. According to Microsoft Threat Intelligence Center (MSTIC), a new Chinese state-sponsored threat actor named HAFNIUM, actively exploits four previously undisclosed security flaws in Exchange Server. The vulnerabilities being exploited are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. According to Microsoft and Volexity, attackers exploited these vulnerabilities as part of a complex attack consisting of several parts to bypass authentication mechanisms, gain administrator privileges and install ASPX web shells on compromised servers. Microsoft recommends prioritizing installing updates on Microsoft Exchange 2013, 2016 and 2019, Exchange Online is not affected.

Recommendations

• Install the security updates, available at: https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901
• Check network and host logs for indicators of compromise released by Microsoft & Volexity
• Ensure Microsoft Exchange servers are up to date and have logging enabled

Details

According to Microsoft, HAFNIUM primarily targets entities in the United States across several industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and non-governmental organizations. They have previously compromised victims by exploiting vulnerabilities in internet-facing servers, and have used legitimate open-source frameworks.

CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allows the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

The second vulnerability is CVE-2021-26857, an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit. The third vulnerability, CVE-2021-26858, is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials. The fourth vulnerability is CVE-2021-27065, a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Suspected TTPs used by HAFNIUM

Tools:

Covenant: A .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform. Procdump: This tool is used to extract credentials from the OS memory. Since ProcDump is a signed Microsoft utility, AV usually doesn’t trigger on it. ProcDump creates a minidump of the target process from which Mimikatz can extract credentials. Nishang: A framework and collection of scripts and payloads which enables usage of PowerShell. (PowerShell v3 and above) PowerCat: Aka, Powershell Netcat which is a new version of netcat in the form of the powershell script. 7-Zip

Procedures:

Hafnium first gains access to an Exchange server either with a stolen password or by exploiting one of the Exchange server zero-days to appear as someone with legitimate access. Attackers then deploy a Web shell so they can remotely control an affected server. This remote access enables them to steal data from target organizations.

Impact:

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server and may export the content of email inboxes and address books to a remote server. If not patched, these four zero-day vulnerabilities can be chained together to gain access to vulnerable Microsoft Exchange servers (both internal & external facing), steal email, and plant further malware to facilitate long-term access to victim environments.

IOCs

Web shell hashes:

b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e
2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1
65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944

IP addresses:

103.77.192.219
104.140.114.110
104.250.191.110
108.61.246.56
149.28.14.163
157.230.221.198
167.99.168.251
185.250.151.72
192.81.208.169
203.160.69.66
211.56.98.146
5.254.43.18
5.2.69.14
80.92.205.81
91.192.103.43

Breach Disclosure: Gab

The social-media platform Gab has reportedly been breached by a group named DDoSecrets and released to certain individuals on February 28th, 2021. Through the use of a SQL injection vulnerability in Gab, DDoSecrets were able to siphon not only all of Gab's public posts and profiles, but also private group and private individual posts and messages, along with user and group passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This breach impacted the entire userbase of Gab, with more than 70GB of data representing more than 40 million posts. While this data could be extremely dangerous in the wrong hands, DDoSecrets is aware of that fact and chose to only release the data to journalists, social scientists, and researchers.

This is the latest breach related to "hacktivism", stemming from the Parler breach earlier this year, which exposed data on Parler users and potential relations to the United States Capitol Riots on January 6th. DDoSecrets had some involvement in this, with their co-founder sharing analysis and data on Parler as well as perserving the data along with the Internet Archive.

While the data will most likely not go public, although possible, there are unencrypted passwords contained in the data dump, which could be used by hackers for other account takeovers.

Breach Disclosure: Multiple Free VPN Services

On February 25th 2021, a post advertising breached data for sale on 3 popular free VPN apps was published on a popular hacker forum. The impacted services are SuperVPN, GeckoVPN, and ChatVPN with over 21 million total user records for sale. The breached data contains sensitive information of the services customers including names, email address, geo location, IP Addresses, payment history and more.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The post advertising the data for sale details the services which were breached along with the date the information was breached, which was the 24th February 2021- a day before the post was created. Links are included to sample sets of the data along with contact information of the post author, under the alias of 000 and soapceo.

Figure 1: Post advertising breached data for sale

The samples of data include the SQL schema of the databases which were breached. These list columns which contain data including:

• Email address
• Username
• Alias
• Geo location
• Passwords (randomly generated strings)
• Payment-related data
• Platform
• Device OS version
• App version
• IMSI number
• Manufacturer/model information

Figure 2: Table schemas from SQL dump samples

Breaking News: 2021-02-26 - 2021-03-04

T-Mobile discloses data breach after SIM swapping attacks - BleepingComputer

American telecommunications provider T-Mobile has disclosed a data breach after an unknown number of customers were apparently affected by SIM swap attacks. SIM swap fraud allows scammers to take control of targets' phone numbers after porting them using social engineering techniques. T-Mobile revealed that an unknown attacker gained access to customers' account information, including personal info and personal identification numbers (PINs). The company quickly identified and terminated the unauthorized activity. However, customers are recommended to change their account PIN, as well as their security questions and answers.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-discloses-data-breach-after-sim-swapping-attacks/

Ryuk ransomware now self-spreads to other Windows LAN devices - BleepingComputer

French security researchers have discovered a new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims' local networks. To propagate itself over the local network, the new variant lists all the IP addresses in the local ARP cache and sends Wake-on-LAN (WOL) packets to each of the discovered devices. Once launched, it will thus spread itself on every reachable machine on which Windows RPC accesses are possible. During the third quarter of 2020, Ryuk affiliates have been observed hitting, on average, roughly 20 companies every week.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/

Twitter scammers earned over $145k this week in Bitcoin, Ethereum, Doge - BleepingComputer

Cryptocurrency scammers have made at least $145,000 this week by promoting fake giveaways through hacked verified Twitter accounts. Suspicious links were embedded in the tweets that redirect to sites pretending to be Medium posts that promote the giveaway and include further links to the actual giveaway site. These sites tell visitors to send cryptocurrency to the listed address, and the site will send back double the amount that the user has sent.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-scammers-earned-over-145k-this-week-in-bitcoin-ethereum-doge/

Ransomware gang hacks Ecuador's largest private bank, Ministry of Finance - BleepingComputer

Ecuador's Ministry of Finance and the country's largest bank, Banco Pichincha, have been hacked ​by a hacking group called 'Hotarus Corp'. The ransomware gang first targeted Ecuador's Ministry of Finance, the Ministerio de Economía y Finanzas de Ecuador, where they deployed a PHP-based ransomware strain to encrypt a site hosting an online course and then attacked Banco Pichincha. According to a security reseacher, the threat actors used a commodity PHP ransomware called Ronggolawe (or AwesomeWare) to encrypt the site's contents. Soon after the attack, the threat actors released a text file containing 6,632 login names and hashed password combinations on a hacker forum. The ransomware gang claims to have stolen sensitive ministry information, emails, employee information, contracts.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-hacks-ecuadors-largest-private-bank-ministry-of-finance/

Oxford University COVID lab falls victim to hackers

An isolated cyber incident was detected at Oxford University's Division of Structural Biology, "Strubi" lab after access details for a number of its systems were spotted online. A spokesperson for the University stated that they have identified and contained the problem and are now investigating further. The University also confirmed that there has been no impact on any clinical research. The National Cyber Security Centre is currently working with the University to determine the nature and scope of the attack.

See the full report here: https://www.itpro.co.uk/security/hacking/358728/oxford-university-covid-research-lab-reportedly-hacked

NSA, Microsoft promote a Zero Trust approach to cybersecurity - BleepingComputer

The National Security Agency (NSA) and Microsoft are advocating for the Zero Trust security model as a more efficient way for enterprises to defend against today’s increasingly sophisticated threats. The model was created in 2010 by John Kindervag, who also coined the term zero trust, principal analyst at Forrester Research at the time but talked about it had started in the early 2000s. Google implemented zero-trust security concepts following Operation Aurora in 2009 for an internal project that became BeyondCorp.

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-microsoft-promote-a-zero-trust-approach-to-cybersecurity/

Microsoft fixes Windows 10 drive corruption bug — what you need to know - BleepingComputer

Microsoft has fixed a Windows 10 bug that could cause NTFS volumes to become corrupted by merely accessing a particular path or viewing a specially crafted file. The bug was reported last month, which allows any users, including those with low privileges, to mark an NTFS volume as dirty.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-10-drive-corruption-bug-what-you-need-to-know/

Google shares PoC exploit for critical Windows 10 Graphics RCE bug - BleepingComputer

Project Zero, Google's 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component. The Project Zero researchers discovered the vulnerability, tracked as CVE-2021-24093, in a high-quality text rendering Windows API named Microsoft DirectWrite. Microsoft has released security updates to address it on all vulnerable platforms on February 9, 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/google-shares-poc-exploit-for-critical-windows-10-graphics-rce-bug/

Experts found a critical authentication bypass flaw in Rockwell Automation software

A critical authentication bypass vulnerability, tracked as CVE-2021-22681, can be exploited by remote attackers to compromise programmable logic controllers (PLCs) manufactured by Rockwell Automation. The flaw has received a CVSS score of 10. Rockwell recommended users follow the list of risk mitigation and recommended user actions for its projects.

See the full report here: https://securityaffairs.co/wordpress/115085/ics-scada/rockwell-automation-software-flaw.html?utm_source=rss&utm_medium=rss&utm_campaign=rockwell-automation-software-flaw

Npower withdraws mobile app after hackers steal personal details - The Guardian

Npower has permanently withdrawn its mobile app after hackers used it to access its customers’ personal details, including the sort codes and the last four digits of their bank accounts. The company stated that it had identified suspicious cyber-activity affecting the Npower mobile app, where someone has accessed customer accounts using login data stolen from another website.

See the full report here: https://www.theguardian.com/business/2021/feb/27/npower-mobile-app-hackers-personal-details-gas-electricity-customers

New APT Group Targets Airline Industry & Immigration https://t.co/vdyHb6dBqE #CyberSecurityNews #Cyber #CyberSecurity #CyberAttacks #CyberWar #APT #SecurityBreach #Malware #ZeroDay #Hacker #Breach Please Retweet

A new threat group with some similarities to some other known advanced persistent threat (APT) actors is attacking the International Air Transport Association (IATA), multiple airlines, and individuals planning to emigrate to Canada on government job-related programs. The threat group is tracked as "LazyScripter" whose primary motive appears to be to steal information and intelligence from victims, both for current use and for future targeted attacks.

See the full report here: https://www.darkreading.com/threat-intelligence/new-apt-group-targets-airline-industry-and-immigration/d/d-id/1340249

Hackers hit State Bank of India users with text phishing scam - Business Standard

Several users of the State Bank of India (SBI) have been targeted with a phishing scam where hackers have flooded them with suspicious text messages, requesting them to redeem their SBI credit points worth Rs 9,870. The link associated with the text messages redirects the user to a fake website and on the landing page, the user is asked to submit personal information along with sensitive financial details like card number, expiry date, CVV, and Mpin in a 'State Bank of India Fill Your Details' form.

See the full report here: https://www.business-standard.com/article/companies/hackers-hit-state-bank-of-india-users-with-text-phishing-scam-121030100508_1.html

Russian hackers aim cyber attack on Ukrainian government agencies - TEISS

The Ukrainian government’s National Coordination Center for Cybersecurity stated that hackers attempted a cyber attack to spread malicious documents through the System of Electronic Interaction of Executive Bodies (SEI EB). SEI EB is a web-based portal used by most public authorities to circulate documents between departments. The hackers uploaded malicious documents containing macro scripts on the SEI EB portal. Once the user downloads any of the scripts and enables editing, the macros would download malware secretly onto the victim’s computer and gain control over the system.

See the full report here: https://www.teiss.co.uk/russian-hackers-targeting-ukrainian-government-agencies/

New Zealand-based cryptocurrency exchange Cryptopia hacked again

A New Zealand-based cryptocurrency exchange Cryptopia hacked again. About NZ$62,000 (US$45,000) in the XSN cryptocurrency had been transferred out of its cold wallet on February 1, 2021. In 2019, Cryptopia disclosed a cyberattack that took place on January 14th. At the time of the first attack, the threat actors stole approximately USD 30 million worth of cryptocurrencies. At the time of the second hack, the wallet contained around 2.7 million NZD worth of Stakenet’s native token called Stakenet (XSN).

See the full report here: https://securityaffairs.co/wordpress/115099/hacking/cryptopia-hacked-twice.html?utm_source=rss&utm_medium=rss&utm_campaign=cryptopia-hacked-twice

Google Voice silenced by expired TLS certificate in February outage - BleepingComputer

In an incident report published on Friday, Google said that a Google Voice outage affecting a majority of the telephone service's users earlier this month was caused by expired TLS certificates. This worldwide outage prevented most Google Voice users from logging into their accounts and using the service for more than four hours between February 15th and February 16th, 2021.

See the full report here: https://www.bleepingcomputer.com/news/google/google-voice-silenced-by-expired-tls-certificate-in-february-outage/

Beware: AOL phishing email states your account will be closed - BleepingComputer

An AOL mail phishing campaign is underway to steal users' login name and password by warning recipients that their account is about to be closed. Once AOL credentials are submitted, the stolen credentials are sent to the attackers, and the user is redirected to the standard AOL login page.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-aol-phishing-email-states-your-account-will-be-closed/

Far-Right Platform Gab Has Been Hacked—Including Private Data

On Sunday night, the WikiLeaks-style group Distributed Denial of Secrets is revealing what it calls calling GabLeaks, a collection of more than 70 gigabytes of Gab data representing more than 40 million posts. DDoSecrets says a hacktivist who self-identifies as JaXpArO and My Little Anonymous Revival Project siphoned that data out of Gab's backend databases to expose the platform's largely rightwing users. DDoSecrets says it's not publicly releasing the data due to its sensitivity and the vast amounts of private information it contains. Instead, the group says it will selectively share it with journalists, social scientists, and researchers.

See the full report here: https://www.wired.com/story/gab-hack-data-breach-ddosecrets/

NSW Transport agency extorted by ransomware gang after Accellion attack - BleepingComputer

The transport system for the Australian state of New South Wales has suffered a data breach after the Clop ransomware exploited a vulnerability to steal files. Last week, Transport for NSW disclosed that their agency suffered a data breach after their secure file-sharing system, Accellion FTA was attacked, and hackers stole data. This weekend, the Clop ransomware published screenshots of alleged emails and documents stolen from the NSW government during an attack on their Accellion FTA device. The leaked data includes confidential documents, steering committee documents, and assorted emails.

See the full report here: https://www.bleepingcomputer.com/news/security/nsw-transport-agency-extorted-by-ransomware-gang-after-accellion-attack/

World's leading dairy group Lactalis hit by cyberattack - BleepingComputer

Lactalis, the world's leading dairy group, has disclosed a cyberattack after unknown threat actors have breached some of the company's systems. Lactalis stated that only a limited number of computers on its network were compromised during the attack. The firm added that there was no data breach to report according to an ongoing investigation of this incident. Lactalis has also taken IT systems offline on all company sites impacted by the cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/worlds-leading-dairy-group-lactalis-hit-by-cyberattack/

Malicious NPM packages target Amazon, Slack with new dependency attacks - BleepingComputer

The security firm, Sonatype discovered malicious packages targeting applications related to Amazon, Zillow, Lyft, and Slack using a new 'Dependency Confusion' vulnerability to steal Linux/Unix password files and open reverse shells back to the attackers. These malicious packages are named 'amzn,' 'zg-rentals,' 'lyft-dataset-sdk,' 'serverless-slack-app' and utilize similar names as known repositories on GitHub and other projects.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-npm-packages-target-amazon-slack-with-new-dependency-attacks/

European e-ticketing platform Ticketcounter extorted in data breach - BleepingComputer

A Dutch e-Ticketing platform has suffered a data breach after a user database containing 1.9 million unique email addresses was stolen from an unsecured staging server. Ticketcounter is a Dutch e-Ticketing platform that allows clients, such as zoos, parks, museums, and events, to provide online tickets to their venue. On February 21st, a threat actor created a topic on a hacker forum to sell the stolen Ticketcounter database but quickly took the post down.

See the full report here: https://www.bleepingcomputer.com/news/security/european-e-ticketing-platform-ticketcounter-extorted-in-data-breach/

Tether cryptocurrency firm says docs in $24 million ransom are 'forged' - BleepingComputer

USDT cryptocurrency developer Tether has said they are being extorted by threat actors who are demanding 500 bitcoins, or approximately $24 million, not to leak allegedly stolen emails and documents. Tether has stated that the records circulating online are forged, and they received a ransom note demanding 500 bitcoins or this alleged data dump will be publicly released online.

See the full report here: https://www.bleepingcomputer.com/news/security/tether-cryptocurrency-firm-says-docs-in-24-million-ransom-are-forged/

Hackers use black hat SEO to push ransomware, trojans via Google - BleepingComputer

The delivery system for the Gootkit information stealer has evolved into a complex and stealthy framework, which earned it the name Gootloader, and is now pushing a wider variety of malware via hacked WordPress sites and malicious SEO techniques for Google results. Apart from increasing the number of payloads, Gootloader has been seen distributing them across multiple regions from hundreds of hacked servers that are active at all times.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-black-hat-seo-to-push-ransomware-trojans-via-google/

Minion privilege escalation exploit patched in SaltStack Salt project

The Salt Project has patched a privilege escalation bug impacting SaltStack Salt minions that could be used during a wider exploit chain. The vulnerability, CVE-2020-28243, is described as a privilege escalation bug impacting SaltStack Salt minions allowing an unprivileged user to create files in any non-blacklisted directory via command injection in a process name.

See the full report here: https://www.zdnet.com/article/minion-hijacking-flaw-patched-in-saltstack-salt-project/

Firewall Vendor Patches Critical Auth Bypass Flaw

Germany-based cybersecurity company Genua has fast-tracked a fix for a critical flaw in one of its firewall products. If exploited, the vulnerability could allow local attackers to bypass authentication measures and log in to internal company networks with the highest level of privileges. The patch can be downloaded in GenuGate GUI or by calling “getpatches” on the command line interface.

See the full report here: https://threatpost.com/firewall-critical-security-flaw/164347/

New Jailbreak Tool Works on Most iPhones

Unc0ver, a team of hackers behind the jailbreak tool, released a new tool that works on nearly every iPhone model and exploits a flaw that Apple reported was under active attack last month. The group says its new tool works on iOS 11 to iOS 14.3, which was rolled out in December 2020.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/new-jailbreak-tool-works-on-most-iphones/d/d-id/1340286

Working Windows and Linux Spectre exploits found on VirusTotal - BleepingComputer

Working exploits targeting Linux and Windows systems against a three-year-old vulnerability dubbed Spectre was found on the online VirusTotal malware analysis platform. The vulnerability was unveiled as a hardware bug in January 2018 by Google Project Zero researchers. If successfully exploited on vulnerable systems, it can be used by attackers to steal sensitive data, including passwords, documents, and any other data available in privileged memory.

See the full report here: https://www.bleepingcomputer.com/news/security/working-windows-and-linux-spectre-exploits-found-on-virustotal/

Microsoft fixes actively exploited Exchange zero-day bugs, patch now - BleepingComputer

Microsoft has released emergency out-of-band security updates for all supported Microsoft Exchange versions that fix four zero-day vulnerabilities actively exploited in targeted attacks. These four zero-day vulnerabilities are chained together to gain access to Microsoft Exchange servers, steal email, and plant further malware for increased access to the network. Microsoft has detected a China state-sponsored hacking group known as Hafnium utilizing these attacks against US organizations to steal data.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-actively-exploited-exchange-zero-day-bugs-patch-now/

Post-Cyberattack, Universal Health Services Faces $67M in Losses

The cyberattack that hit Universal Health Services (UHS) in September has cost the healthcare service provider a whopping $67 million in damages, according to financial statements. A fourth-quarter earnings report last week from UHS highlighted the significant incremental labor expense needed to restore IT operations after the incident. UHS said that administrative functions like billing were also delayed, which harmed its operating cash flows in the fourth quarter.

See the full report here: https://threatpost.com/post-cyberattack-universal-health-services-faces-67m-in-losses/164424/

SolarWinds reports $3.5 million in expenses from supply-chain attack - BleepingComputer

SolarWinds has reported expenses of $3.5 million from last year's supply-chain attack, including costs related to incident investigation and remediation. Further expenses were recorded by SolarWinds after paying for legal, consulting, and other professional services related to the December hack and provided to customers for free.

See the full report here: https://www.bleepingcomputer.com/news/security/solarwinds-reports-35-million-in-expenses-from-supply-chain-attack/

Microsoft 365 Defender Threat Analytics enters public preview - BleepingComputer

Threat Analytics, a set of reports from expert Microsoft security researchers that help customers understand, prevent and mitigate active threats, is now available in public preview for Microsoft 365 Defender. This release extends the proactive guidance of Microsoft security researchers, which had previously been available only in Defender for Endpoint. Threat Analytics helps security teams track and stop emerging threats (including ongoing attacks, critical security flaws, and widespread malware) using threat intelligence provided by Microsoft security researchers.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-365-defender-threat-analytics-enters-public-preview/

Payroll giant PrismHR outage likely caused by ransomware attack - BleepingComputer

Leading payroll company PrismHR is suffering a massive outage after suffering a cyberattack this weekend that looks like a ransomware attack from conversations with customers. PrismHR is an online payroll, benefits, and human resources platform used by Professional employer organizations (PEO). PEOs use this platform to provide payroll, HR, and benefits services to their clients, commonly small and medium-sized businesses.

See the full report here: https://www.bleepingcomputer.com/news/security/payroll-giant-prismhr-outage-likely-caused-by-ransomware-attack/

Malaysia Airlines discloses a nine-year-long data breach - BleepingComputer

Malaysia Airlines has experienced a data breach spanning nine years that exposed the personal information of members in its Enrich frequent flyer program. According to Malaysia Airlines, the breach occurred at a third-party IT service provider who notified the airline that member data was exposed between March 2010 and June 2019. It is unknown how many Enrich members were affected by this breach.

See the full report here: https://www.bleepingcomputer.com/news/security/malaysia-airlines-discloses-a-nine-year-long-data-breach/

Google patches actively exploited Chrome browser zero-day vulnerability

Google has fixed an actively exploited zero-day vulnerability in the Chrome 89.0.4389.72 version released today, March 2nd, 2021, to the Stable desktop channel for Windows, Mac, and Linux users. Google rated the zero-day vulnerability as high severity and described it as an Object lifecycle issue in audio.

See the full report here: https://www.zdnet.com/article/google-patches-actively-exploited-chrome-browser-zero-day-vulnerability/

SEC charges group for alleged pump-and-dump Airborne Wireless stock scam

The US Securities and Exchange Commission (SEC) has charged seven individuals in connection to an alleged pump-and-dump stock scheme. On March 2, SEC said that investors in a technology company were defrauded out of $45 million through the scam, in which Kalistratos Kabilafkas secretly controlled Simi Valley, Calif.-based Airborne Wireless Network, a publicly-traded company.

See the full report here: https://www.zdnet.com/article/sec-charges-group-for-alleged-pump-and-dump-airborne-wireless-stock-scam/

VC giant Sequoia discloses data breach after failed BEC attack - BleepingComputer

American VC firm Sequoia Capital has disclosed a data breach following what looks like a failed business email compromise (BEC) attack from January. While the attackers were able to breach the employee's email inbox, they didn't gain access to other resources or assets on the company's network.

See the full report here: https://www.bleepingcomputer.com/news/security/vc-giant-sequoia-capital-discloses-data-breach-after-failed-bec-attack/

Cybersecurity firm Qualys is the latest victim of Accellion hacks - BleepingComputer

Cybersecurity firm Qualys is likely the latest victim to have suffered a data breach after a zero-day vulnerability in their Accellion FTA server was exploited to steal hosted files. In December, a wave of attacks targeted the Accellion FTA file-sharing application using a zero-day vulnerability that allowed attackers to steal files stored on the server. Since then, the Clop ransomware has been extorting these victims by posting the stolen data on their ransomware data leak site. Yesterday, the Clop ransomware group posted screenshots of files allegedly belonging to the cybersecurity firm Qualys. The leaked data includes purchase orders, invoices, tax documents, and scan reports. In the latest statement, Qualys has confirmed that their Accellion FTA server was breached in December 2020 using a zero-day vulnerability. As the server was deployed in their DMZ, which is segregated from their internal network, Qualys' product environment was not compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/cybersecurity-firm-qualys-is-the-latest-victim-of-accellion-hacks/

GRUB2 boot loader reveals multiple high severity vulnerabilities - BleepingComputer

GRUB, a popular boot loader used by Unix-based operating systems has fixed multiple high severity vulnerabilities. The vulnerabilities are tracked as CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-3418, CVE-2021-20225, and CVE-2021-20233. Although 117 upstream code patches have been issued to resolve these CVEs, detailed instructions with regards to mitigation and obtaining updates would be provided by OS vendors.

See the full report here: https://www.bleepingcomputer.com/news/security/grub2-boot-loader-reveals-multiple-high-severity-vulnerabilities/

CompuCom MSP confirms ongoing outage following malware incident - BleepingComputer

US managed service provider CompuCom has suffered a cyberattack leading to service outages and customers disconnecting from the MSP's network to prevent the spread of malware. The outage prevented customers from accessing the company's customer portal to open troubleshooting tickets. The company issued a statement to BleepingComputer stating that they suffered a 'malware incident' and that there is no evidence of it spreading to customers' systems.

See the full report here: https://www.bleepingcomputer.com/news/security/compucom-msp-confirms-ongoing-outage-following-malware-incident/

RTM Cybergang Adds New Quoter Ransomware to Crime Spree

The Russian-speaking RTM threat group is targeting organizations in an ongoing campaign that leverages a well-known banking trojan, brand new ransomware strain, and extortion tactics. According to the researchers at Kaspersky, the triple-threat attack has hit at least ten Russian organizations in the transport and finance sectors via malicious email messages. If the RTM banking trojan fails, attackers deploy a never-before-seen ransomware called Ransom.Win32.Quoter. This ransomware encrypts the contents of computers, using the AES-256 CBC algorithm, and leaves a message demanding a ransom. If victims fail to pay the ransom in demand, attackers rely on double extortion, where they hold the compromised data and threaten to release or leak the data.

See the full report here: https://threatpost.com/rtm-banking-trojan-quoter-ransomware/164447/

US government warns of Social Security scams using fake federal IDs - BleepingComputer

Fraudsters are tricking potential victims into handing over their personal information or sending money in the latest Social Security scam campaigns, warns the US government. According to reports received by the Office of the Inspector General (OIG), the scammers' tactics arsenal has been updated to include the use of fake IDs designed to look like those used by Federal employees. To convince their targets that their identity and demands are legitimate, the scammers can email or text photos of the fake federal IDs. People are urged to remain vigilant about suspicious letters, texts, calls, or emails about an alleged problem with their Social Security number, account, or payments.

See the full report here: https://www.bleepingcomputer.com/news/security/us-government-warns-of-social-security-scams-using-fake-federal-ids/