Threat Intelligence Bulletin: 03/05/2021 - 03/11/2021

Breach Disclosure: Oklahoma Tourism and Recreation Department

In December 2020, the Oklahoma Tourism and Recreation Department was breached, resulting in the exposure of 637,000 email addresses. An unknown individual had originally contacted the Oklahoma organization stating that they had stolen data from the website TravelOK[.]com, in addition to travel related websites for the state. In addition to including email addresses, the breach data also includes first and last names, addresses, phone numbers, birthdays, and hashed passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

While originally attributed to an unknown individual by the Oklahoma Tourism and Recreation Department, the user 'pompompurin' on RaidForums, stated that had breached the website. This user has been responsible for a large number of breaches recently, however, the leaker requested attribution to 'badhou3a' when releasing this data to HaveIBeenPwned. It is not verified at this time who is ultimately responsible for this breach, however, the user 'pompompurin' had released this with evidence on RaidForums, as opposed to a request for attribution in HaveIBeenPwned.

Figure 1: Sample of travelok.sql database

Figure 2: Breach advertisement on RaidForums

Breaking News: 2021-03-05 - 2021-03-11

Ongoing phishing attacks target US brokers with fake FINRA audits - BleepingComputer

In an ongoing phishing campaign, scammers are targeting US brokerage firms and brokers using fake compliance audit alerts to harvest information, warns US Financial Industry Regulatory Authority (FINRA). The phishing emails sent from fake finra-online[.]com domain, asks the recipient to respond to an issue of regulatory non-compliance for which the victim's immediate response is required and then asks them to click on a malicious link or document," FINRA explains. FINRA recommends people who clicked on any link or image in the phishing email immediately notify the appropriate individuals in their firm of the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/ongoing-phishing-attacks-target-us-brokers-with-fake-finra-audits/

New ransomware only decrypts victims who join their Discord server - BleepingComputer

Security Researchers at MalwareHunterTeam have discovered a new ransomware called 'Hog' that encrypts users' devices and only decrypts them if they join the developer's Discord server. It encrypts victims' files and then launches a decryptor program to generate a Discord token. The token allows the ransomware to authenticate to Discord's APIs as the user and check if they joined their server. If the victim has joined the server or the server does not exist, the ransomware will decrypt the victims' files using a static key embedded in the ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomware-only-decrypts-victims-who-join-their-discord-server/

SITA data breach affects millions of travelers from major airlines - BleepingComputer

Passenger data from multiple airlines around the world have been compromised after hackers breached servers belonging to SITA, a global information technology company. The associated air carriers have informed passengers that some of their data have been accessed by an intruder breaching SITA's Passenger Service System (PSS), a service that handles transactions from ticket reservations to boarding. Some of the affected airlines include Lufthansa, Air New Zealand, Singapore Airlines, Scandinavian Airlines, Cathay Pacific, Jeju Air, Malaysia Airlines, and Finnair.

See the full report here: https://www.bleepingcomputer.com/news/security/sita-data-breach-affects-millions-of-travelers-from-major-airlines/

D-Link, IoT Devices Under Attack By Tor-Based Gafgyt Variant

Researchers have discovered a new variant of the Gafgyt botnet that is actively targeting vulnerable D-Link and Internet of Things devices. In order to evade detection, the new variant uses Tor to hide its command-and-control (C2) communications and encrypts sensitive strings in the samples. The botnet is mainly propagated through weak Telnet passwords and exploits three vulnerabilities, remote code execution flaw (CVE-2019-16920) in D-Link devices; a remote code execution vulnerability in Liferay enterprise portal software; and a flaw (CVE-2019-19781) in Citrix Application Delivery Controller.

See the full report here: https://threatpost.com/d-link-iot-tor-gafgyt-variant/164529/

WordPress Injection Anchors Widespread Malware Campaign

Security researchers with eSentire have spotted a Gootloader campaign infiltrating dozens of legitimate WordPress websites involved in the hotel industry, high-end retail, education, healthcare, music, and visual arts, among others. The Gootloader malware is poisoning websites globally as part of an extensive drive-by and watering-hole cybercampaign that abuses WordPress sites by injecting them with hundreds of pages of fake content. The adversaries have so far delivered the Cobalt Strike intrusion tool, the Gootkit banking trojan, or the REvil ransomware, according to forensic analysis. However, it’s unclear how the sites were initially compromised. Website admins are advised to patch all plugins, WordPress itself, and back-end servers as soon as possible to avoid risks.

See the full report here: https://threatpost.com/wordpress-injection-malware-campaign/164555/

Investors are the next target of large-scale cyberattacks - BleepingComputer

In a new report by email cybersecurity company Agari, BEC scammers have started to target investors with fake 'capital call' notices that carry a much larger payout than your standard BEC scam. These scams are when the attackers impersonate a vendor and ask the victim to send payments to a bank account under their control. The attacks seen by Agari are sent from email services, most commonly the centrum[.]cz webmail provider based out of the Czech Republic.

See the full report here: https://www.bleepingcomputer.com/news/security/investors-are-the-next-target-of-large-scale-cyberattacks/

Multiple Cisco products exposed to DoS attack due to a Snort issue

Several Cisco products are exposed to denial-of-service (DoS) attacks due to a vulnerability in the Snort detection engine. The vulnerability resides in the Ethernet Frame Decoder of the Snort detection engine. The vulnerability, tracked as CVE-2021-1285, can be exploited by an unauthenticated, adjacent attacker to trigger a DoS condition by sending it specially crafted Ethernet frames. Users are recommended to upgrade to the fixed versions.

See the full report here: https://securityaffairs.co/wordpress/115341/security/cisco-products-dos-snort-issue.html

Microsoft Reveals 3 New Malware Variants Relating to SolarWinds Cyberattack - MUO - MakeUseOf

Microsoft has revealed three newly found malware variants dubbed GoldMax, Sibot, and GoldFinder relating to the SolarWinds cyberattack. At the same time, it has also given the threat actor behind SolarWinds a specific tracking name: Nobelium. Microsoft assesses that the newly surfaced pieces of malware were used by the actor to maintain persistence and perform actions on very specific and targeted networks post-compromise, even evading initial detection during incident response.

See the full report here: https://www.makeuseof.com/microsoft-reveals-new-malware-solarwinds/

Samsung fixes critical Android bugs in March 2021 updates - BleepingComputer

This week Samsung has started rolling out Android's March security updates to mobile devices to patch critical security vulnerabilities in the runtime, operating system, and related components. This comes after Android had published their March 2021 security updates bulletin, which includes patches for critical vulnerabilities impacting the latest devices.

See the full report here: https://www.bleepingcomputer.com/news/security/samsung-fixes-critical-android-bugs-in-march-2021-updates/

Ransomware gang plans to call victim's business partners about attacks - BleepingComputer

In February, the REvil ransomware operation posted a job notice where they were looking to recruit people to perform DDoS attacks and use VOIP calls to contact victims and their partners. These new tactics include a free service where the threat actors, or affiliated partners, will perform voice-scrambled VOIP calls to the media and victim's business partners with information about the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-plans-to-call-victims-business-partners-about-attacks/

Check to see if you’re vulnerable to Microsoft Exchange Server zero-days using this tool

Microsoft's Exchange Server team has released a script for IT admins to check if systems are vulnerable to recently-disclosed zero-day bugs. The script has been updated to include indicators of compromise (IOCs) linked to four zero-day vulnerabilities found in the Microsoft Exchange Server.

See the full report here: https://www.zdnet.com/article/check-to-see-if-youre-vulnerable-to-microsoft-exchange-server-zero-days-using-this-tool/

Microsoft is giving Windows admins full control over driver updates - BleepingComputer

Microsoft has announced a new deployment service for drivers and firmware that will make it easier for IT admins to select the right drivers for devices on their enterprise network. Once the new service is available, admins will be able to choose the drivers to be offered via Windows Update in their environment out of a selection of matching options and schedule them for deployment.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-is-giving-windows-admins-full-control-over-driver-updates/

Microsoft Office 365 gets protection against malicious XLM macros - BleepingComputer

Microsoft has added XLM macro protection for Microsoft 365 customers by expanding the runtime defense provided by Office 365's integration with Antimalware Scan Interface (AMSI) to include Excel 4.0 (XLM) macro scanning. Microsoft first extended support for its Antimalware Scan Interface (AMSI) to Office 365 client applications in 2018 to defend customers against attacks using VBA macros. The recent AMSI instrumentation in XLM directly tackles the rise of malware campaigns that abuse this feature.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-office-365-gets-protection-against-malicious-xlm-macros/

Report: Russian hackers exploit Lithuanian infrastructure | World | pressofatlanticcity.com - Press of Atlantic City

According to Lithuania’s intelligence service report, the hacker groups linked to Russian intelligence conducted cyber-attacks against top Lithuanian officials and decision-makers last year and used the Baltic nation’s technology infrastructure as a base to hit targets elsewhere. Among others, the Russian cyber-espionage group APT29 with alleged links to Russia’s intelligence services exploited Lithuania’s information technology infrastructure to carry out attacks by APT29 against foreign entities developing a COVID-19 vaccine.

See the full report here: https://apnews.com/4f643495296f645e8957594034ec0367

Flagstar Bank customer data breached through Accellion hack

Flagstar Bank has been added to a list of companies breached due to an Accellion software zero-day vulnerability. Accellion's file-sharing program, File Transfer Appliance (FTA), is an enterprise product used to transfer large files. Accellion first informed the company of a security issue on January 22, 2021. Following which Flagstar permanently discontinued the use of this file sharing platform. However, the unauthorized party was able to access some of Flagstar's information on the Accellion platform.

See the full report here: https://www.zdnet.com/article/flagstar-bank-customer-data-breached-through-accellion-hack/

Microsoft's MSERT tool now finds web shells from Exchange Server attacks - BleepingComputer

Microsoft has pushed out a new update for their Microsoft Safety Scanner (MSERT) tool to detect web shells deployed in the recent Exchange Server attacks. On March 2nd, Microsoft disclosed that four Exchange Server zero-day vulnerabilities were being used in attacks against exposed Outlook on the web (OWA) servers. These vulnerabilities are tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065.

See the full report here: https://www.bleepingcomputer.com/news/security/microsofts-msert-tool-now-finds-web-shells-from-exchange-server-attacks/

VMware releases fix for severe View Planner RCE vulnerability - BleepingComputer

VMware has addressed a high severity unauthenticated RCE vulnerability in VMware View Planner, allowing attackers to abuse servers running unpatched software for remote code execution. According to VMware's security advisory, the vulnerability tracked as CVE-2021-21978 can be exploited remotely by unauthenticated attackers in low complexity attacks that don't require user interaction. The flaw is caused by improper validation of file extensions due to improper input validation and lack of authorization bugs in the logupload web application.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-releases-fix-for-severe-view-planner-rce-vulnerability/

Intel CPU interconnects can be exploited by malware to leak encryption keys and other info, academic study finds

Chip-busting boffins in America have devised yet another way to filch sensitive data by exploiting Intel's processor design choices. Doctoral student Riccardo Paccagnella, master's student Licheng Luo, and assistant professor Christopher Fletcher from the University of Illinois at Urbana-Champaign delved into the way CPU ring interconnects work and found they can be abused for side-channel attacks. The upshot is that one application can infer another application's private memory and snoop on the user's key presses.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/08/intel_ring_flaw/

Privacy-First Browser Brave Is Launching a Search Engine

Brave, makers of an open-source web browser, are launching a privacy-focused alternative search engine that will offer options for ad-supported and ad-free search results. Following Brave’s acquisition of Tailcat, a search engine developed by the former Cliqz team, the company announced its forthcoming product known as Brave Search.

See the full report here: https://www.wired.co.uk/article/brave-browser-search

Iranian Hackers Using Remote Utilities Software to Spy On Its Targets

Hackers with suspected ties to Iran are actively targeting academia, government agencies, and tourism entities in the Middle East and neighboring regions as part of an espionage campaign aimed at data theft. Dubbed "Earth Vetala" by Trend Micro, it leveraged spear-phishing emails containing embedded links to a popular file-sharing service called Onehub to distribute malware. The embedded links direct victims to a .ZIP file that contains a legitimate remote administration software developed by RemoteUtilities, which is capable of downloading and uploading files, capturing screenshots, browsing files and directories, and executing and terminating processes.

See the full report here: https://thehackernews.com/2021/03/iranian-hackers-using-remote-utilities.html

University of the Highlands and Islands shuts down campuses as it deals with 'ongoing cyber incident'

The University of the Highlands and Islands (UHI) in Scotland is fending off an ongoing cyber incident that has shut down its campuses. The institution, which spans 13 locations across the northernmost part of the UK, warned that most services – including its Brightspace virtual learning environment were affected. The institute does not believe that personal data had been affected. However, the source of the incident is not yet known.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/08/uni_highlands_islands_cyber_incident/

Fake Google reCAPTCHA Phishing Attack Swipes Office 365 Passwords

Microsoft users are being targeted with thousands of phishing emails in an ongoing attack aiming to steal their Office 365 credentials. The attacker leverages a fake Google reCAPTCHA system and top-level domain landing pages that include the logos of victims’ companies. The emails first take recipients to a fake Google reCAPTCHA system page. Once victims “pass” the reCAPTCHA test, they are then redirected to a phishing landing page, which asks for their Office 365 credentials.

See the full report here: https://threatpost.com/google-recaptcha-phishing-office-365/164566/

Google Chrome to block port 554 to stop NAT Slipstreaming attacks - BleepingComputer

Google Chrome will block the browser's access to TCP port 554 to protect against attacks using the NAT Slipstreaming 2.0 vulnerability. Last year, security researchers disclosed a new version of the NAT Slipstreaming vulnerability that allows malicious scripts to bypass a website visitor's NAT firewall and access any TCP/UDP port on the visitor's internal network.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-to-block-port-554-to-stop-nat-slipstreaming-attacks/

Supernova malware clues link Chinese threat group Spiral to SolarWinds server hacks

Intrusion activity related to the Supernova malware planted on compromised SolarWinds Orion installations exposed on the public internet points to an espionage threat actor based in China. Security researchers named the hacker group Spiral and correlated findings from two intrusions in 2020 on the same victim network to determine activity from the same intruder. According to the researchers, CVE-2020-10148 has been actively exploited by Spiral. This vulnerability is found in the SolarWinds Orion API and is described as an authentication bypass bug leading to the remote execution of API commands.

See the full report here: https://www.zdnet.com/article/supernova-malware-clues-link-chinese-threat-group-spiral-to-solarwinds-hacks/

Crypto-Miner Campaign Targets Unpatched QNAP NAS Devices

Owners of popular QNAP Systems network-attached storage (NAS) devices are being warned that a malicious cryptocurrency campaign is actively exploiting two unpatched critical firmware bugs. QNAP fixed the flaws in October 2020. However, researchers at Qihoo 360’s Network Security Research Lab report a widening campaign targeting over 100 unpatched firmware versions used by 4.3 million of QNAP’s NAS devices.

See the full report here: https://threatpost.com/miner-campaign-targets-unpatched-qnap-nas/164580/

Apple emits patches for iOS, macOS, Safari, etc to stop dodgy websites hijacking people's gadgets

Apple on Monday released security patches for macOS, iOS, iPadOS, watchOS, and Safari to fix up a vulnerability that can be exploited by malicious web pages to run malware on victims' computers and gadgets. Users should upgrade to Safari 14.0.3, macOS Big Sur 11.2.3, watchOS 7.3.2, iOS 14.4.1, and iPadOS 14.4.1, as necessary.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/09/apple_security_update/

Microsoft 365 adds 'External' email tags for increased security - BleepingComputer

Microsoft is working on boosting Exchange Online phishing protection capabilities by adding support for external email message tags to its cloud-based email service. This will be achieved by presenting a new tag on emails called 'External' in the message list. In some Outlook clients, a 'mail tip' will be included at the top of the reading pane with the sender's email address. The new external email tags will only show up in Outlook on the web, the new Outlook for Mac, and Outlook mobile (iOS and Android).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-365-adds-external-email-tags-for-increased-security/

Hackers access surveillance cameras at Tesla, Cloudflare, banks, more - BleepingComputer

Hackers gained access to live surveillance cameras installed at Tesla, Equinox, healthcare clinics, jails, and banks, including the Bank of Utah. In addition to images captured from the cameras, the hacker also shared screenshots of their ability to gain root shell access to the surveillance systems used by Cloudflare and at Telsa HQ. According to Tillie Kottmann, a reverse engineer for the group of hackers, they gained access to these surveillance systems using a super admin account for Verkada, a surveillance company that works with all of these organizations. Verkada is currently investigating the intrusion and has disabled all internal administrator accounts to prevent any unauthorized access.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-access-surveillance-cameras-at-tesla-cloudflare-banks-more/

US seizes more domains used in COVID-19 vaccine phishing attacks - BleepingComputer

The US Department of Justice has seized another domain name, usaregenermedicals[.]com, that was being used to impersonate the official site of a biotechnology company involved in COVID-19 vaccine development. The seized domain claimed to sell the REGEN-COV2 emergency antibody-drug cocktail developed by Regeneron Pharmaceuticals and approved by the U.S. Food and Drug Administration for emergency COVID-19 treatment in November 2020. The US Department of Justice has seized four other phishing domains seized in recent months for conducting COVID-19-related scams.

See the full report here: https://www.bleepingcomputer.com/news/security/us-seizes-more-domains-used-in-covid-19-vaccine-phishing-attacks/

Adobe fixes critical Creative Cloud, Adobe Connect vulnerabilities - BleepingComputer

Adobe has released security updates that fix vulnerabilities in Adobe Creative Cloud Desktop, Framemaker, and Connect. The March advisory addresses fixed eight vulnerabilities, out of which Adobe Creative Cloud Desktop has the most of critical updates, with two allowing code execution and the third leading to privilege escalation. Adobe advises customers using vulnerable products to update to the latest versions as soon as possible to block attacks that could lead to successful exploitation of unpatched installations.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-creative-cloud-adobe-connect-vulnerabilities/

z0Miner botnet hunts for unpatched ElasticSearch, Jenkins servers - BleepingComputer

According to a report published by researchers at Qihoo 360's Network Security Research Lab, z0Miner is now probing for servers unpatched against vulnerabilities addressed in 2015 and earlier. The botnet uses exploits targeting an ElasticSearch RCE vulnerability tracked as CVE-2015-1427 and an older RCE impacting Jenkins servers. After compromise, z0Miner used a similar attack logic as the one observed by 360 Netlab researchers, gaining persistence via crontab and starting to mine for Monero.

See the full report here: https://www.bleepingcomputer.com/news/security/z0miner-botnet-hunts-for-unpatched-elasticsearch-jenkins-servers/

iPhone Call Recorder bug gave acess to other people's conversations - BleepingComputer

An iOS call recording app patched a security vulnerability that gave anyone access to the conversations of thousands of users by simply providing the correct phone numbers. The application’s name is “Automatic call recorder” or “Acr call recorder” and has thousands of user reviews in the App Store, amounting to a rating above four stars. It has also been listed among the top call recording apps for iPhone.

See the full report here: https://www.bleepingcomputer.com/news/security/iphone-call-recorder-bug-gave-acess-to-other-peoples-conversations/

Microsoft Edge Legacy will now prompt you to install Chromium Edge - BleepingComputer

Microsoft Edge Legacy has officially reached the end of life, and soon the web browser will begin displaying notifications telling users to switch to the new Chromium-based Microsoft Edge. This policy's use is short-lived, though, as, on April 13th, 2021, Microsoft's Patch Tuesday will automatically install an update that removes Microsoft Edge Legacy and replaces it with the new Chromium-based Microsoft Edge.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-legacy-will-now-prompt-you-to-install-chromium-edge/

Microsoft shares detection, mitigation advice for Azure LoLBins - BleepingComputer

Azure LoLBins can be used by attackers to bypass network defenses, deploy cryptominers, elevate privileges, and disable real-time protection on a targeted device. On Windows systems, LoLBins (short for living-off-the-land binaries) are Microsoft-signed executables (downloaded or pre-installed) that threat actors can abuse to evade detection while performing various malicious tasks such as downloading, installing, or executing malicious code. Microsoft recommends using Azure Defender for Resource Manager, which keeps track of Azure management operations and alerts you if it spots suspicious activity.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shares-detection-mitigation-advice-for-azure-lolbins/

GandCrab ransomware affiliate arrested for phishing attacks - BleepingComputer

A 20-year-old man was arrested on February 25th by South Korean police after an international investigation traced GandCrab ransom payments to withdrawals made by the suspect. South Korean media states the suspect distributed 6,486 phishing emails. These emails pretended to be from South Korean police investigating the email recipient's online defamation.

See the full report here: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-affiliate-arrested-for-phishing-attacks/

F5 urges customers to patch critical BIG-IP pre-auth RCE bug - BleepingComputer

F5 Networks, a leading provider of enterprise networking gear, has announced four critical remote code execution (RCE) vulnerabilities affecting most BIG-IP and BIG-IQ software versions. The advisory also includes three other RCE vulnerabilities (two high and one medium, with CVSS severity ratings between 6.6 and 8.8), allowing authenticated remote attackers to execute arbitrary system commands. The vulnerabilities are fixed in BIG-IP versions 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, and 11.6.5.3.

See the full report here: https://www.bleepingcomputer.com/news/security/f5-urges-customers-to-patch-critical-big-ip-pre-auth-rce-bug/

More hacking groups join Microsoft Exchange attack frenzy - BleepingComputer

More state-sponsored hacking groups have joined the ongoing attacks targeting tens of thousands of on-premises Exchange servers impacted by severe vulnerabilities tracked as ProxyLogon. In a Friday update to their announcement, Microsoft stated that several other threat actors "beyond HAFNIUM" are also exploiting the four critical Exchange flaws. According to the data collected by ESET researchers, web shells have already been deployed on over 5,000 unique Exchange servers from over 115 countries. The report states that the unpatched Exchange servers are currently hunted down by "at least 10 APT groups, including APT27, Tick, and Calypso, Winnti Group, Tonto Team, Mikroceen, and a newly detected threat actor dubbed Websiic.

See the full report here: https://www.bleepingcomputer.com/news/security/more-hacking-groups-join-microsoft-exchange-attack-frenzy/

SAP Stomps Out Critical RCE Flaw in Manufacturing Software

Enterprise software giant SAP pushed out fixes for a critical-severity vulnerability in its real-time data monitoring software for manufacturing operations. If exploited, the flaw could allow an attacker to access SAP databases, infect end users with malware and modify network configurations. The critical-bug fix was part of 18 security patches released by SAP addressing new vulnerabilities and updating previously released patches. The two most critical fixes included the vulnerability in SAP’s Manufacturing Integration and Intelligence (MII) application for synchronizing manufacturing operations, as well as one in SAP’s NetWeaver AS Java software stack.

See the full report here: https://threatpost.com/sap-critical-rce-flaw-manufacturing/164666/

Nim-Based Malware Loader Spreads Via Spear-Phishing Emails

In an ongoing spear-phishing campaign, scammers are distributing a malware loader, which researchers call NimzaLoader. Security researchers first observed the NimzaLoader campaign on Feb. 3, in the form of emails with “personalized details” for victims, including their names and company names. The phishing emails purport to come from a coworker and contains a malicious link to a fake PDF preview. If the email recipient clicks on the link, they are redirected to a landing page hosted on email marketing service GetResponse. That page links to the “PDF” and tells the victim to “save to preview.” This link redirects the victim to the NimzaLoader executable. Researchers have linked NimzaLoader back to TA800, a threat group that has targeted a wide range of industries in North America, infecting victims with banking trojans and malware loaders.

See the full report here: https://threatpost.com/nim-based-malware-loader-spreads-via-spear-phishing-emails/164643/

Ryuk ransomware hits 700 Spanish government labor agency offices - BleepingComputer

SEPE, the Spanish government agency for labor, suffered a Ryuk ransomware attack that forced the organization to shut its systems down, causing multiple delayed appointments throughout Spain. The ransomware attack has hit more than 700 agency offices across Spain. The ransomware has also spread beyond SEPE's workstations and has reached the agency's remote working staff's laptops. SEPE confirmed that personal data, payroll, and unemployment benefits were not affected after the ransomware attack. The agency is currently working on restoring priority services as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-hits-700-spanish-government-labor-agency-offices/