Threat Intelligence Bulletin: 03/12/2021 - 03/18/2021

Breach Disclosure: Liker

In March 2021, the social network site Liker suffered a data breach. The breach was allegedly in retaliation for the Gab data breach and data scraped from Parler. The site was taken offline following the breach which exposed 465,000 user email addresses, names, dates of birth, private messages, security questions and passwords stored as bcrypt hashes.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to posts on the popular hacker forum Raidforums, the breach was facilitated by the user under the alias of badhou3a who used their access to create posts as the social networks support accounts as well as exfiltrate the sites user database. The breach reportedly took place between the 4th and 9th of March 2021 with the information containing:

• Email address
• Authorization tokens
• Dates of birth
• Education history
• Geographic location
• IP addresses
• Full names
• Passwords (bcrypt hashes)
• Phone numbers
• Security questions and answers
• Social media profiles
• Username
• Private messages

Figure 1: Raidforums post detailing breach details

Figure 2: Sample of breached data

Liker has yet to make a comment on the breach, and since the data was released on popular hacker forums, the site has been taken offline and remains inaccessible to its users. Liker's website presents a notice informing the site is down for maintenance and upgrades.

Figure 3: liker.com notice

Breach Disclosure: WeLeakInfo

The popular credential selling site, WeLeakInfo, which was recently shut down by the FBI in January of 2020, has been hit by a data breach on March 11th, 2021. This resulted in the data of more than 24,000 customers of the illegal site being released on various hacking forums. The data included users of WeLeakInfo that made their purchases using Stripe, the online sales platform, which included full names, IP Addresses, addresses, partial credit card data, transaction dates, Stripe reference numbers, and phone numbers.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Before the FBI seized WeLeakInfo last year, this site was home to stolen information from over 10,000 data breaches, which was around 12 billion indexed user credentials. According to the seller of this data on hacking forums, the FBI may have missed a domain that was associated with payment processing, which allowed the attacker to take over the domain and harvest the data.

Fortunate for users of WeLeakInfo, only users who used the Stripe payment processing were impacted by the breach, whereas anyone who used Bitcoin or Paypal should be not impacted.

Figure 1: Posting of WeLeakInfo data on RaidForums

Breaking News: 2021-03-12 - 2021-03-18

Google fixes second actively exploited Chrome zero-day this month - BleepingComputer

Google has fixed a second actively exploited Chrome zero-day this month with the release of Chrome 89.0.4389.90 to the Stable desktop channel for Windows, Mac, and Linux users. The zero-day tracked as CVE-2021-21193 is rated by Google as a high severity vulnerability. It is a use after free bug in Blink that could lead to arbitrary code execution on systems running vulnerable Chrome versions.

See the full report here: https://www.bleepingcomputer.com/news/security/google-fixes-second-actively-exploited-chrome-zero-day-this-month/

Scammers promote fake cryptocurrency giveaways via Twitter ads - BleepingComputer

Threat actors have started to use 'Promoted' tweets, otherwise known as Twitter ads, to spread cryptocurrency giveaway scams. When creating the tweets, the scammers break up the URL so that Twitter's ad fraud detection algorithms do not detect them. The giveaway sites' final landing pages are commonly Tesla, or Elon Musk-themed and contain a Bitcoin, Ethereum, or Dogecoin address that users are told to send coins. In return, the scammers state that the sender will receive double the amount that they sent.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-promote-fake-cryptocurrency-giveaways-via-twitter-ads/

Google shares Spectre PoC targeting browser JavaScript engines - BleepingComputer

Google has published JavaScript proof-of-concept (PoC) code to demonstrate the practicality of using Spectre exploits targeting web browsers to access information from a browser's memory. According to the Google Security Team, the shared PoC works across a wide range of processor architectures, operating systems, and hardware generations. Google advises web developers to use new security mechanisms to mitigate Spectre-style hardware attacks and common web-level cross-site leaks.

See the full report here: https://www.bleepingcomputer.com/news/security/google-shares-spectre-poc-targeting-browser-javascript-engines/

New ZHtrap botnet malware deploys honeypots to find more targets - BleepingComputer

Security researchers have spotted a new botnet malware dubbed ZHtrap, capable of hunting down and transforming infected routers, DVRs, and UPnP network devices into honeypots that help it find other targets to infect. The botnet's main capabilities include DDoS attacks and scanning for more vulnerable devices to infect. However, it also comes with backdoor functionality allowing the operators to download and execute additional malicious payloads. ZHtrap's most interesting feature is that it turns infected devices into honeypots to collect IP addresses of more targets likely vulnerable to its propagation methods or already infected by other malware. Once deployed, ZHtrap's honeypot starts listening to a list of 23 ports, and it sends all IPs connecting to them to its scanning module as potential targets in its attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/new-zhtrap-botnet-malware-deploys-honeypots-to-find-more-targets/

Metamorfo Banking Trojan Abuses AutoHotKey to Avoid Detection

In an attempt to evade detection and steal users’ information, the Metamorfo banking trojan is abusing AutoHotKey (AHK) and the AHK compiler, warns security researchers. Metamorfo monitors browser activity looking for targeted banks, listed in the form of strings in the AHK compiler process memory. When a victim opens one of the targeted banking pages, Metamorfo overlays it with a fake version of the webpage designed to harvest credentials. Users can protect themselves by being wary of what files they download and also by checking their machines for random new file folders in the Windows Program Data directory.

See the full report here: https://threatpost.com/metamorfo-banking-trojan-autohotkey/164735/

CEO of Sky Global encrypted chat platform indicted by US - BleepingComputer

The US Department of Justice has indicted the CEO of encrypted messaging company Sky Global, and an associate for allegedly aiding criminal enterprises avoid detection by law enforcement. Department of Justice states that as part of Sky Global's services, it guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised. Further, Sky Global has generated hundreds of millions of dollars by operating a secure communications platform to facilitate narcotics distribution worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/ceo-of-sky-global-encrypted-chat-platform-indicted-by-us/

Critical Security Hole Can Knock Smart Meters Offline

Critical security vulnerabilities in Schneider Electric smart meters could allow an attacker a path to remote code execution (RCE), or to reboot the meter causing a denial-of-service (DoS) condition on the device. Researchers found that two different exploitation paths arise from the improper restriction of operations within a memory buffer, depending on the specific architecture. They reported these as two different vulnerabilities tracked as CVE-2021-22714 and CVE-2021-22713. The vulnerability was addressed in updates released in January and March, and users are urged to move to the patched versions.

See the full report here: https://threatpost.com/critical-security-smart-meter-offline/164753/

These Android apps can steal your banking details, get rid of them now - BGR India

Security researchers at Check Point have found ten malicious apps that contain a new dropper called Clast82 that installs the AlienBot Banker and MRAT to a person’s smartphone. AlienBot is a type of malware that uses Firebase for C2 communication and GitHub for payload downloads. The dropper disables its malign intents and sets them as ‘false.’ Once the evaluation is successful, it turns on its evil mode and drops in payloads to infect people with financial trojans. With this, the malware can steal people’s banking details, two-factor authentication (2FA) codes, and more.

See the full report here: https://www.bgr.in/apps/android-apps-dropping-banking-trojan-to-steal-financial-data-beware-of-them-947340/

OVH data center fire likely caused by faulty UPS power supply - BleepingComputer

OVH founder and chairman Octave Klaba has provided a plausible explanation for the fire that had burned down OVH data centers in Strasbourg, France. OVH is the largest hosting provider in Europe and the third-largest in the world. The cloud computing company provides VPS, dedicated servers, and other web services.

See the full report here: https://www.bleepingcomputer.com/news/security/ovh-data-center-fire-likely-caused-by-faulty-ups-power-supply/

7-Zip developer releases the first official Linux version - BleepingComputer

An official version of the popular 7-zip archiving program has been released for Linux for the first time. Linux already had support for the 7-zip archive file format through a POSIX port called p7zip but it was maintained by a different developer. As the p7zip developer has not maintained their project for 4-5 years, 7-Zip developer Igor Pavlov decided to create a new official Linux version based on the latest 7-Zip source code.

See the full report here: https://www.bleepingcomputer.com/news/software/7-zip-developer-releases-the-first-official-linux-version/

Microsoft shares temporary fix for Windows 10 printing crashes - BleepingComputer

Microsoft has provided a temporary fix for the Windows 10 blue screen crashes plaguing customers when printing after installing the March 2021 cumulative updates. According to Microsoft, users received an APC_INDEX_MISMATCH error with a blue screen when attempting to print to several printers in some apps.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-temporary-fix-for-windows-10-printing-crashes/

Google emits data-leaking proof-of-concept Spectre exploit for Intel CPUs to really get everyone's attention

Google on Friday released proof-of-concept code for conducting a Spectre-based attack against its Chrome browser to show how web developers can take steps to mitigate browser-based side-channel attacks. The code executes a timing attack, by which the attacker observes the time required to access memory and infers whether the selected address is in the cache or needs to be loaded, based on whether the operation was fast or slow.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/12/google_spectre_code/

Microsoft Edge to use a four-week release cycle to sync with Chrome - BleepingComputer

Major Stable versions of Microsoft Edge will now be released every four weeks to synchronize with the new four-week release cycle announced by Google Chrome. This month, Google announced switching from a six-week release cycle to a four-week cycle after improving their testing and release process.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-edge-to-use-a-four-week-release-cycle-to-sync-with-chrome/

Microsoft Exchange exploits now used by cryptomining malware - BleepingComputer

The operators of Lemon_Duck, a cryptomining botnet that targets enterprise networks, are now using Microsoft Exchange ProxyLogon exploits in attacks against unpatched servers. The malware is known for installing XMRig Monero (XMR) CPU coinminers on infected devices to mine cryptocurrency for the botnet's owners.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-exploits-now-used-by-cryptomining-malware/

15-year-old Linux kernel bugs let attackers gain root privileges - BleepingComputer

Three vulnerabilities found in the iSCSI subsystem of the Linux kernel could allow local attackers with basic user privileges to gain root privileges on unpatched Linux systems. These security bugs can only be exploited locally, which means that potential attackers will have to gain access to vulnerable devices by exploiting another vulnerability or using an alternative attack vector. GRIMM researchers discovered the bugs 15 years after they were introduced in 2006 during the initial development stages of the iSCSI kernel subsystem.

See the full report here: https://www.bleepingcomputer.com/news/security/15-year-old-linux-kernel-bugs-let-attackers-gain-root-privileges/

Experts say ransomware attack on Buffalo Public Schools should have been anticipated - Buffalo News

Buffalo Public Schools leaders were taken by surprise by the ransomware attack on the district's network Friday. Experts say that the length of time it will take for the Buffalo Public Schools to get back online depends on the district's backup measures and planning. The district is working with technology industry experts and law enforcement authorities to resolve the ransomware attack.

See the full report here: https://buffalonews.com/news/local/experts-say-ransomware-attack-on-buffalo-public-schools-should-have-been-anticipated/article_60a77598-8446-11eb-8b6b-d3137700ab43.html

Experts found 15 flaws in Netgear JGS516PE switch, including a critical RCE

Netgear has released security and firmware updates to address 15 vulnerabilities in its JGS516PE Ethernet switch, including an unauthenticated, remote code execution flaw rated as critical. The switch internal management web application in firmware versions before 2.6.0.43 failed to correctly implement access controls in one of its endpoints, allowing unauthenticated attackers to bypass authentication and execute actions with administrator privileges. Users are recommended to upgrade the firmware version to 2.6.0.48.

See the full report here: https://securityaffairs.co/wordpress/115586/hacking/netgear-soho-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=netgear-soho-flaws

Hackers are trading in medical data relating to French citizens (Includes interview) - Digital Journal

The sensitive medical data belonging to nearly half a million French people have been stolen and leaked online. The security incident was announced by France's Ministry of Health. This indicated that the data was being sold online in a cybercrime forum. It appears that some of the data consists of identifying information including birth date, blood type, GP, health insurance provider, medical treatments, HIV status, and pregnancy test results.

See the full report here: http://www.digitaljournal.com/tech-and-science/technology/hackers-are-trading-in-medical-data-relating-to-french-citizens/article/586634

Israeli car financing company hacked, dozens of personal documents leaked - The Jerusalem Post

Black Shadow, the hackers who leaked thousands of documents containing the personal information of customers with Israel’s Shirbit insurance company in December, have now hacked the servers of K.L.S. Capital Ltd. as well, the group said in a Telegram post on Saturday. K.L.S. is a car financing company that has been around for over 17 years, employing some 20 people and over 26,000 existing customers whose personal information could potentially be released due to the hack.

See the full report here: https://www.jpost.com/jpost-tech/israeli-car-financing-company-hacked-private-information-held-for-ransom-661865

New PoC for Microsoft Exchange bugs puts attacks in reach of anyone - BleepingComputer

A security researcher has released a new proof-of-concept exploit this weekend that requires slight modification to install web shells on Microsoft Exchange servers vulnerable to the actively exploited ProxyLogon vulnerabilities. Since Microsoft disclosed the actively exploited Microsoft Exchange security vulnerabilities, known collectively as ProxyLogon, administrators and security researchers have been scrambling to protect vulnerable servers exposed on the Internet.

See the full report here: https://www.bleepingcomputer.com/news/security/new-poc-for-microsoft-exchange-bugs-puts-attacks-in-reach-of-anyone/

Twitter bug automatically suspends you when tweeting 'Memphis' - BleepingComputer

A bug on Twitter is causing users to become temporarily suspended if they tweet the word Memphis. This bug started after users tweeting about the Tennessee city, sports teams, or players suddenly found that they were temporarily suspended for 12 hours after Tweeting the word Memphis. Twitter has fixed the bug but did not share what specifically caused it.

See the full report here: https://www.bleepingcomputer.com/news/technology/twitter-bug-automatically-suspends-you-when-tweeting-memphis/

Phishing sites now detect virtual machines to bypass detection - BleepingComputer

Phishing sites are now using JavaScript to evade detection by checking whether a visitor is browsing the site from a virtual machine or headless device. The script checks the visitor's screen's width and height and uses the WebGL API to query the rendering engine used by the browser. The script also checks if the visitor's screen has a color depth of less than 24-bits or if the screen height and width are less than 100 pixels. If it detects any of these conditions, the phishing page will display a message in the browser's developer console and show an empty page to the visitor.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-sites-now-detect-virtual-machines-to-bypass-detection/

Hackers stole NFTs from Nifty Gateway users - The Verge

Some users of NFT marketplace Nifty Gateway said hackers stole digital artwork worth thousands of dollars from their accounts. Some people who were hacked also said their credit cards on file were used to purchase additional NFTs, also costing thousands of dollars, which were then transferred away to a hacker’s account. Nifty Gateway suggests the hackers may have successfully reused login credentials that leaked from other services. To help prevent future hacks, it recommends enabling two-factor authentication.

See the full report here: https://www.theverge.com/2021/3/15/22331818/nifty-gateway-hack-steal-nfts-credit-card

Hackers steal health data of 50,000 patients from Pace Program claim company - Becker's Hospital Review

PeakTPA, a company that manages the Program of All-Inclusive Care for the Elderly claims for Medicare and Medicaid users, began notifying 50,000 patients that their data was breached after data from two of PeakTPA's cloud servers was stolen. On Dec. 31, 2020, PeakTPA learned about the stolen data. The data may have included patients' Social Security numbers, full name, and medical treatment information, the company said in a notice on its website.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/hackers-steal-health-data-of-50-000-patients-from-pace-program-claim-company.html

Windows 10 emergency updates released to fix printing crashes - BleepingComputer

Microsoft has released out-of-band non-security updates to fix a know Windows 10 issue causing blue screens when printing to network printers after installing the March 2021 cumulative updates. According to Microsoft, the collective updates will address an issue that might cause a blue screen when attempting to print to several printers using some apps and might generate the error, APC_INDEX_MISMATCH.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-emergency-updates-released-to-fix-printing-crashes/

Twitter now supports multiple 2FA security keys on mobile and web - BleepingComputer

Twitter has added support for multiple security keys to accounts with two-factor authentication (2FA) enabled for logging into the social network's web interface and mobile apps. The company also announced a future option for 2FA-enabled accounts to use security keys as the primary authentication method while having all other login methods disabled.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-now-supports-multiple-2fa-security-keys-on-mobile-and-web/

iOS Clock app crashes due to strange Beirut timezone bug - BleepingComputer

A bug in iOS is causing the Clock app to crash when creating a new alarm if the device's timezone is set to Beirut, Lebanon. This bug is believed to have started iOS 14.4, which was released in January, with Apple users in Beirut suddenly complaining that the Clock app started crashing when setting a new alarm.

See the full report here: https://www.bleepingcomputer.com/news/apple/ios-clock-app-crashes-due-to-strange-beirut-timezone-bug/

Blender website in maintenance mode after hacking attempt - BleepingComputer

Blender.org, the official website of the popular 3D computer graphics software Blender, is now in maintenance mode, according to a message displayed on the site. The website is undergoing maintenance due to a hacking attempt, and parts of the blender.org website and some of the blogs are still down and will remain offline for several hours.

See the full report here: https://www.bleepingcomputer.com/news/security/blender-website-in-maintenance-mode-after-hacking-attempt/

Hafnium’s China Chopper: a ‘slick’ and tiny web shell for creating server backdoors

Security researchers have provided insight into China Chopper, a web shell used by the state-sponsored Hafnium hacking group. On Monday, Trustwave published an analysis of one of the group's tools, China Chopper, a web shell widely used for post-exploitation activities. The web shell has been detected in Exchange Server-related attacks alongside DearCry ransomware deployment.

See the full report here: https://www.zdnet.com/article/hafniums-china-chopper-a-slick-and-tiny-web-shell-for-creating-server-backdoors/

Microsoft releases one-click Exchange On-Premises Mitigation Tool - BleepingComputer

Microsoft has released a one-click Exchange On-premises Mitigation Tool (EOMT) tool to allow small business owners to easily mitigate the recently disclosed ProxyLogon vulnerabilities. Microsoft released the EOMT one-click PowerShell script so that small business owners who do not have dedicated or security teams can get further help securing their Microsoft Exchange servers.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-one-click-exchange-on-premises-mitigation-tool/

Mimecast: SolarWinds hackers stole some of our source code - BleepingComputer

Mimecast confirmed that the state-sponsored SolarWinds hackers who breached its network earlier this year downloaded source code out of a limited number of repositories. The threat actor accessed certain Mimecast-issued certificates and related customer server connection information, including a subset of email addresses and other contact information, as well as encrypted and/or hashed and salted credentials. The threat actor also accessed and downloaded a limited number of Mimecast's source code repositories, but the company found no evidence of any modifications to their source code nor do they believe there was any impact on their products. Mimecast reset all affected hashed and salted credentials and recommends customers hosted in the US and the UK to reset any server connection credentials they use on the Mimecast platform.

See the full report here: https://www.bleepingcomputer.com/news/security/mimecast-solarwinds-hackers-stole-some-of-our-source-code/

PYSA Ransomware Pillages Education Sector, Feds Warn

The FBI has issued a warning about an uptick in cyberattacks on the education sector that are delivering the PYSA ransomware. In a “Flash” alert to the cybersecurity community, the Feds said that PYSA has been seen in attacks on schools in 12 U.S. states and in the United Kingdom in March alone. The attacks have cast a wide net, hitting higher education, K-12 schools, and seminaries, the alert warned.

See the full report here: https://threatpost.com/pysa-ransomware-education-feds-warn/164832/

New botnet targets network security devices with critical exploits - BleepingComputer

Cybersecurity researchers on Monday disclosed a new wave of ongoing attacks exploiting multiple vulnerabilities to deploy Mirai variants on compromised systems. Upon successful exploitation, the attackers try to download a malicious shell script, which contains further infection behaviors such as downloading and executing Mirai variants and brute-forcers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-botnet-targets-network-security-devices-with-critical-exploits/

Mom & Daughter Duo Hack Homecoming Crown

A 17-year-old high school senior along with her mother were arrested this week, charged with accessing student records in a fraudulent attempt to rig her school’s Homecoming Queen election. The mother was arrested and booked into the county jail and released after posting a $6,000 bond, while her daughter was taken to the juvenile detention center.

See the full report here: https://threatpost.com/mom-daughter-duo-hack-homecoming-crown/164829/

Hackers leak payment data from defunct WeLeakInfo breach site - BleepingComputer

The now-defunct WeLeakInfo data breach site has suffered a data breach after a threat actor leaked the service's payment information and customer info. WeLeakInfo was a website that offered paid subscriptions for searchable access to a database containing 12.5 billion user records stolen during data breaches. This data included email addresses, names, phone numbers, addresses, and in many cases, passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-payment-data-from-defunct-weleakinfo-breach-site/

Magecart Attackers Save Stolen Credit-Card Data in .JPG File

Magecart attackers have found a new way to hide their nefarious online activity by saving data they’ve skimmed from credit cards online in a .JPG file on a website they’ve injected with malicious code. Researchers at website security firm Sucuri discovered the elusive tactic recently during an investigation into a compromised website using the open-source e-commerce platform Magento 2, Luke Leal from Sucuri’s malware research team said in a report posted online last week.

See the full report here: https://threatpost.com/magecart-attackers-stolen-data-jpg/164815/

Hackers spoofed Huawei website to steal 5G information

Cybercriminals are using a phishing website disguised as the Huawei company career page to target people working in the telecommunications industry, according to new research by security software provider McAfee. Dubbed Operation Diànxùn by the company’s Advanced Threat Research (ATR) Strategic Intelligence team, the campaign is aimed at spying on telecommunication companies based in Southeast Asia, Europe, and the US, with an emphasis on German, Vietnamese and Indian businesses.

See the full report here: https://www.itpro.co.uk/security/phishing/358908/hackers-impersonated-huawei-to-lure-in-victims-warns-mcafee

Twitter images can be abused to hide ZIP, MP3 files — here's how - BleepingComputer

A researcher disclosed a method of hiding up to three MB of data inside a Twitter image. In his demonstration, he showed both MP3 audio files and ZIP archives contained within the PNG images hosted on Twitter. Although the attached PNG files hosted on Twitter represent valid images when previewed, merely downloading and changing their file extension was enough to obtain different content from the same file. This technique can be leveraged by stealthy threat actors to hide malicious commands, payload, and other content in ordinary-looking files, such as images.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-images-can-be-abused-to-hide-zip-mp3-files-heres-how/

Chile's bank regulator shares IOCs after Microsoft Exchange hack - BleepingComputer

Chile's Comisión para el Mercado Financiero (CMF) has disclosed that their Microsoft Exchange server was compromised through the recently disclosed ProxyLogon vulnerabilities. They suffered a cyberattack after threat actors exploited the ProxyLogon vulnerabilities in their Microsoft Exchange servers to install web shells and attempt to steal credentials. The CMF has released IOCs of web shells and a batch file found on their compromised server.

See the full report here: https://www.bleepingcomputer.com/news/security/chiles-bank-regulator-shares-iocs-after-microsoft-exchange-hack/

$4,000 COVID-19 ‘Relief Checks’ Cloak Dridex Malware

According to researchers at Cofense, a campaign began circulating in March that capitalized on Americans’ interest in the forthcoming $1,400 relief payments and other aid. The emails impersonate the IRS, using the agency’s official logo and a spoofed sender domain of IRS[.]gov and claim to offer an application for financial assistance. In reality, the emails offer the Dridex banking trojan, which then collects banking information from the victim's system.

See the full report here: https://threatpost.com/covid-19-relief-checks-dridex-malware/164853/

Cisco Plugs Security Hole in Small Business Routers

Cisco's RV132W ADSL2+ Wireless-N VPN routers and RV134W VDSL2 Wireless-AC VPN routers are vulnerable to a high-severity vulnerability. The vulnerability, tracked as CVE-2021-1287, stems from the routers' web-based management interface improperly validating user-supplied input. An authenticated attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. Cisco has fixed the issue and urges users to update to the latest version.

See the full report here: https://threatpost.com/cisco-security-hole-small-business-routers/164859/

CISA Issues Advisory on TrickBot Campaigns

US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) and the FBI has issued an advisory warning security teams to guard against the advanced TrickBot Trojan malware. According to the agencies, schemes that employ TrickBot malware are cropping up again in North America, where a sophisticated group of cybercrime actors is luring victims, via phishing emails, with a traffic infringement phishing scheme to download the TrickBot malware. Agency officials recommend security teams block suspicious IP addresses and train employees on awareness and phishing tactics to guard against Trickbot.

See the full report here: https://www.darkreading.com/attacks-breaches/cisa-issues-advisory-on-trickbot-campaigns/d/d-id/1340440