Threat Intelligence Bulletin: 03/19/2021 - 03/25/2021

Breach Disclosure: Carding Mafia

The carding forum, Carding Mafia, experienced a data breach around 03/17/2021. In a post by user 'HansoN' on Raidforums, they shared the breach, however, the user 'DuckSquad' claimed responsibility and shared a link to a paste site containing more details. According to the DuckSquad posting, there are around 500,000 users details included in the breach, while HansoN said around 290,000 lines.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In the posting on Raidforums by HansoN, they share the contents of the SQL database acquired from Carding Mafia, which includes the following fields:

INSERT INTO user (userid, usergroupid, membergroupids, displaygroupid, username, password, passworddate, email, styleid, parentemail, homepage, icq, aim, yahoo, msn, skype, showvbcode, showbirthday, usertitle, customtitle, joindate, daysprune, lastvisit, lastactivity, lastpost, lastpostid, posts, reputation, reputationlevelid, timezoneoffset, pmpopup, avatarid, avatarrevision, profilepicrevision, sigpicrevision, options, birthday, birthday_search, maxposts, startofweek, ipaddress, referrerid, languageid, emailstamp, threadedmode, autosubscribe, pmtotal, pmunread, salt, ipoints, infractions, warnings, infractiongroupids, infractiongroupid, adminoptions, profilevisits, friendcount, friendreqcount, vmunreadcount, vmmoderatedcount, socgroupinvitecount, socgroupreqcount, pcunreadcount, pcmoderatedcount, gmmoderatedcount, assetposthash, fbuserid, fbjoindate, fbname, logintype, fbaccesstoken, bloggroupreqcount, showblogcss, vbseo_likes_in, vbseo_likes_out, vbseo_likes_unread, dbtech_vbshout_banned, dbtech_vbshout_settings, dbtech_vbshout_shouts, dbtech_vbshout_shoutstyle, dbtech_vbshout_silenced, dbtech_vbshout_shoutarea, dbtech_vbshout_pm, dbtech_vbshout_soundsettings, dbtech_vbshout_shoutboxsize, dbtech_vbshout_shoutboxsize_detached, dbtech_vbshout_displayorder, dbtech_vbshout_shouts_lifetime, newrepcount, dbtech_registration_invites_sent_total, dbtech_registration_invites_sent, panjo_selling, showvsastats, rmEmailDate, rmEmailCount, rmoptout) VALUES

To note, there are a large number of sensitive fields, including social media profiles, IP addresses, usernames and passwords, and birthday.

Figure 1: Breach posting on Raidforums

Breach Disclosure: Astoria

Astoria Company LLC, a lead generation company experienced a data breach sometime before January 26th, 2021 when security researchers identified the breached data being posted for sale on a darkweb marketplace. This breach is attributed to ShinyHunters, who are prolific breach brokers responsible for a large number of breaches and subsequent sharing of data.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to the breach advertisement, this impacted 300 million user database allegedly from Astoria Company, which consisted of:

• Name
• Emails
• IP Addresses
• Birthdates
• Address
• Social Security Numbers

In some instances, the data also included driver information, VIN numbers, auto accidents, medical history, income, property value, insurance information, family information, education, and much more. This type of information was available due to the type of data that Astoria contains, which can be quite substantial, since they are for generating leads of people interested in certain areas.

Figure 1: Breach posting for sale

This data was originally listed for $250,000, which as we've seen before, has been posted for free some time after the original sale has expired or is no longer profitable.

This breach is extremely valuable to those who are able to obtain it, as it contains extremely sensitive data in some cases, and can be used by threat actors in a variety of malicious ways.

Breaking News: 2021-03-19 - 2021-03-25

Bogus Android Clubhouse App Drops Credential-Swiping Malware

Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers BlackRock malware and steals credentials from 458 services, including Twitter, WhatsApp, Facebook and Amazon. Despite being invite-only, and only available on Apple’s App Store, the app has over 13 million downloads. Cybercriminals are swooping in on Android users looking to download Clubhouse by creating their own fake Android version of the app. To add legitimacy to the scam, the fake app is delivered from a website purporting to be the real Clubhouse website.

See the full report here: https://threatpost.com/android-clubhouse-app-malware/164915/

Critical F5 BIG-IP Flaw Now Under Active Attack

Researchers are reporting mass scanning and wild exploitation of a critical-severity flaw in the F5 BIG-IP and BIG-IQ enterprise networking infrastructure. The vulnerability, CVE-2021-22986, exists in the F5 BIG-IP and BIG-IQ enterprise networking infrastructure and could allow attackers to take full control over a vulnerable system. Earlier in March, F5 issued a patch for the flaw, which has a CVSS rating of 9.8 and exists in the iControl REST interface. After the patch was issued, several researchers posted proof-of-concept (PoC) exploit code after reverse-engineering the Java software patch in BIG-IP.

See the full report here: https://threatpost.com/critical-f5-big-ip-flaw-now-under-active-attack/164940/

FBI warns of BEC attacks increasingly targeting US govt orgs - BleepingComputer

The Federal Bureau of Investigation (FBI) is warning US private sector companies about an increase in business email compromise (BEC) attacks targeting state, local, tribal, and territorial (SLTT) government entities. According to the FBI, from 2018 through 2020, the FBI observed increases in business email compromise (BEC) actors targeting state, local, tribal, and territorial (SLTT) government entities for financial gain due to vulnerability exploitation and transparency requirements. BEC actors continue to target SLTT government entities with spoofed emails, phishing attacks, vendor email compromise, and credential harvesting techniques to manipulate payment or direct deposit information. Organizations are advised to remain watchful of BEC attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-bec-attacks-increasingly-targeting-us-govt-orgs/

Computer giant Acer hit by $50 million ransomware attack - BleepingComputer

Computer giant Acer has reportedly suffered a ransomware attack. The REvil ransomware gang claims to be responsible for the attack and announced on their data leak site that they had breached Acer and shared some images of allegedly stolen files as proof. These leaked images contained documents that include financial spreadsheets, bank balances, and bank communications. The threat actors are allegedly demanding the largest known ransom to date, $50,000,000. Acer is yet to provide a clear answer regarding whether they suffered a REvil ransomware attack.

See the full report here: https://www.bleepingcomputer.com/news/security/computer-giant-acer-hit-by-50-million-ransomware-attack/

NHS exec's Twitter accounts hacked to promote PS5 scam - Eurogamer.net

NHS chief transformation officer Helen Bevan, her two Twitter accounts with a combined 133,000 followers were hacked to promote a PlayStation 5 sales scam. According to the BBC, Bevan paid £110 to someone who said they could restore the accounts within 25 minutes, but they turned out to be a scammer as well. Twitter restored the Twitter accounts after a couple of days.

See the full report here: https://www.eurogamer.net/articles/2021-03-20-nhs-execs-twitter-accounts-hacked-to-promote-ps5-scam

Swiss hacker charged for leaking proprietary source code - BleepingComputer

Swiss national Till Kottmann has been charged for conspiracy, wire fraud, and aggravated identity theft, the U.S. Department of Justice announced. Kottmann has been at the forefront of numerous leaks involving source code, some of it proprietary or confidential, from dozens of large companies. Most recently, Kottmann and the group of hackers they were part of (the ironically named “APT-69420 Arson Cats“) gained access to surveillance systems at Tesla, Equinox, healthcare clinics, jails, and banks.

See the full report here: https://www.bleepingcomputer.com/news/security/swiss-hacker-charged-for-leaking-proprietary-source-code/

New Malware Hidden in Apple IDE Targets macOS Developers

Researchers from SentinelOne have discovered new malware dubbed "XcodeSpy" that is targeting developers of macOS apps. The malware is disguised as a legitimate Xcode open source project called TabBarInteraction that provides macOS developers with code for animating the iOS Tab Bar based on user interaction. XcodeSpy installs a variant of the EggShell backdoor on an Apple developer's macOS system. The backdoor is designed to spy on the developer and has features for recording the victim's camera, microphone, and keyboard activity. It also can download and upload files and remain persistent on an infected system.

See the full report here: https://www.darkreading.com/application-security/new-malware-hidden-in-apple-ide-targets-macos-developers/d/d-id/1340471

Microsoft halts rollout of Windows 10 KB5001649 emergency update - BleepingComputer

Microsoft has paused the Windows 10 KB5001649 cumulative update rollout, likely due to installation issues and reported crashes. Microsoft is now offering the previously released KB5001567 emergency update instead. After the release of the March 2021 Windows 10 KB5000802 and KB5000808 cumulative updates, users began experiencing APC_INDEX_MISMATCH for win32kfull.sys BSOD crashes when printing.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-halts-rollout-of-windows-10-kb5001649-emergency-update/

Microsoft Edge tests fix for DNS-over-HTTPS performance issues - BleepingComputer

Microsoft is testing a fix for performance issues in Microsoft Edge’s DNS-over-HTTPS feature and has once again enabled a list of suggested DoH servers. DNS-over-HTTPS (DoH) allows DNS resolution to be performed over an encrypted HTTPS connection rather than through normal plain text DNS lookups. Microsoft Edge added support for DNS-over-HTTPS (DoH) in version 86, but the prepopulated DoH providers list/configuration pane was removed after users began reporting performance issues.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-tests-fix-for-dns-over-https-performance-issues/

Microsoft Defender adds automatic Exchange ProxyLogon mitigation - BleepingComputer

Microsoft Defender Antivirus will now protect unpatched on-premises Exchange servers from ongoing attacks by automatically mitigating the actively exploited CVE-2021-26855 vulnerability. Customers running System Center Endpoint Protection on their servers will also be protected through the same automated mitigation process. This interim mitigation is designed to help protect customers while they take the time to implement the latest Exchange Cumulative Update for their version of Exchange.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-adds-automatic-exchange-proxylogon-mitigation/

Critical F5 BIG-IP vulnerability now targeted in ongoing attacks - BleepingComputer

Almost ten days after application security company F5 Networks released patches for critical vulnerabilities in its BIG-IP and BIG-IQ products, adversaries have begun opportunistically mass scanning and targeting exposed and unpatched networking devices to break into enterprise networks. News of in the wild exploitation development comes on the heels of a proof-of-concept exploit code that surfaced online earlier this week by reverse-engineering the Java software patch in BIG-IP.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-f5-big-ip-vulnerability-now-targeted-in-ongoing-attacks/

Hacking group used 11 zero-days to attack Windows, iOS, Android users - BleepingComputer

Project Zero, Google's zero-day bug-hunting team, discovered a group of hackers that used 11 zero-days in attacks targeting Windows, iOS, and Android users within a single year. The Project Zero team revealed that the hacking group behind these attacks ran two separate campaigns, in February and October 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-used-11-zero-days-to-attack-windows-ios-android-users/

Critical RCE Vulnerability Found in Apache OFBiz ERP Software—Patch Now

The Apache Software Foundation has addressed a high severity vulnerability in Apache OFBiz that could have allowed an unauthenticated adversary to remotely seize control of the open-source enterprise resource planning (ERP) system. Tracked as CVE-2021-26295, the flaw affects all versions of the software before 17.12.06. It is recommended to upgrade Apache OFBiz to the latest version (17.12.06) to mitigate the risk associated with the flaw.

See the full report here: https://thehackernews.com/2021/03/critical-rce-vulnerability-found-in.html

Finland IDs hackers linked to parliament spying attack - KRQE News 13

Finland’s domestic security agency said Thursday that the cybergroup APT31, which is generally linked to the Chinese government, was likely behind a cyberspying attack on the information systems of the Nordic country’s parliament. The agency identified a cyber espionage operation targeted in 2020 against parliament to intrude into parliament’s IT systems.

See the full report here: https://www.krqe.com/news/business/finland-ids-hackers-linked-to-parliament-spying-attack/

DDoS booters now abuse DTLS servers to amplify attacks - BleepingComputer

According to reports that surfaced in December, a DDOS attack used DTLS to amplify traffic from vulnerable Citrix ADC devices that used DTLS configurations without a 'HelloClientVerify' anti-spoofing mechanism designed to block such abuse. DDoS attacks using DTLS can reach an amplification factor of 35 according to German DDoS protection vendor Link11 or an amplification ratio of 37.34:1 based on info from DDoS mitigation firm Netscout.

See the full report here: https://www.bleepingcomputer.com/news/security/ddos-booters-now-abuse-dtls-servers-to-amplify-attacks/

Windows 10 KB5001649 update is rolling out again to fix printing - BleepingComputer

The printer fixing roller coaster continues as Microsoft is once again rolling out the KB5001649 out-of-band update to users via Windows Update. After installing the March 2021 Patch Tuesday updates, users began reporting that Windows 10 would crash when printing or print jobs would be missing graphics elements, have blank pages, or other issues.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5001649-update-is-rolling-out-again-to-fix-printing/

Popular remote lesson monitoring program could be exploited to attack student PCs

McAfee disclosed the existence of multiple security holes in Netop Vision Pro, popular monitoring software adopted by schools for teachers to control remote learning sessions. The four critical vulnerabilities in the software were tracked as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195: an incorrect privilege assignment problem, a default permissions error, the cleartext transmission of sensitive information, and authorization issues. Overall, the security flaws allowed for privilege escalation and Remote Code Execution (RCE) attacks within a compromised network.

See the full report here: https://www.zdnet.com/article/popular-remote-student-learning-program-found-to-be-riddled-with-security-holes/

CISA releases CHIRP, a tool to detect SolarWinds malicious activity

US CISA released the CISA Hunt and Incident Response Program (CHIRP) tool, which is a Python-based tool that allows detecting malicious activity associated with the SolarWinds hackers in compromised on-premises enterprise Windows environments. CHIRP scans for signs of APT compromise within an on-premises environment, by default it searches for IOCs associated with malicious activity detailed in AA20-352A and AA21-008A alerts.

See the full report here: https://securityaffairs.co/wordpress/?p=115821

Mozilla Firefox tweaks Referrer Policy to shore up user privacy

Mozilla has announced that it will introduce a more privacy-focused default Referrer-Policy to protect Firefox users' privacy, starting with the web browser's next version. The new user privacy protection feature against accidental leaking of sensitive user data will be introduced in Firefox 87. Once updated, the web browser will automatically trim user-sensitive information like path and query string information accessible from the Referrer URL.

See the full report here: https://www.zdnet.com/article/mozilla-firefox-tweaks-referrer-policy-to-shore-up-user-privacy/

API security becomes a ‘top’ priority for enterprise players

As attacks against APIs continue to increase, the enterprise is beginning to take the security aspects of API adoption more seriously. In a new report released on Monday by Imvision, "API Security is Coming," the company asked over 100 cybersecurity professionals in the US and Europe for insight on the current state of enterprise API security.

See the full report here: https://www.zdnet.com/article/api-security-becomes-a-top-priority-for-enterprise-players/

Microsoft Exchange servers now targeted by Black Kingdom ransomware - BleepingComputer

Another ransomware operation, known by the name 'Black Kingdom' is exploiting the Microsoft Exchange Server ProxyLogon vulnerabilities to encrypt servers. A security researcher from MalwareTechBlog tweeted that a threat actor was compromising Microsoft Exchange servers via the ProxyLogon vulnerabilities to deploy ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-now-targeted-by-black-kingdom-ransomware/

MangaDex manga site temporarily shut down after cyberattack - BleepingComputer

Manga scanlation giant MangaDex has been temporarily shut down after suffering a cyberattack and having its source code stolen. MangaDex is one of the largest manga scanlation (scanned translations) sites where visitors can read manga comics online for free. According to SimilarWeb, MangaDex is the 179th most frequently visited site on the web, with over 76 million visitors per month. According to an announcement now showing on Mangadex.org, a threat actor gained access to the site after stealing an admin user's session token through a website vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/mangadex-manga-site-temporarily-shut-down-after-cyberattack/

Adobe Fixes Critical ColdFusion Flaw in Emergency Update

Adobe has released out-of-band security updates to address a critical vulnerability impacting ColdFusion versions 2021, 2016, and 2018. The latest flaw, tracked as CVE-2021-21087, exists in ColdFusion versions 2016 (Update 16 and earlier), 2018 (Update 10 and earlier), and 2021 (Version 2021.0.0.323925) and could lead to arbitrary code execution. Adobe released ColdFusion 2016 Update 17, ColdFusion 2018 Update 11, and ColdFusion 2021 Update 1 to patch the vulnerability and said that all previous versions before these patches are vulnerable to attacks.

See the full report here: https://threatpost.com/adobe-critical-coldfusion-flaw-update/164946/

CISA Warns of Security Flaws in GE Power Management Devices

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of critical-severity security flaws in GE’s Universal Relay (UR) family of power management devices. The UR devices allow the underlying devices to switch into various power modes. GE has issued patches for the following affected UR device families: B30, B90, C30, C60, C70, C95, D30, D60, F35, F60, G30, G60, L30, L60, L90, M60, N60, T35, and T60.

See the full report here: https://threatpost.com/cisa-security-flaws-ge-power-management/164961/

Microsoft shares workaround for 0xc004c003 Windows 10 activation errors - BleepingComputer

Microsoft has shared a workaround for customers experiencing 0xc004c003 activation failures on Windows 10, version 2004, and 20H2 devices after installing January 2021 monthly "C" release KB4598291 preview update. This known issue does not impact customers who installed the KB4598298 nonsecurity preview release.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-workaround-for-0xc004c003-windows-10-activation-errors/

WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack

Google has disclosed that a now-patched vulnerability affecting Android devices that use Qualcomm chipsets is being weaponized by attackers to launch targeted attacks. Tracked as CVE-2020-11261, the flaw concerns an improper input validation issue in Qualcomm's Graphics component that could be exploited to trigger memory corruption when an attacker-engineered app requests access to a huge chunk of the device's memory. The bug was discovered by Google's Android Security team on July 20, 2020, and reported to Qualcomm, after which it was fixed in January 2021.

See the full report here: https://thehackernews.com/2021/03/warning-new-android-zero-day.html

Researchers Discover Two Dozen Malicious Chrome Extensions

Researchers at Cato Networks have discovered two dozen malicious Google Chrome browser extensions and 40 associated malicious domains that are being used to introduce adware on victim systems, steal credentials, or quietly redirect victims to malware distribution sites. Adversaries have also been known to purchase rights to a legitimate Chrome extension and then modify it later with malicious code or to use a malicious extension to download additional malicious extensions.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/researchers-discover-two-dozen-malicious-chrome-extensions/d/d-id/1340482

Energy giant Shell discloses data breach after Accellion hack - BleepingComputer

Energy giant Shell has disclosed a data breach after attackers compromised the company's secure file-sharing system powered by Accellion's File Transfer Appliance (FTA). Shell stated that the incident only affected the Accellion FTA appliance. There is no evidence of any impact on Shell's core IT systems as the file transfer service is isolated from the rest of Shell's digital infrastructure. According to the company, some of the data accessed during the attack belongs to stakeholders and Shell subsidiaries. Some contained personal data and others included data from Shell companies and some of their stakeholders.

See the full report here: https://www.bleepingcomputer.com/news/security/energy-giant-shell-discloses-data-breach-after-accellion-hack/

Ministry of Defence academy hit by state-sponsored hackers

The Ministry of Defence academy was hit by a major cyberattack, according to the British tabloid newspaper The Sun, Russia and China state-sponsored hackers are suspected to be behind the offensive. The cyberattack took offline the website of the academy and knocked out the IT network, which is run by a contractor. Systems at the academy were compromised and it will take time to completely restore the impacted computers and servers.

See the full report here: https://securityaffairs.co/wordpress/115870/hacking/ministry-of-defence-hacked.html?utm_source=rss&utm_medium=rss&utm_campaign=ministry-of-defence-hacked

UK colleges and unis urged to prepare for ransomware before it's too late

Britain's National Cyber Security Centre (NCSC) has urged universities, schools, and colleges to be watchful following an increase in ransomware attacks targeting educational institutions. The warning comes in the wake of higher-profile attacks in recent weeks such as the one against Birmingham's South and City College, which resulted in all 13,000 students being told to stay at home and switch to online lectures last week. The University of the Highlands and Islands was also struck earlier this month, leading the institution to shut down its campuses while beleaguered IT staff fought off the ransomware. NCSC urges organizations to take regular backups of their network, prepare incident response protocols, and ensure that if malware does get a foothold on a school's network, it can be controlled quickly.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/23/ransomware_targeting_education_ncsc_warning/

Phish Leads to Breach at Calif. State Controller

A phishing attack was reported last week which allowed attackers to gain access to email and files at the California State Controller’s Office (SCO), an agency responsible for handling more than $100 billion in public funds each year. The phishers had access for more than 24 hours, and stole Social Security numbers and sensitive files on thousands of state workers, and send targeted phishing messages to at least 9,000 other workers and their contacts. The California State Controller’s Office issued a statement on March 20, confirming the intrusion.

See the full report here: https://krebsonsecurity.com/?p=54930

High-availability server maker Stratus hit by ransomware - BleepingComputer

Stratus Technologies has suffered a ransomware attack that required systems to be taken offline to prevent the attack's spread. As part of their response, Stratus also took their ActiveService Network (ASN) and Stratus Service Portal off-line. Stratus stated that they contacted all of their ASN customers to provide further support.

See the full report here: https://www.bleepingcomputer.com/news/security/high-availability-server-maker-stratus-hit-by-ransomware/

Microsoft: 92% of Exchange servers safe from ProxyLogon attacks - BleepingComputer

According to Microsoft, roughly 92% of all Internet-connected on-premises Microsoft Exchange servers affected by the ProxyLogon vulnerabilities are now patched and safe from attacks. A total of 400,000 Internet-connected Exchange servers were impacted by the ProxyLogon vulnerabilities when Microsoft issued the initial security patches, on March 2. Apart from an additional set of security updates and guidance, Microsoft also released a one-click Exchange On-premises Mitigation Tool (EOMT) tool to enable small business owners to quickly mitigate the recently disclosed ProxyLogon vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-92-percent-of-exchange-servers-safe-from-proxylogon-attacks/

Hobby Lobby Exposes Customer Data in Cloud Misconfiguration

Arts-and-crafts retailer Hobby Lobby has suffered a cloud-bucket misconfiguration, exposing a raft of customer information, according to a report. An independent security researcher uncovered the issue and reported it to Motherboard in an online chat, according to a Vice writeup. The researcher said that customer names, partial payment-card details, phone numbers, and physical and email addresses were all caught up in the leak, along with source code for the company’s app and employee names and email addresses.

See the full report here: https://threatpost.com/hobby-lobby-customer-data-cloud-misconfiguration/164980/

Ransomware gang leaks data stolen from Colorado, Miami universities - BleepingComputer

Grades and social security numbers for students at the University of Colorado and University of Miami patient data have been posted online by the Clop ransomware group. Starting in December, threat actors affiliated with the Clop ransomware operation began targeting Accellion FTA servers and stealing the data stored on them. Companies use these servers to share sensitive files and information with people outside of their organization.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-leaks-data-stolen-from-colorado-miami-universities/

CNA insurance firm hit by a cyberattack, operations impacted - BleepingComputer

CNA Financial, a leading US-based insurance company, has suffered a cyberattack impacting its business operations and shutting down its website. CNA is considered the sixth-largest commercial insurance company in the USA, according to the Insurance Information Institute, and offers a wide range of insurance products, including cyber insurance policies.

See the full report here: https://www.bleepingcomputer.com/news/security/cna-insurance-firm-hit-by-a-cyberattack-operations-impacted/

Purple Fox malware worms its way into exposed Windows systems - BleepingComputer

Purple Fox, a malware previously distributed via exploit kits and phishing emails, has now added a worm module that allows it to scan for and infect Windows systems reachable over the Internet in ongoing attacks. The malware comes with rootkit and backdoor capabilities, was first spotted in 2018 after infecting at least 30,000 devices, and is used as a downloader to deploy other malware strains.

See the full report here: https://www.bleepingcomputer.com/news/security/purple-fox-malware-worms-its-way-into-exposed-windows-systems/

Ransomware attack shuts down Sierra Wireless IoT maker - BleepingComputer

Sierra Wireless, a world-leading IoT (Internet of Things) solutions provider, today disclosed a ransomware attack that forced it to halt production at all manufacturing sites. The Canadian multinational headquartered in Richmond, British Columbia, has more than 1,300 employees worldwide, develops communication equipment, and has research and development centers in North America, Europe, and Asia.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-shuts-down-sierra-wireless-iot-maker/

Microsoft fixes Windows PSExec privilege elevation vulnerability - BleepingComputer

PsExec, a Sysinternals utility designed to allow administrators to perform various activities on remote computers, contained a vulnerability in the PsExec's named pipe communications that could allow local users to elevate to SYSTEM privileges on Windows devices. This local privilege escalation allows a non-admin process to escalate to SYSTEM if PsExec is executed locally or remotely on the target machine. Microsoft has released PsExec v2.33, which includes a new fix for the named pipe local privilege elevation vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-windows-psexec-privilege-elevation-vulnerability/

Google removes privacy-focused ClearURLs Chrome extension - BleepingComputer

ClearURLs, a privacy-preserving browser add-on that automatically removes tracking elements from URLs, has been blocked by Google from the Chrome Web Store. Users saw ClearURLs disappearing from the Chrome Web Store with its page throwing a 404 (not found) error message. However, Chrome users can download and manually install the ClearURLs extension from the project's GitHub releases page. Microsoft Edge users can also download the extension from the Edge Add-ons store.

See the full report here: https://www.bleepingcomputer.com/news/security/google-removes-privacy-focused-clearurls-chrome-extension/

Microsoft warns of phishing attacks bypassing email gateways - BleepingComputer

An ongoing phishing operation that stole an estimated 400,000 OWA and Office 365 credentials since December has now expanded to abuse new legitimate services to bypass secure email gateways (SEGs). The attacks are part of multiple phishing campaigns collectively dubbed the "Compact" Campaign, active since early 2020. They take advantage of configuration settings that ensure the delivery of emails even when the email solution detects phishing. The phishing operation is expanding and now abuses Amazon Simple Email Service (SES) and the Appspot cloud computing platform to deliver phishing emails and generate multiple phishing URLs for each target.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-phishing-attacks-bypassing-email-gateways/

Active Exploits Hit WordPress Sites Vulnerable to Thrive Themes Flaws

Attackers are actively exploiting two recently-patched vulnerabilities in a popular suite of tools for WordPress websites from the marketing platform Thrive Themes. Two vulnerabilities were discovered across both these Legacy Themes and plugins, and patches were subsequently released on March 12. The flaws could be chained together to allow unauthenticated attackers to ultimately upload arbitrary files on vulnerable WordPress sites, allowing for website compromise. Users are advised to update to the latest versions available.

See the full report here: https://threatpost.com/active-exploits-wordpress-sites-thrive-themes/165013/

Facebook blocks Chinese state hackers targeting Uyghur activists - BleepingComputer

Facebook took down accounts used by a Chinese-sponsored hacking group to deploy surveillance malware on devices used by Uyghurs activists, journalists, and dissidents living outside China. The hacking group tracked as Earth Empusa or Evil Eye used the now disabled Facebook accounts to send links that redirected their targets to malicious websites under their control in watering hole attacks. They targeted activists, journalists, and dissidents, predominantly among Uyghurs from Xinjiang in China primarily living abroad in Turkey, Kazakhstan, the United States, Syria, Australia, Canada, and other countries.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-blocks-chinese-state-hackers-targeting-uyghur-activists/

Cisco addresses critical bug in Windows, macOS Jabber clients - BleepingComputer

Cisco has addressed a critical arbitrary program execution vulnerability impacting several versions of Cisco Jabber client software for Windows, macOS, Android, and iOS. Cisco Jabber is a web conferencing and instant messaging app that allows users to send messages via the Extensible Messaging and Presence Protocol (XMPP). The security flaw tracked as CVE-2021-1411 is rated with a 9.9/10 severity score, and it is caused by improper input validation of incoming messages' contents. Vulnerable software includes Cisco Jabber for Windows, macOS, Android, or iOS, versions 12.9 or earlier.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-addresses-critical-bug-in-windows-macos-jabber-clients/