Threat Intelligence Bulletin: 03/26/2021 - 04/01/2021

Breaking News: 2021-03-26 - 2021-04-01

Microsoft releases Windows 10 SSU to fix security update issue - BleepingComputer

​Microsoft has released the Windows 10 1909 KB5000850 cumulative update preview and a new KB5001205 Servicing Stack Update that resolves a Secure Boot vulnerability. This SSU fixes an issue installing a previously released Secure Boot security update. With the release of the KB5001205 SSU, Microsoft is fixing an issue that causes the CVE-2020-0689 Secure Boot security update not to be installed. CVE-2020-0689 is a vulnerability that could allow attackers to bypass Secure Boot and install untrusted software. This update also addresses an issue that might prevent the CVE-2020-0689 update from installing. The KB5001205 Servicing Stack Update (SSU) will automatically be installed by Windows Update to improve the update experience.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-ssu-to-fix-security-update-issue/

Apple fixes iOS zero-day vulnerability exploited in the wild - BleepingComputer

Apple has released security updates to address an iOS zero-day bug actively exploited in the wild and affecting iPhone, iPad, iPod, and Apple Watch devices. The vulnerability tracked as CVE-2021-1879 and was discovered in the Webkit browser engine, which allows attackers to launch universal cross-site scripting attacks after tricking targets into opening maliciously crafted web content on their devices. The zero-days were addressed by Apple by improving the management of object lifetimes in iOS 14.4.2, iOS 12.5.2, and watchOS 7.3.3.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-fixes-ios-zero-day-vulnerability-exploited-in-the-wild/

German Parliament targeted again by Russian state hackers - BleepingComputer

Email accounts of multiple German Parliament members were targeted in a spearphishing attack. The attackers were able to gain access to the email accounts of seven members of the German federal parliament (Bundestag) and 31 members of German regional parliaments. It is not yet known if any data was stolen during the incident. German security authorities suspect that a Russian military intelligence hacking group dubbed Ghostwriter was behind the attack.⁦

See the full report here: https://www.bleepingcomputer.com/news/security/german-parliament-targeted-again-by-russian-state-hackers/

SolarWinds patches critical code execution bug in Orion Platform - BleepingComputer

SolarWinds has released security updates to address four vulnerabilities impacting the company's Orion IT monitoring platform, two of them allowing attackers to execute arbitrary code remotely. The highest severity security flaw is a JSON deserialization bug that remote attackers can exploit to execute arbitrary code through Orion Platform Action Manager's test alert actions. Administrators can deploy the security updates and the additional security improvements by installing the Orion Platform 2020.2.5 release.

See the full report here: https://www.bleepingcomputer.com/news/security/solarwinds-patches-critical-code-execution-bug-in-orion-platform/

New Android malware spies on you while posing as a System Update - BleepingComputer

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. The remote access trojan (RAT) can steal data, messages, images, and take control of Android phones. Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-malware-spies-on-you-while-posing-as-a-system-update/

Clop Ransomware gang now contacts victims’ customers to force victims into pay a ransom

Clop ransomware operators are switching to a new tactic to force victims into paying the ransom by emailing their customers and asking them to demand a ransom payment to protect their privacy. The new technique aims at making the double-extortion tactic more efficient, crooks sent emails directly to victims’ customers found in documents stolen during the ransomware attack.

See the full report here: https://securityaffairs.co/wordpress/116029/cyber-crime/clop-ransomware-extortion.html?utm_source=rss&utm_medium=rss&utm_campaign=clop-ransomware-extortion

Social media users advised to be on guard against hacking - The Himalayan Times

The Cyber Bureau of Nepal Police has cautioned social media users against the traps set by online scammers to hack their accounts to serve their interests such as blackmailing, cheating, and extortion. Social media users are advised not to respond to phishing emails, as the scammers are likely to extract the password of the account by sending a link. The bureau has suggested the social media users that should set up multi-factor authentication on their accounts to prevent the likelihood of hacking.

See the full report here: https://thehimalayantimes.com/nepal/social-media-users-advised-to-be-on-guard-against-hacking

Hackers demand ransom from Town of Didsbury in cyber attack - Cochrane Today

The Town of Didsbury was the victim of a cyber-attack on March 21, 2021, when fraudsters encrypted the town’s information systems with ransomware and made a ransom demand to decrypt the system. According to the town's chief executive officer, fire services, and water and waste management were not impacted. The town staff is working to determine if the information was removed from the town's system or inappropriately accessed.

See the full report here: https://www.cochranetoday.ca/beyond-local/hackers-demand-ransom-from-town-of-didsbury-in-cyber-attack-3582099

FatFace sends controversial data breach email after ransomware attack - BleepingComputer

British clothing brand FatFace has sent a controversial confidential data breach notification to customers after suffering a ransomware attack earlier this year. According to the notification, threat actors gained access to FatFace's network and systems and accessed customer data. This data includes customers' names, email addresses, mailing addresses, and partial credit card information (last four digits and expiration date). The data breach was caused by a Conti ransomware attack in January 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/fatface-sends-controversial-data-breach-email-after-ransomware-attack/

Lawsuit filed against SFU for data breach - The Peak

Following SFU’s data breach on February 3, 2021, BC law firm Slater Vecchio LLP filed a class-action lawsuit against the university on behalf of the 200,000 individuals affected by the incident. The lawsuit argues that SFU students should have a higher safety standard for the storage of their personal information.

See the full report here: https://the-peak.ca/2021/03/lawsuit-filed-against-sfu-for-data-breach/

Hades ransomware operators are hunting big game in the US

On Friday, Accenture's Cyber Investigation & Forensic Response (CIFR) and Cyber Threat Intelligence (ACTI) teams published analysis into the latest Hades campaign, operating since December 2020. According to cybersecurity researchers, at least three major companies have been successfully attacked with the ransomware strain, including a transport & logistics company, a consumer products retailer, and a global manufacturer.

See the full report here: https://www.zdnet.com/article/hades-ransomware-operators-are-hunting-big-game-in-the-us/

This Android malware hides as a System Update app to spy on you

A new sophisticated Android spyware app disguising itself as a software update has been discovered by researchers. According to Zimperium zLabs, the malware masquerades as a System Update application while quietly exfiltrating user and handset data. The sample app detected by the team was found on a third-party repository and not the official Google Play Store.

See the full report here: https://www.zdnet.com/article/this-android-malware-hides-as-a-system-update-app-to-spy-on-you/

US charges close to 500 individuals for COVID-19 fraud, criminal activity

The US Department of Justice (DoJ) has charged 474 individuals for participating in COVID-19 scams and fraudulent activity. The US agency says that these alleged criminals are responsible for trying to fraudulently obtain at least $569 million from consumers and the US government itself across 56 federal districts.

See the full report here: https://www.zdnet.com/article/us-charges-close-to-500-individuals-for-covid-19-fraud-criminal-activity/

PHP's Git server hacked to add backdoors to PHP source code - BleepingComputer

In an attempt to compromise the PHP codebase, two malicious commits were pushed to the official PHP Git repository yesterday. The incident is alarming, considering PHP remains the server-side programming language to power over 79% of the websites on the Internet. The threat actors had signed off on these commits as if these were made by known PHP developers and maintainers, Rasmus Lerdorf and Nikita Popov.

See the full report here: https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/

Forex trader data leak exposes millions of confidential records - TechRadar

The Forex trading site FBS has leaked the confidential records of its users after the company left an ElasticSearch server exposed online. The tech news outlet WizCase discovered that FBS had left an ElasticSearch server exposed online in October of last year. The news outlet quickly reached out to the company, and FBS secured the server on October 5, 2020. However, during the few short days, the server was left unsecured, nearly 20TB of data was leaked which contained more than 16bn records.

See the full report here: https://www.techradar.com/news/forex-trader-data-leak-exposes-millions-of-confidential-records

Hackers disrupted live broadcasts at Channel Nine. Is it a Russian retaliation?

A cyber attack has hit the Australian Channel Nine’s live broadcasts disrupting its operations. The broadcaster was unable to air its Sunday morning news program, which runs from 7:00 am to 1:00 pm from Sidney. The 5:00 pm news program, which is transmitted from Melbourne, did not go to air too. The company confirmed that the unprecedented cyber attack impacted the Nine IT network, while its email systems did not appear to be affected.

See the full report here: https://securityaffairs.co/wordpress/116053/breaking-news/channel-nine-cyber-attack.html?utm_source=rss&utm_medium=rss&utm_campaign=channel-nine-cyber-attack

CompuCom MSP expects over $20M in losses after ransomware attack - BleepingComputer

American managed service provider CompuCom is expecting losses of over $20 million following this month's DarkSide ransomware attack that took down most of its systems. CompuCom is an IT managed services provider (MSP) and a wholly-owned subsidiary of The ODP Corporation (Office Depot/Office Max).

See the full report here: https://www.bleepingcomputer.com/news/security/compucom-msp-expects-over-20m-in-losses-after-ransomware-attack/

Ransomware admin is refunding victims their ransom payments - BleepingComputer

After recently announcing the end of the operation, the administrator of Ziggy ransomware is now stating that they will also give the money back. The admin also made available a decryption tool to make the process easier, along with the source code for a decryptor that does not need an internet connection to work.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-admin-is-refunding-victims-their-ransom-payments/

Critical netmask networking bug impacts thousands of applications - BleepingComputer

Popular npm library netmask has a critical networking vulnerability. netmask is frequently used by hundreds of thousands of applications to parse IPv4 addresses and CIDR blocks or compare them. The vulnerability tracked as CVE-2021-28918 concerns how netmask handles mixed-format IP addresses, or more specifically when a decimal IPv4 address contains a leading zero. Following the researchers' responsible reporting of the vulnerability, the netmask developer pushed out a series of fixes for the bug to GitHub, along with test cases validating that IPv4 octets with 0-prefixes are treated as octal and not decimal numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/

Flaws in Ovarro TBox RTUs Could Open Industrial Systems to Remote Attacks

As many as five vulnerabilities have been uncovered in Ovarro's TBox remote terminal units (RTUs) that, if left unpatched, could open the door for escalating attacks against critical infrastructures, like remote code execution and denial-of-service. TBox is an all-in-one solution for automation and control systems for supervisory control and data acquisition (SCADA) applications, with its telemetry software used for remote control and monitoring of assets in several critical infrastructure sectors, such as water, power, oil and gas, transportation, and process industries.

See the full report here: https://thehackernews.com/2021/03/flaws-in-ovarro-tbox-rtus-could-open.html

After oil giant Shell hit by Clop ransomware, workers' visas dumped online as part of extortion attempt

Royal Dutch Shell is the latest corporation to be infected by the Clop ransomware. The criminals behind the malware have siphoned internal documents from the oil giant and publicly leaked some of the data, notably a selection of workers' passports and visa scans to chivy the corporation along to pay the ransom.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/29/shell_clop_ransomware_leaks/

Microsoft working to fix Windows 10 21H1 update install issue - BleepingComputer

Microsoft is working to fix an issue causing a recently released Windows 10 21H1 build to fail to install for customers enrolled in the Windows Insider program. The cumulative update released on March 25 includes all the fixes bundled with 21H1 Build 19043.899 and a fix for a bug triggering printing issues. On systems affected by that issue, customers would experience problems printing the graphical content in a document after installing the March 9 cumulative updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-windows-10-21h1-update-install-issue/

Pair of Apex Legends Players Banned for DDoS Server Attacks

Two high-ranked Apex Legends players have been banned from the platform for cheating by launching distributed denial-of-service (DDoS) attacks on an Xbox server. The players who had achieved the rank of Apex Predators in the console version of the game haven’t been named, but the whole thing went down publicly on Reddit’s r/apexlegends forum over the weekend.

See the full report here: https://threatpost.com/apex-legends-players-banned-ddos-server-attacks/165085/

Docker Hub images downloaded 20M times come with cryptominers - BleepingComputer

Researchers found that more than two-dozen containers on Docker Hub have been downloaded more than 20 million times for cryptojacking operations spanning at least two years. Docker Hub is the largest library of container applications, allowing companies to share images internally or with their customers, or the developer community to distribute open-source projects.

See the full report here: https://www.bleepingcomputer.com/news/security/docker-hub-images-downloaded-20m-times-come-with-cryptominers/

Harris Federation hit by ransomware attack affecting 50 schools - BleepingComputer

The IT systems and email servers of London-based nonprofit multi-academy trust Harris Federation were taken down by a ransomware attack on Saturday. Harris Federation is an education charity running 50 Harris primary and secondary academies with 37,000 students from London and surrounding areas.

See the full report here: https://www.bleepingcomputer.com/news/security/harris-federation-hit-by-ransomware-attack-affecting-50-schools/

Hades Ransomware Gang Exhibits Connections to Hafnium

In one Hades ransomware attack, the Awake team identified a Hafnium domain as an indicator of compromise within the timeline of the Hades attack. Hafnium is an APT believed to be liked by the Chinese government, which Microsoft identified as carrying out zero-day attacks on Microsoft Exchange servers using the group of vulnerabilities now known as ProxyLogon.

See the full report here: https://threatpost.com/hades-ransomware-connections-hafnium/165069/

8.2 TB Of MobiKwik User Data Allegedly Hacked, Company Denies Breach - India Times

A massive database breach has allegedly occurred in MobiKwik servers where the KYC data of hundreds of thousands of its users has surfaced on the dark web as much as 8.2 terabytes of data. The data that is on offer includes a total of 350 gigabytes of MySQL dumps that include 500 databases. It also consists of 99 million mail, phone passwords, addresses, and data surrounding installed apps, IP addresses, GPS locations, etc. MobiKwik in a statement rejects that such a data breach has occurred.

See the full report here: https://www.indiatimes.com/technology/news/mobikwik-data-breach-hack-credit-card-pan-card-database-dark-web-537273.html

China-linked RedEcho APT took down part of its C2 domains

China-linked APT group RedEcho has taken down its attack infrastructure after security experts have exposed it. At the end of February, security experts have uncovered a suspected Chinese APT actor targeting critical infrastructure operators in India. The list of targets includes power plants, electricity distribution centers, and seaports in the country.

See the full report here: https://securityaffairs.co/wordpress/116094/apt/redecho-apt-c2-shutdown.html?utm_source=rss&utm_medium=rss&utm_campaign=redecho-apt-c2-shutdown

New Bugs Could Let Hackers Bypass Spectre Attack Mitigations On Linux Systems

Security researchers have disclosed two new vulnerabilities in Linux-based operating systems that, if successfully exploited, could let attackers circumvent mitigations for speculative attacks such as Spectre and obtain sensitive information from kernel memory. The flaws tracked as CVE-2020-27170 and CVE-2020-27171 impact all Linux kernels before 5.11.8. Patches for the security issues were released on March 20, with Ubuntu, Debian, and Red Hat deploying fixes for the vulnerabilities in their respective Linux distributions.

See the full report here: https://thehackernews.com/2021/03/new-bugs-could-let-hackers-bypass.html

Ziggy Ransomware Gang Offers Refunds to Victims - Threatpost

The Ziggy ransomware gang announced in early February they were getting out of the cybercrime business. Now they say they’re ready to refund their victims’ money. Anyone who paid a ransom to Ziggy just needs to shoot them an email with proof of payment calculated in Bitcoin and the computer ID. After that, the money will be returned to the Bitcoin wallet in about two weeks.

See the full report here: https://threatpost.com/ziggy-ransomware-gang-offers-refund-to-victims/165124/

Iranian hackers targeting US, Israeli medical researchers: analysis | TheHill - The Hill

Cybersecurity group Proofpoint discovered that the Iranian hacking group, known as “Phosphorous” or “Charming Kitten,” had begun targeting around 25 medical professionals in the fields of genetic, neurology, and oncology research in both the U.S. and Israel in December. The Iranian hackers went after their targets in an effort to obtain personal account credentials, using malicious phishing emails to lure the targets to a page masquerading as a Microsoft login page.

See the full report here: https://thehill.com/policy/cybersecurity/545654-iranian-hackers-targeting-us-israeli-medical-researchers-analysis

Tax scammers in China turn photos into vids to crack tax dept facial recognition system

Criminals tricked the State Taxation Administration platform’s identity verification system by manipulating high-def photos with a widely available app that turns photos into videos. The scammers then obtained a smartphone that allowed them to bypass its camera during facial authentication, instead feeding their doctored videos into the system. The facial recognition system fell for the trick and authenticated the people depicted in the videos. One logged in, the fraudsters issued fake invoices on behalf of a shell company, and presumably hoped they would be paid.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/03/31/tax_scammers_fool_ai_facial_recognition/

Park Hill School District says it was target of ransomware attack - KMBC Kansas City

The Park Hill School District has suffered a ransomware attack that forced the district to cancel classes two days last week. An unauthorized person has encrypted the district's files to force it to pay a ransom. The school district has backup systems and did not pay the ransom. District officials said there is no evidence of data being taken in the attack.

See the full report here: https://www.kmbc.com/article/park-hill-school-district-says-it-was-target-of-ransomware-attack/35985231

Ransomware group targets universities in Maryland, California in new data leaks

The Clop ransomware group has posted financial documents and passport information allegedly belonging to the University of Maryland and the University of California online. On March 29, the threat actors began publishing screenshots of data supposedly stolen from the US educational institutes. These screenshots, including records that allegedly belong to the University of Maryland, Baltimore, show a federal tax document, requests for tuition remission paperwork, an application for the Board of Nursing, passports, and tax summary documents.

See the full report here: https://www.zdnet.com/article/ransomware-group-targets-universities-of-maryland-california-in-new-data-leaks/

Microsoft Exchange attacks increase while WannaCry gets a restart - BleepingComputer

The recently patched vulnerabilities in Microsoft Exchange have sparked new interest among cybercriminals, who increased the volume of attacks focusing on this particular vector. While ransomware attacks have increased in frequency in the past six months, cybersecurity company Check Point last week noticed a surge in incidents targeting Microsoft Exchange servers vulnerable to the so-called ProxyLogon critical bugs.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-attacks-increase-while-wannacry-gets-a-restart/

Leading Indian fintech platform MobiKwik denies data breach - BleepingComputer

Indian digital financial services platform Mobikwik denies claims that almost 8 TB of data put up for sale was allegedly stolen from its servers. This privately held fintech platform provides financial services and a phone-based payment gateway to more than 120 million users. Mobikwik says that approximately 3 million merchants and over 300 billers are currently using its services.

See the full report here: https://www.bleepingcomputer.com/news/security/leading-indian-fintech-platform-mobikwik-denies-data-breach/

Scammers target universities in ongoing IRS phishing attacks - BleepingComputer

The Internal Revenue Service (IRS) is warning of ongoing phishing attacks impersonating the IRS and targeting educational institutions. The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-target-universities-in-ongoing-irs-phishing-attacks/

US govt warns that buying fake COVID-19 vaccine cards is a crime - BleepingComputer

US federal agencies have warned today against making or selling fake COVID-19 vaccination record cards as this is breaking the law. The FBI, the Department of Health and Human Services, and the Office of Inspector General (HHS-OIG) issued the warning today in the form of a public service announcement published on the Internet Crime Complaint Center.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-that-buying-fake-covid-19-vaccine-cards-is-a-crime/

VMware fixes bug allowing attackers to steal admin credentials - BleepingComputer

VMware has published security updates to address a high severity vulnerability in vRealize Operations that could allow attackers to steal admin credentials after exploiting vulnerable servers. vRealize Operations is an AI-powered and self-driving IT operations management for private, hybrid, and multi-cloud environments, available as an on-premises or SaaS solution.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-bug-allowing-attackers-to-steal-admin-credentials/

CISA gives federal agencies 5 days to find hacked Exchange servers

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to scan their networks again for any signs of compromised on-premises Microsoft Exchange servers and report their findings within five days. Microsoft disclosed ongoing attacks coordinated by several Chinese-backed hacking groups targeting the vulnerabilities. Slovak internet security firm ESET also shared info on at least ten more hacking groups actively abusing these bugs. CISA issued another directive ordering federal agencies to urgently update or disconnect their Exchange on-premises servers after Microsoft released security updates for zero-day bugs collectively dubbed ProxyLogon. CISA also asked agencies that find any evidence of compromise using Microsoft's new tools and report the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-gives-federal-agencies-5-days-to-find-hacked-exchange-servers/

BazarCall malware uses malicious call centers to infect victims - BleepingComputer

For the past two months, security researchers have been waging an online battle against a new 'BazarCall' malware that uses call centers to distribute some of the most damaging Windows malware. The new malware was discovered being distributed by call centers in late January and is named BazarCall. It starts with a phishing email and uses phone call centers to distribute malicious Excel documents that install malware. The campaign is used to distribute the BazarLoader malware, TrickBot, IcedID, and Gozi IFSB.

See the full report here: https://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims/

Ubiquiti cyberattack may be far worse than originally disclosed - BleepingComputer

The data breach report from Ubiquiti in January is allegedly a cover-up of a massive incident that put at risk customer data and devices deployed on corporate and home networks. According to an anonymous source, the attacker had root privilege over all Ubiquiti AWS accounts, counting all S3 data buckets, application logs, databases, user credentials, and the secrets to forging single sign-on cookies. This level of access allows authentication to cloud-based devices, such as the UniFi line of wired/wireless products dispersed across the world.

See the full report here: https://www.bleepingcomputer.com/news/security/ubiquiti-cyberattack-may-be-far-worse-than-originally-disclosed/

US CISA warns of DoS flaws in Citrix Hypervisor

US CISA warns that Citrix has released security updates to address flaws in Citrix Hypervisor (XenServer) that could be exploited by threat actors to execute code in a virtual machine to trigger a denial of service condition on the host. The two vulnerabilities, tracked as CVE-2021-28038 and CVE-2021-28688, could be abused to cause the host to crash or become unresponsive. An attacker would have to be able to execute privileged code in a guest virtual machine. CISA encourages users and administrators to review Citrix Security Update CTX306565 and apply the necessary updates.

See the full report here: https://securityaffairs.co/wordpress/116190/security/citrix-hypervisor-dos-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=citrix-hypervisor-dos-flaws

Google: North Korean hackers are targeting researchers through fake offensive security firm

A North Korean hacking group known to have targeted security researchers in the past has now upped its game through the creation of a fake offensive security firm. According to Google TAG specialists, the fake company, dubbed "SecuriElite," was set up on March 17 as securielite[.]com. SecuriElite claims to be based in Turkey and offers penetration testing services, software security assessments, and exploits. In addition, the SecuriElite 'team' has been furnished with a fresh set of fake social media profiles to lure the victims.

See the full report here: https://www.zdnet.com/article/google-north-korean-hackers-targeting-researchers-now-pretend-to-be-from-offensive-security-firm/

Microsoft kills off the Cortana app for Android and iOS

Microsoft confirmed its ended support for Cortana on mobile, and the apps will stop working after March 31, 2021. Microsoft's digital assistant Cortana was first unveiled with Windows Phones, and it was later introduced on Android and iOS. For Windows 10, Microsoft has promised that Cortana will still receive new features with regular updates via the Microsoft Store.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-kills-off-the-cortana-app-for-android-and-ios/