Threat Intelligence Bulletin: 04/02/2021 - 04/09/2021

Breach Disclosure: Facebook

On April 3, 2021, ZeroFOX observed the RaidForums actor "TomLiner" post a 15 GB database of 533,313,128 user records split into 106 country-specific download files scraped from Facebook (facebook.com). The large majority of records list phone numbers associated with Facebook accounts, while a smaller slice contains other personally identifiable information (PII) such as name, email address, gender, date of birth, occupation, city, country, biography, and relationship status. The database does not contain any passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A Facebook spokesperson noted that the data was originally compiled by exploiting a contact importer vulnerability patched in late August 2019 that made it "possible to input multiple phone numbers and, by running an algorithm, connect which number matched to a specific user." In 2020, the RaidForums actors "GreenHat77" and "Yusuf234567" each offered the same database for sale, the latter of whom completed multiple transactions with positive feedback into early 2021.

Some observers speculate that these users are aliases of the RaidForums actor "seller13" who is openly affiliated with the hacking group "ShinyHunters". Another actor under the alias "omgdata" a.k.a. "osintshopmanager" also monetized querying the database through a Telegram bot in January. From this data breach package, ZeroFOX extracted 46,343,480 unique records with email addresses, including 44,318,402 with facebook[.]com domains (username[@]facebook[.]com) and 2,025,78 with other email domains (primarily gmail[.]com, hotmail[.]com, and yahoo[.]com).

Breaking News: 2021-04-02 - 2021-04-08

US DOJ: Phishing attacks use vaccine surveys to steal personal info - BleepingComputer

The US Department of Justice warns of phishing attacks using fake post-vaccine surveys to steal money from people or tricking them into handing over their personal information. Attackers promise potential victims cash or prizes for filling out the fake surveys. Instead, they only harvest the filled-out personally identifiable information to fuel fraud schemes involving identity theft. It is recommended to avoid clicking on links received via text messages or emails claiming to be a vaccine survey if they come from unknown and unverified sources.

See the full report here: https://www.bleepingcomputer.com/news/security/us-doj-phishing-attacks-use-vaccine-surveys-to-steal-personal-info/

Legacy QNAP NAS Devices Vulnerable to Zero-Day Attack

Some legacy models of QNAP network-attached storage devices are vulnerable to remote unauthorized attacks because of two unpatched vulnerabilities. The two critical zero-day bugs tracked as CVE-2020-25099 and CVE-2021-36195, affect legacy QNAP Systems storage hardware, and expose devices to remote unauthenticated attackers. Currently, QNAP has released the fix in the latest firmware and related app. For the legacy versions, security updates are expected to be available in a week.

See the full report here: https://threatpost.com/qnap-nas-devices-zero-day-attack/165165/

Ragnarok Ransomware Hits Boggi Milano Menswear

Luxury Italian men’s clothing brand Boggi Milano was hit with a ransomware attack. The Ragnarok ransomware group is confirmed to be behind the attack. They exfiltrated 40 GB of data, including human resources files and salary information. No one has disclosed how much Ragnarok wants in ransom to return the files. The Boggi Milano website is still up and running, and the brand said it is working with Italian authorities on the matter.

See the full report here: https://threatpost.com/ragnarok-ransomware-boggi-milano-menswear/165161/

VMware fixes authentication bypass in data center security software - BleepingComputer

VMware has addressed a critical vulnerability in the VMware Carbon Black Cloud Workload appliance that could allow attackers to bypass authentication after exploiting vulnerable servers. Attackers can exploit the security vulnerability tracked as CVE-2021-21982 by manipulating an administrative interface URL to obtain valid authentication tokens and admin API of unpatched VMware Carbon Black Cloud Workload appliances. Users are advised to apply the latest patch to mitigate the vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-authentication-bypass-in-data-center-security-software/

Brown University hit by cyberattack, some systems still offline - BleepingComputer

Brown University, a private US research university, had to disable systems and cut connections to the data center after suffering a cyberattack on Tuesday. The university's Computing & Information Services staff took steps to protect the University's digital resources, including shutting down connections to the central data center and systems within it. Among the most commonly accessed resources that are temporarily unavailable are Banner, VPN, RemoteApps, and some websites hosted on Brown.edu. The IT staff is still working on restoring connectivity and bringing additional systems back online to return operating status to normal.

See the full report here: https://www.bleepingcomputer.com/news/security/brown-university-hit-by-cyberattack-some-systems-still-offline/

FBI: APTs Actively Exploiting Fortinet VPN Security Holes

The FBI and the Cybersecurity and Infrastructure Security Agency are warning that advanced persistent threat (APT) nation-state actors are actively exploiting known security vulnerabilities in the Fortinet FortiOS cybersecurity operating system, affecting the company’s SSL VPN products. APTs are exploiting CVE-2018-13379, CVE-2019-5591, and CVE-2020-12812 to exploit Fortinet SSL VPN and gain a foothold within networks before moving laterally and carrying out recon. Users are advised to apply the patches immediately.

See the full report here: https://threatpost.com/fbi-apts-actively-exploiting-fortinet-vpn-security-holes/165213/

Call of Duty Cheats Expose Gamers to Malware, Takeover

Activision, the company behind Call of Duty: Warzone, has issued a warning that a threat actor is taking out ads for cheat tools, which instead turns out to be remote-access trojan (RAT) malware. The scam was first floated in March when a cyberattacker posted in hacking forums that they had a free, “newbie-friendly” method for spreading a RAT via video game cheat. The RAT gives an attacker full access to the victim’s machine and also installs other malicious code on victims’ computers.

See the full report here: https://threatpost.com/call-of-duty-cheats-gamers-malware/165209/

Asteelflash electronics maker hit by REvil ransomware attack - BleepingComputer

Asteelflash, a leading French electronics manufacturing services company, has suffered a cyberattack by the REvil ransomware gang who is demanding a $24 million ransom. While Asteelflash has not publicly disclosed an attack, BleepingComputer found this week a sample of the REvil ransomware that allowed access to the Tor negotiation page for their cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/asteelflash-electronics-maker-hit-by-revil-ransomware-attack/

Robinhood Warns Customers of Tax-Season Phishing Scams

Attackers have targeted customers of stock-trading broker Robinhood with a phishing campaign aimed to steal their credentials and spread malware using fake tax documents. Attackers targeted customers in two ways. One attack vector used phishing emails with links to fake Robinhood websites prompting visitors to enter their login credentials, including authentication codes the company uses to help ensure the security of people’s accounts. Other emails saw attackers taking advantage of tax season, asking potential victims to download fake tax files—such as Form 1099—that included malware.

See the full report here: https://threatpost.com/robinhood-warns-customers-of-tax-season-phishing-scams/165180/

GitHub Actions being actively abused to mine cryptocurrency on GitHub servers - BleepingComputer

GitHub Actions is currently being abused by attackers to mine cryptocurrency using GitHub's servers in an automated attack. The particular attack adds malicious GitHub Actions code to repositories forked from legitimate ones and creates a Pull Request for the original repository maintainers to merge the code back, to alter the original code. BleepingComputer also observed the malicious code loads a misnamed crypto miner npm[.]exe from GitLab and runs it with the attacker's wallet address.

See the full report here: https://www.bleepingcomputer.com/news/security/github-actions-being-actively-abused-to-mine-cryptocurrency-on-github-servers/

Hackers Steal YU Students' and Employees' Personal Information in Accellion Security Breach - The Commentator - The Commentator

Hackers recently stole Yeshiva University students’ and employees’ personal information, including Social Security numbers and financial information — in a data security breach of Accellion, Inc., a third-party vendor used by the university to securely transfer files. The university has since taken the platform offline. In an email, the university’s Information Technology Services (ITS)stated that this incident is limited to the Accellion application and there has not been any unauthorized access to Yeshiva’s computer systems.

See the full report here: https://yucommentator.org/2021/04/hackers-steal-yu-students-and-employees-personal-information-in-accellion-security-breach/

GitHub Arctic Vault likely contains leaked MedData patient records - BleepingComputer

GitHub Arctic Code Vault has likely captured sensitive patient medical records from multiple healthcare facilities in a data leak attributed to MedData. The private data was leaked on GitHub repositories last year whose contributors carry the Arctic Code Vault badge.

See the full report here: https://www.bleepingcomputer.com/news/security/github-arctic-vault-likely-contains-leaked-meddata-patient-records/

Microsoft outage caused by overloaded Azure DNS servers - BleepingComputer

Microsoft has revealed that Thursday's worldwide outage was caused by a code defect that allowed the Azure DNS service to become overwhelmed and not respond to DNS queries. On Thursday, Microsoft experienced a global outage that prevented users from accessing or signing into numerous services.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outage-caused-by-overloaded-azure-dns-servers/

Ransomware gang leaks data from Stanford, Maryland universities - BleepingComputer

Personal and financial information stolen from Stanford Medicine, University of Maryland Baltimore (UMB), and the University of California was leaked online by the Clop ransomware group. The threat actors obtained the documents after hacking the universities' Accellion File Transfer Appliance (FTA) software used to share and store sensitive information.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-leaks-data-from-stanford-maryland-universities/

533 million Facebook users’ phone numbers leaked on hacker forum - BleepingComputer

The mobile phone numbers and other personal information for approximately 533 million Facebook users worldwide has been leaked on a popular hacker forum for free. The stolen data first surfaced on a hacking community in June 2020 when a member began selling the Facebook data to other members. What made this leak stand out was that it contained member information that can be scraped from public profiles and private mobile numbers associated with the accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/533-million-facebook-users-phone-numbers-leaked-on-hacker-forum/

Malware attack is preventing car inspections in eight US states - BleepingComputer

A malware cyberattack on emissions testing company Applus Technologies is preventing vehicle inspections in eight states, including Connecticut, Georgia, Idaho, Illinois, Massachusetts, Utah, and Wisconsin. On Tuesday, March 30th, vehicle emissions testing platform Applus Technologies suffered a malware attack that caused them to disconnect their IT systems. At this time, Applus Technologies cannot provide a time frame for when they will restore service as State governments require them to go through a rigorous mitigation and testing process.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-attack-is-preventing-car-inspections-in-eight-us-states/

How to check if your info was exposed in the Facebook data leak

Data breach notification service Have I Been Pwned can now be used to check if your personal information was exposed in yesterday's Facebook data leak that contains mobile numbers, name, gender, location, relationship status, occupation, date of birth, and email addresses for over 500 million users. This data was originally sold in private sales after being collected in 2019 using a bug in the 'Add Friend' feature on Facebook. Facebook had closed this vulnerability soon after it was discovered, but threat actors continued to circulate the data until it was finally released for free. Unfortunately, the most common user identifiable field in yesterday's Facebook leak is phone numbers. However, only 2.5 million out of the 533 million Facebook member records also included an email address. Due to this, even if Have I Been Pwned does not return a matching email address, the user can still be part of the leak.

See the full report here: https://www.bleepingcomputer.com/news/security/how-to-check-if-your-info-was-exposed-in-the-facebook-data-leak/

Canadian hardware store chain gets slammed by ransomware attack - Insurance Business CA

A notice on the DarkSide leak website addressed to Home Hardware Store states that they have downloaded the firm's private data. The screenshots of some of the documents being leaked appear to be a December 2020 financial report and a November 2020 letter that seems to pertain to an acquisition deal. According to the company's investigations, it appears that the attack has not affected dealer retail systems or any consumer transaction or payment data.

See the full report here: https://www.insurancebusinessmag.com/ca/news/cyber/canadian-hardware-store-chain-gets-slammed-by-ransomware-attack-251259.aspx

DeFi aggregator raided by five hackers on launch day - Cointelegraph

Fledgling decentralized finance protocol ForceDAO has had a rough start, with several incursions from hackers taking place just hours after it launched. The Ethereum-based yield aggregator had launched its airdrop campaign on April 3, 2021, when four malicious black-hat hackers managed to drain a total of 183 ETH worth approximately $367,000 at the time. A flaw in the contract used by ForceDAO enabled the attackers to exploit this mechanism to mint xFORCE tokens which were then withdrawn and exchanged for ETH on the markets.

See the full report here: https://cointelegraph.com/news/defi-aggregator-raided-by-five-hackers-on-launch-day

Sierra Wireless resumes production after ransomware attack

Canadian IoT solutions provider Sierra Wireless announced that it resumed production at its manufacturing sites halted after a ransomware attack that hit its internal network and corporate website on March 20. The Canadian multinational added that the ransomware attack did not impact its customer-facing products and services since the affected internal IT systems are separated. The company did not provide info on what ransomware operation was behind the attack or if any data was stolen from compromised systems before they were encrypted in the statement published on March 25.

See the full report here: https://www.bleepingcomputer.com/news/security/sierra-wireless-resumes-production-after-ransomware-attack/

Airlift Express Fixes Vulnerabilities in Its E-commerce Store

A team of security researchers from PrivacySavvy recently discovered an OTP vulnerability in Airlift Express that could lead to account hacks and exploits by cybercriminals. According to the researchers, hackers can access an Airlift account if they could get a legit phone number through social engineering and use brute force to get to the right OTP. The researchers have reported this issue to the company. Following which the company has successfully fixed the security loopholes.

See the full report here: https://securityaffairs.co/wordpress/116251/hacking/airlift-express-opt-flaw.html?utm_source=rss&utm_medium=rss&utm_campaign=airlift-express-opt-flaw

Conti Ransomware gang demanded $40 million ransom to Broward County Public Schools

Broward County Public Schools district announced that it was the victim of a ransomware attack, and crooks demanded a $40,000,000 payment. BCP is the sixth-largest school district in the nation and the second-largest in the state of Florida. The attack took place in March and the Broward County Public Schools were forced to shut down their IT systems. The Conti ransomware gang claimed responsibility for the attack, but the district did not provide additional details about the ransomware attack.

See the full report here: https://securityaffairs.co/wordpress/116254/cyber-crime/broward-county-public-schools-ransomware.html?utm_source=rss&utm_medium=rss&utm_campaign=broward-county-public-schools-ransomware

LinkedIn Spear-Phishing Campaign Targets Job Hunters

A threat group called Golden Chickens is delivering the fileless backdoor more_eggs through a spear-phishing campaign targeting professionals on LinkedIn with fake job offers, according to researchers at eSentire. The phishing emails try to trick a victim into clicking on a malicious .ZIP file by picking up the victim’s current job title and adding the word “position” at the end, making it appear like a legitimate offer.

See the full report here: https://threatpost.com/linkedin-spear-phishing-job-hunters/165240/

Microsoft Defender for Endpoint now supports Windows 10 Arm devices - BleepingComputer

Microsoft today announced that Microsoft Defender for Endpoint, the enterprise version of its Defender antivirus, now comes with support for Windows 10 on Arm devices. Windows 10 on Arm, a full-featured version of Windows 10 designed explicitly for Arm devices, has run most apps since the first such devices (known as Always Connected PCs) were launched in late 2017.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-for-endpoint-now-supports-windows-10-arm-devices/

Adult content from hundreds of OnlyFans creators leaked online - BleepingComputer

After a shared Google Drive was posted online containing the private videos and images from hundreds of OnlyFans accounts, a researcher has created a tool allowing content creators to check if they are part of the leak. OnlyFans is a website that allows content creators to earn money by sharing images, videos, and live streams with fans who pay to subscribe to their content. It is common for people to share OnlyFans content they subscribe to but what stands out about this leak is the large number of creators whose private content has been shared at once.

See the full report here: https://www.bleepingcomputer.com/news/security/adult-content-from-hundreds-of-onlyfans-creators-leaked-online/

Spy Operations Target Vietnam with Sophisticated RAT

An advanced cyberespionage campaign targeting government and military entities in Vietnam has been discovered that delivered a remote-access tool (RAT) for carrying out espionage operations, researchers said. Further analysis suggested that this campaign was conducted by a group related to a Chinese-speaking advanced persistent threat (APT) known as Cycldek (a.k.a. Goblin Panda, APT 27 and Conimes), according to Kaspersky researchers, who added that the group has been active since at least 2013.

See the full report here: https://threatpost.com/spy-operations-vietnam-rat/165243/

Apple Mail Zero-Click Security Vulnerability Allows Email Snooping

A zero-click security vulnerability in Apple’s macOS Mail would allow a cyberattacker to add or modify any arbitrary file inside Mail’s sandbox environment, leading to a range of attack types. The exploitation of the bug could lead to unauthorized disclosure of sensitive information to a third party, the ability to modify a victim’s Mail configuration, including mail redirects which enables takeover of victim’s other accounts via password resets and the ability to change the victim’s configuration so that the attack can propagate to correspondents in a worm-like fashion.

See the full report here: https://threatpost.com/apple-mail-zero-click-security-vulnerability/165238/

Ransomware attack affects 750000 Personal Touch patients, employees across US - Becker's Hospital Review

Personal Touch Holding Corp., the parent company of Personal Touch Home Care centers across the U.S., recently began notifying 753,107 patients and employees of a ransomware attack on its cloud-stored business records. The data breach occurred between Jan. 20, 2021, and Jan. 27, 2021, and the compromised information may include Social Security numbers, financial information, medical records, and more of patients, employees, and dependents. The data breach affected 29 direct and indirect subsidiaries of Personal Touch across the U.S.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/ransomware-attack-affects-750-000-personal-touch-patients-employees-across-u-s.html

Personal data of about 30000 e2i clients potentially exposed after malware attack on vendor's employee - CNA

Personal data of about 30,000 people who have used e2i’s services may have been exposed after a malware attack on the mailbox of an employee at a third-party vendor. E2i (Employment and Employability Institute) is the job and training arm of the National Trades Union Congress (NTUC). The potentially affected personal data may include names, NRIC, contact details, educational qualifications, and employment details.

See the full report here: https://www.channelnewsasia.com/news/singapore/e2i-clients-personal-data-potentially-exposed-malware-attack-14560620

Experts found critical flaws in Rockwell FactoryTalk AssetCentre

An American provider of industrial automation, Rockwell Automation has patched nine critical vulnerabilities in its FactoryTalk AssetCentre product. The issues discovered by the researchers are deserialization and SLQ injection vulnerabilities. The flaws have been rated with a CVSS score of 10. Successful exploitation of these vulnerabilities may allow unauthenticated attackers to perform arbitrary command execution, SQL injection, or remote code execution.

See the full report here: https://securityaffairs.co/wordpress/116391/ics-scada/rockwell-factorytalk-assetcentre-flaws.html

EtterSilent maldoc builder used by top cybercriminal gangs - BleepingComputer

A malicious document builder named EtterSilent is gaining a lot of attention on underground forums. In a blog post today, researchers at Intel 471 found that the seller offered weaponized Microsoft Office (2007 through 2019) documents in two 'flavors': with an exploit for a known vulnerability or with a malicious macro. One of the vulnerabilities leveraged is CVE-2017-8570, a high-severity remote code execution. The author also mentioned two other vulnerabilities (CVE-2017-11882 and CVE-2018-0802), albeit some restrictions applied, and demonstrated them. Several cybercriminal groups have leveraged EtterSilent services for their operations. Some examples are banking trojans IcedID/BokBot, Ursnif/Gozi ISFB, and QakBot/QBot. Along with Trickbot.

See the full report here: https://www.bleepingcomputer.com/news/security/ettersilent-maldoc-builder-used-by-top-cybercriminal-gangs/

Signal Adds a Payments Feature—With Cryptocurrency

Signal today announced that it's rolling out a new feature that will allow its users to send money to one another within its encrypted communications network. To do so, it has integrated support for the cryptocurrency MobileCoin, a form of digital cash designed to work efficiently on mobile devices while protecting users' privacy and even their anonymity. For now, the payment feature will be available only to users in the UK, and only on iOS and Android, not the desktop.

See the full report here: https://www.wired.com/story/signal-mobilecoin-payments-messaging-cryptocurrency/

Crypto Malware 'AppleJeus' Opens Cryptocurrency Wallets to Thieves - Security Intelligence

In a joint advisory published by the FBI and the Department of the Treasury, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) warned that the Hidden Cobra threat group was using AppleJeus to target cryptocurrency exchanges, finance service companies, and similar entities. The malicious actors used trojanized versions of cryptocurrency trading apps to spread the crypto-malware. The malware then allows threat actors to prey upon businesses and steal cryptocurrency from specific users’ wallets.

See the full report here: https://securityintelligence.com/news/applejeus-crypto-malware-targets-cryptocurrency/

Ransomware hits TU Dublin and National College of Ireland - BleepingComputer

The National College of Ireland (NCI) and the Technological University of Dublin have announced that ransomware attacks hit their IT systems. NCI is currently working on restoring IT services after being hit by a ransomware attack over the weekend that forced the college to take IT systems offline.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-hits-tu-dublin-and-national-college-of-ireland/

Facebook data leak now under EU data regulator investigation - BleepingComputer

Ireland's Data Protection Commission (DPC) is investigating a massive data leak concerning a database containing personal information belonging to more than 530 million Facebook users. The mobile phone numbers and other personal information of hundreds of millions of Facebook users worldwide were leaked on a popular hacker forum for free after it was sold in June 2020 for an estimated $30,000 and made searchable via a private Telegram bot.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-data-leak-now-under-eu-data-regulator-investigation/

Hacker sells $38M worth of gift cards from thousands of shops - BleepingComputer

A Russian hacker has sold on a top-tier underground forum close to 900,000 gift cards with a total value estimated at $38 million. The database contained cards from thousands of brands and may originate from an older breach at the now-defunct discount gift card shop Cardpool.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-sells-38m-worth-of-gift-cards-from-thousands-of-shops/

European Commission, other EU orgs recently hit by cyber-attack - BleepingComputer

The European Commission and several other European Union organizations were hit by a cyberattack in March, according to a European Commission spokesperson. As revealed by the spokesperson, the IT security incident impacted multiple EU institutions, bodies, or agencies' IT infrastructure.

See the full report here: https://www.bleepingcomputer.com/news/security/european-commission-other-eu-orgs-recently-hit-by-cyber-attack/

Chinese Hackers Selling Intimate Stolen Camera Footage

Stolen videos captured by tens of thousands of security cameras at private properties throughout China are now for sale across social media, marketed as sex tapes. According to the South China Morning Post, which reported that the cost of each tape varies, depending on how salacious the material is, nudity and sex acts can fetch around $8 apiece, while just watching someone in a hotel room might just run around $3, the paper said.

See the full report here: https://threatpost.com/chinese-hackers-intimate-camera-footage/165281/

Have I Been Pwned adds search for leaked Facebook phone numbers - BleepingComputer

Facebook users can now use the Have I Been Pwned data breach notification site to check if their phone number was exposed in the social site's recent data leak. Last weekend, a threat actor released a data leak containing information for 533 million Facebook users. This information includes phone numbers and Facebook IDs for almost all exposed accounts and other optional information such as a member's name, gender, relationship status, location, occupation, date of birth, and email address.

See the full report here: https://www.bleepingcomputer.com/news/security/have-i-been-pwned-adds-search-for-leaked-facebook-phone-numbers/

SAP issues advisory on the exploit of old vulnerabilities to target enterprise applications

Threat actors are targeting mission-critical SAP applications unsecured against already patched vulnerabilities, exposing the networks of commercial and government organizations to attacks. SAP and cloud security firm Onapsis warned of these ongoing attacks and have worked in partnership with the Cybersecurity and Infrastructure Security Agency (CISA) and Germany's cybersecurity agency BSI to warn SAP customers to deploy patches and survey their environments for unsecured apps.

See the full report here: https://www.zdnet.com/article/sap-issues-advisory-on-vulnerable-applications-being-widely-targeted-by-hackers/

Hackers download Trinity Health patients' PHI: 5 details - Becker's Hospital Review

Livonia, Mich.-based Trinity Health is notifying patients that their protected health information was recently accessed and downloaded by an unauthorized user. The unauthorized user was able to take advantage of a previously unknown and unreported flaw in the security of Accellion's appliance. Trinity Health said files containing its patients' protected health information, including names, birthdates, medical record numbers, lab results, and payer names were exposed by the incident. Also, Social Security numbers and credit card numbers were exposed to a very small number of individuals.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/hackers-download-trinity-health-patients-phi-5-details.html

Attackers Blowing Up Discord, Slack with Malware

Cisco’s Talos team said in a report on collaboration app abuse this week that during the past year threat actors have increasingly used apps like Discord and Slack to trick users into opening malicious attachments and deploy various RATs and stealers, including Agent Tesla, AsyncRAT, Formbook, and others. The researchers explained that Slack, Discord, and other collaboration app platforms use content delivery networks (CDNs) to store the files shared back and forth within channels. Users can create external links that allow the files to be accessed, regardless of whether the recipient even has the app installed. This functionality will allow attackers to deliver their malicious payload to the CDN over encrypted HTTPS, and that the files will be compressed, further disguising the content.

See the full report here: https://threatpost.com/attackers-discord-slack-malware/165295/

Google Forms and Telegram abused to collect phished credentials

Security researchers note an increase in alternative methods to steal data from phishing attacks, as scammers obtain the stolen info through Google Forms or private Telegram bots. According to a cybersecurity company, Group-IB the phishing kits allow collecting stolen user data using Google Forms and Telegram. Another trend the researchers observed was that the authors of phishing kits were double-dipping to increase their profits by adding code that copies the stream of stolen data to their network host. Users of Microsoft, PayPal, Google, and Yahoo products were the top targets.

See the full report here: https://www.bleepingcomputer.com/news/security/google-forms-and-telegram-abused-to-collect-phished-credentials/

Gigaset Android phones infected by malware via hacked update server

Gigaset, a German manufacturer of telecommunications devices, including a series of smartphones running the Android OS has been repeatedly infected with malware since the end of March after threat actors compromised the vendor's update server in a supply-chain attack.Users found their Gigaset mobile devices repeatedly opening web browsers and displaying advertisements for mobile game sites. An unknown application called 'Easenf', installed by the device's system update app, that when deleted, would automatically be reinstalled. Other malicious apps found alongside it include 'gem', 'smart', and 'xiaoan.' Three malware apps are detected as adware or downloaders. Gigaset confirms cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/gigaset-android-phones-infected-by-malware-via-hacked-update-server/

Microsoft's Windows 10, Exchange, and Teams hacked at Pwn2Own

Pwn2Own 2021 contestants won $440,000 after successfully exploiting previously unknown vulnerabilities to hack Microsoft's Windows 10 OS, the Exchange mail server, and the Teams communication platform. Pwn2Own competitors will also target Google Chrome, Microsoft Edge (Chromium), Zoom Messenger, while others will try their hand at exploiting other new bugs in Microsoft Exchange, Windows 10, Ubuntu Desktop, and Parallels Desktop. After the vulnerabilities are exploited and disclosed during Pwn2Own, software, and hardware vendors are given 90 days to develop and release security fixes for all vulnerabilities reported.

See the full report here: https://www.bleepingcomputer.com/news/security/microsofts-windows-10-exchange-and-teams-hacked-at-pwn2own/

VISA: Hackers increasingly using web shells to steal credit cards

Global payments processor VISA warns that threat actors are increasingly deploying web shells on compromised servers to exfiltrate credit card information stolen from online store customers. Visa Payment Fraud Disruption (PFD) identified a trend whereby many eSkimming attacks used web shells to establish a command and control (C2)during the attacks. Once deployed, the skimmers allow them to steal the payment, and personal info submitted by the compromised online stores' customers and send it to servers under their control. The attackers used multiple methods to breach the online shops' servers, including vulnerabilities in unsecured administrative infrastructure, eCommerce-related application/website plugins, and outdated/unpatched eCommerce platforms.

See the full report here: https://www.bleepingcomputer.com/news/security/visa-hackers-increasingly-using-web-shells-to-steal-credit-cards/

Fake Netflix App on Google Play Spreads Malware Via WhatsApp - Threatpost

According to CheckPoint researchers, malware masqueraded as an app called FlixOnline, which advertised via WhatsApp messages offering free Netflix Premium for 60 anywhere in the world. But once installed the malware sets about stealing data and credentials. The malware was designed to monitor a user’s WhatsApp notifications, sending automatic replies to a user’s incoming messages using content that it receives from a remote server. It was also able to self-propagate, sending messages to users’ WhatsApp contacts and groups with links to the fake app. The app was live on Google Play for two months and the malware racked up 500 victims, according to Check Point. The firm alerted Google to the malware, which took the app down.

See the full report here: https://threatpost.com/netflix-app-google-play-malware-whatsapp/165288/

REvil ransomware now changes password to auto-login in Safe Mode - BleepingComputer

At the end of March, a new sample of the REvil ransomware was discovered by security researcher R3MRUM that refines the new Safe Mode encryption method by changing the logged-on user's password and configuring Windows to automatically login on reboot. It is believed that this mode was added as a way to evade detection by security software and to shut down backup software, database servers, or mail servers to have greater success when encrypting files.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/