Threat Intelligence Bulletin: 04/09/2021 - 04/15/2021

Patch Tuesday 04/13/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
• Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for March 2021 contained 108 vulnerabilities in total, with:

• 3 vulnerabilities rated as Critical
• 77 vulnerabilities rated as High
• 27 vulnerabilities rated as Medium
• 1 vulnerability rated as Low

Most Notable Vulnerabilities

Microsoft has identified the proofs-of-concept (PoC) for CVE-2021-28449, CVE-2021-28458, CVE-2021-28460,CVE-2021-28456, CVE-2021-28454, CVE-2021-27091, and CVE-2021-27064.

CVE-2021-27091

CVE-2021-27091 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the RPC Endpoint Mapper Service. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted by CVE-2021-27091:

• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2008 R2 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows Server (Server Core installation) 2012
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1

CVE-2021-28310

CVE-2021-28310 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The CVE is believed to be exploited in the wild, potentially by several threat actors. According to Kaspersky researchers, BITTER APT group are exploiting CVE-2021-28310, who were behind CVE-2021-1732 exploit.

The following products are impacted by CVE-2021-28310:

• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 10 1803 for 32-bit Systems
• Microsoft Windows 10 1803 for x64-based Systems
• Microsoft Windows 10 1803 for ARM64-based Systems
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 2004 for 32-bit Systems
• Microsoft Windows 10 2004 for ARM64-based Systems
• Microsoft Windows 10 2004 for x64-based Systems
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Windows 10 20H2 for ARM64-based Systems
• Microsoft Windows 10 20H2 for x64-based Systems
• Microsoft Windows Server (Server Core installation) 2019
• Microsoft Windows Server (Server Core installation) 1909
• Microsoft Windows Server (Server Core installation) 2004
• Microsoft Windows Server (Server Core installation) 20H2

Other Notable Vulnerabilities

Other notable Microsoft vulnerabilities include CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. These are flaws in Exchange Server versions 2013-2019 that could allow a remote attacker to execute arbitrary code on the system.

Users are advised to apply the latest security patches specified in Microsoft's April Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

ZeroFOX Threat Research: Quarter 1 2021 Threat Report

The ZeroFOX Threat Research team is excited to announce the release of our Quarterly Threat Report for Q1 of 2021.

Link to Download

• https://zf-tf-csv.s3-us-west-2.amazonaws.com/9378ded7-c547-40c7-8398-b529e7ed8b01.pdf

Report Summary

In the first quarter (Q1) of 2021, the global cyber threat landscape exhibited a series of events that included takedowns of criminal infrastructure, the persistence of ransomware extortion schemes, and creative tools and techniques used to deliver malicious artifacts to victims. Law enforcement agencies worldwide worked together to disrupt criminal operations in credit card networks, ransomware groups, and botnet infrastructure. The success of ransomware double extortion tactics led to the continuation of this method as new ransomware types emerged and operators used grey hat tactics to justify their criminal actions. Threat actors leveraged creative delivery tools and techniques that evade detection by security technologies and make analyzing cyber threats more complex.

In underground cyber communities, ZeroFOX Threat Research observed significant competition among threat actors due to increased traffic in marketplace networks. The investigation of the December 2020 SolarWinds Orion breach continued in Q1, with security researchers identifying six malware types used in the breach. Another large-scale attack took place against Microsoft Exchange Servers this quarter in which threat actors exploited a set of vulnerabilities to access target environments and install malware. Furthermore, four key industries faced cybersecurity risks due to COVID-19-themed threats, vulnerable infrastructure, and evolved technology. In this Quarterly Threat Landscape Review, ZeroFOX Research provides an overview and analysis of the prominent threats in Q1 2021.

Breaking News: 2021-04-09 - 2021-04-15

Critical Zoom vulnerability triggers remote code execution without user input

Researchers have disclosed a vulnerability in Zoom, which can be used to launch remote code execution attacks. A three-bug attack chain was demonstrated in the Pwn2Own hacking contest that caused an RCE on a target machine, and all without any form of user interaction. The technical details of the attack have not been disclosed publicly. Zoom is yet to address the bug and release a patch.

See the full report here: https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/

Attackers deliver legal threats, IcedID malware via contact forms - BleepingComputer

Threat actors are using legitimate corporate contact forms to send phishing emails that threaten enterprise targets with lawsuits and attempt to infect them with the IcedID info-stealing malware. The recent phishing campaign bypasses contact forms' CAPTCHA protection to flood enterprises with a barrage of phishing messages. To further increase their attacks' efficiency, the threat actors threaten their targets with legal action for copyright infringements to pressure them into clicking embedded links directing them to IcedID payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-deliver-legal-threats-icedid-malware-via-contact-forms/

Data from 500M LinkedIn Users Posted for Sale Online

Hackers have posted an archive containing Personal data from more than 500 million LinkedIn users, on a popular hacking forum. The leaked data includes LinkedIn IDs, full names, professional titles, email addresses, phone numbers, and other personally identifiable information (PII). LinkedIn officials confirmed that data from the platform was included in the leak said it was not due to a breach of its system but instead was scraped from the LinkedIn site.

See the full report here: https://threatpost.com/data-500m-linkedin-users-online/165329/

Washington State educational organizations targeted in cryptojacking spree

US educational organizations are being targeted by threat actors intent on compromising their networks to covertly mine cryptocurrency. Otherwise known as cryptojacking attacks, this form of assault is usually mired in stealth as the overall aim is to quietly install cryptocurrency mining components that leech stolen computational power. According to a new advisory released by Palo Alto Network's Unit 42 team, cryptojacking incidents have recently taken place against educational institutions in Washington State. A UPX-packed cpuminer, used to mine LTC and BTC, has been delivered by way of malicious traffic.

See the full report here: https://www.zdnet.com/article/washington-state-educational-organizations-targeted-in-cryptojacking-spree/

LinkedIn denies being hacked - FOX10 News

Professional networking site LinkedIn says it has not been hacked. The company says the post was made on a website popular with hackers. But, according to LinkedIn, the information was taken only from users' public profiles. The company says it did not see any private information in the post.

See the full report here: https://www.fox10tv.com/news/us_world_news/linkedin-denies-being-hacked/article_0aaf96f8-9944-11eb-8c13-7f9d7a3d1b4a.html

Personal data of 1.3 million Clubhouse users has reportedly leaked online days after LinkedIn and Facebook also suffered data breaches

According to a report, the personal data of 1.3 million Clubhouse users has leaked online on a popular hacker forum. The leaked data of Clubhouse users includes names, social media profile names, and other details.

See the full report here: https://www.businessinsider.com/clubhouse-data-leak-1-million-users-2021-4

CT emissions tests are still halted after malware attack on DMV provider - Thehour.com

A company official said Thursday that Applus Technologies continues to work with the Connecticut Department of Motor Vehicles to get their program up and running safely and securely as quickly as they can after some of its eight programs are affected by a hacking incident. Following an attempted malware attack, some of Applus’ programs were halted. In Connecticut, that affected the state DMV’s ability to offer emissions testing services.

See the full report here: https://www.ctpost.com/news/article/Official-Provider-continues-to-work-with-CT-DMV-16087513.php

62000 e-mails to Certis may have been accessed by crooks - The Straits Times

About 62,000 e-mails from the public, businesses, and customers of local security firm Certis, some containing NRIC and credit card numbers, may have been accessed by cybercriminals, the company said yesterday. The Personal Data Protection Commission said it is investigating the matter.

See the full report here: https://www.straitstimes.com/tech/tech-news/62000-e-mails-to-certis-may-have-been-accessed-by-crooks

UAE fake jobs alert: Hackers using LinkedIn to steal data - Khaleej Times

Cybersecurity solutions firm eSentire said its Threat Response Unit (TRU) has found that hacking groups are spearphishing professionals on LinkedIn with fake job offers to infect them with a sophisticated backdoor Trojan. The scammers offer fake jobs to infect mobile phones and computers to steal the data of the professionals. Backdoor trojans give threat actors remote control over the victim’s computer, allowing them to send, receive, launch and delete files.

See the full report here: https://www.khaleejtimes.com/news/crime-and-courts/uae-fake-jobs-alert-hackers-using-linkedin-to-steal-data

Leading cosmetics group Pierre Fabre hit with $25 million ransomware attack - BleepingComputer

Leading French pharmaceutical group Pierre Fabre suffered a REvil ransomware attack where the threat actors initially demanded a $25 million ransom. Pierre Fabre is the second largest pharmaceutical group in France and the second largest dermo-cosmetics laboratory globally. With over 10,000 worldwide, Pierre Fabre developers a wide variety of products ranging from chemotherapy drugs to skincare products.

See the full report here: https://www.bleepingcomputer.com/news/security/leading-cosmetics-group-pierre-fabre-hit-with-25-million-ransomware-attack/

Tipp City student records exposed during law firm data breach - Dayton Daily News

Some Tipp City Exempted Village Schools parents received a letter in the mail Thursday about a data breach in January at a law firm used by the district. Superintendent Mark Stefanik said Thursday the district first was notified of the breach at the Bricker and Eckler law firm in early February and was told that a cyber law partner had been hired to examine the contents of records involved. Information in the records affected included student names, grades, grade point averages, attendance data, prior classes attended, and some official school photographs.

See the full report here: https://www.daytondailynews.com/local/tipp-city-student-records-exposed-during-law-firm-data-breach/QSXX2ERZBBGUZLAZV2VGMJRTHE/

CSGO Exploit Allows Hackers to Steal Passwords | Game Rant - GameRant

Ethical hackers have discovered an exploit in Counter-Strike: Global Offensive (CS: GO) that allows a player's information to be stolen simply by clicking an invite. The hack is implemented in Steam's invite system and allows the hacker to obtain information from possibly anyone on the platform if they accept said invite. This hack can also be implemented as part of a larger community invite, and multiple accounts can be hacked in the process.

See the full report here: https://gamerant.com/csgo-stolen-password-exploit-hackers/

Iran calls blackout at underground atomic facility 'nuclear terrorism.' Israeli outlets blame an Israeli cyberattack.

Iran on Sunday described a blackout at its underground Natanz atomic facility as an act of nuclear terrorism, raising regional tensions as world powers and Tehran continue to negotiate over its tattered nuclear deal. While there was no immediate claim of responsibility, suspicion fell immediately on Israel, where its media nearly uniformly reported a devastating cyberattack orchestrated by the country that caused the blackout.

See the full report here: https://www.businessinsider.com/iran-blames-blackout-at-atomic-facility-on-nuclear-terrorism-2021-4

Hackers hit India’s 2nd largest broker Upstox - Times of India

On Saturday, stockbroking app Upstox revealed that it suffered a data breach that compromised contact details and know-your-customer details of its users. In an announcement post, the Tiger Global-backed company said it received emails claiming unauthorized access into its database, following which it restricted access to the impacted database, and added security enhancements at all of its third-party data warehouses.

See the full report here: https://timesofindia.indiatimes.com/business/india-business/hackers-hit-indias-2nd-largest-broker-upstox/articleshow/82021252.cms

Joker malware infects over 500,000 Huawei Android devices - BleepingComputer

More than 500,000 Huawei users have downloaded from the company’s official Android store applications infected with Joker malware that subscribes to premium mobile services. Researchers found ten seemingly harmless apps in AppGallery that contained code for connecting to malicious command and control servers to receive configurations and additional components.

See the full report here: https://www.bleepingcomputer.com/news/security/joker-malware-infects-over-500-000-huawei-android-devices/

Mozilla flooded with requests after Apple privacy changes hit Facebook - BleepingComputer

Mozilla volunteers have recently been flooded with online merchants and marketers' requests for their domains to be added to what's called a Public Suffix List (PSL). Public Suffix List (PSL) is an initiative of the Mozilla community volunteers to maintain a list of top-level domains (TLDs) and domains that should be treated as one to prevent the mixing of cookies between distinct domains.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-flooded-with-requests-after-apple-privacy-changes-hit-facebook/

Expired certificate caused a Pulse Secure VPN global scale outage

Pulse Secure VPN users were not able to login after a code signing certificate used to digitally sign and verify software components has expired. Experts noticed that the code-signing certificate used to sign the file has expired on April 12, which means that signature analyzed was considered not valid and caused the massive outage. The company suggests users use Pulse Desktop Client, instead of launching it through the browser, as a workaround.

See the full report here: https://securityaffairs.co/wordpress/116719/security/pulse-secure-vpn-outage.html?utm_source=rss&utm_medium=rss&utm_campaign=pulse-secure-vpn-outage

BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain

The McAfee Mobile Research Team uncovered several new variants of the Android malware family BRATA being distributed in Google Play, ironically posing as app security scanners. First spotted at the end of 2018 and named “Brazilian Remote Access Tool Android” (BRATA) by Kaspersky, this “RAT” initially targeted users in Brazil and then rapidly evolved into a banking trojan. These malicious apps take full control of the device by abusing accessibility services. Recent versions of BRATA were also seen serving phishing webpages targeting users of financial entities, not only in Brazil but also in Spain and the USA.

See the full report here: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/brata-keeps-sneaking-into-google-play-now-targeting-usa-and-spain/

Hackers steal Stanford students' Poptropica passwords - The Stanford Daily

In the latest cyberattack, hackers have obtained stolen data belonging to members of the Stanford community most notably, their Poptropica passwords. The stolen passwords are part of a massive data breach meant to profit off exclusive items on the online role-playing game platform.

See the full report here: https://www.stanforddaily.com/2021/04/11/hackers-steal-stanford-students-poptropica-passwords/

New Malware Downloader Spotted in Targeted Campaigns - Dark Reading

Researchers at Malwarebytes recently spotted the Saint Bot dropper, as they have named it, being used as part of the infection chain in targeted campaigns against government institutions in the country of Georgia. In each case, the attackers used Saint Bot to drop information stealers and other malware downloaders. According to the security vendor, it is likely that the new loader is being used by a few different threat actors, so there are likely other victims.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/new-malware-downloader-spotted-in-targeted-campaigns/d/d-id/1340640

Late Breach Notice In Europe Leads To Nearly €500K Fine - JD Supra

On 31 March 2021, the Dutch Data Protection Authority (DPA) announced that it fined the online reservation platform Booking.com €475,000 for failing to notify the DPA of a data breach within the timeline established in the GDPR. The DPA determined that Booking.com did not inform the authority of the breach within the 72-hour deadline required under Article 33 GDPR, which requires organizations to notify data protection authorities without undue delay and, where feasible, not later than 72 hours after having become aware of the breach.

See the full report here: https://www.jdsupra.com/legalnews/late-breach-notice-in-europe-leads-to-4802404/

Google Chrome, Microsoft Edge zero-day vulnerability shared on Twitter - BleepingComputer

A security researcher has dropped a zero-day remote code execution vulnerability on Twitter that works on the current version of Google Chrome and Microsoft Edge. The security researcher released a working proof-of-concept (PoC) exploit for a remote code execution vulnerability for the V8 JavaScript engine in Chromium-based browsers. While the researcher states that the vulnerability is fixed in the latest version of the V8 JavaScript engine, it is not clear when Google will roll out Google Chrome.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-microsoft-edge-zero-day-vulnerability-shared-on-twitter/

NAME:WRECK DNS vulnerabilities affect over 100 million devices - BleepingComputer

Security researchers disclosed nine vulnerabilities affecting implementations of the Domain Name System protocol in popular TCP/IP network communication stacks running on at least 100 million devices. Collectively referred to as NAME: WRECK, the flaws could be leveraged to take offline affected devices or to gain control over them. The vulnerabilities were found in widespread TCP/IP stacks that run on a wide range of products, from high-performance servers and networking equipment to operational technology (OT) systems that monitor and control industrial equipment.

See the full report here: https://www.bleepingcomputer.com/news/security/name-wreck-dns-vulnerabilities-affect-over-100-million-devices/

Dutch supermarkets run out of cheese after ransomware attack - BleepingComputer

A ransomware attack against conditioned warehousing and transportation provider Bakker Logistiek has caused a cheese shortage in Dutch supermarkets. Bakker Logistiek is one of the largest logistics services providers in the Netherlands, offering air-conditioned warehousing and food transportation for Dutch supermarkets. Last week, Bakker Logistiek suffered a ransomware attack that encrypted devices on their network and disrupted food transportation and fulfillment operations.

See the full report here: https://www.bleepingcomputer.com/news/security/dutch-supermarkets-run-out-of-cheese-after-ransomware-attack/

ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users

A threat actor is selling account information for 21 million customers of ParkMobile, a mobile parking app that’s popular in North America. The stolen data includes customer email addresses, dates of birth, phone numbers, license plate numbers, hashed passwords, and mailing addresses.

See the full report here: https://krebsonsecurity.com/2021/04/parkmobile-breach-exposes-license-plate-data-mobile-numbers-of-21m-users/

Microsoft Warns of Malware Delivery via Google URLs

Microsoft has warned organizations of a new attack campaign that uses legitimate website contact forms to deliver malicious links to businesses via emails containing fake legal threats. In this campaign, Microsoft noticed attackers targeting businesses by abusing their corporate contact forms. Analysts believe the influx of emails stemming from contact forms indicates the attackers may have automated the process by bypassing CAPTCHA protections.

See the full report here: https://www.darkreading.com/risk/microsoft-warns-of-malware-delivery-via-google-urls/d/d-id/1340648

Microsoft April 2021 Patch Tuesday fixes 108 flaws, 5 zero-days - BleepingComputer

With today's update, Microsoft has fixed 108 vulnerabilities, with 19 classified as Critical and 89 as Important. The following four vulnerabilities Microsoft states were publicly exposed but not exploited: CVE-2021-27091 - RPC Endpoint Mapper Service Elevation of Privilege Vulnerability, CVE-2021-28312 - Windows NTFS Denial of Service Vulnerability, CVE-2021-28437 - Windows Installer Information Disclosure Vulnerability, CVE-2021-28458 - Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability. The CVE-2021-28310 - Win32k Elevation of Privilege Vulnerability discovered by Kaspersky researcher was found exploited in the wild, and Kaspersky believes the vulnerability exploited was utilized by the BITTER APT group.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2021-patch-tuesday-fixes-108-flaws-5-zero-days/

Capcom: Ransomware gang used old VPN device to breach the network - BleepingComputer

Capcom has released a final update about the ransomware attack it suffered last year. Investigators discovered that Ragnar Locker operators gained access to Capcom’s internal network by targeting an old VPN backup device located at the company’s North American subsidiary in California. From there, the attacker pivoted to devices in offices in the U.S. and Japan and detonated the file-encrypting malware on November 1st, causing email and file servers to be taken offline. Capcom is currently notifying affected individuals.

See the full report here: https://www.bleepingcomputer.com/news/security/capcom-ransomware-gang-used-old-vpn-device-to-breach-the-network/

CISA gives federal agencies until Friday to patch Exchange servers - BleepingComputer

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to install newly released Microsoft Exchange security updates by Friday. On April 13, 2021, Microsoft has released security updates for four Microsoft Exchange vulnerabilities discovered by the NSA. These Exchange vulnerabilities are capable of remote code execution, with two vulnerabilities not requiring attackers to authenticate first. CISA has updated their previously released Emergency Directive 21-02 to require all federal agencies to install security updates by 12:01 AM on Friday, April 16th, 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-gives-federal-agencies-until-friday-to-patch-exchange-servers/

New Linux, macOS malware hidden in fake Browserify NPM package - BleepingComputer

A new malicious package has been spotted on the npm registry, which targets NodeJS developers using Linux and Apple macOS operating systems. The malicious package is called "web-browserify," and imitates the popular Browserify npm component downloaded over 160 million times over its lifetime. web-browserify is itself built by combining hundreds of legitimate open-source components, and performs extensive reconnaissance activities on an infected system.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-macos-malware-hidden-in-fake-browserify-npm-package/

Update Your Chrome Browser to Patch 2 New In-the-Wild 0-Day Exploits

Google on Tuesday released a new version of Chrome web-browsing software for Windows, Mac, and Linux with fixes for two security vulnerabilities, both of which it says are under active exploitation. One of the two flaws concerns an insufficient validation of untrusted input in its V8 JavaScript rendering engine (CVE-2021-21220). Another flaw is a use-after-free vulnerability in its Blink browser engine (CVE-2021-21206). Chrome 89.0.4389.128 is expected to roll out in the coming days. Users can update to the latest version by heading to Settings > Help > About Google Chrome to mitigate the risk associated with the flaws.

See the full report here: https://thehackernews.com/2021/04/2-new-chrome-0-days-under-attack-update.html

FBI nuked web shells from hacked Exchange Servers without telling owners

A court-approved FBI operation was conducted to remove web shells from compromised US-based Microsoft Exchange servers without first notifying the servers' owners. On March 2nd, Microsoft released a series of Microsoft Exchange security updates for vulnerabilities actively exploited by a hacking group known as HAFNIUM. These vulnerabilities are collectively known as ProxyLogon and were used by threat actors in January and February to install web shells on compromised Exchange servers. The FBI requested this warrant because they believed that the owners of the still-compromised web servers did not have the technical ability to remove them on their own and that the shells posed a significant risk to the victim.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-nuked-web-shells-from-hacked-exchange-servers-without-telling-owners/

Adobe fixes critical vulnerabilities in Photoshop and Digital Editions - BleepingComputer

Adobe has released security updates that address security vulnerabilities in Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and RoboHelp. In total, the company addressed ten security vulnerabilities affecting four products, with seven of them rated as critical as they allow arbitrary code execution or arbitrary file writes. Adobe advises customers using vulnerable products to update to the latest versions as soon as possible to fix bugs that could lead to successful exploitation of unpatched installations.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-vulnerabilities-in-photoshop-and-digital-editions/

Watch out for this W-2 phishing scam targeting the 2021 tax season

With the United State tax season in high gear, threat actors have sprung into action with a recent tax document phishing scam that abuses TypeForm forms to create convincing login forms used as part of their phishing scams and steal the login credentials. According to researchers from email security firm ArmorBlox, the TypeForm form includes a blurred out 2020 W-2 tax document pretending to be secured by the Adobe Secure Document service and request that the visitor enters their email address and password to log in and retrieve the W-2 document. Users are advised to scrutinize unexpected emails, especially those containing links to shared documents or that prompt you to log in to a service.

See the full report here: https://www.bleepingcomputer.com/news/security/watch-out-for-this-w-2-phishing-scam-targeting-the-2021-tax-season/

SAP fixes critical bugs in Business Client, Commerce, and NetWeaver - BleepingComputer

On Tuesday, the SAP Product Security Team shared information about vulnerabilities discovered and fixed in company products. In total, there are 19 security notes, five of them being updates to previous bugs.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-fixes-critical-bugs-in-business-client-commerce-and-netweaver/

Security Bug Allows Attackers to Brick Kubernetes Clusters

A security researcher found a bug (CVE-2021-20291) in containers/storage that leads to a Denial of Service (DoS) of the container engines CRI-O and Podman when pulling a malicious image from a registry. Through this vulnerability, malicious actors could jeopardize any containerized infrastructure that relies on these vulnerable container engines, including Kubernetes and OpenShift. Patches for the bug were issued in version 1.28.1 of containers/storage; CRI-O version v1.20.2; and Podman version 3.1.0. Admins should update as soon as possible.

See the full report here: https://threatpost.com/security-bug-brick-kubernetes-clusters/165413/

New WhatsApp Bugs Could've Let Attackers Hack Your Phone Remotely

Facebook-owned WhatsApp recently addressed two security vulnerabilities in its messaging app for Android that could have been exploited to execute malicious code remotely on the device and even compromise encrypted communications. The flaw (CVE-2021-24027) leverages Chrome's support for content providers in Android (via the "content://" URL scheme) and a same-origin policy bypass in the browser (CVE-2020-6516), thereby allowing an attacker to send a specially-crafted HTML file to a victim over WhatsApp, which, when opened on the browser, executes the code contained in HTML file. WhatsApp users are recommended to update to version 2.21.4.18 to mitigate the risk associated with the flaws.

See the full report here: https://thehackernews.com/2021/04/new-whatsapp-bug-couldve-let-attackers.html

Google Chrome 90 released with HTTPS as the default protocol - BleepingComputer

Google has released Chrome 90 today, April 14th, 2021, to the Stable desktop channel, and it includes security improvements, a new AV1 encoder, and the default protocol changed to HTTPS. Chrome 90 fixes 37 security bugs. Windows, Mac, and Linux desktop users can upgrade to Chrome 90 by going to Settings -> Help -> About Google Chrome. The browser will then automatically check for the new update and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-90-released-with-https-as-the-default-protocol/

100,000 Google Sites Used to Install SolarMarket RAT

Hackers are using search engine optimization (SEO) tactics to lure business users to more than 100,000 malicious Google sites that seem legitimate and install a remote access trojan (RAT), tracked as SolarMarker, to gain a foothold on a network and later infect systems with ransomware, credential-stealers, banking trojans, and other malware. SEO tactics direct users searching for common business forms such as invoices, receipts, or other templates to hacker-controlled Google-hosted domains. This is an increasingly common trend with malware delivery, which speaks to the improved security of applications such as browsers that handle vulnerable code.

See the full report here: https://threatpost.com/google-sites-solarmarket-rat/165396/