Threat Intelligence Bulletin: 04/16/2021 - 04/22/2021

ZeroFOX Early Warning: Monitoring Network Access Sales for Impending Ransomware Attacks

While law enforcement authorities scored big wins against the cybercriminal groups Egregor and Netwalker earlier this year, ransomware attacks remain a persistent threat to the security and reputation of organizations around the world. In March 2021 alone, ZeroFOX recorded over 160 targets who were “named and shamed” across 15 different data leak sites run by ransomware operators engaged in double extortion, an increasingly popular tactic of exfiltrating data before crypto-locking a network and threatening to release sensitive stolen information on the dark web. Yet the success of even an illicit business like ransomware still relies on the quality of its people for day-to-day operations. The first quarter of this year continues to show the outsized importance of specific buyers and sellers of network access, increasingly known as “Initial Access Brokers” (IABs), in the supply chain of ransomware attacks. Given the close business relationship between these brokers and ransomware operators, identifying a potential network access sale may give critical early warning for an impending ransomware attack.

Figure 1: Number of ransomware victims per family in March 2021

Recommendations

• Review network logs for communication potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

In recent years, ransomware operators are increasingly dependent on purchased initial access to gain a foothold into targeted networks, from which they can then perform the lateral movement to advance their access privileges and deploy their attacks. Using initial access brokers enables threat actors to avoid the time-consuming, laborious process of finding victims and attempting to hack them. Many cybercriminal groups have started affiliate programs, such as Avaddon on Exploit, to entice the best hacking talent to work with them on ransomware operations. A steady stream of initial access to various networks is negotiated in exchange for a cut of the profits from ransom payments. Another prolific operator, REvil, even provided close to a million dollars to XSS in September 2020 as part of a new recruitment drive for partners.

Figure 2: Advertisement on a popular hacking forum from the ransomware operators, Avaddon

ZeroFOX most frequently observes public-facing sellers offering access to Remote Desktop Protocols (RDP) and Virtual Private Networks (VPN). Many VPN and RDP offers also boast remote code execution (RCE) vulnerabilities with access to Citrix networking and other virtualization products. Often though the type of access is not specified. Instead the level of access that a buyer could gain, either user or admin, is shared to entice buyers. The most active access brokers often create running threads on forums like Exploit or XSS and update them with their latest accesses for sale at prices of thousands of dollars. They occasionally reveal their methods for acquiring valuable access, such as mass scanning techniques for unpatched systems with critical vulnerabilities and the abuse of popular penetration testing tools. Forum activity is only a small visible subset of the overall network access market, which operates more privately via direct messaging and covert channels like Telegram and Jabber.

Figure 3: A user on a popular hacking forum selling access to compromised networks

ZeroFOX closely monitors such forum threads and posts for any disclosed details that may unmask the targeted networks of these access sales. Hacker forum moderators typically demand at least a minimum amount of information on a target, including country, industry, and revenue. So far this year ZeroFOX has detected the suspected names of nearly two dozen corporate and government targets of network access sales through the careful correlation of threat actor language with open source research. Given the close business relationship between initial access brokers and ransomware operators, identifying a potential network access sale may give critical early warning for an impending ransomware attack. For example, in March 2021, ZeroFOX identified two network access targets for sale on XSS who succumbed to ransomware attacks by the Avaddon and REvil cybercriminal groups a few weeks later.

Conclusion

As more cybercriminals seek their own slice of the lucrative network access market, ZeroFOX anticipates additional opportunities to thwart the supply chain of ransomware attacks through early warning detection and reporting. Security teams should remain diligent in monitoring for potential signs of compromised account and network security, and ensure appropriate detection and incident response capabilities are in place.

Figure 4: Users on multiple forums selling access to compromised networks and accounts

Breach Disclosure: The Phone House Spain

The actor behind Babuk ransomware has advertised that they have compromised mobile communications retailer The Phone House Spain. The group claims they have stolen as many as 13 million customer data records, including 5.2 million email addresses.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 16th, the operators of Babuk ransomware posted a claim on their dark web victims page that they had compromised The Phone House Spain. The claim stated that they had stolen an "entire dump of their 10 Oracle databases" with customer details that include full name, date of birth, email address, and phone number, among other sensitive data. The data published so far includes 5.2 million email addresses, 58% of which were already present within the Have I Been Pwned website. Babuk is an actor that operates in "double extortion" tactics, meaning that during a breach they exfiltrate sensitive data from victims to use as extra leverage to entice payment of the ransom in addition to encrypting the victim's systems.

Figure 1. The listing for the Phone House Spain breach on Babuk's ransomware victims web page.

Figure 2. An except of the ransom note from the Babuk ransomware.

Breaking News: 2021-04-16 - 2021-04-22

BazarLoader Malware Abuses Slack, BaseCamp Clouds

The BazarLoader malware is leveraging worker trust in collaboration tools like Slack and BaseCamp, in email messages with links to malware payloads. According to researchers at Sophos, in the first campaign spotted, adversaries are targeting employees of large organizations with emails that purport to offer important information related to contracts, customer service, invoices, or payroll. The links inside the emails are hosted on Slack or BaseCamp cloud storage, targeting the companies that use these platforms. The links download and execute the malware on the victim’s machine.

See the full report here: https://threatpost.com/bazarloader-malware-slack-basecamp/165455/

Major BGP leak disrupts thousands of networks globally - BleepingComputer

A large BGP routing leak that occurred last night disrupted the connectivity for thousands of major networks and websites around the world. Although the BGP routing leak occurred in Vodafone's autonomous network based in India, it has impacted U.S. companies, including Google. This occurred from the network mistakenly advertising that it supported over 30,000 BGP prefixes or routes, when it didn't, causing the internet to flood this network with traffic that was not meant to go through it.

See the full report here: https://www.bleepingcomputer.com/news/security/major-bgp-leak-disrupts-thousands-of-networks-globally/

iOS Kids Game Morphs into Underground Crypto Casino

A kids’ game called “Jungle Run” that, until recently, was available in the Apple App store, was secretly a cryptocurrency-funded casino set up to scam people out of money. The app reviews included complaints from users that they were scammed out of deposits and payouts. Apple has now taken down the app.

See the full report here: https://threatpost.com/ios-kids-game-crypto-casino/165450/

HackBoss malware poses as hacker tools on Telegram to steal digital coins - BleepingComputer

The authors of a cryptocurrency-stealing malware, HackBoss, are distributing it over Telegram to aspiring cybercriminals under the guise of free malicious applications. The scheme tempts victims with the prospect of getting hacking tools, mostly for brute-forcing passwords for banking, dating, and social media accounts. Researchers found over 100 cryptocurrency wallet addresses associated with the HackBoss operation that received more than $560,000 since November 2018.

See the full report here: https://www.bleepingcomputer.com/news/security/hackboss-malware-poses-as-hacker-tools-on-telegram-to-steal-digital-coins/

Microsoft fixes Windows 10 bug that can corrupt NTFS drives - BleepingComputer

Microsoft has fixed a bug that could allow a threat actor to create specially crafted downloads that crash Windows 10 simply by opening the folder where they are downloaded. By simply changing to the folder in a command prompt, accessing it from the Run: field, opening it from File Explorer, Windows 10 would mark the drive as dirty and prompt you to reboot your computer and run chkdsk. Microsoft has classified this bug as a DDoS vulnerability and is tracking it as CVE-2021-28312 with the title 'Windows NTFS Denial of Service Vulnerability.'

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-windows-10-bug-that-can-corrupt-ntfs-drives/

Windows 10 update causing DNS and shared folder issues - BleepingComputer

As part of this week's April 2021 Patch Tuesday, Microsoft released the Windows 10 KB5001330 & KB5001337 cumulative updates to fix various security vulnerabilities and bugs discovered in the operating system. Since installing the updates, some corporate users have reported having issues with DNS resolution that prevent access to shared folders on servers when trying to access them by the server's name. If attempting to access the shared folder via the server's IP address, users can properly connect to the shared folders.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-update-causing-dns-and-shared-folder-issues/

Twitter is suffering from another worldwide outage today - BleepingComputer

Twitter is suffering a worldwide outage that started last night and is continuing into Saturday morning with erratic behavior and features partially working. The issues people are experiencing include searches not working, content not loading with a spinning circle, images not displaying, or even problems logging into the site. Twitter is aware of the problem and stated it is a problem on their servers.

See the full report here: https://www.bleepingcomputer.com/news/technology/twitter-is-suffering-from-another-worldwide-outage-today/

SysAdmin of Billion-Dollar Hacking Group Gets 10-Year Sentence

A high-level manager and systems administrator associated with the FIN7 threat actor has been sentenced to 10 years in prison, the U.S. Department of Justice announced Friday. A 35-year-old Ukrainian national, is said to have played a crucial role in a criminal scheme that compromised tens of millions of debit and credit cards, in addition to aggregating the stolen information, supervising other members of the group, and maintaining the server infrastructure that FIN7 used to attack and control victims' machines.

See the full report here: https://thehackernews.com/2021/04/sysadmin-of-billion-dollar-hacking.html

Amex cards removed from Google Pay due to expired certificate - BleepingComputer

An expired certificate has led to the repeated removal of linked American Express credit cards from user's Google Pay accounts. Starting yesterday, Google Pay users with linked American Express cards began receiving emails that Google removed their linked Amex card. In response to American Express card users, Amex's Twitter support account stated they were aware of the issue and are working on resolving it.

See the full report here: https://www.bleepingcomputer.com/news/google/amex-cards-removed-from-google-pay-due-to-expired-certificate/

Popular Codecov code coverage tool hacked to steal dev credentials - BleepingComputer

Codecov online platform for hosted code testing reports and statistics announced on Thursday that a threat actor had modified its Bash Uploader script, exposing sensitive information in customers’ continuous integration (CI) environment. The company learned of the compromise on April 1st, but the investigation determined that the first signs of this software supply-chain attack occurred in late January.

See the full report here: https://www.bleepingcomputer.com/news/security/popular-codecov-code-coverage-tool-hacked-to-steal-dev-credentials/

Kaspersky discovers zero-day exploit in Desktop Window Manager - IT Brief New Zealand

Security researchers at Kaspersky have discovered a zero-day exploit in Desktop Window Manager. The exploit was uncovered when the researchers analyzed the CVE-2021-1732 exploit used by the BITTER APT group. A zero-day vulnerability tracked as CVE-2021-28310 is an escalation of privilege (EoP) exploit found in Desktop Window Manager, allowing the attackers to execute arbitrary code on a victim’s machine. The exploit is likely used together with other browser exploits to escape sandboxes or obtain system privileges for further access. A patch for the CVE-2021-28310 was released on April 13th, 2021.

See the full report here: https://securitybrief.co.nz/story/kaspersky-discovers-zero-day-exploit-in-desktop-window-manager

Hackers are targeting Pakistani taxpayers with FBR emails containing harmful malware, warns FBR - TechJuice

The Federal Board of Revenue (FBR) on Saturday clarified that the revenue body had not sent any e-mail after taxpayers among others across Pakistan complained of receiving fake emails regarding the income tax defaulters list. In a statement, the Federal Board of Revenue (FBR) has warned the taxpayers that hackers are not only trying to fetch their sensitive financial data but attempting to hijack their systems through malware and spy on them. The tax authority asked the general citizens to be cautious and not to download any attachments sent through such fake emails since they comprise phishing and spamming attempts intended to infect the users with harmful viruses & malware.

See the full report here: https://www.techjuice.pk/hackers-are-targeting-pakistani-taxpayers-with-fbr-emails-containing-harmful-malware-warns-fbr/

Domino's India database likely hacked, 1 million credit card details leaked along with mail IDs, cell numbers - India Today

Popular pizza outlet Domino’s India seems to have fallen victim to a cyber attack. According to Alon Gal co-founder of an Israeli cybercrime intelligence, the hackers have access to Domino’s India 13TB of internal data which includes employee details of over 250 employees across verticals such as IT, Legal, Finance, Marketing, Operations, etc. The hackers claim to have got all customer details and 18 crore order details which include customer's names, phone numbers, email IDs, delivery address, payment details including more than 10 lakh credit card details used to purchase on Domino’s India app. For now, Domino's India has neither confirmed nor denied that the data of its consumers have been stolen or leaked from its servers.

See the full report here: https://www.indiatoday.in/technology/news/story/domino-s-india-database-likely-hacked-1-million-credit-card-details-leaked-along-with-mail-ids-cell-numbers-1792305-2021-04-18

Attackers Target ProxyLogon Exploit to Install Cryptojacker - Threatpost

Cryptojacking can be added to the list of threats that face any unpatched Exchange servers that remain vulnerable to the now-infamous ProxyLogon exploit, new research has found. Researchers discovered the threat actors using Exchange servers compromised using the highly publicized exploit chain, which suffered a barrage of attacks from advanced persistent threat (APT) groups to infect systems with everything from ransomware to webshells to host Monero cryptomining malware, according to a report posted online this week by SophosLabs.

See the full report here: https://threatpost.com/attackers-target-proxylogon-cryptojacker/165418/

Medtronic partners with cybersecurity startup Sternum to protect its pacemakers from hackers - TechCrunch

Medtronic, a medical device company, has been in hot water over the last couple of years because its pacemakers were getting hacked through their internet-based software updating systems. But in a new partnership with Sternum, an IoT cybersecurity startup based in Israel, Medtronic has focused on resolving the issue. Sternum’s solution allows medical devices to protect themselves in real-time. They created autonomous security that operates from within the device that can defend it without the need to update and patch vulnerabilities.

See the full report here: https://techcrunch.com/2021/04/16/medtronic-partners-with-sternum-iot-cybersecurity-startup-to-protect-its-pacemakers-from-hackers/

US sanctions cryptocurrency addresses linked to Russian cyberactivities - BleepingComputer

The US government sanctioned this week twenty-eight cryptocurrency addresses allegedly associated with entities or individuals linked to Russian cyberattacks or election interference. The US government introduced these sanctions in an executive order by President Biden that formally announced that the Russian SVR, and its hacking division, commonly referred to as APT29, The Dukes, or Cozy Bear, were behind the recent SolarWinds supply chain attack.

See the full report here: https://www.bleepingcomputer.com/news/security/us-sanctions-cryptocurrency-addresses-linked-to-russian-cyberactivities/

Discord Nitro gift codes now demanded as ransomware payments - BleepingComputer

In a novel approach to ransom demands, new ransomware calling itself 'NitroRansomware' encrypts victim's files and then demands a Discord Nitro gift code to decrypt files. When purchasing a Nitro subscription, users can apply it to their account or buy it as a gift for another person. When gifting, the purchaser will be given an URL, which can then be given to another Discord user.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-nitro-gift-codes-now-demanded-as-ransomware-payments/

WordPress to automatically disable Google FLoC on websites - BleepingComputer

Google introduced a new ad tracking technology called Federated Learning of Cohorts, or FLoC, that uses a web browser to anonymously place users into interest or behavioral buckets based on how they browse the web. WordPress announced today that they plan on treating Google's new FLoC tracking technology as a security concern and plans to block it by default on WordPress sites.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-to-automatically-disable-google-floc-on-websites/

Virus alert! WhatsApp Pink link will give hackers control of your phone, don’t open it at any cost - 91mobiles

A new malware link disguised as a custom WhatsApp theme is making the rounds on WhatsApp group chats. Dubbed as WhatsApp Pink, the malware link claims to change your WhatsApp theme from the original green to pink. However, according to cybersecurity experts, it’s a virus that allows cybercriminals to hack and take control of your phone. Once a user clicks on the link, it takes them to an APK download page. The APK is disguised as an official WhatsApp update contains the virus. If a user installs the APK, they give hackers access to their phone.

See the full report here: https://www.91mobiles.com/hub/whatsapp-pink-link-hack-scam-what-is-it/

Lazarus Group Uses New Tactic to Evade Detection

Security researchers at Malwarebytes have observed North Korea-affiliated advanced persistent threat actor Lazarus Group employing a new technique to deliver malware while evading security tools. One of its newest methods involves embedding a malicious HTML Application (HTA) file within a compressed zlib file, within a PNG file. During run time, the PNG file is converted into a BMP file format. Because the BMP file is uncompressed, converting from PNG to BMP automatically decompresses the malicious zlib object. Because the malicious object is compressed within the PNG image, it bypasses static detection.

See the full report here: https://www.darkreading.com/lazarus-group-uses-new-tactic-to-evade-detection/d/d-id/1340728

Valve finally fixes CS:GO exploit that could give hackers control of PCs - Eurogamer.net

Valve has finally fixed a security vulnerability in Counter-Strike: Global Offensive that could be used by hackers to gain remote control of a player's PC - an issue the company had reportedly known about for two years by the time its existence was publicized last week. News of the exploit was circulated in a tweet by the not-for-profit reverse-engineering group The Secret Club.

See the full report here: https://www.eurogamer.net/articles/2021-04-19-valve-finally-fixes-cs-go-exploit-that-could-give-hackers-control-of-pcs

Chinese military seen behind Japan cyber attacks, NHK says

China's military is thought to have instructed a hacker group to conduct cyberattacks on nearly 200 Japanese research institutions and firms, public broadcaster NHK reported, citing unidentified people in a police investigation. Investigators believe the cyberattacks were carried out by a group known as Tick under the instruction of the People's Liberation Army.

See the full report here: http://www.straitstimes.com/asia/east-asia/chinese-military-seen-behind-japan-cyber-attacks-nhk-says

Malware That Spreads Via Xcode Projects Now Targeting Apple's M1-based Macs

A Mac malware campaign targeting Xcode developers has been retooled to add support for Apple's new M1 chips and expand its features to steal confidential information from cryptocurrency apps. XCSSET came into the spotlight in August 2020 after it was found to spread via modified Xcode IDE projects, which, upon the building, were configured to execute the payload. The malware repackages payload modules to imitate legitimate Mac apps, ultimately responsible for infecting local Xcode projects and injecting the primary payload to execute when the compromised project builds.

See the full report here: https://thehackernews.com/2021/04/malware-spreads-via-xcode-projects-now.html

Geico data breach exposed customers' driver's license numbers - BleepingComputer

Car insurance provider Geico has suffered a data breach where threat actors stole the driver's licenses for policyholders for over a month. Geico is the second-largest car insurance company in the United States, with over 17 million policies for more than 28 million vehicles.

See the full report here: https://www.bleepingcomputer.com/news/security/geico-data-breach-exposed-customers-drivers-license-numbers/

Coding error allowed attackers to delete Facebook live video

Facebook has resolved a coding issue in live video services that allowed attackers to effectively delete content without the consent of owners. On April 17, a security researcher published an advisory explaining how the vulnerability worked, together with Proof-of-Concept (PoC) code able to trigger an attack.

See the full report here: https://www.zdnet.com/article/coding-error-allowed-attackers-to-delete-facebook-live-video/

Mozilla Fixes Firefox Flaw That Allowed Spoofing of HTTPS Browser Padlock

The Mozilla Foundation fixed a flaw in its Firefox browser that allowed spoofing of the HTTPS secure communications icon, displayed as a padlock in the browser address window. Successful exploitation of the flaw could have allowed a rogue website to intercept browser communications. The patch was part of the non-profit’s Monday update to Firefox 88 and its corporate Firefox ESR 78.10 browser and its Thunderbird 78.10 email client. In total, Firefox 88 addresses 13 browser bugs, six of which are rated high-severity.

See the full report here: https://threatpost.com/mozilla-fixes-firefox-flaw/165501/

SonicWall warns customers to patch 3 zero-days exploited in the wild - BleepingComputer

Security hardware manufacturer SonicWall is urging customers to patch a set of three zero-day vulnerabilities affecting both its on-premises and hosted Email Security products. The company said it's "imperative" that organizations using its Email Security hardware appliances, virtual appliances, or software installations on Microsoft Windows Server machines immediately upgrade to a patched version.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-warns-customers-to-patch-3-zero-days-exploited-in-the-wild/

Microsoft partially fixes Windows 7, Server 2008 vulnerability - BleepingComputer

Microsoft has silently issued a partial fix for a local privilege escalation (LPE) vulnerability impacting all Windows 7 and Server 2008 R2 devices. This LPE vulnerability stems from the misconfiguration of two service registry keys and it allows local attackers to escalate privileges on any fully patched systems.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-partially-fixes-windows-7-server-2008-vulnerability/

Pulse Secure VPN zero-day used to hack defense firms, govt orgs - BleepingComputer

Pulse Secure has shared mitigation measures for a zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited in attacks against worldwide organizations and focused on US Defense Industrial Base (DIB) networks. To mitigate the vulnerability tracked as CVE-2021-22893, Pulse Secure advises customers with gateways running PCS 9.0R3 and higher to upgrade the server software to the 9.1R.11.4 release.

See the full report here: https://www.bleepingcomputer.com/news/security/pulse-secure-vpn-zero-day-used-to-hack-defense-firms-govt-orgs/

REvil gang tries to extort Apple, threatens to sell stolen blueprints - BleepingComputer

The REvil ransomware gang asked Apple to "buy back" stolen product blueprints to avoid having them leaked on REvil's leak site before today's Apple Spring Loaded event. REvil tried to extort Apple only after Quanta Computer, a leading notebook manufacturer and one of Apple's business partners, refused to communicate with the ransomware gang or pay the ransom demanded after they allegedly stole "a lot of confidential data" from Quanta's network.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/

Fake Microsoft Store, Spotify sites spread info-stealing malware - BleepingComputer

Attackers are promoting sites impersonating the Microsoft Store, Spotify, and an online document converter that distribute malware to steal credit cards and passwords saved in web browsers. The attack was discovered by cybersecurity firm ESET who issued a warning yesterday on Twitter to be on the lookout for the malicious campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-microsoft-store-spotify-sites-spread-info-stealing-malware/

Microsoft disables Google's FLoC tracking in Microsoft Edge, for now - BleepingComputer

Microsoft has disabled Google's controversial FLoC browser-based tracking feature in their Chromium-based Microsoft Edge browser. This month, Google began testing a new tracking platform called Federated Learning of Cohorts, or FLoC, that places users in anonymous buckets, or cohorts, based on their interest and browsing behavior. As FLoC is a Google browser-based feature, it is currently only supported on Google Chrome and Chromium-based browsers through a component named 'Federated Learning of Cohorts.'

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-googles-floc-tracking-in-microsoft-edge-for-now/

Novel Email-Based Campaign Targets Bloomberg Clients with RATs

Security researchers have discovered a new e-mail-based campaign by an emerging threat actor who aims to spread various remote access trojans (RATs) to a very specific group of targets who use Bloomberg’s industry-based services. Attacks dubbed ‘Fajan’, start in the form of what looks like targeted emails to clients of Bloomberg BNA. The emails claim to contain an invoice for clients but instead include an attached Excel spreadsheet that contains macro code to either download the next infection stage or drops and run the final payload, which is always a Javascript- or VB-based RAT that allows the attacker to take control over the infected system using HTTP over a non-standard TCP port.

See the full report here: https://threatpost.com/email-campaign-targets-bloomberg-clients/165514/

Foreign Spies Target British Nationals With Fake Social Media Profiles

British security agency MI5 has launched a new education campaign to warn potential victims of the attacks. Thousands of UK nationals have been targeted by fake LinkedIn profiles linked to hostile states in the past five years, British security agency MI5 reports. The education campaign called 'Think Before You Link,' informs potential targets that foreign spies are using the website to link up with workers who may have access to sensitive information.

See the full report here: https://www.darkreading.com/attacks-breaches/foreign-spies-target-british-nationals-with-fake-social-media-profiles/d/d-id/1340767

Facebook uncovers Palestinian government officials targeted with malware - ZDNet

Facebook has published new findings that unveil two Palestinian organizations that have been running cyber espionage campaigns against government officials, student groups, and security forces. The two groups both used fake and compromised social media accounts posing primarily as young women, and also as Fatah or Hamas supporters, various military groups, journalists, and activists to build trust with people in order to trick them into installing malicious software. The threat actor used fully functional custom iOS surveillanceware labeled as Phenakite that was capable of stealing sensitive user data from iPhones without requiring the devices to be jailbroken.

See the full report here: https://www.zdnet.com/article/facebook-uncovers-palestinian-government-officials-targeted-with-malware/

Linux bans University of Minnesota for committing malicious code - BleepingComputer

Linux kernel project maintainers have imposed a ban on the University of Minnesota (UMN) from contributing to the open-source Linux project. The move comes after a group of UMN researchers were caught submitting a series of malicious code commits, or patches that deliberately introduced security vulnerabilities in the official Linux codebase, as a part of their research activities. Additionally, the project maintainers have decided to revert all code commits that were ever submitted from @umn.edu email addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-bans-university-of-minnesota-for-committing-malicious-code/

Massive Qlocker ransomware attack uses 7zip to encrypt QNAP devices - BleepingComputer

A massive ransomware campaign targeting QNAP devices worldwide is underway, and users are finding their files now stored in password-protected 7zip archives. The ransomware is called Qlocker and began targeting QNAP devices on April 19th, 2021. According to the reports from the users, the attackers use 7-zip to move files on QNAP devices into password-protected archives. After the devices are encrypted, users are left with a ransom note that includes a unique client key that the victims need to enter to log into the ransomware's Tor payment site.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-qlocker-ransomware-attack-uses-7zip-to-encrypt-qnap-devices/

Logins for 1.3 million Windows RDP servers collected from hacker market - BleepingComputer

​The login names and passwords for 1.3 million current and historically compromised Windows Remote Desktop servers have been leaked by UAS, the largest hacker marketplace for stolen RDP credentials. Since December 2018, a group of security researchers have had secret access to the database for the UAS marketplace and have been quietly collecting sold RDP credentials for almost three years. The listed RDP servers are from all over the world, including government agencies from sixty-three countries, with Brazil, India, and the United States being the top three.

See the full report here: https://www.bleepingcomputer.com/news/security/logins-for-13-million-windows-rdp-servers-collected-from-hacker-market/