zerofox logo
Advisories

Threat Intelligence Bulletin: 04/23/2021 - 04/29/2021

|by Alpha Team

banner image

Breach Disclosure: ShopBack

In September 2020, ShopBack, a cashback reward program available across the Asia-Pacific, suffered a data breach. The leaked database was posted on several popular hacker forums and contains over 20 million records including email addresses, contact numbers, geolocation, names and salted SHA-1 hashed passwords. The breached data totals almost 1.45gb.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On November 11th, 2020, a threat actor under the aliases of "Polaris” and "LeakedInsta" posted a data breach package targeting the organization ShopBack. The database was advertised within several forums including XSS and RaidForums. Credit was also given to ShinyHunters within these posts, indicating the well known data breach brokers were involved in obtaining or the distribution of this data.

Shortly after the breached data was made available, ShopBack responded to the news, and forced a password change for all users of the platform.


Figure 1: RaidForums post advertising the breached data

Breach Disclosure: BigBasket

On April 25, 2020, threat actors published data obtained from the October 2020 BigBasket data breach on a cybercriminal underground forum. The data consisted of 20 million compromised records such as client names, email addresses, and hashed passwords. A BigBasket spokesperson confirms that the published dataset only contains information from the October breach.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

BigBasket, an India-based grocery delivery service, suffered a data breach in October 2020 which resulted in 20 million user credentials compromised. The ShinyHunters threat actors published a link to the breached data on a cybercriminal underground forum as well as a list of database column headers for each data type. ShinyHunters is a well-known threat actor group involved with breaching organizations and publishing stolen data on cybercriminal marketplaces.


Figure 1: Screenshot of BigBasket post by ShinyHunters

The full list of columns within the breached database were included within the post advertising the data for download.

id, created_on, updated_on, created_by_id, updated_by_id, email, password, first_name, last_name, dob, photo, is_staff,
is_active, is_superuser, last_login, registered_ip, last_logged_ip, date_joined, hub_id, address2, zipcode, location,
mobile_no, phone_no, activation_key, oac_code, news_status, about_us, address1, city, is_mapped, is_validated, area,
is_cashback_eligible, apin, pin, validated_email, validated_mobile_no, validated_address, manual_override_hub,
member_type_id, cookie_value, week_id, mapped_on, residential_complex, mapped_by_id, landmark, city_id, last_order_id,
date_of_first_order, date_of_last_order, num_of_orders, first_order_id, maximum_order_delivered_value,
total_order_orig_value, total_order_orig_num_items, total_order_delivered_num_items, total_order_invoice_value,
total_order_delivered_value, maximum_order_invoice_value, total_order_delivered_num_qty, total_order_orig_num_qty,
email_domain, credit, total_store_brand_order_value, channel, total_fv_order_value, last_fv_order_date,
last_meat_order_date, last_store_brand_order_date, total_meat_order_value, source_id, ref_id, email2,
phone_no2, password_changed_time, is_mobile_no_validated, is_email_validated

Figure 2: Full list of database columns within the breached data

Breach Disclosure: MangaDex

In March 2021, MangaDex, a website that hosts advertisement-free manga comics, disclosed a data breach that resulted in the compromise of nearly 3 million records. Threat actors posted the leaked database on cybercriminal marketplaces in early April 2021. The data set included users' email addresses, usernames, and bcrypt password hashes.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 6, 2021, an actor using the alias "YuriSeb0" posted a data breach package targeting MangaDex on a cybercriminal marketplace forum. ZeroFOX researchers extracted nearly 3 million records with usernames, email addresses, and passwords.


Figure 1: Actor "YuriSeb0" posted a link to download the MangaDex data breach package

The breach occurred when threat actors gained unauthorized access to a MangaDex administrator account through "the reuse of a session token found in an old database leak through faulty configuration of session management." Shortly after discovering the incident, MangaDex took the website offline to patch vulnerable code and update the website. MangaDex strongly advises website users to change passwords.

Breach Disclosure: Descomplica

During March 2021, the Brazilian educational tech company, Descomplica, suffered a data breach. The breached data contained just under 5 million email addresses, and associated names, partial credit card information, purchase history, and password hashes.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 21st 2021, a threat actor under the alias "notpriv" posted a thread to a popular hacker forum containing breached data targeting the organization Descomplica, a provider of an online educational platform designed to prepare students for college entrance exams based in Brazil. Within the post, multiple download URLs were provided allowing other actors to retrieve SQL dump data provided by the threat actor. In a subsequent post, "notpriv" also claimed to have copies of Descomplica's private repositories held on Github.

The entire post contains download links for several SQL dump files for multiple database tables from Descomplica, including:

  • Account - Users
  • Marketing - Leads
  • Payment - CreditCards
  • Payment - AppleStoreSettlements
  • Payment - GooglePlaySettlements
  • public - users
  • public - social_media

The data includes sensitive information of Descomplica users including email addresses, names, transaction history, social media profiles and payment card information, which can be used to commit further fraud or social engineering attacks against impacted users.


Figure 1: Raidforums post distributing the breached data

Breach Disclosure: Jefit

On March 21, 2021, Jefit disclosed a data breach that took place in August 2020. 9 million user accounts were compromised in the breach which included email addresses, usernames, IP addresses, and passwords.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

In March 2021, home workout tracking application, Jefit suffered a data breach due to a security bug in a Jefit system. Threat actors gained access to nearly 9 million records of Jefit user information, including encrypted passwords. Jefit reported that financial data was not included in the data breach, as the company does not store customer payment information. Jefit strongly recommends that all users change their password to a more secure format.

In February 2021, an actor using the alias "N9XDZ" posted a data breach package targeting Jefit on a Russian-speaking cybercriminal marketplace forum. The dataset contains 2.8 million records of de-hashed credentials, specifically email and password pairs, and is circulating in other cybercriminal marketplace forums.


Figure 1: Actor "N9XDZ" posted a link to a Jefit data break package on a cybercriminal marketplace forum

Breach Disclosure: Emotet The FBI and the Dutch NHTCU have released over 4 million email addresses of accounts victimized by the Emotet trojan. According to HIBP, 39% of the victim accounts were already known from previous breaches.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details On 25 April, the FBI, in coordination with the Dutch National High Technical Crimes Unit (NHTCU) released 4,324,770 emails to the Have I Been Pwned (HIBP) data breach notification website. Due to the sensitive nature of the data, HIBP is not listing the accounts in a searchable format, but the site is sending out direct victim notifications. Alternately, if an administrator can provide proof of ownership of a domain they will be able to see if they are impacted via the HIBP notification service or by a domain search.
These accounts were released following a seizure of the botnet’s infrastructure by international law enforcement in eight countries on January 27th, and a measure remotely directing all copies of the malware to uninstall themselves from victim computers, also on April 25.

Breaking News: 2021-04-23 - 2021-04-29

Hackers Exploit VPN to Deploy SUPERNOVA malware on SolarWinds Orion

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed details of a new advanced persistent threat (APT) that's leveraging the Supernova backdoor to compromise SolarWinds Orion installations after gaining access to the network through a connection to a Pulse Secure VPN device. Interestingly, the adversary is said to have used valid accounts that had multi-factor authentication (MFA) enabled, rather than an exploit for a vulnerability, to connect to the VPN, thus allowing them to masquerade as legitimate teleworking employees of the affected entity. An investigation into the incident is ongoing. In the meantime, CISA is recommending organizations to implement MFA for privileged accounts, enable firewalls to filter unsolicited connection requests, enforce strong password policies, and secure Remote Desktop Protocol (RDP) and other remote access solutions.

See the full report here: https://thehackernews.com/2021/04/hackers-exploit-vpn-flaw-to-deploy.html

HashiCorp is the latest victim of Codecov supply-chain attack - BleepingComputer

Open-source software tools and Vault maker HashiCorp disclosed a security incident yesterday that occurred due to the recent Codecov attack. HashiCorp, a Codecov customer, has stated that the recent Codecov supply-chain attack aimed at collecting developer credentials led to the exposure of HashiCorp's GPG signing key. This incident has only impacted HashiCorp's SHA256SUM signing mechanism.

See the full report here: https://www.bleepingcomputer.com/news/security/hashicorp-is-the-latest-victim-of-codecov-supply-chain-attack/

Passwordstate password manager hacked in supply chain attack - BleepingComputer

Click Studios, the company behind the Passwordstate enterprise password manager, notified customers that attackers compromised the app's update mechanism to deliver malware in a supply-chain attack after breaching its networks. According to a notification email regarding the supply-chain attack sent to customers, malicious upgrades were potentially downloaded by customers between April 20 and April 22. Its customer list includes companies from a wide range of industry verticals, including government, defense, finance, aerospace, retail, automotive, healthcare, legal, and media.

See the full report here: https://www.bleepingcomputer.com/news/security/passwordstate-password-manager-hacked-in-supply-chain-attack/

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed. Homebrew is a free and open-source software package manager solution that allows the installation of software on Apple's macOS operating system and Linux. The discovered vulnerability would allow an attacker to inject arbitrary code into a cask and have it be merged automatically.

See the full report here: https://thehackernews.com/2021/04/critical-rce-bug-found-in-homebrew.html

New cryptomining malware builds an army of Windows, Linux bots - BleepingComputer

A recently discovered cryptomining botnet is actively scanning for vulnerable Windows and Linux enterprise servers and infecting them with Monero (XMRig) miner and self-spreader malware payloads. First spotted by Alibaba Cloud (Aliyun) security researchers in February (who dubbed it Sysrv-hello) and active since December 2020, the botnet has also landed on the radars of researchers at Lacework Labs and Juniper Threat Labs after a surge of activity during March.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cryptomining-malware-builds-an-army-of-windows-linux-bots/

A ransomware gang made $260,000 in 5 days using the 7zip utility - BleepingComputer

A ransomware gang has made $260,000 in just five days simply by remotely encrypting files on QNAP devices using the 7zip archive program. Starting on Monday, QNAP NAS users from all over the world suddenly found their files encrypted after a ransomware operation called Qlocker exploited vulnerabilities on their devices. The threat actors scanned for QNAP devices connected to the Internet and exploited them using the recently disclosed vulnerabilities. These exploits allowed the threat actors to remotely execute the 7zip archival utility to password protect all the files on victims' NAS storage devices.

See the full report here: https://www.bleepingcomputer.com/news/security/a-ransomware-gang-made-260-000-in-5-days-using-the-7zip-utility/

Microsoft pushes emergency fix for Windows 10 KB5001330 gaming issues - BleepingComputer

Microsoft has released an emergency fix for gaming issues introduced by the Windows 10 2004 and Windows 10 20H2 KB5001330 update. With this release of the KB5000842 of the Windows 10 preview cumulative update at the end of March and in the subsequent release of April's KB5001330 update, Windows 10 users have been experiencing performance issues when playing games.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-pushes-emergency-fix-for-windows-10-kb5001330-gaming-issues/

Fake Microsoft DirectX 12 site pushes crypto-stealing malware - BleepingComputer

Cybercriminals have created a fake Microsoft DirectX 12 download page to distribute malware that steals your cryptocurrency wallets and passwords. First discovered by a security researcher, when the bogus DirectX 12 installers are launched, they will quietly download malware from a remote site and execute it.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-microsoft-directx-12-site-pushes-crypto-stealing-malware/

Oscar-Bait, Literally: Hackers Abuse Nominated Films for Phishing, Malware

The anticipation surrounding the upcoming 93rd Academy Awards broadcast on Sunday is being used by scammers to trick people into giving up their credentials. In the hopes of watching an Oscar-nominated movie, users visited a site where they were shown the first few minutes of the film before being asked to register to continue watching. During the registration, to confirm their region of residence, the victim was asked to enter their bank card details. After some time, money was debited from the card, and as expected, the film did not continue to play.

See the full report here: https://threatpost.com/oscar-bait-hackers-nominated-phishing-malware/165583/

Low-Cost Carrier Booking Engine Radixx Suffers Malware Incident - Simple Flying

Radixx, a tech firm that collaborates with low-cost airlines, has shared that a malware attack caused an outage to carrier reservation systems this week. The company highlights that approximately 20 airlines have been impacted by the issue. According to the company, passenger information was not affected by the attack. The company is taking steps to stand up a new Radixx application server environment.

See the full report here: https://simpleflying.com/radixx-malware-incident/

A new Linux Botnet abuses IaC Tools to spread and other emerging techniques

Researchers from Trend Micro have spotted a new Linux botnet employing multiple emerging techniques among cyber-criminals, including the use of Tor proxies, the abuse of legitimate DevOps tools, and the removal or deactivation of competing malware. This Linux botnet downloads all the files it needs from the Tor network, including legitimate binaries like ss, ps, and curl. This is the first bot that abuses the infrastructure-as-code (IaC) tools, such as Ansible, Chef, and Salt Stack for spreading. The botnet is currently involved in cryptocurrency mining activity, it delivers the XMRig Monero (XMR) miner onto the infected machines.

See the full report here: https://securityaffairs.co/wordpress/117155/malware/linux-botnet-emerging-techniques.html

Volunteer-run pirate Manga website attacked, loses hashed passwords, has ‘nobody’ to fix the mess

A “scanlation” website for Manga has admitted that its members' credentials have been stolen and are now for sale online. MangaDex[.]org has been offline since March 21st when the site admitted to a security incident. Then on March 21st, the site went offline, save for a single index[.]html page offering occasional updates on the security incident. The database reportedly contains MangaDex username, email, bcrypt-hashed password, and first & last accessed IP addresses.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/04/26/mangadex_data_breach/

Hacker leaks 20 million alleged BigBasket user records for free - BleepingComputer

A threat actor has leaked approximately 20 million BigBasket user records containing personal information and hashed passwords on a popular hacking forum. BigBasket is a popular Indian online grocery delivery service that allows people to shop online for food and deliver it to their homes. A well-known seller of data breaches known as ShinyHunters posted a database for free on a hacker forum that he claims was stolen from BigBasket.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-leaks-20-million-alleged-bigbasket-user-records-for-free/

Emotet malware nukes itself today from all infected computers worldwide - BleepingComputer

Emotet, one of the most dangerous email spam botnets in recent history, is being uninstalled today from all infected devices with the help of a malware module delivered in January by law enforcement. The botnet's takedown is the result of an international law enforcement action that allowed investigators to take control of the Emotet's servers and disrupt the malware's operation. Emotet was used by the TA542 threat group (aka Mummy Spider) to deploy second-stage malware payloads, including QBot and Trickbot, onto its victims' compromised computers.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-nukes-itself-today-from-all-infected-computers-worldwide/

Windows 10 package manager can now remove any app from the command line - BleepingComputer

The Windows 10 package manager is getting some new and exciting features that allow you to manage any installed applications directly from the command line. Commonly used in Linux, package managers permit you to automate the installation, upgrading, and removal of applications from a command line. Even more helpful, package managers will automatically determine the dependencies of the program you are trying to install and install those dependencies as well.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-package-manager-can-now-remove-any-app-from-the-command-line/

Hackers are targeting Soliton FileZen file-sharing servers

Threat actors are exploiting two vulnerabilities in the popular file-sharing server FileZen, tracked as CVE-2020-5639 and CVE-2021-20655, to steal sensitive data from businesses and government organizations. FileZen servers allow users to share data according to their needs, overcoming problems with file size limits, content filters, and potential loss. Soliton addressed both flaws in FileZen solutions with the release of firmware versions V4.2.8 and V5.0.3.

See the full report here: https://securityaffairs.co/wordpress/117208/hacking/soliton-filezen-file-sharing-servers.html

Microsoft Defender now blocks cryptojacking malware using Intel TDT - BleepingComputer

Microsoft announced that Microsoft Defender for Endpoint, the enterprise version of its Windows 10 Defender antivirus, now comes with support for blocking cryptojacking malware using Intel's silicon-based Threat Detection Technology (TDT). Intel TDT couples low-level hardware telemetry collected from the CPU's performance monitoring unit (PMU) with machine learning to detect crypto-mining malware at execution time.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-now-blocks-cryptojacking-malware-using-intel-tdt/

Boffins found a bug in Apple AirDrop that could leak users’ personal info

Security researchers have discovered a privacy issue in Apple’s wireless file-sharing protocol Apple AirDrop that could expose user’s contact information, such as email addresses and phone numbers. The experts pointed out that an attacker could learn the phone numbers and email addresses of AirDrop users, even if it is not direct contact. The attackers need to have a Wi-Fi-capable device and physical proximity to a target that initiates the discovery process by opening the sharing pane on an iOS or macOS device.

See the full report here: https://securityaffairs.co/wordpress/117250/hacking/apple-airdrop-bug.html

Microsoft announces end of life for multiple .NET Framework versions - BleepingComputer

Microsoft announced that multiple .NET Framework versions (4.5.2, 4.6, and 4.6.1) signed using the legacy and insecure Secure Hash Algorithm 1 (SHA-1) will reach the end of support on April 26, 2022. After this date, Microsoft will no longer provide updates including security fixes or technical support for these versions. The only exception is the .NET Framework 4.6 version that ships with Windows 10 Enterprise LTSC 2015, which will get its support extended to October 2025, when the OS reaches its end of life.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-announces-end-of-life-for-multiple-net-framework-versions/

Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software

Nvidia has disclosed a group of security vulnerabilities in the Nvidia graphics processing unit (GPU) display driver, which could subject gamers and others to privilege-escalation attacks, arbitrary code execution, denial of service (DoS), and information disclosure. The Nvidia virtual GPU (vGPU) software also has a group of bugs that could lead to a range of similar attacks. Nvidia has released patches to mitigate all of the bugs, which uses can download through the Nvidia Driver Downloads page or, for the vGPU software update, through the Nvidia Licensing Portal.

See the full report here: https://threatpost.com/nvidia-security-bugs-gpu-vgpu/165597/

Apple fixes macOS zero-day bug exploited by Shlayer malware - BleepingComputer

Apple has fixed a zero-day vulnerability in macOS exploited in the wild by Shlayer malware to bypass Apple's File Quarantine, Gatekeeper, and Notarization security checks and download second-stage malicious payloads. Shlayer's creators have managed to get their malicious payloads through Apple's automated notarizing process before. In the past, Shlayer also used a two-year-old technique to escalate privileges and disable macOS' Gatekeeper to run unsigned second-stage payloads in a campaign detected by Carbon Black’s Threat Analysis Unit.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-fixes-macos-zero-day-bug-exploited-by-shlayer-malware/

US Urges Organizations to Implement MFA, Other Controls to Defend Against Russian Attacks

The FBI, the Department of Homeland Security (DHS), and the Cybersecurity & Infrastructure Security Agency (CISA) are urging US organizations to implement multifactor authentication and other defensive mechanisms to protect against threat activity by Russia's Foreign Intelligence Service (SVR). In a new joint advisory, the three entities warn government agencies, think tanks, information technology companies, and policy analysis organizations, in particular, to watch out for attacks from APT29, a threat group that they describe as working for the SVR.

See the full report here: https://www.darkreading.com/threat-intelligence/us-urges-organizations-to-implement-mfa-other-controls-to-defend-against-russian-attacks/d/d-id/1340832

Flubot Spyware Spreading Through Android Devices

Android mobile phone users across the U.K. are being targeted by text messages containing a particularly nasty piece of spyware called “Flubot,” according to the country’s National Cyber Security Centre. The U.K.’s National Cyber Security Centre (NCSC) has issued security guidance about how to identify and remove FluBot malware, while network providers including Three and Vodafone have also issued warnings to users over the text message attacks.

See the full report here: https://threatpost.com/flubot-spyware-android-devices/165607/

DC Police confirms cyberattack after ransomware gang leaks data - BleepingComputer

The Metropolitan Police Department has confirmed that they suffered a cyberattack after the Babuk ransomware gang leaked screenshots of stolen data. The Metropolitan Police Department, also known as the DC Police or MPD, is the primary law enforcement agency for Washington, DC, the US capital. This statement comes after the Babuk Locker gang said they had compromised the DC Police's networks and stolen 250 GB of unencrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/dc-police-confirms-cyberattack-after-ransomware-gang-leaks-data/

Reverb discloses data breach exposing musicians' personal info - BleepingComputer

Popular musical instrument marketplace Reverb has suffered a data breach after an unsecured database containing customer information was exposed online. Reverb is the largest online marketplace devoted to selling new, used, and vintage musical instruments and equipment.

See the full report here: https://www.bleepingcomputer.com/news/security/reverb-discloses-data-breach-exposing-musicians-personal-info/

Ransomware gang now warns they will leak new Apple logos, iPad plans - BleepingComputer

The REvil ransomware gang has mysteriously removed Apple's schematics from their data leak site after privately warning Quanta that they would leak drawings for the new iPad and new Apple logos. Earlier this month, the ransomware gang conducted an attack on Quanta, a Taiwan-based original design manufacturer (ODM) that helps manufacture the Apple Watch, Apple Macbook Air, and the Apple Macbook Pro. As part of this attack, the threat actors stole data belonging to the company, including drawings and schematics for Apple products.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-now-warns-they-will-leak-new-apple-logos-ipad-plans/

Hackers threaten to dump Presque Isle police files on dark web - Bangor Daily News

An unidentified cybergang associated with Avaddon Ransomware allegedly threatened to begin dumping the Presque Isle Police Department files on the dark web after accessing them if the police did not comply with a ransom request. In a notice posted on the dark web, the Avaddon-related gang claims it has the Presque Isle Police Department files including victim statements, personal data of employees, reports of criminal cases, data from officers’ computers, confidential data, records, and certificates.

See the full report here: https://bangordailynews.com/2021/04/27/news/aroostook/presque-isle-police-server-hacked-by-ransomware/

MangaDex discloses data breach after stolen database shared online - BleepingComputer

Manga scanlation site MangaDex disclosed a data breach last week after learning that the site's user database was privately circulating among threat actors. In March, MangaDex was hacked, and a threat actor claimed to have stolen the site's source code and its database. At this time, the database is privately being circulated and has not been publicly released. MangaDex has since been offline while they work on releasing a newer version of their site using source code that was not compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/mangadex-discloses-data-breach-after-stolen-database-shared-online/

Microsoft Edge to add automatic HTTPS option for all domains - BleepingComputer

Microsoft Edge will automatically redirect users to a secure HTTPS connection when visiting websites using the HTTP protocol, starting with version 92, coming in late July. By default, this new option will allow Edge users to switch from HTTP to HTTPS on websites that are likely to support the more secure protocol. However, users will also be able to configure the browser to upgrade all connections to HTTPS (Hypertext Transfer Protocol Secure) as the default internet communication protocol for all domains.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-edge-to-add-automatic-https-option-for-all-domains/

Minnesota University Apologizes for Contributing Malicious Code to the Linux Project

Researchers from the University of Minnesota apologized to the maintainers of the Linux Kernel Project on Saturday for intentionally including vulnerabilities in the project's code, which led to the school being banned from contributing to the open-source project in the future. The apology comes over a study into what's called "hypocrite commits," which was published earlier this February. The project aimed to deliberately add use-after-free vulnerabilities to the Linux kernel in the name of security research, apparently in an attempt to highlight how potentially malicious code could sneak past the approval process, and as a consequence, suggest ways to improve the security of the patching process.

See the full report here: https://thehackernews.com/2021/04/minnesota-university-apologizes-for.html

Microsoft Teams worldwide outage impacts user logins, chats - BleepingComputer

A worldwide Microsoft Teams outage is blocking users from logging into their accounts, and preventing those already logged in from sending and receiving messages. Microsoft is currently monitoring telemetry and investigating to identify the issues causing degraded chat functionality.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-worldwide-outage-impacts-user-logins-chats/

FBI shares 4 million email addresses used by Emotet with Have I Been Pwned - BleepingComputer

Millions of email addresses collected by Emotet botnet for malware distribution campaigns have been shared by the Federal Bureau of Investigation (FBI) as part of the agency’s effort to clean infected computers. Individuals and domain owners can now learn if Emotet impacted their accounts by searching the database with email addresses stolen by the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-shares-4-million-email-addresses-used-by-emotet-with-have-i-been-pwned/

Nintendo Sues Video-Game Pirates

Gaming giant Nintendo has filed a lawsuit against video-game piracy group ringleader Gary Bowser, a Canadian national behind Team Xecuter, which law enforcement said built and sold hacking devices that enabled consoles to play unauthorized versions of games. Bowser was arrested last October, along with his alleged Team Xecuter co-conspirators for targeting Nintendo Switch, the Nintendo 3DS, the Nintendo Entertainment Classic Edition, Sony PlayStation Classic, and Microsoft Xbox, the Department of Justice said.

See the full report here: https://threatpost.com/nintendo-sues-video-game-pirates/165646/

Feds Arrest an Alleged $336M Bitcoin-Laundering Kingpin

IRS says it has finally identified the Russian-Swedish administrator behind that long-running anonymizing system and charged him with laundering hundreds of millions of dollars worth of bitcoins, much of which was sent to or from dark web drug markets. In total, the IRS calculates that the threat actor allegedly took home roughly $8 million worth of bitcoin through the service, based on exchange rates at the times of each transaction.

See the full report here: https://www.wired.com/story/bitcoin-fog-dark-web-cryptocurrency-arrest/

Linux Kernel Bug Opens Door to Wider Cyberattacks

An information disclosure security vulnerability has been discovered in the Linux kernel, which can be exploited to expose information in the kernel stack memory of vulnerable devices. The bug (CVE-2020-28588) exists in the /proc/pid/syscall functionality of 32-bit ARM devices running Linux, according to Cisco Talos, which discovered the vulnerability. Users are encouraged to update these affected products as soon as possible to Linux Kernel versions 5.10-rc4, 5.4.66, and 5.9.8, according to the advisory.

See the full report here: https://threatpost.com/linux-kernel-bug-wider-cyberattacks/165640/

F5 BIG-IP Found Vulnerable to Kerberos KDC Spoofing Vulnerability

Cybersecurity researchers on Wednesday disclosed a new bypass vulnerability (CVE-2021-23008) in the Kerberos Key Distribution Center (KDC) security feature impacting F5 Big-IP application delivery services. The KDC Spoofing vulnerability allows an attacker to bypass the Kerberos authentication to Big-IP Access Policy Manager (APM), bypass security policies, and gain unfettered access to sensitive workloads. F5 has released a patch to address the weakness.

See the full report here: https://thehackernews.com/2021/04/f5-big-ip-found-vulnerable-to-kerberos.html

DigitalOcean data breach exposes customer billing information - BleepingComputer

Cloud hosting provider DigitalOcean has disclosed a data breach after a flaw exposed customers' billing information. An email sent out to affected customers states that a flaw allowed an unauthorized user to access customers' billing details between April 9th, 2021, and April 22nd, 2021. The exposed information includes s customer's billing name, billing address, payment card expiration, last four digits of credit card, and the payment card's bank name. The company has fixed the flaw and disclosed the breach to data protection authorities.

See the full report here: https://www.bleepingcomputer.com/news/security/digitalocean-data-breach-exposes-customer-billing-information/

Fourth time's a charm - OGUsers hacking forum hacked again - BleepingComputer

Popular hacking forum OGUsers has been hacked for its fourth time in two years, with hackers now selling the site's database containing user records and private messages. Hackers are selling the stolen OGUsers database for $3,000 on a popular hacking forum. A source familiar with the attack stated OGusers was hacked on April 11th, 2021, and that the attackers gained access to a complete dump of the forum database. This dump includes the user records and private messages for approximately 350,000 OGUsers members.

See the full report here: https://www.bleepingcomputer.com/news/security/fourth-times-a-charm-ogusers-hacking-forum-hacked-again/

Microsoft releases new APIs for managing Windows Update - BleepingComputer

New Microsoft Graph APIs released today in public preview allow developers and IT professionals to manage Windows 10 updates and expedite Windows 10 security updates in enterprise environments. Microsoft Graph is an API platform that helps developers create apps capable of accessing Microsoft 365, Windows 10, and Enterprise Mobility + Security data. By connecting deployment service capabilities with Microsoft Graph, app developers can easily build rich update management tools and extend these experiences with contextual user data.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-new-apis-for-managing-windows-update/

Chase Bank Phish Swims Past Exchange Email Protections

Threat actors are impersonating Chase Bank in two phishing attacks that can slip past Microsoft Exchange security protections in an aim to steal credentials from victims — by spoofing real-life customer scenarios. One of which claims to contain a credit card statement, while the other informs users that their online account access has been restricted due to unusual login activity. Both attacks managed to bypass two Microsoft Exchange security protections–Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MSDO)–on their way to customer inboxes.

See the full report here: https://threatpost.com/chase-bank-phish-sexchange-email-protections/165653/

SMS phishing scam lures Rogers customers with outage refunds - BleepingComputer

Cybercriminals target Rogers customers with a new SMS phishing campaign pretending to be refunded for last week's Canada-wide wireless outage. Last week, Rogers suffered a massive outage throughout Canada, preventing users from accessing wireless voice and data services. In response, Rogers promised a refund equivalent to a day of wireless service for affected customers. This week, customers began receiving smishing (SMS phishing) texts that pretend to be from Rogers, offering a refund for last week's outage. These texts state that Rogers is giving customers a $50.00 CAD refund, and to claim it, they need to visit the included link.

See the full report here: https://www.bleepingcomputer.com/news/security/sms-phishing-scam-lures-rogers-customers-with-outage-refunds/

Tags: weekly bulletin, all industries, global