Threat Intelligence Bulletin: 04/30/2021 - 05/06/2021

Breaking News: 2021-04-30 - 2021-05-06

ISC urges updates of DNS servers to wipe out new BIND vulnerabilities

The Internet Systems Consortium (ISC) has released an advisory outlining three vulnerabilities in BIND 9 that could impact the safety of DNS systems. The vulnerabilities are tracked as CVE-2021-25216, CVE-2021-25215 and CVE-2021-25214. Although there is no evidence of active exploitation for any of the bugs, . users are advised to update to BIND 9.11.31, 9.16.15, and 9.17.12.

See the full report here: https://www.zdnet.com/article/isc-urges-updates-of-dns-servers-to-wipe-out-new-bind-vulnerabilities/

Your stolen ParkMobile data is now free for wannabe scammers - BleepingComputer

The account information for almost 22 million ParkMobile customers is now in the hands of hackers and scammers after the data was released for free on a hacking forum. On March 26th, 2021, ParkMobile issued a security notification on their website stating that one of their services was hacked and unauthorized people gained access to customer data. This data has been released as a 4.5 GB CSV text file containing the account information for 21,887,299 ParkMobile customers. It includes customers' first and last names, initials, mobile numbers, email addresses, user names, bcrypt hashed passwords, mailing address, license plate numbers, and vehicle information.

See the full report here: https://www.bleepingcomputer.com/news/security/your-stolen-parkmobile-data-is-now-free-for-wannabe-scammers/

First Horizon bank online accounts hacked to steal customers’ funds - BleepingComputer

Bank holding company First Horizon Corporation disclosed the some of its customers had their online banking accounts breached by unknown attackers earlier this month. They discovered the attack in mid-April 2021 where threat actors targeted the customers' online bank accounts using previously stolen credentials and by exploiting a vulnerability in third-party software. They were also able to gain access to customer information stored in the breached accounts and drain funds from some of them before their intrusion was discovered. The firm has reimbursed all the impacted customers for their stolen funds.

See the full report here: https://www.bleepingcomputer.com/news/security/first-horizon-bank-online-accounts-hacked-to-steal-customers-funds/

Suspected Chinese state hackers target Russian submarine designer - BleepingComputer

Hackers suspected to work for the Chinese government have used a new malware called PortDoor to infiltrate the systems of an engineering company that designs submarines for the Russian Navy. The threat actor targeted Rubin Central Design Bureau for Marine Engineering in Saint Petersburg, a defense contractor that designed most of Russia’s nuclear submarines. They used a spear-phishing email specifically crafted to lure the general director of the company into opening a malicious document.

See the full report here: https://www.bleepingcomputer.com/news/security/suspected-chinese-state-hackers-target-russian-submarine-designer/

Python also impacted by critical IP address validation vulnerability - BleepingComputer

The Python standard library IP address also suffers from the critical IP address validation vulnerability identical to the flaw that was reported in the "netmask" library earlier this year. The researchers who had discovered the critical flaw in netmask, also discovered the same flaw in this Python module and have procured a vulnerability identifier, tracked as CVE-2021-29921.

See the full report here: https://www.bleepingcomputer.com/news/security/python-also-impacted-by-critical-ip-address-validation-vulnerability/

Windows 10 Device Manager update makes removing drivers easier - BleepingComputer

​The Windows 10 Device Manager is getting a helpful upgrade that makes it easier to uninstall a specific driver by seeing what devices are using it. When Windows 10 detects a new hardware component, it will attempt to find a compatible driver to initialize the hardware in the operating system. If a driver that is already being used can be used to initialize another device, Windows 10 will use it as well.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-device-manager-update-makes-removing-drivers-easier/

Google Chrome is getting a new Progressive Web App feature - BleepingComputer

As more companies and independent developers are switching to Progressive Web Apps as their preferred solution for native apps, Microsoft and Google are slowly adding new PWA features to improve the web apps experience on Windows and other platforms. Progressive web app, or PWA, is the latest web technology that allows anyone to use websites as native mobile or desktop apps.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-is-getting-a-new-progressive-web-app-feature/

Office 365 security baseline adds macro signing, JScript protection - BleepingComputer

Microsoft has updated the security baseline for Microsoft 365 Apps for enterprise (formerly Office 365 Professional Plus) to include protection from JScript code execution attacks and unsigned macros. Security baselines enable security admins to use Microsoft-recommended Group Policy Object (GPO) baselines to reduce the attack surface of Microsoft 365 Apps and boost the security posture of enterprise endpoints they run on.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-security-baseline-adds-macro-signing-jscript-protection/

Cryptocurrency Exchange Hotbit Hacked: Systems Paralyzed, 2 Million Users Affected – Exchanges Bitcoin News - Bitcoin News

Cryptocurrency exchange platform Hotbit suffered a serious cyber-attack on April 29, 2021, which led to the paralyzation of several basic services. The hackers were reportedly unsuccessful in gaining access to Hotbit’s wallets but did manage to compromise the platform’s user database. Thus, the Hotbit team has advised customers to disregard any communication from entities claiming to be representatives of the exchange.

See the full report here: https://news.bitcoin.com/cryptocurrency-exchange-hotbit-hacked-2-million-users/

NCape municipality battles devastating ransomware attack - ITWeb

The Nama Khoi Municipality in the Northern Cape Province is struggling to restore IT systems that were hit by a ransomware attack last year. According to Brandon Love, the municipality’s chief information officer, on Wednesday, 9 December 2020, the municipality’s ICT systems were compromised by a ransomware virus infection. He notes the virus, known as Pysa, is a file-encrypting ransomware virus, developed during the COVID-19 pandemic to target local government systems and healthcare systems.

See the full report here: https://www.itweb.co.za/content/8OKdWqDY581vbznQ

Experian API Leaks Most Americans' Credit Scores - Threatpost

A researcher is claiming that the credit scores of almost every American were exposed through an API tool used by the Experian credit bureau, which he said was left open on a lender site without even basic security protections. Experian, for its part, refuted concerns from the security community that the issue could be systemic.

See the full report here: https://threatpost.com/experian-api-leaks-american-credit-scores/165731/

Hackers Break Into Tesla Using a Drone Flying Over the Car - autoevolution

Two cybersecurity researchers have demonstrated a vulnerability that allowed them to unlock the doors of a Tesla Model X using nothing more than a drone and a Wi-Fi dongle to connect to the infotainment unit and launch the remote attack. Tesla rolled out update 2020.44 in late October 2020 to resolve the security problems, with the carmaker also offering a $31,500 bounty for disclosing the vulnerabilities.

See the full report here: https://www.autoevolution.com/news/hackers-break-into-tesla-using-a-drone-flying-over-the-car-160447.html

Illinois attorney general's office network hacked with ransomware - WAND

The personal data of citizens may have been exposed after a ransomware attack compromised the Illinois attorney general's office network, officials said. A press release Attorney General Kwame Raoul is notifying the public about the data breach following state law, which requires the public to be notified if their information may have been compromised. The attack was first discovered in the early hours of Saturday, April 10, when employees couldn't access the office network.

See the full report here: https://www.wandtv.com/news/illinois-attorney-generals-office-network-hacked-with-ransomware/article_1236263a-a934-11eb-91f6-23f08ecd3123.html

Over 40 Apps With More Than 100 Million Installs Found Leaking AWS Keys

BeVigil search engine identified over 40 apps with more than a cumulative 100 million downloads that had hardcoded private Amazon Web Services (AWS) keys embedded within them, putting their internal networks and their users' data at risk of cyberattacks. The findings are the result of an analysis of over 10,000 apps submitted to CloudSEK's BeVigil.

See the full report here: https://thehackernews.com/2021/05/over-40-apps-with-more-than-100-million.html

Health care giant Scripps Health hit by ransomware attack - BleepingComputer

Nonprofit health care provider Scripps Health in San Diego is currently dealing with a ransomware attack that forced the organization to suspend user access to its online portal and switch to alternative methods for patient care operations. Following the attack, patient services have been offline and some critical-care patients have been redirected to other hospitals, according to local media reports.

See the full report here: https://www.bleepingcomputer.com/news/security/health-care-giant-scripps-health-hit-by-ransomware-attack/

N3TW0RM ransomware emerges in wave of cyberattacks in Israel - BleepingComputer

A new ransomware gang known as 'N3TW0RM' is targeting Israeli companies in a wave of cyberattacks starting last week. Israeli media Haaretz reported that at least four Israeli companies and one nonprofit organization had been successfully breached in this wave of attacks. N3TW0RM has created a data leak site where they threaten to leak stolen files as a way to scare their victims into paying a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/n3tw0rm-ransomware-emerges-in-wave-of-cyberattacks-in-israel/

Pulse Secure fixes VPN zero-day used to hack high-value targets - BleepingComputer

Pulse Secure has fixed a zero-day vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance that is being actively exploited to compromise the internal networks of defense firms and govt agencies. The cybersecurity firm FireEye revealed that threat actors actively exploited the zero-day vulnerability, tracked as CVE-2021-22893, to deploy malware on Pulse Secure devices to steal credentials and provide backdoor access to compromised networks.

See the full report here: https://www.bleepingcomputer.com/news/security/pulse-secure-fixes-vpn-zero-day-used-to-hack-high-value-targets/

Hewlett Packard Enterprise Plugs Critical Bug in Edge Platform Tool

Hewlett Packard Enterprise (HPE) is urging customers to patch one of its premier edge application management tools that could allow an attacker to carry out a remote authentication bypass attack and infiltrate a customer’s cloud infrastructure. Rated critical, with a CVSS score of 9.8, the bug impacts all versions of HPE’s Edgeline Infrastructure Manager (EIM) before version 1.21.

See the full report here: https://threatpost.com/hewlett-packard-critical-bug-edge/165797/

PoC exploit released for Microsoft Exchange bug dicovered by NSA - BleepingComputer

Technical documentation and proof-of-concept exploit (PoC) code is available for a high-severity vulnerability in Microsoft Exchange Server that could let remote attackers execute code on unpatched machines. The flaw is for one of the four that the National Security Agency (NSA) reported to Microsoft and received a fix in April.

See the full report here: https://www.bleepingcomputer.com/news/security/poc-exploit-released-for-microsoft-exchange-bug-dicovered-by-nsa/

Apple fixes 2 iOS zero-day vulnerabilities actively used in attacks - BleepingComputer

Apple has released security updates that fix two actively exploited iOS zero-day vulnerabilities in the Webkit engine used by hackers to attack iPhones, iPads, iPods, macOS, and Apple Watch devices. These vulnerabilities are tracked as CVE-2021-30665 and CVE-2021-30663, and both allow arbitrary remote code execution (RCE) on vulnerable devices simply by visiting a malicious website. RCE vulnerabilities are considered the most dangerous as they allow attackers to target vulnerable devices and execute commands on them remotely.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-2-ios-zero-day-vulnerabilities-actively-used-in-attacks/

Three new malware families found in global finance phishing campaign

Researchers have found three new malware families used in a widespread phishing campaign entrenched in financial crime. FireEye's Mandiant cybersecurity team said the malware strains, dubbed Doubledrag, Doubledrop, and Doubleback, were detected in December 2020. The threat actors behind the malware are being tracked as UNC2529. Over 50 domains, in total, were used to manage the global phishing scheme. The lure emails contained links to URLs leading to malicious .PDF payloads and an accompanying JavaScript file contained in a .zip archive. The .js file contains a dropper to load malware into the infected systems.

See the full report here: https://www.zdnet.com/article/researchers-find-three-new-malware-families-used-in-global-finance-phishing-campaign/

New Windows 'Pingback' malware uses ICMP for covert communication - BleepingComputer

Security researchers have disclosed their findings on a novel Windows malware sample that uses Internet Control Message Protocol (ICMP) for its command-and-control (C2) activities. Dubbed "Pingback," this malware targets Microsoft Windows 64-bit systems, and uses DLL Hijacking to gain persistence.

See the full report here: https://www.bleepingcomputer.com/news/security/new-windows-pingback-malware-uses-icmp-for-covert-communication/

DOD expands bug disclosure program to all publicly accessible systems - BleepingComputer

US Department of Defense (DOD) officials today announced that the department's Vulnerability Disclosure Program (VDP) has been expanded to include all publicly accessible DOD websites and applications. DOD's VDP is led by the Department of Defense Cyber Crime Center (DC3), and it allows security researchers to search for and report any vulnerabilities affecting public-facing DOD information systems.

See the full report here: https://www.bleepingcomputer.com/news/security/dod-expands-bug-disclosure-program-to-all-publicly-accessible-systems/

Critical 21Nails Exim bugs expose millions of servers to attacks - BleepingComputer

Newly discovered critical vulnerabilities in the Exim mail transfer agent (MTA) software allow unauthenticated remote attackers to execute arbitrary code and gain root privilege on mail servers with default or common configurations. These security flaws are collectively known a 21Nails. All versions released before Exim 4.94.2 are vulnerable to attacks attempting to exploit the 21Nails vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-21nails-exim-bugs-expose-millions-of-servers-to-attacks/

Google Chrome adopts Windows 10 exploit protection feature - BleepingComputer

Google Chrome now hinders attackers' efforts to exploit security bugs on systems with Intel 11th Gen or AMD Zen 3 CPUs, running Windows 10 2004 or later. This is possible after the adoption of Intel's Control-flow Enforcement Technology (CET), supported on Windows 10 computers through an implementation known as Hardware-enforced Stack Protection which adds enhanced exploit protection to all compatible devices.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-adopts-windows-10-exploit-protection-feature/

U.S. Agency for Global Media data breach caused by a phishing attack - BleepingComputer

The United States Agency for Global Media (USAGM) has disclosed a data breach that exposed the personal information of current and former employees and their beneficiaries. USAGM is a US government agency whose mission is to "inform, engage, and connect people in support of freedom and democracy."

See the full report here: https://www.bleepingcomputer.com/news/security/us-agency-for-global-media-data-breach-caused-by-a-phishing-attack/

Twilio discloses impact from Codecov supply-chain attack - BleepingComputer

Cloud communications and VoIP platform Twilio has now disclosed that it was impacted by the recent Codecov supply-chain attack in a small capacity. Codecov had been a victim of a supply-chain attack that lasted for two months. Further investigation revealed that a small number of email addresses had likely been exfiltrated by an unknown attacker. The company has notified the impacted individuals and has taken steps to remediate the additional potential exposure.

See the full report here: https://www.bleepingcomputer.com/news/security/twilio-discloses-impact-from-codecov-supply-chain-attack/

Vulnerable Dell driver puts hundreds of millions of systems at risk - BleepingComputer

A collection of five flaws, collectively tracked as CVE-2021-21551, have been discovered in DBUtil, a driver from that Dell machines. The driver is installed and loaded during the BIOS update process and is unloaded at the next reboot. The flaws can be exploited to escalate privileges from a non-administrator user to kernel mode privileges. A video is published to demonstrate the vulnerability in DBUtil driver and achieve local privilege escalation on a target system. Dell has released an advisory to address the vulnerability and has recommended steps to remediate the flaws.

See the full report here: https://www.bleepingcomputer.com/news/security/vulnerable-dell-driver-puts-hundreds-of-millions-of-systems-at-risk/

Anti-Spam WordPress Plugin Could Expose Website User Data

An SQL injection vulnerability discovered in a WordPress plugin called “Spam protection, AntiSpam, FireWall by CleanTalk” could expose user emails, passwords, credit card data, and other sensitive information to an unauthenticated attacker. The vulnerability is tracked as CVE-2021-24295, which carries a high-severity CVSS vulnerability rating of 7.5 out of 10. Web admins are advised to update to the patched version of the plugin, 5.153.4.

See the full report here: https://threatpost.com/anti-spam-wordpress-plugin-expose-data/165901/

New Crypto-Stealer ‘Panda’ Spread via Discord

Researchers have discovered a new information stealer, dubbed as Panda Stealer, which is being spread through a worldwide spam campaign. The most recent wave of the spam campaign has had the biggest impact in Australia, Germany, Japan, and the U.S. PandaStealer is delivered in rigged Excel files masquerading as business quotes, bent on stealing victims’ cryptocurrency and other information. The researchers found 264 files similar to Panda Stealer on VirusTotal, with some of them being shared by threat actors on Discord. It is suspected those threat actors could be are using Discord to share the Panda Stealer build with each other.

See the full report here: https://threatpost.com/panda-stealer-crypto-wallets-discord/165898/

Cisco bugs allow creating admin accounts, executing commands as root - BleepingComputer

Cisco has fixed critical SD-WAN vManage and HyperFlex HX software security flaws that could enable remote attackers to execute commands as root or create rogue admin accounts. Cisco SD-WAN vManage Software vulnerabilities patched today could enable unauthenticated, remote attackers to execute arbitrary code or access sensitive information. The Cisco HyperFlex HX Command Injection security bugs make it possible for remote attackers with no privileges on the targeted servers to perform command injection attacks. Cisco's Product Security Incident Response Team (PSIRT) also confirmed that it is not aware of the active exploitation of these vulnerabilities in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-bugs-allow-creating-admin-accounts-executing-commands-as-root/