zerofox logo
Advisories

Threat Intelligence Bulletin: 05/07/2021 - 05/13/2021

|by Alpha Team

banner image

Featured Advisory: Intelligence Requirements

The ZeroFOX Threat Intelligence Team would like to announce the addition of our customer-facing intelligence requirements. This will better facilitate transparency to our customers in the execution of our threat intelligence lifecycle, as well as providing an avenue for customers to provide input where they observe a potential gap or opportunity to better address their needs.

Discussion

Vision

Intelligence requirements are a vehicle by which ZeroFOX can focus our attention and effort to maximal and measurable effect. Intelligence requirements are clear, single focus questions that define a general intelligence need. They define a concept of what is needed as opposed to the specifics of how it is collected. As we roll out our product offerings, all of our CTI products and initiatives are going to tie directly back to one or more of these intelligence requirements.

ZeroFOX has grouped these intelligence requirements into seven categories: Personally Identifiable Information (PII) and Fraud; Deep/Dark Web and Criminal Underground; Brand; Vulnerabilities; Malware; Internet Infrastructure; and Geopolitical and Physical. Each of these categories has several requirements associated with them that we feel provides excellent coverage of the general threat landscape, and they will also be augmented by shorter-term priority intelligence requirements driven by urgent and time-limited initiatives such as high-risk vulnerabilities or on-demand investigations and requests for information.

Categories

PII and Fraud Intelligence Requirements

This category of intelligence requirements focuses on capturing activities related to stealing personal data, such as Social Security numbers, credit card numbers , compromised account credentials, or potentially other sensitive data that could be used for impersonation, identity theft, fraud, doxxing, or social engineering campaigns.

  1. What stolen data packages are being sold, traded or released that contains customer data?
  2. What sites, tools or data breaches are being used for doxxing or targeting against customers?
  3. What locations are being used to buy or sell stolen or illicitly obtained data, such as PII or FI (financial information)?
  4. Who and what are the biggest phishing and fraud actors and Tactics, Techniques, and Procedures (TTPs)?
  5. How do adversaries attack and exfiltrate PII/FI to sell?
  6. What TTPs are being used to socially engineer or leverage our customer's employees as knowing or unknowing insider threats?

Deep Dark Web and Criminal Underground Intelligence Requirements

This category of intelligence requirements focus on actors and activities on deep web, dark web, covert communication channels or clearnet criminal underground sites. This collection effort examines both actors and victims, as well as the sites and campaigns they operate. This category also encompasses Ransomware.

  1. Where are adversaries congregating and discussing TTPs?
  2. What is the most up to date list of active ransomware shame websites being used to publish victim data?
  3. What shops exist where adversaries can buy or sell illicit services or data related to other ZeroFOX Intelligence Requirements?
  4. Where are victims of malware and cybercriminal attacks discussed?
  5. What victims of malware and cybercriminal attacks can negatively impact our customers?

Brand Intelligence Requirements

Brand Protection is one of ZeroFOX’s core competencies. To that end, we look to protect our customers and their brands, monitoring social media, impersonation, critical dissent and threats. We are capturing who, where, and how adversaries act to diminish the brand of our customers.

  1. What are the most successful TTPs being used to target and impersonate brands?
  2. What policies and procedures are social networks implementing that affect how adversaries target our customer's brands?

Vulnerability Intelligence Requirements

Vulnerability awareness is a critical component of any company’s risk management and security posture. While ZeroFOX does not generally perform internal exploit and vulnerability research, we do seek to be a one-stop provider to collate major published vulnerability write ups and enrich them to better assist our customers to maintain peak preparedness and vigilance.

  1. What are the latest vulnerabilities being released publicly by vendors?
  2. Which vulnerabilities and exploits are being discussed and prioritized by the security research & adversary communities?
  3. Which exploits are being discussed and prioritized by the security research & adversary communities?

Malware Intelligence Requirements

This category of requirements centers on malware campaigns and the broader context of the CTI attack lifecycle. Advanced Persistent Threats (APTs), e-crime, and malware-as-a-service issues fall under this domain.

  1. What malware, adversaries and TTPs are being used to gain initial access to organizations?
  2. What malware, adversaries and TTPs are being used to pivot and escalate access within organizations?
  3. What malware, adversaries and TTPs are being used to exfiltrate data from organizations?
  4. What malware, adversaries and TTPs are being used to ransomware organizations?
  5. What infrastructure is being used to host, distribute, coordinate or provide failover for malware campaigns?

Internet Infrastructure Intelligence Requirements

Not all components of an attack are localized. Virtualization, bulletproof hosting, DNS attacks, and supply chain attacks are potential blind spots if the focus is limited narrowly on local resources. We take a broader look at infrastructure vectors and monitor how they could potentially affect our customers.

  1. What domain registrars typically host domains connected to malware, phishing or attack infrastructure?
  2. What Virtual Private Server (VPS) providers are most likely bulletproof hosters?
  3. What vulnerabilities are currently being exploited in internet facing infrastructure?
  4. What are the TTPs of actors trying to breach internet facing infrastructure for downloading databases to sell?

Geopolitical and Physical Intelligence Requirements

Not all threats are limited to the virtual world. ZeroFOX constantly observes the geopolitical climate as it relates to our customers, as well as physical threats to their offices or employees.

  1. What events or policies are affecting our specific customer's geographic areas of operation?
  2. What physical TTPs are affecting our customer's cybersecurity and physical posture?
  3. What active disinformation campaigns are our customer cohorts or geographic areas of operation facing?

Future Growth

However, there is always room for improvement, and in an effort to ensure that we appropriately address the needs of customers, external submissions will be accepted for consideration. Furthermore, in an effort to ensure that the requirements remain timely and relevant, the entire set will be actively curated and reviewed every quarter.

We are excited to begin this new initiative, and believe it is an excellent step in providing the best world-class coverage in our sector. We look forward to continuing to provide timely, meaningful, actionable, and far-reaching intelligence in a more improved, efficient, effective, and responsive way with these improvements.

Microsoft Patch Tuesday 05/11/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
  • Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for May 2021 contained 55 vulnerabilities in total, with:

  • 2 vulnerabilities rated as Critical
  • 35 vulnerabilities rated as High
  • 18 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified the proof-of-concept (PoC) for CVE-2021-28461, CVE-2021-26419, CVE-2021-31173 and CVE-2021-31936. However, at the time of reporting, no publicly available proofs-of-concept were found.

CVE-2021-31166

CVE-2021-31166 is a remote code execution vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the HTTP Protocol Stack. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim. Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.

The following products are impacted:

  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

CVE-2021-26419

CVE-2021-26419 is a memory corruption vulnerability in Microsoft Internet Explorer that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the scripting engine. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Internet Explorer 11 on Windows 10 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for x64-based Systems
  • Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1
  • Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows 8.1 for 32-bit systems
  • Internet Explorer 11 on Windows 8.1 for x64-based systems
  • Internet Explorer 11 on Windows RT 8.1
  • Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows Server 2012
  • Internet Explorer 11 on Windows Server 2012 R2
  • Internet Explorer 11 on Windows Server 2016
  • Internet Explorer 11 on Windows Server 2019
  • Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2
  • Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2

CVE-2021-31194

CVE-2021-31194 is a remote code execution vulnerability in Microsoft Windows that could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw in the OLE Automation. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1803 for 32-bit Systems
  • Windows 10 Version 1803 for ARM64-based Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

CVE-2021-28476

CVE-2021-28476 is a remote code execution vulnerability in Microsoft Windows that could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Hyper-V. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for x64-based systems
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

Other Microsoft Vulnerabilities

Other notable Microsoft vulnerabilities include CVE-2021-27068 and CVE-2020-24587. The flaw, CVE-2021-27068, exists in Visual Studio that could allow a remote authenticated attacker to execute arbitrary code on the system. Another bug, CVE-2020-24587, exists in Microsoft Windows that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system.

Users are advised to apply the latest security patches specified in Microsoft's May Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breach Disclosure: WedMeGood

Early in January of 2021, the Indian wedding planning platform, WedMeGood, suffered a data breach exposing 1.3 million customers, consisting of 41.5 GB of stolen data. The prolific hacking group, ShinyHunters, have claimed responsbility for this breach and have uploaded it to various hacking forums, resulting in this database being shared across multiple forums.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Although still not verified by WedMeGood, the supposed data of over 1.3 million users has been leaked online in various forums by the hacking group ShinyHunters. Sensitive user data consisting of the following was included in the data breach:

  • City
  • Gender
  • Full Name
  • Phone Number
  • Email Address
  • Password Hash
  • Booking Leads
  • Last Login Date
  • Account Creation Date
  • Facebook Unique ID Number
  • Vacation Description for Airbnb


Figure 1: Screenshot of ShinyHunters posting of WedMeGood database for free

In addition this to recent breach, WedMeGood was the victim of another data breach in October of 2020 resulting in the database being listed for sale on the same hacking forums as ShinyHunters posted on.

Breach Disclosure: DriveSure

In December 2020, car dealership service provider, DriveSure, suffered a data breach that resulted in the exposure of 3.6 million email addresses of US-based customers. The breach also included names, phone numbers, physical addresses, VIN numbers, odometer readings, and vehicle makes and models.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On January 4, 2021, threat actor "pompompurin" posted a data breach package targeting DriveSure on a cybercriminal marketplace network. The package consisted of a SQL database containing 3,229,101 records of customer information and a 5.93 GB zip archive of files and logs containing the breached data.


Figure 1: A truncated screenshot of the DriveSure leak posted by actor "pompompurin"

The advertisement also contained a full list of the types of data compromised in the breach.

Full Names, Full Addresses, Home Phone, Work Phone, Cell Phone, Email, Hashed Password (bcrypt) 
(Only a small amount of users set a password online - 93,063), Car make & model, VIN Numbers, 
Dealer car was purchased from, Records of how much they paid for service, Warranty Status, 
Emails to customers, Texts sent to customers, IP Addresses, Damage claims, Survey Responses, 
Logs of edits to customers, Current status of car, and much more.

Figure 2: Full list of compromised data types

Alpha Team Flash Report: Colonial Pipeline Ransomware Attack Update

Executive Summary

On May 7, 2021, the Colonial Pipeline Company announced that it was the victim of a ransomware attack. In response to the incident and to contain the threat, the company took certain systems offline resulting in a temporary halt of their operations. Numerous reports state that US cybersecurity firm FireEye has been engaged to investigate the nature and scope of the attack, though ZeroFOX does not have any conclusive evidence to confirm or refute this assertion. Law enforcement and other federal agencies were promptly notified and are reportedly working with Colonial Pipeline. While the company’s operations have been restored on May 12, 2021, this incident highlights the potential impact that compromising key infrastructure can have, regardless of early identification of compromise.

Recommendations

  • The Darkside operators do not have a specific set of data that they target. While on the system, they attempt to exfiltrate any documents or files that seem like they would be important, such as user credentials, financial records, non-disclosure agreements, contracts, network diagrams, and personal information. Segmenting the network and implementing role-based access control is often an effective countermeasure.
  • Likewise, while OT and IT systems are often highly related, segment ICS resources from IT resources wherever possible.
  • Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
  • Unlike many other ransomware and e-crime actors, Darkside deploys techniques that attack other operating systems besides Microsoft Windows, including launching their own virtual machines where possible. Ensure your anti-virus/intrusion protection systems have current detection packages and signatures, can detect non-Windows activity, and includes network monitoring.
  • Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above average size, particularly in a compressed format such as .zip, .rar, .tar, .7z, or .gz
  • Many Russian-language threat actors perform a language check against the target system, and will abandon the attack if a Cyrillic language pack is installed. It does not need to be used in order to be effective, only installed.
  • It is not currently known what data was stolen from Colonial Pipeline during the attack. If you have any concern that you have affiliate data that may have been compromised in this breach then please enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.

Details

While Colonial Pipeline has not made an official announcement about the attribution of the attack, on May 10, a statement made by the Federal Bureau of Investigation (FBI) confirmed that DarkSide ransomware is responsible for the compromise of the Colonial Pipeline. Numerous media outlets had previously cited an anonymous US official who reportedly told the Washington Post that the DarkSide ransomware gang was behind the attack. While the threat actors have not reportedly responded to any media inquiries or claimed any responsibility, they have released a brief note on their [.]onion leak page. According to the May 10 note, while the threat actors appear to distance themselves from any geopolitical implications, they do not make any claims about the incident or make any explicit reference to Colonial Pipeline. The group also noted that they would be introducing measures to moderate the activity of their Ransomware-as-a- Service “partners.” Figure 1 is a screenshot of the DarkSide operators' latest post on their data leak website tating that they are an apolitical group and that their goal is to make money.

Figure 1: Post made by DarkSide operators shortly after the Colonial Pipeline ransomware attack

According to Bloomberg, the attackers stole nearly 100 gigabytes of data within two hours from the company network, which is based in Alpharetta, Georgia. However, on May 8, the FBI and other government agencies reportedly took offline the cloud computing system the gang used to collect stolen data. To date, ZeroFOX has not observed any leaked data thought to be sourced from the attack. As of May 13, Bloomberg reported that Colonial Pipeline paid a USD $5M ransom to decrypt encrypted systems.

The DarkSide ransomware group, which began operations around August 2020, has performed targeted attacks against numerous companies, including two major electric utilities companies in Brazil - Centrais Eletricas Brasileiras (Eletrobras) and Companhia Paranaense de Energia (Copel), in February 2021. DarkSide uses a ransomware-as-a-service model. It is a selective operation with affiliates interviewed before being given access to DarkSide's control panel. DarkSide shares profit with the affiliates, who retain a percentage of the ransom fee from each victim, which usually starts at 25 percent for ransom fees less than $500,000 USD and decreases to 10 percent for ransom fees greater than $5M USD.

Similar to other ransomware types, DarkSide operators spread laterally across network devices until they gain access to an administrator account and the Windows domain controller. DarkSide operators have leveraged attack vectors such as phishing and remote desktop protocol vulnerabilities to distribute DarkSide ransomware to their targets. DarkSide is also known to have previously used double extortion tactics, whereby victim files are also stolen, with the threat of its exposure on the internet used as leverage for the victim to pay ransom demands. Figure 2 is a screenshot of a DarkSide ransom note. The image has been modified to remove references to the victim and DarkSide ransomware websites.

Figure 2: DarkSide ransom note instructions on decrypting encrypted files and paying ransom demands

On May 9, The US Department of Transportation (USDOT) announced that to avoid disruption to supply, the Federal Motor Carrier Safety Administration (FMCSA) issued a temporary hours of service exemption that applies to those transporting gasoline, diesel, jet fuel, and other refined petroleum products to Alabama, Arkansas, District of Columbia, Delaware, Florida, Georgia, Kentucky, Louisiana, Maryland, Mississippi, New Jersey, New York, North Carolina, Pennsylvania, South Carolina, Tennessee, Texas, and Virginia.

Oil refining companies reportedly said their operations had not yet been impacted. On May 9, Kinder Morgan Inc, stated its Products (SE) Pipeline Corporation (PPL), serving many of the same regions, remains in full service and working around the clock to accommodate additional barrels during Colonial's downtime.

As of May 10, gasoline futures are up about 0.7 percent at USD 2.14 a barrel, after they had advanced as much as 4.2 percent in overnight trading, but analysts reportedly said prices for gasoline, particularly spot prices in regions impacted by the closure, could continue to rise if the pipeline is not back in service in a few more days.

DarkSide Metrics Overview

ZeroFOX Research has tracked reported DarkSide ransomware infections since 2020. The group operates a data leak website exposing the names and data of their victims. Since February 2021, DarkSide operators have targeted numerous victims. ZeroFOX's research revealed that the majority of victims, around 76 percent, were located in North America. This figure was followed by victims located in the European Union (EU) and Russia with a smaller percentage, around 15 percent. (ZeroFOX Note: All organizations affected in this region are EU-based) Figure 3 displays a pie chart depicting the percentages of DarkSide victims around the world.

Figure 3: DarkSide ransomware targets by geographic region since February 2021

Displayed in Figure 4, the top three DarkSide industry targets since February 2021 were retail and consumer packaged goods (CPG) (22 percent), manufacturing (21 percent), and legal consulting (16 percent).

Figure 4: DarkSide ransomware targets by industry since February 2021

Other industries followed with smaller percentages, including healthcare organizations. In November 2020, a DarkSide operator claimed in an affiliate advertisement posted on a Russian-speaking forum that targeting organizations in medicine, education, public sector, and non-profit organizations were strictly prohibited. Figure 5 is a screenshot of the post followed by its English translation.

Figure 5 Snippet of DarkSide affiliate advertisement posted in a Russian-speaking forum

English translation of Russian text in Figure 5:

Rules?
The following areas are prohibited:
- Medicine (Hospitals, hospitals). 
- Education (Universities, schools). 
- Public sector (municipalities, any government bodies). 
- Non-profit organizations (charities, associations).

Sources

hXXps://www[.]colpipe[.]com/news/press-releases/media-statement-colonial-pipeline-system-disruption
hXXps://www[.]fbi[.]gov/news/pressrel/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline
hXXps://www[.]wsj[.]com/articles/fbi-suspects-criminal-group-with-ties-to-eastern-europe-in-pipeline-hack-11620664720?mod=hp_lead_pos1
hXXp://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id[.]onion/press-center
https://www[.]fmcsa[.]dot[.]gov/emergency/esc-ssc-wsc-regional-emergency-declaration-2021-002-05-09-2021
hXXps://www[.]transportation[.]gov/briefing-room/us-department-transportations-federal-motor-carrier-administration-issues-temporary
hXXps://www[.]washingtonpost[.]com/business/2021/05/08/cyber-attack-colonial-pipeline/
hXXps://www[.]wsj[.]com/articles/as-colonial-pipeline-shutdown-drags-on-after-hack-eyes-are-on-gasoline-prices-11620660258
hXXps://www[.]wsj[.]com/articles/u-s-pipeline-shutdown-exposes-cyber-threat-to-energy-sector-11620574464
hXXps://www[.]foxbusiness[.]com/markets/crude-oil-prices-in-focus-after-colonial-pipeline-cyberattack
hXXps://eletrobras[.]com/pt/ri/ComunidadoseFatos/Comunicado%20ao%20Mercado%20-%2003[.]02[.]21%20-%20Eletronuclear[.]pdf
hXXps://www[.]bleepingcomputer[.]com/news/security/largest-us-pipeline-shuts-down-operations-after-ransomware-attack/
hXXps://www[.]bloomberg[.]com/news/articles/2021-05-09/u-s-fuel-sellers-scramble-for-alternatives-to-hacked-pipeline
hXXps://www[.]cnbc[.]com/2021/05/08/colonial-pipeline-shuts-pipeline-operations-after-cyberattack[.]html
hXXps://www[.]nbcnews[.]com/politics/national-security/russian-criminal-group-may-be-responsible-colonial-pipeline-ransomware-attack-n1266793
hXXps://www[.]newsweek[.]com/cyber-attack-colonial-pipeline-emergency-declaration-1589936
hXXps://www[.]reuters[.]com/business/energy/ransom-group-linked-colonial-pipeline-hack-is-new-experienced-2021-05-09/
hXXps://apnews[.]com/article/europe-hacking-government-and-politics-technology-business-333e47df702f755f8922274389b7e920
hXXps://seekingalpha[.]com/news/3693613-colonial-pipeline-shut-after-cyberattack
hXXps://seekingalpha[.]com/news/3693634-biden-turns-to-emergency-powers-to-counter-colonial-pipeline-disruption
hXXps://thehill[.]com/policy/energy-environment/552569-gas-prices-set-to-rise-after-pipeline-cyberattack
hXXps://www[.]bbc[.]com/news/business-57050690
hXXps://us-cert[.]cisa[.]gov/ncas/alerts/aa21-131a
hXXps://www[.]bloomberg[.]com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom

Breaking News: 2021-05-07 - 2021-05-13

Qualcomm Chip Bug Opens Android Fans to Eavesdropping

A vulnerability exists in Qualcomm Mobile Station Modem (MSM) Interface, which could allow mobile hackers to remotely target Android users by injecting malicious code into a phone’s modem, gaining the ability to execute code, access mobile users’ call histories and text messages, and eavesdrop on phone calls. The bug is tracked as CVE-2020-11292 and impacts Google Pixel, LG, OnePlus, Samsung’s flagship Galaxy line, and Xiaomi devices. Qualcomm has issued a fix but the patches will be slow to roll out. As with all Android OEM issues, each handset vendor will need to apply the fix for its customers.

See the full report here: https://threatpost.com/qualcomm-chip-bug-android-eavesdropping/165934/

New TsuNAME DNS bug allows attackers to DDoS authoritative DNS servers - BleepingComputer

A newly disclosed domain name server (DNS) vulnerability publicly known as TsuNAME can be used as an amplification vector in large-scale reflection-based distributed denial of service (DDoS) attacks targeting authoritative DNS servers. Authoritative DNS servers are commonly managed by both government and private organizations, including Internet Service Providers (ISPs) and worldwide tech giants. Successful exploitation of the vulnerability could possibly lead to the takedown of directly impacted authoritative DNS servers, potentially causing countrywide Internet outages if a country code top-level domain (ccTLD) is affected.

See the full report here: https://www.bleepingcomputer.com/news/security/new-tsuname-dns-bug-allows-attackers-to-ddos-authoritative-dns-servers/

iPhone Hack Allegedly Used to Spy on China’s Uyghurs

U.S. intelligence said that the Chaos iPhone remote takeover exploit was used against the minority ethnic group before Apple could patch the problem. A successful exploit would allow a remote attacker to jailbreak an iPhoneX and gain access to a victim’s data, processing power, and more. Evidences reveal that the Chinese intelligence allegedly used the exploit as a weapon to target China’s Uyghur Muslims.

See the full report here: https://threatpost.com/iphone-hack-spying-china-uyghurs/165950/

Foxit Reader bug lets attackers run malicious code via PDFs - BleepingComputer

Foxit Software, the company behind the highly popular Foxit Reader, has published security updates to fix a high severity remote code execution (RCE) vulnerability affecting the PDF reader. This security flaw could allow attackers to run malicious code on users' Windows computers and, potentially, take over control. The vulnerability is tracked as CVE-2021-21822 and impacts Foxit Reader 10.1.3.37598 and earlier versions. Users are advised to upgrade to the latest version to mitigate this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/foxit-reader-bug-lets-attackers-run-malicious-code-via-pdfs/

Russian state hackers switch targets after US joint advisories - BleepingComputer

Russian Foreign Intelligence Service (SVR) operators have switched their attacks to target new vulnerabilities. The warning comes after US and UK governments formally attributed the SolarWinds supply-chain attack and COVID-19 vaccine developer targeting to Russian SVR (aka APT29, Cozy Bear, and The Dukes) operators' cyber-espionage efforts on April 15. The SVR operators are changing their techniques and procedures in an attempt to avoid further detection and remediation efforts by network defenders. The new techniques included the deployment of the open-source tool Sliver, targeting servers exposed ProxyLogon attacks targeting the CVE-2021-26855.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-state-hackers-switch-targets-after-us-joint-advisories/

New Moriya rootkit stealthily backdoors Windows systems

In a campaign dubbed Operation TunnelSnake by Kaspersky researchers, the team informed that an advanced persistent threat (APT) group, origin unknown but suspected of being Chinese-speaking, has used the rootkit to quietly take control of networks belonging to organizations. The newly-discovered rootkit, named Moriya, is used to deploy passive backdoors on public-facing servers. The backdoors are then used to stealthily establish a connection with a command-and-control (C2) server controlled by the threat actors for malicious purposes. The targeted victims of the APT have been found in Asia and Africa.

See the full report here: https://www.zdnet.com/article/new-moriya-rootkit-stealthily-backdoors-windows-systems/

Twitter scammers impersonate SNL in Elon Musk cryptocurrency scams - BleepingComputer

Twitter scammers are jumping on Elon Musk's hosting of Saturday Night Live to push cryptocurrency scams to steal people's Bitcoin, Ethereum, and Dogecoin. A recent tactic has been to hack abandoned verified Twitter accounts to promote these scams to a wider base of followers. These tactics have been immensely successful for the scammers as they have stolen cryptocurrency worth over a million dollars from unsuspecting users.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-scammers-impersonate-snl-in-elon-musk-cryptocurrency-scams/

Microsoft removes last remaining Windows 10 upgrade blocks - BleepingComputer

Microsoft has addressed the last remaining known issues affecting Windows 10 computers with Conexant or Synaptics devices causing errors and problems when updating to Windows 10 versions 2004 or 20H2. These issues impacting computers with Conexant ISST audio drivers and those with Conexant or Synaptics audio devices have been under investigation since May 2020, when the first version of Windows 10 2004 was released.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-removes-last-remaining-windows-10-upgrade-blocks/

Largest U.S. pipeline shuts down operations after ransomware attack - BleepingComputer

Colonial Pipeline, the largest fuel pipeline in the United States, has shut down operations after suffering what is reported to be a ransomware attack. Colonial Pipeline transports refined petroleum products between refineries located in the Gulf Coast and markets throughout the southern and eastern United States. According to a report by CNBC, Colonial Pipeline suffered a ransomware attack yesterday that forced them to shut down their entire network to prevent the spread of the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/largest-us-pipeline-shuts-down-operations-after-ransomware-attack/

Bulletproof hosting admins plead guilty to running cybercrime safe haven - BleepingComputer

Four individuals from Eastern Europe face 20 years in prison for Racketeer Influenced Corrupt Organization (RICO) charges after pleading guilty to running a bulletproof hosting service as a safe haven for cybercrime operations targeting US entities. According to a DOJ press release, their service provided multiple cybercrime-affiliated clients with the infrastructure needed in malicious campaigns running between 2008 and 2015.

See the full report here: https://www.bleepingcomputer.com/news/security/bulletproof-hosting-admins-plead-guilty-to-running-cybercrime-safe-haven/

Microsoft: Business email compromise attack targeted dozens of orgs - BleepingComputer

Microsoft detected a large-scale business email compromise (BEC) campaign that targeted more than 120 organizations using typo-squatted domains registered a few days before the attacks started. BEC scammers use various tactics (including social engineering, phishing, or hacking) to compromise business email accounts, later used to redirect payments to bank accounts under their control or target employees in gift card scams.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-business-email-compromise-attack-targeted-dozens-of-orgs/

Twitter scammers impersonate SNL in Elon Musk cryptocurrency scams - BleepingComputer

Twitter scammers are jumping on Elon Musk's hosting of Saturday Night Live to push cryptocurrency scams to steal people's Bitcoin, Ethereum, and Dogecoin. A recent tactic has been to hack abandoned verified Twitter accounts to promote these scams to a wider base of followers. These tactics have been immensely successful for the scammers as they have stolen cryptocurrency worth over a million dollars from unsuspecting users.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-scammers-impersonate-snl-in-elon-musk-cryptocurrency-scams/

Bulletproof hosting admins plead guilty to running cybercrime safe haven - BleepingComputer

Four individuals from Eastern Europe face 20 years in prison for Racketeer Influenced Corrupt Organization (RICO) charges after pleading guilty to running a bulletproof hosting service as a safe haven for cybercrime operations targeting US entities. According to a DOJ press release, their service provided multiple cybercrime-affiliated clients with the infrastructure needed in malicious campaigns running between 2008 and 2015.

See the full report here: https://www.bleepingcomputer.com/news/security/bulletproof-hosting-admins-plead-guilty-to-running-cybercrime-safe-haven/

DHS secretary warns ransomware attacks on the rise, targets include small businesses - WPVI-TV

Homeland Security Secretary Alejandro Mayorkas warned that cyberattacks, specifically ransomware attacks, are on the rise, and targets range from government agencies to small businesses. Mayorkas said that $350 million was paid out for ransomware attacks in 2020.

See the full report here: https://abcnews.go.com/Politics/dhs-secretary-warns-ransomware-attacks-rise-targets-include/story?id=77512872

Canada’s Tokyo hopefuls hit with credit card fraud on top of pandemic challenges - Penticton Western News

The Canadian swimmer is among athletes trying to prepare for the Tokyo Olympics amid the COVID-19 pandemic while also dealing with credit card fraud. Several Canadian athletes have discovered fake applications for a Walmart MasterCard were approved in their names. They’re dealing with the time-consuming fallout.

See the full report here: https://www.pentictonwesternnews.com/sports/canadas-tokyo-hopefuls-hit-with-credit-card-fraud-on-top-of-pandemic-challenges/

US invokes emergency powers after cyberattack shuts crucial fuel pipeline

The Biden administration has invoked emergency powers as part of an “all-hands-on-deck” effort to avoid fuel shortages after the worst-ever cyber-attack on US infrastructure shut down a crucial pipeline supplying the east coast. The federal transport department issued an emergency declaration on Sunday to relax regulations for drivers carrying gasoline, diesel, jet fuel, and other refined petroleum products in 17 states and the District of Columbia. It lets them work extra or more flexible hours to make up for any fuel shortage related to the pipeline outage.

See the full report here: https://www.theguardian.com/us-news/2021/may/10/us-invokes-emergency-powers-after-cyberattack-shuts-crucial-fuel-pipeline

WhatsApp to restrict features if you refuse Facebook data sharing - BleepingComputer

WhatsApp says that it will not delete or deactivate the accounts of users who oppose its latest privacy policy update that requires sharing data with Facebook companies. The company backtracks on a previous decision that gave its users a harsh ultimatum to accept sharing their data with Facebook if they want to continue using their account or, as an alternative, to delete their accounts.

See the full report here: https://www.bleepingcomputer.com/news/technology/whatsapp-to-restrict-features-if-you-refuse-facebook-data-sharing/

Google Chrome's new privacy feature restricts online user tracking - BleepingComputer

In the latest move to improve the privacy of the Chrome browser, Google is adding support for a new HTML tag that prevents user tracking by isolating embedded content from the page embedding it. Currently, web browsers allow third-party iframes to communicate with their embedding page. It can be done using postMessage, attributes, and permissions.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chromes-new-privacy-feature-restricts-online-user-tracking/

Windows 10 Notepad will warn when you're running an old version - BleepingComputer

The Windows 10 Notepad will soon include a built-in notification that alerts users when a new version is available. In March 2021, Microsoft announced with the release of Windows Insider build 21337 that Notepad is becoming an inbox app, which is updateable via the Microsoft Store outside regular Windows 10 updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-notepad-will-warn-when-youre-running-an-old-version/

Lemon Duck hacking group adopts Microsoft Exchange Server vulnerabilities in new attacks

Researchers have explored the latest activities of the Lemon Duck hacking group, including the leverage of Microsoft Exchange Server vulnerabilities and the use of decoy top-level domains. In late March, Microsoft said the Lemon Duck botnet had been observed exploiting vulnerable servers and using the systems to mine for cryptocurrency.

See the full report here: https://www.zdnet.com/article/lemon-duck-hacking-group-adopts-microsoft-exchange-server-vulnerabilities-in-new-attacks/

Amazon seized, destroyed two million fake products sent to warehouses in 2020

Amazon's crusade against counterfeit product sellers on the firm's platform continues with two million products seized and destroyed in 2020. Fake, counterfeit products, poor quality, misleading photos, and more are all noted in buyer reviews and there are vast numbers of counterfeit operations that Amazon is attempting to detect and remove.

See the full report here: https://www.zdnet.com/article/amazon-seized-destroyed-two-million-fake-products-sent-to-order-warehouses-in-2020/

Over 25% Of Tor Exit Relays Spied On Users' Dark Web Activities

An unknown threat actor managed to control more than 27% of the entire Tor network exit capacity in early February 2021, a new study on the dark web infrastructure revealed. It's the latest in a series of efforts undertaken to bring to light malicious Tor activity since December 2019. The attacks, which are said to have begun in January 2020, were first documented and exposed by the same researcher in August 2020.

See the full report here: https://thehackernews.com/2021/05/over-25-of-tor-exit-relays-are-spying.html

US and Australia warn of escalating Avaddon ransomware attacks - BleepingComputer

The Federal Bureau of Investigation (FBI) and the Australian Cyber Security Centre (ACSC) are warning of an ongoing Avaddon ransomware campaign targeting organizations from an extensive array of sectors in the US and worldwide. The FBI said in a TLP:GREEN flash alert last week that Avaddon ransomware affiliates are trying to breach the networks of manufacturing, healthcare, and other private sector organizations around the world.

See the full report here: https://www.bleepingcomputer.com/news/security/us-and-australia-warn-of-escalating-avaddon-ransomware-attacks/

GitHub now supports security keys when using Git over SSH - BleepingComputer

GitHub has added support for securing SSH Git operations using FIDO2 security keys for added protection from account takeover attempts. With GitHub's newly added feature, a user can now use portable FIDO2 devices for SSH authentication to secure Git operations and prevent accidental private key exposure and malware initiating requests without users' approval.

See the full report here: https://www.bleepingcomputer.com/news/security/github-now-supports-security-keys-when-using-git-over-ssh/

Tulsa Deals With Aftermath of Ransomware Attack

The City of Tulsa said it is experiencing technical difficulties after a ransomware attack over the weekend. The city said no customer information was compromised, but residents will experience delays in its network services. Many of its internal systems have been shut down by the city's information technology and security teams out of an abundance of caution.

See the full report here: https://www.darkreading.com/attacks-breaches/tulsa-deals-with-aftermath-of-ransomware-attack/d/d-id/1340967

VLC Media Player 3.0.14 fixes broken Windows automatic updater - BleepingComputer

VideoLan has released VLC Media Player 3.0.14 to fix an issue affecting Window users and causing the software's auto-updater not to launch the new version's installer automatically. This issue is caused by a bug introduced in the automatic updater code of VLC 3.0.12 and fixed with the release of VLC 3.0.14. Because of this bug, VLC updates are downloaded to the users' computers, verified for integrity, but will not be installed as the auto-updater fails to launch the VLC 3.0.14 installer.

See the full report here: https://www.bleepingcomputer.com/news/software/vlc-media-player-3014-fixes-broken-windows-automatic-updater/

Compsci boffin publishes proof-of-concept code for 54-year-old zero-day in Universal Turing Machine

A computer science professor from Sweden has discovered an arbitrary code execution vuln in the Universal Turing Machine, one of the earliest computer designs in history though he admits it has no real-world implications. The universal Turing machine is generally considered to be the simplest, most abstract model of a computer.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/05/11/turing_machine_0day_no_patch_available/

Microsoft Outlook bug prevents viewing or creating email worldwide - BleepingComputer

A Microsoft Outlook update released yesterday for the desktop client introduced bugs that prevent users from creating or viewing mail. Microsoft released Outlook version 2104 build 13929.20372, and after installing the update, users of the click-to-run desktop client found that they could no longer accurately view emails or create new ones.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-bug-prevents-viewing-or-creating-email-worldwide/

South Korea orders urgent review of energy infrastructure cybersecurity

South Korea’s Ministry of Trade, Energy, and Infrastructure has ordered a review of the cybersecurity preparedness of the nation’s energy infrastructure. Minister of Trade, Industry, and Energy Moon Seung-wook convened a meeting yesterday, saying it was needed considering the ransomware attack on the Colonial Pipeline that shuttered one of the USA’s main oil transport facilities.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/05/12/south_korea_security_review/

German watchdog bans Facebook from using WhatsApp users' data - BleepingComputer

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) has banned Facebook today from processing WhatsApp user data for the next three months. The order issued today by the HmbBfDI, one of Germany's data protection commissioners, comes after WhatsApp said that it will slowly restrict account features for users who refuse to give up control of their data and have it shared with Facebook companies starting May 15th, 2021.

See the full report here: https://www.bleepingcomputer.com/news/technology/german-watchdog-bans-facebook-from-using-whatsapp-users-data/

Fake Chrome App Anchors Rapidly Worming ‘Smish’ Cyberattack

A new Android malware that impersonates the Google Chrome app has spread to hundreds of thousands of people in the last few weeks, according to researchers. The fake app is being used as part of a sophisticated hybrid cyberattack campaign that also uses mobile phishing to steal credentials.

See the full report here: https://threatpost.com/fake-chrome-app-worming-smish-cyberattack/166038/

Microsoft: Threat actors target aviation orgs with new malware - BleepingComputer

Microsoft warns of an ongoing spear-phishing campaign targeting aerospace and travel organizations with multiple remote access trojans (RATs) deployed using a new and stealthy malware loader. As Microsoft observed while tracking this campaign, the threat actors' end goal is to harvest and exfiltrate data from infected devices using the RATs' remote control, keylogging, and password-stealing capabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-threat-actors-target-aviation-orgs-with-new-malware/

Biden issues executive order to increase U.S. cybersecurity defenses - BleepingComputer

President Biden signed an executive order Wednesday to modernize the country's defenses against cyberattacks and give more timely access to information necessary for law enforcement to conduct investigations. This executive order follows the numerous cyberattacks targeting US interests this year, including the SolarWinds supply chain attacks in December and the more recent DarkSide ransomware attack against the US fuel pipeline. These initiatives will be conducting in rolling phrases ranging between 30 days from the executive order, to in some cases, 360 days.

See the full report here: https://www.bleepingcomputer.com/news/security/biden-issues-executive-order-to-increase-us-cybersecurity-defenses/

All Wi-Fi devices impacted by new FragAttacks vulnerabilities - BleepingComputer

Newly discovered Wi-Fi security vulnerabilities collectively known as FragAttacks (fragmentation and aggregation attacks) are impacting all Wi-Fi devices (including computers, smartphones, and smart devices) going back as far as 1997. Three of these bugs are Wi-Fi 802.11 standard design flaws in the frame aggregation and frame fragmentation functionalities affecting most devices, while others are programing mistakes in Wi-Fi products. The vulnerabilities affect all modern security protocols of Wi-Fi, including the latest WPA3 specification. Even the original security protocol of Wi-Fi, called WEP, is affected. There is no evidence of the vulnerabilities being used against Wi-Fi users maliciously, and these issues are mitigated through routine device updates and better security implementation practices.

See the full report here: https://www.bleepingcomputer.com/news/security/all-wi-fi-devices-impacted-by-new-fragattacks-vulnerabilities/

Researchers Unearth 167 Fake iOS & Android Trading Apps

Researchers have discovered 167 counterfeit iOS and Android apps stealing money from victims while disguised as popular cryptocurrency trading, stock trading, and banking apps. The scam started on a social media and dating website where victims are tricked their target into installing a malicious cryptocurrency trading app. These fraudulent applications are designed to exploit the growing interest in trading apps, driven by the recent increase in the value of cryptocurrencies and interest in low-cost or free stock trading.

See the full report here: https://www.darkreading.com/mobile/researchers-unearth-167-fake-ios-and-android-trading-apps/d/d-id/1340998

Tags: weekly bulletin, all industries, global