Threat Intelligence Bulletin: 05/14/2021 - 05/20/2021

Cybercriminals use 3D Modeling Software for CARES Fraud

Cybercriminals have been abusing private company and government websites to fraudulently apply for CARES act benefits and reimbursements. ZeroFOX Threat Research has recorded hundreds of thousands of CARES fraud advertisements from cybercriminals on the deep, dark web and covert communication channels, especially Telegram. These advertisements include the buying and selling of services and goods to circumvent Know Your Customer (KYC) technology on these websites. A new method of circumvention involves using 3D Modeling software to defeat driver’s license and a “selfie” check on these sites.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Assessment

ZeroFOX Threat Research assesses:

• There is a high chance that actors performing CARES fraud will continue to improve methods to defeat KYC
• There is a high chance that victims will not know about fraudulent claims in their name until subsequent tax years, giving fraudsters a significant lead to process and launder the stolen money
• Actors will continue targeting investigative and background checking services, as they provide enough information to build a “full profile” of people and businesses, and they will likely use a combination of phishing and insider threat recruitment to maintain access
• Due to the success of these methods for CARES fraud, there is a moderate chance that actors will begin to apply these methods to defeat KYC in other platforms, such as financial platforms or cryptocurrency exchanges

Recommendations

• Deploy effective KYC measures and technologies to sufficiently review client signup data
• Continuously monitor cybercriminal activity for new tactics and techniques that attempt to defeat the KYC technology your organization uses
• Consider deploying anti-fraud techniques to combat automated signups, such as identifying discrepancies in user sign-up data, which includes geolocation, device, IP address and attempts to sign up
• Have a process to thoroughly review your KYC datasets for fake or fraudulent records, especially selfies and driver’s licenses

Details

On March 29, 2020, the Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law. The goal of the Act was to provide economic relief to Americans affected by the COVID-19 pandemic. The Act helped fund numerous government relief programs, such as Paycheck Protection Program (PPP), Pandemic Unemployment Assistance (PUA), Economic Injury Disaster Loan (EIDL), and Small Business Authority (SBA) programs.

On March 26, 2021, nearly a year later, the FBI issued a public announcement detailing their actions in combating cybercriminals who submit fraudulent claims to steal the appropriated money from the CARES Act. ZeroFOX Threat Research has monitored cybercriminal activity related to CARES fraud, which involves how to defeat Know Your Customer (KYC) methods used by cybercriminals, as well as tracking tens of thousands of advertisements related to CARES fraud on covert communication channels and the dark web.

Defeating KYC methods allows cybercriminals to circumvent the authentication processes while fraudulently applying for these loans. In general, these actors steal an identity “pro” (profile) of a legitimate business or person. This is typically done through open source research, phishing and insider threat methods, or stolen accounts that can access investigative and background checking databases.

Figure 1: An actor selling background investigation service accounts on Telegram

To help combat fraudulent CARES claims, many companies and government organizations employ methods that will prevent filings of these claims based on the “pro” alone. Many of these services require an image, or “selfie”, of the applicant, which can match the driver’s license of the applicant. Stealing a driver’s license is a well known method used by phishing kits, and many of the background investigation services these actors gain malicious access to also contain driver’s license numbers. For example, one investigative service advertises an report that provides PII (personally identifiable information) of a person of interest, business accounts, and driver’s license information, all which are required by most KYC vendors.

Figure 2: Actor selling background investigations service accounts with different types of reports

In order to measure the impact of CARES-related fraud, ZeroFOX Threat Research aggregated advertisements, channels, and actor handles that openly advertise their services and inventory. From May 2020 to May 2021, ZeroFOX Threat Research has recorded the following number of advertisements for CARES-related fraud on Telegram:

• 270,828 profile or method advertisements for SBA, PPP and CARES fraud
• 269,381 background investigation service lookup advertisements (Phish or Insider)
• 48,271 DL Lookup advertisements (Method or Service)

Many of these messages contain advertisements for methods. Typically, actors keep methods secret in order to reduce the chance of it being discovered, as well as to create exclusivity around the method. One recent technique that has been circulating on these actor channels involves defeating the selfie and picture check for KYC.

Figure 3: Actor advertises goods and services to create fake identification, including ‘selfie scans’

ZeroFOX Threat Research obtained a number of video advertisements defeating the “selfie check” for some of these KYC videos. Actors will use 3D modeling software to create a picture of the victim, and then present the 3D model to the selfie identification check to pass the selfie check.

Figure 4: Video of 3D Model rendered by the actor.

In Figure 4, the actor presents a 3D Model of the victim. The screenshot also has a reflection of the actor’s phone, which is using WithPersona, an identity and KYC provider, Selfie Check feature. Throughout the 29 second video, the actor pans back and forth between the camera and the phone. At the end of the video, the phone screen changes to what looks like a confirmation screen. Link to imgur gif: https://imgur.com/a/v7Qtssm

Figure 5: Actor uses 3D rendered victim for Selfie & Driver’s Licenses identification

In Figure 5, a separate actor performs the driver’s license and selfie check for WithPersona. They navigate between a piece of software that contains the 3D image and the verification software. A “congratulations, you are done!” screen emerges for both the driver’s license and selfie check. Imgur link: https://imgur.com/a/v7Qtssm

Breaking News: 2021-05-14 - 2021-05-20

Rapid7 source code, credentials accessed in Codecov supply-chain attack - BleepingComputer

US cybersecurity firm Rapid7 has disclosed that some source code repositories were accessed in a security incident linked to the supply-chain attack that recently impacted customers of the popular Codecov code coverage tool. These repositories contained some internal credentials, which have all been rotated, and alert-related data for a subset of MDR customers. The company has already notified a "small subset of customers" potentially impacted by this breach to take measures to mitigate any potential risks.

See the full report here: https://www.bleepingcomputer.com/news/security/rapid7-source-code-credentials-accessed-in-codecov-supply-chain-attack/

Chemical distributor pays $4.4 million to DarkSide ransomware - BleepingComputer

Chemical distribution company Brenntag paid a $4.4 million ransom in Bitcoin to the DarkSide ransomware gang to receive a decryptor for encrypted files and prevent the threat actors from publicly leaking stolen data. At the beginning of May, Brenntag suffered a ransomware attack that targeted their North America division. As part of this attack, the threat actors encrypted devices on the network and stole unencrypted files. According to an anonymous source, the DarkSide ransomware group claimed to have stolen 150GB of data during their attack.

See the full report here: https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/

Microsoft build tool abused to deliver password-stealing malware - BleepingComputer

Threat actors are abusing the Microsoft Build Engine (MSBuild) to deploy remote access tools (RATs) and information-stealing malware filelessly as part of an ongoing campaign. MSBuild (msbuild.exe) is a legitimate and open-source Microsoft development platform that is used to build apps on any Windows system if provided with an XML schema project file. The attackers used Remcos RAT, Quasar RAT, and RedLine Stealer payloads onto their victims' computers to collect and exfiltrate system information, cookies, and crypto wallet information from configuration files and app data.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-build-tool-abused-to-deliver-password-stealing-malware/

Toshiba unit struck by DarkSide ransomware group

A French unit of Toshiba has become the latest victim of a DarkSide ransomware attack. After discovering the attack, Toshiba Tec shut down networks between Japan, Europe, and its subsidiaries to prevent the spread of damage while recovery protocols and data backups were implemented. The leak record, posted May 13, claims that over 740GB of data was stolen from Toshiba.

See the full report here: https://www.zdnet.com/article/toshiba-unit-struck-by-darkside-ransomware-group/

QNAP warns of eCh0raix ransomware attacks, Roon Server zero-day - BleepingComputer

QNAP has warned customers of an actively exploited Roon Server zero-day bug and eCh0raix ransomware attacks targeting their Network Attached Storage (NAS) devices. Devices using weak passwords may be susceptible to attack. QNAP customers are urged to protect their data from potential eCh0raix attacks by using stronger passwords for their administrator accounts, enabling IP Access Protection to protect accounts from brute force attacks, and avoiding using default port numbers 443 and 8080.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/

Irish healthcare shuts down IT systems after Conti ransomware attack - BleepingComputer

Ireland's Health Service Executive (HSE), the country's publicly funded healthcare system, has shut down all IT systems after its network was breached in a ransomware attack. The Conti ransomware group is confirmed to be behind the attack. The officials are currently investigating the incident and have shut down all the IT systems in order to protect them from this attack.

See the full report here: https://www.bleepingcomputer.com/news/security/irish-healthcare-shuts-down-it-systems-after-conti-ransomware-attack/

FIN7 Backdoor Masquerades as Ethical Hacking Tool

The financially motivated cybercrime gang behind the Carbanak RAT is back with the Lizar malware, which can harvest all kinds of info from Windows machines. The notorious FIN7 cybercrime gang, a financially motivated group, is spreading a backdoor called Lizar under the guise of being a Windows pen-testing tool for ethical hackers. The Lizar toolkit is structurally similar to Carbanak and consists of a loader and various plugins that are used for different tasks.

See the full report here: https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/

Ireland’s Health Services hit with $20 million ransomware demand - BleepingComputer

Ireland’s health service, the HSE, says they are refusing to pay a $20 million ransom demand to the Conti ransomware gang after the hackers' encrypted computers and disrupted health care in the country. Ireland's Health Service Executive (HSE), the country's publicly funded healthcare system, shut down all of their IT systems on Friday after suffering a Conti ransomware attack.

See the full report here: https://www.bleepingcomputer.com/news/security/ireland-s-health-services-hit-with-20-million-ransomware-demand/

DarkSide extracts $4.4m ransom from German chemical distribution company - TEISS

Earlier this week, when the DarkSide ransomware group forced U.S. pipeline giant Colonial Pipeline to pay $5 million in ransom to restore operations, it also extracted a ransom payment of $4.4 million in Bitcoin from Brenntag, a German chemical distribution company. According to the reports, Brenntag had no choice but to pay the ransom after the ransomware group targeted the company's North American division, encrypted corporate devices, and stole up to 150GB of data, including unencrypted files. The group reportedly gained access to the Brenntag North America network after purchasing stolen credentials from another entity.

See the full report here: https://www.teiss.co.uk/brenntag-pays-ransom-darkside-ransomware-group/

Microsoft: Windows 10 1809 and 1909 have reached end of service - BleepingComputer

Multiple editions of Windows 10 versions 1803, 1809, and 1909 have reached their End of Service (EOS) on this month's Patch Tuesday, as Microsoft reminded its customers. Devices running Windows 10 editions that have reached EoS will no longer receive technical support nor monthly bug and security fixes to protect them from the latest discovered security threats.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-10-1809-and-1909-have-reached-end-of-service/

Apple rejected over 215,000 apps in 2020 for privacy violations - BleepingComputer

Apple says that more than 215,000 iOS apps were blocked by its App Store's App Review team for privacy violations in 2020, while another 150,00 were rejected because they were spamming or misleading iOS users. The company also blocked 48,000 applications from being published on the App Store due to using undocumented or having hidden features. Ninety-five thousand additional apps were also removed from the App Store for using bait-and-switch tactics where new features and capabilities were added to fundamentally change their functionality after being approved.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-rejected-over-215-000-apps-in-2020-for-privacy-violations/

Ransomware ads now also banned on Exploit cybercrime forum - BleepingComputer

The team behind Exploit, a major cybercrime forum used by ransomware gangs to hire affiliates and advertise their Ransomware-as-a-Service (RaaS) services, has announced that ransomware ads are now banned and will be removed. Exploit says the decision was taken because ransomware groups attacking targets indiscriminately attracts a lot of attention.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-ads-now-also-banned-on-exploit-cybercrime-forum/

New Microsoft Edge version fixes crashes while using YouTube - BleepingComputer

Microsoft has fixed a nasty bug that was causing the Microsoft Edge browser to crash while watching YouTube videos or reading comments. Earlier this month, bleepingcomputer reported that Microsoft Edge would become unresponsive when watching a full-screen video, and a circular loading graphic would appear. Eventually, the browser would stop responding and crash.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-microsoft-edge-version-fixes-crashes-while-using-youtube/

Hackers could publish HSE patient data online, says Minister - The Irish Times

Hackers are expected to have accessed patient data as part of the HSE ransomware attack and may now publish it online, a Government Minister has said. He said accessing such patient files would be the first thing hackers would do before trying to encrypt data or delete backups and that usually such information was sold on and later released either by the hackers or other parties.

See the full report here: https://www.irishtimes.com/news/crime-and-law/hackers-could-publish-hse-patient-data-online-says-minister-1.4566862

Ransomware Group DarkSide Announces its Intent to Shut Down Post-Colonial Hack - Which-50

DarkSide, responsible for the Colonial Pipeline cyber-attack, is said to be disbanding and further suggests it will refrain from distributing hacking tools to its customers who intend to use the tools on critical infrastructure. The group has shut down its dark website. DarkSide was paid $US5 million by Colonial Pipeline and, according to reports, $US4.4M by chemical distribution company Brenntag.

See the full report here: https://which-50.com/ransomware-group-darkside-announces-its-intent-to-shut-down-post-colonial-hack/

Encrypted chat apps doubling as illegal marketplaces - SecurityBrief New Zealand

Encrypted chat apps are doubling as illegal marketplaces as criminals utilize them to sell stolen goods without fear of content moderation, according to NortonLifeLock. Encrypted chat apps are gaining popularity worldwide due to their central premise of not sending user data to tech giants. However, encrypted chat apps are also being used by criminals to sell illegal goods. Because content moderation is, by design, nearly impossible on these apps, they allow for an easy vector for dealers of illicit goods to communicate directly to customers without fear of law enforcement involvement.

See the full report here: https://securitybrief.co.nz/story/encrypted-chat-apps-doubling-as-illegal-marketplaces

Herff Jones credit card breach impacts college students across the US - BleepingComputer

Graduating students from several universities in the U.S. have been reporting fraudulent transactions after using payment cards at popular cap and gown maker Herff Jones. In the wake of the reports that started last Sunday, the company started an investigation to determine the extent of the data breach.

See the full report here: https://www.bleepingcomputer.com/news/security/herff-jones-credit-card-breach-impacts-college-students-across-the-us/

MSI warns of a malicious site lacing Afterburner overclocking utility with malware - PC Gamer

MSI is informing the public of malicious software being disguised as the official MSI Afterburner software. According to MSI, the Afterburner software hosted on that particular domain could contain a variety of malware, including a trojan virus and/or a keylogger.

See the full report here: https://www.pcgamer.com/msi-warns-of-a-malicious-site-lacing-afterburner-overclocking-utility-with-malware/

Panda Stealer malware targets digital currencies via Discord links, spam emails - CoinGeek

New malware is targeting digital currency wallets, spreading through spam emails and Discord channels. The malware, dubbed Panda Stealer, has mostly targeted victims in the U.S., Germany, Japan, and Australia.

See the full report here: https://coingeek.com/panda-stealer-malware-targets-digital-currencies-via-discord-links-spam-emails/

Exploit released for wormable Windows HTTP vulnerability - BleepingComputer

Proof-of-concept exploit code has been released over the weekend for a critical wormable vulnerability in the latest Windows 10 and Windows Server versions. The bug, tracked as CVE-2021-31166, was found in the HTTP Protocol Stack (HTTP.sys) used by the Windows Internet Information Services (IIS) web server as a protocol listener for processing HTTP requests.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/

Conti ransomware also targeted Ireland's Department of Health - BleepingComputer

The Conti ransomware gang failed to encrypt the systems of Ireland's Department of Health (DoH) despite breaching its network and dropping Cobalt Strike beacons to deploy their malware across the network. On the same day, Conti operators breached the network of Ireland's Health Service Executive (HSE), the country's publicly funded healthcare system, and forced it to shut down all IT systems to contain the incident. Even though the incident has led to widespread disruption affecting Ireland's healthcare services, Taoiseach Micheál Martin, the Prime Minister of Ireland, said that the HSE would not be paying any ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-also-targeted-irelands-department-of-health/

DarkSide Ransomware Variant Targets Disk Partitions

Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware. The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of a widespread wormlike activity.

See the full report here: https://www.darkreading.com/endpoint/darkside-ransomware-variant-targets-disk-partitions/d/d-id/1341038

FBI spots spear-phishing posing as Truist Bank bank to deliver malware - BleepingComputer

Threat actors impersonated Truist, the sixth-largest US bank holding company, in a spear-phishing campaign attempting to infect recipients with what looks like remote access trojan (RAT) malware. They also tailored the phishing campaign to spoof the financial institution through registered domains, email subjects, and an application, all appearing to be related to the institution, the FBI said in a TLP: WHITE private industry notification.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-spots-spear-phishing-posing-as-truist-bank-bank-to-deliver-malware/

Magecart Goes Server-Side in Latest Tactics Changeup

Magecart Group 12, known for skimming payment information from online shoppers, was fingered for last September’s gonzo attack on more than 2,000 e-Commerce sites, and now researchers have issued a report explaining how they did it detailing a new technical approach. The skimmers are still very active, according to the analysis.

See the full report here: https://threatpost.com/magecart-server-side-itactics-changeup/166242/

UK govt seeks advice on defending against supply-chain cyberattacks - BleepingComputer

The UK government has announced a call for advice on defending against software supply-chain attacks and ways to strengthen IT Managed Service Providers (MSPs) across the country. The move came over last week when President Biden had issued an executive order to increase cybersecurity defenses across the U.S.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-govt-seeks-advice-on-defending-against-supply-chain-cyberattacks/

More ransomware websites disappear in aftermath of Colonial Pipeline hack - KSL.com

Two more ransomware operators appear to have disappeared from the web, a cybersecurity researcher said on Sunday, in another potential aftershock following this month's hack of U.S. fuel transport company Colonial Pipeline. The sites, run by groups dubbed "AKO" and "Everest," appear to have become unreachable over the weekend, according to Allan Liska, a researcher with the cybersecurity firm Recorded Future.

See the full report here: https://www.ksl.com/article/50167469/more-ransomware-websites-disappear-in-aftermath-of-colonial-pipeline-hack

Bizarro Banking Trojan Sports Sophisticated Backdoor - Threatpost

A never-before-documented Brazilian banking trojan, dubbed Bizarro, is targeting customers of 70 banks scattered throughout Europe and South America, researchers said. According to an analysis from Kaspersky released Monday, Bizarro is mobile malware aimed at capturing online banking credentials and hijacking Bitcoin wallets from Android users. It spreads via Microsoft Installer packages, which are either downloaded directly by victims from links in spam emails or installed via a trojanized app, according to the analysis.

See the full report here: https://threatpost.com/bizarro-banking-trojan-backdoor/166211/

FBI says cybercrime complaints more than doubled in 14 months - BleepingComputer

The FBI's Internet Crime Complaint Center (IC3) has seen a massive 100% in cybercrime complaints over the past 14 months. When the IC3 first began logging complaints in 2000, it took seven years to reach 1 million complaints. Since then, it has taken an average of 29.5 months for each additional million complaints. For the period between March 2020 and May 2021, the IC3 saw a massive increase of 1 million complaints in just 14 months.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-says-cybercrime-complaints-more-than-doubled-in-14-months/

NVIDIA cripples cryptocurrency mining on RTX 3080 and 3070 cards - BleepingComputer

NVIDIA announced that it's halving the hash rate for Etehereum cryptocurrency mining on the new GeForce RTX 3080, 3070, and 3060 Ti graphics cards to make them less desirable for miners. The company will add "Lite Hash Rate" or "LHR" identifiers to retail product listings and boxes for all these new nerfed graphics cards that will start shipping later this month. According to Wuebbling, this decision was taken to make sure that more of these cards will be used by gamers worldwide instead of stacked in cryptocurrency mining farms.

See the full report here: https://www.bleepingcomputer.com/news/cryptocurrency/nvidia-cripples-cryptocurrency-mining-on-rtx-3080-and-3070-cards/

Stalkerware Apps Riddled with Security Bugs

Android stalkerware apps used to surreptitiously track people’s movements and digital activities turn out to themselves be rife with security holes that put victims in even danger. Stalkerware can track the GPS location of a victim’s device, record conversations, capture images, and snoop on browser histories. According to ESET researchers, the apps access, gather, store and transmit more information than any other app their victims have installed.

See the full report here: https://threatpost.com/stalkerware-apps-security-bugs/166274/

Mozilla starts rolling out Site Isolation to all Firefox channels - BleepingComputer

Mozilla has started rolling out the Site Isolation security feature to all Firefox channels, protecting users from attacks launched via malicious websites. Until today, Site Isolation could only be enabled by users of Firefox Nightly, the release channel used by Mozilla to test new features not yet ready for a wider rollout. Site Isolation has been under development since April 2018 under the Project Fission codename, with Mozilla first announcing plans to add it to the Firefox web browser in February 2019.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-starts-rolling-out-site-isolation-to-all-firefox-channels/

Chrome now automatically fixes breached passwords on Android - BleepingComputer

Google is rolling out a new Chrome on Android feature to help users change passwords compromised in data breaches with a single tap. Whenever checking for stolen passwords on supported sites and apps, Google Assistant will display a "Change password" button that will instruct Chrome to navigate to the website and go through the entire password change process on its own.

See the full report here: https://www.bleepingcomputer.com/news/security/chrome-now-automatically-fixes-breached-passwords-on-android/

New Zealand hospitals infected by ransomware, cancel some surgeries

New Zealand’s Waikato District Health Board (DHB) has been hit with a strain of ransomware that took down most IT services Tuesday morning and drastically reduced services at six of its affiliate hospitals. The attack disabled all IT services except email. Patient notes became inaccessible, clinical services were disrupted and surgeries postponed. Phone lines went down and hospitals were forced to accept urgent patients only.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/05/19/new_zealand_hospitals_taken_down/

Scammers Pose as Meal-Kit Services to Steal Customer Data

Attackers are piggybacking off the booming market for meal-kit delivery services since the pandemic and sending SMS phishing messages doctored up to look like their legitimate correspondence from popular brand names, including HelloFresh and Gousto. Researchers at Tessian discovered the meal-kit phishing campaigns and said there are many versions of the phishing pitch.

See the full report here: https://threatpost.com/scammers-meal-kit-services-customer-data/166282/

May Android security updates patch 4 zero-days exploited in the wild - BleepingComputer

According to info provided by Google's Project Zero team, four Android security vulnerabilities were exploited in the wild as zero-day bugs before being patched earlier this month. There are indications that CVE-2021-1905, CVE-2021-1906, CVE-2021-28663 and CVE-2021-28664 were used by attackers to target a limited number of users. The four Android vulnerabilities impact Qualcomm GPU and Arm Mali GPU Driver components. Android users are recommended to install this month's security updates as soon as possible if they are impacted by these issues.

See the full report here: https://www.bleepingcomputer.com/news/security/may-android-security-updates-patch-4-zero-days-exploited-in-the-wild/

Microsoft to retire Internet Explorer on some Windows 10 versions - BleepingComputer

Microsoft is finally retiring Internet Explorer 11 desktop application and will go out of support on June 15, 2022, for certain versions of Windows 10. The retirement announcement impacts Internet Explorer 11 desktop apps delivered via the Semi-Annual Channel (SAC) to systems running Windows 10 client SKUs (version 20H2 and later) and Windows 10 IoT (version 20H2 and later). After being retired on June 15, 2022, the Internet Explorer desktop application will be out of support and disabled, automatically redirecting users to Microsoft Edge when launched.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-to-retire-internet-explorer-on-some-windows-10-versions/

Qlocker ransomware shuts down after extorting hundreds of QNAP users - BleepingComputer

The Qlocker ransomware gang has shut down their operation after earning $350,000 in a month by exploiting vulnerabilities in QNAP NAS devices. Starting on April 19th, the threat actors conducted the attacks through recently disclosed QNAP vulnerabilities that allowed threat actors to encrypt victims' files using the built-in 7-zip application remotely. All the tor sites related to the ransomware are currently offline.

See the full report here: https://www.bleepingcomputer.com/news/security/qlocker-ransomware-shuts-down-after-extorting-hundreds-of-qnap-users/

Keksec Cybergang Debuts Simps Botnet for Gaming DDoS

A newly discovered malware named Simps is carrying out distributed denial-of-service (DDoS) attacks on gaming targets and others, using internet of things (IoT) nodes. Simps was first seen in April being dropped on IoT devices by the Gafgyt botnet, a Linux-based botnet. In the current campaign, Gafgyt infects Realtek and Linksys endpoints and deploys a shell script to download Simps. Simps itself then uses Mirai and Gafgyt modules for DDoS functionality.

See the full report here: https://threatpost.com/keksec-simps-botnet-gaming-ddos/166306/