Threat Intelligence Bulletin: 05/21/2021 - 05/27/2021

Breach Disclosure: DailyQuiz

On May 4, 2021, the Nulled[.]to forum actor "DonaldJuji" posted a data breach package targeting the organization Daily Quiz (Dailyquiz[.]me), a quiz website. The package was split into multiple csv files, and the contents contained approximately 12 million emails, usernames and plaintext passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

As of 24 May 2021, there has been no official email or statement from DailyQuiz detailign the breach. Shortly after the breach was given away for free on Nulled, the DailyQuiz website began displaying a popup on it's website, urging users to change their passwords due to an "optional security breach".

Figure 1: DailyQuiz.me front page

The breach was circulated in RaidForums in January 2021, but was listed for sale rather than given away for free.

Figure 2: Actor thekilob advertising the dataset

Breach Disclosure: IIMJobs

On November 23, 2020, the actor "n3xtr4n" on the Russian-language forum XSS posted an 8.73 GB data breach package targeting the organization IIMJobs (iimjobs[.]com), an online recruitment platform for middle and senior management positions in India. The data was also circulated by the now-banned actor "tudos" on RaidForums. The breach contained approximately 4,300,000 records, and had 102 column headers. Emails, MD5 hashed passwords, IP addresses and resumes were included in the breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

According to an article by Hackread, approximately 1.4 million registered users had their accounts and MD5 hashed passwords exposed. The hashed passwords were not salted.

Breach Disclosure: Yam

In 2013, Taiwainese video website, Yam, suffered a data breach in which 13 million records were exposed. The breach involved the exposure of email addresses, usernames, physical addresses, date of birth, and unsalted MD5 hashed passwords. The leaked data was posted on cybercriminal underground marketplaces in April 2021.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 9, 2021, the actor "databank0007" posted a data breach package targeting the organization Yam Media. Yam is the largest video website and the second-largest portal website in Taiwan. The website was originally breached in 2013. From this package, ZeroFOX extracted 16,325,560 records with usernames, email addresses, and passwords.

Figure 1: Actor "databank0007" posted a Yam data break package on a cybercriminal marketplace forum

Breach Disclosure: Livpure

In August 2020, India-based water and air purifier manufacturer, Livpure, disclosed a data breach resulting in the exposure of over 1 million records. Among these records were 270,000 unique email addresses. Other exposed data included names, phone numbers, physical addresses, and details of purchased items.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 19, 2021, ZeroFOX observed the actor "Drekavac" offering to sell compromised network access and a dumped customer database from Livpure, a large manufacturer of water and air purifiers in India. The actor claims to have obtained the network and database access in April 2021 to 1.8 million user records (names, emails, physical addresses, and phone numbers). The actor did not disclose any fixed price for the stolen data and shared their Jabber handle for communication with potential buyers.

Figure 1: Actor "Drekavac" posts an advertisement selling a Livpure customer database and compromised network access on a cybercriminal marketplace network##

Breach Disclosure: MobiFriends In January 2019, Spain-based dating application, MobiFriends, suffered a data breach that resulted in the compromise of over 3 million user records. Email addresses, usernames, date of birth, and passwords were included in the list of compromised records. The data does not include records of images or private messages.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 12, 2020, actor "RFBOT" posted a data breach package targeting the MobiFriends dating app on a cybercriminal marketplace forum. From this package, ZeroFOX extracted 3,688,058 records with usernames, email addresses, and passwords. The leaked database is circulating on other marketplace forums.

Figure 1: Actor "RFBOT" posted a data breach package targeting the organization Mobifriends

The database headers obtained from the breach package are presented in Figure 2.

Breach Package Headers

id, username, password, email, own sex, birth date, PERS_ALTA, PERS_BAJA, PERS_CP, PERS_POBL_CODIGO, province code, country, 
idiom, mobile, operator code, PERS_ULTIMA_ACTIVIDAD, PERS_ESTADO, profile photo, PERS_BIENVENIDA, USER_STATUS

Figure 2: Full list of breach package headers

Breach Disclosure: Moneycontrol

In April 2021, a threat actor posted a data breach package on a cybercriminal marketplace forum targeting the Indian business news website, Moneycontrol. The breach occurred in 2020 and contains over 700,000 records including email addresses, phone numbers, physical addresses, and cleartext passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 26, 2021, actor "kehanet00" posted a data breach package targeting the organization Moneycontrol, an Indian online business news website owned by E-EIGHTEEN Dot Com Ltd., a subsidiary of the media house TV18. The leaked database is circulating on other marketplace forums. From this package, ZeroFOX extracted 770,449 records with email addresses and cleartext passwords.

Figure 1: Actor "kehanet00" posted a CSV containing compromised records for Moneycontrol on a cybercriminal marketplace forum

The following contains the full list of database headers obtained from the CSV posted by actor "kehanet00."

Breach Package Headers

User_email,user_pwd,user_country,user_phone,user_mobile,user_pincode,user_dob,user_gender,user_address,user_city,user_state

Figure 2: Full list of database headers within the breached data

Breaking News: 2021-05-21 - 2021-05-27

Microsoft releases SimuLand, a test lab for simulated cyberattacks - BleepingComputer

Microsoft has released SimuLand, an open-source lab environment to help test and improve Microsoft 365 Defender, Azure Defender, and Azure Sentinel defenses against real attack scenarios. SimuLand test labs will provide use cases from a variety of data sources including telemetry from Microsoft 365 Defender security products, Azure Defender, and other integrated data sources through Azure Sentinel data connectors. Currently, the only lab environment available for deployment allows researchers to test and improve their defenses against Golden SAML attacks that allow threat actors to forge authentication to cloud apps.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-releases-simuland-a-test-lab-for-simulated-cyberattacks/

Microsoft: Massive malware campaign delivers fake ransomware - BleepingComputer

Microsoft Security Intelligence team has discovered a massive malware campaign that used the Java-based STRRAT remote access trojan (RAT) to steal data and spread fake ransomware payloads using compromised email accounts. The spam emails lured the recipients into opening what looked like PDF attachments but instead were images that downloaded the RAT malware when clicked. The rat malware is used to log keystrokes, run commands remotely and harvest sensitive information including credentials from email clients and browsers including Firefox, Internet Explorer, Chrome, Foxmail, Outlook, and Thunderbird.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-massive-malware-campaign-delivers-fake-ransomware/

Spammers flood PyPI with pirated movie links and bogus packages - BleepingComputer

The official Python software package repository, PyPI, is getting flooded with spam packages. These packages are named after different movies in a style that is commonly associated with torrents and "warez" sites hosting pirated content. Each of these packages is posted by a unique pseudonymous maintainer account, making it challenging for PyPI to remove the packages and spam accounts all at once. Currently, the PyPI admins are working on addressing the spam attack.

See the full report here: https://www.bleepingcomputer.com/news/security/spammers-flood-pypi-with-pirated-movie-links-and-bogus-packages/

Comcast now blocks BGP hijacking attacks and route leaks with RPKI - BleepingComputer

Comcast, one of America's largest broadband providers, has now deployed Resource Public Key Infrastructure (RPKI) on its network to defend against BGP route hijacks and leaks. BGP route hijacks is a networking problem that occurs when a particular network on the internet falsely advertises that it supports certain routes or prefixes that it, in fact, does not. This can cause a drastic surge in misdirected internet traffic that eventually leads to global congestion and a Denial of Service (DoS). With the implementation, Comcast now both cryptographically signs route information and validates the cryptographic signatures of other networks' route information.

See the full report here: https://www.bleepingcomputer.com/news/security/comcast-now-blocks-bgp-hijacking-attacks-and-route-leaks-with-rpki/

E-commerce giant suffers major data breach in Codecov incident - BleepingComputer

E-commerce platform Mercari has disclosed a major data breach incident that occurred due to exposure from the Codecov supply-chain attack. Mercari is a Japanese public company and an online marketplace that has recently expanded its operations to the United States and the United Kingdom. The company has confirmed that tens of thousands of customer records, including financial information, were exposed to external actors due to the Codecov breach.

See the full report here: https://www.bleepingcomputer.com/news/security/e-commerce-giant-suffers-major-data-breach-in-codecov-incident/

Air India data breach impacts 4.5 million customers - BleepingComputer

Air India disclosed a data breach after personal information belonging to roughly 4.5 million of its customers was leaked two months following the hack of Passenger Service System provider SITA in February 2021. The breach involved personal data registered between 26th August 2011 and 3rd February 2021, with details that included name, date of birth, contact information, passport information, ticket information, Star Alliance, and Air India frequent flyer data (but no passwords data were affected) as well as credit cards data. After investigation, it was found that no credit card information or password data was accessed during the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/air-india-data-breach-impacts-45-million-customers/

WP Statistics Bug Allows Attackers to Lift Data from WordPress Sites

WP Statistics, a plugin installed on more than 600,000 WordPress websites, has an SQL-injection security vulnerability that could let site visitors make off with all kinds of sensitive information from web databases, including emails, credit card data, passwords, and more. WP Statistics is a plugin that delivers analytics for site owners. The high-severity bug is tracked as CVE-2021-24340 and has a rating 7.5 out of 10 on the CVSS scale. VeronaLabs, the plugin’s developer, has released a patch with version 13.0.8.

See the full report here: https://threatpost.com/wp-statistics-attackers-data-wordpress/166386/

QNAP confirms Qlocker ransomware used HBS backdoor account - BleepingComputer

QNAP is advising customers to update the HBS 3 disaster recovery app to block Qlocker ransomware attacks targeting their Internet-exposed Network Attached Storage (NAS) devices. "The ransomware known as Qlocker exploits CVE-2021-28799 to attack QNAP NAS running certain versions of HBS 3 (Hybrid Backup Sync)," the Taiwan-based NAS appliance maker said in a security advisory issued on Friday.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-confirms-qlocker-ransomware-used-hbs-backdoor-account/

Wormable Windows HTTP vulnerability also affects WinRM servers - BleepingComputer

A wormable vulnerability in the HTTP Protocol Stack of the Windows IIS server can also be used to attack unpatched Windows 10 and Server systems publicly exposing the WinRM (Windows Remote Management) service. Although it can be abused by threat in remote code execution (RCE) attacks, the vulnerability ONLY impacts versions 2004 and 20H2 of Windows 10 and Windows Server. Microsoft already patched the critical bug tracked as CVE-2021-31166 during the May Patch Tuesday.

See the full report here: https://www.bleepingcomputer.com/news/security/wormable-windows-http-vulnerability-also-affects-winrm-servers/

Bizarro banking malware targets 70 banks in Europe and South America - BleepingComputer

A banking trojan named Bizarro that originates from Brazil has crossed the borders and started to target 70 banks in Europe and South America. Statistics from cybersecurity company Kaspersky shows that Bizarro’s targets are now customers of banks in Europe (Germany, Spain, Portugal, France, Italy) and South America (Chile, Argentina, Brazil).

See the full report here: https://www.bleepingcomputer.com/news/security/bizarro-banking-malware-targets-70-banks-in-europe-and-south-america/

Microsoft releases first Windows 10 build without Internet Explorer - BleepingComputer

Microsoft has released the first Windows 10 build without the Internet Explorer web browser to Windows Insiders in the Dev Channel. As Microsoft announced on Wednesday, Internet Explorer 11 will be permanently retired from several Windows 10 versions and editions, and replaced with the Chromium-based Microsoft Edge in June 2022.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-first-windows-10-build-without-internet-explorer/

DarkSide Getting Taken to ‘Hackers’ Court’ For Not Paying Affiliates

Cybercriminals who have worked as affiliates with ransomware group DarkSide, responsible for the Colonial Pipeline attack, are having a tough time getting paid for their work now that the group has had its operations interrupted, so, they’re turning to admins of the group’s Dark Web criminal forum to sort things out in what researchers call a shady version of the People’s Court.

See the full report here: https://threatpost.com/darkside-hackers-court-paying-affiliates/166393/

Insurance Firm CNA Financial Reportedly Paid Hackers $40 Million in Ransom

U.S. insurance giant CNA Financial reportedly paid $40 million to a ransomware gang to recover access to its systems following an attack in March, making it one the most expensive ransoms paid to date. The development was first reported by Bloomberg, citing people with knowledge of the attack. The adversary that staged the intrusion is said to have allegedly demanded $60 million a week after the Chicago-based company began negotiations with the hackers, culminating in the payment two weeks following the theft of company data.

See the full report here: https://thehackernews.com/2021/05/insurance-firm-cna-financial-reportedly.html

LittleBigPlanet Servers Shut Down Following Cyber Attacks - GameRant

After six weeks of issues, the LittleBigPlanet servers were finally up and running. However, via the official Twitter page, developer Media Molecule has confirmed that the servers have been attacked, and therefore things must be shut down again temporarily. The LittleBigPlanet servers were first shut down in mid-March due to a reported DDoS attack (Distributed Denial-of-Service), although this was not the confirmed reason at the time.

See the full report here: https://gamerant.com/littlebigplanet-servers-shut-down-again-cyber-attack-may-2021/

NZ firm helps Irish health service recover from ransomware attack - Stuff.co.nz

Authorities in Ireland have turned to a tool provided free-of-charge by Nelson-based cyber-security company Emsisoft to help the Irish health service recover from a devastating ransomware attack. Emsisoft has also offered to provide free help to Waikato DHB, which has experienced a similar cyber attack, although in the DHB’s case it is less clear what assistance it could immediately provide and it has yet to hear back on its offer.

See the full report here: https://www.stuff.co.nz/business/125220408/nz-firm-helps-irish-health-service-recover-from-ransomware-attack

Sierra College victim of ransomware attack - Gold Country Media

Sierra College was the victim of a ransomware attack Thursday morning that left students unable to submit final assignments and teachers unable to work on posting final grades before Friday’s end of the semester. According to the college spokesperson Josh Morgan, law enforcement has been called in along with a third-party cybersecurity forensic consultant to investigate how the ransomware attack occurred.

See the full report here: https://goldcountrymedia.com/news/189799/sierra-college-victim-of-ransomware-attack/

Indonesia’s national health insurance scheme leaks at least a million citizens' records

Indonesia’s government has admitted the breach of personal data from the agency that runs its national health insurance scheme. On May 20th Kominfo, Indonesia’s Ministry of Communication and Information Technology acknowledged it was aware of a post on notorious stolen-data-mart Raidforums offering to sell a million records leaked from the Badan Penyelenggara Jaminan Sosial (BPJS), an agency that runs national health insurance scheme Jaminan Kesehatan Nasional (JKN).

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/05/24/indonesia_health_data_breach/

Google Chrome fix released for worldwide crashes on Windows 10, Linux - BleepingComputer

Google has released a minor Google Chrome update that fixes the worldwide browser crashes occurring since Thursday on Windows 10 and Linux. On Thursday, many Windows 10 users suddenly found that Google Chrome extensions and tabs were crashing, as shown in the image below. It was later learned that Linux users were affected by this issue as well.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-fix-released-for-worldwide-crashes-on-windows-10-linux/

Microsoft Exchange admin portal blocked by expired SSL certificate - BleepingComputer

The Microsoft Exchange admin portal is currently inaccessible from some browsers after Microsoft forgot to renew the SSL certificate for the website. Microsoft Exchange admins who attempted to access the admin portal at admin.exchange.microsoft.com suddenly found that their browsers were issuing warnings that the connection was not private due to an expired SSL certificate.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-admin-portal-blocked-by-expired-ssl-certificate/

Amex fined £90,000 for sending 4 million spam emails in a year - BleepingComputer

The UK data regulator has fined American Express (Amex) £90,000 for sending over 4 million spam emails to customers within one year. During the investigation, the ICO found that Amex had sent over 50 million of what it classed as servicing emails to its customers, the UK Information Commissioner's Office (ICO) said.

See the full report here: https://www.bleepingcomputer.com/news/security/amex-fined-90-000-for-sending-4-million-spam-emails-in-a-year/

Garda expect ‘avalanche’ of fraud claims following hacker data release - The Irish Times

Gardaí is preparing for an “avalanche” of fraud once the cybercriminals who attacked the Health Service Executive release the stolen patient data this week, as they have promised to do. The gang behind the cyber attack had given the Government until today to pay a €16.4 million ransom to stop it publishing or selling what it claims is 700 gigabytes of stolen data.

See the full report here: https://www.irishtimes.com/news/crime-and-law/garda-expect-avalanche-of-fraud-claims-following-hacker-data-release-1.4573027

Cyberattack targeting Alaska's state health department website disrupts some online services - Anchorage Daily News

A malware attack targeting the Alaska Department of Health and Social Services’ website has prompted the disruption of some online services as the website remains unavailable to the public, the state health department said Tuesday evening. Investigators have not yet determined whether the cyberattack compromised confidential or personal information, DHSS said in a statement.

See the full report here: https://www.adn.com/alaska-news/2021/05/18/cyberattack-targeting-alaskas-state-health-department-website-disrupts-some-online-services/

Apple fixes three zero-days, one abused by XCSSET macOS malware - BleepingComputer

Apple has released security updates to patch three macOS and tvOS zero-day vulnerabilities attackers exploited in the wild, with the former being abused by the XCSSET malware to bypass macOS privacy protections. In all three cases, Apple said that it is aware of reports that the security issues may have been actively exploited, but it didn't provide details on the attacks or threat actors who may have abused the zero-days.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-fixes-three-zero-days-one-abused-by-xcsset-macos-malware/

Bluetooth flaws allow attackers to impersonate legitimate devices - BleepingComputer

Attackers could abuse vulnerabilities discovered in the Bluetooth Core and Mesh Profile specifications to impersonate legitimate devices during the pairing process and launch man-in-the-middle (MitM) attacks. Successfully exploiting the vulnerabilities found and reported by researchers at the Agence nationale de la sécurité des systèmes d'information (ANSSI), could enable the attackers to launch MitM attacks while within wireless range of vulnerable devices.

See the full report here: https://www.bleepingcomputer.com/news/security/bluetooth-flaws-allow-attackers-to-impersonate-legitimate-devices/

Details Disclosed On Critical Flaws Affecting Nagios IT Monitoring Software

Cybersecurity researchers disclosed details about 13 vulnerabilities in the Nagios network monitoring application that could be abused by an adversary to hijack the infrastructure without any operator intervention. Nagios is an open-source IT infrastructure tool analogous to SolarWinds Network Performance Monitor (NPM) that offers monitoring and alerting services for servers, network cards, applications, and services.

See the full report here: https://thehackernews.com/2021/05/details-disclosed-on-critical-flaws.html

DarkSide affiliates claim gang's bitcoin deposit on hacker forum - BleepingComputer

Since the DarkSide ransomware operation shut down a week ago, multiple affiliates have complained about not getting paid for past services and issued a claim for bitcoins in escrow at a hacker forum. To gain the trust of potential partners and expand the operation, DarkSide deposited 22 bitcoins on the famous hacker forum XSS. The wallet is managed by the site’s administrator, which in this case acts as a guarantor for the gang and an arbitrator if a dispute occurs.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-affiliates-claim-gangs-bitcoin-deposit-on-hacker-forum/

Audio maker Bose discloses data breach after ransomware attack - BleepingComputer

Bose Corporation (Bose) has disclosed a data breach following a ransomware attack that hit the company's systems in early March. In a breach notification letter filed with New Hampshire's Office of the Attorney General, Bose said that it experienced a sophisticated cyber-incident that resulted in the deployment of malware/ransomware across its environment.

See the full report here: https://www.bleepingcomputer.com/news/security/audio-maker-bose-discloses-data-breach-after-ransomware-attack/

Restaurant Reservation System Patches Easy-to-Exploit XSS Bug

An easy-to-exploit bug impacting the WordPress plugin ReDi Restaurant Reservation allows unauthenticated attackers to pilfer reservation data and customer personal identifiable information by simply submitting a malicious snippet of JavaScript code into the reservation comment field. The bug affects ReDi Restaurant Reservation versions before 21.0307, with a patched (v. 21.0426) version of the plugin available for download. The vulnerability (CVE-2021-24299) is a persistent cross-site scripting (XSS) bug.

See the full report here: https://threatpost.com/reservation-system-easy-to-exploit-xss-bug/166414/

Indonesian govt blocks access to RaidForums hacking forum after data leak - BleepingComputer

The Indonesian government is blocking access to the RaidForums hacking forum after the alleged personal information of Indonesian citizens was posted online. On Friday, a newly registered forum member posted what they claim is a database containing 200 million records of personal data for Indonesian people.

See the full report here: https://www.bleepingcomputer.com/news/security/indonesian-govt-blocks-access-to-raidforums-hacking-forum-after-data-leak/

FBI Analyst Indicted for Theft of Osama bin Laden Threat Intel

An FBI analyst with top-secret security clearance illegally squirreled away national-security documents related to Osama bin Laden, al-Qaeda, cybersecurity, and more in her home for years, the feds say. Kendra Kingsbury, who was working in the FBI’s Kansas City Division until being put on leave in December 2017, has been indicted by a federal grand jury for allegedly routinely removing numerous documents from their safekeeping at the office, over and over during the period between June 2004 to Dec. 15, 2017.

See the full report here: https://threatpost.com/fbi-analyst-cyber-threat-bin-laden-data/166405/

Zeppelin ransomware comes back to life with updated versions - BleepingComputer

The developers of Zeppelin ransomware have resumed their activity after a period of relative silence that started last Fall and started to advertise new versions of the malware. A recent variant of the malware became available on a hacker forum at the end of last month, offering cyber criminals in the ransomware business complete independence.

See the full report here: https://www.bleepingcomputer.com/news/security/zeppelin-ransomware-comes-back-to-life-with-updated-versions/

Domino's India discloses data breach after hackers sell data online - BleepingComputer

Domino's India has disclosed a data breach after a threat actor hacked their systems and sold their stolen data on a hacking forum. In April 2021, a threat actor created a new topic on a hacking forum where they claimed to be selling 13 TB of stolen data, including details for 18 crores (180 million) orders and 1 million credit cards, from Domino's India. This month, the same threat actors launched a Tor dark web search engine that allows people to enter their phone numbers or email addresses to see if their information is exposed in the database. However, the company state that the threat actor's claims to have stolen 1 million credit cards are false as they do not store any financial details of users on their site.

See the full report here: https://www.bleepingcomputer.com/news/security/dominos-india-discloses-data-breach-after-hackers-sell-data-online/

Microsoft fixes new Windows 10 bug corrupting FLAC music files - BleepingComputer

Microsoft has fixed a known Windows 10 issue that would lead to FLAC encoded music files becoming corrupted when changing their title, artist, or other metadata in File Explorer. The bug impacts multiple Windows 10 editions (Home, Pro, Enterprise, Education, Pro Education, and Pro for Workstations) and versions (version 2004 and version 20H2).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-new-windows-10-bug-corrupting-flac-music-files/

Google Chrome 91 released with new features, security improvements - BleepingComputer

Google has released Chrome 91 today, May 25th, 2021, to the Stable desktop channel, and it includes security improvements, the ability to copy and paste files into web pages, and new developer features. Chrome 91 fixes 32 security vulnerabilities, with eight being marked as 'High' severity.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-91-released-with-new-features-security-improvements/

VMware warns of critical bug affecting all vCenter Server installs - BleepingComputer

VMware urges customers to patch a critical remote code execution (RCE) vulnerability in the Virtual SAN Health Check plug-in and impacting all vCenter Server deployments. The vulnerability can be used by anyone who can reach the vCenter Server over the network to gain access, regardless of whether you use vSAN or not. vCenter Server is a server management solution that helps IT admins manage virtual machines and virtualized hosts within enterprise environments via a single console.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-warns-of-critical-bug-affecting-all-vcenter-server-installs/

Threat Actor ‘Agrius’ Emerges to Launch Wiper Attacks Against Israeli Targets

A new attack group called Agrius is launching damaging wiper attacks against Israeli targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated. Sentinel Labs analysts said they have been tracking Agrius’ operations in Israel since 2020 and have observed the evolution of the group’s malware, Apostle, to include ransomware functionality. Researchers added that the wiper attacks were conducted using a secondary malware called “Deadwood” (a.k.a. “Detbosit”), which Sentinel Labs said has unconfirmed links to an Iranian threat group.

See the full report here: https://threatpost.com/agrius-wiper-attacks-israeli-targets/166474/

Russian Hydra DarkNet Market Made Over $1.3 Billion in 2020

Russian-language dark web marketplace Hydra has emerged as a hotspot for illicit activities, pulling in a whopping $1.37 billion worth of cryptocurrencies in 2020, up from $9.4 million in 2016. The "blistering growth" in annual transaction volumes marks a staggering 624% year-over-year jump over three years from 2018 to 2020.

See the full report here: https://thehackernews.com/2021/05/russian-hydra-darknet-market-made-over.html

Pulse Secure VPNs Get Quick Fix for Critical RCE

Pulse Secure’s parent company, Ivanti, issued an out-of-band advisory on May 14 that addresses a high-severity bug, identified as CVE-2021-22908, in Pulse Connect Secure versions 9.0Rx and 9.1Rx. The vulnerability is rated as High with a CVSS score of 8.5 out of 10. The CERT Coordination Center has also issued a report about the vulnerability, explaining that the problem stems from a buffer overflow vulnerability in the PCS gateway and the gateway's ability to connect to Windows file shares through a number of CGI endpoints could be leveraged to carry out an attack. Currently, there is no practical solution, but there are workarounds available to remediate the issue.

See the full report here: https://threatpost.com/pulse-secure-vpns-critical-rce/166437/

Google Discovers New Rowhammer Attack Technique

Researchers have published details of a new Rowhammer vulnerability called "Half-Double" that exploits increasingly smaller DRAM chips. Rowhammer, first reported in 2014, is a vulnerability through which repeated access to one address can allow an attacker to compromise data stored at other addresses. The discovery indicates that as RAM chips have grown smaller, the Rowhammer attack can be used to affect a greater number of cells.

See the full report here: https://www.darkreading.com/threat-intelligence/google-discovers-new-rowhammer-attack-technique/d/d-id/1341147

PDF Feature ‘Certified’ Widely Vulnerable to Attack

Certified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents’ integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks. The certified PDFs use two specific signatures to authenticate the document, an Approval signature, and a Certification signature. Researchers discovered flaws in Certified signatures that are vulnerable to specific novel attacks, dubbed as "Evil Annotation” (EAA) and “Sneaky Signature” (SSA). Both allow an attacker to overlay malicious content (PDF) on top of the certified information without showing any signs it was altered.

See the full report here: https://threatpost.com/pdf-certified-widely-vulnerable-to-attack/166505/

Office 365 bug: Exchange Online, Outlook emails sent to junk folder - BleepingComputer

Microsoft is investigating an Office 365 issue causing Outlook and Exchange Online emails to skip recipients' inboxes and being sent their junk folders instead. The Microsoft 365 Service health status page is currently directing customers to the Microsoft 365 Status Twitter account for more details regarding this ongoing incident. The company has informed that more information will be shared under EX258373 in the Microsoft 365 admin center.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/office-365-bug-exchange-online-outlook-emails-sent-to-junk-folder/