Threat Intelligence Bulletin: 05/28/2021 - 06/03/2021

Breach Disclosure: JD

In 2013, Chinese e-commerce service, JD, suffered a data breach in which 13 GB of data containing 77 million unique e-mail addresses were exposed. The breach involved the exposure of usernames, phone numbers, and SHA-1 hashed passwords. The leaked data was posted on cybercriminal underground marketplaces in May 2021.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On May 25, 2021, the Raid Forums actor "SSL3" posted a data breach package targeting the organization JD.com (jd[.]com), also known as Jingdong and formerly called 360buy, is a Chinese e-commerce company headquartered in Beijing. The leaked database is also circulating on the XSS forum. JD is China's second largest e-commerce platform. The website was originally breached in 2013, and data from this breach was also distributed in criminal underground forums in Decmber of 2016, as well, including customer names, addresses, phone numbers, ID numbers, and purchase history. ZeroFOX has not been able to confirm whether the released package from 2021 is the same data from the 2016 release.

Breach Disclosure: Domino's India

In 2021, Domino's India, which is operated by the parent organization Jubilant Foodworks Limited who is the master franchisee for Domino's Pizza in India, suffered a data breach in which 13 TB of data containing employee records for 250 employees, details for 180 million orders, and 1 million credit cards were allegedly exposed. The breach involved the release of names, phone numbers, emails, delivery addresses, and payment details. The leaked data was originally posted for sale on cybercriminal underground marketplaces in April 2021.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On May 25, 2021, Domino's India disclosed a data breach against their network. The breach originally occured in April, 2021, and was offered for sale by the Raid Forums actor "BRBbrbt" on April 16, 2021, and then again in May 2021. Jubilant FoodWorks Limited is the parent company of Domino's India, and is the major franchisee in India for Domino's Pizza. The database allegedy contains data from 2015-2021 with Outlook mail archives, including all internal files of 250 employees from IT, Legal, Finance, Marketing, Operations, and other departments. It also contains all customer information, 180 million order details (name, phone number, email, delivery address, payment details), and 1 Million credit cards used to purchase on Dominos mobile application. The threat actor offered the database for sale for 10 BTC (about USD 570,000 at the time) and then demanded a ransom of 50 BTC (about USD 2.8M at the time) or they would build a search portal of the data. That portal appears to have launched in May, 2021, as a Tor dark web search engine run by the threat actor.

Cybercriminal Underground Networks Respond to Ransomware Activity After Colonial Pipeline Attack

On May 7, 2021, Colonial Pipeline suffered a ransomware attack that led to systems being suspended for several days. The incident underscored the severity of modern-day ransomware attacks and how such attacks affect the general public's lives and critical infrastructure. In response to the incident, the United States (US) federal government worked quickly to enact legislation that assists US-based organizations affected by a cyber attack, including an executive order improving national cybersecurity. On the other hand, threat actors in cybercriminal underground networks also responded to the attack, with some forums banning ransomware discussion and ransomware operators banning attacks on critical infrastructure.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets
• Segment critical network resources using zero-trust configurations
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks
• Limit file egress by size and type
• Disable macros whenever possible
• Avoid opening unsolicited attachments and never click suspicious links
• Enable 2-factor authentication for all of your organizational accounts
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

The threat of ransomware in today's cyber threat landscape makes it critical for organizations to take proper precautions to prevent attacks on their systems. Throughout 2020 and into 2021, ransomware continually matured into a severe threat to organizations and individuals through sophisticated infection vectors and double extortion tactics. Many ransomware groups emerged during this period where they operated data leak sites to expose their victims and threatened to release their data if ransom demands were not met within a specific timeframe. ZeroFOX observed a total of 36 ransom-and-leak operations dating back to as early as May 2019.

The DarkSide ransomware attack on Colonial Pipeline demonstrated how a ransomware attack could affect civilians and the federal government, especially in maintaining critical infrastructure. In the aftermath of the attack, the US government took action to draft legislation that centers around improving national cybersecurity. Such actions include enacting cybersecurity policies, leveraging threat intelligence, conducting incident response, and securing older systems and government infrastructure.

The prevalence of double extortion tactics and evasive malware attack chains made it so that ransomware operations became a trending topic among cybercriminal underground marketplaces due to the lucrative appeal. Despite some ransomware groups operating their websites via dark web networks, some groups engaged with cybercriminal forums and platforms to advertise their operations and recruit other actors to join their affiliate programs.

ZeroFOX monitors many cybercriminal communities and advertisements for affiliate programs. An example of a ransomware affiliate program was observed by ZeroFOX when Babuk ransomware operators posted an advertisement on a Russian-speaking forum (Figure 1) recruiting members to join their affiliate program in March 2021. The operators were looking for members to join their three different ransomware products.

Figure 1: Russian-language post of Babuk ransomware affiliate program (Note: translated from Russian)

After the Colonial Pipeline attack, some cybercrime marketplace networks banned any or all ransomware-related posts and advertisements, and some ransomware operators updated their affiliate programs to forbid affiliate members from targeting critical infrastructure. ZeroFOX Research recorded a number of examples where ransomware groups and cybercriminal forum administrators disclosed restrictions on ransomware-related activity.

On May 13, 2021, the REvil ransomware group (also known as Sodinokibi) published a thread on a cybercriminal underground network notifying members that a DarkSide ransomware member disclosed that the team lost access to the DarkSide leak site, payment server, and Denial of Service (DOS) servers after the Colonial Pipeline attack. The REvil member then discussed that affiliate members were forbidden from targeting government, healthcare, and educational institutions. Figure 2 is a screenshot of the Revil thread.

Figure 2: REvil actor announces ban on affiliates targeting government, healthcare, and education organizations after DarkSide attack (Note: translated from Russian)

One day after REvil's post, website administrators on a popular Russian-language forum opened a thread prohibiting discussion of all ransomware sales, advertisements, and affiliate programs. While it may be possible that some threat actors have concerns over repercussions for engaging with prohibited ransomware posts, the primary reason for the ban is to prevent further attention to these cybercriminal marketplace networks. These networks often include security researchers and law enforcement monitoring networks for threat intelligence and potential takedown opportunities, and threat actors are aware of their presence on such networks. The administrators Figure 3 is a screenshot of the original post translated from Russian to English.

Figure 3: Forum administrator prohibits ransomware discussions (Note: translated from Russian)

Indeed, major ransomware groups operating affiliate programs are working to adapt to the new realities for their presence in key underground forums. ZeroFOX observed an actor representing the Avaddon ransomware group recently attempt to open a new thread for recruiting penetration testers, but a forum administrator quickly removed it in line with the new ban. Despite initial concerns from some actors, posts advertising network access sales continue without disruption, and ransomware actors are showing their ongoing interest in this activity with positive reactions, such as “LockBitSupp” in Figure 4.

Figure 4: LockBit actor noting positive reaction to recent network access sale (Note: translated from Russian)

Conversely, the new restrictions have not prevented some ransomware groups from conducting activities. Groups like Conti and Avaddon ransomware continue operations at a higher rate even without regard to target industries. Figure 5 is a chart displaying a list of ransomware groups that participate in data leak exposures via double extortion schemes collected by ZeroFOX. Conti ransomware takes the lead with the highest volume of infections followed by Avaddon ransomware. REvil and DarkSide follow with the third and fourth highest data leak rates. However, this volume is likely to change due to the recent bans put in place by underground forum administrators and ransomware operators.

Figure 5: Volume of ransomware data leak targets from February 1, 2021, to June1, 2021

The massive attention that DarkSide ransomware received for the Colonial Pipeline attack signals a shift towards a targeted effort to thwart ransomware attacks. However, it is currently unclear if these efforts will result in fewer ransomware attacks. Although the bans put in place by administrators in cybercriminal underground networks may decrease the volume of ransomware-related activity, it does not guarantee that all ransomware-related activities will cease. For example, posts regarding network access sales are likely to continue as long as the advertisement does not mention ransomware. Furthermore, ransomware data leak websites will continue operations, but to avoid repercussions like that of DarkSide, these groups are likely to specify prohibited industry targets. Only time will tell if these actions will prompt lasting results.

Breaking News: 2021-05-29 - 2021-06-04

Mexico walls off national lottery sites after ransomware DDoS threat - BleepingComputer

Access to Mexico's Lotería Nacional and Pronósticos lottery websites are now blocked to IP addresses outside of Mexico after a ransomware gang threatened to perform denial of service attacks. Lotería Nacional is the government-run national lottery system of Mexico, operating under Mexico's Ministry of Finance. Yesterday, the Avaddon ransomware operation stated that they successfully conducted an attack on 'Pronosticos Deportivo,' where they claim to have stolen data and then encrypted the devices. The ransomware gang also threatened to release more documents and to DDoS the victim's website if negotiations did not begin within 240 hours.

See the full report here: https://www.bleepingcomputer.com/news/security/mexico-walls-off-national-lottery-sites-after-ransomware-ddos-threat/

Hackers Exploit Post-COVID Return to Offices

With COVID-19 restrictions lifting and workers trickling back to offices, threat actors are sharpening their spear-phishing ploys. The latest scam includes pelting recipients with emails purportedly from their CIOs welcoming employees back into offices. The emails outline a company’s post-pandemic cubicle protocols, at the same time attempt to steal company and personal credentials.

See the full report here: https://threatpost.com/hackers-exploit-covid-office/166550/

Chinese cyberspies are targeting US, EU orgs with new malware - BleepingComputer

Chinese threat groups are deploying new malware strains on the compromised network of dozens of US and EU organizations after exploiting vulnerable Pulse Secure VPN appliances. After compromising the targeted devices, they deployed malware to maintain long-term access to networks, collect credentials, and steal proprietary data. The threat actor groups UNC2630 and UNC2717 are suspected to be behind the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-cyberspies-are-targeting-us-eu-orgs-with-new-malware/

Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents

Cybersecurity researchers have disclosed two new attack techniques on certified PDF documents that could potentially enable an attacker to alter a document's visible content by displaying malicious content over the certified content without invalidating its signature. The attack idea exploits the flexibility of PDF certification, which allows signing or adding annotations to certified documents under different permission levels.

See the full report here: https://thehackernews.com/2021/05/researchers-demonstrate-2-new-hacks-to.html

SonicWall urges customers to 'immediately' patch NSM On-Prem bug - BleepingComputer

SonicWall urges customers to immediately patch a post-authentication vulnerability impacting on-premises versions of the Network Security Manager (NSM) multi-tenant firewall management solution. The vulnerability tracked as CVE-2021-20026 affects NSM 2.2.0-R10-H1 and earlier, and it was patched by SonicWall in the NSM 2.2.1-R6 and 2.2.1-R6 (Enhanced) versions.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-urges-customers-to-immediately-patch-nsm-on-prem-bug/

Siemens Patches Major PLC Flaw that Bypasses Its 'Sandbox' Protection

Researchers from ICS security vendor Claroty published details on a severe vulnerability they found in Siemens SIMATIC S7-1200 and S7-1500 PLCs that could allow an attacker to gain remote access to protected memory areas of the popular programmable logic controllers. Siemens issued firmware updates for both PLC models that fix the memory-protection bypass flaw (CVE-2020-15782), which scored a CVSS 8.1 severity rating and plans to publish more updated mitigations for products for which updates are not yet available.

See the full report here: https://www.darkreading.com/physical-security/siemens-patches-major-plc-flaw-that-bypasses-its-sandbox-protection/d/d-id/1341161

Microsoft: Russian hackers used 4 new malware in USAID phishing - BleepingComputer

Microsoft states that a Russian hacking group used four new malware families in recent phishing attacks impersonating the United States Agency for International Development (USAID). Thursday night, the Microsoft Threat Intelligence Center (MSTIC) disclosed that the Russian-backed hacking group APT29, also known as Nobelium, had compromised the Contact Contact account for USAID. Using this legitimate marketing account, the threat actors impersonated USAID in phishing emails sent to approximately 3,000 email accounts at more than 150 different organizations, including government agencies and organizations devoted to international development, humanitarian, and human rights work.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-russian-hackers-used-4-new-malware-in-usaid-phishing/

New Epsilon Red ransomware hunts unpatched Microsoft Exchange servers - BleepingComputer

A new ransomware threat calling itself Red Epsilon has been seen leveraging Microsoft Exchange server vulnerabilities to encrypt machines across the network. Epsilon Red ransomware attacks rely on more than a dozen scripts before reaching the encryption stage and use a commercial remote desktop utility.

See the full report here: https://www.bleepingcomputer.com/news/security/new-epsilon-red-ransomware-hunts-unpatched-microsoft-exchange-servers/

HopeHealth announces third-party data breach | Local News | scnow.com - SCNow

HopeHealth recently was notified that CaptureRx, a third-party business associate that provides certain pharmacy support services to many health care providers, experienced a data breach earlier this year that involved more than 1.6 million patients at more than 120 health care facilities nationwide. This included 963 HopeHealth patients, primarily in the Williamsburg County area. CaptureRx is in the process of sending written notice to all patients affected by the breach.

See the full report here: https://scnow.com/news/local/hopehealth-announces-third-party-data-breach/article_e91508fa-c096-11eb-9286-676ac67e1480.html

Watch out: These unsubscribe emails only lead to further spam - BleepingComputer

For some time, spammers have been sending emails that ask if you wish to unsubscribe or subscribe. These emails do not explain what you are unsubscribing or subscribing to and are being used by spammers to verify if the recipient's email is valid and susceptible to phishing scams and other malicious activity.

See the full report here: https://www.bleepingcomputer.com/news/security/watch-out-these-unsubscribe-emails-only-lead-to-further-spam/

Lawmakers weigh up how to address the menace of ransomware - Digital Journal

In the U.S.., the Department of Justice (DOJ) is launching a task force dedicated to addressing the growing threat of ransomware. According to a new survey exploring security issues, the Unisys Security Index, less than one in three (31 percent) of U.S. citizens are concerned about their data security while working from home during the COVID-19 global health crisis.

See the full report here: https://www.digitaljournal.com/tech-science/lawmakers-weigh-up-how-to-address-the-menace-of-ransomware/article

Hackers using fake streaming site to distribute BazaLoader dropper - TEISS

The phishing campaign, first discovered in early May by Proofpoint, involved hackers setting up a fake movie-streaming website called BravoMovies and populating the site with fake movie posters and additional content to make it appear genuine. The victims are tricked into downloading the BazaLoader malware dropper by making them believe they erroneously subscribed to a movie streaming service.

See the full report here: https://www.teiss.co.uk/bazaloader-dropper-phishing-scam/

'Dearthy Star' pleads guilty to selling info of 65K health care employees - BleepingComputer

The University of Pittsburgh Medical Center (UPMC), a health care provider, data has been sold on Darkweb by a threat actor known as 'TheDearthStar' and 'Dearthy Star’. He stole the Personally Identifiable Information (PII) of 65,000 employees from UPMC’s breached HR databases and sold it on the Dark web. The healthcare systems are an attractive target for the cybercriminals engaged in committing identity theft and bank fraud.

See the full report here: https://www.bleepingcomputer.com/news/security/dearthy-star-pleads-guilty-to-selling-info-of-65k-health-care-employees/

Bose confirms ransomware attack that exposed employee data - Engadget

Audio equipment manufacturer Bose Corporation confirms a cyber incident that resulted in the deployment of ransomware across their environment. The threat actor has accessed some of the company’s current and former employees’ personal information after getting a foothold in their network. Bose has initiated incident response protocols and notified the affected individuals. The investigation is ongoing.

See the full report here: https://www.engadget.com/bose-ransomware-attack-employee-data-110550196.html

Swedish Health Agency shuts down SmiNet after hacking attempts - BleepingComputer

The Swedish Public Health Agency discovered that there have been several attempted intrusions into their SmiNet database which is used to store electronic reports with statistics on COVID-19 infections. Therefore, the agency has closed down the database temporarily and investigating the incident. The incident has been reported to the Police and the Privacy Protection Authority.

See the full report here: https://www.bleepingcomputer.com/news/security/swedish-health-agency-shuts-down-sminet-after-hacking-attempts/

Have I Been Pwned goes open source, bags help from FBI

The Pwned (HIBP) website, which is famous for alerting people if it turns out their credentials have been swiped and leaked from an account database, has now open-sourced its project's internals for people to pick up, use, and improve. The Pwned Passwords codebase is now available from GitHub under a BSD three-clause license. According to the creator, the FBI has offered to feed known compromised passwords into the HIBP website.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/06/01/in_brief_security/

Food giant JBS Foods shuts down production after cyberattack - BleepingComputer

JBS Foods, a leading food company and the largest meat producer globally had to shut down production at multiple sites worldwide following a cyberattack. The incident impacted multiple JBS production facilities worldwide over the weekend, including those from the United States, Australia, and Canada.

See the full report here: https://www.bleepingcomputer.com/news/security/food-giant-jbs-foods-shuts-down-production-after-cyberattack/

Police warn companies against paying hackers a ransom - RTHK - RTHK

Police have warned companies that in the unfortunate event that their data is held hostage by criminals using ransomware, they should not pay up, especially with cryptocurrency. Officers said using virtual currency would make it extremely difficult for them to trace the money and investigate a case.

See the full report here: https://news.rthk.hk/rthk/en/component/k2/1593645-20210601.htm

NZ cloud storage company being used by ransomware attackers, says FBI - New Zealand Herald

The FBI warns Auckland company, Mega.NZ is being used by ransomware attackers. The company has told RNZ there is no sign hackers are using its service to store patient data stolen from Waikato hospitals, but it cannot rule out the possibility.

See the full report here: https://www.nzherald.co.nz/nz/nz-cloud-storage-company-being-used-by-ransomware-attackers-says-fbi/CJN7XDMIUZEY3IX2Q34SA4APAY/

Microsoft adds Automatic HTTPS in Edge for secure browsing - BleepingComputer

Microsoft rolled out a new feature for the Microsoft Edge browser. Now, the browser can automatically switch users to a secure HTTPS connection when visiting websites over HTTP after enabling Automatic HTTPS. As of now, this feature is available for selected users of Microsoft Edge 92. The automatic switch to an HTTPS connection will protect Edge users from man-in-the-middle (MITM) attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-adds-automatic-https-in-edge-for-secure-browsing/

US Seizes Domains Used by SolarWinds Hackers in Cyber Espionage Attacks

The U.S. Department of Justice (DoJ) stated that they managed to take control of two command-and-control (C2) and malware distribution domains used in the new spear-phishing campaign by Russian hackers who breached SolarWinds IT management software. This wide-scale campaign targeted a mass email marketing company to send phishing emails to approximately 3,000 email accounts at more than 150 different organizations.

See the full report here: https://thehackernews.com/2021/06/us-seizes-domains-used-by-solarwinds.html

Critical WordPress plugin zero-day under active exploitation - BleepingComputer

Security researchers have discovered a critical file upload vulnerability being actively exploited in Fancy Product Designer, a WordPress plugin installed on over 17,000 sites. The zero-day bug allowing threat actors to upload malware in the plugin. Successful exploitation could allow the threat actors to completely take over vulnerable sites following remote code execution attacks. IOCs are available.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-zero-day-under-active-exploitation/

Firefox now blocks cross-site tracking by default in private browsing - BleepingComputer

Mozilla says that Firefox users will be protected against cross-site tracking automatically while browsing the Internet in Private Browsing mode. Starting with the Firefox 89 version release, Total Cookie Protection will be enabled by default in Private Browsing windows.

See the full report here: https://www.bleepingcomputer.com/news/security/firefox-now-blocks-cross-site-tracking-by-default-in-private-browsing/

Windows 10's package manager flooded with duplicate, malformed apps - BleepingComputer

Last week, Microsoft released the first stable version of its Windows 10 package manager, Winget, which allows the users to manage apps via command-line. Winget lets Windows users automate app management, including installing, configuring, upgrading, and uninstalling applications.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10s-package-manager-flooded-with-duplicate-malformed-apps/

Hacker forum contest gives $100K for new ways to steal digital assets

The administrator of a Russian-speaking cybercriminal forum has held a contest for the community to share uncommon methods to target cryptocurrency-related technology. Members of the forum had one month to submit their papers and enter a competition that promised more than $100,000 in prizes. The announcement came on April 20 and asked for research papers that explored various ways to steal private keys and cryptocurrency wallets, uncommon mining software, smart contracts, or non-fungible tokens (NFTs).

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-forum-contest-gives-100k-for-new-ways-to-steal-digital-assets/

FUJIFILM shuts down network after suspected ransomware attack

Japanese giant FujiFilm is investigating a ransomware attack against its Tokyo-based headquarters and has shut down portions of its network to prevent the attack's spread. A security researcher said that Fujifilm’s corporate network was recently infected by Qbot trojan, working with the REvil group.

See the full report here: https://www.bleepingcomputer.com/news/security/fujifilm-shuts-down-network-after-suspected-ransomware-attack/

Firefox now autoupdates on Windows even when not running

The Windows version of Firefox can now automatically upgrade itself to the latest version in the background when the web browser is not running. Firefox background updates will be scheduled for the default profile every 7 hours when the browser is not running to check for new updates, download them, and install them without requiring user interaction. This new feature was first rolled out to Windows Nightly users on April 12 in the form of a Background Update Agent. Background Update is now part of a staged rollout to all Windows users over the next few months, as part of the Beta 89 and the Release 89 cycles.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-now-autoupdates-on-windows-even-when-not-running/

Huawei USB LTE dongles are vulnerable to privilege escalation attacks

A security researcher disclosed a privilege escalation flaw in Huawei's USB LTE dongle model E3372. The USB thumb drive and comes with software to install on macOS called HiLink. One of the installation files is missing appropriate access control settings. A malicious user can replace the file with malicious code and wait for a legitimate user to start using the cellular data service via Huawei device. The firm has advised users of its USB LTE dongle (E3372) to obtain the "Hi Link" driver files from their website to resolve this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/huawei-usb-lte-dongles-are-vulnerable-to-privilege-escalation-attacks/

Database, source code allegedly related to bulletproof hosting, once Parler’s service provider, up for sale on hacker forum

Group-IB, a cybersecurity firm, discovered a database allegedly belonging to a bulletproof hosting provider DDoS-Guard, a Russian online infrastructure services provider, posted for sale on a cybercrime forum on May 26. The database supposedly contains information about DDoS-Guard’s customers, including their names, IP addresses, and payment information. In addition to the database, the threat actor claims to have the source code of the DDoS-Guard’s infrastructure. The seller is currently auctioning the entire set at a starting price of $350,000.

See the full report here: https://securityaffairs.co/wordpress/118508/hacking/bulletproof-hosting-database-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=bulletproof-hosting-database-leak

Exploit broker Zerodium is looking for Pidgin 0day exploits

Zero-day exploit broker Zerodium announced it is looking for 0day exploits affecting the IM client tool Pidgin on Windows and Linux. The company will pay up to $100,000 for zero-days in Pidgin, which is a free and open-source multi-platform instant messaging client. Zerodium resells the exploits to its customers that include law enforcement bodies and intelligence agencies that could use them in their investigations.

See the full report here: https://securityaffairs.co/wordpress/118500/breaking-news/zerodium-pidgin-0day.html?utm_source=rss&utm_medium=rss&utm_campaign=zerodium-pidgin-0day

FBI attributes JBS ransomware attack to REvil

United States-based food processing company JBS was the victim of a cyberattack on May 30, which disrupted operations at more than a dozen U.S. facilities. The US FBI has officially stated that the REvil operation, aka Sodinokibi, is behind the ransomware attack and is working diligently to bring the threat actors to justice.

See the full report here: https://www.zdnet.com/article/fbi-attributes-jbs-ransomware-attack-to-revil/

Prometheus and Grief – two new emerging ransomware gangs targeting enterprises. Mexican Government data is published for sale.

Prometheus and Grief, two new emerging ransomware gangs targeting enterprises. Prometheus is a new emerging ransomware group extorting enterprises in various verticals across the globe. The group has published a stolen data allegedly belonging to the Mexican Government for sale, possibly becoming the first cybercriminal group that has touched a major state in Latin America on such a level. Grief is a lesser-known ransomware group, which claims to have data stolen from 5 organizations including 1 in Mexico. Interestingly, the Grief WEB-site in the TOR network has an “anti-crawl” protection preventing cybersecurity researchers from automated indexing of their content by various cyber threat intelligence platforms and their bots.

See the full report here: https://securityaffairs.co/wordpress/118446/cyber-crime/prometheus-grief-ransomware.html?utm_source=rss&utm_medium=rss&utm_campaign=prometheus-grief-ransomware

AMT Games data breach: Millions of Users’ Messages, Account IDs, and IP Addresses Exposed

WizCase’s security team discovered an unsecured ElasticSearch server owned by AMT Games which exposed 1.47 TB of data. This leak exposed users’ email addresses, IP addresses, Facebook data, and more to potential attack. The leaked data numbers in the millions and were accessible to anyone who possessed the link. There was no need for a password or login credentials to access the information, and the data was not encrypted. The leak has since been secured.

See the full report here: https://securityaffairs.co/wordpress/118529/data-breach/amt-games-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=amt-games-data-leak

Flaws in Realtek RTL8170C Wi-Fi module allow hijacking wireless communications

Researchers found multiple flaws in the Realtek RTL8170C Wi-Fi module that could be exploited to elevate privileges and hijack wireless communications. The vulnerabilities impact all embedded and IoT devices that use the Realtek RTL8710C module, they could be exploited only by attackers on the same Wi-Fi network or know the network’s pre-shared key (PSK) used to authenticate wireless clients on local area networks. The researchers demonstrated a video proof-of-concept (PoC). The vendor addressed the issue with the release of the updated version ambz2 SDK (7.1d).

See the full report here: https://securityaffairs.co/wordpress/118558/security/realtek-rtl8170c-wi-fi-module-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=realtek-rtl8170c-wi-fi-module-flaws

Chinese cybercriminals spent three years creating a new backdoor to spy on governments

A new backdoor used in ongoing cyberespionage campaigns has been connected to Chinese threat actors. According to Check Point Research (CPR), the backdoor has been designed, developed, tested, and deployed over the past three years to compromise the systems of a Southeast Asian government's Ministry of Foreign Affairs. The Windows-based malware's infection chain began with spear-phishing messages, impersonating other departments in the same government, in which members of staff were targeted with weaponized, official-looking documents sent via email. If victims open the files, remote RTF templates are pulled and a version of Royal Road, an RTF weaponizer, is deployed. The tool works by exploiting a set of vulnerabilities in Microsoft Word's Equation Editor (CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802). The attackers are not only interested in cold data, but also what is happening on a target’s personal computer at any moment, resulting in live espionage.

See the full report here: https://www.zdnet.com/article/chinese-cybercriminals-spent-three-years-creating-a-new-backdoor-to-spy-on-governments/

Necro Python bot revamped with new VMWare, server exploits

According to researchers from Cisco Talos, Necro Python bot developer has made many changes to increase the power and versatility of the bot including exploits for over 10 different web applications and the SMB protocol that are being weaponized in the bot's recent campaigns. Exploits are included for vulnerabilities in software such as VMWare vSphere, SCO OpenServer, and the Vesta Control Panel. The new addition to the bot is a cryptocurrency miner, XMRig, which is used to generate Monero (XMR) by stealing the compromised machine's computing resources. Other features include the ability to launch distributed denial-of-service (DDoS) attacks, data exfiltration, and network sniffing.

See the full report here: https://www.zdnet.com/article/necro-python-bot-revamped-with-new-vmware-smb-exploits/

New SkinnyBoy malware used by Russian hackers to breach sensitive orgs

Security researchers have discovered a new piece of malware called SkinnyBoy that was used in spear-phishing campaigns attributed to Russian-speaking hacking group APT28. The threat actor, also known as Fancy Bear, Sednit, Sofacy, Strontium, or PwnStorm, used SkinnyBoy in attacks targeting military and government institutions earlier this year. SkinnyBoy is intended for an intermediary stage of the attack, to collect information about the victim and to retrieve the next payload from the command and control (C2) server. According to Cluster25 threat research company, APT28 likely started this campaign at the beginning of March, focusing on ministries of foreign affairs, embassies, the defense industry, and the military sector. The indicators of compromise are shared by the researchers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-skinnyboy-malware-used-by-russian-hackers-to-breach-sensitive-orgs/

Google Chrome now warns you of extensions from untrusted devs

Google has added new protection capabilities for Enhanced Safe Browsing users in Chrome, warning the user when installing untrusted extensions and allowing them to request more in-depth scans of downloaded files, available to Chrome users since May 2020. Starting with Google Chrome 91, released last month, a new Enhanced Safe Browsing feature is rolling out to all users to alert them if they're installing an extension made by an untrusted developer. New developers will have to build up trust over at least a few months until they will be added to Enhanced Safe Browsing's list of trusted developers. Until then, extensions they publish on the Chrome Web Store will be flagged as untrusted, and Chrome will notify users of what data the extensions can access.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-now-warns-you-of-extensions-from-untrusted-devs/

WordPress force installs Jetpack security update on 5 million sites

Automattic, the company behind the WordPress content management system, force deploys a security update on over five million websites running the Jetpack WordPress plug-in. Jetpack is a popular WordPress plug-in that provides free security, performance, and website management features, including brute-force attack protection, site backups, secure logins, and malware scanning. The plugin has more than 5 million active installations, and it is developed and maintained by Automattic, the company behind WordPress.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-force-installs-jetpack-security-update-on-5-million-sites/

Microsoft Teams calls are getting end-to-end encryption in July

Starting in July, Microsoft Teams will support an option to use end-to-end encryption (E2EE) for ad hoc 1:1 Teams VoIP calls, providing an additional option for conducting sensitive online conversations. Microsoft says that they will allow Microsoft Teams administrators to configure who has access to this feature to support their particular organization's security and compliance policies. This feature can be enabled by administrators for specific users or the entire organization. When end-to-end encryption is enabled, certain Microsoft Teams features will no longer be available.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-calls-are-getting-end-to-end-encryption-in-july/