Threat Intelligence Bulletin: 06/04/2021

Breach Disclosure: Nameless Malware

Between 2018 and 2020 a previously unseen strain of Trojan malware infected over 3 million computers running Windows Operating Systems, and stole over 1.2 terabytes of personal information including credentials for multiple platforms, text files, images, documents, cookie data, and autofill data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

Custom trojan malware designed to steal victim data is easily available within various underground marketplaces and forums, for as little as $100. The malware is often hidden within "cracked" or hacked versions of commercial software and computer games which can be downloaded from piracy sites or torrent platforms.

By AngelHack, 03/31/21 03:57 PM in [Software] - malware, exploits, bundles, crypts
Hello everyone 🖐️🤙 present to your attention my own malware development

Some product info:

    Native stealer
    Collecting data from all Chromium-based browsers
    Grabber for cookies, passwords, forms, maps from browsers
    Still all pc information, screenshot
    Data collection Outlook, Pidgin, Thunderbird, Microsoft Edge, Mozilla Firefox,
    Session collection: Telegram, 2FA, ProtonVPN, NordVPN,
    Collecting files from the desktop (.txt)
    Collect all psi data (+)
    Parsing from device memory
    Block double logs
    Complete PC information
    Anti CIS
    Clipper has compatibility with over 40 cryptocurrencies
    Clipper has non detects (permanent FUD) supported by us

Stealer build weight - 210kb
Clipper build weight - 24kb

Logs are sent to your FPT server, which guarantees complete security of your logs
Clients of our malware have access to a daily free Crypt for the entire service life of the software.

Figure 1: Text from thread post advertising "stealer" malware on an underground Russian forum.

Figure 2: Screenshot of thread post

In total, 1.2 terabytes of data was stolen and sent to the attackers consisting of:

26 million login credentials (emails or usernames, and passwords), for just under 1 million websites.
Over 6 million files from victims desktop and Downloads folders.
2 billion cookies and session tokens, which potentially provide direct access to accounts.
Credentials, payment and autofill data from over 48 applications, including web browsers.

Microsoft Patch Tuesday 06/08/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:
Microsoft's Patch Tuesday update for June 2021 contained 50 vulnerabilities in total, with:

1 vulnerability rated as Critical
35 vulnerabilities rated as High
14 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has reported six zero-day vulnerabilities that are currently under active attack, while three are publicly known at the time of release. In a report released by Kaspersky, the two vulnerabilities, CVE-2021-31955 and CVE-2021-31956 were used in attacks by a new threat actor group known as PuzzleMaker.
However, at the time of reporting, no publicly available proof-of-concepts were found.

CVE-2021-33742
CVE-2021-33742 is a flaw in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by an error in the MSHTML platform. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.