Threat Intelligence Bulletin: 06/25/2021 - 07/01/2021

Flash Alert: LinkedIn Data Exposure

On 22 June 2021, a well-regarded cyber threat actor on a popular English-language Deep Web forum began advertising the public exposure of an alleged 700 million LinkedIn users. Preliminary analysis suggests that the actor abused the official LinkedIn API to obtain the dataset, then compiled and enriched the data to be sold on the forum in question. Based on sample data the actor provided, ZeroFOX assesses that the data includes user information from 2021 and was not compromised as result of any known vulnerabilities in LinkedIn infrastructure.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks. 2FA allows for verification of an individual through two methods: a password or personal identification number (PIN) and a token (usually from a mobile device). A token is typically a one-time generated code that can be retrieved from an authenticator application, device, or text message. 2FA increases security by ensuring an account will remain protected even if the password is compromised
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Control your visibility and consider limiting the contact information you share in your profile. Even if you do not have contact information in your public profile, there is a lot of potentially sensitive information that threat actors can misuse. Do not include your email address, home address, or phone number in your profile's Summary
• Review your privacy control settings and make changes as needed. Consider limiting access to your feed and setting the “anonymous” profile viewing mode. Please check this section every so often for new privacy options that may be added in the future
• Since LinkedIn offers the ability to contact users via its InMail internal message service, having this functionality enabled could allow threat actors to contact you directly. The risk of social engineering is thus greatly increased
• Consider a LinkedIn Premium subscription, as it would allow you to monitor who viewed your profile. The Who Viewed Your Profile feature displays your profile visitors in the last 90 days, and can provide additional trends and insights about viewers
• Be skeptical of invites you receive from unknown contacts. A common scheme by cyber criminals is the creation of fictional personas on LinkedIn that can be used for corporate espionage. Threat actors can approach executives posing as customer prospects, job recruiters, or former colleagues. Once accepted into the executive's LinkedIn network, the threat actor can send a spear-phishing email or attempt to extract proprietary information and monitor the executive's new connections and clients
• Be aware of fake users. Take the time to verify and look for warning signs. In addition to keyword stuffing and scraped photos, a user with a small number of connections should be viewed as suspicious, as should an incomplete profile and poor spelling. LinkedIn encourages users to report bogus accounts using the drop-down arrow next to that user's profile

Details

The actor is seeking USD $5,000 for the entire dataset and has not disclosed any sales on the forum, as of 30 June. “TomLiner” has been active since February 2021 with a relatively high reputation for the few threads they have created. They most notably were responsible for uploading scraped Facebook data for 533 million users on April 3, 2021, that was collected around August 2019.

Figure 1: Screenshot of actor “TomLiner” post of the alleged compromised data set

Although this data did not include passwords, which could potentially be leveraged in account takeovers or credential stuffing attacks, the data is believed to be valuable in the facilitation of other malicious activity--such as spamming operations, phishing, etc. Although it would be possible to obtain said data through OSINT practices from the LinkedIn platform, the aggregation of the data enables would-be attackers to readily identify and target organization personnel contained therein. While not including passwords, the scraped data included the following fields:

• Email Addresses
• Full names
• Phone numbers
• Physical Addresses
• Geolocation records
• LinkedIn username and profile URL
• Personal, professional experience and background
• Genders
• Other social media accounts and usernames

Responding to this incident, LinkedIn posted a blog on June 29th, stating:

“Our teams have investigated a set of alleged LinkedIn data that has been posted for sale. We want to be clear that this is not a data breach and no private LinkedIn member data was exposed. Our initial investigation has found that this data was scraped from LinkedIn and other various websites and includes the same data reported earlier this year in our April 2021 scraping update.”

Flash Alert: Windows Print Spooler Remote Code Execution Vulnerability (PrintNightmare)

A zero-day flaw was detected in Microsoft Windows Print Spooler service, which allows a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. The Print Spooler is used to manage the printing process in Windows, including loading the appropriate printer drivers and scheduling the print job for printing. Despite the initial findings on the vulnerability, security researchers discovered that PrintNightmare is different from CVE-2021-1675. On 21 June 2021, Microsoft upgraded the severity of CVE-2021-1675 to Critical and changed the vulnerability type from EoP (elevation of privilege) to RCE (remote code execution). Although Microsoft has released a fix for CVE-2021-1675 in the June 2021 Patch Tuesday release, currently no patch is available for PrintNightmare. There are several versions of Proof-of-Concept code available which work against fully patched systems.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Details

Print Spooler (spoolsv.exe) is a Windows service that acts as an interface between the Windows operating system (OS), applications, and local or networked printers that manages the printing process. The management mainly includes retrieving the location of the correct printer driver, loading that driver, spooling high-level function calls into a print job, and scheduling the print job for printing. A bug detected in Microsoft Windows Print Spooler service fails to restrict access to the RpcAddPrinterDriverEx() function, which can allow a remote authenticated attacker to gain full domain access and execute arbitrary code with SYSTEM privileges on a vulnerable system. The exploitation requires a user to be authenticated as a domain user. The vulnerability affects all Windows OS versions and may affect deprecated Windows versions such as XP and Vista.

Impact

Despite the need for authentication, the severity of the issue is critical as threat actors can use it to take over a Windows domain server to easily deploy malware across a company’s network.

Remediation

As a workaround, administrators are strongly advised to stop and disable the spooler service, especially on domain controller systems.

Threat Actor Chatter

Multiple posts on popular underground cybercrime forums were created on 30 June 2021, the same day that the information security community was sharing details and proof of concept (PoC) exploits. On Exploit, one of the moderators created a post detailing the vulnerability and linking the public PoCs on Github that were some of the same PoCs being shared on social media.

Figure 1: A moderator on Exploit discusses PrintNightmare

English translation:

"PrintNightmare CVE-2021-1675 By pixe1, 18 hours ago in Security and Hacking

Quite an interesting and serious vulnerability in the Windows Spooler Service (the RpcAddPrinterDriver abuse) that definitely needs to be paid attention to.

details, PoCs, exploits, fixes are discussed below

original write-up https://github.com/afwu/PrintNightmare

Result.png

dr.tom Posted 10 hours ago

it's like RCE, but relevant for domain networks. since there must be a valid account for operation (any domain user will do as I understand it) and you can break through the same DC"

On XSS, an actor shared python exploit code directly in the post.

Figure 2: An actor on XSS discusses PrintNightmare

Much like the security research community, the cybercrime community relies on news and PoC code for vulnerabilities as a way to bolster their operations. As documented in the ZeroFOX ZeroLogon vulnerability report (https://cloud.zerofox.com/alpha_team/vulnerabilities/427496) , a PoC for ZeroLogon was published and 13 days later Microsoft confirmed in-the-wild exploitation of the vulnerability.

Figure 3: ZeroLogon timeline of events. PrintNightmare was announced this week and there was already PoC code released, unlike ZeroLogon

Assessment

ZeroFOX Threat Research assesses that threat actors will most likely use knowledge from the security research community to embed PrintNightmare into their toolsets. Much like ZeroLogon, PrintNightmare is a useful lateral movement and remote exploitation vulnerability that can give Administrative access to critical infrastructure on Windows, such as Domain Controllers. Much like with ZeroLogon, this exploit can be used to infect a Domain Controller and spread additional malware throughout the Active Directory environment. Since there is no patch, and there are PoCs available, it is likely this will be a more attractive option for Threat Actors as they will race against Microsoft to exploit PrintNightmare in the wild.

Sources

References

https://www.bleepingcomputer.com/news/security/public-windows-printnightmare-0-day-exploit-allows-domain-takeover/ https://threatpost.com/poc-exploit-windows-print-spooler-bug/167430/ https://twitter.com/gentilkiwi/status/1410246348784422916

Proof-of-Concept Code

https://github.com/afwu/PrintNightmare https://github.com/cube0x0/CVE-2021-1675

Detection and Remediation

https://github.com/LaresLLC/CVE-2021-1675 https://github.com/SigmaHQ/sigma/pull/1588/files

Breaking News: 2021-06-25 - 2021-07-01

FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Payment-Card Losses

One of the Carbanak cybergang’s highest-level hacker is destined to serve seven years while making $2.5 million in restitution payments. The group typically uses malware-laced phishing attacks against victims to steal bank-card data and sell it. It has also become well-known for targeting point-of-sale (PoS) systems at casual-dining restaurants, casinos and hotels. Since 2020, it has also added ransomware/data exfiltration attacks. FIN7 was pretending to be a legitimate organization that hawks Lizar as a Windows pen-testing tool for ethical hackers.

See the full report here: https://threatpost.com/fin7-pen-tester-jail/167293/

Leaked email scandal engulfs Poland’s political elite - POLITICO.eu

Poland's ultra-conservative leadership faces a growing scandal as the private emails of top officials including Prime Minister Mateusz Morawiecki are being leaked to the public following a hacking operation. The main goal of the ongoing attack is to compromise democratic values, freedom of speech and trusted public debate targeted by disinformation, says a Polish. The leaked emails and official documents are regularly posted by two anonymous accounts on Telegram, one in Russian and one in Polish and there were several Facebook accounts and at least one Twitter account promoting the Telegram content.

See the full report here: https://www.politico.eu/article/leaked-email-scandal-engulfs-poland-political-elite-mails-hacking/

Microsoft admits to signing rootkit malware in supply-chain fiasco - BleepingComputer

Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control (C2) IPs. G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec. community in tracing and analyzing the malicious drivers bearing the seal of Microsoft. It turns out, the C2 infrastructure belongs to a company classified under "Communist Chinese military" by the US Department of Defense.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-admits-to-signing-rootkit-malware-in-supply-chain-fiasco/

Mercedes-Benz data breach exposes SSNs, credit card numbers - BleepingComputer

Yesterday, German automotive brand and luxury vehicle company, Mercedez-Benz disclosed a data breach that impacted some customers and potential buyers. The data breach exposed credit card information, social security numbers, and driver license numbers of under 1,000 Mercedes-Benz customers and potential buyers. The company confirmed that none of the systems were compromised as a result of this incident, and at this time, there is no evidence that any Mercedes-Benz files were maliciously misused.

See the full report here: https://www.bleepingcomputer.com/news/security/mercedes-benz-data-breach-exposes-ssns-credit-card-numbers/

Cisco ASA Bug Now Actively Exploited as PoC Drops

Researchers have dropped a proof-of-concept (PoC) exploit on Twitter for known cross-site scripting (XSS) vulnerability in the Cisco Adaptive Security Appliance (ASA). The bug is tracked as CVE-2020-3580 that allows unauthenticated, remote attackers to execute arbitrary code within the [ASA] interface and access sensitive, browser-based information. Users are advised to apply the patches to mitigate the vulnerability.

See the full report here: https://threatpost.com/cisco-asa-bug-exploited-poc/167274/

Hackers Crack Pirated Games with Cryptojacking Malware

A new Monero cryptojacking malware distributed via “cracked” versions of popular online games is wiping out antivirus programs (AVs) and surreptitiously mining cryptocurrency in more than a dozen countries. The malware, dubbed “Crackonosh,” has been active since 2018 and lurks in pirated versions of Grand Theft Auto V, NBA 2K19 and Pro Evolution Soccer 2018 that gamers can download free in forums. The malware installs the coinminer XMRig to mine Monero cryptocurrency from within the cracked software downloaded to an affected device. So far, threat actors have reaped more than $2 million, or 9000 XMR in total, from the campaign, researchers said.

See the full report here: https://threatpost.com/hackers-crack-pirated-games-malware/167263/

Nobelium hackers accessed Microsoft customer support tools - BleepingComputer

Microsoft discovered new attacks conducted by the Russian state-sponsored Nobelium hacking group, who were responsible for the SolarWinds supply-chain attacks, and now hacked Microsoft support agent's computer which exposed customer's subscription information. The attackers conducting password spray and brute-force attacks to gain access to corporate networks and targeting specific customers.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/nobelium-hackers-accessed-microsoft-customer-support-tools/

A #phishing campaign is delivering a new variant of one of the oldest forms of remote access trojan (RAT) malware in an effort to steal usernames, passwords and other sensitive information. Stay informed:

Researchers have detailed a new Agent Tesla campaign that distributes an updated version of the malware via phishing emails. This new variant is one of the oldest forms of remote access trojan (RAT) malware and is distributed to steal usernames, passwords, and other sensitive information and even cryptocurrency from the victim. Researchers recommend using antivirus software and users to be careful when it comes to opening attachments from unknown sources with unexpected emails.

See the full report here: https://www.zdnet.com/article/this-phishing-email-is-pushing-password-stealing-malware-to-windows-pcs/

Researchers Identify New Malware Loader Variant - BankInfoSecurity.com

Security firm Proofpoint uncovered a new campaign by cybercrime group, TA543. This campaign is deploying a new variant of a malware loader, JSSLoader, to target victims by sending them malicious phishing emails. These emails appear to be from the United Parcel Service and contain malicious links. The campaigns have attempted to target a wide range of industries.

See the full report here: https://www.bankinfosecurity.com/researchers-identify-new-malware-loader-variant-a-16944

New ransomware group Hive leaks Altus group sample files

On June 14th, Altus Group, a commercial real estate software solutions company, has announced that its data was breached. A week later, they reported no evidence of impact. Now, their data may have possibly been leaked by Hive, a new ransomware group.

See the full report here: https://securityaffairs.co/wordpress/119418/cyber-crime/new-ransomware-group-hive-leaks-altus-group-sample-files.html

Steam Profile Images Might Contain Malware | TheGamer - TheGamer

Steam is the latest platform to find itself as an unwitting host to malware, according to a new report from G Data. Hackers are hiding malware in Steam Profile images which could be downloaded to a user’s computer through a separate downloader.

See the full report here: https://www.thegamer.com/steam-profile-images-might-contain-malware/

Renown announces data breach involving patient health information - KRNV My News 4

Renown announced Friday a data breach involving health information of patients residing in Nevada and neighboring states. Following the breach, Elekta hired a forensic investigator to launch an investigation to determine the nature and scope of the suspicious activity.

See the full report here: https://mynews4.com/news/local/renown-announces-data-breach-involving-patient-health-information

Cisco ASA vulnerability actively exploited after exploit released - BleepingComputer

Hackers are scanning for and actively exploiting a vulnerability in Cisco ASA devices after a PoC exploit was published on Twitter. Cisco first disclosed the vulnerability and issued a fix in October 2020. However, the initial patch for CVE-2020-3580 was incomplete, and a further fix was released in April 2021. This vulnerability can allow an unauthenticated threat actor to send targeted phishing emails or malicious links to a user of a Cisco ASA device to execute JavaScript commands in the user's browser.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-asa-vulnerability-actively-exploited-after-exploit-released/

MyBook Users Urged to Unplug Devices from Internet – Krebs on Security - Krebs on Security

Hard drive giant Western Digital is urging users of its MyBook Live brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a critical flaw that can be triggered by anyone who knows the Internet address of an affected device. The NVD writeup says Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug. The security bug can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands, NVD wrote.

See the full report here: https://krebsonsecurity.com/2021/06/mybook-users-urged-to-unplug-devices-from-internet/

Binance exchange helped track down Clop ransomware money launderers - BleepingComputer

Cryptocurrency exchange service Binance played an important part in the recent arrests of Clop ransomware group members, helping law enforcement in their effort to identify, and ultimately detain the suspects. Using the name FANCYCAT to refer to the group, Binance says that the criminals were laundering money resulting from ransomware attacks and various other illegal activities.

See the full report here: https://www.bleepingcomputer.com/news/security/binance-exchange-helped-track-down-clop-ransomware-money-launderers/

Details of over 200,000 students leaked in cyberattack - The Jerusalem Post

The details of about 280,000 students throughout Israel were leaked after a cyberattack targeted the AcadeME company, which services many colleges and universities throughout the country, last week. A pro-Palestinian Malaysian hacker group, known by the name DragonForce claimed that it hacked into AcadeME, stating that "The largest and most advanced student and graduate recruitment network in Isreal hacked by DragonForce Malaysia" in a Telegram message on June 20.

See the full report here: https://www.jpost.com/israel-news/details-of-over-200000-students-leaked-in-cyberattack-672179

Miss. healthcare organization announces data breach affecting patient information - WLOX

Mississippi Center for Advanced Medicine (MCAM) announced that a data breach has happened in Dec 2020 and affected its internal server. The organization stated that the health information of some patients might have accessed by the attackers but electronic health record information and financial information are not compromised.

See the full report here: https://www.wlox.com/2021/06/23/miss-healthcare-organization-announces-data-breach-affecting-patient-information/

Fortinet firewall vulnerability could give hackers full control

Security researchers have discovered a vulnerability in the Fortinet FortiWeb firewall, tracked as CVE-2021-22123, that could let an attacker take full control of the security device. The APT actors are actively targeting a broad range of victims across multiple sectors exploiting these kinds of vulnerability. Therefore, organizations using these products should update them as soon as possible.

See the full report here: https://www.itpro.co.uk/security/vulnerability/360008/vulnerability-in-fortinet-firewall-could-enable-hackers-to-gain

Watch Out! Zyxel Firewalls and VPNs Under Active Cyberattack

Zyxel, a Taiwanese networking equipment company, is warning customers of an ongoing attack targeting a "small subset" of its security products such as firewall and VPN servers. According to the company, the threat actor attempting to bypass authentication and establish SSL VPN tunnels with unknown user accounts to manipulate the device's configuration. It is recommended that customers should disable HTTP/HTTPS services from the WAN and implement a list of restricted geo-IP to enable remote access only from trusted locations.

See the full report here: https://thehackernews.com/2021/06/watch-out-zyxel-firewalls-and-vpns.html

Ransomware gangs now creating websites to recruit affiliates

Recently, criminal operations are now promoting their service on their sites and attracting new recruits. LockBit ransomware gang announced a new major version for their tool, claiming significant improvement for the encryption speed, and announced a new affiliate recruitment session. Another gang promoting their ransomware-as-a-service (RaaS) operation on their website is Himalaya, an actor that started its activity in the current year.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gangs-now-creating-websites-to-recruit-affiliates/

NFC Flaws Allow ATM Hacking With A Wave Of A Phone

A security researcher has found a collection of bugs that allow anyone to hack ATMs, along with a wide variety of point-of-sale terminals, in a new way: with a wave of his phone over a contactless credit card reader, to make a payment or extract money from a cash machine. The bugs are present in the near-field communications (NFC) reader chips used in millions of ATMs and point-of-sale systems worldwide.

See the full report here: https://www.wired.com/story/atm-hack-nfc-bugs-point-of-sale/

REvil ransomware's new Linux encryptor targets ESXi virtual machines

A security researcher at MalwareHunterTeam found that the REvil ransomware (aka Sodinokibi) operation is now using a Linux encryptor that targets and encrypts Vmware ESXi virtual machines. With the enterprise moving to virtual machines, there is an increase in ransomware operators creating their tools to mass encrypt storage used by VMs.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomwares-new-linux-encryptor-targets-esxi-virtual-machines/

Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground

According to researchers, a new posting with 700 million LinkedIn records has appeared on a popular hacker forum. Analysts from Privacy Sharks stated that they came across the data put up for sale on RaidForums by a hacker calling himself “GOD User TomLiner.” The advertisement, posted June 22, claims that 700 million records are included in the cache, and included a sample of 1 million records as “proof.” According to LinkedIn, no breach of its networks has occurred this time.

See the full report here: https://threatpost.com/data-700m-linkedin-users-cyber-underground/167362/

Cobalt Strike Usage Explodes Among Cybercrooks

Security Researchers have stated that the Cobalt Strike has gone fully mainstream in the crimeware world and is now used by more cybercrime and general commodity malware operators than APT and espionage threat actors. According to the researcher, when it comes to how threat actors are attempting to compromise hosts, Cobalt Strike is increasingly being used as an initial access payload, as opposed to being a second-stage tool that’s used after attackers have gained access.

See the full report here: https://threatpost.com/cobalt-strike-cybercrooks/167368/

Russian hackers had months-long access to Denmark's central bank - BleepingComputer

Russian state hackers compromised Denmark’s central bank (Danmarks Nationalbank) and planted malware that gave them access to the network for more than half a year without being detected. The breach was part of the SolarWinds cyber espionage campaign last year that the U.S. attributed to the Russian Foreign Intelligence Service. The compromise came to light after technology publication Version2 obtained official documents from the Danish central bank through a freedom of information request. In an email statement for Version2, the bank admitted that it was affected by the SolarWinds supply-chain attack and that it took action immediately after learning of the compromise.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-had-months-long-access-to-denmarks-central-bank/

DoubleVPN servers, logs, and account info seized by law enforcement - BleepingComputer

​Law enforcement has seized the servers and customer logs for DoubleVPN, a double-encryption service commonly used by threat actors to evade detection while performing malicious activities. DoubleVPN is a Russian-based VPN service that double-encrypts data sent through their service. When using the service, requests are encrypted and transmitted to one VPN server, which sends it to another VPN server, which finally connects to the final destination. these services are commonly used by hackers to obfuscate their locations and originating IP addresses when performing cyberattacks.

See the full report here: https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/

Microsoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks

Microsoft has patched two bugs in its Chromium-based Edge browser last week, one of which could be used by an attacker to bypass security and to remotely inject and execute arbitrary code on any website just by sending a message. The vulnerability is tracked as CVE-2021-34506 and is rated as Medium. The bug in Edge’s auto-translate could have let remote attackers pull off RCE on any foreign-language website just by sending a message with an XSS payload. Microsoft said there are no known exploits, however, researchers have published a working proof-of-concept attack. Users are advised to update to the latest Edge version to remediate the flaws.

See the full report here: https://threatpost.com/microsoft-edge-browser-uxss-attacks/167389/

Lorenz ransomware decryptor recovers victims' files for free

Dutch cybersecurity firm Tesorion has released a free decryptor for the Lorenz ransomware, allowing victims to recover some of their files for free without paying a ransom. Lorenz is a human-operated ransomware that began operating in April 2021 and has since listed twelve victims whose data they have stolen and leaked on their ransomware data leak site. The Lorenz ransomware decryption tool can be downloaded from NoMoreRansom.

See the full report here: https://www.bleepingcomputer.com/news/security/lorenz-ransomware-decryptor-recovers-victims-files-for-free/

Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine

An unpatched security vulnerability affecting Google's Compute Engine platform could be abused by an attacker to take over virtual machines over the network. According to a security researcher, this is done by impersonating the metadata server from the targeted virtual machine's point of view. By mounting this exploit, the attacker can grant access to themselves over SSH (public key authentication) so that they can log in as the root user.

See the full report here: https://thehackernews.com/2021/06/unpatched-virtual-machine-takeover-bug.html

McAfee reports a surge of malware hidden in COVID-19 vaccine appointments - SecurityBrief Asia

McAfee has released its latest Mobile Threat Report that finds a surge in new attacks targeting people’s anxiety around COVID-19. McAfee's researchers found attackers are hiding malware and malicious links inside fake vaccination appointments and registration display ads. The pandemic has led to an increased dependence on mobile devices, which has also prompted bad actors to develop new ways of deceiving consumers and stealing personal data.

See the full report here: https://securitybrief.co.nz/story/mcafee-reports-a-surge-of-malware-hidden-in-covid-19-vaccine-appointments

RCE Bug in Adobe Experience Manager Revealed - Softpedia News

Adobe’s content management system includes a flaw that affects Mastercard, LinkedIn and Sony’s PlayStation customers. The vulnerability allowed hackers to gain access to passwords and remotely execute code on vulnerable AEM installations. It was discovered that Adobe’s content management system, Adobe Experience Manager (AEM), contained a zero-day vulnerability that may have affected customers as diverse as MasterCard, LinkedIn, and PlayStation. This bug allows attackers to bypass authentication and gain access to CRX Package Manager. Adobe was alerted of the problem on March 25. Earlier this month, Adobe announced a fix for their AEM program.

See the full report here: https://news.softpedia.com/news/rce-bug-in-adobe-experience-manager-revealed-533381.shtml

Facebook sues hackers who hijacked advertising agencies' accounts

Facebook has filed lawsuits against two groups of suspects who took over advertising agency employees’ accounts using a technique known as session theft and abused its ad platform to run unauthorised or deceptive ads. Their victims’ Facebook login credentials were stolen using a malicious Android app named “Ad Manager for Facebook” created by the defendants. The app is now taken down and is no longer available on the Google Play Store. Facebook has also refunded and helped the victims to secure their accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-sues-hackers-who-hijacked-advertising-agencies-accounts/

SMB Worm Targeting EternalBlue Vuln Spreads to US

The well-known EternalBlue exploit developed by National Security Agency (NSA) for Server Message Block (SMB) protocol is being a serious significant threat to many organizations across the US even after 4 years when the vendor had issued a patch to address the flaw.

See the full report here: https://www.darkreading.com/endpoint/smb-worm-targeting-eternalblue-vuln-spreads-to-us/d/d-id/1341445

Leaked Babuk Locker ransomware builder used in new attacks - BleepingComputer

A leaked tool used by the Babuk Locker operation to create custom ransomware executables is now being used by another threat actor in a very active campaign targeting victims worldwide. A sample of Babuk operation's ransomware builder was uploaded on Virus Total where the threat actor modified the ransom note to include their own contact info, and then run the build executable to create customized ransomware encryptors and decryptors that target Windows, VMware ESXi, Network Attached Storage (NAS) x86, and NAS ARM devices. Soon after the builder was leaked online, a threat actor began using it to launch a very active ransomware campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/

Microsoft finds Netgear router bugs enabling corporate breaches - BleepingComputer

Microsoft 365 Defender Research Team has discovered critical firmware vulnerabilities in some NETGEAR router models that could allow unauthenticated attackers to access unpatched routers' management pages via authentication bypass, gain access to secrets stored on the device, and derive saved router credentials using a cryptographic side-channel attack. The security flaws impact DGN2200v1 series routers running firmware versions before v1.0.0.60 and compatible with all major DSL Internet service providers. The three bugs can compromise a network's security, opening the gates for attackers to roam untethered through an entire organization.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-finds-netgear-router-bugs-enabling-corporate-breaches/

Public Windows PrintNightmare 0-day exploit allows domain takeover - BleepingComputer

Technical details and a proof-of-concept (PoC) exploit have been accidentally leaked for a currently unpatched vulnerability in Windows that allows remote code execution. The vulnerability is dubbed as Print Nightmare and is considered a zero-day flaw. Despite the need for authentication, the severity of the issue is critical as threat actors can use it to take over a Windows domain server to easily deploy malware across a company’s network. Several researchers have tested the leaked PoC exploit on fully patched Windows Server 2019 systems and were able to execute code as SYSTEM. At the time of reporting, there is no patch available to remediate the flaw. As a workaround, users are recommended to stop and disable the service on Domain Controllers as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/public-windows-printnightmare-0-day-exploit-allows-domain-takeover/

Received a WhatsApp verification code without requesting it? Beware – you might be about to have your account stolen

Recently Southwark Police of South London officers had warned the public about the scammers are stealing accounts by tricking WhatsApp users to share verification codes they are sent through SMS. It's a social-engineering attack where fraudsters ask WhatsApp users to send their WhatsApp user verification code to hijack their accounts.

See the full report here: https://hotforsecurity.bitdefender.com/blog/received-a-whatsapp-verification-code-without-requesting-it-beware-you-might-be-about-to-have-your-account-stolen-26073.html