Threat Intelligence Bulletin: 07/02/2021 - 07/08/2021

The Threat of Malware on the United States Government

Threats to government agencies, including local, state, and even federal entities have been on the rise in recent years. This year, with the SolarWinds hack, we saw one of the largest and still largely unknown threats that targeted government and commercial entities that may have shed the most light on the ever-growing threats against government agencies.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Taken from a CISA alert regarding Ransomware targeting the public health sector, here are some vital takeaways that government organizations should be using:

• Patch operating systems, software, and firmware as soon as manufacturers release updates.
• Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
• Use multi-factor authentication where possible.
• Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
• Implement application and remote access allow listing to only allow systems to execute programs known and permitted by the established security policy.
• Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
• Audit logs to ensure new accounts are legitimate.
• Implement network segmentation. Sensitive data should not reside on the same server and network segment as the email environment.
• Set antivirus and anti-malware solutions to automatically update; conduct regular scans.
• Regularly back up data, air gap, and password protect backup copies offline.
• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, secure location.
• Focus on awareness and training. Because end users are targeted, make employees and stakeholders aware of the threats—such as ransomware and phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
• Ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.

Details

Along with the massive SolarWinds hack, there has been an increase in ransomware attacks against many local and state governments that have crippled key infrastructure for weeks and months, in a time when people needed the most assistance from the government. While in some cases these organizations may be targeted due to potential lack of security budget meaning they would be easier to compromise, other cases may be for political motivations. Oftentimes however, these could all be victims of opportunity, especially in cases when ransomware is involved. This method allows attackers to “spray and pray” anyone and everyone regardless of size or entity in order to force victims to pay a ransom or end up shutting down critical public services.

ZeroFOX has observed the following ransomware groups targeting government entities as of January 1, 2021:

Figure 1: Active Ransomware Groups and the number of government victims per group

One potential reason for the increase in attacks on government entities could be due to the lack of security and/or funding for the services being attacked. With limited budgets, local and state government agencies may not be able to perform all the functions of a well-rounded security program, or not have proper tooling or personnel in place to prevent these sorts of attacks. Knowing this, along with the fact that the public requires certain services, which if taken down, would increase demand by the public to restore them as quickly as possible, attackers would capitalize on this and distribute ransomware to the victims forcing them to pay. Unlike commercial organizations, the general population doesn’t rely on these services to maintain certain aspects of their lives, so commercial organizations have more flexibility when it comes to paying the ransom.

The impact of malware/ransomware on organizations has varied, with some major instances including the following impact:

• In 2019, the city of Baltimore, MD was the victim of the RobbinHood ransomware variant, which impacted all servers (with the exception of essential services). The real estate market in Baltimore was also impacted due to property transfers not being completed until the systems were restored. This was a multi-month effort to restore and cost upwards of $18 million dollars.

Figure 2: Twitter posting for Robbinhood ransomware targeting Baltimore city

• In 2019, Jackson County, GA was targeted with Ryuk ransomware and paid $400,000 to restore access to their files, after crippling key infrastructure including emergency services.
• In 2019, Lake City, FL was targeted with Ryuk ransomware which impacted phones, email, and online utility payment programs forcing the city to pay $460,000
• In 2018, the city of Atlanta, GA was the victim of a ransomware attack (the ransomware variant was SamSam) and potentially impacted up to 6 million people. Costs were upward of $9.5 million to recover from this attack.

Stories like the ones above would likely only motivate potential attackers to target government organizations due to the hefty payouts and urgency in which they would need to pay. With malware basically providing a suite of tools to attackers, like TrickBot and BazarLoader, the attackers are better equipped to rapidly deploy and compromise entities by dropping ransomware on their machines.

Conclusion

Ransomware has played a huge role in the prompting of new cybersecurity policy and has definitely brought this immense problem to light, with many organizations coming together to tackle this problem. With easier tools to use, a weakened cybersecurity program and funding, and no lack of targets, the risk is a lot higher that many government entities will be attacked, and potentially compromised.

With more pressure from government officials and the FBI to not pay the ransom, this may force ransomware operators to make it more affordable and likely to pay, or take other actions to force payment, like, leaking stolen data until the ransom is paid.

Breach Disclosure: Raychat

In January 2021, the popular Iranian chat application, Raychat, suffered a data breach impacting over 267 million accounts. Raychat was founded in 2017 as a business and social messaging mobile application, partnering with businesses which could use the app for customer service. The data was discovered to be publicly exposed via a NoSQL database instance before being destroyed by a bot attack. After the breach, 150 million records of user data were distributed on cyber crime forums in May 2021.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

The breached data was obtained from an exposed MongoDB instance, owned by Raychat. This database held information on millions of users including:

• Email address
• Hashed password
• Name
• Telegram id
• IP address
• Geographic location

After the exposed data was discovered, the database was erased by bad actors which left a ransom note, demanding 0.019 bitcoin (approximately $919 at the time) for data to be recovered. It was unclear however if the data had been downloaded by the actor leaving the ransom note in advance of it's deletion.

On May 3, 2021, the RaidForums actor "datahub" posted a 26 GB data breach package of 150 million records, including "email, bcrypt, name, telegram id, IP, UA, referrer" from the Raychat data breach. The author explained they managed to download most of the exposed data before the database was erased.

Figure 1: Thread from author datahub providing data breach package

Repeat Offenders: Targeting prior victims for fun and profit

Ransomware has become an ever-growing threat in the cyber landscape. The number of attacks is growing, the size of the ransoms are increasing, and as a result, so are the premiums for ransomware insurance. Now it appears that there is a growing trend whereby threat actors compromise victims who have already been attacked in recent memory.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Recommendations

• When breaches occur, always change known compromised passwords, as well as passwords on critical accounts
• Ensure multiple-factor authentication is enabled
• If the initial attack vector is known, ensure that the vulnerabilities leveraged are corrected immediately
• Perform a penetration test to determine weaknesses in the network configuration and correct the findings as soon as possible

Details

An interesting trend may be emerging in the ransomware world. Some victims are being attacked multiple times. ZeroFOX research has uncovered three victims in the last month that were compromised two or more times during that time.

The first case is a manufacturing company who had originally been compromised by Maze ransomware in April of 2020. They were again compromised in March of 2021, this time by the Darkside ransomware team. In June 2021, they fell victim to compromise yet again, this time to Conti.

In the second case, a financial services company originally fell victim to Egregor in October 2020. They were compromised again by Conti in June 2021. The third re-victimized company was a retail company originally attacked by DoppelPaymer in March 2021, and again by Grief ransomware three months later in June 2021. These timelines are represented in Figure 1.

Figure 1. A timeline of the attacks discussed in this report.

The reasoning behind selecting companies that had already been infected is not absolute, but repeat attacks against victims definitely appear to be on the rise and the selection of targets who have ransomware insurance policies is too frequent to be coincidental. Actors such as REvil have even gone on record and stated that insured victims are preferred targets. A recent report by CyberReason reported that four out of five victims of ransomware were attacked again. It was not immediately clear, however, what defined the relationship between the initial and subsequent attacks.

In the cases with Maze, Darkside, and Egregor, Conti had operated in a cartel with them both before they went defunct. It may seem unlikely that these targets were selected for monetary reasons given they had been recently victimized, and if they paid out already then they would be in a worse position financially to pay a ransom. However, ransomware actors openly admit to doing easy jobs for easy money. Particularly with insured companies, an already compromised company is already shown to be vulnerable, and even if the money may be less than an initial breach, it has a higher likelihood of success.

ZeroFOX does not have any evidence to relate Grief ransomware to DoppelPaymer. Grief is a newcomer to the landscape, however, and not as much is documented about their operations or their team members. Given the interconnected history of many of these teams, it is fully possible that a member of their organization was familiar with the earlier attack and used the knowledge and TTPs to score a quick victory for their reputation.

ZeroFOX does not have the specific details of these attacks, including the ransoms paid. However, all of these groups share a similar attack chain for their intrusions. With the possible exception of Grief, all of these groups have worked with affiliates (or have been affiliates of each other) in a ransomware-as-a service group, sometimes referred to as a cartel. Under such a model, the initial attack and compromise is done separately, possibly even using a different team, and the ransomware is deployed after the exploitation phase is complete. It is also possible, however, that these ransomware actors have some sort of common reconnaissance techniques and have simply captured the same vulnerabilities in their scans before these companies have effectively secured their networks, though that seems less likely given the tight interrelation of many of these groups.

Conclusion

Ransomware has increased across the board, not only in terms of sheer volume of attacks, but also in terms of required ransoms. We are also aware that actors are actively targeting companies with ransomware insurance. However, it is becoming clear that having recently been a victim of an attack is not a deterrent from being attacked again, and may actually increase the risk of one or more subsequent attacks.

Breaking News: 2021-07-02 - 2021-07-08

VirusTotal ordered to reveal private info of stolen HSE data downloaders

An Irish court has ordered Chronicle Security Ireland and Chronicle LLC, the owners of VirusTotal, to provide the Private information of subscribers who downloaded or uploaded confidential data, stolen from Ireland's national health care service during a Conti ransomware attack. As part of this attack, Conti claimed to have stolen 700GB of data that allegedly included patient and employee info, contracts, financial statements, payroll, and more. The stolen data file was downloaded 23 times from VirusTotal before the service removed.

See the full report here: https://www.bleepingcomputer.com/news/security/virustotal-ordered-to-reveal-private-info-of-stolen-hse-data-downloaders/

Twitter now lets you use security keys as the only 2FA method

Twitter now lets users use security keys as the only two-factor authentication (2FA) method while having all other login methods disabled. 2FA is an additional security layer for Twitter accounts requiring users to use a security key or enter a code together with their passwords to log into their accounts. This ensures that only the account owner can log in and blocks malicious takeover attempts. The company also upgraded security key support to the WebAuthn standard, which delivers secure authentication over the web and enabled the ability to use 2FA on any Twitter account without a phone number.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-now-lets-you-use-security-keys-as-the-only-2fa-method/

Trickbot cybercrime group linked to new Diavol ransomware - BleepingComputer

FortiGuard labs security researchers have linked a new ransomware strain dubbed Diavol to Wizard Spider, the cybercrime group behind the Trickbot botnet. In early June 2021, the EDR solution of the company had blocked the Ransomware attack deployed on different systems with the payload of Diavol and Conti Ransomware. The parameters used by the attackers, along with the errors in the hardcoded configuration, hint to the fact that Diavol is a new tool in the arsenal of its operators which they are not yet fully accustomed to.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-cybercrime-group-linked-to-new-diavol-ransomware/

NSA, FBI Reveal Hacking Methods Used by Russian Military Hackers

In the joint advisory from NSA, CISA, FBI, and NCSC, it was revealed that GRU Russian Military Intelligence Unit is behind the ongoing hacking campaign conducted from mid-2019 where the campaign uses a Kubernetes cluster in brute force access attempts against the enterprise and cloud environments of government and private sector targeted worldwide. The agencies stated that the attacks primarily focused on the U.S. and Europe, targeting government and military, defense contractors, energy companies, higher education, logistics companies, law firms, media companies, political consultants or political parties, and think tanks.

See the full report here: https://thehackernews.com/2021/07/nsa-fbi-reveal-hacking-methods-used-by.html

Dropbox Used to Mask Malware Movement in Cyberespionage Campaign

The ongoing spear-phishing campaign is targeting the Afghan government, using Dropbox for command-and-control (C2) communications and going so far as to impersonate the Office of the President to infiltrate the Afghan National Security Council (NSC). The suspected advanced persistent threat (APT) group has been dubbed IndigoZebra. According to a report published by Check Point Research, this is just the latest in a long-running operation that goes back as far as 2014, when the same threat actors also targeted the Central-Asian countries of Kyrgyzstan and Uzbekistan.

See the full report here: https://threatpost.com/dropbox-malware-ongoing-spearphishing-cyberespionage/167402/

Google Chrome will get an HTTPS-Only Mode for secure browsing - BleepingComputer

Google is working on adding an HTTPS-Only Mode to the Chrome web browser to protect users' web traffic from eavesdropping by upgrading all connections to HTTPS. This new feature is now being tested in the Chrome 93 Canary preview releases for Mac, Windows, Linux, Chrome OS, and Android. While no official announcement has been made yet, HTTPS-Only Mode will likely start rolling out on August 31, when Chrome 93 is expected to reach stable status.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-will-get-an-https-only-mode-for-secure-browsing/

Hacked Data for 69K LimeVPN Users Up for Sale on Dark Web

The VPN provider known as LimeVPN has been hit with a hack affecting 69,400 user records. A hacker claims to have stolen the company’s entire customer database before knocking its website offline. The stolen records included user names, passwords in plain text, IP addresses, and billing information, according to PrivacySharks. Researchers added the attack also included public and private keys of LimeVPN users. Using the stolen private keys, hackers can easily decrypt every LimeVPN user’s traffic.

See the full report here: https://threatpost.com/hacked-data-limevpn-dark-web/167492/

Mongolian Certificate Authority Hacked to Distribute Backdoored CA Software

In yet another instance of software supply chain attack, unidentified hackers breached the website of MonPass, one of Mongolia's major certificate authorities, to backdoor its installer software with Cobalt Strike binaries. A public webserver, hosted by MonPass, was also infiltrated potentially as many as eight separate times, with the researchers uncovering eight different web shells and backdoors on the compromised server. Cobalt Strike is becoming increasingly popular among threat actors as an initial access payload.

See the full report here: https://thehackernews.com/2021/07/mongolian-certificate-authority-hacked.html

New Google Scorecards Tool Scans Open-Source Software for More Security Risks

Google has launched Scorecards V2.0.0, its automated security tool that produces a "risk score" for open source initiatives, with improved checks and capabilities to make the data generated by the utility accessible for analysis. Many software today relying on open-source projects since the customer needs an easy way to judge whether their dependencies are safe. Scorecards helps to reduce the toil and manual effort required to continually evaluate changing packages when maintaining a project's supply chain.

See the full report here: https://thehackernews.com/2021/07/new-google-scorecards-tool-scans-open.html

New Mirai-Inspired Botnet Could Be Using Your KGUARD DVRs in Cyber Attacks

Cybersecurity researchers have revealed details about a new Mirai-inspired botnet called "mirai_ptea" that leverages an undisclosed vulnerability in digital video recorders (DVR) provided by KGUARD to propagate and carry out distributed denial-of-service (DDoS) attacks. Since 2016 the Mirai botnet has been linked to a string of large-scale DDoS attacks. The KGUARD DVR firmware had vulnerable code prior to 2017 that enabled remote execution of system commands without authentication. Approximately 3,000 devices exposed online are susceptible to the vulnerability.

See the full report here: https://thehackernews.com/2021/07/new-mirai-inspired-botnet-could-be.html

Microsoft warns of critical PowerShell 7 code execution vulnerability - BleepingComputer

Microsoft warns of a critical .NET Core remote code execution vulnerability in PowerShell 7 caused by how text encoding is performed in .NET 5 and .NET Core. The vulnerability is tracked as CVE-2021-26701 and exists in System.Text.Encodings.Web Customers package. Users are urged to install the updated PowerShell 7.0.6 and 7.1.3 versions as soon as possible to protect their systems from potential attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-critical-powershell-7-code-execution-vulnerability/

REvil ransomware hits 200 companies in MSP supply-chain attack - BleepingComputer

The REvil ransomware gang targeted approximately six large MSPs, with thousands of customers, through what appears to be a Kaseya VSA supply-chain attack. Kaseya VSA is a cloud base MSP platform that allows providers to perform patch management and client monitoring. Kaseya is warning all VSA customers to immediately shut down their VSA server to prevent the attack's spread while they investigate.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-200-companies-in-msp-supply-chain-attack/

Actively exploited PrintNightmare zero-day gets unofficial patch - BleepingComputer

Free micro patches addressing the actively exploited PrintNightmare zero-day vulnerability in the Windows Print Spooler service are now available through the 0patch platform. The bug, tracked as CVE-2021-34527, enables attackers to take over affected servers via RCE with SYSTEM privileges, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. Even though no security updates are available to address the PrintNightmare security flaw at the moment, Microsoft has shared mitigation measures to block attackers from compromising vulnerable systems and is working on a fix.

See the full report here: https://www.bleepingcomputer.com/news/security/actively-exploited-printnightmare-zero-day-gets-unofficial-patch/

Apple and Amazon Under Investigation in Spain for Possible Anti-Competitive Practices

Apple and Amazon are facing antitrust disciplinary proceedings in Spain for possible restrictive competition practices around the sale of Apple products, it has emerged. In a press release, the country's National Commission on Markets and Competition (CNMC) said it had access to "certain information" from which it had found "rational indications" that Amazon and Apple are in breach of laws related to the defense of competition and the Treaty on the Functioning of the European Union.

See the full report here: https://www.macrumors.com/2021/07/02/amazon-apple-investigated-antitrust-spain/

US chemical distributor shares info on DarkSide ransomware data theft

The chemical distribution company Brenntag has shared additional information on what data was stolen from its network by DarkSide ransomware operators during an attack from late April 2021 that targeted its North America division. The data exfiltrated by the DarkSide attackers include social security number, date of birth, driver's license number, and select medical information.

See the full report here: https://www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/

Android Apps with 5.8 million Installs Caught Stealing Users' Facebook Passwords

Google steps in to remove nine Android apps downloaded more than 5.8 million times from the company's Play Store. The apps were caught stealing users' Facebook login credentials via a piece of JavaScript code received from an adversary-controlled server. In the last link of the attack, the stolen information was exfiltrated to the server using the trojanized applications.

See the full report here: https://thehackernews.com/2021/07/android-apps-with-58-million-installs.html

Hackers take down Apex servers as a plea to save Titanfall from hackers - Dot Esports

Recently hackers took down Apex Legends' servers as part of a plea to "save Titanfall" from the relentless hacking and distributed denial-of-service (DDoS) attacks. This kind of attack would likely require access to Apex‘s playlist file—a list of game modes that the server supports. Security vulnerabilities can allow hackers to play with the servers to send out their messages and even interrupt the service.

See the full report here: https://dotesports.com/apex-legends/news/hackers-take-down-apex-servers-as-a-plea-to-save-titanfall-from-hackers

Ransomware Gangs Taking Aim At Soft Target Industrial Control Systems

A report by cybersecurity researchers at Trend Micro warns that ransomware is a concerning and rapidly evolving threat to legacy industrial control systems (ICS) endpoints globally with a significant rise in activity during the past year, 2020. The networks which support utilities like water and power, need to be fully operational to provide services, so the victim might decide to give in and meet the ransom demand of the cybercriminals. According to the report, the US is the country with the most instances of ransomware affecting ICSs, followed by India, Taiwan, and Spain.

See the full report here: https://www.zdnet.com/article/ransomware-gangs-are-taking-aim-at-soft-target-industrial-control-systems/

US insurance giant AJG reports data breach after ransomware attack - BleepingComputer

Arthur J. Gallagher (AJG), a US-based global insurance brokerage and risk management firm, was fallen victim to a ransomware attack that hit its systems in late September 2020. While AJG didn't confirm the data breach at that time, a subsequent investigation found multiple types of sensitive information stored on systems breached during the incident. The company is now notifying data regulatory authorities and all potentially impacted individuals as required by law and warning them of identity theft risks and recommends keeping an eye out for unusual activity on their account statements and credit reports.

See the full report here: https://www.bleepingcomputer.com/news/security/us-insurance-giant-ajg-reports-data-breach-after-ransomware-attack/

Bitcoin cyber attacks surge following rising demand and increasing price of bitcoin

According to an analysis by Barracuda Networks, Phishing impersonations and business email compromise (BEC) attacks designed to steal victims’ bitcoin surged by 192% between October 2020 and May 2021. The research shows that this is because of rising demand, increasing price valuations, and more cryptocurrency holders than ever before. As cryptocurrency payments are decentralized and unregulated, cybercriminals can extort victims’ bitcoin whilst remain completely anonymous.

See the full report here: https://www.helpnetsecurity.com/2021/07/05/bitcoin-cyber-attacks/

GitLab triages bug bounty-reported flaws with latest release - The Daily Swig

GitLab has resolved some vulnerabilities including two high-impact web security flaws, with an update to its software development platform. A cross-site request forgery (CSRF) vulnerability in GitLab’s GraphQL API created a means for an attacker to call mutations while posing as their victim. Another vulnerability can let attackers perform denial-of-service (DoS) attacks by abusing the GitLab Webhook feature.

See the full report here: https://portswigger.net/daily-swig/gitlab-triages-bug-bounty-reported-flaws-with-latest-release

Sweden's FSA Probes Klarna Over Customer Info Breach - pymnts.com

Payments firm Klarna is under the watch of Sweden's Finansinspektionen, over reported violations of security law. Recently, for around 30 minutes, users of Klarna were able to see other users' data. The report said that data didn't include users' card data. The company stated the incident was the result of "human error." The investigation is ongoing to check whether Klarna has violated bank secrecy or not.

See the full report here: https://www.pymnts.com/news/security-and-risk/2021/sweden-fsa-probes-klarna-over-customer-info-breach/

US water company WSSC Water hit by a ransomware attack

According to reports from WJZ13 Baltimore, WSSC Water is investigating a ransomware attack that took place on May 24, 2021, and that targeted a portion of their network that operates non-essential business systems. The company removed the malware just hours later and locked out the threat. However, the attackers accessed internal files. WSSC has already notified the FBI, Maryland Attorney General, and state and local homeland security officials. Fortunately, the attack did not impact the water quality, but the investigation is still ongoing.

See the full report here: https://securityaffairs.co/wordpress/119700/cyber-crime/wssc-water-ransomware-attack.html

Revil ransomware gang hit Spanish telecom giant MasMovil

MasMovil is one of the largest Spanish telecom operators and it has been recently hit by the REvil ransomware gang that claims to have stolen sensitive data from the company. The ransomware group shared screenshots of the allegedly stolen documents on its leak sites. The screenshot image shows folders from the systems of the company (i.e. Backup, RESELLERS, SCORING, PARLEM).

See the full report here: https://securityaffairs.co/wordpress/119719/cyber-crime/masmovil-ransomware-attack.html

Experts warn Chinese hackers targeting SBI users via phishing, free gift scams - Free Press Journal

In fresh trouble for the State Bank of India (SBI), hackers of Chinese origin are targeting bank users with phishing scams, asking them to update their KYC using a particular website link followed by requesting OTP sent to the user and some confidential bank account information for offering free gifts from the bank via a WhatsApp message with suspicious URL. The URL manipulation showed that the web server has directory listing enabled and found other links visible which proves that not only the SBI users, but IDFC, PNB, IndusInd and Kotak bank users are also targeted by the same type of phishing scam.

See the full report here: https://www.freepressjournal.in/business/experts-warn-chinese-hackers-targeting-sbi-users-via-phishing-free-gift-scams

Microsoft 365 to let SecOps lock hacked Active Directory accounts

Microsoft is updating Microsoft Defender for Identity to allow security operations (SecOps) teams to block attacks by locking a compromised user's Active Directory account. After adding "native 'response' actions" to the Defender for Identity, SecOps will have the ability to directly lock the Active Directory account, or to prompt for the password to be reset, meaning more direct action can be taken when a user is compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-365-to-let-secops-lock-hacked-active-directory-accounts/

Interpol Arrests Moroccan Hacker Engaged in Nefarious Cyber Activities

Cybersecurity firm Group-IB disclosed in a report, that the law enforcement authorities with Interpol have apprehended a threat actor presumably responsible for multiple attacks on telecom companies, major banks, and multinational corporations in France with the goal of stealing customers' bank information. The two-year investigation, dubbed Operation Lyrebird by the international, intergovernmental organization, resulted in the arrest of a Moroccan citizen nicknamed Dr HeX.

See the full report here: https://thehackernews.com/2021/07/interpol-arrests-hacker-in-morocco-who.html

Microsoft Issues Emergency Patch for Critical Windows PrintNightmare Vulnerability

Microsoft has shipped an emergency out-of-band security update to address a critical zero-day vulnerability, known as "PrintNightmare" that affects the Windows Print Spooler service and can permit remote threat actors to run arbitrary code and take over vulnerable systems. The bug is racked as CVE-2021-34527 and impacts all supported editions of Windows. The update, however, does not include Windows 10 version 1607, Windows Server 2012, or Windows Server 2016, for which the company stated patches will be released in the forthcoming days.

See the full report here: https://thehackernews.com/2021/07/microsoft-issues-emergency-patch-for.html

Pro-Trump ‘Gettr’ Social Platform Hacked On Day One

Gettr, a social media platform set up by allies of former President Donald Trump was overburden by Sonic the Hedgehog-themed porn and had prominent users’ profiles defaced. Next, hackers posted its user database online. JubaBaghdad, who describes himself as a white-hat hacker, stated that Gettr managed to fix the poorly implemented API that he had pried open for the attack, but that the fix didn’t keep him from scraping user data from individuals’ accounts.

See the full report here: https://threatpost.com/trump-gettr-social-media-hacked-day-1/167574/

Huge increase of threat actors using Cobalt Strike - Proofpoint research - SecurityBrief New Zealand

Cybersecurity company, Proofpoint, has released research finding which shows 161% increase in threat actors using the threat emulation tool Cobalt Strike. Cobalt Strike is a legitimate security tool used by penetration testers to emulate threat actor activity in a network. As per the company findings, Cobalt Strike is currently used by more cybercrime and general commodity malware operators than APT and espionage threat actors.

See the full report here: https://securitybrief.co.nz/story/huge-increase-of-threat-actors-using-cobalt-strike-proofpoint-research

CISA, FBI share guidance for victims of Kaseya ransomware attack - BleepingComputer

CISA and the Federal Bureau of Investigation (FBI) have shared guidance for managed service providers (MSPs) and their customers impacted by the REvil supply-chain ransomware attack that hit the systems of Kaseya's cloud-based MSP platform. They have also advised MSPs affected by the attack to further check their systems for signs of compromise using a detection tool provided by Kaseya over the weekend and enable multi-factor authentication (MFA) on as many accounts as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-fbi-share-guidance-for-victims-of-kaseya-ransomware-attack/

WildPressure APT Emerges With New Malware Targeting Windows and macOS

Wiregrass Electric Cooperative, a rural Alabama electric cooperative was hit by a ransomware attack which temporarily blocked the customers’ access to their account information. Wiregrass Electric Cooperative did not suffer a data breach and the provision of the electrical service was not impacted. The organization took off-line the member account information and payment systems as a precaution. Out of abundance of caution, WEC is conducting system maintenance following the attack which prevents members from accessing their accounts and any payment systems.

See the full report here: https://thehackernews.com/2021/07/wildpressure-apt-emerges-with-new.html

This Serious WiFi Bug Can Break Your iPhone

A specially-crafted hotspot can cause big problems for your iPhone or iPad. Researchers discovered that a specific network name -- %secretclub%power -- can completely disable your iPhone's ability to connect to Wi-Fi and things cannot be restored back to normal. Hackers using this as a vulnerability to do something more malicious from setting up Wi-Fi hotspots with this name and no password. To avoid this make sure that Auto-Join Hotspots is set to Ask to Join or Never on your iPhone (and iPad).

See the full report here: https://www.zdnet.com/article/serious-wi-fi-bug-can-break-your-iphone-but-heres-how-to-protect-yourself/

Non-Malicious Android Crypto Mining Apps Scam Users at Scale

Researchers at mobile security firm Lookout have identified more than 170 Android apps that target and scam users interested in cryptocurrencies. Twenty-six of these were found on the official Google Play store. These apps cannot even be classified as 'malware' and difficult to detect by automated scans, since they do nothing typified as malicious and don't contain a payload. To avoid being a victim of these scams, check the online reviews with keywords like 'I cannot download the balance', or 'the balance value keeps reverting to zero' before paying for or downloading an app.

See the full report here: https://www.securityweek.com/non-malicious-android-crypto-mining-apps-scam-users-scale

Microsoft's incomplete PrintNightmare patch fails to fix vulnerability - BleepingComputer

Researchers have bypassed Microsoft's emergency patch for the PrintNightmare vulnerability to achieve remote code execution and local privilege escalation with the official fix installed. Last night, Microsoft released an out-of-band security update that only fixed the remote code execution component of the vulnerability. The threat actors could still use the local privilege escalation component to gain SYSTEM privileges on vulnerable systems.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsofts-incomplete-printnightmare-patch-fails-to-fix-vulnerability/

Tor Browser adds new anti-censorship feature, V2 onion warnings - BleepingComputer

The Tor Project has released Tor Browser 10.5 with V2 onion URL deprecation warnings, a redesigned Tor connection experience, and an improved anti-censorship feature. To warn Tor website admins of the upcoming changes, the Tor Browser will now display a message when visiting version 2 Onion sites that their URLs would soon be deprecated, and the site will soon be unreachable unless they upgrade to version 3.

See the full report here: https://www.bleepingcomputer.com/news/security/tor-browser-adds-new-anti-censorship-feature-v2-onion-warnings/

Critical Sage X3 RCE Bug Allows Full System Takeovers

Researchers have discovred four vulnerabilities in the popular Sage X3 enterprise resource planning (ERP) platform, which could allow attackers to tamper with or sabotage victims’ business-critical processes and to intercept data. The bugs are tracked as CVE-2020-7387, CVE-2020-7388, CVE-2020-7389 and CVE-2020-7390. Users are advised to apply the patches as soon as possible.

See the full report here: https://threatpost.com/critical-sage-x3-rce-bug-allows-full-system-takeovers/167612/