Threat Intelligence Bulletin: 07/09/2021 - 07/15/2021
|by Alpha Team
Strategic Advisory: 2020 Summer Olympics Event Assessment
In this Event Assessment report, the ZeroFox Threat Analysis & Investigations team provides an in-depth analysis of possible cyber and physical security concerns associated with the Tokyo 2020 Olympic Games.
Standing Intelligence Requirements
For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
The 2020 Summer Olympic Games, also known as Tokyo 2020, are scheduled to be held from July 23, 2021, to August 8, 2021, in Tokyo, Japan. Originally scheduled to take place in 2020, the event was postponed as a result of the COVID-19 pandemic. Although Tokyo 2020 faces unique challenges, and its organizers’ creativity and resiliency are being put to the test, no credible physical or cybersecurity-related threats associated with the upcoming Olympic events were identified as of the writing of this report. Nevertheless, concerns over the possible impact of ransomware attacks or nation-state activities on the Games persist.
Breaking News: 2021-07-09 - 2021-07-15
Magecart Hackers Hide Stolen Credit Card Data Into Images for Evasive Exfiltration
Magecart group have latched on to a new technique of obfuscating the malware code within comment blocks and encoding stolen credit card data into images and other files hosted on the server. To Avoid raising suspicion, the credit card details dumped into image files on the server can later be downloaded using a simple GET request at a later date. MageCart is an ever growing threat to e-commerce websites with the goal of plundering credit card numbers by injecting malicious JavaScript skimmers and selling them on the black market.
See the full report here: https://thehackernews.com/2021/07/magecart-hackers-hide-stolen-credit.html
Hackers Derail Iran's Train System, Post Supreme Leader's Phone Number as Help Line
Cyberattacks reportedly disrupted Iran’s railway system on Friday and also trolled the nation’s Supreme Leader Ali Khamenei, posting his phone number as “the number to call for information” on multiple train station message boards causing that trains have been massively delayed but not totally stalled. Attacks on transportation networks and hubs are mostly semi-frequent. Through this attack the railway’s website, local ticket offices, and cargo services have all apparently been affected.
See the full report here: https://gizmodo.com/hackers-derail-irans-train-system-post-supreme-leaders-1847260870
Insurance giant CNA reports data breach after ransomware attack
CNA Financial Corporation, a leading US-based insurance company, is notifying customers of a data breach following a Phoenix CryptoLocker ransomware attack that hit its systems in March. The investigation revealed that the threat actor accessed certain CNA systems at various times and copied a limited amount information contained customers' personal information such as names and Social Security numbers before deploying the ransomware.
See the full report here: https://www.bleepingcomputer.com/news/security/insurance-giant-cna-reports-data-breach-after-ransomware-attack/
FBI warns cryptocurrency owners, exchanges of ongoing attacks - BleepingComputer
The Federal Bureau of Investigation (FBI) has warned cryptocurrency owners, exchanges, and third-party payment platforms of threat actors actively targeting virtual assets in attacks that can lead to significant financial losses. According to the FBI, attackers are using several tactics to steal and launder cryptocurrency, including technical support fraud, SIM swapping (aka SIM hijacking), and taking control of their targets' cryptocurrency exchange accounts via identity theft or account takeovers. Financial organizations are advised to check for mails coming from spoofed email addresses and keep track and monitor recently created accounts.
See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-cryptocurrency-owners-exchanges-of-ongoing-attacks/
Microsoft: PrintNightmare security updates work, start patching! - BleepingComputer
Microsoft has released the emergency security updates this week that correctly patches the PrintNightmare Print Spooler vulnerability for all supported Windows versions. This clarified guidance comes after security researchers tagged the patches as incomplete after finding that the OOB security updates could be bypassed in specific scenarios. Users are strongly recommended to apply the updates as soon as possible.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-printnightmare-security-updates-work-start-patching/
Cisco BPA, WSA Bugs Allow Remote Cyberattacks
Cisco has addressed a set of high-severity privilege-escalation vulnerabilities affecting Business Process Automation (BPA) application and Cisco’s Web Security Appliance (WSA), which could allow authenticated, remote attackers to access sensitive data or take over a targeted system. The bugs are tracked as CVE-2021-1574, CVE-2021-1576, and CVE-2021-1359. Users are advised to upgrade to the latest fixed versions to mitigate the vulnerabilities.
See the full report here: https://threatpost.com/cisco-bpa-wsa-bugs-cyberattacks/167654/
CISA Releases Ransomware Readiness Assessment Tool for Assessing Organizations’ Cybersecurity Posture - CPO Magazine
CISA released the Ransomware Readiness Assessment (RRA) tool that can help organizations assess the vulnerability of their systems to ransomware attacks, and to identify areas that can be improved. The module, which is part of the Cyber Security Evaluation Tool (CSET), covers two areas, namely, information technology (IT) and industrial control system (ICS) assets. All organizations regardless of their cybersecurity maturity levels can use the ransomware readiness assessment tool to test their ransomware resilience.
See the full report here: https://www.cpomagazine.com/cyber-security/cisa-releases-ransomware-readiness-assessment-tool-for-assessing-organizations-cybersecurity-posture/
#smishing is effective and convincing. The victim would be alarmed when they received the text that will lead them to click the link, fill in their personal information, and click enter. #Phishing #smsscam #socialengineer #cybersecurityawareness
The head of the Garda National Economic Crime Bureau stated that within three days, over one hundred amounts ranging between €2,500 and €19,500 have been reported stolen by people as a result of "smishing" or fake text messages. Fraudsters are sending fake text messages impersonating the Bank of Ireland and directing customers to fake websites. He urged phone companies to filter fake calls, identify the source and try to work with Gardai, Interpol, and Europol to stop these frauds.
See the full report here: https://www.rte.ie/news/business/2021/0630/1232206-bank-of-ireland-warns-on-scams/
China using #AI to develop robots that can hide in sea launch bombs and cyber attacks - Cybersecurity Insiders #Privacy #Phishing #Ransomware #Cloud #Cybersecurity #Infosec #Cyberattacks #Hacking #IoT #Security
Researchers suspected that the Republic of China is developing Unmanned Underwater Vehicles (SUVs) that have the potential to launch torpedos and cyber attacks on the digital infrastructure available in the vicinity. They aim to create vehicles that are capable to conduct underwater warfare and also can launch digital attacks by connecting themselves to the nearby internet resource.
See the full report here: https://www.cybersecurity-insiders.com/china-using-ai-to-develop-robots-that-can-hide-in-sea-launch-bombs-and-cyber-attacks/
ParkMobile Hit With Proposed Class Action Over Data Breach - Law360
A lawsuit was filed in the Northern District of Georgia against ParkMobile LLC that runs an app allowing customers to pay parking meters from their phone. The company is accused of having lax online security that compromised customers' data during a hack in March 2021. The data breach cost 21 million customers more than $5 million and exposed sensitive information.
See the full report here: https://www.law360.com/articles/1401717/parkmobile-hit-with-proposed-class-action-over-data-breach
Mint Mobile hit by a data breach after numbers ported, data accessed
Mint Mobile has disclosed a data breach after an unauthorized person gained access to subscribers' account information and ported phone numbers to another carrier. The company immediately took steps to reverse the process and restore the service. It is recommended that users should reset their account password, as the threat actors may have gained access to their Mint Mobile password.
See the full report here: https://www.bleepingcomputer.com/news/security/mint-mobile-hit-by-a-data-breach-after-numbers-ported-data-accessed/
Bandidos Malware Targeting Networks in South America - Softpedia News
Cybersecurity researchers disclosed a malware espionage campaign targeting South American commercial networks, with the majority of efforts focused on Venezuela. In this campaign, the malware, Bandidos is an improved version of the Bandook which was designed to target enterprises in industries such as healthcare, software services, retail, manufacturing, and construction. According to the chain analysis of the latest attack, the PCs can be compromised just by opening malicious emails that contain PDF attachments.
See the full report here: https://news.softpedia.com/news/bandidos-malware-targeting-networks-in-south-america-533485.shtml
CISA publishes malware analysis report and updates alert on DarkSide ransomware - Security Magazine
CISA has published a new Malware Analysis Report (MAR) on DarkSide Ransomware and updated Alert AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks. The Alert was originally released on May 11, 2021 and this update adds indicators of compromise associated with a DarkSide ransomware variant.
See the full report here: https://www.securitymagazine.com/articles/95624-cisa-publishes-malware-analysis-report-and-updates-alert-on-darkside-ransomware
Data of 1.2M patients stolen prior to third-party vendor ransomware attack - SC Magazine
Recently the Practicefirst Medical Management Solutions and the PBS Medcode notified 1.2 million patients that their data was accessed and stolen from its network, ahead of a ransomware attack deployed on Dec. 25, 2020. Officials said they shut down the system, performed a system-wide password reset, alerted law enforcement, and contracted with an outside privacy and security firm. The hack exposed sensitive information about the patients.
See the full report here: https://www.scmagazine.com/home/health-care/data-of-1-2m-patients-stolen-prior-to-third-party-vendor-ransomware-attack/
Pakistan-based Hackers Targeting Critical Infrastructure PSUs in India - News18
Cybersecurity firm Seqrite has revealed in a report that Pakistan-based hacker groups, Transparent Tribe, are now targeting India's critical infrastructure includes PSUs from the telecom, power, and finance sectors. Researchers suspect that the APT ‘Operation SideCopy’ appears to be a cyber espionage campaign aimed at collecting sensitive information to gain a competitive advantage against India.
See the full report here: https://www.news18.com/news/india/pakistan-based-hackers-targeting-critical-infrastructure-psus-in-india-3943676.html
NYC launches cyberdefense center amid major ransomware attacks - SlashGear
New York City is the first major metro region in the US to launch a cyberdefense center located in a Manhattan skyscraper. This center is a mix of private and government entities having 282 partners that will work together to illuminate possible cybersecurity threats, helping protect the city and its critical infrastructure. This initiative is the result of the growing number of ransomware attacks.
See the full report here: https://www.slashgear.com/nyc-launches-cyberdefense-center-amid-major-ransomware-attacks-10681986/
A New Critical SolarWinds Zero-Day Vulnerability Under Active Attack
SolarWinds, the Texas-based company has issued patches to contain a remote code execution flaw in its Serv-U product. The fixes, which target Serv-U Managed File Transfer and Serv-U Secure FTP products, arrive after Microsoft notified the IT management and remote monitoring software maker that the flaw was being exploited in the wild. Successful exploitation of the vulnerability (CVE-2021-35211) could enable an adversary to run arbitrary code on the infected system, including the ability to install malicious programs and view, change, or delete sensitive data.
See the full report here: https://thehackernews.com/2021/07/a-new-critical-solarwinds-zero-day.html
Authentication bypass allows complete takeover of Modicon PLCs used across industries - CSO Online
Security researchers found a flaw in several programmable logic controllers (PLCs) from Schneider Electric’s Modicon series that could allow hackers to bypass their authentication mechanism and execute malicious code. Attackers with network access to impacted controllers could exploit the issue to install malware that alters the operation of the controllers and hides those malicious changes from the workstations and operators managing them.
See the full report here: https://www.csoonline.com/article/3624598/authentication-bypass-allows-complete-takeover-of-modicon-plcs-used-across-industries.html
Threat actors scrape 600 million LinkedIn profiles and are selling the data online – again
LinkedIn experienced another massive data scrape conducted by a malicious actor. An archive of data collected from hundreds of millions of LinkedIn user profiles surfaced on a hacker forum, where it’s currently being sold for an undisclosed sum. This is the third time in recent four months that LinkedIn data has been scrapped and sold. The data includes the publicly available information but availability on a mass scale, can still put users at risk of spam and phishing attacks.
See the full report here: https://securityaffairs.co/wordpress/120009/cyber-crime/600m-linkedin-profiles-scraped.html
Trickbot Malware Returns with a new VNC Module to Spy on its Victims
Russia-based transnational cybercrime group is revamping its attack infrastructure in response to recent counter efforts from law enforcement. Researchers discovered that the new capabilities of Trickbot malware used to monitor and gather intelligence on victims, using a custom communication protocol to hide data transmissions between command-and-control servers and victims, making attacks difficult to detect.
See the full report here: https://thehackernews.com/2021/07/trickbot-malware-returns-with-new-vnc.html
Fashion retailer Guess discloses data breach after ransomware attack
American fashion brand and retailer Guess has notified its affected customers of a data breach following a February 2021 ransomware attack that led to data theft. The investigation determined that Social Security numbers, driver's license numbers, passport numbers, and financial account numbers may have been accessed or acquired.
See the full report here: https://www.bleepingcomputer.com/news/security/fashion-retailer-guess-discloses-data-breach-after-ransomware-attack/
Hackers Spread BIOPASS Malware via Chinese Online Gambling Sites
Cybersecurity researchers are warning about a new malware that is striking online gambling companies in China via a watering hole attack. The attack deploys either Cobalt Strike beacons or a previously undocumented Python-based backdoor called BIOPASS RAT that takes advantage of Open Broadcaster Software (OBS) Studio's live-streaming app to capture the screen of its victims to attackers. It is recommended to download apps only from trusted sources and official websites to avoid being compromised.
See the full report here: https://thehackernews.com/2021/07/hackers-spread-biopass-malware-via.html
Iranian Hackers Pose as UK Scholars to Target Experts - Voice of America
According to the cybersecurity firm Proofpoint, the threat group, known as TA453, has targeted university professors and other experts seeking sensitive information. As part of the latest operation, the IRGC-tied hacker group compromised the website of SOAS Radio and then sent the victims “registration links” to the site, according to the researchers. The targets of the latest campaign included think tank experts in Middle Eastern affairs, top professors from well-known academic institutions, and journalists specializing in the Middle East.
See the full report here: https://www.voanews.com/middle-east/iranian-hackers-pose-uk-scholars-target-experts
#Phishing attack targets DocuSign and SharePoint users #hackers #infosec
Security Researchers reported that cybercriminals are mimicking legitimate correspondence to actively target popular cloud applications DocuSign and SharePoint in phishing attacks designed to steal user log-in credentials. They further added that most of the emails use COVID-19 as a way to dupe users into clicking on a bogus document. It is recommended, companies should also have a security operations team, properly equipped to monitor logs for alerts around impossible geographical travel, log-ins from a new location, or suspicious user activity.
See the full report here: https://www.scmagazine.com/home/security-news/phishing-attack-targets-docusign-and-sharepoint-users/
Ransomware Giant REvil’s Sites Disappear
All of REvil’s Dark Web sites slipped offline as of early Tuesday morning, and it’s not clear whether it’s due to the ransomware gang getting busted or whether the threat actors did it on purpose. The REvil ransomware operation, a.k.a. Sodinokibi, uses both clear web and Dark Web sites to negotiate ransoms, leak data, support its backend infrastructure and receive payment from its many victimized organizations. That victims list has recently grown with the addition of Kaseya and its many managed service provider (MSP) customers, as well as the global meat supplier JBS Foods.
See the full report here: https://threatpost.com/ransomware-revil-sites-disappears/167745/
Adobe updates fix 28 vulnerabilities in 6 programs - BleepingComputer
Adobe has released a Patch Tuesday security update release that fixes vulnerabilities in Adobe Dimension, Illustrator, Framemaker, Acrobat, Reader, and Bridge. In total, Adobe fixed 28 vulnerabilities with today's updates. Almost all critical vulnerabilities could lead to arbitrary code execution, allowing threat actors to execute commands on vulnerable computers. Out of the security updates released today, Adobe Acrobat and Reader had the most fixes, with 19 vulnerabilities.
See the full report here: https://www.bleepingcomputer.com/news/security/adobe-updates-fix-28-vulnerabilities-in-6-programs/
Updated Joker Malware Floods into Android Apps
The Joker premium billing-fraud malware is back on Google Play with an updated bag of tricks to evade scanners. The developers of the latest versions of Joker, which began emerging in late 2020, are taking advantage of legitimate developer techniques to try and hide the actual intent of the payload from traditional, legacy-based mobile security toolsets, which helps them evade both device-based security and app store protections.
See the full report here: https://threatpost.com/updated-joker-malware-android-apps/167776/
Safari Zero-Day Used in Malicious LinkedIn Campaign
Researchers shed light on how attackers exploited Apple web browser vulnerabilities to target government officials in Western Europe. The Safari WebKit flaw is tracked as CVE-2021-1879 and allowed attackers to execute maliciously crafted web content leading to cross-site scripting. Before the fix, researchers assert Russian-language threat actors were exploiting the vulnerability in the wild by using LinkedIn Messaging to send government officials from Western European countries malicious links that could collect website-authentication cookies, according to the post by Maddie Stone and Clement Lecigne from Google TAG.
See the full report here: https://threatpost.com/safari-zero-day-linkedin/167814/
SonicWall warns of 'critical' ransomware risk to EOL SMA 100 VPN appliances - BleepingComputer
SonicWall has issued an "urgent security notice" warning customers of ransomware attacks targeting unpatched end-of-life (EoL) Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) products. Companies still using EoL SMA and/or SRA devices with 8.x firmware are urged to update the firmware immediately or disconnect the appliances as soon as possible to fend off the critical risk of ransomware attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-critical-ransomware-risk-to-eol-sma-100-vpn-appliances/
BazarBackdoor sneaks in through nested RAR and ZIP archives - BleepingComputer
Security researchers caught a new phishing campaign that tried to deliver the BazarBackdoor malware by using the multi-compression technique and masking it as an image file. The new BazarBackdoor campaign deployed earlier this month and lured enterprise recipients with an “Environmental Day” theme, officially celebrated on June 5. Both attached nested ZIP and RAR archives in the attachment contained a JavaScript file that ultimately delivered Trickbot’s BazarBackdoor malware, a stealthy backdoor typically used on corporate targets to provide remote access to the threat actor.
See the full report here: https://www.bleepingcomputer.com/news/security/bazarbackdoor-sneaks-in-through-nested-rar-and-zip-archives/
Tags: weekly bulletin, all industries, global