Threat Intelligence Bulletin: 07/16/2021 - 07/22/2021

Breach Disclosure: Vastaamo

In late 2018, Finland-based psychotherapy service, Vastaamo, suffered a data breach that resulted in the exposure of 30,000 patient records. These records included patient names, social security numbers, and patient notes from therapy sessions. The compromise became public in 2020 after victims received extortion messages from attackers threatening to publish their private information unless they paid a ransom demand of EUR 200 (approximately USD 240 during the time).

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

In May 2021, an actor using the alias "Zan" published a thread on a cybercriminal marketplace network advertising the sale of the Vastaamo data breach. Approximately 30,000 records were in the breach package. The post also contains a list of database headers for infomration obtained from the breach. It is unclear if this actor initially breached the company or purchased the database from another seller in order to leak publicly for the first time, as the breach information circulated on other cybercriminal marketplaces.

Figure 1: Actor "Zan" publishes a thread on Vastaamo data breach package

Breach Disclosure: Short Édition

In June 2021, France-based publishing company, Short Édition, was the victim of a data breach that resulted in the compromise of approximately 505 thousand records. The information involved in the breach included names, email addresses, mailing addresses, and salted SHA-1 or SHA-512 password hashes.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On June 26, 2021, Short Édition suffered a data breach in which the following types of data were compromised:

• Names
• Usernames
• Email addresses
• Mailing addresses
• Phone numbers
• Date of birth
• Gender
• Salted SHA-1 or SHA-512 password hashes

The breach occurred when Short Édition's hosting servers were the target of a large-scale cyberattack. The company took the website down and immediately began working with law enforcement and cybersecurity experts to investigate the incident. Short Édition recommends that all website users change their account passwords as a precaution.

Flash Alert: Pegasus Malware Targets High-Profile Victims in Zero-Click Attacks

TLP: GREEN

On July 18, 2021, the non-profit organization, Forbidden Stories, published an article that detailed the targeting of high-profile individuals with spyware malware, after investigating a data leak that contained over 50,000 phone numbers of possible targets. The malware, called Pegasus, was developed by the Israel-based technology firm NSO Group, and is used to monitor all incoming and outgoing traffic from targeted devices. This includes, but is not limited to, tracking keystrokes, recording audio and video, monitoring device logs, and collecting data from applications. Pegasus utilized a "zero-click" attack vector which involves a set of exploits used to target fully patched mobile devices, such as an Apple iPhone 12 running iOS 14.6 in July 2021.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Recommendations

• The use of zero-click technology enables the malware to execute on the target device without user interaction, making it difficult to detect and prevent. If suspicious activity is observed on a device, report this activity to the appropriate security teams.
• Previous Pegasus attacks involved malicious links in text messages via social engineering lures. Avoid clicking on suspicious links in text messages and emails from unknown contacts and instead report such activity to the appropriate security teams.
• Although Pegasus is a highly-targeted type of spyware, it is recommended to understand the malware's tactics, techniques, and procedures (TTPs), and continue following approved cybersecurity practices.

Details

Headlines about Pegasus spyware broke on July 18, 2021, after media organizations investigated a massive data leak containing over 50,000 phone numbers of individuals who were possible persons of interest for NSO Group clients. Media investigations identified over 1,000 phone numbers belonging to individuals in over 50 countries. This group included high-profile targets such as journalists, activists, politicians, and world leaders, as well as friends and relatives of some of these targets.

Amnesty International performed a forensic analysis of Pegasus attacks from 2014 to 2021, primarily focusing on the forensic traces from iOS and Android devices. When Pegasus first emerged in reports, the malware used social engineering to initiate the spyware on the target device. In one example that occurred in 2016, Pegasus was associated with an attack on a target which involved suspicious text messages containing malicious links. When clicked, the link would trigger a chain of exploits to remotely "jailbreak" (a privilege escalation to remove software restrictions on Apple devices) the iPhone and install Pegasus. After the installation, the spyware would monitor and collect all incoming and outgoing data from the phone. Some of these actions may include:

• Collecting keystrokes
• Recording audio and video
• Extracting phone call logs
• Monitoring communications (email, text messages, etc.)
• Enabling and tracking geolocation
• Monitoring network configurations and device settings
• Monitoring other applications installed on the target device (ZeroFox Note: This includes bypassing security settings for encrypted chat applications.)

In the most recent investigation of the Pegasus spyware performed by the non-profit organizations, the malware uses a zero-click attack vector. This type of attack vector does not require any user interaction from the target to compromise the device. In Amnesty International's forensic analysis, the investigation revealed that Pegasus exploits successfully infected fully patched iPhone 12 devices running iOS 14.6 in July 2021. Although Apple uses robust security measures for their digital devices, it does not mean that Apple devices are immune from cyber attacks and security vulnerabilities, as demonstrated by the zero-click attacks. Zero-click attacks were also used by NSO Group in 2019 by exploiting iOS iMessage and FaceTime applications, and later in 2020 via the Apple Music application.

Amnesty International compiled a list of indicators of compromise (IOCs) via forensic analysis on known Pegasus attacks. The list contains references to network injections, malicious processes, and affected mobile applications. Additionally, Amnesty researchers uploaded a GitHub repository containing IOCs for domain names from Pegasus versions 1 through 4, email addresses, files, and processes identified in Pegasus attacks.

IOC Sources

https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso

Breaking News: 2021-07-16 - 2021-07-22

Tulsa Says Network Hack Gained Some Social Security Numbers

Hackers gained access to the Social Security numbers of 27 people during a ransomware attack that forced the city of Tulsa to shut down parts of its computer network for months. More than 18,000 hacked files were posted on the dark web with other information such as names, dates of birth, addresses and driver’s license numbers. All public-facing services have since been restored and the entire network is expected to be fully functional.

See the full report here: https://www.securityweek.com/tulsa-says-network-hack-gained-some-social-security-numbers

Coinbase Users Face Ongoing Phishing Attacks

The rise in the value of cryptocurrencies has inevitably drawn the eye of criminals for numerous phishing campaigns against Coinbase users. Researchers found the phishing campaign designed to steal Coinbase login credentials for the theft of cryptocurrency, financial and personal details through sending the well drafted Phishing email supporting the Coinbase logo from a hijacked email account. Coinbase, along with most authorities, urges users to employ two-factor authentication to overcome this phishing campaign.

See the full report here: https://www.securityweek.com/coinbase-users-face-ongoing-phishing-attacks

Facebook Suspends Accounts Used by Iranian Hackers to Target US Military Personnel

Facebook disclosed it dismantled a online cyber espionage campaign conducted by Iranian hackers named “Tortoiseshell” targeting military personnel and companies in the defense and aerospace sectors in the U.S., U.K., and Europe using fake online personas on its platform. The attacks were part performed by the bad actors leveraging Facebook as a social engineering vector to redirect the victims to rogue domains via malicious links. To disrupt this operation, Facebook blocked malicious domains from being shared on their platform and taken down around 200 accounts run by the hacking group.

See the full report here: https://thehackernews.com/2021/07/facebook-suspends-accounts-used-by.html

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

A critical SQL-injection security vulnerability in the WooCommerce e-commerce platform and a related plugin has been under attack as a zero-day bug, researchers have disclosed. The bug could allow unauthenticated cyberattackers to gain access to information from an online store’s database, including customer data and payment-card info and employee credentials. The related plugin affected by the bug is the WooCommerce Blocks feature, which is installed on more than 200,000 sites. The exploitation prompted WooCommerce to release an emergency patch for the issue late on Wednesday.

See the full report here: https://threatpost.com/zero-day-attacks-woocommerce-databases/167846/

Microsoft's print nightmare continues with malicious driver packages - BleepingComputer

Microsoft's print nightmare continues with another example of how a threat actor can achieve SYSTEM privileges by abusing malicious printer drivers. A security researcher discovered a way to abuse Windows' normal method of installing printer drivers to gain local SYSTEM privileges through malicious printer drivers. This technique can be used even if admins applied Microsoft's recommended mitigations of restricting printer driver installation to admins and disabling Point and Print. This technique could be used to help threat actors spread laterally in an already compromised network.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-print-nightmare-continues-with-malicious-driver-packages/

Microsoft shares guidance on new Windows Print Spooler vulnerability - BleepingComputer

Microsoft has released an advisory to address a vulnerability in Windows Print Spooler service. It is tracked as CVE-2021-34481 and can locally exploited to gain elevated privileges on the device. The flaw is not related to PrintNightmare and is a local only vulnerability. Microsoft is yet to release a patch to fix this issue, but has provided workaroubds to mitigate this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/

Hackers Move To Extort Gaming Giant EA

The hackers stole a wealth of data from gaming giant EA have moved from trying to sell that data to now releasing parts of it publicly to extort EA. Hackers reports that they didn’t get any response for their demand email on ransome [sic] from EA, results in 1.3GB cache from stolen data released and also they threaten keep posting stolen data if EA don’t contact or pay them. The hackers broke into EA by purchasing a Slack login token from an underground market. EA believes the stolen data does not poses any concern to player privacy and have no reason to believe that there is any material risk to their game, business or players.

See the full report here: https://www.vice.com/en/article/m7e57n/hackers-extort-ea-fifa

Toddler mobile banking malware surges across Europe #computermalware #cybersecurity #antivirusandmalware #malware #cyberattack #banking #cybercrime #cyber #datasecurity #europe #technology #phishing #databreach

Toddler, a new Android banking Trojan that is surging across Europe, especially Spain and Italy were infection hotspots. Toddler had tracked to malicious .APK files and Android apps. While the Trojan not been found on Google Play as of now, numerous legitimate websites have been compromised to host and serve the malware. The Trojan is able to maintain unusual level of persistence like, preventing an infected device from being rebooted and a handset from being used in safe mode. Removal of the malware from the device requires huge technical expertise, and it looks like the process will not get easier in the future.

See the full report here: https://www.zdnet.com/article/toddler-mobile-banking-malware-surges-across-europe/

Cyberattack on Moldova's Court of Accounts destroyed public audits

A cyberattack reported in Moldova's "Court of Accounts" leading to the agency's public databases and audits being destroyed. Court of Accounts of Moldova is a government authority that performs audits of public financial resources and government agencies. The attack has led the agency to shut down its website while the incident is investigated and data can be restored.While this cyberattack was destructive for the Court of Accounts, the threat actors could have caused further damage by using the site to distribute malware to visitors.

See the full report here: https://www.bleepingcomputer.com/news/security/cyberattack-on-moldovas-court-of-accounts-destroyed-public-audits/

Instagram Security Check hopes to make life harder for account hackers

Instagram has rolled out a new feature in the hope of better securing its active users' accounts. Security Checkup will pop-up on users' smartphones whenever the social network detects suspicious activity associated with an account, or believes it may have been compromised. Several security measures like enabling two-factor authentication, ensuring email addresses and phone numbers given are correct and up to date, enabling “Login Request” feature that alerts user when unauthorized account login happens. Instagram recommends their users to enable these security measures to make the life of hackers harder.

See the full report here: https://www.bitdefender.com/blog/hotforsecurity/instagram-security-check-hopes-to-make-life-harder-for-account-hackers

REvil Ransomware Site Goes Offline

Multiple websites linked to the infamous ransomware gang REvil are currently offline showing "Onionsite not found," error message when trying to visit it. REvil is the group linked to the recent hack of information technology firm Kaseya which an REvil affiliate used to then ransom a wealth of other companies around the world. The reason for the downtime is unclear. Sometimes dark web sites temporarily go offline and swiftly return. The site has been down now for over eight hours.

See the full report here: https://www.vice.com/en/article/bvz5m4/revil-ransomware-site-goes-offline

“In the latest #LinkedIn #phishing scam, the sender’s email address as shown appears to be from Paul University which is based in Nigeria.” #GoogleForms

Security researchers have discovered a new LinkedIn phishing campaign that targeted approximately 700 users through Google Workspace by hosting the phishing page on Google Forms. The phishing email itself prompted users to verify their LinkedIn accounts with the subject line including the potential victim’s name as well to make it look more authentic. The sender’s email address appears to be from Paul University which is based in Nigeria.

See the full report here: https://www.hackread.com/linkedin-phishing-scam-google-forms/

The ‘Freedom Phone’ that far-right leaders are hawking is a cheap Chinese Android—and a security nightmare - The Daily Dot

Security experts are raising concerns over the “Freedom Phone,” a new device promoted by prominent conservatives as both secure and censorship-resistant. Researchers state that the Freedom Phone runs on a custom Android operating system known as “FreedomOS” and provides access to apps that had previously been banned from app stores in the wake of the Capitol riot. The website for the Freedom Phone does not provide any pertinent information regarding its specifications or source code and without access to the operating system’s source code, users won’t know what exactly their phone is doing in the background.

See the full report here: https://www.dailydot.com/debug/freedom-phone-security-issues/

Hackers sending fake copyright complaint notice with malware to Facebook users: Expert - ETCIO.com

Security researcher warned that cybercriminals are sending out fake copyright complaint notifications to Facebook users with malicious links that can harm their computers. The criminals are tagging politicians including Members of Parliament, MLAs, government officials, and celebrities. The attackers are sending out notifications in the name of Facebook Security team. It is recommended that anyone who has received this kind of notification should never click on the link in the notification which prima facie looks malicious.

See the full report here: https://cio.economictimes.indiatimes.com/news/digital-security/hackers-sending-fake-copyright-complaint-notice-with-malware-to-facebook-users-expert/84464542

Google begins supporting email authentication protocol to guard against phishing | #phishing | #scams

Google started its planned implementation of Brand Indicators for Message Identification (BIMI) into Gmail inboxes, per a press release. BIMI is an email authentication protocol that allows brands to verify their identity to email recipients through logos that appear alongside their emails. Brands must first pass through verification steps, such as implementing Domain-based Message Authentication, Reporting and Conformance (DMARC), and obtaining a BIMI certificate.

See the full report here: https://nationalcybersecuritynews.today/google-begins-supporting-email-authentication-protocol-to-guard-against-phishing-phishing-scams/

China's New Law Requires Researchers to Report All Zero-Day Bugs to Government #Privacy #Phishing #Ransomware #Cloud #Cybersecurity #Infosec #Cyberattacks #Hacking #IoT #Security

The Cyberspace Administration of China (CAC) has issued new stricter vulnerability disclosures regulations that mandate security researchers uncovering critical flaws in computer systems to mandatorily disclose them first-hand to the government authorities within two days of filing a report. The "Regulations on the Management of Network Product Security Vulnerability" are expected to go into effect starting September 1, 2021.

See the full report here: https://thehackernews.com/2021/07/chinas-new-law-requires-researchers-to.html

US govt offers $10 million reward for info on nation-state cyber operations

The US government is offering a $10 million reward for information on campaigns conducted by state-sponsored hackers and for details that can help authorities in identifying and locating people involved in cyber operations conducted by foreign governments against US infrastructure. The Rewards for Justice program has set up a Tor-based website to allow individuals to report information about cyber operations. They have also set up a tips-reporting service on the dark web to protect the safety of potential sources.

See the full report here: https://securityaffairs.co/wordpress/120238/cyber-warfare-2/us-govt-10-million-reward.html?utm_source=rss&utm_medium=rss&utm_campaign=us-govt-10-million-reward

Microsoft Defender for Identity now detects PrintNightmare attacks - BleepingComputer

Microsoft has added support for PrintNightmare exploitation detection to Microsoft Defender for Identity to help Security Operations teams detect attackers' attempts to abuse this critical vulnerability. As revealed by Microsoft program manager Daniel Naim, Defender for Identity now identifies Windows Print Spooler service exploitation (including the actively exploited CVE-2021-34527 PrintNightmare bug) and helps block lateral movement attempts within an org's network.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-for-identity-now-detects-printnightmare-attacks/

D-Link issues hotfix for hard-coded password router vulnerabilities - BleepingComputer

D-Link has issued a firmware hotfix to address multiple vulnerabilities in the DIR-3040 AC3000-based wireless internet router. Following successful exploitation, they can let attackers execute arbitrary code on unpatched routers, gain access to sensitive information or crash the routers after triggering a denial of service state.

See the full report here: https://www.bleepingcomputer.com/news/security/d-link-issues-hotfix-for-hard-coded-password-router-vulnerabilities/

HelloKitty ransomware is targeting vulnerable SonicWall devices - BleepingComputer

CISA warns of threat actors targeting "a known, previously patched, vulnerability" found in SonicWall Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) products with end-of-life firmware. While CISA and SonicWall did not reveal the identity of the threat attackers behind these attacks, according to the reports, HelloKitty has been exploiting the vulnerability for the past few weeks. Cybersecurity firm CrowdStrike also confirmed that the ongoing attacks are attributed to multiple threat actors, including HelloKitty.

See the full report here: https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-is-targeting-vulnerable-sonicwall-devices/

NSO spyware was allegedly used to target activists and journalists

As per the new findings researchers claimed that NSO Group spyware was misused to target the media and other people. In the Washington Post, a multi-partner investigation claiming that NSO's Pegasus software was used to successfully hack 37 phones, including journalists, activists and the two women closest to murdered Saudi journalist Jamal Khashoggi. The list included 1,000 people who didn't obviously fit the software's intended criminal targets, including over 600 politicians, 189 journalists, 85 humans rights activists and 65 business executives.

See the full report here: https://www.engadget.com/nso-spyware-targeted-journalists-politicians-190234376.html

Ransomware hits law firm counseling Fortune 500, Global 500 companies

Campbell issued a press release providing notice after the investigation confirmed that sensitive information of the individuals was accessed by the threat actors behind the ransomware attack. Now, the company is offering 24 months of free access to credit monitoring, fraud consultation, and identity theft restoration services to all individuals whose Social Security numbers or equivalent information was exposed during the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-hits-law-firm-counseling-fortune-500-global-500-companies/

Comparis customers targeted by scammers after ransomware attack - BleepingComputer

Swiss price comparison platform Comparis has notified customers of a data breach following a ransomware attack that hit and took down its entire network. During the investigation, the online platform discovered that the ransomware operators behind the attack could gain access to and likely steal customer data stored on Comparis Group's systems. Now, the company is encouraging its customer to be extremely vigilant in general and to immediately report any suspicious event.

See the full report here: https://www.bleepingcomputer.com/news/security/comparis-customers-targeted-by-scammers-after-ransomware-attack/

Google patches Chrome zero‑day vulnerability exploited in the wild - We Live Security

Google has rolled out an update for its Chrome web browser that fixes a range of vulnerabilities, including a zero-day flaw that has been known to be actively exploited in the wild. The company is aware of reports that an exploit for CVE-2021-30563 exists in the wild as per Google’s security update describing the newly disclosed zero-day vulnerability. It is recommended that both admins and users should update their browsers to the latest version (91.0.4472.164) as soon as practicable.

See the full report here: https://www.welivesecurity.com/2021/07/16/google-patches-chrome-zero-day-vulnerability-exploited-in-the-wild/

Saudi Aramco data breach sees 1 TB stolen data for sale

The Saudi Arabian Oil Company, Saudi Aramco fell victim to a cyber-attack where attackers have stolen 1 TB of proprietary data belonging to the company. The threat actor, aka ZeroX, is offering it for sale on the darknet, starting at a negotiable price of $5 million. However, the company has pinned this data incident on third-party contractors and stated that the incident had no impact on Aramco's operations. It is to note that it is neither a ransomware attack nor an extortion incident.

See the full report here: https://www.bleepingcomputer.com/news/security/saudi-aramco-data-breach-sees-1-tb-stolen-data-for-sale/

Microsoft takes down domains used to scam Office 365 users

Microsoft's Digital Crimes Unit (DCU) has seized 17 malicious domains used by scammers in a business email compromise (BEC) campaign targeting the company's customers. The domains taken down by Microsoft were so-called "homoglyph" domains registered to resemble those of legitimate business. According to the complaint filed by Microsoft, scammers used the domains registered via NameSilo LLC and KS Domains Ltd./Key-Systems GmbH as malicious infrastructure in BEC attacks against Office 365 customers and services.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-takes-down-domains-used-to-scam-office-365-users/

US and allies officially accuse China of Microsoft Exchange attacks

The U.S. government and its key allies, including the European Union, the United Kingdom, and NATO, are officially blaming China for 2021 year's widespread Microsoft Exchange hacking campaign. The attack on Microsoft Exchange software was highly likely to enable large-scale espionage, including acquiring personally identifiable information and intellectual property. The NSA, CISA, and FBI also issued a joint advisory containing more than 50 tactics, techniques, and procedures (TTPs) that Chinese state-sponsored cyber actors have used in attacks targeting the US and allied networks.

See the full report here: https://www.bleepingcomputer.com/news/security/us-and-allies-officially-accuse-china-of-microsoft-exchange-attacks/

Unpatched iPhone Bug Allows Remote Device Takeover

A vulnerability in Apple iOS opens the door to remote code execution (RCE), researchers found. The assessment is a revision from a previous understanding of the flaw that viewed it as a low-risk denial-of-service (DoS) problem affecting the iPhone’s Wi-Fi feature. Security researchers found that the flaw could be used for RCE without little interaction with the victim and that the attack worked on fully patched iPhones.

See the full report here: https://threatpost.com/unpatched-iphone-bug-remote-takeover/167922/

Braham attacked by foreign ransomware | - ECM Publishers

Foreign cyberattackers invaded and held the city of Braham’s domain administrator account for ransom. The invasion occurred on June 8 at approximately 3:42 a.m. and compromised full access to eight city computers. Braham City Administrator Angie Grafstrom said the attackers were from Russia, according to intelligence.

See the full report here: https://www.hometownsource.com/braham-attacked-by-foreign-ransomware/article_0341a610-e681-11eb-84cc-e71fe355fb88.html

Northern's self-service ticket machines hit by ransomware cyber attack - BBC News

Northern rail's new self-service ticket machines have been targeted by a suspected ransomware cyber-attack. The system has been offline since last week and an investigation is underway. The government-run operator said it had taken swift action along with its supplier, Flowbird, and customer and payment data had not been compromised.

See the full report here: https://www.bbc.com/news/uk-england-57892711

Chinese Hackers Hid Hacked Data In A Donald Trump Picture

The US government accused four Chinese hackers working for a cybersecurity company of actually being spies tasked with stealing secrets all over the world. As part of their hacking activities, the four allegedly used popular internet services such as LinkedIn and GitHub. the DOJ lists 21 victims without naming them, which include research facilities in the US, universities, defense contractors, and foreign government agencies in Cambodia, Saudi Arabia, and Malaysia. Hackers were stolen trade secrets and proprietary hydroacoustic data" inside pictures of Donald Trump and a Koala using a technique called steganography.

See the full report here: https://www.vice.com/en/article/n7bqaw/chinese-hackers-hid-hacked-data-inside-a-pidonald-trump-picture

U.S. Government Attributes ICS Attacks to Russia, China, Iran

The United States government on July 20, 2021, released an Alert, (AA21-201A), attributing the several past attacks involving industrial control systems (ICS) to Russian, Chinese, and Iranian state-sponsored threat actors. The alert contains indicators of compromise (IoCs), as well as recommendations for the energy sector and other critical infrastructure owners on how to secure their systems against such attacks.

See the full report here: https://www.securityweek.com/us-government-attributes-ics-attacks-russia-china-iran

This New Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

Cybersecurity researchers disclosed an undocumented malware strain dubbed "MosaicLoader" that singles out individuals searching for cracked software as part of a global campaign. The malware arrives on target systems by posing as cracked installers. According to the researcher, the best way to defend against MosaicLoader is to avoid downloading cracked software from any source.

See the full report here: https://thehackernews.com/2021/07/this-new-malware-hides-itself-among.html

China Says Washington Hack Claims 'Fabricated', Condemns US Allies

Recently, the United States accused China, for the March 2021-Cyber attack on Microsoft Exchange where threat actors have exploited flaws in the Microsoft Exchange service where at least 30,000 US organizations including local governments as well as organizations worldwide got affected. In response to the accusation, China hit back stating that the US had "fabricated" allegations it carried out a massive Microsoft hack.

See the full report here: https://www.securityweek.com/china-says-washington-hack-claims-fabricated-condemns-us-allies

FBI: Threat actors may be targeting the 2020 Tokyo Summer Olympics

FBI warns of threat actors potentially targeting the upcoming Olympic Games Tokyo 2020 and encourages to remain vigilant and maintain best practices in the network and digital environments. Attacks coordinated by criminal or nation-state threat actors could involve DDoS attacks, ransomware, social engineering, phishing campaigns, or insider threats. Such attacks could disrupt or even block live broadcasts of the event, exfiltrate sensitive data before encrypting or after hacking into IT systems, or impact digital infrastructure supporting the Olympics.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-threat-actors-may-be-targeting-the-2020-tokyo-summer-olympics/

Joker billing fraud malware found in Google Play Store

11 Android Malicious apps harboring the Joker malware have been discovered in the Google Play Store covers utilities, health, and device personalization among the main app categories targeted. The Joker malware focuses on compromising Android devices and it is designed to spy on its victims, steal information, harvest contact lists, and monitor SMS messaging. Joker operators are constantly switching up their methods to bypass security mechanisms. However, Google takes malicious app reports seriously and, such as in this case, rapidly removed the offending Joker apps from Google Play.

See the full report here: https://www.zdnet.com/article/joker-billing-fraud-malware-found-in-google-play-store/

New Windows 10 vulnerability allows anyone to get admin privileges - BleepingComputer

Windows 10 and Windows 11 are vulnerable to a local elevation of privilege vulnerability after discovering that users with low privileges can access sensitive Registry database files. As these files contain sensitive information about all user accounts on a device and security tokens used by Windows features, they should be restricted from being viewed by regular users with no elevated privileges. Microsoft is investigating this issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-10-vulnerability-allows-anyone-to-get-admin-privileges/

New Linux kernel bug lets you get root on most modern distros - BleepingComputer

Unprivileged attackers can gain root privileges by exploiting a local privilege escalation (LPE) vulnerability in default configurations of the Linux Kernel's filesystem layer on vulnerable devices. As discovered by Qualys researchers, the LPE security flaw tracked as CVE-2021-33909 (dubbed Sequoia) is present in the filesystem layer used to manage user data, a feature universally used by all major (Linux) operating systems.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-kernel-bug-lets-you-get-root-on-most-modern-distros/

Fortinet fixes bug letting unauthenticated hackers run code as root - BleepingComputer

Fortinet has released updates for its FortiManager and FortiAnalyzer network management solutions to fix a serious vulnerability that could be exploited to execute arbitrary code with the highest privileges. Both FortiManager and FortiAnalyzer are enterprise-grade network management solutions for environments with up to 100,000 devices. They are available as a physical appliance, as a virtual machine, in the cloud, or hosted by Fortinet.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-fixes-bug-letting-unauthenticated-hackers-run-code-as-root/

16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines

Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products, install programs, view, change, encrypt or delete data or create new accounts with more extensive user rights. The bug (CVE-2021-3438) has lurked in systems for 16 years but was only uncovered this year, SentinelOne said.

See the full report here: https://threatpost.com/hp-printer-driver-bug-windows/167944/

Kubernetes Cloud Clusters Face Cyberattacks via Argo Workflows

Misconfigured permissions for Argo’s web-facing dashboard allow unauthenticated attackers to run code on Kubernetes targets, including cryptomining containers. Argo Workflows is an open-source, container-native workflow engine for orchestrating parallel jobs on Kubernetes to speed up processing time for compute-intensive jobs like machine learning and big-data processing. The misconfigurations can also expose sensitive information such as code, credentials and private container-image names.

See the full report here: https://threatpost.com/kubernetes-cyberattacks-argo-workflows/167997/

‘Substantial’ rise in fraud and hacking during coronavirus pandemic - Yahoo Eurosport UK

Fraud and hacking soared during the pandemic as criminals “took advantage of behavioural changes” while reports of domestic abuse-related offences also rose, official figures show. Lockdowns and restrictions brings a surge in online shopping which led to “substantial increases” in percentages of fraud and computer misuse offences in recent pandemic times. There were large decreases in theft offences, such as domestic burglary and theft from the person, as more people stayed at home and limited their social contact.

See the full report here: https://uk.news.yahoo.com/substantial-rise-fraud-hacking-during-093844130.html

France warns of APT31 cyberspies targeting French organizations

The French national cyber-security agency warned of an ongoing series of attacks through the compromised home routers network as operational relay boxes in order to perform stealth reconnaissance as well as attacks against a large number of French organizations coordinated by the Chinese-backed APT31 hacking group. APT31 is responsible for several attacks from April 2017 till March 2021. APT31 is a hacking group working at the behest of the Chinese Government known for its numerous espionage and information theft operations.

See the full report here: https://www.bleepingcomputer.com/news/security/france-warns-of-apt31-cyberspies-targeting-french-organizations/

TikTok, Snapchat account hijacker arrested for role in Twitter hack - BleepingComputer

The United States Department of Justice has announced a 22-year old UK public guilty, for his role in the Twitter hack last year that gave attackers access to the company's internal network exposing high-profile accounts to hijacking. The criminal complaint was filed in the U.S. District Court for the Northern District of California, alleges that the suspect was also involved in takeovers of TikTok and Snapchat accounts. The group of hackers also used high-profile accounts to promote a cryptocurrency scam, managing to collect more than $100,000 in a single Bitcoin wallet.

See the full report here: https://www.bleepingcomputer.com/news/security/tiktok-snapchat-account-hijacker-arrested-for-role-in-twitter-hack/

XLoader malware steals logins from macOS and Windows systems - BleepingComputer

A highly popular malware for stealing information from Windows systems has been modified into a new strain called XLoader, which can also target macOS systems. It is derived from the Formbook info-stealer for Windows and has been active since last February. XLoader is currently being offered on an underground forum as a botnet loader service that can “recover” passwords from web browsers and some email clients.

See the full report here: https://www.bleepingcomputer.com/news/security/xloader-malware-steals-logins-from-macos-and-windows-systems/

New malware uses search engine ads to target pirate gamers

A new strain of malware is using paid commercials in indexed lists to target clients looking for pirated software. Security researchers at Bitdefender have found the initial malware dropper stored in archives that pretend to offer cracked software installers. Cyber criminals were observed to be purchasing pay-per-click (PPC) advertisements related to pirated software then inserting these links to the malware droppers into their ads. The malware the program installs includes simple cookie stealers that can be used to hijack victims' online sessions. They can exfiltrate Facebook login data, enabling cyber criminals to take over a victim's account, making posts that damage a victim's reputation or spread malware further.

See the full report here: https://www.itpro.co.uk/security/malware/360313/new-malware-uses-search-engine-ads-to-target-pirate-gamers

Malicious NPM Package Caught Stealing Users' Saved Passwords From Browsers

A software package, named "nodejs_net_server", available from the official NPM repository has been revealed to be actually a front for a tool that's designed to steal saved passwords from the Chrome web browser. The package was downloaded over 1,283 times since February 2019, was last updated seven months ago, with its corresponding repository leading to non-existent locations hosted on GitHub. It isnt malicious in itself, but it can be when put into the malicious use context.

See the full report here: https://thehackernews.com/2021/07/malicious-npm-package-caught-stealing.html

New Windows and Linux Flaws Give Attackers Highest System Privileges

Researchers have discovered a new local privilege escalation vulnerability in Microsoft's Windows 10 and the forthcoming Windows 11 forms "SeriousSAM" that grants clients with low-level consents access to Windows framework documents, thus, empowering them to expose the working framework establishment secret key and even unscramble private keys. The most recent revelation additionally denotes the third openly uncovered unpatched bug in Windows since the arrival of Patch Tuesday reports on July 13.

See the full report here: https://thehackernews.com/2021/07/new-windows-and-linux-flaws-give.html