Threat Intelligence Bulletin: 7/23/2021 - 7/29/2021
|by Alpha Team
ZeroFOX Threat Research: Quarter 2 2021 Threat Report
The ZeroFOX Threat Research team is excited to announce the release of our Quarterly Threat Report for Q2 of 2021.
Link to Download
Report Summary
In this Quarterly Threat Landscape Review, ZeroFox Threat Research provides an overview of the threats that impacted the global threat landscape in Q2 2021.
In the second quarter of 2021 (Q2), threat actor tactics, techniques, and procedures (TTPs) reflected that of the evolving threat landscape which included increased activity from ransomware attacks, severe security vulnerabilities, and legislation addressing cyber attacks. Increasing levels of ransomware attacks took place this quarter, demonstrating the evolving and critical threat such attacks pose to organizations and individuals. As a result of these ransomware attacks, as well as other high-impact cyber attacks on United States (US)-based organizations, President Joe Biden issued a presidential executive order creating a plan to address cyber attacks in order to strengthen national security.
In terms of cyber criminal underground networks, ransomware played a significant role in marketplace networks, as threat actors launched new data leak websites and advertised compromised data to profit from ransomware attacks. As phishing attacks remain a consistent threat, phishing ecosystems provide context on successful operations and how threat actors leverage stolen data from attacks. The new vulnerabilities and exploits that emerged this quarter have the potential to critically impact enterprise organizations, such as the PrintNightmare vulnerability that can allow attackers to run arbitrary code with SYSTEM privileges.
Breaking News: 2021-07-23 - 2021-07-29
India and Vietnam most hit by Android malware - Tech Wire Asia
Android malware continues to target mobile devices around the world especially India and Vietnam are ranked among the top five countries globally to be hit by Android/FakeAdBlocker malware. Android/FakeAdBlocker are masquerading as an ad blocker for Android mobile devices hiding malware and malicious links inside, it installs adware and possibly other malware when users looking for a legitimate adblocker install them from third-party sites or app stores. To avoid this, the Common security practices should be enforced including downloading software from reliable sources only and not simply clicking on links.
See the full report here: https://techwireasia.com/2021/07/india-and-vietnam-most-hit-by-android-malware/
Ransomware gang breached CNA’s network via fake browser update - BleepingComputer
CNA Financial has provided a glimpse into how Phoenix CryptoLocker operators breached its network, stole data, and deployed ransomware payloads in a ransomware attack that hit its network in March 2021. The attackers first breached an employee's workstation using a fake and malicious browser update delivered via a legitimate website and then moved laterally through CNA's network. As CNA further discovered the Stolen data was not sold or traded with others. According to breach information filed by CNA with the office of Maine's Attorney General, this data breach affected 75,349 individuals.
See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-breached-cna-s-network-via-fake-browser-update/
Thales launches payment card with onboard fingerprint scanner
Thales has reported the "world's first" payment card to include an onboard fingerprint sensor which promises to improve security and usability. It replaces the traditional PIN with an on-card fingerprint sensor and requires no modifications to existing point-of-sale (POS) payment terminals. It claims that in terms of security, the biometric card ultimately means that a lost or stolen card is useless without the owner's fingerprint to authenticate a contactless transaction. In such trustworthy payment environments, there is no need to set any payment limit.
See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/07/22/thales_fingerprint_payment/
Kaseya Gets Universal Decryptor to Help REvil Ransomware Victims
Kaseya, a Florida-based software vendor encountered a widespread supply-chain ransomware attack namely REvil about three weeks ago. On July 21, the company confirmed that it obtained a decryptor for victims of the attack from a third party and has teams actively helping customers affected by the ransomware to restore their environments. The company also added that there were no reports of any problems or issues associated with the decryptor.
See the full report here: https://thehackernews.com/2021/07/kaseya-gets-universal-decryptor-to-help.html
Microsoft has a workaround for 'HiveNightmare' flaw: Nuke your shadow copies from orbit
Microsoft has distributed an authority workaround for its Access Control Lists (ACLs) vulnerability. The vulnerability has been named "HiveNightmare" and tracked as CVE-2021-36934. Successful exploitation of this vulnerability would allow an attacker to change data, install programs, and create new users. However, an attacker must have the ability to execute code on a victim system to exploit this vulnerability. Microsoft additionally affirmed that all versions of Windows from 1809, including Windows Server 2019, and above are potentially vulnerable.
See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/07/22/microsoft_hivenightmare/
Apple security updates: iOS 14.7 fixes WiFiDemon flaw
Apple has released security updates for macOS Big Sur, Catalina and Mojave as well as iOS and iPadOS. macOS Big Sur accompanies fixes for a huge number of safety issues like permitting a sandboxed interaction to bypass sandbox limitations. The macOS Catalina and Mojave security updates deliver many of the same fixes yet, in addition, extra ones like a vulnerability that might be abused by an unprivileged application to catch USB gadgets are also fixed. Many of the vulnerabilities fixed in iOS and iPadOS are the same ones fixed in macOS however, others are specific to these mobile operating systems.
See the full report here: https://www.helpnetsecurity.com/2021/07/22/security-ios-14-7/
Hackers Access Personal and Call Information and Port Numbers in Mint Mobile Data Breach - CPO Magazine
Mint, a California-based mobile virtual network operator on T-Mobile’s network, suffered a data breach where hackers were able to access Mint subscribers’ account information including call history, names, addresses, emails, and Mint mobile password, and ported mobile numbers to another carrier. The company has confirmed that only a small number of Mint mobile subscribers were affected.
See the full report here: https://www.cpomagazine.com/cyber-security/hackers-access-personal-and-call-information-and-port-numbers-in-mint-mobile-data-breach/
Fake Windows 11 installers now used to infect you with malware - BleepingComputer
Scammers are taking advantage of the hype around Microsoft's next Windows release to push fake Windows 11 installers riddled with malware, adware, and other malicious tools. While Windows 11 will start rolling out worldwide during early 2022, Microsoft has already made it available for install to all customers enrolled in the Insider program. However, hundreds of users have already downloaded installers from unofficial sources are getting infected with malware.
See the full report here: https://www.bleepingcomputer.com/news/security/fake-windows-11-installers-now-used-to-infect-you-with-malware/
MacOS malware steals Telegram accounts, Google Chrome data - BleepingComputer
Security researchers have published details about the method used by a strain of macOS malware to steal login information from multiple apps, enabling its operators to steal accounts. Dubbed XCSSET, the malware keeps evolving and has been targeting macOS developers for more than a year by infecting local Xcode projects. The taregted apps include Telegram instant messaging software and Google Chrome.
See the full report here: https://www.bleepingcomputer.com/news/security/macos-malware-steals-telegram-accounts-google-chrome-data/
Attackers deploy cryptominers on Kubernetes clusters via Argo Workflows - BleepingComputer
Threat actors are abusing misconfigured Argo Workflows instances to deploy cryptocurrency miners on Kubernetes (K8s) clusters. Argo Workflows is the most popular workflow execution engine for Kubernetes, designed to orchestrate parallel jobs for speeding up machine learning or data processing computing-intensive jobs on Kubernetes clusters. Threat actors gain access to such clusters via Internet-exposed Argo dashboards and deploy their own malicious workflows using various Monero miner containers, including kannix/monero-miner, a defunct container that mines for Monero using the XMRig CPU/GPU miner. Admins are advised to always enable authentication on Argo Workflows dashboards and monitor their environments for malicious activity.
See the full report here: https://www.bleepingcomputer.com/news/security/attackers-deploy-cryptominers-on-kubernetes-clusters-via-argo-workflows/
Child tax credit scams: IRS warns of scammers impersonating agency to help sign up, speed up payments | #phishing | #scams
The IRS warns that scammers, impersonating the agency, are offering alleged “help” sign up for the Child Tax Credit program. There are also fake stories of “speeding up” monthly payments. The agency said it’s all a trick to steal personal information, money, and identities. The victim can report suspicious IRS-related phishing and online scams at IRS.gov.
See the full report here: https://nationalcybersecuritynews.today/child-tax-credit-scams-irs-warns-of-scammers-impersonating-agency-to-help-sign-up-speed-up-payments-phishing-scams/
This Malware Worth Rs 3600 Is Stealing Personal Information Of Mac, Windows Users - http://www.newsgram.com/
Security Researchers warned of a malware strain "Xloader" available for just Rs 3,600 ($49) on the Dark Web, which is helping hackers steal the information of Mac and Windows users. The attackers trick users into downloading the malware strain via spoofed emails containing malicious Microsoft Office documents. This strain now has capabilities to harvest log-in credentials, collect screenshots, log keystrokes, and execute malicious files.
See the full report here: https://www.newsgram.com/this-malware-worth-rs-3600-is-stealing-personal-information-of-mac-windows-users
Microsoft shares mitigations for new PetitPotam NTML relay attack - BleepingComputer
Microsoft has released mitigations for the new PetitPotam NTLM relay attack that allows taking over a domain controller or other Windows servers. PetitPotam is a new method that can be used to conduct an NTLM relay attack discovered by a French security researcher. This method was disclosed this week along with a proof-of-concept (PoC) script.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shares-mitigations-for-new-petitpotam-ntml-relay-attack/
GitHub boosts supply chain security for Go modules
GitHub has announced a slew of supply chain security upgrades for modules based on the Go programming language. According to GitHub, there are four main areas of improvement for supply chain security now available for Go modules. The first is GitHub's Advisory Database, an open-source repository of vulnerability information which, at the time of writing, now contains over 150 Go advisories.
See the full report here: https://www.zdnet.com/article/github-boosts-supply-chain-security-for-go-modules/
Windows 10 July security updates break printing on some systems - BleepingComputer
Microsoft says customers may experience printing and scanning issues on devices using smart card (PIV) authentication after installing July 2021 Windows 10 security updates. After installing updates on domain controllers (DCs) in the system environment, printers, scanners, and multifunction devices that are not compliant with section 3.2.1 of RFC 4556 spec might fail to print when using smart card (PIV) authentication.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-july-security-updates-break-printing-on-some-systems/
Microsoft’s fix for Windows 10 gaming issues is coming soon - BleepingComputer
Some users have been experiencing performance issues while playing games after the release of Windows 10's March 2021 updates and its subsequent updates. Microsoft made sure to issue the patch files in April and then in July to resolve these gaming issues.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-s-fix-for-windows-10-gaming-issues-is-coming-soon/
A closer look at Windows 11’s recent changes - BleepingComputer
Windows 11 has formally reported in the last month with an updated Start, taskbar, and Action Center experience. Microsoft is still on Windows 11 and the organization has introduced new modifications with the latest updates. Some of the major updates include enabling the Microsoft Teams chatting feature in the Windows Taskbar, to calculate and display the estimated installation time of an update.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/a-closer-look-at-windows-11-s-recent-changes/
Anexinet partners with Ping Identity to improve cybersecurity offerings for customers
Anexinet announced the association has teamed up with Ping Identity to utilize concentrated Identity Access Management (IAM) of Ping Identity with Anexinet’s cybersecurity assessments to help customers secure their data through multi-factor authentication, single sign-on, access management, intelligent API security, directory, and data governance capabilities.
See the full report here: https://www.helpnetsecurity.com/2021/07/26/anexinet-ping-identity/
Norton Security UWP app helps protect Lenovo laptop PCs from hackers and online scams
NortonLifeLock declared that the Norton Security Universal Windows Platform (UWP) application will be pre-installed on select new Lenovo laptop PCs.The important highlights of the Norton Security UWP application incorporate program assurance that shields individual data from programmers and online tricks, a safe VPN to help block malicious network threats and unwanted ad tracking, and Dark Web Monitoring, which notifies users when their personal information is found on dark web marketplaces, where cybercriminals buy and sell stolen information.
See the full report here: https://www.helpnetsecurity.com/2021/07/26/nortonlifelock-lenovo/
Microsoft 365 drops support for Internet Explorer 11 in August - BleepingComputer
Microsoft has reminded customers that Microsoft 365 apps and services will drop support for the legacy Internet Explorer 11 (IE11) web browser next month, on August 17, 2021. After the end of support is reached, those still trying to connect to Microsoft 365 may face degraded user experience or connection failures. Enterprise organizations depending on legacy Internet Explorer-based websites and apps for critical processes can still use them with Microsoft Edge's IE mode.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-365-drops-support-for-internet-explorer-11-in-august/
CISA warns of disguised malware on hacked Pulse Secure devices
CISA has published a new alert warning of 13 malware samples related to exploited Pulse Secure devices. The samples were detected under the radar of antivirus detection products. Hackers have used several flaws (CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-2289) to access devices and create webshells to expand backdoor access. CISA encouraged users and administrators to review the 13 malware analysis reports (MARs) for threat actor techniques, tactics, and procedures (TTPs) and indicators of compromise (IOCs).
See the full report here: https://www.itpro.co.uk/security/malware/360327/cisa-warns-of-disguised-malware-on-hacked-pulse-secure-devices
Microsoft Warns of LemonDuck Malware Targeting Windows and Linux Systems - The Hacker News
LemonDuck malware is the latest cybersecurity threat, which has evolved from a cryptocurrency botnet to a dangerous malware capable of stealing credentials, removing security controls, and spreading itself via emails, among other things. Microsoft recently highlighted the dangers of LemonDuck and how it has evolved in a technical write-up.
See the full report here: https://thehackernews.com/2021/07/microsoft-warns-of-lemonduck-malware.html
Discord is now an essential tool for hackers - TechRadar
Gaming-centric messaging platform Discord has become a favorite tool among cybercriminals, research suggests. A new report from security company Sophos shows that Discord, which has grown rapidly in popularity in recent years, is now regularly used to host, distribute and control different kinds of malware. Over the past two months, Sophos has detected almost 140 times the number of Discord malware threats than in the same period last year.
See the full report here: https://www.techradar.com/news/discord-is-now-an-essential-tool-for-hackers
Researchers warn of unpatched Kaseya Unitrends backup vulnerabilities - BleepingComputer
Security researchers warn of three new zero-day vulnerabilities in the Kaseya Unitrends service and advise users not to expose the service to the Internet. Kaseya Unitrends is a cloud-based enterprise backup and disaster recovery solution that is offered as a stand-alone solution or as an add-on for the Kaseya VSA remote management platform.
See the full report here: https://www.bleepingcomputer.com/news/security/researchers-warn-of-unpatched-kaseya-unitrends-backup-vulnerabilities/
Microsoft Defender ATP now secures removable storage, printers - BleepingComputer
Microsoft has added new removable storage devices and printer controls to Microsoft Defender for Endpoint which is the enterprise version of its Windows 10 Defender antivirus. These new abilities available will allow access restrictions to removable devices and blocking printing tasks via non-corporate or non-approved printers.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-atp-now-secures-removable-storage-printers/
SSD belonging to Euro-cloud Scaleway was stolen from back of a truck, then turned up on YouTube
Yann Lechelle, CEO of Scaleway revealed that a disk was stolen during the transit between two Scaleway data centres over a year ago. A YouTuber who creates content about the persistence of data even after disks are formatted had bought the disk on a classifieds site. Lechelle says Scaleway worked with the YouTuber to recover the disk.
See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/07/27/stolen_scaleway_ssd_recovered/
Signal fixes bug that sent random images to wrong contacts - BleepingComputer
Signal has fixed a genuine bug in its Android application that, sometimes, sent irregular accidental pictures to contacts without an obvious explanation. This was first reported in December 2020. Further, the researchers found that the bug was caused by the "rare intersection" of database properties. To prevent this issue, Signal Android app users should update to the latest version of the app, available on the Google Play store.
See the full report here: https://www.bleepingcomputer.com/news/security/signal-fixes-bug-that-sent-random-images-to-wrong-contacts/
Amazon might accept Bitcoin payments by the end of the year
According to the reports, Amazon has plans to accept Bitcoin payments by the end of the year. A job advert spotted by City AM over the weekend suggested the e-commerce giant is looking for a "cryptocurrency and blockchain lead".
See the full report here: https://www.itpro.co.uk/business/business-operations/360356/amazon-set-to-accept-cryptocurrencies-payments
Google revamps bug bounty program
Google has disclosed through a that the company has paid out over $29 million for 11,055 bugs found in its services since 2010 in a Vulnerability Reward Program which is now renamed as "Bug Hunters".The post also served as a reminder that Google pays out for patches to open-source software as well as research papers on FOSS security.
See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/07/28/google_revamps_vulnerability_reward_program/
Microsoft Teams now automatically blocks phishing attempts - BleepingComputer
Microsoft has broadened Defender for Office 365 Safe Links security to Microsoft Teams to shield clients from malicious URL-based phishing assaults. Utilizing Safe Links can assist with shielding enterprise organizations from malicious links sent by threat actors behind phishing attempts and other attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-teams-now-automatically-blocks-phishing-attempts/
LockBit ransomware now encrypts Windows domains using group policies - BleepingComputer
Researchers at MalwareHunterTeam have discovered a new version of the LockBit 2.0 ransomware that automates the encryption of a Windows domain using Active Directory group policies. The new version include numerous advanced features with many used by other ransomware operations in the past. The new approach of interacting with active directory propagating ransomware to local domains as well as built-in updating global policy with anti-virus disable makes "pentester" operations easier for new malware operators.
See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/
UC San Diego Health discloses data breach after phishing attack - BleepingComputer
UC San Diego Health, the academic health system of the University of California, San Diego, has disclosed a data breach after the compromise of some employees' email accounts. UC San Diego Health discovered unauthorized access to some of its employees' email accounts on April 8, after being initially alerted to suspicious activity on March 12. The attackers may have accessed or acquired the personal information of patients, employees, and students between December 2, 2020, and April 8, 2021, after breaching the email accounts in a phishing attack. While there is no evidence misuse of information, community members and potentially affected individuals are advised to keep an eye out for identity theft or fraud attempts.
See the full report here: https://www.bleepingcomputer.com/news/security/uc-san-diego-health-discloses-data-breach-after-phishing-attack/
Apple Patches Actively Exploited Zero-Day in iOS, MacOS
Apple on Monday patched a zero-day vulnerability in its iOS, iPadOS, and macOS operating systems, only a week after issuing a set of OS updates addressing about three dozen other flaws. The bug, CVE-2021-30807, was found in the iGiant's IOMobileFrameBuffer code, a kernel extension for managing the screen frame buffer that could be abused to run malicious code on the affected device.
See the full report here: https://threatpost.com/apple-patches-actively-exploited-zero-day-in-ios-macos/168177/
Zimbra Server Bugs Could Lead to Email Plundering
Zimbra webmail server has two flaws that could let an attacker paw through the inbox and outbox of all the employees in all the enterprises that use the collaboration tool, researchers say. According to Zimbra’s site, its email and collaboration tools are used by over 200,000 businesses, over a thousand government and financial institutions, and hundreds of millions of users to exchange emails every day.
See the full report here: https://threatpost.com/zimbra-server-bugs-email-plundering/168188/
Northern Ireland suspends vaccine passport system after data leak - BleepingComputer
Northern Ireland's Department of Health (DoH) has temporarily stopped its COVIDCert online vaccination certification service following a data exposure incident.COVIDCert enables fully vaccinated individuals based in Northern Ireland to obtain a digital certificate confirming their COVID-19 vaccination status. The government body mentioned that a few users were potentially exposed to the data of other users.
See the full report here: https://www.bleepingcomputer.com/news/security/northern-ireland-suspends-vaccine-passport-system-after-data-leak/
Google Cloud to open new region in Melbourne
The tech giant, Google has revealed that it is set to open a new cloud region in Melbourne which would be the firm's second region in Australia. This would benefit its cloud customers from the low latency and high performance of their cloud-based workloads and data.
See the full report here: https://www.itpro.co.uk/cloud/cloud-computing/360396/google-cloud-to-open-new-region-in-melbourne
New Android Malware Uses VNC to Spy and Steal Passwords from Victims
Researchers from ThreatFabric said in a write-up shared with The Hacker News that Android-based remote access trojan (RAT) has been found to use screen recording features to steal sensitive information on the device.
See the full report here: https://thehackernews.com/2021/07/new-android-malware-uses-vnc-to-spy-and.html
Devtron - Opensource Kubernetes delivery Workflow for CI/CD with security features like Granular Hierarchical Security policy Management, Automatic Vulnerability management during CI as well as within cluster.
Devtron is an Opensource platform for an End-to-End Kubernetes software delivery workflow.It gives SaaS like experience without Lock-in or Premium of the SaaS product. There are a lot of features under Security, Cost Optimization and Stability. Security Features like Access Management, Granular Hierarchical Security policy Management and particularly for automatic vulnerability Management during CI, also within the cluster.
See the full report here: https://www.reddit.com/r/netsec/comments/otcb8x/devtron_opensource_kubernetes_delivery_workflow/
Critical Microsoft Hyper-V bug could haunt orgs for a long time - BleepingComputer
Technical details are now available for a vulnerability that affects Hyper-V, Microsoft's native hypervisor for creating virtual machines on Windows systems and in the Azure cloud computing environment. The bug is in Hyper-V's network switch driver (vmswitch.sys) and affects Windows 10 and Windows Server 2012 through 2019. It emerged in a build from August 2019 and received a patch earlier this year in May. Currently tracked as CVE-2021-28476, the security issue has a critical severity score of 9.9 out of 10. Exploiting it on unpatched machines can have a devastating impact as it allows crashing the host (denial of service) or execute arbitrary code on it.
See the full report here: https://www.bleepingcomputer.com/news/security/critical-microsoft-hyper-v-bug-could-haunt-orgs-for-a-long-time/
Grief ransomware operation is DoppelPaymer rebranded - BleepingComputer
After a period of little to no activity, the DoppelPaymer ransomware operation has made a rebranding move, now going by the name Grief. It is unclear if any of the original developers is still behind this ransomware-as-a-service (RaaS) but clues uncovered by security researchers point to a continuation of the project. Despite the threat actor’s effort to make Grief look like a separate RaaS, the similarities to DoppelPaymer are so striking that a connection between the two is impossible to dismiss.
See the full report here: https://www.bleepingcomputer.com/news/security/grief-ransomware-operation-is-doppelpaymer-rebranded/
Tags: weekly bulletin, all industries, global