Threat Intelligence Bulletin: 07/30/2021 - 08/05/2021

Breaking News: 2021-07-30 - 2021-08-05

New destructive Meteor wiper malware used in Iranian railway attack - BleepingComputer

A new file wiping malware called Meteor was discovered that was used in the recent attacks against Iran's railway system. Earlier this month, Iran's transport ministry and national train system suffered a cyberattack, causing the agency's websites to shut down and disrupting train service. According to SentinelOne researchers, the attack itself is dubbed 'MeteorExpress,' and utilizes a toolkit of batch files and executables to wipe a system, lock the device's Master Boot Record (MBR), and install a screen locker. Unlike ransomware attacks, destructive wiper attacks are used to cause chaos for an organization or to distract admins while another attack is taking place.

See the full report here: https://www.bleepingcomputer.com/news/security/new-destructive-meteor-wiper-malware-used-in-iranian-railway-attack/

Chipotle’s marketing account hacked to send phishing emails - BleepingComputer

Hackers have compromised an email marketing account belonging to the Chipotle food chain and used it to send out phishing emails, luring recipients to malicious links. The campaign sent out in three days at least 120 malicious emails from a hacked Mailgun account used by Chipotle for email marketing purposes. Most of the messages directed users to credential-harvesting sites impersonating services from a financial business and Microsoft. A very small number had malware attachments.

See the full report here: https://www.bleepingcomputer.com/news/security/chipotle-s-marketing-account-hacked-to-send-phishing-emails/

Phony Call Centers Tricking Users Into Installing Ransomware and Data-Stealers

An ongoing malicious campaign that employs phony call centers has been found to trick victims into downloading malware capable of data exfiltration as well as deploying ransomware on infected systems. The attacks, dubbed "BazaCall", use vishing-like method wherein targeted users are sent email messages informing them of a forthcoming subscription charge unless they call a specific phone number. By tricking the recipients into calling the number, the victims are connected with actual human operators at the fraudulent call centers, who then provide them with instructions to download the BazaLoader malware. Since the malware is not distributed via a link or document within the message body itself, the lures add a level of difficulty that enables attackers to evade phishing and malware detection software.

See the full report here: https://thehackernews.com/2021/07/phony-call-centers-tricking-users-into.html

Ransomware attack hits Coghlin Electrical of Worcester - Worcester Telegram

Coghlin Electrical Corp. was hit with a ransomware attack on Monday night. The company has recovered all the files without paying hackers and is currently working with law enforcement to investigate the incident and are following all legal requirements. There is still no information about the ransomware group behind this attack.

See the full report here: https://www.telegram.com/story/news/2021/07/30/ransomware-attack-hits-coghlin-electrical-worcester/5403019001/

New Android Malware 'Vultur' Can Record Your Screen, Steal Bank Details: 1 Major Warning Sign and How to Stop It - iTech Post

Vultur a new Android RAT malware has been reported stealing banking, social media, and cryptocurrency data from Android devices using screen-recording methods to capture activities on a mobile device and send it back to the attackers' severs. After hackers have stolen keylogging data or login credentials, they can use this information to access your account or withdraw your money from a separate device. To stop the Vultur malware in our Android device, we should immediately disable its App Permissions.

See the full report here: https://www.itechpost.com/articles/106544/20210731/new-android-malware-vultur-record-screen-steal-bank-details-1.htm

NSA Warns Public Networks are Hacker Hotbeds

NSA advices the security teams to be mindful of the recently booming wireless threats employees face when using Wi-Fi networks. It also lumps Bluetooth technology and Near Field Communications (NFC) into its list of worrisome protocols. Advice also includes warnings of fake access points that can vacuum up user credentials and skim other personal data. There are very important steps to follow to avoid this wireless threat including turn off Bluetooth in public, avoid public Wi-Fi especially the ones which doesn’t require password to join and disable NFC when not needed.

See the full report here: https://threatpost.com/nsa-warns-public-networks-are-hacker-hotbeds/168268/

Linux eBPF bug gets root privileges on Ubuntu - Exploit released - BleepingComputer

A security researcher released exploit code for a high-severity vulnerability in Linux kernel eBPF (Extended Berkeley Packet Filter) that can give an attacker increased privileges on Ubuntu machines. The bug is tracked as CVE-2021-3490 and is a privilege escalation, so leveraging it requires local access on the target machine. The exploit developer Valentina Palmiotti, describes the technical details behind CVE-2021-3490 and its exploitation on Ubuntu short-term releases 20.10 (Groovy Gorilla) and 21.04 (Hirsute Hippo).

See the full report here: https://www.bleepingcomputer.com/news/security/linux-ebpf-bug-gets-root-privileges-on-ubuntu-exploit-released/

Cisco Researchers Spotlight Solarmarker Malware

Cisco Talos, have seen new activity from Solarmarker, a .NET-based information stealer and keylogger focusing on credential and residual information theft targeting health care, education, and municipal governments most often. Microsoft researchers added that Solarmarker campaign is using SEO poisoning in order to make their dropper files highly visible in search engine results, potentially skewing. Talos warned organizations to look out for the malware since it is critical in organizations’ security, particularly credentials.

See the full report here: https://www.zdnet.com/article/cisco-researchers-spotlight-solarmarker-malware/

DOJ: SolarWinds hackers breached emails from 27 US Attorneys’ offices - BleepingComputer

The US Department of Justice reported that the Microsoft Office 365 email accounts of employees at 27 US Attorneys' offices were breached by the Russian Foreign Intelligence Service (SVR) during the SolarWinds global hacking spree. According to the DOJ, the APT is believed to have access to compromised accounts from approximately May 7 to December 27, 2020. The compromised data included all sent, received, and stored emails and attachments found within those accounts during that time.

See the full report here: https://www.bleepingcomputer.com/news/security/doj-solarwinds-hackers-breached-emails-from-27-us-attorneys-offices/

Node.js fixes severe HTTP bug that could let attackers crash apps - BleepingComputer

Node.js has released updates to fix a high severity, use-after-free vulnerability, tracked as CVE-2021-22930. It could be exploited by attackers to corrupt the process and cause unexpected behaviors, such as application crashes and potentially remote code execution. The vulnerability is fixed in Node.js versions 16.6.0, 12.22.4 (LTS) and 14.17.4 (LTS).

See the full report here: https://www.bleepingcomputer.com/news/security/nodejs-fixes-severe-http-bug-that-could-let-attackers-crash-apps/

PyPI packages caught stealing credit card numbers, Discord tokens

The Python Package Index (PyPI) registry has removed several Python packages divided into different categories this week aimed at stealing users' credit card numbers, Discord tokens, web-browser files and granting code execution capabilities to attackers. These malicious packages were published under three different PyPI accounts. These packages were targeted the credit card details stored in web browser for later use. Yet another strand of malware loaded by some of these packages was aimed at reconnaissance activities to gather system information.

See the full report here: https://www.bleepingcomputer.com/news/security/pypi-packages-caught-stealing-credit-card-numbers-discord-tokens/

Discord once again found to be hosting malware payloads - TechRadar

Cybersecurity researchers have once again witnessed Discord, a gaming-centric messaging platform, being used to host malicious payloads during an investigation into the increasing use of HTML smuggling. The attackers are using HTML Smuggling to deliver the payload to the endpoint because the browser is one of the weakest links without network solutions blocking it.

See the full report here: https://www.techradar.com/news/more-evidence-of-discord-hosting-malicious-payloads

Microsoft shares mitigation for recent Windows Server printing issues - BleepingComputer

Microsoft has released temporary mitigation Information for a known issue, CVE-2021-33764, that might cause print and scan failures on multiple Windows Server versions after installing July 2021 security updates on domain controllers. Customers who encounter this issue are advised to first check if they have the latest drivers and firmware installed on impacted devices. If the known issue still appears on up-to-date devices, affected customers should contact the device manufacturer and ask for setting changes or updates to make the printer or scanner compliant with CVE-2021-33764 hardenings deployed via July Windows 10 security updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-recent-windows-server-printing-issues/

Researchers Uncover New Android Banking Malware - BankInfoSecurity.com

A new report by security firm Threatfabric said that a newly uncovered banking Trojan dubbed "Vultur" is targeting Android users through screen recording to capture the victim's banking credentials. The latest campaign has been active since September 2020 and is being spread by malicious actors as a legitimate app in Google Play Store. The report further added that the malware is actively targeting banking app users across Italy, Australia, and Spain.

See the full report here: https://www.bankinfosecurity.com/researchers-uncover-new-android-banking-malware-a-17194

Amazon Gets Record $888M EU Fine over Data Violations

The e-commerce company Amazon.com Inc. faces the biggest ever European Union fine for a data privacy breach as its lead watchdog hit it with a 746 million-euro ($888 million) penalty for violating the bloc’s strict data protection rules. The Luxembourg data protection authority’s decision on July 16 was disclosed in a regulatory filing by Amazon. The decision stated that Amazon’s processing of personal data did not comply with the EU General Data Protection Regulation.

See the full report here: https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach

Google Play Protect fails Android security tests once more - BleepingComputer

Google Play Protect, the Android built-in malware defense system, has failed the real-world tests of antivirus testing lab AV-TEST after detecting just over two-thirds out of more than 20,000 malicious apps it was pitted against. Google's Android mobile threat protection, which automatically scans over 100 billion apps every day, was introduced during the Google I/O 2017 in May 2017, with rollout to all Android devices starting in July 2017.

See the full report here: https://www.bleepingcomputer.com/news/security/google-play-protect-fails-android-security-tests-once-more/

DarkSide ransomware gang returns as new BlackMatter operation - BleepingComputer

Encryption algorithms found in a decryptor show that the notorious DarkSide ransomware gang has rebranded as a new BlackMatter ransomware operation and is actively performing attacks on corporate entities. After conducting a cyber attack on Colonial Pipeline, the US's largest fuel pipeline, and causing fuel shortages in the southeast of the USA, the DarkSide ransomware group faced increased scrutiny by international law enforcement and the US government.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/

FBI warns investors of fraudsters posing as brokers and advisers - BleepingComputer

The FBI Criminal Investigative Division and Securities and Exchange Commission warned investors of fraudsters impersonating registered investment professionals such as investment advisers and registered brokers. The end goal of these broker imposter schemes is to lure their targets into investment scams using spoofed sites, fake social media profiles, cold calling, and doctored documents.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-investors-of-fraudsters-posing-as-brokers-and-advisers/

CISA launches vulnerability disclosure platform for federal agencies - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) today launched a new vulnerability disclosure policy (VDP) platform for US federal civilian agencies. Initially announced in June, the federal civilian enterprise-wide crowdsourced VDP platform provided by BugCrowd and EnDyna was established in support of Binding Operational Directive (BOD) 20-01 issued in September 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-launches-vulnerability-disclosure-platform-for-federal-agencies/

Bot protection now generally available in Azure Web Application Firewall - BleepingComputer

Azure Web Application Firewall (WAF) is a web application firewall that helps to protect web applications from common threats such as SQL injection, cross-site scripting, and other web exploits. The Web Application Firewall (WAF) bot protection features users to enable a managed bot protection rule set for their WAF to block or log requests from known malicious IP addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/bot-protection-now-generally-available-in-azure-web-application-firewall/

Hackers shut down Rome region website, affecting vaccine bookings - The Local Italy

Nicola Zingaretti, the President of the Lazio, the Italian region that includes Rome, informed via a Facebook post that the website stating information regarding the covid vaccination was down on Sunday after being hit by a cyber attack. The site for booking vaccinations was also unavailable.

See the full report here: https://www.thelocal.it/20210801/hackers-shut-down-rome-region-website-affecting-vaccine-bookings/

Zoom agrees to pay subscribers $25 to put its security SNAFUs behind it

Zoom Video Communications Inc. has consented to pay $85 million and further develop its security practices as part of a preliminary settlement to a two-pronged lawsuit filed against it over privacy violations and so-called “Zoombombing.”Zoom denied wrongdoing in the settlement and mentioned that their users' privacy and security were top priorities for them.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/08/02/zoom_legal/

Windows 11 stock photo leaks upcoming Microsoft Paint redesign - BleepingComputer

The Microsoft Paint application is getting a redesign in Windows 11. An authority stock photograph of Windows 11 has coincidentally released the impending upgrade of the Microsoft Paint application and this updated paint application comes with a modern user interface.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-stock-photo-leaks-upcoming-microsoft-paint-redesign/

Arthur J. Gallagher Co. Hit With Suit Over Data Breach - Law360

Lead plaintiffs Jason Myers and John Parsons claim in a suit filed Thursday that Gallagher failed to implement adequate security systems and practices necessary to protect that information, failed to comply with the minimum industry data security standards, and didn't tell its customers or employees that their personal information had been exposed in a timely manner.

See the full report here: https://www.law360.com/articles/1408375/arthur-j-gallagher-co-hit-with-suit-over-data-breach

UF Health admits patient data may have been compromised in ransomware attack - Villages-News

Two months after a ransomware attack was launched on its computer systems, UF Health-The Villages Hospital is admitting that patient data may have been compromised. The attack was discovered over the Memorial Day weekend at the hospital in The Villages and its sister medical center in Leesburg. Although UF Health initially shrugged it off as a “glitch,” the truth poured out through accounts of patients and staff who described the nightmare which accompanied the ransomware attack.

See the full report here: https://www.villages-news.com/2021/07/31/uf-health-admits-patient-data-may-have-been-compromised-in-ransomware-attack/

University of San Diego Health Substitute Notice of Data Breach - Business Wire

UC San Diego Health recently identified and responded to a security matter involving unauthorized access to some employee email accounts. At no time was continuity of care for our patients affected by the event. UC San Diego Health reported the event to the FBI and is working with external cybersecurity experts to investigate the event and determine what happened, what data was impacted, and to whom the data belonged. While the investigation is ongoing, UC San Diego Health is notifying the community of what personal information may have been involved.

See the full report here: https://www.businesswire.com/news/home/20210727005337/en/University-of-San-Diego-Health-Substitute-Notice-of-Data-Breach

Google Chrome to no longer show secure website indicators - BleepingComputer

Google will no longer show if a site is secure rather it will only show an indicator when one visits an insecure site. Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-to-no-longer-show-secure-website-indicators/

Windows 10 to automatically block potentially unwanted apps - BleepingComputer

Microsoft has added a new 'Potentially unwanted app blocking' setting in Windows security that causes Microsoft Defender to block potentially unwanted applications (PUAs) by default starting this month. Windows 10 users who do not wish to block PUAs by default can turn this feature off.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-to-automatically-block-potentially-unwanted-apps/

Chipotle Emails Serve Up Phishing Lures

There was a data breach reported in the Chipotle Mexican Grill, a fast-food chain, in which its customers who had signed up via email received phishing lures and malicious links that redirected to credential harvesting sites. Researchers at Inky reported that Chipotle’s email vendor Mailgun was breached, allowing threat actors to commandeer the company’s email marketing efforts.

See the full report here: https://threatpost.com/chipotle-serves-up-lures/168279/

Google is ending sign-in support for Android Gingerbread and older devices next month - TechSpot

Google has declared that it will presently don't permit sign-ins on gadgets running Android 2.3.7 or lower beginning September 27, 2021. The company is in an effort to keep users safe online by further restricting the functionality of nearly decade-old Android hardware.

See the full report here: https://www.techspot.com/news/90626-google-ending-sign-support-android-gingerbread-older-devices.html

Online radio for your smartphone - Introductions - BleepingComputer

It's now possible to install the free radio program for smartphones to listen to all favorite radio channels online. There are websites that offer online radio services, such as Pandora, I Listened, Tunein, and several others. These websites are very easy to navigate and have a very user-friendly interface which makes them extremely popular.

See the full report here: https://www.bleepingcomputer.com/forums/t/756047/online-radio-for-your-smartphone/

Apple Researching Ways to Expand the iPhone's Display to Hide the Notch - MacRumors

A patent titled "Electronic devices with adjustable display windows" was filed with the U.S. Patent and Trademark Office which explained how a device's display could move as to show and hide the front-facing camera and other optical components. Apple has described this mechanism as creating a "window region".While patents are not an affirmation of Apple's accurate designs for future items, they do feature the company's particular spaces of research.

See the full report here: https://www.macrumors.com/2021/08/03/apple-researching-ways-to-hide-the-notch/

Citizen's New Service Helps Paying Users Summon the Cops

Citizen is an application that tracks local crime and lets you film incidents as they happen. It has launched a new subscription service called Protect which enables users who pay the $20 monthly fee to contact Citizen’s team of virtual security agents for help whenever they feel threatened. Andrew Frame, CEO of the application mentioned that they were on this journey to evolve the public safety system and use technology to supercharge it.

See the full report here: https://www.wired.com/story/citizen-protect-subscription/

Deloitte Canada acquires SAP consultancy firm Clockwork

To strengthen its SaaS solution deployment, cloud migration, and custom application development, Deloitte Canada has acquired SAP consultancy firm Clockwork for an undisclosed sum. In addition to this, Clockwork will help the firm serve a new market of clients in the public and private sectors.

See the full report here: https://www.itpro.co.uk/cloud/360466/deloitte-canada-acquires-sap-consultancy-firm-clockwork

Google breaks from Qualcomm with in-house Pixel 6 chip

Google shifts away from its 15-year relationship with Qualcomm. The upcoming Pixel 6 smartphone, will feature its own in-house-built processor. The processor will be adapted for artificial intelligence (AI) and machine learning (ML) capabilities.

See the full report here: https://www.itpro.co.uk/server-storage/system-on-chip-soc/360454/google-breaks-from-qualcomm-with-in-house-pixel-6-chip

NSA and CISA share Kubernetes security recommendations - BleepingComputer

Kubernetes is an open-source solution for deploying, scaling, and managing containerized apps in the cloud, making it an attractive target for cyber attacks. The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have published comprehensive recommendations for strengthening the security of an organization’s Kubernetes system. Hackers are targeting Kubernetes environment for stealing data and causing a denial of service.

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-and-cisa-share-kubernetes-security-recommendations/

Windows admins now can block external devices via layered Group Policy

Microsoft has added support for layered Group Policies, which allow IT, administrators, to control what internal or external devices users can be installed on corporate endpoints across their firm's network. It provides control over what devices are blocked from an installation using a set of device identifiers such as for instance IDs, hardware IDs, setup class, and removable device property. This feature will also be supported in Windows 11.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-admins-now-can-block-external-devices-via-layered-group-policy/

Phishing Campaign Dangles SharePoint File-Shares

Microsoft researchers track down that attackers are using disguised sender addresses and Microsoft SharePoint attracts in a new phishing campaign that could fool people into giving up their credentials. Researchers provided a query string on GitHub that can be run through Microsoft 365 Defender to flag any emails from the campaign that may have slipped past through other gateways.

See the full report here: https://threatpost.com/phishing-sharepoint-file-shares/168356/

Several Malware Families Targeting IIS Web Servers With Malicious Modules

Internet Information Services (IIS) is a flexible, general-purpose webserver from Microsoft that runs on Windows systems to serve requested HTML pages or files.IIS servers disclosed that almost 14 malware families, indicating that the Windows-based web server software continues to be a nest for natively developed malware for close to eight years.

See the full report here: https://thehackernews.com/2021/08/several-malware-families-targeting-iis.html

Edge Super Duper Secure Mode turns off the JavaScript JIT compiler for extra security

Microsoft Edge dealt with an experiment that disabled the JavaScript just-in-time (JIT) compiler to enable some extra security protections. With the JIT engine turned off, it was possible for Edge to turn on protections -- such as the hardware-based Control-flow Enforcement Technology (CET) from Intel, and Windows' Arbitrary Code Guard (ACG) and Control Flow Guard (CFG) -- that were previously incompatible with JIT.

See the full report here: https://www.zdnet.com/article/edge-super-duper-secure-mode-turns-off-the-javascript-jit-compiler-for-extra-security/

LockBit ransomware recruiting insiders to breach corporate networks - BleepingComputer

LockBit 2.0 ransomware can spread across a local network through group policies created on a hijacked domain controller. This gang is effectively enrolling corporate insiders to help them break and scramble organizations' networks. Consequently, the insider is guaranteed million-dollar payouts.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/

Energy group ERG reports minor disruptions after ransomware attack - BleepingComputer

Italian renewable energy group, ERG was hit by a ransomware attack on its systems which affected its information and communications technology (ICT) infrastructure. La Repubblica reported that the attack was coordinated by the LockBit 2.0 ransomware group. However, the organization confirmed that there was no downtime after the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/

Cisco Issues Critical Security Patches to Fix Small Business VPN Router Bugs

Cisco is an American MNC that is the worldwide leader in IT and networking. It has rolled out patches to address critical vulnerabilities impacting its Small Business VPN routers. A remote attacker executes arbitrary code and even causes a denial-of-service (DoS) condition.

See the full report here: https://thehackernews.com/2021/08/cisco-issues-critical-security-patches.html

Google bundles Android and web authentication APIs under one banner

Google has dispatched a set-up of verification and personality APIs, called Google Identity Services, that consolidates all identity products under a single software development kit (SDK) for web and Android developers. This SDK includes the Sign in with Google button as well as the newly launched One Tap. The firm confirmed that Google Identity Services products protect against vulnerabilities such as click-jacking and pixel tracking.

See the full report here: https://www.itpro.co.uk/development/web-development/360468/google-launches-fresh-suite-of-identity-apis-for-developers