Threat Intelligence Bulletin: 08/13/2021 - 08/19/2021

Flash Alert: T-Mobile Data Exposure

TLP: GREEN

On August 16, 2021, United States-based telecommunications company, T-Mobile, disclosed a data breach that possibly resulted in the compromise of approximately 100 million unique records. The investigation into the breach occurred after an actor posted a thread on a cybercriminal underground forum advertising the sale of breach data and claiming it was from T-Mobile. A second update was shared on August 17, 2021 and confirmed that the ongoing investigation revealed some T-Mobile customer data had been accessed. This data included names, date of birth, Social Security numbers and driver’s licenses.T-Mobile currently estimates that 7.8 million current postpaid customers are affected, as well as over 40 million records of former or potential customers who had previously applied for credit. This is the sixth data breach disclosed by T-Mobile within the past five years.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On August 14, 2021, an actor using the alias "SubVirt" published a thread on a cybercriminal underground forum selling a breach package containing 30 million unique records of compromised credentials (Figure 1). The seller advertises the data for 6 bitcoin (USD 275,406.00) and claims the data has never been sold before. Those interested in purchasing the breach package are required to contact the actor on a provided Telegram account, with the note that only serious buyers are eligible to purchase the breach package. The actor also includes a snippet of the data included in the breach, such as:

• Names
• Social security numbers
• Date of birth
• Phone numbers
• Addresses
• Security PINs
• Driver license information

Figure 1: Actor "SubVirt" advertises sale of breach package for 6 BTC

The actor responded to the thread on August 16, 2021 claiming that the data was from T-Mobile and is still for sale. The price for the breach package changed from BTC 6 to USD 200. Figure 2 is a screenshot of the latest posts by "SubVirt." Although the price point in the post is a significant drop from the original amount, ZeroFox Threat Intelligence confirmed from a sensitive source with direct access to the actor that the price is actually at USD 200,000. Additionally, the actor revealed that he no longer has access to the source of the data.

Figure 2: "SubVirt" claims that the breach package is from T-Mobile

After this actor posted the advertisement thread, T-Mobile was made aware of the incident and worked to investigate the claims made by the actor and the information involved in the data leak. On August 17, 2021, T-Mobile published an update on the breach investigation. The company continues working through the investigation, but has learned from preliminary analysis that approximately 7.8 million postpaid customer records were included in the breach as well as 40 million records for former or prospective T-Mobile customers. T-Mobile recommends that all postpaid customers change their PIN as a precautionary measure. T-Mobile is also taking proactive steps to help protect their customers by offering two years of identity monitoring to affected customers.

Breaking News: 2021-08-13 - 2021-08-19

Notorious AlphaBay darknet market comes back to life - BleepingComputer

AlphaBay Market was an online darknet market that operated on the Tor network. It was shut down after a law enforcement action as a part of Operation Bayonet against it in the United States, Canada, and Thailand. Alexander Cazes and DeSnake were the two administrators of it.DeSnake has announced on a dark web forum that the AlphaBay market reopened and was ready for business.

See the full report here: https://www.bleepingcomputer.com/news/security/notorious-alphabay-darknet-market-comes-back-to-life/

Experts Shed Light On New Russian Malware-as-a-Service Written in Rust

FickerStealer is a malicious program categorized as a stealer. It extracts (steals) various sensitive and private information from infected devices. BlackBerry's research and intelligence team said that Ficker was sold and distributed as Malware-as-a-Service (MaaS), via underground Russian online forums and it has several paid packages, with different levels of subscription fees to use their malicious program.

See the full report here: https://thehackernews.com/2021/08/experts-shed-light-on-new-russian.html

Ukraine shuts down money laundering cryptocurrency exchanges - BleepingComputer

The Security Service of Ukraine or SBU is Ukraine's law-enforcement authority and main government security agency in the areas of counterintelligence activity and combating terrorism. It has taken down a network of cryptocurrency exchanges used to anonymize transactions since the beginning of 2021. As part of the investigation, the law enforcement officers seized mobile devices with VPN software installed, computers/server machines with the evidence of illegal activity, seals, incorporation documents of dummy companies registered in Ukraine that was used for money laundering activities, and $37,330 in cash.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-money-laundering-cryptocurrency-exchanges/

Windows 11 gets new versions of Snipping Tool, Mail, and Calculator - BleepingComputer

Windows 11 is an upcoming major version of the Windows NT operating system developed by Microsoft. It has come up with a new version of the Calculator, Mail and Calendar, and the Snipping Tool apps. The new Snipping Tool will replace the Classic Snipping Tool and the Snip & Sketch apps and has combined the best features from both. The Calculator and Mail & Calendar will automatically switch from dark and light mode to match it.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-gets-new-versions-of-snipping-tool-mail-and-calculator/

GitHub deprecates account passwords for authenticating Git operations - BleepingComputer

GitHub has announced that it would require using an SSH key or token-based authentication for authenticated Git operations on GitHub.com and will no longer accept account passwords. To avoid disruptions for developers and integrators it is apt to use a personal access token and web or device authorization respectively.

See the full report here: https://www.bleepingcomputer.com/news/security/github-deprecates-account-passwords-for-authenticating-git-operations/

Hackers Can Spy on DNS Traffic Due to Managed DNS Services Cloud Bugs - Softpedia News

A new class of vulnerabilities hitting major DNSaaS can be used by hackers to get access to sensitive information from corporate networks which intercepts a portion of dynamic DNS traffic from all Internet traffic that was routed through managed DNS providers such as Google and Amazon. The exposed traffic provides threat actors with all the information they need to mount a successful attack like an ability to see what is going on inside companies and government organizations. The vulnerabilities have been patched as Wiz Research team developed a tool for identifying DNS leaks.

See the full report here: https://news.softpedia.com/news/hackers-can-spy-on-dns-traffic-due-to-managed-dns-services-cloud-bugs-533760.shtml

FlyTrap malware masquerades as a coupon code to steal Facebook data - Cheraw Chronicle

Zimperium, a Cybersecurity company has discovered a new form of malware for Android named FlyTrap simply be found in the Google Play Store which looks for Facebook data. It masquerades as an app that supposedly allowed you to register free coupon codes for Netflix, Google AdWords and also been detected in some football-related applications. Attackers redirects the user to a legitimate Facebook login page, where they use Java script injection to store user related data. Google has removed several apps from the Google Play Store following the Zimperium report.

See the full report here: https://www.thecherawchronicle.com/flytrap-malware-masquerades-as-a-coupon-code-to-steal-facebook-data/

Bugs in gym management software let hackers wipe fitness history - BleepingComputer

Multiple Vulnerabilities found in the Wodify fitness platform that allows an attacker to view and modify user data like personal, workout and payment. from any of the more than 5,000 gyms that use the solution worldwide. Wodify is an all-in-one platform used by more than 5,000 gyms worldwide addresses both coaches and athletes. Several impacts like triggering XSS, making changes to payment settings, exposing user sensitive information and so on. Wodify has yet to confirm the roll out of a patch, despite being given ample time to address the security issues.

See the full report here: https://www.bleepingcomputer.com/news/security/bugs-in-gym-management-software-let-hackers-wipe-fitness-history/

Microsoft Teams will alert users of incoming spam calls - BleepingComputer

Microsoft is working on adding a spam call notification feature to the Microsoft 365 Teams collaboration platform. While incoming calls will be tagged as "spam likely" automatically, Teams users will still be able to decide if they want to answer. The company is planning on rolling out the new feature by the end of this month, making it generally available on desktop and the web.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-will-alert-users-of-incoming-spam-calls/

Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware

Cyberattackers are using Google’s reCAPTCHA and fake CAPTCHA-like services to hide various phishing and other campaigns. Hiding phishing content behind CAPTCHAs prevents security crawlers from detecting malicious content and adds a legitimate look to phishing login pages. In just the last month, 7,572 unique malicious URLs were found over 4,088 pay-level domains employing the obfuscation method.

See the full report here: https://threatpost.com/cyberattackers-captchas-phishing-malware/168684/

Facebook rolls out end-to-end encryption for Messenger calls - BleepingComputer

Facebook has rolled out end-to-end encrypted Messenger voice and video calls five years after making it available in one-on-one text chats. It has also updated Messenger's expiring message feature with this rollout to let users decide on their own when they want their messages to disappear from chat. The Disappearing Messages setting now provides more options, allowing users to choose the time before all new messages disappear, customizable from 5 seconds to 24 hours.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-rolls-out-end-to-end-encryption-for-messenger-calls/

US brokers warned of ongoing phishing attacks impersonating FINRA - BleepingComputer

The US Financial Industry Regulatory Authority (FINRA) warns US brokerage firms and brokers of an ongoing phishing campaign impersonating FINRA officials and asking them to hand over sensitive information under the threat of penalties. FINRA is a non-profit organization supervised by the Securities and Exchange Commission (SEC) and authorized by the US government to regulate all publicly active securities firms and exchange markets.

See the full report here: https://www.bleepingcomputer.com/news/security/us-brokers-warned-of-ongoing-phishing-attacks-impersonating-finra/

Scripps Health Reports Financial Toll of Ransomware Attack - GovInfoSecurity.com

The recent ransomware attack that disrupted Scripps Health's IT systems and patient care for nearly a month has so far cost the San Diego-based organization nearly $113 million, including $91.6 million in lost revenue, according to a financial report the nonprofit entity filed Tuesday with a municipal securities regulator. Scripps Health notes in its third-quarter earnings report that upon detecting the cybersecurity incident on May 1, it took immediate action to contain the threat and help reduce disruption to patient care.

See the full report here: https://www.bankinfosecurity.com/scripps-health-a-17288

Discord malware is a persistent and growing threat warns Sophos - PC Gamer

A few weeks back, the leading cybersecurity company, Sophos, issued a warning that Discord is becoming an increasingly common target for hackers. The vicious few pushing out malware tend to target users of successful online services, and considering Discord's 140 million-plus active users, with over 300 million registered to date, that makes the chat software a pretty juicy target.

See the full report here: https://www.pcgamer.com/au/discord-malware-persistence-sophos-report/

SynAck ransomware group releases decryption keys as they rebrand to El_Cometa - ZDNet

The SynAck ransomware gang has released decryption keys for victims that were infected between July 2017 and 2021, according to data obtained by The Record. SynAck is in the process of rebranding itself as the El_Cometa ransomware gang, and a member of the old group gave the keys to The Record. Emsisoft's Michael Gillespie confirmed that the decryption keys are working on SynAck decryption utility that they believe will be safer and easier to use because there are concerns that SynAck victims may damage their files further using the provided keys.

See the full report here: https://www.zdnet.com/article/synack-ransomware-group-releases-decryption-keys-as-they-rebrand-to-el-cometa/

Ransomware Gangs Try to Exploit 'PrintNightmare' Flaws - BankInfoSecurity.com

Security researchers at Cisco Talos and CrowdStrike are tracking several ransomware gangs attempting to exploit bugs in Microsoft Windows dubbed "PrintNightmare," which the company has been warning about since June. Meanwhile, Microsoft published an out-of-band security advisory Wednesday about another zero-day flaw that is part of the class of bugs that make up PrintNightmare, a series of remote code execution vulnerabilities affecting Windows Print Spooler, which enables devices to communicate with printers, as well as other printing features found in various versions of the Windows operating system. Microsoft has issued an emergency workaround for this flaw but has not yet issued a patch.

See the full report here: https://www.bankinfosecurity.com/ransomware-gangs-exploit-printnightmare-vulnerabilities-a-17285

Hacker claims to steal data of 100 million T-mobile customers - BleepingComputer

T-Mobile is the brand name used by the mobile communications subsidiaries of the German telecommunications company Deutsche Telekom AG. A threat actor has claimed to have hacked T-Mobile's servers and stolen databases containing the personal data of approximately 100 million customers, including customers' IMSI, IMEI, phone numbers, customer names, security PINs, Social Security numbers, driver's license numbers, and date of birth.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-claims-to-steal-data-of-100-million-t-mobile-customers/

Ford bug exposed customer and employee records from internal systems - BleepingComputer

A vulnerability was found on Ford Motor Company's website that gave access to peek into confidential company records, databases and perform account takeovers. The issue is caused by an information exposure vulnerability in improperly configured Pega Infinity customer management system instances. The researchers state that some of the exposed assets contained sensitive Personal Identifiable Information (PII) like Customer and employee records, Finance account numbers, Database names and tables, OAuth access tokens, Internal support tickets, User profiles within the organization, Pulse actions, Internal interfaces and Search bar history.

See the full report here: https://www.bleepingcomputer.com/news/security/ford-bug-exposed-customer-and-employee-records-from-internal-systems/

How to Send Messages That Automatically Disappear

Most popular chat apps like Signal, WhatsApp, and Snapchat have included disappearing message features which means that there won't be a permanent record of any conversation. In order to keep proof of the conversation either, it should be saved or one could even take a screenshot of the same which would be notified through the application that is used.

See the full report here: https://www.wired.com/story/how-to-send-messages-that-automatically-disappear/

EasyWSL turns Linux docker images into a Windows 10 WSL distro - BleepingComputer

Microsoft Store has launched a new program called EasyWSL replacing the Windows Subsystem for Linux distribution that could convert almost any Linux Docker image into a WSL distro. The Microsoft Store offers many prebuilt Linux WSL distributions such as Fedora, Ubuntu, Alpine, Kali, Debian, and more. But, many popular Linux distributions such as ArchLinux or Centos are unavailable, and if it is needed it would be available as a paid distribution.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/easywsl-turns-linux-docker-images-into-a-windows-10-wsl-distro/

SGT Capital acquires Utimaco to boost protection of data, identities and critical infrastructures

SGT Capital is a global private equity firm with offices in Germany and Singapore that generates superior returns by driving the internationalization of mid-market businesses in combination with more traditional private equity value creation strategies. The EQT Mid Market Europe fund (“EQT Private Equity”) has agreed to sell Utimaco to SGT Capital. The Company provides on-premises and cloud-based hardware security modules, as well as key management solutions and data intelligence solutions for regulated critical infrastructures.

See the full report here: https://www.helpnetsecurity.com/2021/08/15/sgt-capital-utimaco/

Chase bank accidentally leaked customer info to other customers - BleepingComputer

JPMorgan Chase & Co. is an American multinational investment bank and financial services holding company headquartered in New York City. Chase Bank has admitted to the presence of a technical bug on its online banking website and app that allowed accidental leakage of customer banking information to other customers.

See the full report here: https://www.bleepingcomputer.com/news/security/chase-bank-accidentally-leaked-customer-info-to-other-customers/

Secret terrorist watchlist with 2 million records exposed online - BleepingComputer

Bob Diachenko, Security Discovery researcher came across a plethora of JSON records in an exposed Elasticsearch cluster. The 1.9 million-strong record set contained sensitive information on people, including their names, country citizenship, gender, date of birth, passport details, and no-fly status.

See the full report here: https://www.bleepingcomputer.com/news/security/secret-terrorist-watchlist-with-2-million-records-exposed-online/

Education giant Pearson fined $1M for downplaying data breach - BleepingComputer

Pearson Education is a British-owned education publishing and assessment service to schools and corporations, as well as for students directly. The US Securities and Exchange Commission (SEC) has announced that Pearson has settled charges of mishandling the disclosure process for a 2018 data breach discovered in March 2019. Pearson agreed to pay a $1 million civil money penalty to settle charges.

See the full report here: https://www.bleepingcomputer.com/news/security/education-giant-pearson-fined-1m-for-downplaying-data-breach/

Hive ransomware attacks Memorial Health System, steals patient data - BleepingComputer

Memorial Health System is a non-profit network of three hospitals in Ohio and West Virginia. The Hive ransomware gang has attacked its computers, forcing staff to work with paper charts. The attack caused disruptions of clinical and financial operations, causing urgent surgical cases and radiology exams on Monday to be canceled. Memorial Health System president and CEO Scott Cantley said that the patient or employee data had not been compromised and that the investigation was going on.

See the full report here: https://www.bleepingcomputer.com/news/security/hive-ransomware-attacks-memorial-health-system-steals-patient-data/

Pakistan's tax office services go dark after migration project goes awry

As a result of a cyber-attack, Pakistan's Federal Board (FBR) of Revenue – the nation's tax office – has experienced a lengthy outage after a migration project went bad. The Board (FBR) has acknowledged that an upgrade process encountered "unforeseen anomalies" that resulted in an outage to its public-facing services from the evening of August 13th.

See the full report here: https://www.theregister.com/2021/08/17/pakistan_federal_board_of_revenue_outage/

Bug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop

Security researchers have discovered a critical vulnerability that affects internet-of-things (IoT) devices. This would enable attackers to take control over devices, including security webcams and connected baby monitors. This vulnerability was discovered by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek.

See the full report here: https://threatpost.com/bug-iot-millions-devices-attackers-eavesdrop/168729/

Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF

A cybersecurity firm Rapid7 said that an OS command injection vulnerability in FortiWeb's management interface (version 6.3.11 and prior) could allow a remote, authenticated attacker to execute arbitrary commands on the system, via the SAML server configuration page. Fortinet is expected to release a patch at the end of August with version Fortiweb 6.4.1.

See the full report here: https://thehackernews.com/2021/08/unpatched-remote-hacking-zero-day-flaw.html

CISA: BadAlloc impacts critical infrastructure using BlackBerry QNX - BleepingComputer

BlackBerry QNX's tech is used worldwide by over 195 million vehicles and embedded systems across a wide range of industries, including aerospace and defense, heavy machinery, rail, robotics, industrial controls, automotive, commercial vehicles, and medical.CISA has warned that IoT and OT security flaws are known as BadAlloc impact BlackBerry's QNX Real-Time Operating System (RTOS) that are used by critical infrastructure organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-badalloc-impacts-critical-infrastructure-using-blackberry-qnx/

Neustar helps brands mitigate third-party cookie deprecation impact and device ID loss

Neustar, Inc., is an American technology company that provides real-time information and analytics for the Internet, risk, digital performance, and defense, telecommunications, entertainment, and marketing industries, and also provides clearinghouse and directory services to the global communications and Internet industries. Neustar has released a new process to help marketers both diagnose and mitigate the impact of third-party cookie deprecation and device ID loss across their media and measurement investments.

See the full report here: https://www.helpnetsecurity.com/2021/08/18/neustar-fabrick-impact-assessment/

Govt hackers impersonate HR employees to hit Israeli targets - BleepingComputer

Threat researchers at cybersecurity company ClearSky have reported that Siamesekitten actors used the fake profile to deliver malware to potential victims under the pretext of a job offer. Hackers associated with the Iranian government have focused attack efforts on IT and communication companies in Israel.

See the full report here: https://www.bleepingcomputer.com/news/security/govt-hackers-impersonate-hr-employees-to-hit-israeli-targets/

US Census Bureau hacked in January 2020 using Citrix exploit - BleepingComputer

The US Office of Inspector General (OIG) disclosed in a recent report that the US Census Bureau servers were breached on January 11, 2020, by hackers after exploiting an unpatched Citrix ADC zero-day vulnerability. These servers were used to provide the Bureau with remote-access capabilities for its enterprise staff to access the production, development, and lab networks. According to the OIG, the Bureau failed to mitigate the critical vulnerability exploited in the attack, leaving its servers vulnerable.

See the full report here: https://www.bleepingcomputer.com/news/security/us-census-bureau-hacked-in-january-2020-using-citrix-exploit/

New Windows 10 21H2 build comes with improved WiFi security - BleepingComputer

Microsoft has released Windows 10 21H2 19044.1200 with the new Windows Hello security feature, WPA3 HPE support, and GPU computing in the Windows Subsystem for Linux. Windows Hello security feature supports simplified passwordless deployments and achieves a deploy-to-run state within a few minutes.WPA3 HPE support feature improves the Wi-Fi security and GPU computing in the Windows Subsystem for Linux deployments for machine learning and other compute-intensive workflows.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-10-21h2-build-comes-with-improved-wifi-security/

GitHub urges users to enable 2FA after going passwordless - BleepingComputer

GitHub is yearning for its user base to toggle on two-factor authentication (2FA) after detesting password-based authentication for Git operations. Mike Hanley, the company's Chief Security Officer said that multifactor authentication is widely documented and protects against a wide range of attacks, such as phishing.

See the full report here: https://www.bleepingcomputer.com/news/security/github-urges-users-to-enable-2fa-after-going-passwordless/

Bogus Cryptomining Apps Infest Google Play

Google has removed eight fake Android apps that disguise as cryptocurrency cloud-mining applications. These applications exist to lure users into expensive subscription services and other fraudulent activity. All eight recently removed apps turned out to harbor one of two malware, detected as FakeMinerPay and FakeMinerAd.

See the full report here: https://threatpost.com/bogus-cryptomining-apps-google-play/168785/