Threat Intelligence Bulletin: 08/20/2021 - 08/26/2021

Breaking News: 2021-08-20 - 2021-08-26

InkySquid State Actor Exploiting Known IE Bugs

The InkySquid advanced persistent threat (APT) group, which researchers have linked to the North Korean government, was caught launching watering hole attacks against a South Korean newspaper using known Internet Explorer vulnerabilities. According to the reports by Volexity researchers, the suspicious code is loaded on the Daily NK site, a news outlet focused on North Korea, starting in April. And although the links led to real files, malicious code was being inserted for brief periods, making it difficult to detect.

See the full report here: https://threatpost.com/inkysquid-exploiting-ie-bugs/168833/

New unofficial Windows patch fixes more PetitPotam attack vectors - BleepingComputer

A second unofficial patch for the Windows PetitPotam NTLM relay attack has been released to fix further issues not addressed by Microsoft's official security update. An NTLM relay attack is when a threat actor can force a server or domain controller to authenticate against an NTLM relay server under a threat actor's control. This NTLM relay would then forward the request to a targeted victim's Active Directory Certificate Services via HTTP to receive a Kerberos ticket-granting ticket (TGT), which allows the attacker to assume the identity of the domain controller and take over the Windows domain. Microsoft released a security update as part of the August 2021 Patch Tuesday that attempted to fix the PetitPotam vulnerability, tracked as CVE-2021-36942.

See the full report here: https://www.bleepingcomputer.com/news/security/new-unofficial-windows-patch-fixes-more-petitpotam-attack-vectors/

Hackers can bypass Cisco security products in data theft attacks - BleepingComputer

Cisco reported that unauthenticated attackers could bypass TLS inspection filtering tech in multiple products to exfiltrate data from previously compromised servers inside customers' networks. In such attacks, the threat actors can exploit a vulnerability in the Server Name Identification (SNI) request filtering impacting 3000 Series Industrial Security Appliances (ISAs), Firepower Threat Defense (FTD), and Web Security Appliance (WSA) products. A remote attacker can then execute a command-and-control attack on a compromised host or perform additional data exfiltration attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-bypass-cisco-security-products-in-data-theft-attacks/

Mozi IoT Botnet Now Also Targets Netgear, Huawei, and ZTE Network Gateways

Mozi, a peer-to-peer (P2P) botnet known to target IoT devices, has gained new capabilities that allow it to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE. According to Microsoft's IoT security team, the new Mozi takes specific actions to increase its chances of survival upon reboot or any other attempt by other malware or responders to interfere with its operation. The updated version supports new commands that enable the malware to hijack HTTP sessions and carry out DNS spoofing to redirect traffic to an attacker-controlled domain. Businesses and users using Netgear, Huawei, and ZTE routers are recommended to secure the devices using strong passwords and update the devices to the latest firmware.

See the full report here: https://thehackernews.com/2021/08/mozi-iot-botnet-now-also-targets.html

CISA shares guidance on how to prevent ransomware data breaches

The US Cybersecurity and Infrastructure Security Agency (CISA) has released guidance to help government and private sector organizations prevent data breaches resulting from ransomware double extortion schemes. The federal agency issued these recommendations in response to most ransomware gangs using data stolen from their victims' networks as leverage in ransom negotiations under the threat of publishing the stolen info on dedicated leak sites.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-shares-guidance-on-how-to-prevent-ransomware-data-breaches/

Social account thief goes to prison for stealing, trading nude photos

A New York man received a three-year sentence in federal prison for hacking social media accounts of dozens of female students from State University of New York at Plattsburgh through accessing their school email accounts and stealing nude photos and videos of them. Hacker tried to hack into more than two dozen accounts of females, but managed to break into just ten of them. The university investigated and acted to prevent the “hackers” from accessing the systems through VPN immediately they comes to know about the account lockouts due to the unauthorized password changes.

See the full report here: https://www.bleepingcomputer.com/news/security/social-account-thief-goes-to-prison-for-stealing-trading-nude-photos/

T-Mobile data breach just got worse — now at 54 million customers

Data breach in T-Mobile is keeps getting worse as an update that cyberattack exposed over 54 million individuals' data includes’ customers' IMSI, IMEI, phone numbers, customer names, security PINs, Social Security numbers, driver's license numbers, and date of birth. The hackers said the database with 100 million T- Mobile customers data was stolen approximately two weeks ago. It is advised that all T-Mobile customers assume that their data was exposed and be on the lookout for targeted phishing emails and SMS texts. If any are received, do not click any links embedded in the messages.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-data-breach-just-got-worse-now-at-54-million-customers/

SynAck ransomware decryptor lets victims recover files for free

Emsisoft has released a decryptor for the SynAck Ransomware, allowing victims to decrypt their encrypted files for free. The SynAck ransomware gang launched its operation in 2017 but rebranded as the El_Cometa gang in 2021. As part of this rebranding, the threat actors released the master decryption keys and documentation for their encryption algorithm on their Tor data leak site. The document from Emisoft explains the step by step process to make the decryptor process easy.

See the full report here: https://www.bleepingcomputer.com/news/security/synack-ransomware-decryptor-lets-victims-recover-files-for-free/

Pegasus iPhone hacks used as lure in extortion scheme

A new extortion scam is underway that attempts to capitalize on the recent Pegasus iOS spyware attacks to scare people into paying a blackmail demand. Recently it was revealed that Pegasus spyware was installed on fully updated iPhones through a zero-day zero-click iMessage vulnerability. It is believed that Pegasus has been used to monitor users. By using this instance threat actors began emailing recipients, threatening that their iPhone becomes victim for Pegasus and then put a demand for not revealing personal and private data of the user in public. While receiving these types of emails always remember that they are scams, and you should just mark them as spam and delete the email.

See the full report here: https://www.bleepingcomputer.com/news/security/pegasus-iphone-hacks-used-as-lure-in-extortion-scheme/

Cloudflare mitigated one of the largest DDoS attack involving 17.2 million rps

Cloudflare, a web infrastructure and website security company on Thursday disclosed that it mitigated the largest ever volumetric DDOS attack via a Mirai botnet. It is said to have targeted an unnamed customer in the financial industry. "Within seconds, the botnet bombarded the Cloudflare edge with over 330 million attack requests as 17.2 million requests-per-second (rps0. In this specific incident, the traffic originated from more than 20,000 bots in 125 countries worldwide, with almost 15% of the attack originating from Indonesia, followed by India, Brazil, Vietnam, and Ukraine.

See the full report here: https://thehackernews.com/2021/08/cloudflare-mitigated-one-of-largest.html

Pakistani Military Targeted by Confucius with Pegasus Spyware Lures

Trend Micro discovered a recent spear-phishing campaign by cybercriminal group Confucius, in which hackers are using Pegasus Spyware. The hackers are tricking users into clicking on a malicious document that downloads a data theft code. It is recommended that users should adhere to standard security practices because they are still applicable in most attacks.

See the full report here: https://news.softpedia.com/news/pakistani-military-targeted-by-confucius-with-pegasus-spyware-lures-533823.shtml

Hackers Steal More Than $97M from Liquid Crypto Exchange

Hackers targeted the Japanese cryptocurrency exchange Liquid which resulted in the theft of $97 million worth of digital assets. According to the security sites, the attack affected many users, as Liquid is among the top 20 crypto exchanges in the world in terms of the daily trading volume. The investigation is still ongoing.

See the full report here: https://news.softpedia.com/news/hackers-stal-more-than-97m-from-liquid-crypto-exchange-533830.shtml

U.S. State Department was recently hit by a cyber attack

The U.S. State Department was recently hit by a cyber attack, the Department of Defense Cyber Command is notifying impacted individuals. It is unclear when the breach was discovered, but it is believed to have happened a couple weeks ago. The incident did not impact the operations of the State Department.

See the full report here: https://securityaffairs.co/wordpress/121354/hacking/us-state-department-hit-cyber-attack.html

Official Taliban websites go offline, though reasons unknown - Associated Press

Taliban websites that delivered the victorious insurgents’ official messages to Afghans and the world at large in five languages went offline abruptly last week, indicating an effort to try to squeeze them. The websites’ disappearance may just be temporary as the Taliban secures new hosting arrangements but many popular platforms are trying to diminish the group's online presence.

See the full report here: https://apnews.com/article/technology-business-taliban-ae7c0aa553e9e63f3ddda37cfca72344

Google Issues Warning For 2 Billion Chrome Users - Forbes

Google has warned users about seven new 'High' security risks in the Chrome browser. These vulnerabilities impacting Chrome users on all major operating systems: Windows, macOS, and Linux. The information about these vulnerabilities is not yet disclosed completely to avoid further attacks. Google recommended to. user to upgrade to Chrome browser to version 92.0.4515.159 or above.

See the full report here: https://www.forbes.com/sites/gordonkelly/2021/08/21/google-chrome-warning-high-security-hacks-upgrade-chrome-now/

Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities

CISA releases a security update stating that the Malicious cyber actors are actively exploiting the following ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. An attacker exploiting these vulnerabilities could execute arbitrary code on a vulnerable machine. CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft's Security Update from May 2021.

See the full report here: 16869 at https://us-cert.cisa.gov

Nigerian Threat Actors Solicit Employees to Deploy Ransomware for Cut of Profits - Threatpost

Researchers have discovered a Nigerian threat actor trying to turn an organization’s employees into insider threats by soliciting them to deploy ransomware for a cut of the ransom profits. Researchers at Abnormal Security identified and blocked several emails sent to its customers that offered people $1 million in bitcoin to install DemonWare ransomware. DemonWare, a Nigeria-based ransomware group, was last seen launching a barrage of attacks targeting Microsoft Exchange’s ProxyLogon set of vulnerabilities.

See the full report here: https://threatpost.com/nigerian-solicits-employees-ransomware-profits/168849/

Google discloses unpatched Microsoft WFP Default Rules AppContainer Bypass EoP

Google disclosed the details of a Windows ​​AppContainer vulnerability in the configuration of Windows Firewall that could allow attackers to bypass restrictions and allowed an AppContainer process to access the network. The experts also published a proof-of-concept (PoC) exploit code that could use any location excluding localhost and leverages APCs to execute arbitrary function calls.

See the full report here: https://securityaffairs.co/wordpress/121370/hacking/microsoft-wfp-appcontainer-bypass.html

Microsoft shares guidance on securing Windows 365 Cloud PCs

Microsoft has shared guidance on securing Windows 365 Cloud PCs and information on their built-in security capabilities. The guidance is broken down into actions customers can take to the secure Cloud PCs enrolled in Windows 365 Business and Windows 365 Enterprise subscription plans.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-securing-windows-365-cloud-pcs/

Razer bug lets you become a Windows 10 admin by plugging in a mouse

A Razer Synapse zero-day vulnerability has been disclosed on Twitter, allowing you to gain Windows admin privileges simply by plugging in a Razer mouse or keyboard. A security researcher discovered a zero-day vulnerability in the plug-and-play Razer Synapse installation that allows users to gain SYSTEM privileges on a Windows device quickly. A video demonstration of the Razer Synapse vulnerability has also been shared. When plugging in a Razer device into Windows 10 or Windows 11, the operating system will automatically download and begin installing the Razer Synapse software on the computer. Razer claims that their Razer Synapse software is used by over 100 million users worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/

IBM introduces Telum chips aimed at AI inferencing workloads like fraud detection

IBM introduces Telum chips aimed at AI inferencing workloads like fraud detection. The AI inferencing acceleration will allow it to do real-time deep learning inferencing, fraud detection, and analytics and gain insights as those transactions are running at the system. The software enables bringing deep learning into transactions. The chip contains 8 processor cores with 32MB cache per core. The dual-chip module design contains 22 billion transistors and 19 miles of wire on 17 metal layers.

See the full report here: https://www.zdnet.com/article/ibm-introduces-telum-chips-aimed-at-ai-inferencing-workloads-like-fraud-detection/

Web Censorship Systems Can Facilitate Massive DDoS Attacks

Researchers are warning internet censorship systems are ripe for abuse by a new type of distributed denial of service (DDoS) attack. Netscout, which detailed the attack vector, dubbed the type of DDoS attack a Middlebox HTTP Reflection/Amplification (MBHTTP)misconfiguration vulnerability, meaning an attacker can magnify the amount of malicious traffic they generate while obscuring the sources of the attack traffic. They say attacks can produce DDoS volumes as high as a 700,000 to 1 amplification factor. Netscout recommends that network operators identify abuse-able censorship systems and remove them.

See the full report here: https://threatpost.com/censorship-systems-ddos-attacks/168853/

FBI: OnePercent Group Ransomware targeted US orgs since Nov 2020

The Federal Bureau of Investigation (FBI) has shared information about a threat actor known as OnePercent Group that has been actively targeting US organizations since at least November 2020 as a ransomware affiliate. The US federal law enforcement agency shared indicators of compromise, tactics, techniques and procedures (TTP), and mitigation measures in a flash alert. OnePercent Group actors encrypt the data and exfiltrate it from the victims’ systems. The actors contact the victims via telephone and email, threatening to release the stolen data through The Onion Router (TOR) network and clearnet unless a ransom is paid in virtual currency.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-onepercent-group-ransomware-targeted-us-orgs-since-nov-2020/

Botnet targets hundreds of thousands of devices using Realtek SDK

A Mirai-based botnet now targets a critical vulnerability in the software SDK used by hundreds of thousands of Realtek-based devices, encompassing 200 models from at least 65 vendors, including Asus, Belkin, D-Link, Netgear, Tenda, ZTE, and Zyxel. The security flaw that IoT Inspector security researchers found is now tracked as CVE-2021-35395 and was assigned a 9.8 out of 10 severity rating. It impacts many Internet-exposed wireless devices ranging from residential gateways and travel routers to Wi-Fi repeaters, IP cameras, and smart lightning gateways or connected toys.

See the full report here: https://www.bleepingcomputer.com/news/security/botnet-targets-hundreds-of-thousands-of-devices-using-realtek-sdk/

CISA warns admins to urgently patch Exchange ProxyShell bugs

The US Cybersecurity and Infrastructure Security Agency (CISA) issued its first alert tagged as "urgent," warning admins to patch on-premises Microsoft Exchange servers against actively exploited ProxyShell vulnerabilities. Malicious cyber actors are actively exploiting the following ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft's Security Update from May 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-urgently-patch-exchange-proxyshell-bugs/

Phishing campaign uses UPS.com XSS vuln to distribute malware

A UPS phishing campaign utilized cross-site scripting (XSS) vulnerability in UPS[.]com to push fake and malicious 'Invoice' Word documents. The threat actor used the XSS vulnerability in UPS[.]com to modify the site's regular page to look like a legitimate download page and distribute a malicious document through a remote Cloudflare and make it look like it was being downloaded directly from UPS[.]com. The email sender clearly showed a suspicious domain, as the XSS vulnerability allowed the URL and download page to appear legitimately from UPS, many users would have been victims in this scam.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-campaign-uses-upscom-xss-vuln-to-distribute-malware/

Modified Version of WhatsApp for Android Spotted Installing Triada Trojan

FMWhatsApp 16.80.0, a modified version of the WhatsApp messaging app for Android with the advertising software development kit has been trojanized to intercept text messages, serve malicious payloads, display full-screen ads, and sign up device owners for unwanted premium subscriptions without their knowledge. Modified versions of legitimate Android apps, a practice called Modding are designed to perform wide range of malicious activities. The app is only available via third-party websites.

See the full report here: https://thehackernews.com/2021/08/modified-version-of-whatsapp-for.html

Poly Network Recoups $610M Stolen from DeFi Platform

A threat actor called “Mr. White Hat” has returned the $610 million they stole from the DeFi platform Poly Network. The breached company did offer the position of chief security officer to threat actor in exchange for getting its money back. Also, threat actor said that the plan was never to keep the money, just to prove there are security weaknesses associated with DeFi platforms. The Poly Network DeFi platform connects various blockchains so they can all work together to build a wider infrastructure.

See the full report here: https://threatpost.com/poly-network-recoups-610m-stolen-from-defi-platform/168906/

T-Mobile Sued Over Data Breach Affecting Millions of Customers

Class action lawsuits have been filed against T-Mobile over the recently disclosed data breach impacted more than 50 million of the company’s customers, since T-Mobile maintained private information in a reckless manner. Compromised information includes sensitive personally Identifiable information. The company has offered two years of free identity protection services to impacted individuals, but several affected firms are not satisfied and filed lawsuits on T-Mobile. This lawsuit mentions several cybersecurity incidents affecting T-Mobile over the past years.

See the full report here: https://www.securityweek.com/t-mobile-sued-over-data-breach-affecting-millions-customers

Fake OpenSea support staff are stealing cryptowallets and NFTs

OpenSea users are being targeted in an ongoing and aggressive Discord phishing attack to steal cryptocurrency funds and NFTs. Threat actors have been lurking in OpenSea's Discord server, pretending to be official support representatives for the site to support OpenSea users needing help which invariably leads to scam. The fake support scam will trick the user to follow the needed actions from scammer and gain full access to the cryptocurrency and any NFT collectibles stored in Victim’s MetaMask Wallet. To avoid this scam, users always supposed to open support requests only through Opensea help center.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-opensea-support-staff-are-stealing-cryptowallets-and-nfts/

Trend Micro Detected Nearly 13 Million Malware Events Targeting Linux-based Cloud Environments - PRNewswire

Trend Micro Incorporated, a global cybersecurity leader, released a new research on the state of Linux security in the first half of 2021. The report gives valuable insight into how Linux operating systems are being targeted as organizations increase their digital footprint in the cloud and the pervasive threats that make up the Linux threat landscape. The report investigates the top malware families affecting Linux servers with the top types of malwares and also revealed that most detections arose from systems running end-of-life versions of Linux distributions.

See the full report here: https://www.prnewswire.com/news-releases/trend-micro-detected-nearly-13-million-malware-events-targeting-linux-based-cloud-environments-301360288.html

New Hampshire town loses $2.3 million to overseas scammers

Peterborough, a small New Hampshire town, has lost $2.3 million after Business Email Compromise (BEC) scammers redirected several bank transfers using forged documents sent to the town's Finance Department staff in multiple email exchanges. BEC scammers use various tactics to compromise or impersonate their targets' business email accounts, allowing them to redirect pending or future payments to the bank accounts they control. Town officials discovered the attack on July 26, 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/new-hampshire-town-loses-23-million-to-overseas-scammers/

Critical F5 BIG-IP bug impacts customers in sensitive sectors

BIG-IP application services company F5 has fixed more than a dozen high-severity vulnerabilities in its networking device. The flaws range from authenticated remote command execution to cross-site scripting (XSS) and request forgery, to insufficient permission and denial-of-service. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a notification about F5’s security advisory, encouraging users and administrators to review the information from the company and install the software updates or apply the necessary mitigations.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-f5-big-ip-bug-impacts-customers-in-sensitive-sectors/

Ethereum urges Go devs to fix severe chain-split vulnerability

Ethreum project maintainers are urging Go developers to apply a hotfix to squash a high-severity vulnerability. The vulnerability tracked as CVE-2021-39137 impacts "Geth", aka go-ethereum, the official Golang implementation of the Ethereum protocol. This vulnerability in the open-source project Geth can cause a "chain-split," meaning vulnerable Geth instances would reject accepting canonical chains.

See the full report here: https://www.bleepingcomputer.com/news/security/ethereum-urges-go-devs-to-fix-severe-chain-split-vulnerability/

FIN8 cybercrime gang backdoors US orgs with new Sardonic malware

The threat actor FIN8 has breached and backdoored the network of a US financial organization with a new malware known dubbed Sardonic. According to Bitdefender's researchers, threat actors deployed the new backdoor on targets' systems via social engineering or spear-phishing. Organizations at risk of being targeted by FIN8 (primarily financial, retail, hospitality entities) are advised to check their networks for known FIN8 indicators of compromise.

See the full report here: https://www.bleepingcomputer.com/news/security/fin8-cybercrime-gang-backdoors-us-orgs-with-new-sardonic-malware/

Windows 10 KB5005932 fixes devices that can't install new updates

Microsoft has released the Windows 10 KB5005932 setup update to fix '"PSFX_E_MATCHING_BINARY_MISSING" errors when attempting to install the latest cumulative updates. After installing the May 25, 2021 (KB5003214) and June 21, 2021 (KB5003690) cumulative updates, some Windows 10 21H1, 20H2, and 2004 users have been unable to install the latest cumulative updates (LCU) released as a preview or on Patch Tuesday. This compatibility fix enables an in-place upgrade to be run on devices that cannot complete the installation of the latest cumulative update (LCU). Microsoft released the 'KB5005932 Windows Setup Update' that allows users to perform a manual in-place upgrade by configuring a registry setting. Microsoft recommends users perform an in-place upgrade to automatically install the latest cumulative update as part of the installation process to resolve this issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5005932-fixes-devices-that-cant-install-new-updates/

SteelSeries bug gives Windows 10 admin rights by plugging in a device

A security researcher has found an installation-related software bug on SteelSeries plug-and-play devices on Windows 10 that can be exploited to obtain administrator rights. Leveraging the bug is possible during the device setup process, using a link in the License Agreement screen that can be opened with SYSTEM privileges without a SteelSeries device. An attacker could save the vulnerable signed executable dropped in the temporary folder when plugging in a SteelSeries device and serve it in a DNS poisoning attack. The company was aware of the issue and have disabled the launch of the SteelSeries installer and working on a software update for a permanent fix.

See the full report here: https://www.bleepingcomputer.com/news/security/steelseries-bug-gives-windows-10-admin-rights-by-plugging-in-a-device/

ShinyHunters group claims to have data of 70M AT&T customers

ShinyHunters group claims to have a database containing private information on roughly 70 million AT&T customers. The group is asking $1 million for the entire database, or $200,000 for access, according to the RestorePrivacy. The threat actors claim that data belong to AT&T customers in the United States, but AT&T denied any data breach.

See the full report here: https://securityaffairs.co/wordpress/121439/data-breach/shinyhunters-70m-att-customers.html?utm_source=rss&utm_medium=rss&utm_campaign=shinyhunters-70m-att-customers