zerofox logo
Advisories

Threat Intelligence Bulletin: 08/27/2021 - 09/02/2021

|by Alpha Team

banner image

Popular Phishing Kit Pivots to Target Trading Platforms

ZeroFox has observed a recent trend in phishing kits adding new targets to their offerings, consisting of stock trading and cryptocurrency platforms. The “phishing-as-a-service” kit known as FreakzBrothers has recently added such a target to their store targeting Robinhood, a popular stock trading platform. Copies of these phishing kits were obtained shortly after deployments began and analyzed.

Standing Intelligence Requirements

PII & Fraud Brand For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • Always verify the sender of suspicious or unexpected emails and messages
  • Never download attachments from unknown senders or suspicious emails
  • Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
  • Reach out to your ZeroFox account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

FreakzBrothers is the name of a popular commercial phishing kit which can be obtained from a private marketplace, operated by the authors. During the course of its development over the past several years, targets have consisted of well-known retail brands. With the recent popularity of stock trading applications such as Robinhood, brand new versions of the phishing kit have been released targeting these brands, as well as including new capabilities and a refactored code base.

Figure 1: Phishing page impersonating Robinhood login portal

Figure 2: Phishing page verification process screen

Through the “verification” process, victims are prompted to provide input for their:

  • Email address
  • Full name
  • Date of birth
  • Social security number
  • Full residential address
  • Bank name
  • Bank user id
  • Bank password
  • PIN number

Depending on the email address provided, the victim may also be redirected to a page imitating their consumer email provider's login screen. This is used to gather the victims email password along with other information.

The final stage requires the victim to upload identification documents, namely a photo of their drivers license.

Figure 3: The victim is prompted to upload photos of their identity documents

At each stage of the victim workflow, data is sent via email to the owner of the deployment. The dropper email address is configured via the FreakzBrothers store after purchasing the phishing kit.


Figure 4: Example email content sent to the configured dropper email address

Similarly to other popular commercial phishing kits, the phishing page deployment can be monitored or managed by a separate administrative dashboard. This page contains metrics for the operator, keeping track of the number of visitors, blocked bots, and victims.

Figure 5: Administrative dashboard of the phishing kit

A new technique being used by these kits is the use of an API specifically designed for remote administration and verification of deployments, run by the authors of FreakzBrothers. This API has multiple endpoints allowing for multiple functions:

  • Verifying credentials for the admin dashboard
  • Recording visitor information
  • Logging blocked IP addresses
  • Retrieving configuration data
  • Verifying the domain

Several kits ZeroFox has analyzed also contain code which are disguised as functions to “verify” victim data, but instead simply sends victim information and credit card data directly to the authors of FreakzBrothers.

Figure 6: Function which sends full user and credit card information ($copy) to the API, after emailing victim data to the owner of the deployment.

The addition of trading platforms to popular phishing kit providers shows authors are continuing to adapt and produce new content based on demand and current trends. Due to the nature of phishing kits and how they are distributed, ZeroFox assesses with high confidence that similar offerings will continue to appear, as well as “cracked” or edited versions of popular kits, such a FreakzBrothers.

Breach Disclosure: IndiaMART

In August 2021, IndiaMART, an India-based e-commerce company, was the subject of a data breach that resulted in the compromise of over 38 million records. The data was discovered when a threat actor opened a thread on a cybercriminal underground forum advertising a breach package containing over 20 million unique credentials for IndiaMART. Information obtained from the breach package includes unique email addresses, names, phone numbers, and physical addresses.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
  • Review network logs for potential signs of compromise and data egress.
  • Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On August 21, 2021, actor "globetrotters" posted a data breach package targeting the organization IndiaMART on a cybercriminal underground forum. The actor specifies that the package contains 40 million records, and of those records approximately 20 million unique email addresses. The actor also claims that the post contains data that has been circulating in other cybercriminals networks for over a year. From this package, ZeroFox extracted 20,167,754 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include: physical address, mobile number, and customer profile details.

In a thread observed in May 2021, an actor using the alias "osintguy" advertised the sale of a breach package containing 41 million compromised records allegedly for IndiaMART. The post contains a list of extracted database columns, as well as an attachment containing a sample of the data from the package. The actor requests buyers to contact them via their Telegram handle to purchase the breach package.

Figure 1 Figure 1. Actor "osintguy" advertises sale of alleged IndiaMART breach package

IndiaMART is a business-to-business (B2B) company that connects Indian manufacturers with buyers. The company issued a statement about the incident and denied any data leak or breach. They further clarified that the supposed information within the breach package (sellers' names, email addresses, phone numbers, and physical addresses) are publicly available via the IndiaMART website, and that sellers' personally identifiable information is not exposed on the portal. Although it is unclear how the data was exposed, some possibilities include intentional exposure and scraping, or retrieval via a software vulnerability.

Ransomware Operators Leverage PrintNightmare in Attacks

In August 2021, security researchers discovered that ransomware groups utilized PrintNightmare vulnerabilities in ransomware attacks. PrintNightmare is a colloquial name for security flaws within the Microsoft Print Spooler service that gained significant attention in June and July 2021 due to the critical nature of the vulnerabilities. Ransomware groups Vice Society and Magniber were associated with using multiple PrintNightmare vulnerabilities in targeted infections. By making use of newly disclosed vulnerabilities, like the PrintNightmare flaws, ransomware operators have a higher chance of landing a successful infection, as the patch to remediate the vulnerable software or system is likely unavailable, thus placing potential targets at a higher risk for a ransomware attack.

Standing Intelligence Requirements

DDW VULN Malware

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
  • Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
  • If a workstation is infected with malware, quarantine it on a private network segment with no external connections.
  • If you are alerted or suspect a compromised account, change the password immediately.
  • Disable unneeded protocols on your network (UDP, IPX, NetBIOS) and monitor for any use of them.
  • Monitor usage of dual-purpose tools such as Powershell for abnormal behaviors.
  • Apply security patches or recommended workarounds provided by the Microsoft Security Response Center
  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Security researchers have publicly reported two ransomware groups leveraging PrintNightmare vulnerabilities in their attacks: Vice Society and Magniber. Although Magniber ransomware has been around since 2017, Vice Society is new to ransomware operations (with known infections starting as early as June 2021) and is likely a variation of the HelloKitty ransomware. PrintNightmare does not refer to a single vulnerability — it is the colloquial name for a variety of security flaws in the Microsoft Windows Print Spooler service used to manage access to printing processes, resulting in privilege escalation or remote code execution exploits. Windows enables the Print Spooler service by default, and the critical vulnerabilities associated with PrintNightmare allow attackers to run arbitrary code, modify data, or move laterally across networks.

Magniber and Vice Society ransomware leveraged more than one PrintNightmare vulnerability in their attacks. Both groups used CVE-2021-1675 and CVE-2021-34527, and Magniber also used CVE-2021-36958 when infecting Windows operating systems. Although security researchers worked quickly to push a fix for the flawed software, further investigation into the Print Spooler services revealed that some vulnerabilities allowed attackers to gain SYSTEM privileges in Windows. Additionally, some of the patches released by Microsoft to fix the vulnerabilities led researchers to discover ways in which attackers could exploit the "Point and Print" feature in Windows printing services.

When PrintNightmare was first disclosed in June 2021, security researchers attributed the vulnerability to CVE-2021-1675 until a deep-dive analysis revealed that the flaw was slightly different, in that CVE-2021-1675 was a privilege escalation vulnerability. The new flaw was a remote code execution, thus receiving the label CVE-2021-34527. Additional issues emerged following updates to the PrintNightmare vulnerabilities, including a patch that would affect organizations that use networked printers. Essentially, enabling the patch prevented elevated users from installing printer drivers from remote servers. Although Microsoft provided mitigations for the printer issues, they later recommended against the mitigations claiming it was a risk that would expose the affected environment to Print Spooler service vulnerabilities.

PrintNightmare References on Cybercrime Forums and Networks

Despite available proof-of-concept (PoC) code for researchers to analyze PrintNightmare vulnerabilities, ZeroFox Research observed actors advertising PrintNightmare on three different Russian-speaking underground forums and marketplaces in June, July, and August 2021. While two of the three postings specifically reference CVE-2021-1675, the remaining post simply references "PrintNightmare" in the advertisement.

The first instance of PrintNightmare discussion involved an actor using the alias "pixe1" on a Russian-speaking forum posting about CVE-2021-1675 in June 2021. The actor linked a GitHub file containing a write-up on the vulnerability, posted a screenshot running the CVE code, and commented that it was a serious vulnerability in the Windows Print Spooler service that needs attention. The post has a reply from another actor commenting that the CVE uses remote code execution specifically for domain networks. Figure 1 is a screenshot of the thread translated from Russian to English.

Figure 1 Figure 1. Actor "pixe1" opens a thread on a Russian-speaking forum on CVE-2021-1675

The second instance occurred in late July 2021 when the actor "LORD1" advertised the sale of a penetration testing tool, Core Impact 2.1, as well as a PrintNightmare exploit integrated into the tool for USD 5,000 (Figure 2). The seller also states that PrintNightmare PoCs are publicly available for actors interested in purchasing exploit code.

Figure 2 Figure 2. Actor "LORD1" advertises the sale of Core Impact 2.1 containing PrintNightmare exploit code

The third instance of a PrintNightmare advertisement was when the actor "wav" advertised the sale of CVE-2021-1675 in August 2021. The actor claimed that the exploit was in PowerShell format (ps1) included an applied DLL file, and is supposedly encrypted from the Windows Antimalware Scan Interface (AMSI) and antivirus detection software. Figure 3 is a screenshot of the posting.

Figure 3 Figure 3. Actor "wav" advertises the sale of CVE-2021-1675 in PowerShell format with an applied DLL file

Conclusion

The number of vulnerabilities discovered in the Print Spooler service and the attempts at providing patches and recommendations to mitigate the issues highlight the severity of PrintNightmare and the need to remediate the vulnerabilities. Vice Society and Magniber demonstrated that using one more PrintNightmare flaw led to successful infections on their targets to encrypt and extort the target's sensitive data. Mitigating some of the PrintNightmare flaws introduced new obstacles to address security concerns and additional risks if specific patches were applied to vulnerable systems. The PrintNightmare exploits also demonstrated how ransomware operators could quickly leverage newly disclosed vulnerabilities in their attacks, as it can be advantageous and lead to a successful infection. Furthermore, more threat actors can continue using the PrintNightmare flaws against their targets if vulnerable systems remain unprotected.

Breaking News: 2021-08-27 - 2021-09-02

Ragnarok ransomware releases master decryptor after shutdown

Ragnarok ransomware gang released the master key that can decrypt files locked with their malware. The threat actor did not leave a note explaining the move and replaced all the victims on their leak site with a short instruction on how to decrypt files. Security researchers say, the Ragnarok decryptor released contains the master decryption key which makes the utility a master decryptor that can be used to unlock files with various Ragnarok ransomware extensions.

See the full report here: https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-releases-master-decryptor-after-shutdown/

FBI shares technical details for Hive ransomware

The Federal Bureau of Investigation (FBI) has released some technical details and indicators of compromise associated with Hive ransomware attacks. Along with indicators of compromise (IoCs), the FBI also provides a link to the threat actor’s leak site, a detail that is typically hidden in technical reports. The FBI notes that the threat actor also relies on file-sharing services, many of them anonymous, like Anonfiles, MEGA, Send[.]Exploit, Ufile, or SendSpace. Regardless of ransomware victim's decision to pay or not, the FBI urges companies to report ransomware incidents.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-shares-technical-details-for-hive-ransomware/

Synology: Multiple products impacted by OpenSSL RCE vulnerability

Taiwan-based network-attached storage (NAS) maker Synology has revealed that recently disclosed remote code execution (RCE) and denial-of-service (DoS) OpenSSL vulnerabilities impact some of its products. The list of devices affected by the security flaws tracked as CVE-2021-3711 and CVE-2021-3712 includes DSM 7.0, DSM 6.2, DSM UC, SkyNAS, VS960HD, SRM 1.2, VPN Plus Server, and VPN Server. Although the OpenSSL development team has published OpenSSL 1.1.1l to address the two flaws, Synology does not provide an estimated timeline for releasing security updates.

See the full report here: https://www.bleepingcomputer.com/news/security/synology-multiple-products-impacted-by-openssl-rce-vulnerability/

Kaseya patches Unitrends server zero-days, issues client mitigations

Kaseya Unitrends is a cloud-based enterprise backup and recovery solution provided as a stand-alone solution or an add-on for Kaseya's VSA remote management platform. The American company has issued a security update to patch server-side Kaseya Unitrends zero-day vulnerabilities found by security researchers. The company released Unitrends version 10.5.5-2 on August 12 to patch the two server vulnerabilities and is working on a fix for a third unauthenticated remote code execution flaw impacting the client. The owners are urged to get vulnerable servers offline until a patch was released.

See the full report here: https://www.bleepingcomputer.com/news/security/kaseya-patches-unitrends-server-zero-days-issues-client-mitigations/

VMware addressed 4 High-Severity flaws in vRealize Operations

VMware addressed multiple vulnerabilities in vRealize Operations, including four high severity flaws that could be exploited by an attacker to control an affected system. According to VMware, along with vRealize Operations Manager, VMware Cloud Foundation (vROps) and vRealize Suite Lifecycle Manager (vROps) are affected as well. Users are advised to install the patches.

See the full report here: https://securityaffairs.co/wordpress/121462/security/vmware-vrealize-operations-flaws-2.html?utm_source=rss&utm_medium=rss&utm_campaign=vmware-vrealize-operations-flaws-2

Chinese developers expose data belonging to Android gamers

vPnMentor’s research team discovered a data breach belonging to Chinese mobile gaming company EskyFun. The exposed server has alleged to contain 365,630,387 records from June 2021. The records included IP and IMEI numbers, device information, phone numbers, the OS in use, mobile device event logs, whether or not a handset was rooted; game purchase and transaction reports, email addresses, EskyFun account passwords stored in plaintext, and support requests, among other data. The unsecured server exposed over one million people to phishing & fraud, Corporate espionage attacks.

See the full report here: https://www.zdnet.com/article/chinese-developers-expose-data-belonging-to-android-gamers/

T-Mobile CEO: Hackers brute-forced their way through our network - BleepingComputer

According to a new statement by T-Mobile officials, the hacker behind the carrier's latest massive data breach brute forced his way through T-Mobile's network after gaining access to testing environments. The stolen information included 54.6 million current, former, or prospective customers, containing Social Security numbers, phone numbers, names, addresses, dates of birth, T-Mobile prepaid PINs, and driver license/ID information. The attacker did not exfiltrate customer financial information, credit card information, debit or other payment information during the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-ceo-hacker-brute-forced-his-way-through-our-network/

FIN8 Targets US Bank With New ‘Sardonic’ Backdoor

Security researchers have discovered a new backdoor, named Sardonic that is being used by FIN8 cybergang to target U.S. financial organizations. Sardonic is an updated version of BadHatch backdoor and is still under development. The backdoor is extremely potent and has a wide range of capabilities that help the threat actor leverage new malware on the fly without updating components.

See the full report here: https://threatpost.com/fin8-bank-sardonic-backdoor/168982/

Boston Public Library discloses cyberattack, system-wide technical outage

The Boston Public Library (BPL) has disclosed today that its network was hit by a cyberattack on Wednesday, leading to a system-wide technical outage pausing public computer and public printing services, as well as some online resources. Affected systems in BPL were taken offline immediately, and proactive steps were taken to isolate the problem and shutdown network communication. BPL's IT department is now restoring all affected devices and services, with physical locations some online services still available.

See the full report here: https://www.bleepingcomputer.com/news/security/boston-public-library-discloses-cyberattack-system-wide-technical-outage/

Quebec vaccine passport app hacked within days after launch - MobileSyrup

Quebec’s digital vaccination passport system is under fire in two days since launched as computer programmers are demonstrating how easy it is to hack the province’s new VaxiCode app. The app works as a digital wallet for the unique quick response (QR) codes given to Quebec residents as proof of vaccination. The QR codes contain sensitive information including names, birthdates, vaccination dates, and vaccination types. A hacker group used the newly released app to access the personal QR codes of several notable Quebec politicians.

See the full report here: https://mobilesyrup.com/2021/08/27/quebec-vaccine-passport-app-hacked-within-days-after-launch/

Microsoft Azure vulnerability exposed thousands of cloud databases

Microsoft is warning customers of its Azure cloud platform about a software vulnerability that exposed data belonging to thousands of clients including some numbers from Fortune 500 companies for roughly two years. There was no evidence that hackers exploited the vulnerability to access customer data, according to the company. But the Wiz researchers reported that, Microsoft fixed the vulnerability within 48 hours of its disclosure August 12, but that the vulnerability had been exploitable since mid-2019. Microsoft has asked customers to reset keys to their accounts as a precautionary measure.

See the full report here: https://www.cyberscoop.com/microsoft-azure-cloud-vulnerability/

EskyFun data leak, over 1 million Android gamers impacted

vpnMentor’s researchers discovered that the Chinese mobile gaming company EskyFun suffered a data breach, information of over 1 million gamers were exposed on an unsecured server. The experts pointed out that the gaming firm was collecting a large amount of data when users install their games. vpnMentor reported that the server was containing 134GB of data.

See the full report here: https://securityaffairs.co/wordpress/121589/data-breach/eskyfun-data-leak.html

NAS-maker Synology reveals new remote code execution vulnerabilities - Techradar

The Taiwan-based maker of network-attached storage (NAS) devices, Synology, has revealed that some of its devices are susceptible to the vulnerabilities reported by OpenSSL. OpenSSL, tracked as CVE-2021-3711 and CVE-2021-3712. OpenSSL manifests these vulnerabilities as remote code execution (RCE) and denial-of-service (DoS) bugs in its devices. Synology hasn’t yet published a timeline for patching its impacted devices while the two bugs that impact OpenSSL have already been fixed upstream.

See the full report here: https://www.techradar.com/sg/news/nas-maker-synology-reveals-new-remote-code-execution-vulnerabilities

Cisco says it will not release software update for critical 0-day in EOL VPN routers - ZDNet

Cisco announced recently that it will not be releasing software updates for a vulnerability with its Universal Plug-and-Play (UPnP) service in Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. The vulnerability allows unauthenticated, remote attackers to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition.

See the full report here: https://www.zdnet.com/article/cisco-not-planning-to-fix-critical-0-day-rce-vulnerability-in-eol-vpn-routers/

Cloudflare says it stopped the largest DDoS attack ever reported - ZDNet

Cloudflare said its system managed to stop the largest reported DDoS attack in July, explaining in a blog post that the attack was 17.2 million requests-per-second, three times larger than any previous one they recorded. Cloudflare's Omer Yoachimik explained in a blog post that the company serves over 25 million HTTP requests per second on average in 2021 Q2, illustrating the enormity of the attack.

See the full report here: https://www.zdnet.com/article/cloudflare-says-it-stopped-the-largest-ddos-attack-ever-reported/

Atlassian released security patches to fix a critical flaw in Confluence

Atlassian released security patches to address a critical vulnerability, tracked as CVE-2021-26084, affecting the Confluence enterprise collaboration product. The flaw is an OGNL injection issue that can be exploited by an authenticated attacker to execute arbitrary code on affected Confluence Server and Data Center instances.

See the full report here: https://securityaffairs.co/wordpress/121547/security/atlassian-confluence-rce.html?utm_source=rss&utm_medium=rss&utm_campaign=atlassian-confluence-rce

Millions-worth of cyberattack on rights group website traced to Israeli IT firm - Bulatlat

Sweden-based digital forensic group Qurium Media Foundation has traced the massive and well-funded cyberattacks on the website of human rights group Karapatan to an Israeli IT firm, estimating that the cost of carrying out such an attack could be at least P13 million or $260,000. The cyberattacks against Karapatan began last month, where networks of infected devices flooded sites with the request, overwhelming its servers and taking it offline, also known as Distributed Denial of Service (DDoS) attacks.

See the full report here: https://www.bulatlat.com/2021/08/28/millions-worth-of-cyberattack-on-rights-group-website-traced-to-israeli-it-firm/

Microsoft Warns of Widespread Phishing Attacks Using Open Redirects

Microsoft is warning of a widespread credential phishing campaign that leverages open redirector links in email communications as a vector to trick users into visiting malicious websites while effectively bypassing security software. Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking, Microsoft 365 Defender Threat Intelligence Team said in a report published this week.

See the full report here: https://thehackernews.com/2021/08/microsoft-warns-of-widespread-phishing.html

LockFile Ransomware Bypasses Protection Using Intermittent File Encryption

A new ransomware family that emerged last month comes with its bag of tricks to bypass ransomware protection by leveraging a novel technique called intermittent encryption. Called LockFile, the operators of the ransomware have been found exploiting recently disclosed flaws such as ProxyShell and PetitPotam to compromise Windows servers and deploy file-encrypting malware that scrambles only every alternate 16 bytes of a file, thereby giving it the ability to evade ransomware defenses.

See the full report here: https://thehackernews.com/2021/08/lockfile-ransomware-bypasses-protection.html

Boston Public Library Hit With Cyberattack

Recently, the Boston Public Library was hit with a cyberattack that took down most of its computer network, the library said in a statement. They also added that there is no evidence that sensitive employee or patron data has been compromised. Affected systems were taken offline immediately, and proactive steps were taken to isolate the problem and shut down network communication.

See the full report here: https://www.securityweek.com/boston-public-library-hit-cyberattack

There's a new COVID phishing scam  #securityawareness #cybersecurity #phishing

In a new phishing scam, cybercriminals are relying on pandemic-themed emails to steal credentials, according to a new report from Proofpoint. Proofpoint spotted huge phishing campaigns in which attackers pretended to be from corporate HR departments and asked victims to submit information related to their vaccination statuses. The researchers are recommending that people should check thoroughly before submitting any COVID-19 updates.

See the full report here: https://attacksimulator.com/blog/phishing-scam-asks-for-vaccination-proof/

1 GB of data belonging to Puma available on Marketo

Threat actors claim to have stolen 1 GB of data from the sportswear manufacturer Puma company. The emerging underground marketplace of stolen data ‘Marketo’ available in TOR network announced the publication of data. Experts that have analyzed the code have found evidence that the files of the organizations might have been stolen as a result of a data breach of a third-party software provider.

See the full report here: https://securityaffairs.co/wordpress/121617/cyber-crime/puma-available-marketo.html

Hackers steal thousands of Microsoft user data – CVBJ - Central Valley Business Journal

Microsoft informed thousands of cloud service users that their databases were at risk and that hackers could have access to their information because the company experienced vulnerability in the flagship database of Azure, Cosmos DB. The intruders might be able to read, change or even delete their main databases. Microsoft asked its customers to change their passwords as they as a company could not change them themselves.

See the full report here: https://www.cvbj.biz/2021/08/30/hackers-steal-thousands-of-microsoft-user-data/

LockBit Gang to Publish 103GB of Bangkok Air Customer Data

The LockBit ransomware gang has stolen 103GB worth of files from Bangkok Airways and promising to release them on Tuesday. On Thursday, Bangkok Airways publicly acknowledged that it had been blasted with a cyberattack a week ago, on Monday, Aug. 23. It’s still investigating the incident as a matter of urgency, the company said in a press release and is working on beefing up its defenses.

See the full report here: https://threatpost.com/lockbit-bangkok-airways-breach/169019/

Google App bug blocks Android users from receiving, making calls - BleepingComputer

Google says that users of some Android phone models are affected by a Google App bug preventing them from making and receiving calls. The company has released an update that should likely fix this known issue on impacted Android devices. However, given that the Google Android app has over 5 billion installs worldwide, some of the users are likely still affected even with automatic updates toggled on.

See the full report here: https://www.bleepingcomputer.com/news/google/google-app-bug-blocks-android-users-from-receiving-making-calls/

QNAP works on patches for OpenSSL bugs impacting its NAS devices - BleepingComputer

Network-attached storage (NAS) maker QNAP is investigating and working on security updates to address remote code execution (RCE) and denial-of-service (DoS) vulnerabilities patched by OpenSSL last week. The security flaws tracked as CVE-2021-3711 and CVE-2021-3712 impact QNAP NAS device running QTS, QuTS hero, QuTScloud, and HBS 3 Hybrid Backup Sync (a backup and disaster recovery app), according to advisories published earlier yesterday.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-works-on-patches-for-openssl-bugs-impacting-its-nas-devices/

HPE Warns Sudo Bug Gives Attackers Root Privileges to Aruba Platform

Hewlett Packard Enterprise (HPE) is warning of a vulnerability in Sudo, an open-source program used within its Aruba AirWave management platform that could allow an unprivileged and unauthenticated local user to gain root privileges on a vulnerable host. Rated high in severity, HPE warns the Sudo flaw could be part of a chained attack where an attacker has achieved a foothold with lower privileges via another vulnerability and then uses this to escalate privileges.

See the full report here: https://threatpost.com/hpe-sudo-bug-aruba-platform/169038/

Boffins find if you torture AMD Zen+, Zen 2 CPUs enough, they are vulnerable to Meltdown-like attack

Computer scientists at TU Dresden in Germany have found that AMD's Zen processor family is vulnerable to a data-bothering Meltdown-like attack after all. Exploiting this weakness is an academic exercise, it seems; there are more practical and easier ways for malware and malicious users to interfere with systems.

See the full report here: https://www.theregister.com/2021/08/30/amd_meltdown_zen/

New Microsoft Exchange 'ProxyToken' Flaw Lets Attackers Reconfigure Mailboxes

Technical details have emerged on a severe vulnerability in Microsoft Exchange Server dubbed ProxyToken that does not require authentication to access emails from a target account. An attacker can exploit the vulnerability by crafting a request to web services within the Exchange Control Panel (ECP) application and steal messages from a victim’s inbox.

See the full report here: https://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html

CISA Expands 'Bad Practices' List With Single-Factor Authentication

The US Cybersecurity and Infrastructure Security Agency (CISA) added single-factor authentication to its list of bad practices. As such, the use of a strong 2FA method is recommended in all instances, especially when it comes to remote access to enterprise environments or critical systems. Organizations in all sectors are encouraged to review CISA’s Bad Practices list and take the necessary steps to ensure they address any security weaknesses in their implementations.

See the full report here: https://www.securityweek.com/cisa-expands-bad-practices-list-single-factor-authentication

US officials, experts fear China ransacked Exchange servers for data to train AI systems

The massive cyber attack on Microsoft Exchange servers in March may have been China harvesting information to train AI systems, according to US government officials and computer-security experts. This cyber attack was attributed to Chinese government cyber-spies known as Hafnium; Beijing denied any involvement. It's said the crew exploited four zero-days in Redmond's mail software in a chain to hijack the servers and siphon off data.

See the full report here: https://www.theregister.com/2021/08/31/in_brief_security/

WooCommerce Pricing Plugin Allows Malicious Code-Injection - Threatpost

The Dynamic Pricing and Discounts plugin from Envato can be exploited by unauthenticated attackers. This can result in a variety of attacks, including website redirections to phishing pages, insertion of malicious scripts on product pages, and more. The second bug exists because a core export function lacks a capability check and is accessible to everyone, authenticated or not. Although the issues are patched in version 2.4.2, the CSRF check is still not fixed according to the researchers.

See the full report here: https://threatpost.com/woocommerce-plugin-malicious/169063/

Hackers Reveal New Iran Documents Showing Fear Of Foreign Attack - Iran International

‘Ali’s Justice’ hacking group has been releasing images of abuse taken from the surveillance systems of Tehran’s notorious Evin prison and confidential documents in the past few days. Iran International received a series of new documents showing that Iran’s prison system’s security unit was not only concerned about a foreign attack but also a great weakness in protecting information. Iran’s Judiciary and other officials have acknowledged the authenticity of “some” images and have launched investigations regarding the abuse.

See the full report here: https://iranintl.com/en/iran/hackers-reveal-new-iran-documents-showing-fear-foreign-attack

Indonesian authorities probe million-record leak from national COVID app

Million records from Indonesia's national COVID-19 quarantine management app, eHAC, has been exposed. The app is mandatory for use by travelers moving into and out of Indonesia, or within its borders. The site's researchers stated that they were able to access personally identifiable information, travel information, medical records, and COVID-19 status. The Ministry acknowledged allegations of the leak and stated that it and the Ministry of Health have opened an investigation.

See the full report here: https://www.theregister.com/2021/09/01/indonesia_ehac_covid_app_pii_leak/

SEC Sanctions Several Companies Over Email Account Hacking

The U.S. Securities and Exchange Commission (SEC) announced sanctions against a total of eight entities belonging to three companies over cybersecurity failures that resulted in email accounts getting hacked and the exposure of customer information. Companies including Cetera, Cambridge Investment Research, and KMS Financial Services has got sanctioned by SEC. Without admitting or denying the SEC's findings, each firm agreed to cease and desist from future violations of the charged provisions, to be censured and to pay a penalty.

See the full report here: https://www.securityweek.com/sec-sanctions-several-companies-over-email-account-hacking

How to block Windows Plug-and-Play auto-installing insecure apps

A solution has been found that prevents devices from being taken over by vulnerable Windows applications when devices are plugged into computer. Windows may install a vendor’s application by simply plugging in a device that allows regular users to quickly gain SYSTEM privileges. This vulnerability was discovered in apps known as "co-installers”, which will be executed after Windows Plug-and-Play installs the driver. This can be fixed through configure a Windows Registry value that blocks co-installers from being installed during the Plug-and-Play feature.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/how-to-block-windows-plug-and-play-auto-installing-insecure-apps/

WhatsApp Photo Filter Bug Could Have Exposed Your Data to Remote Attackers

A recently patched high-severity vulnerability in WhatApp's image filter feature could have been abused to send a malicious image over the messaging app to read sensitive information from the app's memory. This flaw was tracked by the CVE with an out-of-bounds read/write vulnerability. WhatsApp reported with no reason to believe users would have been impacted by this bug.

See the full report here: https://thehackernews.com/2021/09/whatsapp-photo-filter-bug-could-have.html

Increase in credential #phishing and brute force attacks causing financial and reputational damage #Sec_Cyber

Abnormal Security released a report with several key findings which examines the escalating adverse impact of socially-engineered and never-seen-before email attacks threatens both financial and reputational to organizations worldwide. Over the course of the quarter, researchers saw a significant increase in credential phishing, brute force attacks. The report also underlines that impersonation is on the rise, with threat actors using both well-known brands and internal automated systems to trick their victims. In fact, impersonation of internal systems like IT Help Desk and IT Support rose 46% over the past two quarters.

See the full report here: https://www.helpnetsecurity.com/2021/08/31/increase-in-credential-phishing/

FTC Bans Stalkerware App SpyFone; Orders Company to Erase Secretly Stolen Data

The stalkerware app company called SpyFone, a surveillance business app was banned by FTC from the surveillance business over concerns that it stealthily harvested and shared data on people's physical movements, phone use, and online activities that were then used by stalkers and domestic abusers to monitor potential targets due to not implementing adequate protections to secure amassed data. FTC call the app developers and ordered to delete the illegally harvested information and notify device owners that the app had been secretly installed on their phones.

See the full report here: https://thehackernews.com/2021/09/ftc-bans-stalkerware-app-spyfone-orders.html

Tags: weekly bulletin, all industries, global