Threat Intelligence Bulletin: 09/03/2021 - 09/09/2021

Breaking News: 2021-09-03 - 2021-09-09

Over 60,000 parked domains were vulnerable to AWS hijacking - BleepingComputer

Domain registrar MarkMonitor had left more than 60,000 parked domains vulnerable to domain hijacking. The parked domains were seen pointing to nonexistent Amazon S3 bucket addresses, hinting that there existed a domain takeover weakness. An attacker can then take over the vulnerable domain in the sense that they can begin serving their own content at the location where the domain's dangling DNS entry is pointing to. The company is investigating the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/over-60-000-parked-domains-were-vulnerable-to-aws-hijacking/

US govt warns orgs to patch massively exploited Confluence bug - BleepingComputer

US Cyber Command (USCYBERCOM) has issued an alert via Twitter today urging US organizations to patch a massively exploited Atlassian Confluence critical bug immediately. The vulnerability is tracked as CVE-2021-26084 and enables unauthenticated attackers to execute commands on a vulnerable server remotely. According to the reports, multiple threat actors began scanning for and exploiting this recently disclosed Confluence RCE vulnerability to install crypto miners after a PoC exploit was publicly released six days after Atlassian's patches were issued.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-orgs-to-patch-massively-exploited-confluence-bug/

Conti ransomware now hacking Exchange servers with ProxyShell exploits - BleepingComputer

The Conti ransomware gang is hacking into Microsoft Exchange servers and breaching corporate networks using recently disclosed ProxyShell vulnerability exploits. ProxyShell is the name of an exploit utilizing three chained Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) that allow unauthenticated, remote code execution on unpatched vulnerable servers. As the threat actors compromised various servers, they would install multiple tools to provide remote access to the devices, such as AnyDesk and Cobalt Strike beacons.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-now-hacking-exchange-servers-with-proxyshell-exploits/

Babuk ransomware's full source code leaked on hacker forum

A threat actor has leaked the complete source code for the Babuk ransomware on a Russian-speaking hacking forum since they shut down their operation due to the tight pressure from U.S. law enforcement after Washinton DC's MPD got attacked. Babuk Locker, ransomware operation uses elliptic-curve cryptography (ECC) as part of its data encryption in double-extortion attacks. Leaked file with 15 folders contains different Visual Studio Babuk ransomware projects for VMware ESXi, NAS, and Windows encryptors, everything a threat actor needs to create a functional ransomware executable.

See the full report here: https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum/

New Zealand internet outage blamed on DDoS attack on nation's third largest internet provider

The major local ISP in New Zealand was hit by an aggressive DDoS attack which causes significant internet disruption across the country and affected many people working from home. Vocus, the country's third-largest internet operator has reported that one of their customer was under DDoS attack and a DDoS mitigation rule was updated to their Arbor DDoS platform to block the attack for the end customer. It appears that services were returning to normal after 30 min of outage. Several other internet providers from different countries are also reported their internet outage due to DDOS attack recently.

See the full report here: https://www.theregister.com/2021/09/03/nz_outage/

Facebook users hacked by Postcode Lottery scammers - The Star

A new scam has been spreading in South Yorkshire targeting the social media users where cybercriminals are able to access social media accounts and then pose as someone the user trust to trick the user into giving away personal details. As part of the scam, they are also then able to target the victim's friends for more data. A victim of cybercrime or fraud must report the same to the concerned authorities like in this case to Action Fraud by visiting www.actionfraud.police.uk.

See the full report here: https://www.thestar.co.uk/news/crime/facebook-users-hacked-by-postcode-lottery-scammers-3371282

Android users urged to delete 8 popular apps that could steal your money - Salisbury Journal

A warning has been released by Belgium police stating that the Joker virus is back in the Android environment and has been spotted in 8 Android Apps. The Apps are Auxiliary Message, Element Scanner, Fast Magic SMS, Free CamScanner, Go Messages, Super Message, Great SMS, and Travel Wallpapers. Google withdrew the apps from the Play Store but if Android users have already installed one, remove it as soon as possible.

See the full report here: https://www.glasgowtimes.co.uk/news/national/uk-today/19557234.android-users-urged-delete-8-popular-apps-steal-money/

Microsoft Says Chinese Hackers Were Behind SolarWinds Serv-U SSH 0-Day Attack

Microsoft has shared technical details about a now-fixed, actively exploited security vulnerability affecting SolarWinds Serv-U managed file transfer service that it has attributed to a threat actor operating out of China. The revelations highlight the variety of techniques and tools used by threat actors to breach corporate networks, including piggybacking on legitimate software. Cybersecurity firm Secureworks connected the intrusions to a China-linked threat actor called Spiral.

See the full report here: https://thehackernews.com/2021/09/microsoft-says-chinese-hackers-were.html

Watch out for new malware campaign”s 'Windows 11 Alpha' attachment - BleepingComputer

A threat actor group has deployed a malware campaign recently that used a Windows 11 theme to lure recipients into activating malicious code placed inside Microsoft Word documents. Security researchers believe that the adversary behind the operations may be the FIN7 cybercrime group, also known as Carbanak and Navigator, that specializes in stealing payment card data.

See the full report here: https://www.bleepingcomputer.com/news/security/watch-out-for-new-malware-campaign-s-windows-11-alpha-attachment/

Apple Delays Plans to Scan Devices for Child Abuse Images After Privacy Backlash

Apple is temporarily hitting the pause button on its controversial plans to screen users' devices for child sexual abuse material (CSAM) after receiving sustained blowback over worries that the tool could be weaponized for mass surveillance and erode the privacy of users. Based on feedback from customers, advocacy groups, researchers, and others, we have decided to take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features, the iPhone maker said in a statement on its website.

See the full report here: https://thehackernews.com/2021/09/apple-delays-plans-to-scan-devices-for.html

Hackers increasingly relying on dropper-as-a-service platforms to distribute malware - Techradar

According to cybersecurity researchers, malware authors are increasingly relying on dropper-as-a-service (DaaS) platforms to distribute their malicious creations. In its latest research, Sophos has shared details about the growth of such DaaS platforms that infect victims who frequent piracy websites looking for cracked versions of popular business and consumer applications.

See the full report here: https://www.techradar.com/au/news/hackers-increasingly-relying-on-dropper-as-a-service-platforms-to-distribute-malware

Google's TensorFlow drops YAML support due to code execution flaw - BleepingComputer

TensorFlow is a free and open-source software library for machine learning and artificial intelligence. Yet Another Markup Language(YAML)is a human-readable data-serialization language that is commonly used for configuration files and in applications where data is being stored or transmitted.YAML assistance has been dropped by TensorFlow because of a code execution flaw.

See the full report here: https://www.bleepingcomputer.com/news/security/googles-tensorflow-drops-yaml-support-due-to-code-execution-flaw/

Windows 11 dark mode has quieter, more soothing sounds - Listen now - BleepingComputer

Microsoft has updated the user interface and the system sounds that include different sounds for Light Mode and Dark Mode in Windows 11. For Light Mode users, the sounds are meant to be brighter and louder, while in Dark Mode, the sounds will be quieter and more subdued with a slight echo.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-dark-mode-has-quieter-more-soothing-sounds-listen-now/

Pacific City Bank hit by AVOS Locker Ransomware

Pacific City Bank was hit by AVOS Locker Ransomware operators, the cybercriminals claims to have stolen sensitive files from the company and threaten to leak them. On September 4, 2021, the ransomware gang added the bank to its leak site and published some screenshots as proof of the hack.

See the full report here: https://securityaffairs.co/wordpress/121872/cyber-crime/pacific-city-bank-avos-locker-ransomware.html

Salesforce Email Service Used for Phishing Campaign | eSecurityPlanet - eSecurity Planet

Cybercriminals are using Salesforce’s mass email service to dupe people into handing over credit card numbers, credentials, and other personal information in a novel phishing campaign that highlights the threats to corporate networks that can come from whitelisted email addresses. According to the Perception Point, the bad actors are sending phishing emails via the Salesforce email service by impersonating the Israel Postal Service in a campaign that has targeted multiple Israeli organizations.

See the full report here: https://www.esecurityplanet.com/threats/salesforce-email-service-used-for-phishing-campaign/

Kaspersky researchers reveal QakBot, a powerful banking Trojan - SecurityBrief Asia

According to new research from Kaspersky, there is an increase in the number of users attacked with QakBot, a banking Trojan in 2021 in comparison to the year 2020. The research revealed that the banking Trojan is adding new capabilities and updating its modules in order to maximize the revenue impact, along with stealing details and information which indicates that QakBot is unlikely to stop its activity anytime soon.

See the full report here: https://securitybrief.co.nz/story/kaspersky-researchers-reveal-qakbot-a-powerful-banking-trojan

Major IPS in New Zealand hit by massive DDoS, Internet outages reported

A massive DDoS hit Vocus ISP, New Zealand‘s internet operator, isolating parts of the country from the Internet. This cyber-attack had affected a range of Vocus customers for approximately 30 minutes. Some Vocus customers in multiple cities, including Auckland, Wellington, and Christchurch, suffered outages. The company quickly restored the operations and apologized for the inconvenience it has caused to the customers.

See the full report here: https://securityaffairs.co/wordpress/121856/hacking/new-zealand-ddos.html

Breach Exposed Dallas Student, Parent, Teacher Personal Data

The Dallas public school system suffered from a data breach and exposed the personal information of students, parents, teachers, and staff dating to 2010. In statements posted to its website, the Dallas Independent School District said that an unauthorized third party downloaded the sensitive data and stored it temporarily on an encrypted cloud storage site.

See the full report here: https://www.securityweek.com/breach-exposed-dallas-student-parent-teacher-personal-data

FBI Warns Ransomware Attack Could Disrupt Food Supply Chain

FBI has sent out a Private Industry Notification to warn organizations in the Food and Agriculture sector about an increase in ransomware attacks that could and impact the food supply chain. Food and agriculture businesses victimized by ransomware suffer significant financial losses. Thus, the FBI recommends that all organizations should implement security practices to reduce the possibility of risk.

See the full report here: https://www.securityweek.com/fbi-warns-ransomware-attack-could-disrupt-food-supply-chain

Office 365 to let admins block Active Content on Trusted Docs

Microsoft plans to allow Office 365 admins ensure that end-users can't ignore organization-wide policies set up to block active content on Trusted Documents. Microsoft plans to roll out this new feature by the end of October, making it generally available worldwide in all environments.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-to-let-admins-block-active-content-on-trusted-docs/

ProtonMail Shares Activist's IP Address With Authorities Despite Its "No Log" Claims - The Hacker News

ProtonMail, an end-to-end encrypted email service provider, facing criticism after it ceded to a legal request and shared the IP address of anti-gentrification activists with law enforcement authorities, leading to their arrests in France. It is recommended that ProtonMail users who are concerned about the visibility of their IP addresses should use a VPN or access the email service over the Tor network for additional anonymity.

See the full report here: https://thehackernews.com/2021/09/protonmail-shares-activists-ip-address.html

Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released

Recently Netgear issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The vulnerabilities are critical in nature and thus companies relying on the vulnerable Netgear switches are recommended to upgrade to the latest version as soon as possible to mitigate any potential exploitation risk.

See the full report here: https://thehackernews.com/2021/09/critical-auth-bypass-bug-affect-netgear.html

Howard University investigating ransomware attack - The Washington Post

Howard University fell victim to a ransomware cyberattack that disrupted Internet service across its Northwest Washington campus through the weekend. According to a statement released by the university, Howard officials took many of their university systems offline and the investigation about the cyber incident is ongoing.

See the full report here: https://www.washingtonpost.com/education/howard-university-ransomware-attack/2021/09/06/e2bbfb0c-0f66-11ec-bc8a-8d9a5b534194_story.html

TrickBot gang developer arrested when trying to leave Korea

The TrickBot cybercrime group is responsible for a variety of sophisticated malware targeting Windows and Linux devices to gain access to victim's networks, steal data, and deploy other malware, such as ransomware. An alleged Russian developer for the notorious TrickBot malware gang was arrested in South Korea after attempting to leave the country. However, the Russian man claims that he had no idea that he was working with a cybercrime gang after getting hired from an employment site.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/

REvil ransomware servers mysteriously come back online

The dark web servers for the REvil ransomware operation have suddenly turned back on after an almost two-month absence. It is unclear if this marks their ransomware gang's return or the servers being turned on by law enforcement. The REvil ransomware gang disappeared last July, due to increased pressure from law enforcement and the White House on REvil’s last attack and demand on Kaseya. But today, both the Tor payment/ negotiation site and Tor 'Happy Blog' data leak site suddenly came back online.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-servers-mysteriously-come-back-online/

McDonald's leaks password for Monopoly VIP database to winners

A bug in the McDonald's Monopoly VIP game where the customers can win several prizes hosted in the United Kingdom this year Aug 25th caused the login names and passwords for the game's both production and staging database servers to be in prize redemption emails sent to prize winners. As these databases may have contained winning prize codes, it could have allowed an unscrupulous person to download unused game codes to claim the prizes. Luckily, a person responsibly disclosed the issue with McDonald's, and while they did not receive a response, they later found that the staging server's password was soon changed.

See the full report here: https://www.bleepingcomputer.com/news/security/mcdonalds-leaks-password-for-monopoly-vip-database-to-winners/

Experts Uncover Mobile Spyware Attacks Targeting Kurdish Ethnic Group

Cybersecurity researchers released new findings that reveal a year-long mobile espionage campaign against the Kurdish ethnic group to deploy two Android backdoors that masquerade as legitimate apps. It targeted the Kurdish ethnic group through at least 28 malicious Facebook posts that would lead potential victims to download Android 888 RAT or SpyNote. The operators shared a Facebook post urging users to download a "new snapchat" app that's designed to capture Snapchat credentials via a phishing website. According to ESET, several countries were most infected by this espionage campaign.

See the full report here: https://thehackernews.com/2021/09/experts-uncover-mobile-spyware-attacks.html

Germany Protests to Russia Over Pre-Election Cyberattacks

Germany has protested to Russia over attempts to steal data from lawmakers by a hacker outfit called Ghostwriter, in what it suspects may have been preparation to spread disinformation before the upcoming German parliamentary election. Germany calls on the Russian government to end such activity immediately, and has made that demand directly to Russian officials.

See the full report here: https://www.securityweek.com/germany-protests-russia-over-pre-election-cyberattacks

A server of the Jenkins project hacked by exploiting a Confluence flaw

A security breach in Jenkins server has been disclosed after threat actors compromised one of their internal servers and installed a cryptocurrency miner. Jenkins is the most popular open-source automation server. The attackers breached a deprecated Confluence service used by the organization exploiting the Confluence CVE-2021-26084 vulnerability. In response to the incident, the Jenkins team took the affected server offline and launched an investigation into the security incident. Last week, Atlassian released security patches to address this flaw that affects the Confluence enterprise collaboration product.

See the full report here: https://securityaffairs.co/wordpress/121934/hacking/jenkins-server-security-breach.html

Cybercriminal Gang Just Leaked 500,000 Fortinet VPN Users' Passwords - Gizmodo

Fortinet is an American multinational corporation headquartered in Sunnyvale, California. It develops and sells cybersecurity solutions. The hacker gang is known by the nickname "Orange", has leaked almost 500,000 login credentials of the users of a popular VPN product from Fortinet on a dark web forum for free. The largest share of credentials comes from India, though Italy, France, and Israel also have sizable shares.

See the full report here: https://gizmodo.com/cybercriminal-gang-just-leaked-500-000-fortinet-vpn-use-1847639308

Microsoft fixes flaw that could leak data between users of Azure container services

Azure Container Instances (ACI)is a service that enables a developer to deploy containers on the Microsoft Azure public cloud without having to provision or manage any underlying infrastructure. Microsoft has claimed to have fixed a vulnerability in ACI which could be exploited by any remote attacker to access other customers' information. However, no technical details of the flaw have been revealed.

See the full report here: https://www.theregister.com/2021/09/09/azure_container_flaw/

Ukrainian extradited for selling 2,000 stolen logins per week - BleepingComputer

A Ukrainian man has been charged for using a malware botnet to brute force computer logon credentials and then selling them on a criminal remote access marketplace by the US Department of Justice. The Ukrainian man has been claimed to brute force 2,000 logins per week using the botnet. The threat actor was arrested by Polish authorities and has since been extradited to the USA.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-extradited-for-selling-2-000-stolen-logins-per-week/

Spoofing Bug Highlights Cybersecurity for Digital Vaccine Passports

Richard Nelson, an independent researcher has found out a critical bug in the Services Australia COVID-19 digital vaccine certificate that would allow an attacker to falsify someone’s vaccine status. As governments turn to vaccine passports and contact-tracing solutions to slow the spread of COVID-19, it’s critical that users have confidence in both the accuracy of the vaccine data, as well as basic privacy protections.

See the full report here: https://threatpost.com/spoofing-bug-cybersecurity-vaccine-passports/169287/