zerofox logo
Advisories

Threat Intelligence Bulletin: 09/10/2021 - 09/16/2021

|by Alpha Team

banner image

Microsoft Patch Tuesday 09/15/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for September 2021 contained 61 vulnerabilities in total, with: 01 vulnerability rated as Critical 44 vulnerabilities rated as High 16 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified proof-of-concepts for CVE-2021-36956 and CVE-2021-40440, but they are yet to be publicly available. CVE-2021-40444 is listed as an important-rated vulnerability and is being actively exploited in the wild with a number of proof-of-concept (PoC) exploits publicly available. In addition, Microsoft has also addressed three critical vulnerabilities CVE-2021-38647, CVE-2021-26435, and CVE-2021-36965.

CVE-2021-40444

CVE-2021-40444 is a Remote Code Execution Vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the MSHTML Platform. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system, conduct Phishing attacks, and could infect the system with more malware.

The following products are impacted:

  • Microsoft Windows Server 2008 SP2 x32
  • Microsoft Windows Server 2008 SP2 x64
  • Microsoft Windows 7 SP1 x32
  • Microsoft Windows 7 SP1 x64
  • Microsoft Windows Server 2008 R2 SP1 x64
  • Microsoft Windows Server 2012
  • Microsoft Windows 8.1 x32
  • Microsoft Windows 8.1 x64
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows RT 8.1
  • Microsoft Windows 10 x32
  • Microsoft Windows 10 x64
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows 10 1809 for x64-based Systems
  • Microsoft Windows 10 1809 for 32-bit Systems
  • Microsoft Windows 10 1809 for ARM64-based Systems
  • Microsoft Windows 10 1607 for 32-bit Systems
  • Microsoft Windows 10 1607 for x64-based Systems
  • Microsoft Windows 10 2004 for 32-bit Systems
  • Microsoft Windows 10 2004 for ARM64-based Systems
  • Microsoft Windows 10 2004 for x64-based Systems
  • Microsoft Windows 10 1909 for 32-bit Systems
  • Microsoft Windows 10 1909 for x64-based Systems
  • Microsoft Windows 10 1909 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for 32-bit Systems
  • Microsoft Windows 10 20H2 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for x64-based Systems
  • Microsoft Windows Server (Server Core installation) 2019
  • Microsoft Windows Server (Server Core installation) 2004
  • Microsoft Windows Server (Server Core installation) 20H2
  • Microsoft Windows Server (Server Core installation) 2016
  • Microsoft Windows Server (Server Core installation) 2012 R2
  • Microsoft Windows Server (Server Core installation) 2012
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
  • Microsoft Windows 10 21H1 for 32-bit Systems
  • Microsoft Windows 10 21H1 for ARM64-based Systems
  • Microsoft Windows 10 21H1 for x64-based Systems
  • Microsoft Windows Server 2022
  • Microsoft Windows Server (Server Core installation) 2022

CVE-2021-36956

CVE-2021-36956 is an Information Disclosure Vulnerability in Microsoft Azure Sphere that could allow a local authenticated attacker to obtain sensitive information. By executing a specially crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

Microsoft Azure Sphere

CVE-2021-40440

CVE-2021-40440 is a Cross-Site Scripting Vulnerability in Microsoft Dynamics Business Central, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

The following products are impacted:

​​Microsoft Dynamics 365 Business Central 2020 Release Wave 2 17.10 Microsoft Dynamics 365 Business Central 2021 Release Wave 1 18.5

CVE-2021-38647

CVE-2021-38647 is a Remote Code Execution Vulnerability in Microsoft Azure Open Management Infrastructure that could allow a remote attacker to execute arbitrary code on the system. By executing a specially crafted program, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

Microsoft Azure Open Management Infrastructure

CVE-2021-26435

CVE-2021-26435 is a Memory Corruption Vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption flaw in the Scripting Engine component. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Microsoft Windows 7 SP1 x32
  • Microsoft Windows 7 SP1 x64
  • Microsoft Windows Server 2012
  • Microsoft Windows 8.1 x32
  • Microsoft Windows 8.1 x64
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows RT 8.1
  • Microsoft Windows 10 x32
  • Microsoft Windows 10 x64
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows 10 1809 for x64-based Systems
  • Microsoft Windows 10 1809 for 32-bit Systems
  • Microsoft Windows 10 1809 for ARM64-based Systems
  • Microsoft Windows 10 1607 for 32-bit Systems
  • Microsoft Windows 10 1607 for x64-based Systems
  • Microsoft Windows 10 2004 for 32-bit Systems
  • Microsoft Windows 10 2004 for ARM64-based Systems
  • Microsoft Windows 10 2004 for x64-based Systems
  • Microsoft Windows 10 1909 for 32-bit Systems
  • Microsoft Windows 10 1909 for x64-based Systems
  • Microsoft Windows 10 1909 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for 32-bit Systems
  • Microsoft Windows 10 20H2 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for x64-based Systems
  • Microsoft Windows Server (Server Core installation) 2019
  • Microsoft Windows Server (Server Core installation) 2004
  • Microsoft Windows Server (Server Core installation) 20H2
  • Microsoft Windows Server (Server Core installation) 2016
  • Microsoft Windows Server (Server Core installation) 2012 R2
  • Microsoft Windows Server (Server Core installation) 2012
  • Microsoft Windows Server for X64-based systems 2008 R2 SP1
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems 2008 SP2
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
  • Microsoft Windows 10 21H1 for 32-bit Systems
  • Microsoft Windows 10 21H1 for ARM64-based Systems
  • Microsoft Windows 10 21H1 for x64-based Systems
  • Microsoft Windows Server 2022
  • Microsoft Windows Server (Server Core installation) 2022
  • Microsoft Windows Server for X64-based systems 2008 SP2

CVE-2021-36965

CVE-2021-36965 in Remote Code Execution in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the WLAN AutoConfig Service component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Microsoft Windows 7 SP1 x32
  • Microsoft Windows 7 SP1 x64
  • Microsoft Windows Server 2012
  • Microsoft Windows 8.1 x32
  • Microsoft Windows 8.1 x64
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows RT 8.1
  • Microsoft Windows 10 x32
  • Microsoft Windows 10 x64
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows 10 1809 for x64-based Systems
  • Microsoft Windows 10 1809 for 32-bit Systems
  • Microsoft Windows 10 1809 for ARM64-based Systems
  • Microsoft Windows 10 1607 for 32-bit Systems
  • Microsoft Windows 10 1607 for x64-based Systems
  • Microsoft Windows 10 2004 for 32-bit Systems
  • Microsoft Windows 10 2004 for ARM64-based Systems
  • Microsoft Windows 10 2004 for x64-based Systems
  • Microsoft Windows 10 1909 for 32-bit Systems
  • Microsoft Windows 10 1909 for x64-based Systems
  • Microsoft Windows 10 1909 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for 32-bit Systems
  • Microsoft Windows 10 20H2 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for x64-based Systems
  • Microsoft Windows Server (Server Core installation) 2019
  • Microsoft Windows Server (Server Core installation) 2004
  • Microsoft Windows Server (Server Core installation) 20H2
  • Microsoft Windows Server (Server Core installation) 2016
  • Microsoft Windows Server (Server Core installation) 2012 R2
  • Microsoft Windows Server (Server Core installation) 2012
  • Microsoft Windows Server for X64-based systems 2008 R2 SP1
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems 2008 SP2
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
  • Microsoft Windows 10 21H1 for 32-bit Systems
  • Microsoft Windows 10 21H1 for ARM64-based Systems
  • Microsoft Windows 10 21H1 for x64-based Systems
  • Microsoft Windows Server 2022
  • Microsoft Windows Server (Server Core installation) 2022
  • Microsoft Windows Server for X64-based systems 2008 SP2

Users are advised to apply the latest security patches specified in Microsoft's September Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Flash Report: Apple issues patch for FORCEDENTRY 0-day

TLP: GREEN

On 13 September, 2021, security researchers disclosed an exploit targeted at Apple products that masquerades malicious Adobe PDF and PSD files as GIF files. The attack produces a condition that allows for arbitrary code execution. According to Apple, the vulnerability affects all iPhones with iOS versions prior to 14.8, all Mac computers with operating system versions prior to macOS Big Sur 11.6, Security Update 2021-005 Catalina, and all Apple Watches prior to watchOS 7.6.2. An update has been released from Apple.

Standing Intelligence Requirements

Malware Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

ATT&CK Framework ATT&CK Framework Cont

Recommendations

  • Pegasus' use of zero-click technology enables the malware to execute on the target device without user interaction, making it difficult to detect and prevent. If suspicious activity is observed on a device, report this activity to the appropriate security teams.
  • Patch Apple devices with the following security updates:
    • iOS 14.8 and iPadOS 14.8
    • macOS Big Sur 11.6
    • Security Update 2021-005 Catalina
    • watchOS 7.6.2
    • Safari 14.1.2

Details

“FORCEDENTRY,” the designated name given to CVE-2021-30860, is the latest exploit in a string of 0-day, zero-click attacks targeting Apple devices, primarily weaponised by the threat actor NSO Group in deploying Pegasus malware. FORCEDENTRY gets its name from the ability to circumvent Apple's BlastDoor security system for iMessage, Apple's instant messaging service. Recent Pegasus attacks revealed that attackers compromised iOS devices through the iMessage application in highly targeted attacks.

The exploit itself is delivered via a payload of one or several PDF and PSD files via SMS, which may be obfuscated by changing file extensions to ‘.gif.' These files are specifically crafted to cause an IMTranscoderAgent crash on the device via an integer overflow, which leads to arbitrary code execution. This exploit chain was used to deliver Pegasus malware to specific targets.

Due to the nature of the payload distribution, targeted individuals are likely to have received multiple PDF or PSD files, possibly with a .gif extension, via SMS before infection, in order to trigger the exploit chain used with FORCEDENTRY. Once exploited, Pegasus malware is used to compromise the device.

Evidence of the exploit can be found via forensically examining an unencrypted backup of the Apple device and interrogating the device's Manifest.db files for specific indicators. Figure 1 is a screenshot of .gif files discovered on an iOS device compromised with Pegasus malware.

Figure 1

Figure 1: Forensic evidence from compromised device showing multiple malicious .gif files via SMS before infection. Source: Citizen Lab Research

Currently, there is limited technical information published on this security vulnerability. Additional technical details may become available after more Apple end-users apply the security updates. (ZeroFox Note: The recent Apple security updates contain fixes for CVE-2021-30860 and CVE-2021-30858. The latter update is for the Apple WebKit engine that is unrelated to FORCEDENTRY but still critical to patch.)

Further information on CVE-2021-30860 can be found within the ZeroFox vulnerability intelligence section. https://cloud.zerofox.com/intelligence/vulnerabilities/448318

Raccoon Stealer Updates Show Focus on Protecting Payloads

Raccoon Stealer is an information stealer that emerged in April 2019. Like most stealers, it is capable of stealing stored auto-fill data, cookies, credentials, credit card data and history from Chromium-based browsers such as Google Chrome and Microsoft Edge. Targeted theft of several cryptocurrency wallets is also supported. Updates often add support for new cryptocurrencies, though it can also be configured to locate any wallet.dat file as well.

Standing Intelligence Requirements

DDW MAL PII

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
  • Review network logs for potential signs of compromise and data egress.
  • Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

Raccoon Stealer is an infostealer (information stealer) type of malware first advertised on various underground forums in April 2019 by an actor going by the handle "raccoonstealer." Its focus is on being small, efficient, and simple enough for anyone to use. To accomplish this, Raccoon Stealer was created as a service offering, complete with a cloud control panel allowing would-be subscribers to configure everything in "just a few clicks." At just $75 per week or $200 per month, Raccoon Stealer is fairly cheap for actors as well.

Figure 1

Figure 1. Original advertisement for Raccoon Stealer (in Russian) in 2019
Source: ZeroFox Threat Research

Multiple updates have happened since the start of the quarter, most notable among them being the addition of new "crypters." A crypter's purpose is to obfuscate a given binary by doing this such as inserting junk code, breaking up the flow of code without changing the original functionality or encrypting sections of code so they cannot be detected by static signatures. Other updates include support for stealing several new cryptocurrency wallets and adding Discord to the list of targeted applications.

Figure 2

Figure 2. A Raccoon Stealer update adds support for a new crypter, “NinjaCrypt”
Source: ZeroFox Threat Research

On August 4, 2021, the actor raccoonstealer announced that they were looking to cooperate with other crypter developers and had completed an "automatic system for issuing a encrypted build.'' This was seemingly in response to subscriber feedback.

Figure 3

Figure 3. Actor raccoonstealer announces they seeking out new crypter projects
Source: ZeroFox Threat Research

An analysis by Cyberint of the JavaScript for Raccoon Stealer's control panel found messages to be displayed to subscribers, instructing them to "crypt" their generated builds. The actor racoonstealer has also been observed reminding others that "Usage without crypt is prohibited."

Figure 4

Figure 4. Actor raccoonstealer reminds a subscriber that crypters must be used against deployed binaries
Source: ZeroFox Threat Research

The recently introduced "Raccoon Clipper" was also updated at the end of July, adding support for the Monero and ZCash cryptocurrencies. Racoon Clipper is an add-on developed separately from the main stealer and works as the name may suggest: monitoring the Windows clipboard. Once it detects a supported cryptocurrency address, it will replace it with one configured by the subscriber in hopes that unsuspecting victims will continue the transaction, unaware that the target address has been changed.

Figure 5

Figure 5. Update notes for Raccoon Clipper, a paid add-on to Raccoon Stealer
Source: ZeroFox Threat Research

Conclusion

The group behind Raccoon Stealer has established themselves as a capable group in the two years since they debuted, providing new features at a regular pace and earning a mostly positive reputation within the community. They've also shown a willingness to add features based on the demands of their subscribers as demonstrated by the recently created API for automatically generating encrypted builds. With the development of a new API for automatically providing obfuscated or "crypted" builds, new targeted applications and support for more cryptocurrency wallets, this quarter has been an active one for Raccoon Stealer.

Breaking News: 2021-09-10 - 2021-09-16

McDonald's Email Blast Includes Password to Monopoly Game Database - Threatpost

Researcher Troy Hunt found out that McDonald’s had accidentally inserted passwords for a server that hosted information tied to the UK Monopoly VIP game.McDonald’s Monopoly VIP promotion dates back to 1987 and is a long-standing tradition among customers who buy menu items, collect tickets with codes and enter those codes on the McDonald’s site to redeem cash and prizes.McDonald’s claimed that it had quickly changed the server passwords when the error was brought to its attention to avoid further problems.

See the full report here: https://threatpost.com/mcdonalds-email-blast-includes-password-to-monopoly-game-database/169346/

HCL Technologies partners with Dell Technologies to protect customers against sophisticated cyberattacks

HCL Technologies have combined with Dell Technologies to provide clients with an advanced cyber recovery solution that protects against ransomware and other sophisticated cyber attacks. The two companies have multiple joint customers, thousands of trained, and certified Dell professionals, and a network of global innovation labs that support innovation and business growth.

See the full report here: https://www.helpnetsecurity.com/2021/09/10/hcl-technologies-dell-technologies/

New Mēris botnet breaks DDoS record with 21.8 million RPS attack - BleepingComputer

The massive DDoS (distributed denial-of-service )attack that has been targeting the internet giant Yandex was powered by a completely new botnet tracked as Mēris.Mirai is malware that infects smart devices that run on ARC processors, turning them into a network of remotely controlled bots or "zombies". This network of bots, called a botnet, is often used to launch DDoS attacks. This news was broke by the Russian media, which described it as being the largest in the history of the Russian internet, the so-called RuNet.

See the full report here: https://www.bleepingcomputer.com/news/security/new-m-ris-botnet-breaks-ddos-record-with-218-million-rps-attack/

BladeHawk Attackers Target Kurds with Android Apps

Researchers from cybersecurity firm ESET have found that a group called BladeHawk have been targeting the Kurdish ethic group for more than a year through an Facebook-based spyware campaign that disguises backdoors in legitimate Android apps. Researchers identified six profiles as part of the BladeHawk campaign, which has been sharing the Android spying apps and targeted about 11,000 followers through 28 unique posts.

See the full report here: https://threatpost.com/bladehawk-attackers-kurds-android/169300/

Zoho ManageEngine Password Manager Zero-Day Gets a Fix, Amid Attacks

Zoho is a cloud-based business solution provider, with integrated solutions to tackle day-to-day business activities. The Zoho suite consists of a wide range of products that deal with different aspects of business management such as email and collaboration, sales and marketing, and other applications that are essential to the proper functioning of a business. A vulnerability has been detected in the Zoho ManageEngine ADSelfService Plus platform that could allow any remote attackers to bypass authentication and have free rein across users’ Active Directory (AD) and cloud accounts.On Tuesday, Zoho issued a patch for this vulnerability.

See the full report here: https://threatpost.com/zoho-password-manager-zero-day-attack/169303/

MyRepublic Data Breach Raises Data-Protection Questions

The Singapore-based ISP and mobile provider, MyRepublic, reported a data breach that exposed data of 79,400 mobile subscribers. An unauthorized data access incident took place on August 29, which targeted a third-party data storage platform used to store the personal data of MyRepublic’s mobile customers. The affected various forms of proof of identification, including data of Singapore citizens, permanent residents and employment and dependent pass holders. The incident has been contained and the affected storage facilities are now secured.

See the full report here: https://threatpost.com/myrepublic-data-breach-protection/169382/

WhatsApp to offer end-to-end encrypted backups in iCloud, Google Drive with user-managed keys

Facebook's WhatsApp will soon add a new feature to store end-to-end (E2E) encrypted backups of their chat history on Google Drive in Android or Apple iCloud in iOS, with an option to self-manage the encryption key. WhatsApp will offer two key handling options. One involves a user-supplied password, unknown to WhatsApp or third-party backup services , that retrieves the user's actual encryption key from a Backup Key Vault based on a hardware security module (HSM) in a WhatsApp data center. The other skips the password and requires the user to supply a 64-digit encryption key, without the involvement of the HSM Backup Key Vault, to access any encrypted backups.

See the full report here: https://www.theregister.com/2021/09/11/whatsapp_cloud_encryption/

Google debuts new Private Compute features in ramp up of Android security

Google has introduced new features to Android's Private Compute Core, a secure environment currently in the beta stages of development. The new features includes live caption, now playing and smart reply options. Each feature utilizes machine learning and to keep data gathered by them private and secure, including speech records, environmental noise detection, and the context of conversations, they will be processed in the Private Compute Core and will not be shared with other apps unless expressly permitted by the handset owner. Google intends to publish the source code of Private Compute Services to allow third-party researchers the opportunity to perform audits.

See the full report here: https://www.zdnet.com/article/google-debuts-new-private-compute-features-to-ramp-up-android-security/

Experts confirmed that the networks of the United Nations were hacked earlier this year

The United Nations has confirmed that its computer networks were hit by a cyberattack earlier this year. The unknown attackers were able to breach parts of the United Nations infrastructure and stolen a huge quantity of documents containing sensitive information that could be used is attacked aimed at agencies within the intergovernmental organization. The entry point for this attack was UN’s proprietary project management software, called Umoja which was not protected with two-factor authentication. The UN and other international agencies are privileged targets for cyber criminals and nation-state actors.

See the full report here: https://securityaffairs.co/wordpress/122064/data-breach/united-nations-data-breach.html

Yandex Pummeled by Potent Meris DDoS Botnet - Threatpost

Massive DDOS attack through exploiting a 2018 bug by a massive botnet, dubbed Mēris targets Russian internet behemoth Yandex through flooding Yandex with millions of HTTP requests for webpages at a peak of at 21.8 million requests per second. Those requests reportedly originated from networking gear made by MikroTik. Tenable Research warned MikroTik edge to patch vulnerability traced through CVE-2018-14847. But MikroTik patched approximately 30 percent of vulnerable modems only, which leaves 200,000 routers vulnerable to attack. While patching MikroTik devices is the most ideal mitigation to combat future Mēris attacks, researchers also recommended blacklisting.

See the full report here: https://threatpost.com/yandex-meris-botnet/169368/

Google Introduces Private Compute Services for Android

Android operating system has got a new suite of services designed to improve privacy introduced by Google this week. This new feature named Private Compute Services add to the previously introduced Private Compute Core in Android 12 beta. In Private Compute Core, no feature has direct access to a network, which is where the newly introduced Private Compute Services come into play that is powered by machine learning, Google says they create a bridge between Private Compute Core and the cloud without compromising privacy. Google plans to make the source code for Private Compute Services available to the public and be audited by security researchers.

See the full report here: https://www.securityweek.com/google-introduces-private-compute-services-android

Latest Microsoft zero-day being actively exploited - ComputerWeekly.com

Security analysts are warning of a zero-day vulnerability in Microsoft products after reports emerged of active exploitation of CVE-2021-40444, a remote code execution (RCE) vulnerability in the MSHTML component of Internet Explorer. Currently, no patch is available.

See the full report here: https://www.computerweekly.com/news/252506480/Latest-Microsoft-zero-day-being-actively-exploited

Cisco released security patches for High-Severity flaws in IOS XR software

Cisco released security updates to address multiple high-severity vulnerabilities in the IOS XR software that can be exploited to conduct multiple malicious activities, such as DoS condition (CVE-2021-34720) and read and overwrite arbitrary files (CVE-2021-34718). Cisco also patched two other high severity privilege escalation bugs, tracked as CVE-2021-34719 and CVE-2021-34728, and a denial of service issue tracked as CVE-2021-34713 that impactes ASR 9000 routers family.

See the full report here: https://securityaffairs.co/wordpress/122100/security/cisco-ios-xr-flaws.html

Pysa Ransomware Gang Debuts Linux Support - BankInfoSecurity.com

According to a report, the Pysa ransomware gang has created a Linux version of its malware designed to target Linux hosts with the ChaChi backdoor, using its Windows counterpart's characteristics. The PYSA gang is known for targeting manufacturers, schools, and others, mainly in the U.S. and U.K., demanding ransom payments as high as $1.6 million, as per the FBI report. Pysa cybercriminal gang is believed to be adopting the hack-and-leak model.

See the full report here: https://www.bankinfosecurity.com/pysa-ransomware-gang-targets-linux-a-17514

Lawsuit filed against Savannah hospitals over ransomware attack - Georgia Health News

A Georgia resident and patient of St. Joseph's/Candler Hospital Health System, has filed a class-action lawsuit on behalf of himself and the 1.4 million patients, professionals, and clients whose personal, financial, and health information may have been compromised in the ransomware attack against the hospital's IT systems. The lawsuit alleges that SJ/C, the region's largest health care system, violated its privacy policy and acted negligently when it failed to adequately secure patients' information and take preventive measures to avoid the ransonware attack and data breach, which was detected on June 17.

See the full report here: https://www.georgiahealthnews.com/2021/09/lawsuit-filed-savannah-hospitals-ransomware-attack/

New SOVA Android Banking trojan is rapidly growing

Researchers from cybersecurity firm ThreatFabric have spotted a new Android banking trojan, dubbed SOVA at the beginning of August, that targets banking applications, cryptocurrency wallets, and shopping apps from the U.S. and Spain. The malware allows an attacker to gather sensitive data from infected devices, including banking credentials and PII.

See the full report here: https://securityaffairs.co/wordpress/122090/cyber-crime/sova-android-banking-trojan.html

Justice department's IT system brought down in ransomware attack - News24

The Department of Justice and Constitutional Development has announced that its Information Technology system has been interrupted due to a security breach. IT experts from the department were working closely with state agencies to investigate and resolve the issue, spokesperson Steve Mahlangu said in a statement on Thursday. The breach was achieved through ransomware on Monday evening.

See the full report here: https://www.news24.com/news24/southafrica/news/justice-departments-it-system-brought-down-in-ransomware-attack-20210909

GitHub tackles severe vulnerabilities in Node.js packages

Mike Hanley, GitHub's Chief Security Officer claimed that reports from researchers Robert Chen and Philip Papurt, prompted GitHub to conduct its own review of tar and @npmcli/arborist, leading to the discovery of security issues that allowed file overwrites and arbitrary code execution.GitHub has resolved numerous vulnerabilities in Node.js packages tar and @npmcli/arborist.

See the full report here: https://www.zdnet.com/article/github-tackles-seven-vulnerabilities-in-node-js-packages/

Windows 11 Android support spotted online ahead of launch - BleepingComputer

Windows 11 will use Windows Subsystem for Android (WSA), which is similar to Linux Subsystem for Linux (WSL). This will enable users to try mobile apps on the desktop operating system. Microsoft officials have already confirmed Android apps will work on Intel, AMD, and Qualcomm (ARM) devices. For Intel PCs, Microsoft is planning to use Intel's Bridge Technology feature.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-android-support-spotted-online-ahead-of-launch/

Hornetsecurity launches security and data loss prevention solution for Microsoft 365

In addition to Microsoft 365’s default protection, Hornetsecurity has released a new solution to provide Microsoft 365 business users with the security and data loss prevention they require. Hornetsecurity has launched 365 Total Protection Enterprise Backup, which covers all aspects of email and data security for Microsoft 365.

See the full report here: https://www.helpnetsecurity.com/2021/09/13/hornetsecurity-microsoft-365/

Department of Justice and Constitutional Development of South Africa hit by a ransomware attack

The Department of Justice and Constitutional Development of South Africa was hit by a ransomware attack that impacted multiple services, including email and bail services. The Department claims that no data has been exfiltrated by the ransomware operators. The IT staff notified law enforcement and is working with them to quickly restore the operations.

See the full report here: https://securityaffairs.co/wordpress/122128/cyber-crime/department-of-justice-and-constitutional-development-of-south-africa-ransomware.html

Chinese hackers allegedly breach servers of 10 Indonesian government agencies - KrASIA

According to a report by cybersecurity news publication, The Record, the internal networks of ten of Indonesia’s government organizations, including the country’s intelligence agency Badan Intelijen Negara (BIN), were breached by hackers originating from China. Insikt Group, the threat research division of cybersecurity company claims that the intrusion is suspected to be linked to a hacker group called Mustang Panda.

See the full report here: https://kr-asia.com/chinese-hackers-allegedly-breach-servers-of-10-indonesian-government-agencies

Technology giant Olympus hit by BlackMatter ransomware - TechCrunch

Olympus Corporation is a Japanese manufacturer of optics and reprography products. Olympus was hit by BlackMatter which is a new ransomware-as-service (RaaS) affiliate program that was founded in July 2021. According to BlackMatter, “The project has incorporated in itself the best features of DarkSide, REvil, and LockBit”.On infected computers, a ransom note was left behind. It’s not known if Olympus paid the ransom, or what amount was demanded by the ransomware group.

See the full report here: https://techcrunch.com/2021/09/12/technology-giant-olympus-hit-by-blackmatter-ransomware/

Google patches 10th Chrome zero-day exploited in the wild this year - BleepingComputer

Google has revealed the release notes for the new Chrome version 93.0.4577.82 for Windows, Mac, and Linux to fix eleven security vulnerabilities. The update is currently rolling out worldwide in the Stable desktop channel, will become available to everyone over the next few days. Google Chrome will also automatically check for new updates the next time you restart the browser.

See the full report here: https://www.bleepingcomputer.com/news/google/google-patches-10th-chrome-zero-day-exploited-in-the-wild-this-year/

Walmart press release hoax causes Litecoin to spike 34% - BleepingComputer

There was a fake Walmart press release that stated it would begin to accept Litecoin which caused the cryptocurrency to jump by almost 35% this morning. Since the press release was published on GlobeNewswire, Yahoo gave much wider attention.CNBC reported that Walmart confirmed that the press release was fake.

See the full report here: https://www.bleepingcomputer.com/news/cryptocurrency/walmart-press-release-hoax-causes-litecoin-to-spike-34-percent/

WooCommerce Multi Currency Bug Allows Shoppers to Change eCommerce Pricing

WooCommerce is an open-source e-commerce plugin for WordPress. It is designed for small to large-sized online merchants using WordPress. A security vulnerability was found in the WooCommerce Multi-Currency plugin which could allow any customer to change the pricing for products in online stores. According to the Ninja Technologies Network (NinTechNet), this issue is due to broken access control in versions 2.1.17 and below.

See the full report here: https://threatpost.com/woocommerce-multi-currency-bug-pricing/169394/

Apple Issues Urgent Updates to Fix New Zero-Day Linked to Pegasus Spyware

Apple has released updates after researchers from the University of Toronto's Citizen Lab revealed details of a zero-day exploit called "FORCEDENTRY" (aka Megalodon) that was weaponized by Israeli surveillance vendor NSO Group. It has let out iOS 14.8, iPadOS 14.8, watchOS 7.6.2, macOS Big Sur 11.6, and Safari 14.1.2 to fix two actively exploited vulnerabilities.

See the full report here: https://thehackernews.com/2021/09/apple-issues-urgent-updates-to-fix-new.html

TransUnion acquires Neustar to enhance fraud detection and prevention offerings

TransUnion is an American consumer credit reporting agency. TransUnion collects and aggregates information on over one billion individual consumers in over thirty countries including "200 million files profiling nearly every credit-active consumer in the United States".It has signed a definitive agreement to acquire Neustar. The acquisition expands TransUnion’s digital identity capabilities through the addition of Neustar’s distinctive data and analytics, enabling consumers and businesses to transact online with greater confidence.

See the full report here: https://www.helpnetsecurity.com/2021/09/14/transunion-neustar/

Anonymous Claims to Have Stolen Huge Trove of Data From Epik, the Right-Wing’s Favorite Web Host - Gizmodo

Epik is an American domain registrar and web hosting company known for providing services to websites that host far-right, neo-Nazi, and other extremist content. Hacktivist collective Anonymous, claim to have hacked “a decade’s worth of data” of Epik. Epik’s clients may soon have their backend information offered up to public scrutiny.

See the full report here: https://gizmodo.com/anonymous-claims-to-have-stolen-huge-trove-of-data-from-1847673935

Microsoft Releases Patch for Actively Exploited Windows Zero-Day Vulnerability

As part of the monthly Patch Tuesday release cycle, Microsoft has rolled out security updates. The vulnerabilities were affecting Windows and other components such as Azure, Office, BitLocker, and Visual Studio. Of the 66 flaws, three are rated Critical, 62 are rated Important, and one is rated Moderate in severity.

See the full report here: https://thehackernews.com/2021/09/microsoft-releases-patch-for-actively.html

Adobe Snuffs Critical Bugs in Acrobat, Experience Manager

Adobe has rolled out security updates for 59 bugs affecting its core products, including Adobe Acrobat Reader, XMP Toolkit SDK, and Photoshop. The Acrobat Reader users need to update their software to fix critical vulnerabilities else any remote attacker could take advantage of this flaw to execute arbitrary code on unpatched versions.

See the full report here: https://threatpost.com/adobe-bugs-acrobat-experience-manager/169467/

Google Chromebook bug causes black screens after login - BleepingComputer

Chromebooks are a new type of computer designed to help you get things done faster and easier. They run Chrome OS, an operating system that has cloud storage, the best of Google built-in, and multiple layers of security. Chromebook users are getting black screens when trying to log into their Chrome OS accounts. The company has acknowledged this issue on the Google Customer Care Portal and is yet to provide updates or a workaround for customers impacted by this bug.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chromebook-bug-causes-black-screens-after-login/

Krita art app users targeted by ransomware posing as paid 'collaboration' opportunities

Krita is a professional free and open source painting program. It is made by artists who want to make affordable art tools available for everyone. Recently it was hit by a ransomware attack. But rather than being attacked directly, its name is being used to spread malware among users via emails offering advertising revenue. The attacker takes over the victim's system, encrypts their files, and demands payment to reverse the process.

See the full report here: https://www.theregister.com/2021/09/14/krita_users_targeted_by_ransomware/

Former U.S. intel operatives to pay $1.6M for hacking for foreign govt - BleepingComputer

The three men, Marc Baier, Ryan Adams, and Daniel Gericke, were part of a clandestine unit named Project Raven, first reported by Reuters, that helped the United Arab Emirates spy on its enemies. The U.S. government has registered a Deferred Prosecution Agreement (DPA) with three former intelligence operatives to resolve criminal charges relating to their offering of hacking services to a foreign government.

See the full report here: https://www.bleepingcomputer.com/news/security/former-us-intel-operatives-to-pay-16m-for-hacking-for-foreign-govt/

Customer Care Giant TTEC Hit By Ransomware

TTEC is an American customer experience technology and services company headquartered in Englewood, Colorado.TTEC faced a system outage impacting access to the network, applications, and customer support. It has suggested to its employees that the company’s network may have been hit by the ransomware group “Ragnar Locker,” and to avoid clicking on a file that suddenly may have appeared in their Windows start menu called “!RA!G!N!A!R!”.Ragnar Locker is an aggressive ransomware group that typically demands millions of dollars worth of cryptocurrency in ransom payments.

See the full report here: https://krebsonsecurity.com/?p=56999

Ransomware gang threatens to wipe decryption key if negotiator hired - BleepingComputer

Ragnar Locker is an aggressive ransomware group that typically demands millions of dollars worth of cryptocurrency in ransom payments. The Ragnar Locker ransomware gang threatened to automatically publish a victim's stolen data if they contacted law enforcement or negotiation firms. On the other hand, the Grief ransomware gang has threatened to delete victim's decryption keys if they hire a negotiation firm, making it impossible to recover encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-wipe-decryption-key-if-negotiator-hired/

Microsoft rolls out passwordless login for all Microsoft accounts - BleepingComputer

Liat Ben-Zur, Microsoft Corporate Vice President disclosed that Microsoft is rolling out passwordless login to all Microsoft accounts. The sign-in will be using passwordless methods like Windows Hello, the Microsoft Authenticator mobile application or a verification code sent to your phone or email. This feature will help to protect Microsoft's account from identity attacks like phishing and also will provide easier access to the other applications and services.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-passwordless-login-for-all-microsoft-accounts/

Malicious Linux version of Cobalt Strike hacking tool found - IT World Canada

Intezer introduces a Genetic Malware Analysis technology, enabling enterprises to detect cyber threats and effectively respond to incidents. Intezer along with McAfee has claimed that they have found a re-implementation of the Cobalt Strike beacon, created by a hacker, which works on Linux and Windows systems. Beacon is Cobalt Strike's payload to model an advanced actor. Beacon executes PowerShell scripts, logs keystrokes, takes screenshots, downloads files, and spawns other payloads.

See the full report here: https://www.itworldcanada.com/article/malicious-linux-version-of-cobalt-strike-hacking-tool-found/458356

Tags: weekly bulletin, all industries, global