Threat Intelligence Bulletin: 9/17/2021 - 9/23/2021

Flash Report: NEW Cooperative Ransomware Attack

TLP: GREEN

On September 19th, 2021, the large Iowa based agricultural business, NEW Cooperative, took systems offline after suffering a ransomware attack from the BlackMatter ransomware group. The ransomware group is demanding 152.29 Bitcoin (5.9 Million USD) before providing the decryption key, as well as threatening to double the ransom amount if payment is not made by September 25th. Due to the nature of the services provided by NEW Cooperative, the attack threatens to disrupt the US food industry and distribution.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
• Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above average size, particularly in a compressed format such as .zip, .rar, .tar, .7z, or .gz

Details

BlackMatter is a well known and prolific ransomware group specialising in double extortion, where data is stolen before systems are encrypted. The group's [.]onion data leak site publicly lists new victims. Each victim page includes a countdown timer showing the victim the remaining time left to pay the ransom before releasing all exfiltrated data publicly. The group also claims they do not target critical infrastructure.

Figure 1: Screenshot of BlackMatters victim page for NEW Cooperative

In leaked communications between the group and NEW Cooperative however, NEW Cooperative argue they are classed as critical infrastructure as almost 40% of all grain production in the US runs on their software, along with millions of animal feed schedules being disrupted as a result of the attack. NEW Cooperative also explained the "impact of this attack will likely be much worse than the pipeline attack for context," in reference to the Colonial Pipeline attack in May, which saw massive disruption to oil distribution across the US. BlackMatter have responded by saying NEW Cooperative "do not fall under the rules,” and as such are not eligible for free decryption. The US federal government lists "food & agriculture" as one of the nation's critical infrastructure sectors, which would indicate NEW Cooperative is classified as critical to the US government.

Figure 2: Negotiation between BlackMatter and NEW Cooperative

The stolen data comprises approximately 1000GB of information, with samples attached to the NEW Cooperative victim page on the BlackMatter group’s site. According to BlackMatter, the data contains:

• Financial information containing invoices and payroll data
• IT Network information for all companies within the group
• Internal knowledge base data
• Encrypted password vaults
• HR and personally identifiable information on employees
• Product and research and development information
• Source code for several products

NEW Cooperative, as of writing, has not made any payments to recover data despite threats from the BlackMatter group negotiator that the ransom amount will be doubled. The attack also coincides with the US Department of the Treasury releasing an updated advisory on potential sanctions for facilitating ransomware payments, which reiterates that making ransomware payments may violate Office of Foreign Assets Control (OFAC) regulations and result in civil penalties.

Indicators

SHA256: 706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d
BTC Wallet: bc1qy9rg63g5zmkyxl9jp3z4szdxe8ayp3x5hq2p4p

Breaking News: 2021-09-17 - 2021-09-23

Travis CI Flaw Exposes Secrets of Thousands of Open Source Projects

Travis CI is a hosted continuous integration service used to build and test software projects hosted on GitHub and Bitbucket. Researcher Felix Lange found a security vulnerability that caused Travis CI to include secure environment variables of all public open-source repositories that use Travis CI in pull request builds. A serious security flaw that exposed API keys, access tokens, and credentials, potentially putting organizations that use public source code repositories at risk of further attacks has been patched by Travis CI.

See the full report here: https://thehackernews.com/2021/09/travis-ci-flaw-exposes-secrets-of.html

New malware uses Windows Subsystem for Linux for stealthy attacks - BleepingComputer

Hackers have come out with new methods to make Windows machines the victims of the new attacks. Security researchers have found out new malicious Linux binaries created for the Windows Subsystem for Linux (WSL). The first samples targeting the WSL environment were discovered in early May and continued to appear every two to three weeks until August 22. They act as loaders for the WSL environment and enjoy very low detection on public file scanning services.

See the full report here: https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/

New Windows security updates break network printing - BleepingComputer

Microsoft had rolled out sixty security updates and fixes for numerous bugs, including a fix for the last remaining PrintNightmare vulnerability as part of their monthly Patch Tuesday updates.But windows administrators have reported wide-scale network printing problems after the installation of these updates. Those with USB printers connected directly to their computers are not having any issues.

See the full report here: https://www.bleepingcomputer.com/news/security/new-windows-security-updates-break-network-printing/

Microsoft offers a fix for the frustrating OneDrive sync issue - Texasnewstoday.com

Microsoft OneDrive is a file hosting service and synchronization service operated by Microsoft as part of its web version of Office. OneDrive on Android can’t sync your photos and videos from your camera roll to Microsoft’s cloud storage service. Microsoft engineers have come up with a workaround, including fine-tuning OneDrive permissions. According to Microsoft, first, grant OneDrive media/camera permissions and enable changes from the settings menu of the application.

See the full report here: https://texasnewstoday.com/microsoft-offers-a-fix-for-the-frustrating-onedrive-sync-issue/463562/

German Election Authority Confirms Likely Cyber Attack

Hackers attacks the website of the authority running Germany's September 26 general election during the campaign to choose a new parliament and a successor to Chancellor. This attack bombarded the website, which publishes the official results of the vote through the DDOS attack, which causes the servers to break down. German government opened an investigation on suspicion of espionage and has pointed the hackers from Russia's "Ghostwriter" group responsible for this attack.

See the full report here: https://www.securityweek.com/german-election-authority-confirms-likely-cyber-attack

Cryptocurrency Launchpad Hit By $3 Million Supply Chain Attack

A recently launched Minimal Initial SushiSwap Offering (MISO) platform from a company named SushiSwap has been hit by a software supply chain attack. SushiSwap is a community-driven DeFi platform that lets users swap, earn, lend, borrow, and leverage cryptocurrency assets all from one place. An anonymous contractor with the GitHub handle AristoK3 steals $3 million in Ethereum by replacing the auction’s wallet with attacker’s wallet though pushing a malicious code by having access to the project's code repository. Funds has been returned from attacker to SushiSwap out of fear of repercussions from law enforcement.

See the full report here: https://arstechnica.com/information-technology/2021/09/cryptocurrency-launchpad-hit-by-3-million-supply-chain-attack/

Cyberattacks against the aviation industry linked to Nigerian threat actor

Researchers have discovered a campaign against the aviation sector, beginning with the analysis of a Trojan by Microsoft. The operator of this campaign used email spoofing to pretend to be legitimate organizations in these industries, and an attached .PDF file included an embedded link, containing a malicious VBScript which would then drop Trojan payloads on a target machine. According to Microsoft, the malware was used to spy on victims as well as to exfiltrate data including credentials, screenshots, clipboard, and webcam data.

See the full report here: https://www.zdnet.com/article/cyberattacks-against-the-aviation-industry-that-flew-under-the-radar-linked-to-nigerian-threat-actor/

Microsoft rolls out Office LTSC 2021 for Windows and Mac - BleepingComputer

Microsoft today started rolling out Office LTSC (Long Term Servicing Channel) for Windows and macOS, the non-subscription Office version for commercial and government customers. Office LTSC 2021 is specifically designed for organizations running regulated devices where feature updates can't be installed for years at a time, for devices without internet connections, as well as specialty systems that require a long-term servicing channel. While it offers performance improvements and expanded accessibility, it will not offer the cloud-based capabilities of Microsoft 365 Apps like real-time collaboration and AI-driven automation in Word, Excel, and PowerPoint, as well as security and compliance capabilities that give added confidence in a hybrid world.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-office-ltsc-2021-for-windows-and-mac/

New Go malware Capoae targets WordPress installs, Linux systems

A new strain of malware, dubbed Capoae, has been spotted in cyberattacks launched against WordPress and Linux systems. The malware is written in Go language and has cross-platform capabilities to spread through known bugs and weak administrative credentials. The vulnerabilities exploited by Capoae include CVE-2020-14882, a remote code execution (RCE) flaw in Oracle WebLogic Server, and CVE-2018-20062, another RCE in ThinkPHP. After the payload is dropped on the targeted system, XMRig is then installed to mine Monero (XMR) cryptocurrency. Users are advised to refrain themselves from using use weak or default credentials on servers or deployed applications.

See the full report here: https://www.zdnet.com/article/new-go-malware-capoae-targets-wordpress-installs-linux-systems/

OMIGOD: Microsoft Azure VMs exploited to drop Mirai, miners - BleepingComputer

The critical Azure OMIGOD vulnerabilities has been actively exploited two days after Microsoft disclosed them during this month's Patch Tuesday. Four security flaws were found in the Open Management Infrastructure (OMI) software agent silently installed by Microsoft on more than half of all Azure instances. These bugs impacts thousands of Azure customers and millions of endpoints. The recent findings reported that the active exploitation of these vulnerabilities are dropping botnet and crypto mining malware. Users are requested to ensure the OMI agent on their VM is up to date and VMs are deployed within a Network Security Group to overcome this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/omigod-microsoft-azure-vms-exploited-to-drop-mirai-miners/

The Biden administration plans to target exchanges supporting ransomware operations with sanctions

According to the Wall Street Journal, the Biden administration is putting in place all the strategies to disrupt the operations of the ransomware gangs. It is expected that the administration will apply sanctions against crypto exchanges, wallets, and traders used by the gangs to cash out ransom payments. In this way, the authorities want to make pressure on the exchanges and threaten to apply sanctions for their support to the criminal practive.

See the full report here: https://securityaffairs.co/wordpress/122352/laws-and-regulations/biden-administration-ransomware-sanctions.html?utm_source=rss&utm_medium=rss&utm_campaign=biden-administration-ransomware-sanctions

Expert discloses details and PoC code for Netgear Seventh Inferno bug

Researchers published the technical details about the critical vulnerability in Netgear smart switches. This vulnerability, dubbed Seventh Inferno, could be exploited by an attacker to potentially execute malicious code and take control of the affected devices. The expert also released the Proof of Concept for this vulnerability, the code first reboots the switch, then fakes a new session and exploits the post-auth Remote Code Execution.

See the full report here: https://securityaffairs.co/wordpress/122338/security/netgear-seventh-inferno-bug.html?utm_source=rss&utm_medium=rss&utm_campaign=netgear-seventh-inferno-bug

TN Public Department’s computer systems suffer ransomware attack - BusinessLine

Recently, the Tamil Nadu Public Department's computers systems suffered a ransomware attack. Tamil Nadu is one of the states in India. The attackers are holding the victim's information and allegedly seeking ransom in cryptocurrency to release the malware. The spokesperson from the department confirmed that they have isolated the affected systems and an ongoing investigation is in place.

See the full report here: https://www.thehindubusinessline.com/news/tn-public-departments-computer-systems-suffer-ransomware-attack/article36542072.ece

New malware uses Windows Subsystem for Linux as an attack vector - BetaNews

Security researchers have discovered a new type of malware that makes use of Windows Subsystem for Linux as a way to stealthily attack systems. Attacks can be carried out using malicious Linux binaries using a technique that was previously just a theoretical proof-of-concept. The new attack vector was discovered by researchers from Black Lotus Labs who describe it as the first instance of an actor abusing WSL to install subsequent payloads.

See the full report here: https://betanews.com/2021/09/18/new-malware-uses-windows-subsystem-for-linux-as-an-attack-vector/

Researchers compile list of vulnerabilities abused by ransomware gangs - BleepingComputer

Security researchers are compiling an easy-to-follow list of vulnerabilities ransomware gangs and their affiliates are using as initial access to breach victims' networks. While these bugs have been or still are exploited by one ransomware group or another in past and ongoing attacks, the list has also been expanded to include actively exploited flaws, as security researcher Pancak3 explained.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-compile-list-of-vulnerabilities-abused-by-ransomware-gangs/

FBI warns hackers could be exploiting critical Zoho bug - TechRadar

In a new joint security advisory, the FBI, CISA, and the Coast Guard Cyber Command (CGCYBER) are warning enterprise organizations that state-sponsored advanced persistent threat (APT) groups are actively exploiting a critical flaw in software from Zoho. The vulnerability itself, tracked as CVE-2021-40539, was discovered in Zoho's ManageEngine ADSelfService Plus software that provides both single sign-on and password management capabilities. If this flaw is exploited successfully, it can allow an attacker to take over vulnerable systems on a company's network.

See the full report here: https://www.techradar.com/news/fbi-warns-hackers-could-be-exploiting-critical-zoho-bug

Numando: A New Banking Trojan Targeting Latin American Users

A new banking Trojan named Numando has been traced as part of a series on malware in Latin America. It uses legitimate platforms like YouTube and Pastebin to store its encrypted, remote configuration and commandeer infected Windows systems."Numando" — is believed to have been active since at least 2018.

See the full report here: https://thehackernews.com/2021/09/numando-new-banking-trojan-targeting.html

New "Elon Musk Club" crypto giveaway scam promoted via email - BleepingComputer

Over the past few weeks, a new Elon Musk-themed cryptocurrency giveaway scam is being promoted through spam email campaigns. This scam is named the "Elon Musk Mutual Aid Fund" or "Elon Musk Club".The phishing emails themselves are low effort and include strange non-descriptive subjects and messages.They also include an HTML attachment named simply 'Get Free Bitcoin - [id].htm' or "Elon Musk Club - [id].htm,".

See the full report here: https://www.bleepingcomputer.com/news/security/new-elon-musk-club-crypto-giveaway-scam-promoted-via-email/

Google to Auto-Reset Unused Android App Permissions for Billions of Devices

Google is bringing an Android 11 feature that auto-resets permissions granted to apps that haven't been used in months, to devices running Android versions 6 and above. The rollout is slated to be complete by sometime in Q1 2022. The changes are part of a number of user-facing privacy and security features that Google has pushed out in recent months.

See the full report here: https://thehackernews.com/2021/09/google-to-auto-reset-unused-android-app.html

US Treasury to announce crypto sanctions to mitigate ransomware attacks - FXStreet

According to the Wall Street Journal, the US Treasury Department could impose new sanctions that could ban cryptocurrencies to be used for ransomware payments. New anti-money laundering and terrorist-finance rules will curb the use of digital assets in illicit activities later this year.

See the full report here: https://www.fxstreet.com/cryptocurrencies/news/us-treasury-to-announce-crypto-sanctions-to-mitigate-ransomware-attacks-202109200514

REvil/Sodinokibi Ransomware Universal Decryptor Key Is Out - Threatpost

Bitdefender is a Romanian cybersecurity technology company headquartered in Bucharest, Romania, with offices in the United States, Europe, Australia, and the Middle East. Bitdefender along with law enforcement has created a key to unlock REvil victims encrypted in ransomware attacks. It is a free, universal decryptor key to unlock data of victimized organizations that were encrypted by REvil/Sodinokibi ransomware attacks before the gang’s servers went belly-up on July 13.

See the full report here: https://threatpost.com/revil-sodinokibi-ransomware-universal-decryptor/169498/

Hacked sites push TeamViewer using fake expired certificate alert - BleepingComputer

Internet Information Services is an extensible web server software created by Microsoft for use with the Windows NT family. Researchers at Malwarebytes Threat Intelligence security have spotted that the malware was installed via a fake update installer [VirusTotal] and was signed with a Digicert certificate.

See the full report here: https://www.bleepingcomputer.com/news/security/hacked-sites-push-teamviewer-using-fake-expired-certificate-alert/

Amazon Driver-Surveillance Cameras Roll Out, Sparking Debate

Amazon has rolled out a program for Drivers working for Amazon Delivery Service Partners (DSPs) in which they are under constant surveillance for safe driving, monitored by artificial intelligence which awards them a score and generates voice reminders for safe driving. That score would be further used to award bonuses, promotions, and more.

See the full report here: https://threatpost.com/amazon-driver-surveillance-cameras/174843/

Data of 106 million visitors to Thailand leaked online

Bob Diachenko is a Cyber Threat Intelligence Director and journalist at SecurityDiscovery.com, a cyber security research blog. Bob Diachenko has discovered his personal data online that is stored on an unprotected Elasticsearch database. This database also contains the personal details of more than 106 million visitors to Thailand.

See the full report here: https://securityaffairs.co/wordpress/122418/data-breach/thailand-visitors-leaked-online.html

Apache OpenOffice can be hijacked by malicious documents, fix still in beta

OpenOffice.org, commonly known as OpenOffice, is a discontinued open-source office suite.Apache OpenOffice (AOO) is currently vulnerable to a remote code execution vulnerability and while the app's source code has been patched, the fix has only been made available as beta software and awaits an official release.

See the full report here: https://www.theregister.com/2021/09/20/apache_openoffice_rce/

Mass Leak of Fitness Tracking Data Hits Fitbit, Apple, Microsoft, Google; 60 Million Records Exposed by Im ... - CPO Magazine

A third-party platform that has the ability to pull fitness tracking data from nearly all of the major wearable device providers has been breached, leaving about 61 million records exposed. While the amount of personal information in these records is limited, the database contained some sensitive items such as first names paired with display names and locations, along with dates of birth and GPS logs in addition to general fitness data.

See the full report here: https://www.cpomagazine.com/cyber-security/mass-leak-of-fitness-tracking-data-hits-fitbit-apple-microsoft-google-60-million-records-exposed-by-improperly-configured-third-party-database/

Double-extortion ransomware: Double the threat, double the challenges for businesses - TechNative

Double extortion is a tactic employed by some ransomware gangs. It begins when a crypto-malware strain steals information stored on a victim's machine before launching its encryption routine. As usual, the ransomware encrypts the victim's data and demands payment in exchange for a decryptor within its ransom note. In the last twelve months alone, thirty-seven percent of UK companies have reported a data breach incident to the Information Commissioner’s Office (ICO), with seventeen percent recording more than one incident.

See the full report here: https://technative.io/double-extortion-ransomware-double-the-threat-double-the-challenges-for-businesses/

Asia Pacific and Japan financial services organizations hit by ransomware face more than US$2.62 million in recovery costs — Sophos - Manila Bulletin

Sophos Group plc is a British security software and hardware company. A survey report named “The State of Ransomware in Financial Services 2021” by the Sophos Group discloses how mid-sized financial services organizations in the Asia Pacific and Japan (APJ) spent more than US$2.62 million on average recovering from a ransomware attack. It also claims that 35% of the financial services organizations surveyed in APJ were hit by ransomware in 2020 and the attackers succeeded in encrypting their data in 69% of the organizations impacted.

See the full report here: https://mb.com.ph/2021/09/22/asia-pacific-and-japan-financial-services-organizations-hit-by-ransomware-face-more-than-us2-62-million-in-recovery-costs-sophos/

Russian hackers targeted Afghan government before Taliban takeover, cybersecurity firm says - EURACTIV

Cisco Talos is the threat intelligence organization at the center of the Cisco Security portfolio. It states that it had identified an undocumented backdoor targeting the Afghan government in late August. The backdoor was installed in infected machines in case the main malware was identified and removed. This belonged to the Russian hacking group Turla.

See the full report here: https://www.euractiv.com/section/cybersecurity/news/russian-hackers-targeted-afghan-government-before-taliban-takeover-cybersecurity-firm-says/

VMware Warns of Critical File Upload Vulnerability Affecting vCenter Server

VMware, Inc. is an American cloud computing and virtualization technology company headquartered in California. It has published a new press release that warns about the 19 vulnerabilities in vCenter Server and Cloud Foundation appliances that a remote attacker could take control of an affected system. Even though the firm has rolled out the workarounds for the flaw, the company claims that they are temporary solutions until further updates are deployed.

See the full report here: https://thehackernews.com/2021/09/vmware-warns-of-critical-file-upload.html

Unpatched Apple Zero-Day Allows Code Execution - Threatpost

A zero-day security vulnerability in Apple’s macOS Finder system was found by an independent security researcher Park Minchan that could allow remote attackers to trick users into running arbitrary commands. According to an SSD Secure Disclosure advisory this week, the vulnerability exists in the way macOS Finder handles.Inetloc files. Big Sur and prior versions of macOS are vulnerable to this vulnerability.Apple has silently patched the issue.

See the full report here: https://threatpost.com/unpatched-apple-zero-day-code-execution/174915/

Hackers Hit 2 Eyecare Groups; Data Breaches at Simon Eye and USV Optical Affect 324K Individuals - InvisionMag

Data breaches were reported in two eyecare provider groups namely Simon Eye Management in Delaware and USV Optical Inc in New Jersey that affected a total of 324,000 individuals.44,000 individuals were affected by the hacking incident that involved emails in Simon Eye Management, and in USV Optical Inc the hacking incident involving a network server affected 180,000 individuals.

See the full report here: https://invisionmag.com/hackers-hit-2-eyecare-groups-data-breaches-at-simon-eye-and-usv-optical-affect-324k-individuals/

FBI, CISA, and NSA warn of escalating Conti ransomware attacks - BleepingComputer

The Conti ransomware group encrypts servers and workstations to force payment from the victim.The Cybersecurity and Infrastructure Security Agency (CISA) is the Nation's risk advisor, working with partners to defend against today's threats and collaborating to build more secure and resilient infrastructure for the future and National Security Agency (NSA), U.S. intelligence agency within the Department of Defense that is responsible for cryptographic and communications intelligence and security. Both CISA and NSA cautioned that an increased number of Conti ransomware attacks are targeting US organizations and keeping operating systems and software up to date, requiring multi-factor authentication, and implementing network segmentation would help to prevent the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-cisa-and-nsa-warn-of-escalating-conti-ransomware-attacks/

Crystal Valley Farm Coop Hit with Ransomware

Crystal Valley Farm is a family-owned and operated, mixed breed, grass-based dairy farm. This Minnesota-based farm supply and grain marketing cooperative was hit by a ransomware attack. The company confirmed the news through a Facebook post and stated that the attack has shut down its payment systems. Until further notice, it can't accept Visa, Mastercard and Discover cards but the local cards work.

See the full report here: https://threatpost.com/crystal-valley-farm-coop-hit-with-ransomware/174928/