Threat Intelligence Bulletin: 09/24/2021 - 09/30/2021

Flash Report: Colossus Ransomware

On Friday, September 24, 2021, the ZeroFox Threat Intelligence team discovered a variant of ransomware called Colossus that affects machines running Microsoft Windows operating systems. The sample has a number of features including binary packing via Themida and sandbox evasion capabilities. The ransomware has a support website for setting up communications with victims, which most likely was launched on September 20, 2021. The ransomware shares a similar ransom note structure to EpsilonRed, BlackCocaine, and some SodinoKibi/REvil notes. As of September 24, 2021, Colossus has one known victim currently in active negotiations, an automotive group based in the United States. The operators appear at least highly familiar if not directly associated with other existing ransomware-as-a-service (RaaS) groups based on their tactics, techniques, and procedures (TTPs).

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets.
• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Segment critical network resources using zero-trust configurations.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Limit file egress by size and type.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• Monitor usage of dual purpose tools such as Powershell for abnormal behaviors.
• Disable port echoing on all Internet-facing devices.
• Use a VPN for internal network connections.
• Avoid opening unsolicited attachments and never click suspicious links.

Details

As part of routine monitoring, ZeroFox detected and extracted a ransom note titled "HOW_TO_RECOVER_FILES.Colossus.txt" from a malware sample uploaded to the Hatching Triage malware analysis service on September 24, 2021. The note contained a link with the domain colossus[.]support and a victim key to access a private "Support Room" page to engage the attacker. The page notes a U.S.-based automotive group of dealerships as the target and threatens to dump 200 GB of exfiltrated data if an amount of USD 400,000 is not paid. A countdown timer shows the ransom is scheduled to increase to USD 600,000 in about 3 days. A suspected representative of the targeted company with the anonymous username "USER912058085" appears to have entered the chat room and initiated negotiations. At this time, the attacker has shared four sample files of stolen data hosted at the file sharing service ibb[.]co and is awaiting a further response.

Figure 1: Private negotiation page for Colossus ransomware target

Figure 2: Colossus ransomware actor sharing samples of stolen data

Ransomware groups tend to host a support page on a 1-1 basis with their victims (a unique page), or they run a support portal. In the case of Colossus, they registered the domain for their support portal on 9/19/2021. The domain is registered via Tucows, and the nameserver responding to DNS lookups is dnspod, a popular DNS provider for cybercriminals. Dnspod has hosted a number of other ransomware support pages. This does not mean there is a definitive link between Colossus and other groups that have used dnspod, such as EpsilonRed and BlackCoaine, rather, it shows that there is a playbook that ransomware operators follow for operational security reasons.

Passive DNS of the support domain shows successful support page resolutions starting on 9/20/2021 to a web server hosted in Riga, Latvia. This webserver is hosted by PINVDS, a Russian-based VPS provider.

ZeroFox has not observed any related deep and dark web chatter specifically on a Colossus ransomware product or Colossus ransomware affiliate program. However, these operators appear to be at least highly familiar if not directly associated with other existing ransomware-as-a-service (RaaS) groups based on their tactics, techniques, and procedures (TTPs). Their ransom note is similar in structure and content to other known ransomware products, including some EpsilonRed/BlackCocaine and REvil/Sodinokibi samples. This could indicate using a similar builder for the ransomware files, and follows a pattern of ransomware groups disappearing and reappearing with a rebranded name and similar toolsets.

Figure 3: Side-by-side-comparison of Colossus and REvil/Sodinokibi ransom notes

Additionally, this Colossus ransomware group is engaging in the double extortion method of encrypting then threatening to leak stolen data on the dark web in a similar manner to over 50 other ransomware and digital extortion groups tracked by ZeroFox so far this year. A public Colossus-specific ransomware leak site is likely to arise in the coming weeks out of this first known operation to leak data. Finally, it is noteworthy to see unique usernames being assigned to any visitors to the private "Support Room" page as a form of enhanced operational security. Other ransomware groups have struggled with security researchers and other malicious actors advertising on social media or even directly hijacking victim chat communications, most recently the BlackMatter ransomware group targeting of NEW Cooperative.

Ransomware Analysis

Similar to other ransomware samples, once the binary executes on the target environment, it begins the infection process. The sample of Colossus leverages PowerShell to facilitate the ransomware infection. However, ransomware operators packed Colossus with the Themida application. Themida is a packer that, when used to protect a binary, modifies the underlying code before running the application inside a custom virtual machine, making analysis of the binary significantly challenging.

Figure 4: Screenshot depicting a Colossus (APP[.]exe) sample packed by Themida

During the infection cycle, the ransomware will begin the encryption process by encrypting all files, documents, and images on the target machine. After encryption, a ransom note will be available for the victim that contains decryption and negotiation instructions. The operators inform the victim to visit the Colossus website and email the operators at the provided email address.

Indicators of Compromise

Hashes:

SHA2- b70b9039ec4b33987a991c5c20729eb3310d7406b8d15161037df3b21fd968bb

MD5 - 4f3669edb010f5db21b13a088182b8fe

SHA1 - 892447e55ff7a3ac5d26c573bb8eb4607b41ba1e

Support Portal:

colossus[.]support

5.188.89.22

colossussupport@protonmail[.]com

Notable Changes and Activity Related to Cobalt Strike in Q3

Summary

This quarter has been an active one for news related to the Cobalt Strike tool suite. The shape of the Cobalt Strike team changed, improved countermeasures were released publicly, and a new version with significant changes and functionality was released.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Recommendations

• Cobalt Strike heavily leverages other attack tools in their framework. Confirm your organization’s security posture maximizes the ability to detect Mimikatz, Metasploit, and non-standard PowerShell scripts.
• Configure your firewall to utilize Transport Layer Security (TLS) Inspection on all traffic through the perimeter.
• Check for non-standard User Agents in web traffic.
• Examine the Host Headers on web traffic to verify the Host Header destination matches the actual routing destination on web traffic.
• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets.
• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Segment critical network resources using zero-trust configurations.
• Enforce best practices on passwords, such as complexity, forced expiration, and prohibiting password reuse.
• Do not share passwords, and do not reuse the same password on different websites and applications.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• Disable unused ports on Internet-facing devices.
• Disable port echoing on all Internet-facing devices
• If you are alerted or suspect a compromised account, change the password immediately.
• Disable unneeded protocols on your network (UDP, IPX, NetBIOS) and monitor for any use of them.
• Monitor usage of dual purpose tools such as Powershell for abnormal behaviors.
• If you have subscribed to ZeroFox’s new Cyber Threat Intelligence Search library, a curated list of Cobalt Strike Indicators of Compromise can be found here: https://cloud.zerofox.com/intelligence/malware?q=cobaltstrike

Details

Cobalt Strike is a suite of tools developed in 2012 by security researcher Raphael Mudge as a framework to perform and orchestrate security and penetration tests. Over the years, it has become a favorite tool for threat actors as well. It had previously been the fruits of Mudge’s solo effort, but earlier this year ownership was acquired by security vendor Help Systems and became a team effort, followed not much later by Mudge’s (amicable) departure.

Significant development efforts had already occurred in the last year with the release of v4.0, and subsequently additional functionality included in v4.2 and v4.3. In November 2020, a cracked version of the v4.0 source code was leaked onto the dark web (legal licenses of Cobalt Strike run 3500 USD), and the hack to obtain that source code was attributed to the threat actor FreakBoy. This leak, in conjunction with Cobalt Strike’s extensive set of tools and capabilities, are likely largely responsible for the sudden surge in popularity of Cobalt Strike in the criminal underground community.

In what could have been a substantial weapon in defense against Cobalt Strike attacks, a vulnerability was discovered by security researchers that would allow a Denial of Service (DoS) attack against a Cobalt Strike C2 server. The vulnerability was released publicly, however, a patch was quickly developed and released.

A project designed to be very similar to Cobalt Strike was discovered in August 2021. The tool was dubbed Vermilion Strike by the threat researchers at Intezer, and the tool was a re-implementation of the functionalities of Cobalt Strike - particularly Cobalt Strike Beacon, but ported to Linux. An equivalent sample of the port was found for Windows as well. Vermilion Strike is not the first effort to re-implement Cobalt Strike Beacon and its capabilities. Another project called Geacon was released in February, 2020, which recreated the Beacon components in Golang.

This quarter in particular saw the release of v4.4, which included a number of new features. One of the new features was the ability to leverage a user-defined Reflective DLL Loader. A Reflective DLL loader is a feature that allows an attacker to load a DLL and inject it into a victim process entirely from memory, rather than requiring it to be read from disk. Even a standardized reflective DLL loader is a sophisticated attack vector, but by allowing user-defined loaders, detection will potentially be significantly more difficult.

Cobalt Strike also previously had a fairly noticeable event detection centered around the Windows Event for a DNS Query (Sysmon event 22). This feature was modified in v4.4 and no longer triggers that Event code, thus mitigating a reliable forensic investigation technique. And in that same spirit of anti-forensic countermeasures, Cobalt Strike has the ability to hide itself in memory when it is not active, an anti-content matching technique referred to as a sleep mask. The technique does require a small flaw, however, in that it must leave a stub of data in order for it to find itself when it would like to become active. Again, that detection was largely mitigated in version 4.4 by making that stub value able to be user-defined.

The framework continued its integration with the popular tool Mimikatz, but slightly decoupled the integration for improved flexibility. Mimikatz is an independent tool, and has its own development schedule, and in v4.4 Cobalt Strike established a mechanism by which to upgrade the integrated version of Mimikatz without having to break Cobalt Strike.

And in the last feature we will discuss, the capability to reconnect to an established TeamServer instance was added. This capability may be done manually or automatically. As such, a defender’s effort to break a connection may be even less valuable, as previously an attacker would need to realize the broken connection and then work to re-establish it, which would take time and resources. Now, after a brief countdown, the command and control will attempt to reconnect itself with virtually no disruption.

Conclusion

Cobalt Strike is an established threat in the hands of attackers. Now development has surged in earnest with new capabilities and new threats to defend against. There is also an active effort to engage the community, sharing techniques, libraries, scripts, and configurations. There is every reason to believe that Cobalt Strike will continue to grow in popularity both among red teams and threat actors for some time to come, and its presence will continue to adapt and present new challenges to network defenders.

Breaking News: 2021-09-24 - 2021-10-01

FamousSparrow APT Wings in to Spy on Hotels, Governments

Researchers from cybersecurity company ESET have identified an effective new group of advanced persistent threats (APTs). The hackers, dubbed FamousSparrow, would have been responsible for executing attacks by targeting hotels, governments, and private organizations around the world. Its specialty is cyber espionage. As per the firm, this malware has the ability to: rename or delete files; create directories; shut down processes; send information such as file attributes, file size, and file writes time; exfiltrate the content of a specified file; write data to a specified file, or establish an interactive reverse shell.

See the full report here: https://threatpost.com/famoussparrow-spy-hotels-governments/174948/

New Android malware steals mobile banking data, money. Here's how to identify - Hindustan Times

The Indian Computer Emergency Response Team (CERT-In), a government cybersecurity agency, released a notification cautioning the users regarding a new malware that is being increasingly used by cybercriminals to steal data and user information, especially mobile banking details. The new Android malware is named ‘Drinik’ and has already targeted customers of more than 27 public and private sector banks in India. Usually, the victim gets an SMS or an e-mail containing a link that redirects to the phishing screen.

See the full report here: https://www.hindustantimes.com/india-news/new-android-malware-steals-mobile-banking-data-money-here-s-how-to-identify-101632452541225.html

High-Severity RCE Flaw Disclosed in Several Netgear Router Models

Netgear, Inc. is a multinational computer networking company based in San Jose, California, with offices in about 25 other countries. It produces networking hardware for consumers, businesses, and service providers. A high-severity remote code execution vulnerability affecting multiple routers was discovered which could permit bad actors with network access to gain remote code execution (RCE) as root via a Man-in-the-Middle (MitM) attack. The vulnerability resides within Circle, a third-party component included in the firmware that offers parental control features. Netgear has released patches to remediate this vulnerability.

See the full report here: https://thehackernews.com/2021/09/high-severity-rce-flaw-disclosed-in.html

100M IoT Devices Exposed By Zero-Day Bug

NanoMQ is a lightweight messaging engine for IoT edge that supports common edge protocols such as MQTT, ZeroMQ, and Nanomsg. Researchers from Guardara found out a zero-day vulnerability in NanoMQ using their technology.NanoMQ, an open-source platform from EMQ that monitors IoT devices in real-time and sends alerts if irregular activities are encountered. Due to this flaw,100 million devices across 10,000 enterprises are vulnerable to attacks.

See the full report here: https://threatpost.com/100m-iot-devices-zero-day-bug/174963/

Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug

Cring (also known as Crypt3r, Ghost, Phantom, or Vjiszy1lo) is a ransomware toll operated by a currently unknown attacker, who is using it in campaigns targeting exposed VPN products. Remote attackers have breached a server that was running an 11-year-old version of Adobe's ColdFusion 9 software. According to a report published by Sophos, the server belonged to an unnamed services company which was used to collect timesheet and accounting data for payroll and also to host a number of virtual machines.

See the full report here: https://thehackernews.com/2021/09/cring-ransomware-gang-exploits-11-year.html

Hackers exploiting critical VMware vCenter CVE-2021-22005 bug - BleepingComputer

Exposed vCenter servers are currently being targeted from various countries over multiple ports and could be used for remote code execution on VMware vCenter Server. The vulnerability is tracked as CVE-2021-22005 and rated as a critical rated bug with a score of 9.8. A researcher named Jang published technical notes on the vulnerability based on the workaround and the patch from VMware. The details are enough for experienced developers to create a working exploit that allows remote code execution with root privileges. Given the severity of the issue, VMware urges administrators to act immediately .

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-vmware-vcenter-cve-2021-22005-bug/

Researcher drops three iOS zero-days that Apple refused to fix - BleepingComputer

An unknown researcher has published proof-of-concept (PoC) exploit code for four iOS zero-day vulnerabilities on GitHub proof-of-concept exploit code, together with apps that harvest sensitive information and displays it in the user interface. This came after Apple delayed patching and failed to credit the researcher. Apple has addressed the bugs in iOS versions 14.7.1, 14.8, and 15.0.

See the full report here: https://www.bleepingcomputer.com/news/security/researcher-drops-three-ios-zero-days-that-apple-refused-to-fix/

Exchange/Outlook Autodiscover Bug Spills $100K+ Email Passwords

Guardicore security researcher Amit Serper has discovered a severe design bug in MIcrosoft Exchange’s autodiscover service that can leak nearly 100,000 unique login names and passwords for Windows domains worldwide. Autodiscover service is a protocol that lets users easily configure applications such as Microsoft Outlook with just email addresses and passwords. This is a severe security issue, since if an attacker can control such domains or has the ability to ‘sniff’ traffic in the same network, they can capture domain credentials in plain text (HTTP basic authentication) that are being transferred over the wire.

See the full report here: https://threatpost.com/exchange-outlook-autodiscover-bug-spills-100k-email-passwords/175004/

Emergency Google Chrome update fixes zero-day exploited in the wild - BleepingComputer

Google has released Chrome 94.0.4606.61 for Windows, Mac, and Linux, an emergency update addressing a high-severity zero-day vulnerability exploited in the wild. The bug, tracked as CVE-2021-37973, is a use after free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation of this vulnerability can let attackers execute arbitrary code on computers running unpatched Chrome versions.

See the full report here: https://www.bleepingcomputer.com/news/security/emergency-google-chrome-update-fixes-zero-day-exploited-in-the-wild/

Operation 'Armor Piercer' targeted Indian government and defence personnel: Report - MediaNama.com

Armor Piercer, a hacking operation uses two remote access trojans (RAT) which masqueraded as the Indian government’s Kavach Application document and allegedly distributed to government and defence agency personnel to access confidential information. Kavach is a two-factor authentication application used by government employees to access their emails. When someone clicks on these modelled documents, it will activate a payload which download the malware to steal credentials from browsers, execute arbitrary commands, gather system information and Conduct file management operations.

See the full report here: https://www.medianama.com/2021/09/223-rat-malware-targeted-indian-govt/

COVID-19 is the target of a new malware attack targeting Android users - Bollyinside - BollyInside

TangleBot, a new form of malware infecting the victim cell phones by tricking them to click on a link which sent through a text message claiming to have the latest COVID-19 guidance and third vaccine appointment information. The virus installed in the phone through Adobe Flash player update prompts immediately after the user clicked the link and gain access over microphone, camera SMS, call logs, internet and GPS. Malware is capable to steal banking credentials through phishing attack. To avoid this users should not respond to unsolicited commercial messages.

See the full report here: https://www.bollyinside.com/news/covid-19-is-the-target-of-a-new-malware-attack-targeting-android-users

Reports: A Ransomware Loader Is Being Spread Through Google Ads - TechDecisions

Increasing in the use of Conti ransomware targetting U.S. and international organizations, including those in healthcare, first responders, and other critical organizations. Microsoft and Sentinel Labs also released information about the use of Conti ransomware that is being downloaded through a Google ads. ZLoader, a banking trojan has been leveraged by threat actors, to distribute the malware which implements web injection to steal cookies, passwords and sensitive information, provides backdoor capabilities and acts as a generic loader for other forms of malware.

See the full report here: https://mytechdecisions.com/network-security/reports-a-ransomware-loader-is-being-spread-through-google-ads/

Illinois man ran business telling clients how to launch computer attacks: DOJ - Yahoo Finance

A man from St. Charles was found guilty by a federal jury for running websites that allowed paying users to launch distributed denial of service, or DDoS, attacks, according to the Department of Justice, U.S. Attorney's Office, Central District of California. The man owned and operated two DDoS facilitation websites, DownThem.org and AmpNode.com, according to evidence presented at his nine-day trial. DownThem sold subscriptions allowing customers to launch DDoS attacks while AmpNode provided server hosting for spoofing servers pre-configured with scripts to launch DDoS attacks.

See the full report here: https://finance.yahoo.com/news/illinois-man-ran-business-telling-114730742.html

Ransomware strike targets US agriculture industry, White House quietly hits back - Fox Business

An industry marked as off-limits to Russian hackers by President Biden was hit in a ransomware attack earlier this week when the operations of two farming co-ops in Iowa and Minnesota were disrupted. The cyberattack was levied at Iowa-based farming co-op, NEW Cooperative, by hackers demanding a $5.9 million cryptocurrency payout in exchange for renewed access to its food supply chains.

See the full report here: https://www.foxbusiness.com/politics/ransomware-strike-targets-us-agriculture-industry-white-house-quietly-hits-back

Microsoft WPBT flaw lets hackers install rootkits on Windows devices - BleepingComputer

Security researchers have found a flaw in the Microsoft Windows Platform Binary Table (WPBT) that could be exploited in easy attacks to install rootkits on all Windows computers shipped since 2012. WPBT is a fixed firmware ACPI (Advanced Configuration and Power Interface) table introduced by Microsoft starting with Windows 8 to allow vendors to execute programs every time a device boots. However, besides enabling OEMs to force install critical software that can't be bundled with Windows installation media, this mechanism can also allow attackers to deploy malicious tools, as Microsoft warns in its documentation.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-wpbt-flaw-lets-hackers-install-rootkits-on-windows-devices/

Hackers can now make Malware untraceable on Windows, Google warns - TheDigitalHacker

Security researchers have revealed a technique through which hackers can use flawed digital signatures in malware payloads to escape detection. Attackers created malformed code signatures that are treated as valid by Windows but unable to be decoded or checked by OpenSSL code, which is used in several security scanning products, Google’s threat analysis group said in a report published on Thursday.

See the full report here: https://thedigitalhacker.com/hackers-can-now-make-malware-untraceable-on-windows-google-warns/

SonicWall Issues Patches for a New Critical Flaw in SMA 100 Series Devices

Network security company SonicWall has addressed a critical security vulnerability affecting its Secure Mobile Access (SMA) 100 series appliances that can permit remote, unauthenticated attackers to gain administrator access on targeted devices remotely. Tracked as CVE-2021-20034, the arbitrary file deletion flaw could allow an adversary to bypass path traversal checks and delete any file, causing the devices to reboot to factory default settings.

See the full report here: https://thehackernews.com/2021/09/sonicwall-issues-patches-for-new.html

German Federal Office for Information Security (BSI) investigates Chinese mobile phones

German Federal Office for Information Security (BSI) is launching an investigation into the cybersecurity of certain Chinese mobile phones. This step was taken by BSI after a report from the Lithuanian cyber defense claimed that some mobile phones that are commercialized by Xiaomi and Huawei revealed an undocumented behavior that was possible to trigger remotely by the Chinese vendors.

See the full report here: https://securityaffairs.co/wordpress/122604/intelligence/bsi-investigates-chinese-mobile-phones.html?utm_source=rss&utm_medium=rss&utm_campaign=bsi-investigates-chinese-mobile-phones

Proper password security falling short despite increase in online presence

LastPass is a freemium password manager that stores encrypted passwords online. The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps for many smartphones. A report from LastPass has revealed that 92 percent of people know that using the same password or a variation is a risk but 65 percent still re-use passwords across accounts and thus increase the risks to their sensitive information. According to the 2021 Data Breach Investigations Report, the need for proper password security remains critical as attacks rise.

See the full report here: https://www.helpnetsecurity.com/2021/09/27/proper-password-security/

Google reports yet another security bug on Chrome. Here’s how it can be fixed - Hindustan Times

Recently Google claimed through a blog post that a high-security threat has been confirmed on Chrome, that affects Windows users, macOS, and Linux. Chrome has witnessed its 11th ‘zero day’ exploit of the year. According to a Forbes report, a ‘zero day’ exploit means when hackers take advantage of a security bug even before Google is able to come up with a solution, thereby increasing the risks.

See the full report here: https://www.hindustantimes.com/business/google-reports-yet-another-security-bug-on-chrome-here-s-how-it-can-be-fixed-101632678566360.html

Microsoft will disable Basic Auth in Exchange Online in October 2022 - BleepingComputer

Microsoft's Exchange Online Team said that from October 1st, 2022, Basic Authentication will be turned off for all protocols in all tenants to protect millions of Exchange Online users. Even though the exact reason for this step is not yet revealed by Microsoft, the cause is likely a Guardicore report that revealed how hundreds of thousands of Windows domain credentials were leaked in plain text by misconfigured email clients using basic authentication.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-will-disable-basic-auth-in-exchange-online-in-october-2022/

A New Jupyter Malware Version is Being Distributed via MSI Installers

Jupyter is a .NET info stealer known for singling out healthcare and education sectors, which make it exceptional at defeating most endpoint security scanning solutions. Researchers have charted the evolution of Jupyter which was first documented in November 2020. Researcher Nadav Lorber said that this evolution of Jupyter shows that threat actors are always innovating it for a more disruptive attack

See the full report here: https://thehackernews.com/2021/09/a-new-jupyter-malware-version-is-being.html

Women, Minorities Are Hacked More Than Others

According to the survey results from Malwarebytes, Digitunity, and Cybercrime Support Network, the minority groups and those with lower incomes and lower education levels are more likely to fall victim to a cyberattack and to encounter online threats. More women receive text messages from unknown numbers that include potentially malicious links than men (79 percent compared with 73 percent).

See the full report here: https://threatpost.com/women-minorities-hacked/175038/

Microsoft Warns of 'FoggyWeb' Malware Targeting AD FS Servers

FoggyWeb is a "passive and highly targeted backdoor" that can remotely exfiltrate sensitive data from a compromised AD FS server. It can also receive additional malicious commands from a command-and-control (C2) server and execute them on the victim's server.Microsoft tracks the attack group as Nobelium that is using a new post-exploitation backdoor capable of stealing sensitive data from a compromised Active Directory Federation Services (AD FS) server.

See the full report here: https://www.darkreading.com/threat-intelligence/microsoft-warns-of-foggyweb-malware-targeting-ad-fs-servers

Microsoft Adds Emergency Threat Mitigation to Its Exchange Server Software

Microsoft has introduced a new threat mitigation feature into Exchange Server. The new Emergency Mitigation (EM) software component allows Microsoft to create and execute vulnerability mitigations for its customers' Exchange Servers automatically. The EM service checks for mitigations hourly via Microsoft's cloud-based Office Config Service.The EM service can also be disabled by an admin if the organization prefers to handle its own mitigations.

See the full report here: https://www.darkreading.com/endpoint/microsoft-adds-emergency-mitigation-tool-for-exchange-server

Bandwidth.com is latest victim of DDoS attacks against VoIP providers - BleepingComputer

Bandwidth is a Communications Platform as a Service company. They sell software application programming interfaces for voice and messaging, using their own IP voice network. It has become part of the distributed denial of service attacks which lead to nationwide voice outages over the past few days. Bandwidth began reporting that they were experiencing unexpected failures with their voice and messaging services from September 25th. The firm has claimed that all its teams are actively engaged in investigating the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/bandwidthcom-is-latest-victim-of-ddos-attacks-against-voip-providers/

QNAP fixes critical bugs in QVR video surveillance solution - BleepingComputer

QNAP Systems, Inc. is a Taiwanese corporation that specializes in Network-attached storage appliances used for file sharing, virtualization, storage management, and surveillance applications.QNAP has announced that it has fixed three command injection vulnerabilities in the QVR software for managing video surveillance.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-fixes-critical-bugs-in-qvr-video-surveillance-solution/

Microsoft 365 MFA outage locks users out of their accounts - BleepingComputer

Microsoft is investigating an issue with Multi-Factor Authentication that is preventing some users from accessing Microsoft 365 services. According to the company, only the customers using on-premises Multi-Factor Authentication (MFA) servers are impacted by this Microsoft 365 issue and customers using Cloud Authentication are not affected.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-365-mfa-outage-locks-users-out-of-their-accounts/

Windows 11's Store is now open to third-party app stores - BleepingComputer

Microsoft has assured that its new app store will also support third-party app stores like Amazon AppStore and Epic Store. Microsoft has claimed that this is part of the company's "open Store for an open platform" approach which makes sure that the business terms are fair and helps in promoting innovation.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11s-store-is-now-open-to-third-party-app-stores/

75K Email Inboxes Hit in New Credential Phishing Campaign

Armorblox secures enterprise communications over email and other cloud office applications with the power of Natural Language Understanding. Security researchers from Armorblox have reported that they have observed attacks on customer systems across Office 365, Microsoft Exchange, and Google Workspace environments. Almost 75,000 email inboxes have been impacted by this email phishing campaign. The threat actors are mainly targeting small groups of employees from different departments within an organization in an apparent attempt to keep a low profile.

See the full report here: https://www.darkreading.com/attacks-breaches/75k-email-inboxes-impacted-in-new-credential-phishing-campaign

FinFisher malware hijacks Windows Boot Manager with UEFI bootkit - BleepingComputer

FinFisher is a commercial software used to steal information and spy on affected victims. It can infect Windows devices using a UEFI bootkit that it injects into the Windows Boot Manager. UEFI (Unified Extensible Firmware Interface) firmware allows for highly persistent bootkit malware as it's installed within SPI flash storage soldered to computers' motherboard making it impossible to get rid of via hard drive replacement or even OS re-installation.

See the full report here: https://www.bleepingcomputer.com/news/security/finfisher-malware-hijacks-windows-boot-manager-with-uefi-bootkit/

Firefox extension stole digital wallet cryptocurrencies – The Clare People - The Clare People

The malicious tool was advertised as an official product of Safepal, which allowed users to securely save their private keys from digital wallets on a fake extension page in the Firefox store. Digital wallets make use of this backup phrase so that users can recover their passwords in case they are forgotten. The app has been taken down and is currently unavailable.

See the full report here: https://www.clarepeople.com/4980-firefox-extension-stole-digital-wallet-cryptocurrencies/

Apple Pay with VISA lets hackers force payments on locked iPhones - BleepingComputer

Apple Pay is a mobile payment and digital wallet service by Apple Inc. that allows users to make payments in person, in iOS apps, and on the web using Safari. It is supported on the iPhone, Apple Watch, iPad, and Mac. Researchers have found a way to make fraudulent payments using Apple Pay from a locked iPhone with a Visa card in the digital wallet with express mode enabled. Express Transit is a feature in Apple devices that allows a transaction to go through without unlocking the device.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-pay-with-visa-lets-hackers-force-payments-on-locked-iphones/

Shades of SolarWinds Attack Malware Found in New 'Tomiris' Backdoor

Researchers at Kaspersky have detected a new backdoor they have dubbed "Tomiris," which has multiple attributes that suggest a link to "Sunshuttle," a second-stage malware that DarkHalo used in its SolarWinds campaign. DarkHalo is the group responsible for breaking into SolarWinds' software development environment and embedding a Trojan in signed updates of the company's Orion network management technology.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/shades-of-solarwinds-attack-malware-found-in-new-tomiris-backdoor

Google launches new reward program for Tsunami Security Scanner

Tsunami Security Scanner is an open-source general-purpose network security scanner, which is meant to help organizations identify vulnerabilities and misconfigurations in their networks in an automated manner. Google has designed a new development program to improve Tsunami's security detection capabilities. Google's vulnerability team management also added that the experimental program will give researchers patch rewards for creating plugins and application fingerprints.

See the full report here: https://www.zdnet.com/article/google-launches-new-reward-program-for-tsunami-security-scanner/

Scam Alert: Flubot malware hits New Zealand - SecurityBrief New Zealand

'Flubot' works by sending a text message to both Android and iPhone users with an alert for a missed call or new voicemail. The telecommunications sector in New Zealand has warned its customers of a new scam text message alert. The chief executive of Telecommunications Forum has warned that the link is not genuine and indications are that customers may find their personal details at risk if they do click on the link.

See the full report here: https://securitybrief.co.nz/story/scam-alert-flubot-malware-hits-new-zealand

Fake Amnesty International Pegasus scanner used to infect Windows - BleepingComputer

Due to the new disclosures on Pegasus spyware by Amnesty International, threat actors are are attempting to drop a less-recognized remote access apparatus called Sarwent for earning profit. The threat actor made an effort to make the malware look like a legitimate antivirus by created an appropriate graphical user interface. As per the results from the investigation, the malware reached mostly users in the U.K.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-amnesty-international-pegasus-scanner-used-to-infect-windows/

Apple AirTag Zero-Day Weaponizes Trackers - OODA Loop

AirTag is a tracking device developed by Apple and is designed to act as a key finder, helping people find personal objects. A recently discovered AirTag flaw allows would-be attackers to redirect users to a malicious webpage when the device is scanned in Lost Mode, effectively turning the tracker into a Trojan horse. Researcher Bobby Rauch has uncovered a vulnerability that turns Lost Mode into a potential attack vector.

See the full report here: https://www.oodaloop.com/briefs/2021/09/30/apple-airtag-zero-day-weaponizes-trackers/

GhostEmperor hackers use new Windows 10 rootkit in attacks - BleepingComputer

Researchers from Kaspersky have found out the use of Demodex rootkit by the hacking group, dubbed as GhostEmperor.This rootkit's primary goal is to hide malware artifacts (including files, registry keys, and network traffic) to evade detection by both forensic investigators and security products. Kaspersky experts claim that this toolset has been in use since at least July 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/ghostemperor-hackers-use-new-windows-10-rootkit-in-attacks/

Google pushes emergency Chrome update to fix two zero-days - BleepingComputer

In order to fix the two zero-day vulnerabilities, Google has started rolling out Chrome 94.0.4606.71 to users worldwide in the Stable Desktop channel for Windows, Mac, and Linux. Google Chrome users can install the update immediately from Chrome menu > Help > About Google Chrome. Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/google-pushes-emergency-chrome-update-to-fix-two-zero-days/