Threat Intelligence Bulletin: 10/01/2021 - 10/07/2021

Breaking News: 2021-10-01 - 2021-10-07

Fake Amnesty International Pegasus scanner used to infect Windows - BleepingComputer

Due to the new disclosures on Pegasus spyware by Amnesty International, threat actors are are attempting to drop a less-recognized remote access apparatus called Sarwent for earning profit. The threat actor made an effort to make the malware look like a legitimate antivirus by created an appropriate graphical user interface. As per the results from the investigation, the malware reached mostly users in the U.K.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-amnesty-international-pegasus-scanner-used-to-infect-windows/

Apple AirTag Zero-Day Weaponizes Trackers - OODA Loop

AirTag is a tracking device developed by Apple and is designed to act as a key finder, helping people find personal objects. A recently discovered AirTag flaw allows would-be attackers to redirect users to a malicious webpage when the device is scanned in Lost Mode, effectively turning the tracker into a Trojan horse. Researcher Bobby Rauch has uncovered a vulnerability that turns Lost Mode into a potential attack vector.

See the full report here: https://www.oodaloop.com/briefs/2021/09/30/apple-airtag-zero-day-weaponizes-trackers/

GhostEmperor hackers use new Windows 10 rootkit in attacks - BleepingComputer

Researchers from Kaspersky have found out the use of Demodex rootkit by the hacking group, dubbed as GhostEmperor.This rootkit's primary goal is to hide malware artifacts (including files, registry keys, and network traffic) to evade detection by both forensic investigators and security products. Kaspersky experts claim that this toolset has been in use since at least July 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/ghostemperor-hackers-use-new-windows-10-rootkit-in-attacks/

Google pushes emergency Chrome update to fix two zero-days - BleepingComputer

In order to fix the two zero-day vulnerabilities, Google has started rolling out Chrome 94.0.4606.71 to users worldwide in the Stable Desktop channel for Windows, Mac, and Linux. Google Chrome users can install the update immediately from Chrome menu > Help > About Google Chrome. Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/google-pushes-emergency-chrome-update-to-fix-two-zero-days/

New APT ChamelGang Targets Russian Energy, Aviation Orgs

A new APT group has emerged that’s specifically targeting the fuel and energy complex and aviation industry in Russia, exploiting known vulnerabilities like Microsoft Exchange Server’s ProxyShell and leveraging both new and existing malware to compromise networks. Researchers at security firm Positive Technologies have been tracking the group, dubbed ChamelGang for its chameleon-like capabilities, since March. Though attackers mainly have been seen targeting Russian organizations, they have attacked targets in 10 countries so far.

See the full report here: https://threatpost.com/apt-chamelgang-targets-russian-energy-aviation/175272/

MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed

The accounts of at least 6,000 Coinbase customers were robbed of funds after attackers bypassed the cryptocurrency exchange’s multi-factor authentication (MFA). The attackers used a flaw in Coinbase’s account recovery process to seize the SMS two-factor authentication tokens needed to break into customers’ accounts and transfer funds to crypto wallets unassociated with Coinbase. In order to pull it off, the culprits first needed access to victims’ email addresses, passwords, phone numbers and personal email inboxes. The company noted that such information can be retreived through phishing attacks or other social engineering techniques that trick victims into disclosing their login credentials.

See the full report here: https://threatpost.com/mfa-glitch-coinbase-customers-robbery/175290/

MoneyLion locks customer accounts after credential stuffing attacks - BleepingComputer

The banking and investing platform MoneyLion had to lock customer accounts that were breached in credential stuffing attacks over the summer, in June and July. The investigation revealed that an unauthorized outside party gained access to the user account on the application using an account password and/or possibly email address retrieved from credential stuffing attacks. In response to the attacks, MoneyLion locked the impacted customers' accounts to force them to reset their credentials and notified them of the incident. Additionally, they have implemented multi-factor authentication for all accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/moneylion-locks-customer-accounts-after-credential-stuffing-attacks/

Hackers rob thousands of Coinbase customers using MFA flaw

Threat actor stole cryptocurrency from 6,000 Coinbase customers, after using a vulnerability to bypass the company's SMS multi-factor authentication security feature. Phishing campaigns are run to steal the user’s email and Coinbase account credentials to conduct the attack by exploiting the vulnerability exist in SMS account recovery process. Coinbase assured that they will make sure the lost fund should be repaid to the affected customers. Coinbase strongly recommended their users to change their passwords immediately and also to switch to a more secure MFA method.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-rob-thousands-of-coinbase-customers-using-mfa-flaw/

Apple Pay Can be Abused to Make Contactless Payments From Locked iPhones

An unpatched flaw in Apple Pay and Visa system that attackers could abuse to make an unauthorized Visa payment with a locked iPhone by taking advantage of the Express Travel mode set up in the device's wallet. The attacker needs no assistance from the merchant and backend fraud detection checks, the transactions could even be relayed from an iPhone inside someone's bag. Express Travel is a feature that allows iPhone and Apple Watch users to make quick contactless payments for public transit without any authentication process. Apple and Visa acknowledged the vulnerability, but have not come to an agreement on who should implement a fix.

See the full report here: https://thehackernews.com/2021/10/apple-pay-can-be-abused-to-make.html

Flubot Android malware now spreads via fake security updates

The Flubot malware has become effective lure to compromise Android devices, now trying to trick its victims into infecting themselves with the help of fake security updates warning them of Flubot infections. Flubot, a banking malware (also known as Cabassous and Fedex Banker) has been active since late 2020. This malware can be pushed via SMS and phishing attempts and it will try to trick the victims into giving additional permissions on the phone and grant access to the Android Accessibility service, which allows it to hide and execute malicious tasks in the background. The malware will likely spread even quicker now that it uses what looks like even more effective lure.

See the full report here: https://www.bleepingcomputer.com/news/security/flubot-android-malware-now-spreads-via-fake-security-updates/

WireX DDoS botnet admin charged for attacking hotel chain

The US Department of Justice charged the admin of the WireX Android botnet for targeting an American multinational hotel chain in a distributed denial-of-service (DDoS) attack. Izzet Mert Ozek, the defendant, used the botnet to target the company's online booking system website in August 2017. However, the defendant has not yet been arrested and a warrant for his arrest is yet to be issued.

See the full report here: https://www.bleepingcomputer.com/news/security/wirex-ddos-botnet-admin-charged-for-attacking-hotel-chain/

Vaccine passport app leaks users’ personal data

Portpass, a vaccine passport app in Canada, has been found to have been exposing the personal data of its users for an unknown length of time. Canadian Broadcasting Corporation (CBC) discovered that the sensitive data was unencrypted and could be viewed in plain text. The data found included email addresses, names, blood types, phone numbers, birthdays, as well as photos of identification like driver’s licenses and passports.

See the full report here: https://blog.malwarebytes.com/privacy-2/2021/09/vaccine-passport-app-leaks-users-personal-data/

Facebook Releases New Tool That Finds Security and Privacy Bugs in Android Apps

Facebook announced its open-sourcing Mariana Trench, an Android-focused static analysis platform to detect and prevent security and privacy bugs in applications created for the mobile operating system at scale. Mariana Trench can be accessed via GitHub, and Facebook has also released a Python package on the PyPi repository.

See the full report here: https://thehackernews.com/2021/09/facebook-releases-new-tool-that-finds.html

Google Search Ends Support For Internet Explorer 11 via @sejournal, @MattGSouthern

Google Search is no longer supporting the Internet Explorer 11 web browser. However, the “ended support” does not mean Google will be inaccessible from Internet Explorer but Google will serve a stripped-down version of the search engine that can return basic results and not much.

See the full report here: https://www.searchenginejournal.com/google-search-ends-support-for-internet-explorer-11/421726/

Sandhills online machinery markets shut down by ransomware attack

US-based trade publication and hosting company Sandhills Global catering to the transportation, agriculture, aircraft, heavy machinery, and technology industries have suffered a ransomware attack. According to the open-source, the Conti ransomware attack is behind the outage. The attack cause the company to shut down all of its IT systems to prevent the attack's spread making hosted websites become inaccessible and disrupting their business operations.

See the full report here: https://www.bleepingcomputer.com/news/security/sandhills-online-machinery-markets-shut-down-by-ransomware-attack/

'Hackers' posing as brokers almost stole varsity's R100m | Citypress - News24

The University of Mpumalanga is based in Mbombela, South Africa. The university transferred an amount of R100 million from its account to be invested in Investec Bank, but the money was instead allegedly diverted to an FNB account. Hackers pretended to be investment bank brokers to get this huge amount from the university.

See the full report here: https://www.news24.com/citypress/news/hackers-posing-as-brokers-almost-stole-varsitys-r100m-20211002

Washington Adventist University Hit By Ransomware Attack - NBC4 Washington

Washington Adventist University(WAU) is a private Seventh-day Adventist university in Takoma Park, Maryland.WAU claims that it was bit by a ransomware attack on Saturday. Due to this attack, its wifi and internet access from the campus would not be available. The school is working with the Montgomery County Cyber Taskforce and the FBI to resolve the attack.

See the full report here: https://www.nbcwashington.com/news/local/washington-adventist-university-hit-by-ransomware-attack/2820163/

TA544 group behind a spike in Ursnif malware campaigns targeting Italy

Proofpoint researchers have discovered a new Ursnif baking Trojan campaign carried out by a group tracked as TA544 that is targeting organizations in Italy.TA544 is a financially motivated threat actor that is active at least since 2017, it focuses on attacks on banking users, it leverages banking malware and other payloads to target organizations worldwide, mainly in Italy and Japan.

See the full report here: https://securityaffairs.co/wordpress/122875/malware/ta544-ursnif-campaigns-italy.html

White House Plans 30-Country Meeting to Combat Ransomware and Cyber Crime - Insurance Journal

President Joe Biden said on Friday that the top U.S. national security advisers would gather officials from 30 countries this month with plans to combat the growing threat of ransomware and other cybercrime. In addition to this, an online session hosted by the White House National Security Council will also be aimed at “improving law enforcement collaboration” on issues like “the illicit use of cryptocurrency."

See the full report here: https://www.insurancejournal.com/news/national/2021/10/04/634945.htm

Ransomware continues to thrive despite changes in hacking scene - SiliconANGLE News

According to McAfee Enterprise's report named Advanced Threat Research Report: October 2021, amid the shift to remote working and the highly publicized Colonial Pipeline attack, cybercriminals introduced new and updated threats and tactics in campaigns targeting prominent sectors, such as government, financial services, and entertainment. The most targeted sector by ransomware was the government, followed by telecom, energy, media, and communications.

See the full report here: https://siliconangle.com/2021/10/04/mcafee-report-finds-ransomware-continues-thrive-despite-changes-hacking-scene/

Largest mobile SMS routing firm discloses five-year-long breach - BleepingComputer

Syniverse is a global company that provides technology and business services for a number of telecommunications companies as well as a variety of other multinational enterprises. The firm has disclosed that hackers had access to its databases over the past five years and compromised login credentials belonging to hundreds of customers. It provides text messaging routing services to over 300 mobile operators, among them Vodafone, AT&T, T-Mobile, Verizon, America Movil, Telefonica, and China Mobile.

See the full report here: https://www.bleepingcomputer.com/news/security/largest-mobile-sms-routing-firm-discloses-five-year-long-breach/

Facebook, Instagram, WhatsApp Go Down

According to public statements from the three Facebook services, Facebook, Instagram, and WhatsApp suffered from outages in the mid of Monday. Even though the reason for the outage was not immediately clear, the security researchers pointed to a Domain Name System (DNS) problem as a possible culprit.

See the full report here: https://www.cnn.com/2021/10/04/tech/facebook-instagram-whatsapp-outage/index.html

Facebook, Instagram, and WhatsApp back online after BGP fix - BleepingComputer

The BGP routing protocol is a service that calculates the most efficient path to reach a website through the multiple autonomous systems/networks that form the Internet. This BGP routing had caused over a five-hour worldwide outage in Facebook, Instagram, and WhatsApp.

See the full report here: https://www.bleepingcomputer.com/news/technology/facebook-instagram-and-whatsapp-back-online-after-bgp-fix/

RaidForums forced to use mirror after Brazilian govt contacts registrar - BleepingComputer

The popular hacking forum, RaidForums hacking suddenly stopped working in the last week after a government filed a legal request with their registrar. However, it was soon back up on a mirror domain with an announcement from the site's owner that explained the outages were caused by a reluctance of their new registrar, NameSilo, and to ignore the government reports that regularly target the platform.

See the full report here: https://www.bleepingcomputer.com/news/security/raidforums-forced-to-use-mirror-after-brazilian-govt-contacts-registrar/

New Atom Silo ransomware targets vulnerable Confluence servers - BleepingComputer

Atlassian Confluence is a highly popular web-based corporate team workspace that helps employees collaborate on various projects. Atom Silo is a newly spotted ransomware group that is targeting a recently patched and actively exploited Confluence Server and Data Center vulnerability to deploy their ransomware payloads. Successful exploitation enables unauthenticated attackers to execute commands on unpatched servers remotely.

See the full report here: https://www.bleepingcomputer.com/news/security/new-atom-silo-ransomware-targets-vulnerable-confluence-servers/

Google to auto-enroll 150m users, 2m YouTubers with two-factor authentication

Google has announced that it would automatically upgrade 150 million users and two million YouTube creators into using two-factor authentication for their accounts by the end of the year to provide an extra layer of security. According to the firm passwords are just passphrases that could be easily guessed, stolen, and shared. Two-factor authentication provides an extra layer of security by, say, requiring a one-time code to complete your login – this code could be generated by an app on your phone or emailed to you – or a hardware key you insert into your computer.

See the full report here: https://www.theregister.com/2021/10/06/google_twofactor_authentication/

IP Surveillance Bugs in Axis Gear Allow RCE, Data Theft

Axis Communications AB is a Swedish manufacturer of network cameras for the physical security and video surveillance industries. Researchers from Nozomi Networks Labs have detected three security vulnerabilities in Axis video products that could be mishandled by the attackers. These three flaws turn out to affect all Axis devices that run the company’s embedded Axis OS. Axis is in the process of releasing patches for all affected devices.

See the full report here: https://threatpost.com/ip-surveillance-bugs-axis-rce-data-theft/175350/

Apache Web Server Zero-Day Exposes Sensitive Data

The Apache HTTP Server, colloquially called Apache, is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. It has rolled out a fix for a zero-day security bug in the Apache HTTP Server, which was first reported to the project last week. The discovered vulnerability could allow path traversal and subsequent file disclosure. Users can protect themselves by upgrading to version 2.4.50.

See the full report here: https://threatpost.com/apache-web-server-zero-day-sensitive-data/175340/

Multiple Critical Flaws Discovered in Honeywell Experion PKS and ACE Controllers

CISA, the U.S. Cybersecurity, and Infrastructure Security Agency has rolled out an advisory regarding multiple security vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers. These flaws could be exploited by any remote attacker to achieve a denial of service condition. Users are urged to update or patch as soon as possible in order to mitigate these vulnerabilities fully.

See the full report here: https://thehackernews.com/2021/10/multiple-critical-flaws-discovered-in.html

Windows 11 bug reverts users back to the Windows 10 taskbar - BleepingComputer

After updating to Windows 11, some users have reported a strange upgrade experience where the new operating system becomes a hybrid of Windows 10 and Windows 11. In order to fix this issue, some users experimented with uninstalling the latest Windows 11 cumulative update while others were forced to create a brand new user profile to fix the issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-bug-reverts-users-back-to-the-windows-10-taskbar/

Amazon's (AMZN) Twitch Is Hacked, Exposing Source Code, Creator Payouts - Bloomberg

Twitch is an interactive live streaming service for content spanning gaming, entertainment, sports, music, and more. Twitch has been attacked by an anonymous hacker. The breach has exposed sensitive source code, detail on payouts to content creators and also exposed Amazon’s development of a digital gaming distribution platform. The hacker had posted a link with 125 gigabytes of data to 4Chan which is an internet messaging board supported by conspiracy theorists with an aim to create more disruption and competition in the online video streaming space.

See the full report here: https://www.bloomberg.com/news/articles/2021-10-06/amazon-s-twitch-is-hacked-exposing-source-code-creator-payouts

Kiwibank outage: Customers vent anger, frustration as online services down again - New Zealand Herald

Kiwibank Limited is a New Zealand state-owned bank and financial services provider with approximately 4% of the market share in terms of assets. Kiwibank's online services went down again making the bank's internet banking and mobile app inaccessible to some customers. The officials took Twitter to claim that it is aware of the condition and is looking into this matter.Cert NZ confirmed at the time it was aware of a DDoS (Distributed Denial of Service) targeting a number of New Zealand organizations and is not sure if the issue related to Kiwibank is related to DDoS.

See the full report here: https://www.nzherald.co.nz/business/kiwibank-outage-customers-vent-anger-frustration-as-online-services-down-again/UWJLKDQ7U4ZX3POZFHETHERVRA/

Canopy Parental Control App Wide Open to Unpatched XSS Bugs

Canopy is a parental control app with real-time smart filtering. According to researchers, it is vulnerable to a variety of cross-site scripting (XSS) attacks. The attacks could range from a sneaky kid disabling the monitoring to a much more serious third-party attack delivering malware to parental users. According to the researcher Young, Canopy needs to implement sanitization of all user-input fields.

See the full report here: https://threatpost.com/canopy-parental-control-app-unpatched-xss-bugs/175384/

Navy Facebook Account Hacked to Stream ‘Age of Empires’ - VICE

The USS Kidd’s official Facebook page has been hijacked by someone who spent more than six hours live-streaming a 1990s-era video game called Age of Empires. Six videos, each of which is more than an hour long, popped up over the next several hours . Navy spokeswoman Cmdr. Nicole Schwegman told that they were working with Facebook technical support to resolve the issue.

See the full report here: https://www.vice.com/en/article/m7e8db/navy-facebook-account-hacked-to-stream-age-of-empires