zerofox logo
Advisories

Threat Intelligence Bulletin: 10/08/2021 - 10/14/2021

|by Alpha Team

banner image

Microsoft Patch Tuesday 10/13/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
  • Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for October 2021 contained 81 vulnerabilities in total, with:
1 vulnerability rated as Critical
54 vulnerabilities rated as High
26 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has listed four zero-days vulnerabilities, CVE-2021-40449, CVE-2021-41338, CVE-2021-40469, and CVE-2021-41335, which are being fixed in October Patch Tuesday security update; among these, CVE-2021-40449 is detected being actively exploited in the wild.

CVE-2021-40449

CVE-2021-40449 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-41338

CVE-2021-41338 is a security bypass vulnerability in Microsoft Windows that could allow a local authenticated attacker to bypass security restrictions, caused by a flaw in the AppContainer Firewall Rules security feature. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to bypass security features.

The following products are impacted:

  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-40469

CVE-2021-40469 is a memory corruption vulnerability in Microsoft Windows that could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the DNS Server component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows Server version 20H2 (Server Core Installation)
  • Windows Server version 2004 (Server Core installation)
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019

CVE-2021-41335

CVE-2021-41335 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Kernel. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

Users are advised to apply the latest security patches specified in Microsoft's October Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Phishing Ecosystem Series: Kit Types

Consumer-targeted phishing attacks are generally split into two buckets, conventional phishing, and targeted spear-phishing. More typical phishing attacks are commonly seen as low-level activity, which requires minimal skill, and only finds success with a small number of potential targets. This is often the case, however, behind the scenes of these phishing attacks is an ecosystem which supports and perpetuates phishing attacks, from sourcing phishing attack code to fraud and money laundering.

This advisory is the first in a series of bi-weekly posts which dives into the ecosystem of phishing, and discusses the TTP’s of threat actors engaged in phishing attacks, and the typical lifecycle of such attacks.

Standing Intelligence Requirements


For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts.
  • Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
  • Avoid opening unsolicited attachments and never click suspicious links
  • Do not share passwords, and do not reuse the same password on different websites and applications.
  • If you are alerted or suspect a compromised account, change the password immediately.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Details

Sourcing the source code

The first stage of any phishing attack takes place well in advance of a phishing site being deployed, and consists of the threat actor obtaining or creating the phishing page which will be utilised. Depending on the competency of the threat actor, this can mean they acquire a pre-made phishing attack, known as a phishing kit, or create their own. A phishing kit typically takes the form of an archive (.zip) file containing code and resources, which allows for phishing attacks to be quickly and easily deployed to web servers. Sourcing a kit itself is not a difficult task, and requires minimal searching. Across covert channels, marketplaces, dark net, and clear net sources, phishing kits can be downloaded, traded, and purchased.


Figure 1: Phishing frameworks available for free on source code management platforms


Figure 2: Private online store offering phishing kits targeting multiple brands and platforms

Phishing kits will vary dramatically in cost based on the complexity and capability of the kit. Simple kits containing only a few files of PHP code can cost anywhere between 10-100 USD to purchase. More complex kits which may require backend databases, integrate third-party API’s, have built in “anti-bot” or evasion techniques, or even use licensing terms, may cost in excess of several hundred dollars.

Phishing Kit Types

In terms of uniqueness based on code, there are a countless number of phishing kits available, with more being made available every day. However, most phishing kits can be categorised into a handful of types, based on their functionality and intended targets.

  • Basic Kit
    • A simple, small archive file containing a handful of simple files, written in HTML, JavaScript and PHP. Will write victim data to local log files for the threat actor to collect manually.
  • Dynamic Kit
    • These kits contain specially made code and logic to present dynamic content to the victim, based on input. This can be in the form of presenting a fake consumer banking login page based on previous input, or presenting logos of their company based on their email address.
  • Puppeteer Kit
    • Specifically designed to phish for online banking credentials, and enable indirect, “live” interaction between the victim and attacker, allowing the threat actor to prompt the victim for information being requested from their online banking provider. For example, this is used to bypass OTP prompts, security phone calls, and secret words
  • Commercial Kits
    • Many of the more popular phishing kits have been commoditised, with the authors licensing usage of their kits, and offering online storefronts where customers can log in and purchase, configure, and download phishing kits. Popular examples include 16Shop and FreakzBrothers.
  • Frameworks
    • A more comprehensive but less popular solution for many would-be phishers, is through the use of a phishing “framework”. These are essentially applications (rather than archive files), which can be run ad-hoc on web servers to automatically generate and deploy phishing pages. Depending on the framework it can offer additional features such as reverse proxying, loading assets from third-party sites dynamically, and automatically importing new phishing pages contributors. These phishing frameworks are easily found on popular source code management platforms.

It is worth noting, alongside these types of phishing kits that typically, if a kit being sold via various channels does not contain some decent form of DRM, encryption, or obfuscation to prevent unintended redistribution, it will not take long for “cracked” versions to appear. These kits have had their source code altered to bypass restrictions and checks which may take place to restrict usage. Likewise, kits may also be altered to the extent to change the logos and wording, but keep the main code base, thus changing the original targeted brand.

Structure

Generally, phishing kits are composed primarily of HTML and PHP files to make up the main code base, and can contain additional resources for logic and rendering such as JavaScript files and images.


Figure 3: Example phishing kit containing PHP files controlling the victim workflow, logic, and blocking capabilities.

An average phishing kit will often contain code and directories grouped into the following functions: Functions/Controls PHP code dictating logic and shared functions for the victim workflow. For example, functions to write information to a log file or send an email at each step. Some kits heavily obfuscate this code in order to try and prevent redistribution or alteration.


Figure 4: Obfuscated PHP code from a popular phishing kit

  • Anti-bot/Blocking
    • Can contain multiple, if not dozens, of scripts and PHP code files which outline IP addresses, geo locations, ISP’s and user agents which should be blocked or redirected to an external page, in order to protect or hide the phishing page. A common evasion technique for phishing kits is to block all requests from popular web crawling or indexing services, which may identify a phishing page.
    • Some kits also use third-party services and API’s in order to provide this functionality, and check the reputation of a visitor's IP address.
  • Victim pages
    • HTML or PHP files containing the basic layout, design, and logic of the victim workflow. These are typically files named after URLs or pages you would commonly see when logging in to online platforms, such as “process”, “signin”, “login”, “onlinebanking”, “email”, “reset”, etc.
  • Assets
    • Files and folders containing image and JavaScript files which are loaded into the phishing pages. Not all kits will contain these assets and instead call them directly from the targeted brand or site.
  • Logs (optional)
    • Depending on the complexity of the phishing kit, victim data is commonly either emailed to the threat actor operating the kit, or saved locally to log files. These tend to be grouped together in a directory so the threat actor can quickly review and retrieve victim data from their deployment. These files, if located, often contain victim usernames, passwords, IP and geolocation information, credit card data and more.

Additionally to the typical structure, other types of kits may contain additional resources and scripts, such as instructional videos on how to deploy, SQL scripts to generate tables and required database schemas, and other applications or scripts, to aid in deploying the phishing attack effectively.

Conclusion

Phishing kit development and distribution is continuing to evolve as many consumer sites change their login and security processes, forcing kit authors to change their code in order to accurately reflect current designs and user experience. ZeroFox assesses with a high likelihood that the sophistication of phishing attacks will continue to increase, and the accessibility of pre-built phishing attacks will continue to allow lesser skilled threat actors to deploy and manage believable, complex, phishing attacks. ZeroFox analyses new phishing kits every day, and provides tools to allow security teams and researchers to analyse phishing kits themselves, to help in understanding the phishing threat landscape.

Breaking News: 2021-10-08 - 2021-10-14

Researchers Warn of FontOnLake Rootkit Malware Targeting Linux Systems

A new campaign that likely targets entities in Southeast Asia with a Linux malware dubbed FontOnLake, that is continuously being upgraded with new features and engineered to enable remote access to its operators. To conceal its existence, FontOnLake's presence is always accompanied by a rootkit. FontOnLake's toolset includes three components that consist of trojanized versions of legitimate Linux utilities that are used to load kernel-mode rootkits and user-mode backdoors, all of which communicate with one another using virtual files. Their scale and advanced design suggest that the authors are well versed in cybersecurity and that these tools might be reused in future campaigns.

See the full report here: https://thehackernews.com/2021/10/researchers-warn-of-fontonlake-rootkit.html

Cox Media Group confirms ransomware attack that took down broadcasts

American media Cox Media Group (CMG) confirmed that it was hit by a ransomware attack impacted approximately over 800 individuals that took down live TV and radio broadcast streams in June 2021. CMG immediately took down systems offline after the attack was detected and reported the incident to the FBI after starting an investigation. The media company found proof that the attackers harvested personal info but not stolen them. CMG did not pay a ransom as a result of this incident. The company has also taken several steps to improve its systems' security to detect and block further breach attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/cox-media-group-confirms-ransomware-attack-that-took-down-broadcasts/

Intuit warns QuickBooks customers of ongoing phishing attacks

Intuit has warned QuickBooks customers that they are targeted by an ongoing phishing campaign impersonating the company and trying to lure potential victims with fake renewal charges. The company said it received reports from customers that they were emailed and told that their “QuickBooks plans had expired”. The recommended way to deal with them is not to click any links embedded in the emails or open attachments and to delete them to avoid being infected or redirected to a phishing landing pages. There were couple of Phishing campaigns attempted on Intuit customers in this year.

See the full report here: https://www.bleepingcomputer.com/news/security/intuit-warns-quickbooks-customers-of-ongoing-phishing-attacks/

Engineering giant Weir Group hit by ransomware attack - BleepingComputer

Scottish multinational engineering firm Weir Group has disclosed an "attempted ransomware attack" that led to "significant temporary disruption" in September. Weir's cybersecurity systems and controls responded quickly to the threat and took robust action. This included isolating and shutting down IT systems including core Enterprise Resource Planning (ERP) and engineering applications. This attack had no impact on Q3 orders since all facilities are operational, and customer impact is currently being mitigated. Weir Group is also working on progressively restoring capabilities on a partial basis in the coming weeks, in order of business priority.

See the full report here: https://www.bleepingcomputer.com/news/security/engineering-giant-weir-group-hit-by-ransomware-attack/

Google Warning: Hackers Develop New Trick to Inject Undetectable Malware on Windows PCs! - iTech Post

Google researchers have warned about OpenSUpdater, a line of software that are now using flawed digital signatures to bypass detection in Windows security software and not to be detected by OpenSSL code used in security scanners. Once that fake certificate accepted by Windows, the attack allows OpenSUpdater to breach security defenses, deploying and launching the samples on a victim's computer without any issues. Google Alerts Microsoft About New Hacking Technique and also presently collaborating with the search titan's Safe Browsing team to impede OpenSUpdater from further spreading onto PCs and devices.

See the full report here: https://www.itechpost.com/articles/107286/20211009/google-warning-hackers-develop-new-trick-inject-undetectable-malware-windows.htm

Ransomware Group FIN12 Aggressively Going After Healthcare Targets

The financially motivated threat actor, FIN12, is targeting healthcare organizations in a disturbing way with a disproportionate focus on organizations with more than $300 million in revenue. Victims also include education, financial, manufacturing, and technology sectors, located in North America, Europe, and the Asia Pacific.

See the full report here: https://thehackernews.com/2021/10/ransomware-group-fin12-aggressively.html

Sky.com servers exposed via misconfiguration

Sky, a subsidiary of Comcast, is Europe’s largest media company. Security Researchers found an exposed configuration file that included plain text access credentials to multiple databases on a domain hosted by the Sky media conglomerate. The company has now remediated the issue.

See the full report here: https://securityaffairs.co/wordpress/123143/data-breach/sky-com-server-misconfiguration.html

Chinese hackers target political issues, universities in Taiwan, Hong Kong: Report - Republic World

According to Microsoft's 2021 Digital Defense Report, Chinese hackers are showing geopolitical goals by targeting political issues and universities in Taiwan and Hong Kong. The "Chromium" cyber activity group targeted important social, economic, and political concerns surrounding Hong Kong and Taiwan, as well as China's neighbors India, Malaysia, Mongolia, Pakistan, and Thailand.

See the full report here: https://www.republicworld.com/world-news/china/chinese-hackers-target-political-issues-universities-in-taiwan-hong-kong-report.html

Microsoft adds tamper protection to Windows 11 security baseline - BleepingComputer

Microsoft has released the final version of its security configuration baseline settings for Windows 11, downloadable today using the Microsoft Security Compliance Toolkit. When enabling the Microsoft Security Baseline for Windows 11, Redmond urges admins to ensure that Microsoft Defender for Endpoint's tamper protection feature, which adds additional protection against human-operated ransomware attacks, is enabled.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-adds-tamper-protection-to-windows-11-security-baseline/

Bank of America insider charged with money laundering for BEC scams - BleepingComputer

The U.S. District Court for the Eastern District of Virginia has charged three men with money laundering and aggravated identity theft after allegedly conducting a business email compromise (BEC) scheme. The indictment alleges that the three men infiltrated the corporate networks of small and large companies in the United States and across the globe, between January 2018 and March 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/bank-of-america-insider-charged-with-money-laundering-for-bec-scams/

Trucking Company Discloses Data Breach from Ransomware Attack - JD Supra

Trucking company Forward Air revealed in a filing with the Securities and Exchange Commission that it suffered a ransomware attack in December 2020, which caused business disruption as it was forced to suspend its electronic data interfaces with its customers. Forward Air is now notifying current and former employees that their personal information was potentially viewed or taken by an unknown actor. The stolen data includes names, addresses, dates of birth, Social Security numbers, passport numbers, bank account numbers, and driver’s license numbers.

See the full report here: https://www.jdsupra.com/legalnews/trucking-company-discloses-data-breach-6015873/

Malware alert: Here's why you shouldn't open the 'Amul Gift' link - The Federal

As Amul, India’s go-to dairy brand celebrates its 75th anniversary year, scamsters are milking the opportunity to steal personal data of unwary internet users through a ‘free gift’ link. Cyber experts claim that these links contain a virus and could be used by fraudsters to access the user’s personal and banking data. For anyone who gets the link as a forward from an unknown number, experts advise reporting it as a scam to WhatsApp and block it immediately.

See the full report here: https://thefederal.com/news/malware-alert-heres-why-you-shouldnt-open-the-amul-gift-link/

US nuke sub plans leaked on SD card hidden in peanut butter sandwich, claims FBI

The United States Department of Justice has announced a leak of information pertaining to the design of the nuclear-powered Virginia-class submarine and the arrest of the alleged leakers. An employee of the Department of the Navy who served as a nuclear engineer contacted entities that he believed represented a foreign power and offered to sell "Restricted Data concerning the design of a nuclear-powered warship".

See the full report here: https://www.theregister.com/2021/10/11/doj_alleges_nuclear_sub_data_leak/

New Danger: Ransomware hits finance industry hard - The Financial Express

Financial services is among the most highly regulated industries in the world. Organizations must adhere to myriad regulations, including SOX, GDPR, and PCI DSS, that include pricey penalties for non-compliance and data breaches. Financial services organizations hit by ransomware face more than $2 million in recovery costs. According to IT security firm Sophos’ new survey report, titled “The State of Ransomware in Financial Services 2021,” this figure exceeds the global average of $1.85 million.

See the full report here: https://www.financialexpress.com/industry/new-danger-ransomware-hits-finance-industry-hard/2347554/

Neiman Marcus data breach exposes personal info of 4.6M customers - Compliance Week

Neiman Marcus Group, Inc., originally Neiman-Marcus, is an American chain of luxury department stores owned by the Neiman Marcus Group, headquartered in Dallas, Texas. The company revealed Thursday it learned in September that “an unauthorized party” accessed customer names and addresses, credit card information, and gift card numbers back in May 2020.

See the full report here: https://www.complianceweek.com/cybersecurity/neiman-marcus-data-breach-exposes-personal-info-of-46m-customers/30890.article

Apple Releases Urgent iPhone and iPad Updates to Patch New Zero-Day Vulnerability

Apple has rolled out a security update for iOS and iPad to address a critical vulnerability that could be exploited by any remote attacker. The flaw, assigned the identifier CVE-2021-30883, concerns a memory corruption issue in the "IOMobileFrameBuffer" component that could allow an application to execute arbitrary code with kernel privileges. With the latest fix, the company has resolved a record 17 zero-days to date in 2021.

See the full report here: https://thehackernews.com/2021/10/apple-releases-urgent-iphone-and-ipad.html

LibreOffice, OpenOffice bug allows hackers to spoof signed docs - BleepingComputer

LibreOffice is a free and open-source office suite, developed by The Document Foundation. OpenOffice: Apache OpenOffice (AOO) is an open-source office productivity software suite. Four researchers at the Ruhr University Bochum found out a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source in LibreOffice and OpenOffice.Both LibreOffice and OpenOffice have pushed updates to address it.

See the full report here: https://www.bleepingcomputer.com/news/security/libreoffice-openoffice-bug-allows-hackers-to-spoof-signed-docs/

Ukraine Arrests Operator of DDoS Botnet with 100,000 Compromised Devices

Ukrainian law enforcement authorities on Monday disclosed the arrest of a hacker responsible for the creation and management of a "powerful botnet".This botnet was used to carry out distributed denial-of-service (DDoS) and spam attacks on behalf of paid customers. The Ukrainian police agency said it conducted a raid of the suspect's residence and seized their computer equipment as evidence of illegal activity.

See the full report here: https://thehackernews.com/2021/10/ukraine-arrests-operator-of-ddos-botnet.html

Microsoft: Iran-linked hackers target US defense tech companies - BleepingComputer

Researchers at Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU) have found out that Iran-linked threat actors are targeting the Office 365 tenants of US and Israeli defense technology companies in extensive password spraying attacks.In password spray attacks, threat actors attempt to brute-force accounts by using the same passwords across multiple accounts simultaneously, which allows them to hide failed attempts using different IP addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-iran-linked-hackers-target-us-defense-tech-companies/

Quest-owned fertility clinic announces data breach after August ransomware attack - ZDNet

Quest Diagnostics is an American clinical laboratory. A Fortune 500 company, Quest operates in the United States, Puerto Rico, Mexico, and Brazil. It was hit by a ransomware attack in August that hit ReproSource, a fertility clinic owned by the company. The ransomware attack led to a data breach, exposing a significant amount of health and financial information for about 350,000 ReproSource patients.

See the full report here: https://www.zdnet.com/article/quest-owned-fertility-clinic-announces-data-breach-after-august-ransomware-attack/

Chinese hackers use Windows zero-day to attack defense, IT firms - BleepingComputer

Researchers at Kaspersky security have found out a malware known as MysterySnail.They also found an elevation of privilege exploits targeting the Win32k driver security flaw. A Chinese-speaking hacking group exploited a zero-day vulnerability in the Windows Win32k kernel driver to deploy a previously unknown remote access trojan (RAT).

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-windows-zero-day-to-attack-defense-it-firms/

Hackers strike computers at a Fresno health network. Whose information was stolen? - Fresno Bee

United Health Centers, which operates nearly two dozen health clinics in Fresno, Kings and Tulare counties, was reportedly targeted in a recent ransomware attack by computer hackers, exposing private patient information to the online world.The ransomware attack reportedly forced United Health Centers to shut down its entire computer network for a time.

See the full report here: https://www.fresnobee.com/news/local/article254934007.html

Olympus US systems hit by cyberattack over the weekend - BleepingComputer

Olympus, a leading medical technology company, was forced to take down IT systems in the Americas (U.S., Canada, and Latin America) following a cyberattack that hit its network Sunday, October 10, 2021. The company has not yet disclosed if customer or company data was accessed or stolen during the cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/olympus-us-systems-hit-by-cyberattack-over-the-weekend/

Dutch police send warning letters to DDoS booter customers - BleepingComputer

Dutch authorities gave a final warning to more than a dozen customers of a distributed denial-of-service (DDoS) website, letting them know that continued cyber offenses lead to prosecution.The police learned about their activity after starting to investigate the website in 2020, following complaints from a game server that was the victim of a DDoS attack via minesearch.rip.

See the full report here: https://www.bleepingcomputer.com/news/security/dutch-police-send-warning-letters-to-ddos-booter-customers/

Mumbai cyber cell’s email hacked, infected file sent to other units - Times of India

The email ID of the east region cyber cell of Mumbai police was hacked on Tuesday and phishing emails were sent to other police cells, with an infected PDF attachment. Recipients of the email have been advised by the police to not open the file as it could result in a malware infestation and thus information pilferage. Officials said they were trying to technically trace the hackers.

See the full report here: https://timesofindia.indiatimes.com/city/mumbai/mumbai-after-chinese-hack-on-grid-pak-hand-likely-in-phishing/articleshow/86978330.cms

MyKings botnet still active and making massive amounts of money - BleepingComputer

The MyKings botnet, also known as Smominru, is like a mash-up of recent security trends: it has been used to mine cryptocurrency, it has taken advantage of users' failure to patch their systems, and it has employed a software exploit released by the Shadow Brokers. The latest team of researchers to look into MyKings is Avast Threat Labs, which gathered 6,700 unique samples to analyze since the beginning of 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/mykings-botnet-still-active-and-making-massive-amounts-of-money/

Hackers accessing webcams a top WFH security concern - RTE.ie

According to a survey carried out by Auxilion, a Dublin-headquartered provider of digital, cloud, and IT services suspicious emails and hackers accessing webcams are the top security concerns for those working from home. The survey which was conducted Censuswide was carried out among 500 office workers in Ireland. On a positive note, it revealed that 82% of respondents are confident in their ability to detect phishing emails.

See the full report here: https://www.rte.ie/news/business/2021/1013/1253561-hackers-accessing-webcams-a-top-wfh-security-concern/

Multiple Oklahoma sheriff's department websites 'hacked' | News | stwnewspress.com - Stillwater News Press

A self-described hacker is claiming to have access to the websites of multiple sheriff's departments in Oklahoma. The front page of the website was replaced with an image of a soldier in silhouette holding a flag with foreign symbols. Below the image was Turkish writing with links to the hacker’s Instagram and Facebook accounts. At the bottom of the page was also an embedded YouTube video of Turkish President Erdogan. The attacker claimed their goal was to spread their religion and broadcast the Turkish President’s speech. No ransom was asked for.

See the full report here: https://www.stwnewspress.com/news/multiple-oklahoma-sheriffs-department-websites-hacked/article_27f6349e-2c59-11ec-a1d1-5fb8ec2fb860.html

Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers

According to researchers, vulnerabilities in the Brizy Page Builder plugin for WordPress sites could be chained together to allow attackers to completely take over a website and it also came with a stored cross-site scripting (XSS) issue and an arbitrary file-upload vulnerability prior to version 2.3.17.

See the full report here: https://threatpost.com/brizy-wordpress-plugin-exploit-site-takeovers/175463/

Espionage Attackers Were Using Windows Zero Day Vulnerability - Redmondmag.com

According to Kaspersky researchers, a Chinese-speaking advanced persistent threat (APT) group had been exploiting a zero-day Windows vulnerability, which got a patch from Microsoft on Tuesday. The attackers typically dropped a remote access Trojan (RAT) to set up a command-and-control point on Windows Server.

See the full report here: https://redmondmag.com/articles/2021/10/13/espionage-attackers-were-using-windows-zero-day-vulnerability.aspx

Tags: weekly bulletin, all industries, global