Threat Intelligence Bulletin: 10/15/2021 - 10/21/2021

Breaking News: 2021-10-16 - 2021-10-21

New Ransomware Encrypts Data and Makes Nasty Threats - IT World Canada

Cybercriminals spread a new form of ransomware called Yanluowang in attacks on victims, in which they not only encrypt the network, but also issue threats to launch distributed denial of service (DDoS) attacks-– flooding their websites with so much traffic that they crash. They also threaten the victims with further attacks or even permanently delete the encrypted data when the victim requests outside help.

See the full report here: https://www.technewsday.com/2021/10/15/new-ransomware-encrypts-data-and-makes-nasty-threats/

New Windows 10 KB5006670 update breaks network printing - BleepingComputer

Windows 10 users and administrators report widescale network printing issues after installing the KB5006670 cumulative update released this week as part of the October 2021 Patch Tuesday. Since installing this update, users are reporting that they cannot print to network print servers, with some users receiving 0x00000709 or 'Element not found' errors. The recent Registry value remediation released on September is no longer working, so there are numerous other suggestions from Windows admins on how to resolve the networking printing issues caused by the Windows 10 KB5006670 are referred to users.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-10-kb5006670-update-breaks-network-printing/

Twitch downplays this month's hack, says it had minimal impact - BleepingComputer

After a security incident this month, Twitch updated that the massive data leak happened last week had minimal impact and only affected a small number of users. The company also stated that no login credentials or full credit card numbers/payment data belonging to users or streamers were exposed, since the systems that store Twitch login credentials, which are hashed with bcrypt. Twitch mentioned that the Data exposed in the incident are the documents from Twitch's source code repository and a subset of creator payout data due to a faulty server configuration change that exposed it to the Internet.

See the full report here: https://www.bleepingcomputer.com/news/security/twitch-downplays-this-months-hack-says-it-had-minimal-impact/

Governments worldwide to crack down on ransomware payment channels - BleepingComputer

Senior officials from 31 countries and the European Union on the Counter-Ransomware Initiative said that their governments would take action to disrupt the cryptocurrency payment channels used by ransomware gangs to finance their operations which would impact the business model. Several complementary efforts will also include disrupting the ransomware ecosystem through law enforcement collaboration and so on. Multiple ongoing efforts are also on the line to disrupt ransomware threats.

See the full report here: https://www.bleepingcomputer.com/news/security/governments-worldwide-to-crack-down-on-ransomware-payment-channels/

Russian cybercrime gang targets finance firms with stealthy macros - BleepingComputer

A new phishing campaign dubbed MirrorBlast is deploying weaponized Excel documents that are extremely difficult to detect to compromise financial service organizations. The actors behind the campaign appear to be ‘TA505,’ an active Russian threat group that has a long history of creativity in the way they lace Excel documents in malspam campaigns. The developers of these malicious documents have made considerable effort to obfuscate malicious code, achieving zero detections on VirusTotal. If the victim is tricked into opening the malicious document and “enable content” in Microsoft Office, the macro executes a JScript script which downloads and installs an MSI package.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-cybercrime-gang-targets-finance-firms-with-stealthy-macros/

CISA Issues Warning On Cyber Threats Targeting Water and Wastewater Systems

CISA released an advisory and warned of ransomware attacks aimed at disrupting water and wastewater facilities (WWS). The agency highlighted five different cyber attacks from 2019 to early 2021 targeting the water and wastewater facilities Sector. The advisory has recommendations to improve cyber security in these critical plants.

See the full report here: https://thehackernews.com/2021/10/cisa-issues-warning-on-cyber-threats.html

US Treasury FinCEN linked $5.2 billion in BTC transactions to ransomware payments

The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) analyzed a large dataset and concluded that approximately $5.2 billion worth of Bitcoin transactions are likely to be associated with operations of the top 10 most commonly reported ransomware variants. Also, they projected that 2021 has a higher ransomware-related transaction value than what was filed in the previous 10 years combined.

See the full report here: https://securityaffairs.co/wordpress/123431/malware/fincen-ransomware-payments.html

Trickbot spreads malware through new distribution channels

The infamous TrickBot (ITG23 and Wizard Spider) malware operators have expanded the distribution channels to deliver malicious payloads, such as Conti ransomware. Surprisingly, the Trickbot botnet continues to evolve despite the operations conducted by law enforcement aimed at dismantling it.

See the full report here: https://securityaffairs.co/wordpress/123455/cyber-crime/trickbot-expands-distribution-channels.html

Amazon textbook rental service scammed for $1.5m

A 36-year-old man from Portage, Michigan, was arrested on Thursday for allegedly renting thousands of textbooks from Amazon and selling them rather than returning them. The man has been indicted on charges of mail and wire fraud, transporting stolen property across state lines, aggravated identity theft, and lying to the FBI.

See the full report here: https://www.theregister.com/2021/10/15/amazon_textbook_rental/

Windows 11 build 22000.282 fixes CPU performance issues, taskbar bug - BleepingComputer

Microsoft released Windows 11 preview build 22000.282 with fixes for AMD CPU performance issues and a bug that displayed the Windows 10 taskbar. This build is available to Windows Insiders in the Beta and Release channels and fixes a long list of bugs plaguing users since Windows 11 was released.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-build-22000282-fixes-cpu-performance-issues-taskbar-bug/

Canon sued for disabling scanner when printers run out of ink - BleepingComputer

Canon USA is being sued for not allowing owners of certain printers to use the scanner or faxing functions if they run out of ink. A customer of Canon filed the class-action lawsuit on Tuesday alleging deceptive marketing and unjust enrichment by the printer manufacturer.

See the full report here: https://www.bleepingcomputer.com/news/legal/canon-sued-for-disabling-scanner-when-printers-run-out-of-ink/

Chinese tech minister says he's 'dealt with' 73,000 websites that breached the law

Andrew Birge, US Attorney for the Western District of Michigan, said a 36-year-old man from Portage, Michigan, was arrested on Thursday for allegedly renting thousands of textbooks from Amazon and selling them rather than returning them. The charges of mail and wire fraud, transporting stolen property across state lines, aggravated identity theft, and lying to the FBI were put on the person.

See the full report here: https://www.theregister.com/2021/10/18/china_tech_crackdown_impact/

Windows 10, Linux, iOS, Chrome and Many Others at Hacked Tianfu Cup 2021

The Tianfu Cup is modeled after Pwn2Own in that hackers try to break into the latest devices and systems using original, never-before-seen methods. The competition hosts three concurrent tournaments, to demonstrate vulnerabilities, crack devices, and to compromise operating systems. In the fourth edition of the international cybersecurity contest held in the city of Chengdu, China , Windows 10, iOS 15, Google Chrome, Apple Safari, Microsoft Exchange Server, and Ubuntu 20 were successfully broken into using original, never-before-seen exploits.

See the full report here: https://thehackernews.com/2021/10/windows-10-linux-ios-chrome-and-many.html

The ShinyHunters Hacker Group Collects Data Like Gamers Collect Pokémon - MakeUseOf

ShinyHunters is a criminal black-hat hacker group that is said to have been involved in numerous data breaches. The group uses the Pokémon Umbreon as its avatar on social media and hacker forums.ShinyHunters retreats and goes underground after a successful attack. During this period of public inactivity, which usually lasts a few months, the hackers develop new products and tactics, select their targets, and then strike again.

See the full report here: https://www.makeuseof.com/shinyhunters-hacker-group/

Sysinternals apps can now auto-update via the Microsoft Store - BleepingComputer

Windows Sysinternals is a website that offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.​Microsoft added their Sysinternals Suite to the Microsoft Store which would allow the popular Sysinternals utilities to be updated automatically as new versions are released.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/sysinternals-apps-can-now-auto-update-via-the-microsoft-store/

REvil ransomware shuts down again after Tor sites were hijacked - BleepingComputer

REvil ransomware is a file blocking virus considered a serious threat that encrypts files after infection and discards a ransom request message. The REvil ransomware operation has likely shut down once again after an unknown person hijacked their Tor payment portal and data leak blog. The threat actor told affiliates to contact for campaign decryption keys via Tox.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/

Hacker Appears To Deface Part Of Trump’s Website - Forbes

Former President Donald Trump's website was hacked Monday and defaced by a purported pro-Turkey “hacktivist,”.Trump’s campaign site was also reportedly defaced last October by hackers who claimed — without any evidence — they had classified information denigrating Trump. According to the archived versions of the page,Trump’s website first appeared to be defaced with references to RootAyyildiz on October 9.

See the full report here: https://www.forbes.com/sites/joewalsh/2021/10/18/hacker-appears-to-deface-part-of-trumps-website/

Trustwave released a free decryptor for the BlackByte ransomware

BlackByte uses a raw key and the Advanced Encryption Standard (AES) to encrypt a victim's files, meaning that anyone in the possession of the raw key would be able to decrypt the data. The ransomware fetches a .PNG file that contains multiple keys, which Trustwave researchers used to create the decryptor.

See the full report here: https://securityaffairs.co/wordpress/123541/malware/blackbyte-ransomware-decryptor.html

Hackers mining third-party apps to steal your health data - India TV News

Hospitals and health care systems have become a major target for hackers during the Covid-19 pandemic and a new report has claimed that third-party apps that pull patient data from electronic health record (EHR) systems are vulnerable to hacking.The records included demographics, lab results, medications, procedures, allergies, and more.According to warnings from intelligence agencies in the US, Europe and Canada nation-state-backed hackers are also trying to infiltrate healthcare systems and steal vaccine-related research and other information.

See the full report here: https://www.indiatvnews.com/technology/news-hackers-mining-third-party-apps-to-steal-your-health-data-741110

Ransomware attack hits owner of dozens of local TV stations - NBC News

Sinclair Broadcast Group, Inc. is a publicly-traded American telecommunications conglomerate that is controlled by the descendants of company founder Julian Sinclair Smith. The firm was hit by ransomware over the weekend and the hackers had used ransomware to encrypt some of its key operational servers, rendering them unusable, and stolen some data.

See the full report here: https://www.nbcnews.com/tech/security/ransomware-attack-hits-owner-dozens-news-stations-rcna3180

Japanese messaging giant Line admits it mishandled user data, promises to do better

LINE is a freeware app for instant communications on electronic devices such as smartphones, tablet computers, and personal computers. LINE users exchange texts, images, video, and audio, and conduct free VoIP conversations and video conferences. The firm has confirmed that it had put the users' personal information at risk as its data protection regimes had multiple shortcomings.The company also admitted it fibbed to users when it promised that all data was stored in Japan – some also went to servers located in South Korea.

See the full report here: https://www.theregister.com/2021/10/19/line_data_governance_report/

FBI warns of fake govt sites used to steal financial, personal data - BleepingComputer

The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. It has warned the US public that threat actors actively use fake and spoofed unemployment benefit websites to harvest sensitive financial and personal information from unsuspecting victims. The FBI said it identified 385 domains, with eight of them impersonating government sites linked to official unemployment benefits platforms.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-govt-sites-used-to-steal-financial-personal-data/

Email phishing crapcannon operators TA505 are back from the dead, researchers warn

TA505 is a financially motivated threat group that has been active since at least 2014. The group is known for frequently changing malware and driving global trends in criminal malware distribution. According to enterprise security software slinger Proofpoint, TA505 is back and has restarted its mass emailing campaigns in September – armed with new malware loaders and a RAT.

See the full report here: https://www.theregister.com/2021/10/19/ta505_email_phishing_threat_group_returns/

Candy Corn Maker Hit With Ransomware

The Ferrara Candy Company is an American candy manufacturer, based in Chicago, Illinois, and owned by the Ferrero Group. Ferrara Candy Co., which makes Brach’s Candy Corn, Sweet Tarts, Nerds, Keebler brand products, and more, reportedly found it had been attacked on Oct. 9 by ransomware that locked down some of its systems and halted manufacturing in some plants.

See the full report here: https://www.darkreading.com/attacks-breaches/candy-corn-maker-hit-with-ransomware

Acer hacked twice in a week by the same threat actor - BleepingComputer

Computer giant Acer suffered two cyberattacks but in two different locations by the same threat actors. The threat actors known as 'Desorden' emailed journalists and informed them that they hacked Acer India's servers and stole data, including customer information. Then they breached Acer Taiwan's servers on October 15th and stole employee and product information. The threat actors wanted to prove that Acer is still vulnerable.

See the full report here: https://www.bleepingcomputer.com/news/security/acer-hacked-twice-in-a-week-by-the-same-threat-actor/

Squirrel Bug Lets Attackers Execute Code in Games, Cloud Services

Squirrel is an open-source, object-oriented programming language used by video games and cloud services for customization and plugin development. It's a lightweight scripting language that suits the size, memory bandwidth, and real-time requirements of applications like video games and embedded systems. An out-of-bounds read vulnerability in the Squirrel programming language lets attackers break out of sandbox restrictions and execute arbitrary code within a Squirrel virtual machine (VM), thus giving a malicious actor complete access to the underlying machine.

See the full report here: https://threatpost.com/squirrel-attackers-execute-code-games-cloud-services/175586/

Notorious Russian ransomware gang Evil Corp. reportedly hit Sinclair Broadcast Group - CyberScoop

Sinclair Broadcast Group, Inc. is a publicly-traded American telecommunications conglomerate that is controlled by the descendants of company founder Julian Sinclair Smith. Last weekend’s cyberattack on Sinclair Broadcast Group was done by Evil Corp. An evil corporation is a trope in popular culture that portrays a corporation as ignoring social responsibility in order to make money for its shareholders. A senior threat analyst at Recorded Future said that the group used a new strain of malware called Macaw in the Sinclair attack.

See the full report here: https://www.cyberscoop.com/sinclair-broadcast-group-russia-ransomware-evil-corp-macaw/

Google: Phishing Campaign Targets YouTube Creators

Google's Threat Analysis Group (TAG) today disclosed the details of a financially motivated phishing campaign that has targeted YouTube creators with "cookie theft" malware, and which it has been disrupting, since 2019.Cookie theft, which TAG also describes as a "pass-the-cookie" attack, is a session hijacking tactic that gives an attacker access to user accounts with session cookies stored in the browser.

See the full report here: https://www.darkreading.com/attacks-breaches/google-phishing-campaign-targets-youtube-creators

US govt to ban export of hacking tools to authoritarian regimes - BleepingComputer

The Commerce Department's Bureau of Industry and Security (BIS) has announced that it would ban U.S. companies from exporting and reselling software and hardware tools that could be used to fuel authoritarian practices through malicious hacking activities and human rights abuse. The new rule is designed to block malicious threat actors' access to hacking tools that could be used to target U.S. entities.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-to-ban-export-of-hacking-tools-to-authoritarian-regimes/

'Squid Game' malware has already arrived on Android phones - Input

Researchers have reported that a Squid Game-themed Android app full of malware has been created by the threat actors. Running the app on an Android device might result in malicious ad fraud (wherein ad revenue is inflated using fake impressions numbers) or unwanted SMS subscriptions. After being alerted to the app’s existence, Google wiped it from the Play Store.

See the full report here: https://www.inputmag.com/tech/squid-game-malware-has-already-arrived-on-android-phones

Hackers Hit OSF Little Company of Mary Medical Center - Patch.com

OSF HealthCare is a not-for-profit Catholic health care organization that operates a medical group, hospital system, and other health care facilities in Illinois and Michigan. It had identified a data security incident that disrupted some of its IT systems which made OSF shut down its systems. Along with the law enforcement, OSF had the third-party forensic investigator for the investigation.OSF has implemented additional safeguards and technical security measures to further protect and monitor its systems.

See the full report here: https://patch.com/illinois/evergreenpark/hackers-hit-osf-little-company-mary-medical-center