Threat Intelligence Bulletin: 10/22/2021 - 10/28/2021

Phishing Ecosystem Series: Lure Distribution

In order for phishing attacks to be successful, they must first be distributed to potential victims. Phishing links sent to potential victims are referred to as “lures,” as they are designed to “hook” victims into following the link embedded in the lure, and follow the phishing workflow. Depending on the targeted brand and technical capability of the attacker, lures can be distributed in many forms.

Phishing lures generally request the recipient to take an action. For example, a victim may be informed their account has been locked and they must log in to restore services, creating a sense of urgency that the victim must enter their details quickly in order to resolve the apparent issue.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Avoid opening unsolicited attachments and never click suspicious links
• Do not share passwords, and do not reuse the same password on different websites and applications.
• If you are alerted or suspect a compromised account, change the password immediately.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Details

The two most popular forms of phishing lure distribution are via email and SMS, with email based phishing attacks being the more common of the two forms and cheapest method of lure distribution. This advisory will cover some of the most used services made available within the phishing ecosystem present on covert channels and dark web networks.

Email Lures

Whilst over time the traditional method of phishing via email has since expanded into other lure distribution mechanisms, phishing campaigns using email lures are still very commonplace. However, as vendors have improved spam and phishing detection capabilities, threat actors have also developed tools and processes to bypass these security measures.

Figure 1: An example of a phishing email targeting a well known commerce platform
Source: Twitter, @DissectMalware

Phishing emails consist of HTML code formatted in such a way that it replicates the targeted brand's own email style. Logos, fonts, structure, and image placement are key in making the email look legitimate to the recipient. In the phishing ecosystem, these types of phishing emails are called “letters.” Many offer services to create these letters via covert channels and dark web forums with each letter, or template, being unique depending on the requirements. Sellers will also tout these templates as “FUD” or “fully undetectable,” meaning that they will bypass most conventional anti-spam or phishing email checks and arrive successfully in the recipient's inbox.

The authors of these templates employ certain techniques in order to increase the likelihood of the email not being blocked or flagged as spam, mainly via “encryption.” These “encrypted letters” are simply obfuscated HTML templates, where the code has been altered in such a way that it still renders correctly. Certain elements in the code are altered and encoded to hide any potential phrases, keywords, or code snippets which are commonly blocked at the email perimeter with signature based detection.

Figure 2: Storefront of a well-known phishing kit provider, which provides free “letter encryption” tools as part of their services
Source: ZeroFox Threat Intelligence

Once the threat actor has obtained their phishing email templates, distribution can begin. Within various channels there are multiple guides and videos made available, showing would-be phishers how they can quickly spin up the required infrastructure on various platform-as-a-service providers, and begin sending emails at scale with available tools.

SMS Lures

Phishing via SMS or “smishing” has gained popularity rapidly over the past few years as it became standard for many businesses to utilise SMS, keeping customers informed of updates and issues. Threat actors leveraged the adoption of this new method of communication to trick unsuspecting victims, some of whom may be well aware of phishing emails and how to identify such lures.

Within the modern ecosystem of phishing attacks, SMS plays a large part with many groups and individuals operating within covert channels and dark web networks selling services, equipment, and data in order to facilitate smishing attacks at scale. This allows low skilled threat actors with few initial resources or skills, to distribute phishing lures en masse with minimal effort and cost.

Despite recent arrests, and law enforcement cracking down on groups selling services dedicated to providing smishing related services, there has not been a noticeable decrease in activity. Individuals advertising bulk SMS services and “leads” still permeate the many channels which exist on encrypted messaging platforms, solely for this purpose.

Figure 3: Sellers on encrypted messaging platforms advertising services dedicated to smishing
Source: ZeroFox Threat Intelligence

When conducting a phishing campaign, the threat actor typically reaches out to sellers to enlist their services in a couple of areas. First, the threat actor needs to obtain a list of mobile telephone numbers to receive the phishing lures. These numbers must be valid, and actively used – as sending messages to numbers which are not in service will not be of any value.

“Leads” are files containing mobile phone numbers, confirmed to be genuine and in use via Home Location Register (HLR) checks, a database containing up-to-date information for every mobile phone subscriber worldwide. A HLR lookup can tell you if a mobile phone number is active, switched on, and which network that number has been assigned to. Sellers will offer leads consisting of numbers from specific geographical locations, carriers, or potentially, mobile numbers associated with specific types of services or accounts.

Figure 4: Screenshots of an online store front dedicated to selling lists of active mobile numbers associated with certain accounts.
Source: ZeroFox Threat Intelligence

After obtaining their leads, the next step is to begin sending phishing lures via SMS to the numbers at scale. To do this, the threat actor may pay either a third party to directly send these messages, or use one of many “Bulk SMS” online services dedicated for this purpose.
These providers also provide the ability to spoof the messages sender ID, as such, depending on how the recipient's mobile device groups SMS messages, the phishing lure may end up listed under the legitimate senders message history.

Figure 5: Home page for an online service selling Bulk SMS sending services
Source: ZeroFox Threat Intelligence

Specialist equipment and software is used to facilitate this activity, which is difficult to proactively prevent, as International Mobile Equipment Identity (IMEI) and mobile numbers can be spoofed and changed at random. Threat actors insert multiple sim cards which can be easily swapped out if numbers are blocked. Connecting directly to these devices allows them to utilise specialist software to facilitate sending mass SMS phishing messages to specified recipients, based on the “leads” provided from whoever is employing their services.

Figure 6: GSM modem used for sending SMS spam available for purchase on a popular online marketplace
Source: ZeroFox Threat Intelligence

The campaign begins after the threat actor operating the phishing campaign provides the leads, SMS message content and desired sender ID to their chosen bulk SMS sender. Messages are sent quickly, as the longer it takes to send lures to all the provided numbers, the chance increases that telecommunications providers will begin receiving reports from recipients, and begin blocking IMEI numbers, slowing down their delivery progress.

Conclusion

While phishing utilising email-based lures is still a very popular method, phishing via SMS or “smishing” is seeing increased adoption due to several factors: The market for threat actors selling this service is incredibly competitive, driving costs down; creating believable lures requires minimal effort, through the use of URL shortening which is commonplace, even in legitimate SMS messages, and sender ID spoofing; Malicious SMS messages are a lot less likely to be blocked. ZeroFox assesses with a high likelihood that phishing campaigns utilising SMS lures will continue to increase and see further adoption.

Breaking News: 2021-10-22 - 2021-10-28

Twitter Suspends Accounts Used to Snare Security Researchers

The Google Threat Analysis Group (TAG) has discovered that Twitter accounts were used to catfish security researchers into downloading malware in a long-running cyber-espionage campaign attributed to North Korea. Twitter suspended two accounts- @lagal1990 and @shiftrows13as part of the operation.

See the full report here: https://threatpost.com/twitter-suspends-security-researchers/175524/

DNS attacks on the rise, organisations remain unprepared - SecurityBrief Australia

According to a new survey from the Neustar International Security Council (NISC) conducted in September 2021, Domain name system (DNS) attacks are impacting organizations at significant rates. The Domain Name System is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. Ransomware, distributed denial-of-service (DDoS), and targeted hacking of accounts have rounded out the top three perceived threats by NISC survey.

See the full report here: https://itbrief.co.nz/story/dns-attacks-on-the-rise-organisations-remain-unprepared

Bug in Popular WinRAR Software Could Let Attackers Hack Your Computer

WinRAR - the data compression, encryption, and archiving tool for Windows that opens RAR and ZIP files. A new vulnerability has been found out in WinRAR that could be abused by any remote attacker to execute arbitrary code on targeted systems. Basically, this vulnerability would intercept and modify requests sent to the user of the application.

See the full report here: https://thehackernews.com/2021/10/bug-in-free-winrar-software-could-let.html

PHI stolen from vendor in ransomware attack, exposing Humana and Anthem members - Becker's Hospital Review

Anthem and Humana are well-known insurers of the USA.Anthem and Humana began notifying members their protected health information has been exposed in a ransomware attack on a billing vendor. Both use the vendor to share information with Village Health, a kidney care provider. Humana reported that 4,424 patients have been affected and Anthem is unclear how many patients have been affected.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/phi-stolen-from-vendor-in-ransomware-attack-exposing-humana-and-anthem-patients.html

Microsoft Launches Security Program for Nonprofits

Microsft has rolled out a set of security tools built to complement its security suite and offer monitoring, attack notification, risk assessment, and security training for nonprofit organizations stating that threats targeting the sector continue to rise. Nonprofits will also have access to free security assessments to help them understand the flaws in their endpoints, identity access, infrastructure, network, and data. The main intention of the firm is to make the nonprofits aware of cybersecurity and also plan to protect their environments.

See the full report here: https://www.darkreading.com/endpoint/microsoft-launches-security-program-for-nonprofits

CoinMarketCap Hack Reportedly Leaks 3.1 Million User Email Addresses - Todayuknews - Todayuknews

3.1 million email addresses linked to CoinMarketCap accounts were reportedly being traded on hacking forums. CoinMarketCap, a price-tracking website for cryptocurrencies, has reportedly fallen victim to a hack that leaked 3.1 million (3,117,548) user email addresses. But the company has assured that the hackers did not gain access to any of the account passwords and also no evidence of a data leak from our own servers were found. One another recent hack on the Coinbase crypto exchange resulted in the compromise of 6,000 user accounts.

See the full report here: https://todayuknews.com/crypto-currency/coinmarketcap-hack-reportedly-leaks-3-1-million-user-email-addresses/

ALERT: FluBot malware targeting Android devices to steal banking information, NCC warns - TheCable

FluBot, a malware, reported by Nigeria Computer Emergency Response Team (ngCERT) as it impersonates Android mobile banking applications to draw fake web view on targeted applications’ and its goal transcends stealing personal data and essentially targetsstealing financial details. FluBot is also circulated through SMS and can snoop on incoming notifications, initiate calls, read or write SMSes, and transmit the victim’s contact list to its control centre. Additionally, the malware creates a backdoor which grants access to the user’s device, thus enabling the invader or attacker to launch other variants of malware. The ngCERT has released guidelines to protect telecoms consumers from falling victims.

See the full report here: https://www.thecable.ng/alert-flubot-malware-targeting-android-devices-to-steal-banking-information-ncc-warns

Facebook Introduces New Tool for Finding SSRF Vulnerabilities

Facebook designed a new tool to help security researchers hunt for Server-Side Request Forgery (SSRF) vulnerabilities. A SSRF attack enables an attacker to abuse a server’s functionality to read or update internal resources. Dubbed SSRF Dashboard, from Facebook features a simple interface that allows researchers to create unique internal endpoint URLs for targeting and then learn whether their URLs have been hit during an SSRF attempt. With the new tool, security researchers can reliably determine whether their SSRF proof-of-concept (PoC) code has been successful, given that only successful PoCs receive hits.

See the full report here: https://www.securityweek.com/facebook-introduces-new-tool-finding-ssrf-vulnerabilities

Popular NPM Package Hijacked to Publish Crypto-mining Malware

The U.S. Cybersecurity and Infrastructure Security Agency has warned of crypto-mining malware embedded in "UAParser.js," a popular JavaScript NPM library. The supply-chain attack targeting the open-source library saw three different versions — 0.7.29, 0.8.0, 1.0.0 — that were published with malicious code on Thursday following a successful takeover of the maintainer's NPM account. The issue has been patched in versions 0.7.30, 0.8.1, and 1.0.1.

See the full report here: https://thehackernews.com/2021/10/popular-npm-package-hijacked-to-publish.html

FIN7 Lures Unwitting Security Pros to Carry Out Ransomware Attacks

The financially motivated cybercrime gang behind the Carbanak backdoor malware, FIN7, is looking to juice its ransomware game by recruiting IT staff to its fake “pen-testing” company. According to a report from Gemini Advisory, the group has set up a fake security company (called “Bastion Secure”) and is looking to hire security pros under the guise of needing red-teaming expertise for its clients. It is not the first time FIN7 has masqueraded as a legitimate security firm, but this latest gambit showcases its continued expansion into the ransomware area.

See the full report here: https://threatpost.com/fin7-security-pros-ransomware-attacks/175681/

Groove ransomware calls on all extortion gangs to attack US interests - BleepingComputer

The Groove ransomware gang is calling on all other ransomware operations to target US interests after law enforcement took down REvil's infrastructure last week. Over the weekend, the REvil ransomware operation was shut down again after an unknown third party hijacked their dark web domains. The blog post also warns ransomware operations not to target Chinese companies, as the gangs would need to use the country as a safe haven if Russia takes a stronger stance on cybercrime operating inside its country.

See the full report here: https://www.bleepingcomputer.com/news/security/groove-ransomware-calls-on-all-extortion-gangs-to-attack-us-interests/

Hacker sells the data for millions of Moscow drivers for $800

Russian media outlets purchased a database from the underground forum that contains 50 million records of Moscow driver data. The hackers were selling this data for $800, and after analysis, researchers found the data collected between 2006 and 2019. This data can be valuable to threat actors to conduct targeted phishing campaigns against the exposed individuals, leading to financial or credentials theft.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-sells-the-data-for-millions-of-moscow-drivers-for-800/

Microsoft Warns of TodayZoo Phishing Kit Used in Extensive Credential Stealing Attacks

Microsoft disclosed an extensive series of credential phishing campaigns, dubbed TodayZoo. This phishing campaign takes advantage of a custom phishing kit having at least five different phishing functionalities. The TodayZoo phishing campaign impersonates Microsoft and claims to be password reset or fax and scanner notification, to redirect victims to malicious pages to steal credentials.

See the full report here: https://thehackernews.com/2021/10/microsoft-warns-of-todayzoo-phishing.html

Threat Actors Abuse Discord to Push Malware - Threatpost

Discord, a digital communication platform, is abused by threat actors. They are using its Content Delivery Network and core features to deliver various types of malware like Remote Access Trojan. Initially, Discord is used by gamers, but now as it is used by organizations too. It might put 150 million users and corporate networks at risk.

See the full report here: https://threatpost.com/threat-actors-abuse-discord-to-push-malware/175663/

CISA: GPS software bug may cause unexpected behavior this Sunday - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) warned that GPS devices might experience issues over the weekend because of a timing bug impacting Network Time Protocol (NTP) servers running the GPS Daemon (GPSD) software. The bug is set to trigger this Sunday, on October 24th, and the implications are somewhat unpredictable as it could cause systems to become unresponsive or unavailable. CISA urges the affected owners and operators to update to GPSD version 3.23, released on August 8, 2021, or newer, to avoid all chances of facing problems.

See the full report here: https://www.bleepingcomputer.com/news/technology/cisa-gps-software-bug-may-cause-unexpected-behavior-this-sunday/

Cisco SD-WAN Security Bug Allows Root Code Execution

Cisco SD-WAN implementations are vulnerable to a high-severity privilege-escalation vulnerability in the IOS IE operating system that could lead to arbitrary code execution. Cisco’s SD-WAN portfolio allows businesses of all sizes to connect disparate office locations via the cloud using various networking technologies, including standard internet connections. The bug (CVE-2021-1529) is an OS command-injection issue, which enables attackers to execute unexpected, dangerous commands directly on the operating system that commonly wouldn’t be accessible.

See the full report here: https://threatpost.com/cisco-sd-wan-bug-code-execution-root/175669/

'Lone Wolf' Hacker Group Targeting Afghanistan and India with Commodity RATs

A new malware campaign targeting Afghanistan and India is exploiting a now-patched, 20-year-old flaw affecting Microsoft Office to deploy an array of commodity remote access trojans (RATs) that allow the adversary to gain complete control over the compromised endpoints. Cisco Talos attributed the cyber campaign to a lone wolf threat actor operating a Lahore-based fake IT company called Bunse Technologies as a front to carry out the malicious activities, while also having a history of sharing content that's in favor of Pakistan and Taliban dating back to 2016.

See the full report here: https://thehackernews.com/2021/10/lone-wolf-hacker-group-targeting.html

Tesco website and app back up after hack attempt - BBC News

Tesco plc is a British multinational grocery and general merchandise retailer headquartered in Welwyn Garden City, England. The website of the retail giant's services had crashed which made the shoppers to unable to order goods and track deliveries. The supermarket later confirmed on Twitter that its groceries website and app were back up and running, but it was temporarily using a "virtual waiting room" to manage the high volume of traffic.

See the full report here: https://www.bbc.com/news/business-59027423

Large DDoS attack shuts down KT's nationwide network - ZDNet

KT Corporation, formerly Korea Telecom, is a South Korean telecommunications company. KT is the second-largest wireless carrier in South Korea, with 16.493 million subscribers as of Q4 2017.KT earlier said it suspected a distributed denial-of-service (DDoS) attack brought down the network which made the customers using the telco's network were unable to access the internet for around 40 minutes at around 11 am on Monday. Later the firm confirmed that the widespread outage on Monday was due to a "routing error" and not a cyber attack as initially suspected.

See the full report here: https://www.zdnet.com/article/large-ddos-attack-shuts-down-south-korean-telcos-nationwide-network/

Fullerton Health vendor's server hacked; personal details of customers sold online - The Straits Times

Founded in 2010, Fullerton Health is a leading vertically integrated healthcare platform in the Asia Pacific with a proven track record of providing clients and patients with enterprise healthcare solutions. The hackers claimed they managed to steal personal details of Fullerton Health customers including insurance policy details of the Singaporeans that were hawked online.

See the full report here: https://www.straitstimes.com/singapore/courts-crime/fullerton-health-vendor-hacked-personal-details-of-customers-sold-online

Hackers using child exploitation images to disable people's Facebook accounts - 9News

Hackers are using images of child pornography as a means of infiltrating the Facebook accounts of some Australians. The disturbing images trigger an alert to Facebook which prompts the social media giant to disable the hacked account as it violates its community standards. Once disabled, the hackers are more easily able to gain control of the person's Facebook account.

See the full report here: https://www.9news.com.au/world/facebook-cybersecurity-social-media-why-hackers-are-posting-child-pornography-onto-peoples-accounts/e1e1af79-1ab1-4673-94f6-918d7bb74c73

Thailand: Baht 130 million stolen by hackers returned in full - The Star Online

The Bank of Thailand is the central bank of Thailand. Scammers hacked into 10,700 debit cards and stole a total of 130 million baht between October 1 and 17. The Bank of Thailand (BOT) and the Thai Bankers Association (TBA) have announced that all the money hackers stole from people’s bank accounts has been returned. The hacked credit cards were frozen. For extra safety BOT and TBA are planning to add additional verification measures such as one-time password (OTP) for online transactions.

See the full report here: https://www.thestar.com.my/aseanplus/aseanplus-news/2021/10/24/thailand-baht-130-million-stolen-by-hackers-returned-in-full

BillQuick Billing App Rigged to Inflict Ransomware

BillQuick® is the Time Tracking, Project Management, and Billing solution that QuickBooks® users have been looking for. Easy to use and flexible, it is the perfect solution for any company that provides professional services. BillQuick was exploited by threat actors to deploy ransomware on vulnerable systems. An SQL-based injection attack has also leaked sensitive information of its customers.

See the full report here: https://threatpost.com/billquick-billing-app-ransomware/175720/

Hackers use 'The Crying Game' apps to install the 'Joker' virus on your smartphone and empty your bank accounts - Entrepreneur

Cybercriminals have taken inspiration from the Korean Netflix series to place in the official Google Play Store several fake apps. These applications are then used to install the Joker virus on Android smartphones for clearing the bank account without their notice. The Joker virus is known to steal information from the victim's device via SMS messages, contact lists, and device information.

See the full report here: https://www.entrepreneur.com/article/393270

Janesville schools hit with ransomware attack locking digital systems - Channel3000.com - WISC-TV3

The School District of Janesville was hit with a ransomware attack over the weekend, locking students, staff, and parents out of several web-based systems and programs. According to the district officials, no data has been accessed or destroyed. School phones, security cameras, and paging systems have not been affected. The State of Wisconsin’s Division of Enterprise Technology Cyber Response Team, the FBI, and the US Department of Homeland Security are working on this.

See the full report here: https://www.channel3000.com/janesville-schools-hit-with-ransomware-attack-locking-digital-systems/

NCC Alerts Telecom Consumers on Flubot Malware - Proshare Nigeria Limited

The Nigerian Communications Commission(NCC) is the independent regulatory authority for the telecommunications industry in Nigeria. The NCC has alerted its telecom customers about the existence of new, high-risk, and extremely damaging, Malware called Flubot. FluBot is malware (like a computer virus) that can be installed on your Android mobile handset if you click on a link in a malicious link in an SMS. According to NCC, it mainly aims at Androids with fake security updates and App installations.

See the full report here: https://www.proshareng.com/news/Security---Support/NCC-Alerts-Telecom-Consumers-on-Flubot-M/59587

Mozilla blocks malicious add-ons installed by 455K Firefox users - BleepingComputer

Mozilla has blocked malicious Firefox add-ons namely Bypass and Bypass XM which are already installed by roughly 455,000 users. The add-ons were using the API to intercept and redirect web requests to block users from downloading updates, updating remotely configured content, and accessing updated blocklists.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-blocks-malicious-add-ons-installed-by-455k-firefox-users/

Millions of Android users targeted in subscription fraud campaign - BleepingComputer

Avast Antivirus is a family of cross-platform internet security applications developed by Avast for Microsoft Windows, macOS, Android, and iOS. The researchers at Avast have discovered a massive fraud campaign named UltimaSMS which was used to subscribe users to premium subscription services without their knowledge.The threat actors conducted the UltimateSMS campaign through 151 Android apps that pretended to be discount apps, games, custom keyboards, QR code scanners, video and photo editors, spam call blockers, camera filters, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/millions-of-android-users-targeted-in-subscription-fraud-campaign/

Hackers use Venmo app to drain retired couple's bank account - WPBF West Palm Beach

Venmo is a peer-to-peer (P2P) payment app available on iPhones and Android phones that allows for the quick and easy exchange of money directly between individuals. A retired Boynton Beach couple has lost all of their savings to hackers using a novel scam involving the payment app Venmo. Till now they haven't got any sort of reimbursement from their bank or from Venmo.

See the full report here: https://www.wpbf.com/article/hackers-use-venmo-app-to-drain-retired-couples-bank-account/38070752

Spammers use Squirrelwaffle malware to drop Cobalt Strike - BleepingComputer

Squirrelwaffle campaigns generally start via spam emails that attempt to convince victims to click an embedded URL using a technique known as email thread hijacking. Email thread hijacking leverages emails that have been stolen prior to the attack and later repurposed to dupe a victim into believing that an email is from someone that they know who is replying to the same thread. Once a victim clicks on the URL, a ZIP file is downloaded that contains a Microsoft Word document. According to the researchers at Cisco Talos, Squirrelwaffle is one of the tools that emerged as an Emotet replacement.

See the full report here: https://www.bleepingcomputer.com/news/security/spammers-use-squirrelwaffle-malware-to-drop-cobalt-strike/

North Korean state hackers start targeting the IT supply chain - BleepingComputer

According to the security researchers at Kaspersky, the North Korean-sponsored Lazarus hacking group has switched focus on new targets. The security researchers found this flaw by expanding its supply chain attack capabilities.The Lazarus Group (also tracked as HIDDEN COBRA by the United States Intelligence Community) is a military hacking group backed by the Democratic People's Republic of Korea and active since at least 2009.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-state-hackers-start-targeting-the-it-supply-chain/

Operations at Iranian gas stations were disrupted today. Cyber attack or computer glitch?

The operations at the state-owned National Iranian Oil Products Distribution Company (NIOPDC) gas stations have been disrupted due to a cyberattack across Iran. Adding to the cyber attack, it also defaced the screens at the gas pumps and gas price billboards. After the attack, the screens at the impacted NIOPDC gas stations were showing the words “cyebrattack 64411".

See the full report here: https://securityaffairs.co/wordpress/123824/hacking/iranian-gas-stations-incident.html?utm_source=rss&utm_medium=rss&utm_campaign=iranian-gas-stations-incident

WordPress Plugin Bug Lets Subscribers Wipe Sites

The security researchers at Wordfence have found that the Hashthemes Demo Importer plugin allows subscribers to wipe sites clean of content.HashThemes Demo Importer imports the full demo with just one click. It is specially developed to add a demo importer functionality in the theme developed by HashThemes.Since this plugin is used in more than 8,000 active installations, this flaw is considered of high severity.

See the full report here: https://threatpost.com/wordpress-plugin-bug-wipe-sites/175826/

QR Codes Help Attackers Sneak Emails Past Security Controls

Researchers at Abnormal Security have detected and blocked some 200 emails that contained a QR code instead of the usual malicious attachment or URL link.This QR code in return drives the users to a phishing website.All of the QR code images were created and sent the same day.

See the full report here: https://www.darkreading.com/attacks-breaches/qr-codes-help-attackers-sneak-emails-past-security-controls

Cybercriminals claim to have hacked the NRA - NBC News

The National Rifle Association (NRA) has released a statement today after a ransomware gang claimed to have attacked the organization. The Grief ransomware gang which has ties to the prolific Russian cybercrime group Evil Corp posted about the NRA on its leak site. Analysis of the released documents shows it is minutes from a recent NRA board meeting as well as documents related to grants. It threatened to leak more files if the NRA did not pay an undisclosed ransom.

See the full report here: https://www.nbcnews.com/tech/security/cybercriminals-claim-hacked-nra-rcna3929

Hackers arrested for ‘infiltrating’ Ukraine’s health database - BleepingComputer

The National Health Service of Ukraine (NHSU) is the central executive body that implements the state policy in the field of state financial guarantees for healthcare servicing the population. The Security Service of Ukraine (SSU) has arrested the threat actors behind the crime of entering the false vaccination entries of people into the NHSU. The threat actors offered to create false COVID-19 vaccination certificates for anyone who paid them 3,000 hryvnias ($114).

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-arrested-for-infiltrating-ukraine-s-health-database/

US bans China Telecom Americas over national security risks - BleepingComputer

China Telecommunications Corporation known by its trading name China Telecom is a Chinese state-owned telecommunication company. The Federal Communications Commission (FCC) has revoked China Telecom Americas' license to provide telecommunication services within the United States. According to the FCC commissioner,this step was taken by taking national security into consideration.

See the full report here: https://www.bleepingcomputer.com/news/security/us-bans-china-telecom-americas-over-national-security-risks/

Washington Central Unified Union School target of ransomware attack - WCAX

Washington Central Unified Union School District serves the Central Vermont towns with elementary, middle, and high schools. The information system of the school has been hacked. Federal, state, and local law enforcement has been notified. Independent investigators and third-party experts are determining the nature and extent of the attack.

See the full report here: https://www.wcax.com/2021/10/28/washington-central-unified-union-school-target-ransomware-attack/