Threat Intelligence Bulletin: 10/29/2021 - 11/04/2021

A Deeper Look at Colossus Ransomware

On September 24, 2021, the ZeroFox Threat Intelligence team discovered a previously unknown ransomware going by the name Colossus. This new ransomware appeared to be building towards the ransom-as-a-service (RaaS) and double-extortion model as many others have before it. The leak site — launched around September 20, 2021 — was short-lived, however. By October 18, 2021, the operators had taken the site offline. To date, ZeroFox has only observed a single victim whose data was never publicly listed for download. With the lack of information available on this new ransomware family, the ZeroFox Threat Intelligence team has reverse engineered the sample to learn more about how it works.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets.
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Avoid opening unsolicited attachments and never click suspicious links.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Review network logs for potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Details

On September 24, 2021, ZeroFox detected a previously unknown ransomware variant that had been uploaded to Hatching Triage, a malware analysis sandbox service. Dropped ransom notes titled "HOW_TO_RECOVER_FILES.Colossus.txt" gave victims the option to communicate via a victim-specific link on the domain colossus[.]support or to contact them using the provided email address. To access the chat, the victim must enter a private key provided in the note.

Colossus “Hell Page”

Initially, Colossus did not offer a traditional leak site on their domain. Victims were given their own link to a chat with the group, but simply browsing to the domain itself returned an empty page until October 13, 2021. When Colossus finally created their own leak page, it listed only the previously known victim. Links to data were promised as “coming soon,” though this ultimately never happened. ZeroFox observed that on October 15, 2021, the only publicly listed victim had been removed and, just three days later on October 18, 2021, the entire website appeared to be non-functional. While the server was still responding as of this writing, each request now returns HTTP 503 Service Unavailable. A scan of multiple forums known for hosting ransomware-as-a-service operators did not uncover any notable findings, besides general chatter confirming the temporary existence of the leak site.

Figure 1. Colossus leak site as it appeared on October 13, 2021.
Source: ZeroFox Threat Intelligence

Figure 2. Colossus leak site after removing the only publicly listed victim.
Source: ZeroFox Threat Intelligence

Ransomware Analysis

The Colossus sample obtained by ZeroFox is protected with Themida, a well-known packer that can make use of virtualization techniques and anti-sandbox measures to make static binary analysis significantly more challenging. The ransomware itself was created in Golang, also referred to simply as “Go.” Similar to Microsoft’s .NET family of programming languages and Oracle’s Java, it is possible to recover the function names used by threat actors used in the source code. While many actors have caught on to this and use tools to obfuscate function names, Go-specific functions and third-party dependencies are left untouched by obfuscation tools. Even if function names are obfuscated, it becomes easy to separate code the analyst is interested in from the potentially hundreds of other functions generated by the Go runtime.

Figure 3. Colossus ransomware function names after obfuscation.
Source: ZeroFox Threat Intelligence

The first step taken by Colossus is to decrypt its configuration. Several items decrypted at this stage are used later to build the ransom note, such as the group’s email address, victim-specific negotiation URL and the ransom note template itself. Each of the configuration items are decrypted nine times through three similar functions that must be called in a specific order.

Figure 4. Colossus decrypting the actor’s email and victim-specific negotiation URL.
Source: ZeroFox Threat Intelligence

While decrypting these configuration items used later for the ransom note, Colossus also decrypts a value it expects to be passed via the command line. If this value is not passed as the first argument, the sample will simply exit without encrypting any files. This has been seen in other ransomware families such as Egregor and may be used to prevent execution in sandbox environments.

Next, Colossus replaces placeholder values in its ransom note template with the values decrypted earlier. Then, it checks for a path to encrypt being passed as the second command line argument. If both of these conditions have been met, the ransom note is then written to that directory and it begins to search for all files in that path. This directory is also checked recursively, meaning any sub-directories will also be encrypted.

Figure 5. A portion of the Colossus ransom note template showing placeholder values.
Source: ZeroFox Threat Intelligence

When searching for files to encrypt, the only criteria checked against is that the text “.Colossus” does not exist anywhere within the file name. Most ransomware families use a list of file extensions to specifically include or exclude from encryption. A careless operator or affiliate running the ransomware from a higher level directory such as the User profile or drive root could cause system instability if they run the ransomware as an administrator.

Figure 6. Colossus decrypts text (“.Colossus” in this instance) to search for in file names.
Source: ZeroFox Threat Intelligence

For each file encrypted by Colossus, a key is randomly generated in four parts. These are then combined into one key before also being encrypted independently using RSA with Optimal Asymmetric Encryption Padding (OAEP).

Figure 7. Colossus file key generation and key protection.
Source: ZeroFox Threat Intelligence

Before encryption, every file is also checked to see if it exceeds a certain size. In this case, the set file size was 1 million bytes, or, roughly 1 megabyte. Encrypting only a set amount of bytes is a common tactic used by actors to speed up the encryption process and finish processing all files before the running process is killed. Only targeting the first so many bytes of a file may also be seen as “good enough” if it effectively corrupts the file to the point that it cannot be used by the victim. To perform the encryption, Colossus opts for a simple XOR routine rather than relying on the previously used AES or RSA encryption methods. The independently encrypted key parts from before are then appended one at a time to the end of the file. Finally, the file is renamed with the configured extension, a processed file counter is increased, and the loop continues.

Figure 8. Colossus will XOR roughly 1 megabyte of data from the start of each file.
Source: ZeroFox Threat Intelligence

Conclusion

In its current state, Colossus appears to be a new and fairly simple ransomware variant. Basic features typically seen in other families such as file extensions to target are not present in this build and the sample obtained by ZeroFox did not always wait for every file to be processed before exiting, which may lead to potential data loss for victims. While ransomware families disappear and reappear — sometimes with a new identity — all the time, it remains unclear whether Colossus’ quick exit means it has disappeared for good.

Indicators of Compromise

Domains

• colossus[.]support

SHA256 Hashes

• b70b9039ec4b33987a991c5c20729eb3310d7406b8d15161037df3b21fd968bb

Cyberattacks Against Healthcare Industries

The healthcare industry is one of the world’s largest and fastest-growing critical industries. Amid the Coronavirus pandemic, the healthcare industry endured a rapid digital transformation. Sensitive information from healthcare companies, such as personally identifiable information (PII), personal health information (PHI), personal health record (PHR), lab results, test reports, and research data are extremely valuable to cybercriminals. Due to the value of such data, threat actors targeted scientists, researchers, business logistics firms, and distribution networks using a variety of threat tactics, like disrupting vaccine supplies, for economic gain or geopolitical advantage.

Recommendations

• Enable risk-based authentication (RBA) for the devices used by the employees who need to access data remotely.
• Enable multi-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Top Cyber Attacks

One of the top cyberattacks that affected the healthcare industry was in 2020 against the British drugmaker, AstraZeneca. AstraZeneca was in the race to deploy a COVID-19 vaccine when threat actors targeted AstraZeneca employees working on COVID-19 research. The attackers used social engineering tactics to break into the drug manufacturer's network, where they impersonated recruiters and approached AstraZeneca employees with fake job offers via social networking platforms like LinkedIn and WhatsApp. Security researchers suspect the involvement of the North Korean threat actors based on the tactics, techniques, and procedures (TTPs) used in the attack. According to reports, the attackers were not thought to have been successful.

In December 2020, cybersecurity researchers uncovered a spear-phishing campaign targeting executives at organizations that support the Cold Chain Equipment Optimization Platform (CCEOP) program started by Gavi, the vaccine Alliance, which assists vaccine distribution around the globe. The attackers impersonated business executives from Haier Biomedical, a Chinese company, serving as a qualified supplier for the CCEOP program, in coordination with the World Health Organization (WHO), UNICEF, and other U.N. agencies. It remains unclear to the researchers whether the phishing campaign was successful.

In March 2021, a Chinese-state-sponsored actor group, APT10, also known as Stone Panda, targeted the IT systems of two Indian COVID-19 vaccine makers: Bharat Biotech and Serum Institute of India (SII). The attackers discovered security vulnerabilities in the IT infrastructure and supply chain software used by these vaccine makers. Security researchers revealed that the motivation was to steal the intellectual property, which could have helped the threat actors get a competitive advantage over Indian pharmaceutical companies.

Another attack was against the US pharmaceutical giant, ExecuPharm. The pharmaceutical firm suffered a data breach and ransomware attack after being targeted by phishing emails sent to employees. The attackers encrypted the ExecuPharm servers, stole corporate and employee data, and sought payment in return for a decryption key.

Top Vulnerabilities

Critical vulnerabilities in various technologies pose a severe threat to the healthcare industry. According to research conducted by the Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC), a vulnerability in Citrix and vulnerabilities in VPN products from Pulse Secure, Fortinet, and Palo Alto are widely used by various APT groups against medical industries. The details are listed below:

Citrix:

• CVE-2019-19781: Citrix Application Delivery Controller And Gateway Code Execution

Pulse Connect Secure:

• CVE-2019-11510: Pulse Connect Secure Information Disclosure
• CVE-2019-11539: Pulse Connect Secure And Pulse Policy Secure Command Execution

Fortinet:

• CVE-2018-13379: FortiOS Vpn Web Portal Directory Traversal
• CVE-2018-13382: FortiOS Security Bypass
• CVE-2018-13383: FortiOS Denial of Service

Palo Alto:

• CVE-2019-1579: PAN-OS Code Execution

These security flaws are classified as critical and exploits for these vulnerabilities are available in the public domain.

The Chinese-state-sponsored threat actor group APT10 was observed attempting to exploit Windows Zerologon vulnerability in attacks. Tracked as CVE-2020-1472, Zerologon is a critical vulnerability that allows attackers to execute arbitrary code with escalated privileges on a vulnerable system.

Other vulnerabilities used by various APT groups against healthcare industries are listed below:

• CVE-2020-11023: Jquery Cross-Site Scripting
• CVE-2019-11358: Jquery Cross-Site Scripting
• CVE-2020-11022: Jquery Cross-Site Scripting
• CVE-2015-9251: Jquery Cross-Site Scripting
• CVE-2018-0802: Microsoft Windows Code Execution
• CVE-2017-11151: Synology Security Bypass
• CVE-2019-16920: D-Link Code Execution
• CVE-2019-1652: Cisco Small Business Routers Command Execution
• CVE-2019-1653: Cisco Small Business Routers Information Disclosure
• CVE-2019-16278: Nostromo Httpd Directory Traversal
• CVE-2020-10189: Manageengine Desktop Central Code Execution
• CVE-2017-0213: Microsoft Windows Com Aggregate Marshaler Privilege Escalation
• CVE-2019-1458: Microsoft Windows Win32k Component Privilege Escalation
• CVE-2015-1701: Microsoft Windows System Token Privilege Escalation
• CVE-2020-0796: Microsoft Server Message Block (Smbv3) Code Execution
• CVE-2019-18935: Progress Telerik Ui For Asp.Net Ajax Code Execution

Top Threat Actors and Groups

Several threat actor groups have targeted healthcare industries in the past. Some of the well-known groups are listed below along with their known or suspected country of origin and attack methods.

APT10 (Stone Panda):

• Country: China (State-sponsored)
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT1 (PLA Unit 61398):

• Country: China
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT41 (Double Dragon):

• Country: China
• Attack Methods: Malware, Passive backdoor, Exploiting vulnerabilities in the web applications/systems.

APT35 (Charming Kitten):

• Country: Iran
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT28 (Fancy Bear):

• Country: Russian Federation
• Attack Methods: Malware, Spear-phishing, Mimikatz, Core-shell.

Other than APT groups, some data brokers sold remote access exploits in various cybercriminal underground networks and forums, which can be utilized by threat actor groups or attackers to get access into a network. ZeroFox Threat Intelligence observed one example of an actor on a Russian-speaking cybercriminal forum advertising the sale of remote access exploits, targeting pharmaceutical companies, among other industries.

Figure 1: A data broker selling exploit kits of pharmaceutical companies on a Russian-speaking forum

Source: ZeroFox Threat Intelligence

Motivation

Over the last year, due to the COVID-19 pandemic, a significant rise in cyberattacks has been observed against healthcare industries, specifically the vaccines manufacturers and pharmaceutical companies. Vaccine manufacturers across the globe were in a race to develop a vaccine for the COVID-19 virus, which gave threat actors several opportunities to leverage cyber threats against targets. Threat actors quickly utilized the pandemic and related fears to lure victims into phishing schemes and malware attacks. In the middle of July 2020, there were multiple reports of cyberattacks to steal COVID-19 vaccine data from the organizations that were involved in vaccine development. The motive behind most of the attacks was financial gain. However, some of the state-sponsored targeted attacks against vaccine manufacturers were to steal intellectual property and slow down vaccine distribution, indicating that financial gain was not the only motive behind the attack.

Intended Effect

According to cybersecurity researchers, the primary target of these attackers is the intellectual properties of organizations. It can harm the competitive advantage and, therefore, the financial foundation of businesses. Apart from the financial gain, some targeted attacks focus on slowing down or disrupting vaccine distribution.

Credential harvesting is also one of the goals of attackers. Stolen credentials allow threat actors to move laterally through a network, conducting surveillance and accumulating additional confidential information from the victim’s environment for future operations.

ZeroFox Threat Research: Quarter 3 2021 Threat Report

The ZeroFOX Threat Research team is excited to announce the release of our Quarterly Threat Report for Q3 of 2021.

Link to Download

https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Quarterly+Threat+Landscape+Review+-+Q3+2021.docx.pdf

Report Summary

In this Quarterly Threat Landscape Review, ZeroFox Threat Research presents an overview of activity and highlights during Q3 2021.

In the third quarter of 2021 (Q3 2021), the global cyber threat landscape changed in a number of significant ways, some of which included: persistent ransomware attacks; numerous disclosed vulnerabilities; and enhanced threat actor tactics, techniques, and procedures (TTPs). Ransomware groups continued launching attacks using new and existing ransomware types, while the involvement of mobile malware and banking trojans in attacks surged this quarter. The persistence and impact of ransomware led to governments around the world working with cybersecurity experts to promote education and response plans for cyber attacks. Newly-disclosed exploits and vulnerabilities emerged this quarter, including various security flaws in enterprise and cloud software, Apple devices, and a surge of vulnerabilities in Microsoft products.

Cybercriminal underground networks endured a quarter rife with data leak advertisements, sale of cybercrime tools, and more groups operating ransomware data leak and digital extortion websites – including the discovery of the Colossus ransomware through ZeroFox collection and detection efforts. Furthermore, ZeroFox Threat Research observed a new type of scam and fraud activity where threat actors steal and unlock digital devices using specially-crafted phishing kits which mimic features used to track devices when lost or stolen.

Breaking News: 2021-10-29 - 2021-11-04

Microsoft warns of password hacking across multiple online accounts - The Edge Markets MY

Microsoft's Detection and Response Team (DART) analysts have warned people who reuse their passwords across multiple online accounts are prone to "password spray" attacks. The analysts said these involve hackers gathering a list of usernames and passwords leaked online and plugging them into various websites.

See the full report here: https://www.theedgemarkets.com/article/microsoft-warns-password-hacking-across-multiple-online-accounts

Massachusetts health network hacked; patient info exposed - Boston.com

Massachusetts health network has been hacked which lead to the exposure of patient information. According to the officials, the attacker hacked into its employee email system and the breach of more than 200,000 patients' personal data happened.The personal data included Social Security numbers, insurance information, and medical information.

See the full report here: https://www.boston.com/news/local-news/2021/10/28/massachusetts-health-network-hacked-patient-info-exposed/

Microsoft: Shrootless bug lets hackers install macOS rootkits - BleepingComputer

The Microsoft 365 Defender Research Team reported a macOS vulnerability named Shrootless which could bypass System Integrity Protection (SIP) and perform arbitrary operations, elevate privileges to root, and install rootkits on vulnerable devices.SIP (also known as rootless) is a macOS security technology that blocks potentially malicious software from modifying protected folders and files by restricting the root user account and limiting the actions it can perform on protected parts of the OS.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shrootless-bug-lets-hackers-install-macos-rootkits/

New AbstractEmu malware roots Android devices, evades detection - BleepingComputer

According to the security researchers at the Lookout Threat Labs, a new Android malware named AbstractEmu can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks. The AbstractEmu malware was distributed hidden inside 19 Android applications that were uploaded on Google Play, the Amazon Appstore, the Samsung Galaxy Store, and other unofficial third-party app stores.

See the full report here: https://www.bleepingcomputer.com/news/security/new-abstractemu-malware-roots-android-devices-evades-detection/

Israeli Researcher Cracked Over 3,500 Wi-Fi Networks in Tel Aviv City

CyberArk security researcher Ido Hoorvitch said that properties in urban areas often have unsafe and weak WiFi passwords in use that could be “easily cracked or even guessed by curious neighbors or malicious actors”.In total, 5,000 WiFi hashes around his neighborhood were gathered as a sample group by wandering the streets with network sniffing equipment.

See the full report here: https://thehackernews.com/2021/10/israeli-researcher-cracked-over-3500-wi.html

This New Android Malware Can Gain Root Access to Your Smartphones

A new Android malware named "AbstractEmu" have the ability to root smartphones and take complete control over infected smartphones while simultaneously taking steps to evade detection. Many Android applications posed as utility apps like a rogue apps, called Lite Launcher. This malware gains the elevated privileges, which gives the malware access to other apps' sensitive data. Once installed, the attack chain is designed to exploit one of older Android security vulnerability that would allow it to gain root permissions and take over the device, extract sensitive data, and transmit to a remote attack-controlled server.

See the full report here: https://thehackernews.com/2021/10/this-new-android-malware-can-gain-root.html

Ransomware Attack Hits PNG Finance Ministry

Papua New Guinea's finance ministry experienced a cyberattack, which briefly disrupted government payments and operations. Ransomware infiltrated and compromised a core server at the department of finance last week, hampering the government's access to foreign aid, its ability to pay cheques and carry out other basic functions in the midst of a spiralling Covid-19 surge. The department has now managed to fully restore the system, however, because of the risk, they are not allowing full usage of the affected network.

See the full report here: https://www.securityweek.com/ransomware-attack-hits-png-finance-ministry

TTC hit by ransomware attack, says 'no risk to employee or customer safety' - CP24 Toronto's Breaking News

A ransomware attack reported on the Toronto Transit Commission, that knocked down some of its communications systems and affected its services. Initially the hack impact was minimal but later hackers broadened their strike on network servers. The attack has crippled the TTC's Vision System, which is used to communicate with vehicle operators. Hackers also took down the 'Next Vehicle Information System' on platform screens, trip-planning apps, the TTC website, and the online Wheel-Trans online booking portal. The TTC noted that there were no major service disruptions during the attack and there is no risk to employee or customer safety.

See the full report here: https://www.cp24.com/news/ttc-investigating-after-hit-by-ransomware-attack-1.5644928

All Windows versions impacted by new LPE zero-day vulnerability - BleepingComputer

A security researcher has disclosed technical details for a Windows zero-day privilege elevation vulnerability and a public proof-of-concept (PoC) exploit that gives SYSTEM privileges under certain conditions. The vulnerabiluty is tracked as CVE-2021-34484 and affects all versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Although, Microsoft has fixed the flaw in its August patch update, the patch was not sufficient and can be bypassed using the new exploit. As this bug requires a threat actor to know a user name and password for another user, it will not be as heavily abused as other privilege elevation vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/all-windows-versions-impacted-by-new-lpe-zero-day-vulnerability/

Microsoft: Windows web content filtering now generally available - BleepingComputer

Microsoft has announced that web content filtering has reached general availability and is now available for all Windows enterprise customers. Web content filtering is part of Defender for Endpoint's web protection capabilities. It enables organizations to deploy custom web usage policies for tracking and controlling access to websites within an enterprise environment. The feature is available on all major web browsers, and it denies attempts to access blocked content via Windows Defender SmartScreen (on Microsoft Edge) and Network Protection (on Chrome, Firefox, Brave, and Opera).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-web-content-filtering-now-generally-available/

Snake malware biting hard on 50 apps for only $25 - BleepingComputer

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks. The trojan is written in .NET and using the same staging mechanism as FormBook and Agent Tesla and has been active since November 2020. Currently, the malware is being sold on dark web forums for as low as $25, which could be why we see a spike in its deployment. Snake installed via malicious email attachments or through drops sites reached by clicking on email links. It also also features keystroke logging, clipboard data theft capabilities and can even capture screenshots of the entire screen, which are then uploaded back to the threat actor.

See the full report here: https://www.bleepingcomputer.com/news/security/snake-malware-biting-hard-on-50-apps-for-only-25/

Fortinet warns of Black Friday scams involving PS5s, Xboxes and fake Amazon gift card generators that steal... - ZDNet

Fortinet's FortiGuard Labs security researchers have discovered that new Black Friday scams are operating in the wild targeting users to steal cryptocurrency. They are luring users with Amazon gift cards on the Black Friday days. Researchers also found scams related to gaming consoles, attempting to lure buyers interested in purchasing PlayStation 5 and Xbox Series X and S systems. These attack attempt has been specifically designed to conduct payment fraud.

See the full report here: https://www.zdnet.com/article/fortinet-warns-of-black-friday-scams-involving-ps5s-xbox-and-fake-amazon-gift-card-generator-stealing-crypto/

Chaos ransomware targets gamers via fake Minecraft alt lists - BleepingComputer

The Chaos Ransomware gang encrypts gamers' Windows devices through fake Minecraft alt lists promoted on gaming forums. According to security researchers, a recently discovered variant of the Chaos ransomware is being tentatively distributed in Japan, encrypting the files of Minecraft players and dropping ransom notes. The lure used by the threat actors are 'alt list' text files that supposedly contain stolen Minecraft account credentials, but in reality, is Chaos ransomware executable.

See the full report here: https://www.bleepingcomputer.com/news/security/chaos-ransomware-targets-gamers-via-fake-minecraft-alt-lists/

Toronto Transit Commission still recovering from ransomware attack - IT World Canada

IT staff at the Toronto Transit Commission (TTC) were still dealing with the effects of a ransomware attack on Saturday afternoon, approximately 40 hours after suspicious network activity was detected. The impact on the bus and subway service of the nation’s biggest transit system so far has been minimal, although its Vision communications system used to communicate with drivers, has been knocked offline. Operators have been forced to communicate with Transit Control with radios.

See the full report here: https://www.itworldcanada.com/article/toronto-transit-commission-still-recovering-from-ransomware-attack/463683

Microsoft: Windows KB5006674, KB5006670 updates break printing - BleepingComputer

Microsoft says Windows customers are experiencing issues with network printing after installing the Windows 11 KB5006674 and Windows 10 KB5006670 updates issued with this month's Patch Tuesday, on October 12. Users attempting to connect to printers shared on Windows print servers might encounter multiple errors preventing them from printing over the network. Customers impacted by these printing problems can now use an official workaround provided by Microsoft to fix the issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-kb5006674-kb5006670-updates-break-printing/

Emergency Google Chrome warning over hack right NOW – fix it here in seconds... - The Scottish Sun

Google has released an emergency Chrome update to fix two zero-days vulnerabilities CVE-2021-38000 and CVE-2021-38003 that are being actively exploited in the wild. The company is recommending users to update Chrome to version 95.0.4638.69.

See the full report here: https://www.thescottishsun.co.uk/tech/7921021/google-chrome-update-urgent-security-fix/

Police Arrest Suspected Ransomware Hackers Behind 1,800 Attacks Worldwide

A joint task force arrested 12 people as part of an international law enforcement operation, for orchestrating ransomware attacks on critical infrastructure and large organizations, that hit over 1,800 victims across 71 countries since 2019. The suspects have been primarily linked to LockerGoga, MegaCortex, and Dharma ransomware. The arrest is the latest action against cybercrime groups.

See the full report here: https://thehackernews.com/2021/10/police-arrest-suspected-ransomware.html

All the ways TikTok tracks you and how to stop it

Highly active threat actors, dubbed "Balikbayan Foxes" and tracked as TA2722, have conducted threat campaigns over 2021 in which they impersonated the Philippine government and businesses to spread Trojan malware. They also targeted the shipping, logistics, manufacturing, pharmaceutical, business, and energy sectors across the US, Europe, and Asia. According to Proofpoint, the group appears to be expanding its tactics to also include credential harvesting.

See the full report here: https://www.zdnet.com/article/proofpoint-unmasks-balikbayan-foxes-a-threat-group-impersonating-the-philippine-govt/

Graff multinational jeweller hit by Conti gang. Data of its rich clients are at risk, including Trump and Beckham

The high society jeweller Graff is hit by conti ransomware group. The threat group demanded a multi-million ransom to avoid leaking details of world leaders, actors, and tycoons. However, they already leaked 69,000 confidential documents that include customer lists, invoices, receipts, and credit notes.

See the full report here: https://securityaffairs.co/wordpress/?p=123980

Iranian Black Shadow hacking group breached Israeli Internet hosting firm

Iranian hacking group Black Shadow compromised the server of the Israeli internet hosting company Cyberserve. The attackers took down several sites hosted by the firm and stole data. The threat group has decided to publish some of the stolen data as the company hasn't contacted them after the attack.

See the full report here: https://securityaffairs.co/wordpress/124000/hacking/black-shadow-hacked-cyberserve.html

Lawsuit Against Google, Bay Area School District Claims Hacker Sent Sexually Explicit Messages to Teacher From Virtual Classroom Account | The Recorder - Law.com

According to a federal privacy lawsuit Oct. 29,a San Francisco Bay Area grade-school boy claims Google and his school district failed to protect him from a hacker who breached his virtual classroom and sent sexually explicit content to his teacher. The 13-year-old Fremont Unified School District student claims he was punished for the inappropriate messages sent by a bad actor who hacked his device in January.

See the full report here: https://www.law.com/therecorder/2021/11/01/lawsuit-against-google-bay-area-school-district-claims-hacker-sent-sexually-explicit-messages-to-teacher-from-virtual-classroom-account/

Hackers threaten to expose the user database of an Israeli LBGTQ dating site - NPR

Atraf, Israel's most prominent LGBTQ dating site, used primarily by gay men was hit by a cyberattack. The hackers have threatened to expose users unless they are paid millions. This weekend, the hackers leaked a sample list of 1,000 users, including cellphone numbers, email addresses, sexual preferences, and HIV status.

See the full report here: https://www.npr.org/2021/11/01/1051215567/hackers-threaten-to-expose-the-user-database-of-an-israeli-lbgtq-dating-site

Roblox back online after three-day outage - says hackers not to blame - Sky News

Roblox, the online gaming platform, is back online after a three-day outage. The company said that the outage was not caused by a cyberattack, but by a "subtle bug" that only cropped up when the company's communications servers came under heavy load.

See the full report here: https://news.sky.com/story/roblox-back-online-after-three-day-outage-says-hackers-not-to-blame-12456975

WhatsApp hackers busted by Delhi police unit, Nigerian held - Times of India

A syndicate that was hacking into mobile devices and WhatsApp accounts of people using custom-made malware has been busted by the (IFSO) unit of Delhi Police, India. According to the officials the syndicate was sending malware through WhatsApp and thereby accessing call logs, SMSs, and contacts and control of the targeted WhatsApp account.

See the full report here: https://timesofindia.indiatimes.com/india/whatsapp-hackers-busted-by-delhi-police-unit-nigerian-held/articleshow/87475217.cms

Crain's Headlines: CNA Hack Impacts 75000 Individual's Personal Info - WTTW News

A major ransomware attack at Chicago Financial Company,a tentative deal was struck after about 10,000 John Deere employees went on strike. And October saw record home sales on the high end of the market.Almost 75,000 people mayhave seen their social security numbers due to the breach in the data that took place.

See the full report here: https://news.wttw.com/2021/11/01/crain-s-headlines-cna-hack-impacts-75000-individual-s-personal-info

'Trojan Source' technique can inject malware into source code without detection - SiliconANGLE News

Researchers at Cambridge University have published a research paper that has detailed a new technique that can be exploited to inject malware into source code without being detected. The method involves manipulating the encoding of source files so that human viewers and compilers see different logic.

See the full report here: https://siliconangle.com/2021/11/01/trojan-source-technique-can-inject-malware-source-code-without-detection/

Chicago radio personalities Leon Rogers, DJ Sundance say Facebook pages were hacked, fans tricked out of thousands - WLS-TV

Popular Chicago radio personalities Leon Rogers and DJ Sundance say hackers took over their Facebook pages to steal money from their fans. Ultimately, their fans were asked to invest in fake business deals. Both the radio personalities are trying to clear their names out of this after this Facebook account hack.

See the full report here: https://abc7chicago.com/leon-rogers-dj-sundance-facebook-pages-hacked/11192184/

Hacked Tucson construction sign insults Biden, praises Trump - Arizona Daily Star

A traffic sign in a construction zone in downtown Tucson was hacked by the hackers and undesirable messages were put up. The incident comes on the same day as Tucson's general elections. However, the Tucson Police Chief and a spokesperson for the Tucson Department of Transportation and Mobility took Twitter to mention that its original traffic message has been brought back on the traffic sign board.

See the full report here: https://tucson.com/news/government-and-politics/hacked-tucson-construction-sign-insults-biden-praises-trump/article_98271fae-3c16-11ec-8d28-07a003028f94.html

Axie Infinity to reimburse users who lost funds due to the hack - Manila Bulletin

Axie Infinity is an NFT-based online video game developed by Vietnamese studio Sky Mavis, which uses Ethereum-based cryptocurrency AXS and SLP. The attacker created a fake Axe Infinity branded webpage and spammed the link on all of Axie Infinity’s Discord announcement channels announcing an exclusive sale. 155 players clicked on the link and attempted to buy Axies, which was a scam. The firm has assured to reimburse everyone who lost their funds due to this announcement.

See the full report here: https://mb.com.ph/2021/11/03/social-engineering-used-to-hack-axie-infinity/

Massachusetts Health Network Hacked; Patient Information Exposed - Insurance Journal

The health care network of UMass Memorial Health, Massachusetts was hacked which involved the breach in the information of their patients. The authorities of the hospital have notified their patients regarding this. The personal data included Social Security numbers, insurance information, and medical information of the patients. According to a federal database of cybersecurity incidents at medical facilities, more than 200,000 patients' data was compromised.

See the full report here: https://www.insurancejournal.com/news/east/2021/11/02/640256.htm

Facebook deletes 1 billion faceprints in Face Recognition shutdown - BleepingComputer

Facebook's Face Recognition system analyzes photos taken of tagged users and associated users' profile photos to build a unique identifier or template. This template is then used to identify users in uploaded photos or automatically tag people in Memories. Facebook has announced that it would not be using the Face Recognition system on its platform and will be deleting over 1 billion people's facial recognition profiles.

See the full report here: https://www.bleepingcomputer.com/news/technology/facebook-deletes-1-billion-faceprints-in-face-recognition-shutdown/

Canadian province health care system disrupted by cyberattack - BleepingComputer

The Canadian provinces of Newfoundland and Labrador have suffered a cyberattack causing regional health systems to shut down their networks and cancel thousands of medical appointments. The IT outage also affected communications in the region, with people reporting an inability to reach the health care centers or 911 via phone. Doctors moved to pen and paper set up as they were not able to upload or create new patient details.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-province-health-care-system-disrupted-by-cyberattack/

US Blacklists Israeli Firms NSO Group and Candiru

The US Commerce Department has added four foreign companies from Israel, Russia, and Singapore to its Entity List for "engaging in activities that are contrary to the national security or foreign policy interests of the United States."These companies include Israeli firms NSO Group and Cendiru, both listed based on evidence that they developed and supplied spyware to foreign governments, which later used the tools to target government officials, journalists, businesspeople, activists, academics, and embassy workers, officials wrote in a release.

See the full report here: https://www.darkreading.com/threat-intelligence/us-blacklists-israeli-firms-nso-group-candiru

Alleged Twitter hacker charged with theft of $784K in crypto via SIM swaps - BleepingComputer

The US Department of Justice has indicted a suspected Twitter hacker known as 'PlugWalkJoe' for also stealing $784,000 worth of cryptocurrency using SIM swap attacks. SIM swap attacks are when threat actors take control of targets' phone numbers by porting them to their own device's SIM card.

See the full report here: https://www.bleepingcomputer.com/news/security/alleged-twitter-hacker-charged-with-theft-of-784k-in-crypto-via-sim-swaps/

Crab Game Devs Caution Streamers After DDOS Attacks - EsportsTalk

The Squid Game-inspired Crab Game is incredibly popular with streamers right now. Crab Game was recently streamed by xQc, who unfortunately got hit with a DDOS attack during the game, as did Sodapoppin. This is unfortunately one of the dangers of playing a game online, but some people can look your IP up and use it to perform a DDOS attack. This floods your router with data and renders it unable to work.

See the full report here: https://www.esportstalk.com/news/crab-game-devs-caution-streamers-after-ddos-attacks/

The U.K. Labour Party discloses a data breach

The U.K. Labour Party discloses a data breach after a service provider that manages its data was hit by a ransomware attack. The party notified relevant authorities and members that some of their information was impacted by the security breach. Exposed data includes information provided by members, registered and affiliated supporters, and other individuals who have provided their info to the Labour Party.

See the full report here: https://securityaffairs.co/wordpress/?p=124162