zerofox logo
Advisories

Threat Intelligence Bulletin: 11/05/2021 - 11/11/2021

Alpha Team
banner image

Microsoft Patch Tuesday 11/09/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
  • Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:
Microsoft's Patch Tuesday update for November 2021 contained 55 vulnerabilities in total, with:

  • 2 vulnerabilities rated as Critical
  • 28 vulnerabilities rated as High
  • 21 vulnerabilities rated as Medium
  • 4 vulnerabilities rated as Low

Most notable vulnerabilities

Microsoft has listed six zero-days vulnerabilities, CVE-2021-42292, CVE-2021-42321, CVE-2021-38631, CVE-2021-41371, CVE-2021-43208, and CVE-2021-43209, which are being fixed in the November Patch Tuesday security update; among these, CVE-2021-42292 and CVE-2021-42321 are detected being actively exploited in the wild.

CVE-2021-42292

CVE-2021-42292 is a Security Feature Bypass Vulnerability in Microsoft Excel that could allow a remote attacker to bypass security restrictions. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to bypass security features and gain access to the system.

The following products are impacted:

  • Microsoft Office 2013 Service Pack 1 (64-bit editions)
  • Microsoft Office 2013 Service Pack 1 (32-bit editions)
  • Microsoft Office 2013 RT Service Pack 1
  • Microsoft Excel 2013 Service Pack 1 (64-bit editions)
  • Microsoft Excel 2013 Service Pack 1 (32-bit editions)
  • Microsoft Excel 2013 RT Service Pack 1
  • Microsoft Office 2016 (64-bit edition)
  • Microsoft Office 2016 (32-bit edition)
  • Microsoft Excel 2016 (64-bit edition)
  • Microsoft Excel 2016 (32-bit edition)
  • Microsoft Office LTSC 2021 for 32-bit editions
  • Microsoft Office LTSC 2021 for 64-bit editions
  • Microsoft Office LTSC for Mac 2021
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft Office 2019 for Mac
  • Microsoft Office 2019 for 64-bit editions
  • Microsoft Office 2019 for 32-bit editions

CVE-2021-42321

CVE-2021-42321 is a Remote Code Execution Vulnerability in Microsoft Exchange Server that could allow a remote authenticated attacker to execute arbitrary code on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Microsoft Exchange Server 2019 Cumulative Update 11
  • Microsoft Exchange Server 2016 Cumulative Update 22
  • Microsoft Exchange Server 2019 Cumulative Update 10
  • Microsoft Exchange Server 2016 Cumulative Update 21

CVE-2021-38631

CVE-2021-38631 is an Information Disclosure Vulnerability in Windows Remote Desktop Protocol (RDP) that could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Desktop Protocol (RDP). By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-41371

CVE-2021-41371 is an Information Disclosure Vulnerability in Windows Remote Desktop Protocol (RDP) that could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Desktop Protocol (RDP). By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-43208

CVE-2021-43208 is a Remote Code Execution Vulnerability in 3D Viewer that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • 3D Viewer

CVE-2021-43209

CVE-2021-43209 is a Remote Code Execution Vulnerability in 3D Viewer that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • 3D Viewer

CVE-2021-3711

CVE-2021-3711 is a Buffer Overflow Vulnerability in OpenSSL that is affecting Microsoft Visual Studio. It is caused by improper bounds checking by the EVP_PKEY_decrypt() function within implementation of the SM2 decryption. By sending specially crafted SM2 content, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

The following products are impacted:

  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  • Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

CVE-2021-26443

CVE-2021-26443 is a Remote Code Execution Vulnerability in Microsoft Virtual Machine Bus (VMBus) that could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Virtual Machine Bus (VMBus) component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for x64-based Systems

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Phishing Ecosystem Series: Evading Detection

One of the main considerations for a threat actor deploying phishing sites, is how long the deployment will remain undetected. The longer a site remains exposed to the internet, the greater the chance of it being crawled, analysed, and flagged as malicious by one of the many automated services which crawl the internet analysing its content. Quick turnover of phishing domains and hosting negatively impacts threat actors, as this both increases the cost of running a campaign, and decreases potential returns as potential victims are warned or blocked from accessing the phishing site.

Threat actors and phishing kit authors have subsequently begun incorporating more advanced methods of evading detection, from simple IP and bot blocking techniques to integrating third party services and APIs to provide more thorough checks on visitors accessing the site.
By performing more vigorous checks on visitors, many bots or scanning services which could identify the site as malicious will simply be blocked, or redirected to legitimate pages.

Standing Intelligence Requirements


For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts.
  • Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
  • Avoid opening unsolicited attachments and never click suspicious links
  • Do not share passwords, and do not reuse the same password on different websites and applications.
  • If you are alerted or suspect a compromised account, change the password immediately.
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Evasive Techniques

Many of the solutions employed by threat actors to evade the detection of their phishing sites contain one or more of the following capabilities. Each capability however can vary in sophistication based on exactly which tools, code or services the phishing kit utilises.

IP lookup

As a rudimentary form of protection, many kits utilise a blocklist of IP addresses and IP address ranges known to be used by various online services and organisations which crawl the internet analysing its content.


Figure 1: A blocklist containing ranges of IP addresses known to be used by security vendors (left), PHP code which checks allow/blocklists to determine if the visitor should pass (right).
Source: ZeroFox Threat Research

Additionally, the IP address can be used for further checks based on associated Internet Service Provider (ISP), and geolocation. ISP and location can be determined in several ways, including local lookups to a GeoIP2 database or external API such as ipdb.

Request Headers

When requesting a web page via a browser, the requesting device sends multiple pieces of information to the web server so it may tailor its response. These are known as “Request Headers”. These headers are also interrogated within many phishing kits in order to block unwanted visitors.
A popular request header used for this purpose is the “User Agent” string . This string informs the receiving web server what type of device is requesting it. This is commonly used by phishing kits as a method of filtering out unwanted visitors. For example, many kits targeting financial institutions are designed to replicate online banking mobile or app views, so will only render the phishing page if the requesting device reports itself to be a mobile device.

URL query parameters

Some phishing kits utilise required arguments/parameters as part of a GET request when navigating to the domain. This means that unless you provide a specific query parameter after the domain, which is specified by the kit owner, you will be unable to even reach the phishing page.


Figure 2: PHP code checking for specific query parameters, and redirecting the visitor if they are not present.
Source: ZeroFox Threat Research

Open-source solutions

Rather than reinventing the wheel, many kit authors use existing, legitimate tools and libraries within their code, allowing them to easily add in basic evasion and bot blocking capabilities. Some of the more frequently observed libraries include;

CrawlerDetect

CrawlerDetect is an open source and widely adopted tool written in PHP which aims to identify and stop known bots/crawlers/spiders based on the user agent and http_from request headers.

Proxyblock

16Shop also utilises some PHP code alongside a third-party api hosted by mind-media.com which will check the visitor's IP against a list of known proxy and VPN IP ranges. If there's a match, the visitor is presented with a 403 http response and details are logged.

Apache Htaccess

Apache is an open-source web server software, commonly used by many phishing site deployments. Apache offers the ability to control access to the site via the use of .htaccess files. These files commonly contain definitions for allowing, blocking, or redirecting visitors based on attributes of the request, including; IP address, user agent, referer, and more.


Figure 3: Excerpt from a .htaccess file found within a popular phishing kit, totalling almost ten thousand lines.
Source: ZeroFox Threat Research

Third-party services

Adoption of third-party services to aid in evading detection has continued to increase, as competition keeps pricing attractive enough for threat actors to invest in paying for access to these API’s. This in turn offsets the need to keep updating local htaccess or bot blocking scripts as vendors rotate their publicly attributed IP ranges, or deploy new web crawlers. These services advertise functionality such as blocking bots, looking up IP address geolocation, URL shortening, disposable email accounts, phone number identity lookup and more, as well as 24/7 support.


Figure 4: Home pages of "bot blocking" services commonly utilised in phishing kits.
Source: ZeroFox Threat Research

Many of these services advertise themselves publicly as a tool to block unwanted visitors or “bots” from accessing your website, and while they may have legitimate customers, an increasing number of phishing kit authors are integrating them into their code in order to increase the lifetime of the phishing attack.


Figure 5: An exposed directory on one of the bot blocking services websites contains information on how to directly integrate their services with popular phishing kits.
Source: ZeroFox Threat Research

Typically, these services expose a public API which can be queried along with an IP. If the IP has been associated with a bot or service which crawls the internet for malicious sites it will block the request and present the requester with a 403 (Forbidden) HTTP response, or redirect them to a legitimate site. Additional information can also be returned to further tailor who is able to reach the phishing page including location, allowing threat actors to easily create a “geo-fence” around their phishing site, only allowing visitors from certain countries or regions to reach the phishing page successfully. This is mainly used for phishing attacks targeting localised companies or ensuring victims are only from another country.

Conclusion

As security vendors and researchers continue to develop and improve phishing detection technology and countermeasures, phishing kit authors and developers also continue to improve evasive capabilities within their tools and code. This has resulted in increased adoption of third-party solutions to this problem, distributing under the popular Software-as-a-Service model. Whilst these tools and services have evolved over time, many functionality remains basically the same. ZeroFox assesses with a high likelihood that evasive techniques and tools will continue to be adapted and integrated into phishing attacks, in line with anti-phishing technology developments.

Breaking News: 2021-11-05 - 2021-11-11

Google Ads for Faux Cryptowallets Net Scammers At Least $500K

Crypto-thieves are buying Google Ads to target victims with fake wallets, which steal credentials and drain balances. According to Check Point Research, attackers are putting Google Ads to search for potential victims. Clicking on the malicious Google Ad takes the user to a malicious site doctored to look like the Phantom (or sometimes MetaMask) wallet site. So far, the hackers have gained more than $500,000 from the scam.

See the full report here: https://threatpost.com/google-ads-cryptowallets-scammers/176047/

Native Tribal Casinos Taking Millions in Ransomware Losses

The FBI is warming of a rise in attacks against tribal casinos. The alert reportedly identified notorious ransomware groups, including Bitpaymer, Conti, Cuba, REvil, Ryuk and Snatch, which have launched successful attacks on casinos, shutting down operations and stealing data. The FBI also said in the notification that the groups targeted tribes with the assumption they lack extensive cybersecurity infrastructure and enforcement reach.

See the full report here: https://threatpost.com/native-tribal-casinos-ransomware-losses/176060/

BrakTooth Bluetooth Bugs Bite: Exploit Code, PoC Released

Researchers have recently discovered BrakTooth flaws in Bluetooth devices and released the test kit and full exploit code for the bugs. BrakTooth is a collection of flaws affecting commercial Bluetooth stacks on more than 1,400 chipsets used in billions of devices, including smartphones, PCs, toys, internet-of-things (IoT) devices and industrial equipment that rely on Bluetooth Classic (BT) for communication. CISA has urged manufacturers, vendors and developers to patch or employ workarounds.

See the full report here: https://threatpost.com/braktooth-bluetooth-bugs-exploit-poc/176036/

Proofpoint Phish Harvests Microsoft O365, Google Logins

A phishing campaign has been reported where phishers are impersonating Proofpoint, the cybersecurity firm, in an attempt to make off with victims’ Microsoft Office 365 and Google email credentials. The email claimed to contain a secure file sent via Proofpoint as a link, which took victims to a splash page that spoofed Proofpoint branding and contained login links for different email providers. The subject line of the phishing mail was added with ‘Re’, which signifies an ongoing conversation and might make victims click the email faster. Attacks like these use social engineering, brand impersonation and the use of legitimate infrastructure to bypass traditional email security filters and users’ eye tests.

See the full report here: https://threatpost.com/proofpoint-phish-microsoft-o365-google-logins/176038/

Mac Trojan Malware Can Hack Your Apple Device, Run Ads and Steal Info: 8 Ways to Prevent, Remove WizardUpdate - iTech Post

A newly discovered Mac Trojan malware names “WizardUpdate” can run ads and steal data from the Apple devices. Although it was already in existence for some time now, it has been upgraded to pose more danger. So, Mac users should be concerned since it has been upgraded to include enhanced evasion and persistence strategies, which are more difficult to track, locate and even put an end to. WizardUpdate--also known as UpdateAgent, a program that runs on a code that can be found in download repositories. Despite the fact that the researchers found no direct evidence of how WizardUpdate is transmitted but few steps were recommended to remove WizardUpdate.

See the full report here: https://www.itechpost.com/articles/107699/20211105/mac-trojan-malware-hack-apple-device-run-ads-steal-info.htm

US defense contractor Electronic Warfare hit by data breach

US defense contractor Electronic Warfare Associates (EWA) has disclosed a data breach after threat actors hacked their email system and stole files containing personal information. The impact has confirmed that the threat actor managed to exfiltrate files containing sensitive information since it experienced when the hacker attempted wire fraud. EWA is a specialist in high-tech defense hardware and software solutions for communication, access control, simulation, training, management, testing, and monitoring systems (radars). A data breach on the firm's email systems may have also compromised military technology secrets as EWA develops and designs these products internally.

See the full report here: https://www.bleepingcomputer.com/news/security/us-defense-contractor-electronic-warfare-hit-by-data-breach/

Threat actors stole $55 million worth of cryptocurrency from bZx DeFi platform

A blockchain security firm SlowMist suspected that threat actors have stolen more than $55 million from the bZx decentralized finance (DeFi) platform. Attackers obtained two private keys for the DeFi platform through spear-phishing attacks. However, the bZx has yet to confirm the exact amount of stolen funds. The decentralized finance (DeFi) platforms allow users to borrow/loan and speculate on cryptocurrency price variations.

See the full report here: https://securityaffairs.co/wordpress/124266/cyber-crime/bzx-defi-platform-hacked.html

Ukraine links members of Gamaredon hacker group to Russian FSB - BleepingComputer

The Gamaredon hacking group, tracked as Armageddon by the SSU, is allegedly operated under the FSB (Russian Federal Security Service) and is believed to be responsible for over 5,000 attacks in Ukraine since 2014. SSU and the Ukrainian secret service say they have identified five members of the Gamaredon hacking group with Ukraine links and are accused of taking part in these attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-links-members-of-gamaredon-hacker-group-to-russian-fsb/

'Trojan Source' attack method can hide bugs into open-source code - BleepingComputer

Security Researchers disclosed and demonstrated the “Trojan Source” class of attacks that could compromise first-party software and supply chains. This new attack method is called “Trojan Source” that allows injecting vulnerabilities into the source code of a software project. A threat actor can reorder the source code to change its logic in a way that creates an exploitable vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/trojan-source-attack-method-can-hide-bugs-into-open-source-code/

Samsung sued for flawed Chromebook hinges cracking displays - BleepingComputer

Samsung is being sued for selling the Samsung Chromebook Plus 2-in-1 even though they allegedly knew for years of a defect that caused displays to break. The class-action lawsuit has been filed by Tony McCoy out of the U.S. District Court for the District of New Jersey and claims that Samsung concealed the defect of the Chromebook and denied covering repair costs (reaching $350), even though the flaw affected numerous customers.

See the full report here: https://www.bleepingcomputer.com/news/legal/samsung-sued-for-flawed-chromebook-hinges-cracking-displays/

OneDrive reaches end of support on Windows 7, 8 in January - BleepingComputer

Microsoft has announced that the OneDrive desktop application will reach the end of support on legacy Windows 7, 8, and 8.1 starting with January 1, 2022. OneDrive is a file hosting and synchronization service enabling Microsoft customers to access their files from the cloud on all their devices, from anywhere. Customers with systems still running Windows 7, 8, or 8.1 are advised to upgrade their OS to Windows 10 or Windows 11.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/onedrive-reaches-end-of-support-on-windows-7-8-in-january/

Data breach at US healthcare provider Viverant PT impacts more than 6,500 patients - The Daily Swig

A data breach at a physical therapy center based in the US has breached the personal data of more than 6,500 patients. Viverant PT, based in Minneapolis, Minnesota, said that the personally identifiable information (PII) of current and former patients and employees was affected in the breach. A wealth of healthcare information is reported to have been leaked, including patient names, addresses, dates of birth, Social Security numbers, driver’s license numbers, and medical record numbers. Other potentially accessed data includes diagnostic or treatment information, payment card numbers with passwords or security codes, health insurance information, financial account numbers with or without passwords or routing numbers, and digital signatures.

See the full report here: https://portswigger.net/daily-swig/data-breach-at-us-healthcare-provider-viverant-pt-impacts-more-than-6-500-patients

MITRE shares list of most dangerous hardware weaknesses - BleepingComputer

The Mitre Corporation is an American not-for-profit organization with dual headquarters in Bedford, Massachusetts, and McLean, Virginia. It has shared a list of the topmost dangerous programming, design, and architecture security flaws plaguing hardware this year. This list was formed by collaborating with the Hardware CWE Special Interest Group (SIG).

See the full report here: https://www.bleepingcomputer.com/news/security/mitre-shares-list-of-most-dangerous-hardware-weaknesses/

Hackers have breached organizations in defense and other sensitive sectors, security firm says - CNN

Cybersecurity researchers are exposing an ongoing effort by these unidentified hackers to steal key data from US defense contractors and other sensitive targets. Officials from the NSA and the US Cybersecurity and Infrastructure Security Agency (CISA) are tracking the threat. According to the senior Palo Alto Networks executive, the hackers have stolen passwords from some targeted organizations with the goal of maintaining long-term access to those networks.

See the full report here: https://www.cnn.com/2021/11/07/politics/hackers-defense-contractors-energy-health-care-nsa/index.html

Some Windows 11 apps are broken due to expired certificate - BleepingComputer

According to Microsoft, some users might find it difficult to open or use certain built-in Windows apps and features due to an expired digital certificate. Ideally, the certificate got expired on October 31, 2021. Devices running in S mode are more likely to be affected. The company is currently working on a fix to address this new known issue which will be provided with a future update.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/some-windows-11-apps-are-broken-due-to-expired-certificate/

State spy agency says it has foiled 14 hacking attempts from abroad this year - The Korea Herald

South Korea's state intelligence agency has detected 14 hacking attempts from abroad on the country's key industry technologies which could have resulted in nearly 1.78 trillion damages. According to the National Intelligence Service (NIS), seven of the attempts were reported from the country's leading chip and display industries.

See the full report here: http://www.koreaherald.com/view.php?ud=20211108000780

Report: 57% of all ecommerce cyberattacks are bot-driven - VentureBeat

According to a 12-month analysis by Imperva Research Labs of cybersecurity risks impacting e-commerce, 57% of all attacks recorded on e-commerce websites were carried out by bots in 2021, compared to 33% for all other industries. According to the reports, the eCommerce industry remains a prime target for cybercrime.

See the full report here: https://venturebeat.com/2021/11/07/report-57-of-all-ecommerce-cyberattacks-are-bot-driven/

Indian securities depository exposed 44 million investors' personal info – twice

A vulnerability at a CDSL subsidiary, CDSL Ventures Limited (CVL), has exposed personal and financial data of over 4 crore Indian investors twice in a period of 10 days, according to cyber security consultancy startup CyberX9.The Central Depository Services (India) Limited (CDSL) is a SEBI registered depository and CDSL Ventures Ltd is a KYC registering agency separately registered with the Securities and Exchange Board of India (SEBI).

See the full report here: https://www.theregister.com/2021/11/09/cdsl_data_leak/

Robinhood data breach exposes 7 million users' personal information - Mashable

Robinhood Markets, Inc. is an American financial services company headquartered in Menlo Park, California, known for pioneering commission-free trades of stocks, exchange-traded funds, and cryptocurrencies via a mobile app introduced in March 2015. The firm has announced a data breach revealing around 7 million users' information after an employee was tricked into providing a hacker with access to internal systems.

See the full report here: https://mashable.com/article/robinhood-data-breach-hack

MediaMarkt hit by Hive ransomware, initial $240 million ransom - BleepingComputer

Media Markt is a German multinational chain of stores selling consumer electronics with over 1000 stores in Europe. It was hit by a ransomware attack with an initial ransom demand of $240 million. Hive ransomware was responsible for the IT systems to shut down and store operations be disrupted in Netherlands and Germany.

See the full report here: https://www.bleepingcomputer.com/news/security/mediamarkt-hit-by-hive-ransomware-initial-240-million-ransom/

BlackBerry Uncovers Initial Access Broker Linked to 3 Distinct Hacker Groups - The Hacker News

The BlackBerry Research & Intelligence Team has found that the ransomware groups are known as MountLocker and Phobos, as well as the StrongPity advanced persistent threat (APT), have all partnered with an IAB threat actor that BlackBerry has dubbed Zebra2104.IABs compromise the networks of various organizations through exploitation, credential-stuffing, phishing, or other means, then establish persistent backdoors to maintain access.

See the full report here: https://thehackernews.com/2021/11/blackberry-uncover-initial-access.html

US sanctions Chatex cryptoexchange used by ransomware gangs - BleepingComputer

The US Treasury Department has announced sanctions against the Chatex cryptocurrency exchange for helping ransomware gangs evade sanctions and facilitating ransom transactions. Chatex is the second largest crypto wallet and p2p exchange in-app platform for Telegram.As part of the Treasury Department’s actions, U.S. residents are prohibited from engaging in transactions with Vasinskyi, Polyanin, Chatex, and all associated entities, or they may face enforcement action or sanctions themselves.

See the full report here: https://www.bleepingcomputer.com/news/security/us-sanctions-chatex-cryptoexchange-used-by-ransomware-gangs/

Dridex Banking Malware Turns Up in Mexico - BankInfoSecurity.com

Mexico-based cybersecurity services company, Metabase Q, has seen a notorious type of banking malware known as Dridex recently appear in Mexico. Dridex also known as Bugat and Cridex is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word. Once a computer is infected, Dridex can capture login credentials, but that's just one of many features. It can detect when someone is logging onto a banking website and inject other malware or keylogging software.

See the full report here: https://www.bankinfosecurity.com/dridex-banking-malware-turns-up-in-mexico-a-17879

Centara hotels and resorts suffered second data breach right after the first data breach - TheDigitalHacker

Centara Hotels & Resorts is Thailand's leading hotel group, with 46 deluxe and first-class properties across Thailand, as well as 24 hotels and resorts in the Maldives, Vietnam, Bali, Sri Lanka, Qatar, Laos, Oman, Turkey, and China. Centara Hotels and resorts got hit by a ransomware attack and the attackers have asked for a ransom amount of $900000.Hackers have claimed to breach the luxury hotels within a few minutes and were able to access a total of 400 GB of files, followed by a second attack on the servers just after ten minutes of the first attack.

See the full report here: https://thedigitalhacker.com/centara-hotels-and-resorts-suffered-second-data-breach-right-after-the-first-data-breach/

Data stolen in Bridgeport ransomware attack found on dark web - WBOY.com

The City of Bridgeport experienced a ransomware attack in May 2021, about which the residents were notified in September 2021. The breached data has information including social security numbers, driver’s license numbers, addresses, and more. Now, the information that was taken is being found on the dark web.

See the full report here: https://www.wboy.com/news/harrison/data-stolen-in-bridgeport-ransomware-attack-found-on-dark-web/

Ransomware Hits Major US Comic Book Distributor - PCMag

Diamond Comic Distributors, Inc. is an American comic book distributor serving retailers in North America and worldwide. It had suffered a ransomware attack on Sunday that temporarily took down the company’s website and disrupted its ability to process customer orders. The firm has notified a team of third-party forensic experts and also law enforcement about the attack.

See the full report here: https://www.pcmag.com/news/ransomware-hits-major-us-comic-book-distributor

Medical software firm urges password resets after ransomware attack - BleepingComputer

Medatixx, a German medical software vendor whose products are used in over 21,000 health institutions, urges customers to change their application passwords following a ransomware attack that has severely impaired its entire operations. The data stolen during the attack is still unknown.

See the full report here: https://www.bleepingcomputer.com/news/security/medical-software-firm-urges-password-resets-after-ransomware-attack/

TeamTNT hackers target your poorly configured Docker servers - BleepingComputer

According to a report by researchers at TrendMicro, the actors have three distinct goals: to install Monero cryptominers, scan for other vulnerable Internet-exposed Docker instances, and perform container-to-host escapes to access the main network.TeamTNT then uses compromised, or actor-controlled Docker Hub accounts to host malicious images and deploy them on a targeted host.

See the full report here: https://www.bleepingcomputer.com/news/security/teamtnt-hackers-target-your-poorly-configured-docker-servers/

Microsoft warns about China-based hacking group that's up to no good (again) - Windows Central

China-based hackers linked with SolarWinds Serv-U zero-day exploit attack are back on Microsoft's radar.This time around, said hackers have been going after vulnerable ZOHO ManageEngine ADSelfService Plus software.The threat actors, dubbed by Microsoft as "DEV-0322," have had their activity monitored and exhibit attack patterns that include malware drops for lateral network infiltration, credential dumping, and custom binary installation.

See the full report here: https://www.windowscentral.com/microsoft-warns-about-china-based-hacking-group-thats-no-good

Claroty and JFrog disclose 14 new vulnerabilities in BusyBox - SC Magazine

The IoT security world got a big lift on Tuesday when researchers reported that they had found 14 new vulnerabilities in BusyBox, a software suite of Unix utilities that tend to run many popular programmable logic controllers, human machine interfaces, and remote terminal units — many of which now run on Linux.

See the full report here: https://www.scmagazine.com/news/ddos/claroty-and-jfrog-disclose-14-new-vulnerabilities-in-busybox

Iranian hackers targeting telcos and ISPs using upgraded malware - IT PRO

According to a report from Accenture, Iranian-backed hackers have been hacking into ISPs and telecom companies since July 2021. Once the ISPs and telecom companies are compromised, it provides access to various organizations and subscribers in addition to its internal systems. The group is known as Lyceum(Hexane or Spirlin), has operated since 2017, and has been linked to malicious campaigns targeting Middle Eastern oil and gas companies.

See the full report here: https://www.itpro.co.uk/security/hacking/361501/iranian-hackers-targeting-telcos-and-isps-using-upgraded-malware

Stor-a-File hit by ransomware after crooks target SolarWinds Serv-U FTP software

Stor-a-File is one of the largest and most successful privately-owned records management service providers in the UK. The firm encountered an attack in August that exploited an unpatched instance of SolarWinds' Serv-U FTP software. The firm has medical companies also as its clients. The firm has refused to pay the criminals and also acknowledges that some data has been leaked by ransomware criminals on a Tor blog.

See the full report here: https://www.theregister.com/2021/11/10/stor_a_file_ransomware_attack_solarwinds_serv_u/

Lazarus hackers target researchers with trojanized IDA Pro - BleepingComputer

The Interactive Disassembler (IDA) is a disassembler for computer software that generates assembly language source code from machine-executable code. A North Korean state-sponsored hacking group known as Lazarus is trying to hack security researchers with a trojanized pirated version of the popular IDA Pro reverse engineering application. Since IDA Pro is an expensive application, some researchers download a pirated cracked version instead of purchasing it.

See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-target-researchers-with-trojanized-ida-pro/

Void Balaur hackers-for-hire sell stolen mailboxes and private data - BleepingComputer

A hacker-for-hire group called Void Balaur was involved in attacks that targeted victims for both financial and surveillance gains. Past attacks targeted IT companies, telecoms, and activists, journalists, and religious leaders alike. However, at a closer look, researchers said that some of these attacks could be linked to the infrastructure of RocketHack.me, a website advertising on-demand hacking services. The same site was referenced in numerous ads on Russian-speaking underground forums such as Probiv, Tenec, and Darkmoney, dating as far back as 2017.

See the full report here: https://www.bleepingcomputer.com/news/security/void-balaur-hackers-for-hire-sell-stolen-mailboxes-and-private-data/

HPE says hackers breached Aruba Central using stolen access key - BleepingComputer

The Hewlett Packard Enterprise Company is an American multinational enterprise information technology company based in Houston, Texas, United States. The firm has confirmed that data repositories for their Aruba Central network monitoring platform were compromised, allowing a threat actor to access collected data about monitored devices and their locations. The threat actor obtained an "access key" that allowed them to view customer data stored in the Aruba Central environment.

See the full report here: https://www.bleepingcomputer.com/news/security/hpe-says-hackers-breached-aruba-central-using-stolen-access-key/

Tags:
weekly bulletin
all industries
global