Threat Intelligence Bulletin: 11/12/2021 - 11/18/2021
Zoom Patches Remote Hijacking Vulnerabilities
Security researchers had revealed vulnerabilities in various entities of Zoom On-Premise deployments, including On-Premise Meeting Connector, Virtual Room Connector, and Recording Connector. The flaws in the affected versions allow an intruder to command and gain server access with escalated privileges, leading to an application crash or remote control of the system. The company has fixed the issues in the latest versions of the affected applications.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956
Recommendations
- Enable multi-factor authentication for all of your organizational Zoom accounts.
- Ensure Zoom applications are updated to their latest version or as advised by the vendor.
- Reach out to [email protected] for assistance.
Details
Zoom, a cloud-based video conferencing and web communication platform, addressed three vulnerabilities tracked as CVE-2021-34414, CVE-2021-34415, and CVE-2021-34416. By exploiting these security flaws, an attacker could execute arbitrary commands and gain admin privileges.
- CVE-2021-34414 and CVE-2021-34416 exist in the following implementations:
- Zoom Meeting Connector Controller up to version 4.6.348.20201217
- Zoom Meeting Connector MMR up to version 4.6.348.20201217
- Zoom Recording Connector up to version 3.8.42.20200905
- Zoom Virtual Room Connector up to version 4.4.6620.20201110
- Zoom Virtual Room Connector Load Balancer prior to version 2.5.5495.20210326
- Zoom Meeting Connector up to version 4.6.360.20210325
- Zoom Meeting Connector MMR up to version 4.6.360.20210325
The affected versions of the On-Premise Meeting Connector and Virtual Room Connector fail to validate the input request to update the network configuration, thus allowing the uninvited user to inject arbitrary commands on the on-premise image with the web portal administrator privileges.
The CVE-2021-34415 affects Zoom On-Premise Meeting Connector Controller versions prior to 4.6.358.20210205. Triggering this vulnerability will allow an attacker to exhaust the server resources and lead to application failure.
Conclusion
Lack of input sanitization in the affected components of On-Premise deployments allows external users to intrude into the network. According to security researchers, the malicious actor needs to obtain the admin or sudo credentials to take remote control of the system. The On-Premise users are recommended to deploy multi-factor authentication and keep the system up-to-date.
Strategic Advisory: Ransomware Landscape
In this Strategic Advisory, the ZeroFox Threat Intelligence team provides an in-depth analysis on the six-month activity of the ransomware landscape from May 2021 to October 2021.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
In the past six months, the ZeroFox Threat Intelligence team has observed the changing ransomware landscape with new, current, and evolved threats. As new threats emerged, current threats persisted or evolved to include novel capabilities and techniques. Among new threats included the discovery of Colossus ransomware by ZeroFox Threat Intelligence and new ransomware families based on old ransomware with a history of success. One of the most active ransomware groups since 2019, REvil was responsible for large-scale attacks on organizations around the world including the Kaseya supply chain attack. The media attention from such attacks led to some popular cybercriminal networks prohibiting the discussion of ransomware or affiliate programs from posting advertisements, as these networks are often monitored by security researchers and law enforcement. Furthermore, the fight against ransomware escalated as world leaders enacted legislation responding to ransomware attacks and sanctions on cryptocurrency exchanges used to pay ransom demands.
Breaking News: 2021-11-12 - 2021-11-18
Hackers Targeted Hong Kong Apple Devices in Widespread Attack
A report from Google's Threat Analysis Group (TAG) reveals the extent of malware attacks on Apple devices that visited Hong Kong–based media and pro-democracy websites. Rather than conducting a targeted attack focusing on high-value targets like journalists and dissidents, the attackers went for scale – indiscriminately placing a backdoor on any iPhone or Mac that visited the affected pages. It's yet another case of previously undisclosed vulnerabilities, or zero-days, being exploited in the wild. Apple has patched the various bugs that allowed the campaign to unfold.
See the full report here: https://www.wired.com/story/ios-macos-hacks-hong-kong-watering-hole/
Magniber ransomware gang now exploits Internet Explorer flaws in attacks - BleepingComputer
The Magniber ransomware gang is now using two Internet Explorer vulnerabilities and malicious advertisements to infect users and encrypt their devices. Because the Magniber ransomware remains uncracked, there's no decryptor to restore any files that have been encrypted with this strain. The damage of their attacks is limited to file encryption; so taking regular backups on secured, isolated systems is a very effective way to deal with this threat.
See the full report here: https://www.bleepingcomputer.com/news/security/magniber-ransomware-gang-now-exploits-internet-explorer-flaws-in-attacks/
New Android Banking Malware Steals Sensitive Info, Damage Phones: Full Details of S.O.V.A Malware - iTech Post
S.O.V.A. – an Android banking malware – allows hackers to steal user information, launch keylogging attacks, and manipulate incoming notifications. S.O.V.A.-based attacks use overlay features to imitate payment systems like PayPal. It is a growing threat for all Android devices, with the ever-growing popularity of online banking.
See the full report here: https://www.itechpost.com/articles/107797/20211112/new-android-banking-malware-steals-sensitive-info-damage-phones-full.htm
'BotenaGo' malware found targeting millions of routers and IoT devices - SiliconANGLE News
BotenaGo is a new botnet discovered by researchers at AT&T that leverages thirty-three exploits to target millions of routers and IoT devices. Upon receiving a command from an operator, BotenaGo will execute remote shell commands on devices in which a vulnerability has been successfully exploited. The malware uses different links, each with a different payload, depending on the infected system.
See the full report here: https://siliconangle.com/2021/11/11/botenago-malware-found-targeting-millions-routers-iot-devices/
School districts are becoming victims of hackers - and you may not even know about it - WFAA.com
The Judson Independent School District paid a ransom of more than $547,000 after falling victim to a cyber attack this summer. District officials released the amount of the ransom Wednesday, two weeks after confirming they paid a ransom. Ransomware hackers had taken down the school district’s electronic systems: phones, Wi-Fi, computers, fax machines, electronic badges for doors.
See the full report here: https://www.wfaa.com/article/news/local/investigates/school-districts-victims-hackers/287-7526356d-0244-494e-8899-74930d014cd5
Philippines gov takes down passport application website amid privacy leak fears
The Department of Foreign Affairs (DFA) on Wednesday said it has disabled its online passport tracker after discovering a "data privacy issue" involving the platform.The agency said it has taken down the tracker and all its data sources "to avoid further data broadcasting".An investigation is ongoing as the DFA takes appropriate measures "to secure the data that may have been exposed". Apart from this, an internal audit is underway to prevent similar incidents from happening in the future.
See the full report here: https://www.theregister.com/2021/11/11/philippines_passport_portal_data_leak/
Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux
Researchers at 360Netlab have found a new botnet named Abcbot that is written in the Go language. The botnet, which is still under development, was first observed in July 2021. As time passed, the botnet added the DGA feature to generate new domain names and IP addresses. Currently, it is capable of self-updating, setting up a web server, launching DDoS attacks, and worm-like propagation.
See the full report here: https://thehackernews.com/2021/11/abcbot-new-evolving-wormable-botnet.html
QBot returns for a new wave of infections using Squirrelwaffle - BleepingComputer
Researchers at TrendMicro have observed a new distribution campaign for QBot relying on Visual Basic Macros (VBA) macros in Microsoft Word documents sent as attachments in phishing emails. Sentinel Labs has also published a report on the rise of the SquirrelWaffle malware loader, linking it directly to QBot, which is dropped as second stage malware. Qbot is also known to partner with ransomware operations to provide them with initial access to a network.
See the full report here: https://www.bleepingcomputer.com/news/security/qbot-returns-for-a-new-wave-of-infections-using-squirrelwaffle/
Microsoft Intune bug forces Samsung devices into non-compliant state - BleepingComputer
Microsoft says some Samsung Galaxy devices will be marked as non-compliant with the organization's security requirements in Microsoft Intune's management interface after automatic restarts or after installing managed updates. Microsoft Intune is a cloud service that allows admins to manage Windows, macOS, iOS/iPadOS, and Android applications and devices in their enterprise environment. It also allows securing proprietary data accessed and shared by users from company-owned or personal devices by enforcing device-specific policies. This could potentially affect access to corporate resources, depending on the Conditional Access policies set by the IT administrator. Users can work around the issue by triggering a device sync to restore access to blocked corporate resources.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-intune-bug-forces-samsung-devices-into-non-compliant-state/
Costco Confirms: A Data Skimmer’s Been Ripping Off Customers
Costco has discovered a payment card skimming device at one of its retail stores and has sent out notification letters informing customers that their card data may have been ripped off if they shopped there recently. Costco workers have removed the device, notified the authorities and is working with law enforcement as they investigate the incident. Customers are advised to check their credit and/or bank statements for suspicious transactions. Costco is also offering victims IDX identity theft protection services, which provide 12 months of credit monitoring, a $1 million insurance reimbursement policy and ID theft recovery services.
See the full report here: https://threatpost.com/costco-data-skimmer-customers-notification/176320/
Europol reveals how ransomware gangs are evolving to evade capture - IT PRO
Europol claimed ransomware will continue to proliferate across the continent but the industry can expect to see more restrictions placed on who or what type of organizations are targeted. The European law enforcement agency released its annual Internet Organised Crime Threat Assessment (IOCTA) which revealed the latest cyber security trends that organizations in the region should be aware of for the coming year, including novel approaches to ransomware and DDoS attacks. Europol claimed ransomware will continue to proliferate across the continent but the industry can expect to see more restrictions placed on who or what type of organizations are targeted.
See the full report here: https://www.itpro.co.uk/security/cyber-crime/361523/europol-report-ddos-ransomware-gangs-evade-capture
Coinbase hit with class action suit over hacked accounts - CoinGeek
Coinbase’s growing cohort of aggrieved former customers is taking action against the company. The suit names Coinbase Global Inc (NASDAQ: COIN) and up to 50 as-yet-unnamed executives and employees as defendants over data breaches by Coinbase which the suit says led to consumers losing their digital assets to hackers. The plaintiff bringing the suit is a trader who was the victim of a hack which led to $50,000 worth of Ethereum purchased using his account without his knowledge.
See the full report here: https://coingeek.com/coinbase-hit-with-class-action-suit-over-hacked-accounts/
Russia-Linked REvil Hackers Hit With Arrests by U.S., Allies - Bloomberg
European authorities announced that police in Romania and South Korea had arrested five people allegedly associated with the Russia-linked ransomware group commonly known as REvil or Sodinokibi. In the U.S., a Ukrainian national, Yaroslav Vasinkyi, and a Russian national, Yevgeniy Polyanin, were indicted for alleged involvement in REvil ransomware attacks, according to Justice Department court documents unsealed Monday in Dallas. While the arrests and associated actions demonstrate a significant capability of governments to disrupt hackers, it remained unclear how much of an impact they’ll have on preventing future ransomware attacks. Cybersecurity experts warn that hackers operate in loosely affiliated groups, often in countries like Russia, where they can evade law enforcement.
See the full report here: https://www.bloomberg.com/news/articles/2021-11-08/biden-administration-allies-unleash-attack-on-revil-ransomware
PhoneSpy Malware Invades Android Users' Privacy - PCMag
Security researchers have discovered a new Android malware called PhoneSpy. They added that to date they found, 23 apps being used to spread it. PhoneSpy has extensive control over infected devices. It is designed to run silently in the background and steals sensitive information that could further be used for personal and corporate blackmail and espionage.
See the full report here: https://www.pcmag.com/news/phonespy-malware-invades-android-users-privacy
Fake end-to-end encrypted chat app distributes Android spyware - BleepingComputer
The GravityRAT, a remote access trojan, is being distributed under a chat application called SoSafe Chat. The app is promoted as a secure messaging application that features end-to-end encryption. Previously in 2020, the malware was distributed via an Android app named ‘Travel Mate Pro,’ but since the pandemic has slowed down traveling, the actors moved to a new medium of distribution. The malware is targeting predominately Indian users, being distributed by Pakistani actors.
See the full report here: https://www.bleepingcomputer.com/news/security/fake-end-to-end-encrypted-chat-app-distributes-android-spyware/
Surveillance firm pays $1 million fine after 'spy van' scandal
The Office of the Commissioner for Personal Data Protection in Cyprus has collected an administrative fine of $1 million fine from intelligence company WiSpear. In 2019, a Chevrolet van packed with equipment that could hack Android smartphones and steal data was stationed near the Larnaca airport. In this regard, the police seize the “spy van,” and also arrested three WiSpear employees, Cyprus nationals, for violation of privacy laws.
See the full report here: https://www.bleepingcomputer.com/news/security/surveillance-firm-pays-1-million-fine-after-spy-van-scandal/
FBI system hacked to email 'urgent' warning about fake cyberattack
The email servers of the Federal Bureau of Investigation (FBI) were hacked recently. The hackers distributed spam emails impersonating FBI warnings. The message warns that a threat actor has been detected in the recipients' network and has stolen data from devices. The hackers identify the threat actor as Vinny Troia, who is the head of security research of the dark web intelligence companies NightLion and Shadowbyte. The FBI confirmed the hack and that they were working on solving the issue.
See the full report here: https://www.bleepingcomputer.com/news/security/fbi-system-hacked-to-email-urgent-warning-about-fake-cyberattack/
Mischievous Joker Android Malware Sneaks Into Googe Play Again, Delete These Apps Now - Hot Hardware
For over a year now, a trojan called Joker is being injected into the Google Play Store, as the malware gets upgraded with new ways of evading detection by Google's vetting process. Apps containing new variants of Joker eventually get exposed, but can rack up thousands of downloads in the meantime. The newest infected apps include a battery-charging animation app and an app that claims to let Android users configure flashing light alerts when receiving a phone call or text message. This article lists the Joker-infested Android apps identified in the past several months.
See the full report here: https://hothardware.com/news/google-kicked-malware-android-apps-play-store-uninstall-now
Ransomware Attack Hits UK Fertility Clinic - Infosecurity Magazine
Data from Lister Fertility Clinic has been put at risk following a ransomware attack on a document management firm – Stor-a-file Limited – which the clinic uses for scanning medical records. The document management firm revealed that 13 organizations had been impacted, with six being healthcare-related. The medical records included consent forms, medical history and test results, treatment recommendations, and fertility treatment records. Credit or debit card details were not included.
See the full report here: https://www.infosecurity-magazine.com/news/ransomwareattack-hits-uk-fertility/
This New Android Malware Might Steal Your Credit Card Information - Digital Information World
A new Android malware called MasterFred uses fake login overlays to steal the credit card information of Netflix, Instagram, and Twitter users. It is very dangerous as the credit card information of people could be easily misused by attackers. The attackers are using the built-in accessibility service in Android to make it so that they can mimic overlays.
See the full report here: https://www.digitalinformationworld.com/2021/11/this-new-android-malware-might-steal.html
Office of Civil Defense's Twitter account hacked - Rappler
The Office of Civil Defense(OCD) says that its official Twitter account was hacked on Sunday, November 14. Because of this there were unusual tweets referring to matters that were not related to the Philippines’ disaster risk reduction and management (DRRM) system appearing. The Office of Civil Defense says that it is working to get its Twitter account back to normal at the soonest possible time.
See the full report here: https://www.rappler.com/nation/office-of-civil-defense-twitter-account-hacked
FTC shares ransomware defense tips for small US businesses - BleepingComputer
The US Federal Trade Commission (FTC) has shared guidance for small businesses on how to secure their networks from ransomware attacks. It guides businesses on blocking threat actors' attempts to exploit vulnerabilities using social engineering or exploits targeting technology. A crucial step is to set up offline, off-site, encrypted backups of information essential to the business. Another step is to train the staff to recognize the tricks ransomware operators use, including phishing messages. The FTC also provides a detailed guide with all the steps businesses have to take to respond to a ransomware attack effectively.
See the full report here: https://www.bleepingcomputer.com/news/security/ftc-shares-ransomware-defense-tips-for-small-us-businesses/
Israel Is Hacking the Phones of Palestinian NGOs and Palestinian Authority Officials
Israel has been caught hacking the phones of six Palestinian human rights staffers. It’s the latest incident in Israel’s larger web of blatantly undemocratic mass surveillance practices.The hack was, apparently, part of an Israeli campaign to criminalize the advocacy efforts of the Palestinian NGOs.
See the full report here: https://www.reddit.com/r/netsec/comments/qtcjp4/israel_is_hacking_the_phones_of_palestinian_ngos/
Researchers Demonstrate New Fingerprinting Attack on Tor Encrypted Traffic
An analysis of website fingerprinting (WF) attacks aimed at the Tor web browser has revealed that it's possible for an adversary to identify a website frequented by a victim; however, only focused adversaries that targeted one particular client configuration and website may succeed in this approach. Untargeted adversaries that aim to generally monitor users' website visits will not succeed, revealed the research. The threat model devised by the academics considers an attacker running an exit node.
See the full report here: https://thehackernews.com/2021/11/researchers-demonstrate-new.html
New Microsoft emergency updates fix Windows Server auth issues - BleepingComputer
Microsoft has released out-of-band updates to address authentication failures related to Kerberos delegation scenarios impacting domain controllers (DC) running supported versions of Windows Server. This issue occurs after users install the November 9, 2021 security updates on domain controllers that are running Windows Server. Users can import this update into Windows Server Update Services (WSUS) manually using the Microsoft Update Catalog.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-microsoft-emergency-updates-fix-windows-server-auth-issues/
Moses Staff hackers wreak havoc on Israeli orgs with ransomless encryptions - BleepingComputer
A hacker group named Moses Staff has claimed responsibility for numerous attacks against Israeli entities, which appear politically motivated as they do not make any ransom payment demands. The group has repeatedly caused damage to Israeli systems in the past few months, infiltrating networks and encrypting files, and then leaking the stolen copies to the public. Moses Staff appears to be using publicly available exploits for known vulnerabilities that remain unpatched on public-facing infrastructure.
See the full report here: https://www.bleepingcomputer.com/news/security/moses-staff-hackers-wreak-havoc-on-israeli-orgs-with-ransomless-encryptions/
Cybercriminals Target Alibaba Cloud for Cryptomining, Malware
Cybercriminals are targeting Alibaba Elastic Computing Service (ECS) instances and disabling certain security features to mine the cryptocurrency Monero (XMR). The attacks involve instructing security filters to drop incoming packets from IP ranges belonging to internal Alibaba zones and regions. Alibaba ECS has an auto-scaling feature, so the service will automatically expand the availability of computing resources depending on demand. This gives cryptominers unlimited resources and could result in bill shock for the victim.
See the full report here: https://threatpost.com/cybercriminals-alibaba-cloud-cryptomining-malware/176348/
High severity BIOS flaws affect numerous Intel processors - BleepingComputer
Two high-severity vulnerabilities that affected a wide range of Intel processor families were disclosed by Intel.SentinelOne is a cybersecurity startup based in Mountain View, California discovered the flaws that allowed threat actors and malware to gain higher privilege levels on the device. These vulnerabilities could lead to escalation of privilege on the machine, but only if the attacker had physical access to vulnerable devices.
See the full report here: https://www.bleepingcomputer.com/news/security/high-severity-bios-flaws-affect-numerous-intel-processors/
New Rowhammer technique bypasses existing DDR4 memory defenses - BleepingComputer
Row hammer is a security exploit that takes advantage of an unintended and undesirable side effect in dynamic random-access memory in which memory cells interact electrically between themselves by leaking their charges, possibly changing the contents of nearby memory rows that were not addressed in the original memory access. Researchers have developed a new fuzzing-based technique called 'Blacksmith' that revives Rowhammer's vulnerability. The emergence of this new Blacksmith method demonstrates that today's DDR4 modules are vulnerable to exploitation, allowing a variety of attacks to be conducted.
See the full report here: https://www.bleepingcomputer.com/news/security/new-rowhammer-technique-bypasses-existing-ddr4-memory-defenses/
SharkBot — A New Android Trojan Stealing Banking and Cryptocurrency Accounts
At the end of October, security firms Cleafy and ThreatFabric have discovered a new Android banking trojan named SharkBot. The malware targets the mobile users of banks in Italy and the UK. The malware can not only automate the theft of user banking funds, but it can also target five cryptocurrency apps.
See the full report here: https://thehackernews.com/2021/11/sharkbot-new-android-trojan-stealing.html
Burnie City Council hackers left their contact details: Mayor - The Advocate
According to Mayor Steve Kons of Burnie City, hackers who caused an extended disruption of City Council IT services did not specifically ask for money. The council noticed something was wrong on November 2, when it identified what it described as an unusual activity on its IT systems. That led to an investigation and a shutdown of various systems.
See the full report here: https://www.theadvocate.com.au/story/7512197/north-west-councils-hackers-left-their-contact-details/
Emotet Makes a Comeback
EMOTET has been one of the most professional and long lasting cybercrime services. First discovered as a banking Trojan in 2014, the malware evolved into the go-to solution for cybercriminals over the years. Security researchers warn that the Emotet botnet has returned and is being installed onto Windows machines that are already infected with TrickBot.Emotet also used infected systems to send automated phishing emails to increase the size of the botnet.
See the full report here: https://www.darkreading.com/threat-intelligence/emotet-returns
200M Adult Cam Model, User Records Exposed in Stripchat Breach
StripChat, has suffered a security breach and has leaked the personal data of millions of users and adult models.The leak, discovered by security researcher Bob Diachenko, took place earlier this month after StripChat exposed its ElasticSearch database cluster on the internet without a password for more than three days between November 4 and November 7.The exposed servers leaked a treasure trove of highly-sensitive information.
See the full report here: https://threatpost.com/adult-cam-model-user-records-exposed-stripchat-breach/176372/
WordPress sites are being hacked in fake ransomware attacks - BleepingComputer
A thread actor has hacked at nearly 300 WordPress websites to display fake encryption notices, trying to trick the site owners into paying 0.1 bitcoin for restoration. The warning indicated that the website was hit with a ransomware attack. The files were reported to be encrypted and the attackers demanded a ransom payment of 0.1 Bitcoin.
See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-sites-are-being-hacked-in-fake-ransomware-attacks/
Belarus government accused of 'partial responsibility' for Ghostwriter campaigns
According to a press release from the European Council on Friday, the “Ghostwriter” campaign targeted “numerous members of Parliaments, government officials, politicians, and members of the press and civil society in the EU”.The Belarusian government has been accused of at least "partial responsibility" for Ghostwriter attacks in Europe. Many of Ghostwriter's campaigns are focused on narratives that are anti-NATO. The European Council has previously accused Russia of Ghostwriter involvement.
See the full report here: https://www.zdnet.com/article/belarus-government-accused-of-partial-responsibility-for-ghostwriter-hacking/
Microsoft adds AI-driven ransomware protection to Defender - BleepingComputer
Microsoft has introduced an AI-driven ransomware attack detection system for Microsoft Defender for Endpoint customers. It is an adaptive system, which can automatically ramp the aggressiveness of cloud-delivered blocking verdicts up and down, based on real-time data and machine learning predictions. The AI-driven enhancement is automatically included in Microsoft Defender for Endpoints as an "always-on".
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-ai-driven-ransomware-protection-to-defender/
NPM fixes private package names leak, serious authorization bug - BleepingComputer
npm – the largest registry of Node.js packages – has announced the fix of security flaws that were identified recently. One of the flaws involved the leak of names of private npm packages on npmjs.com's 'replica' server. Another flaw enabled attackers to publish unauthorized new versions of any existing npm package. Additionally, npm's parent company, GitHub, will require npm maintainers to enable 2FA, from sometime in the first quarter of 2022.
See the full report here: https://www.bleepingcomputer.com/news/security/npm-fixes-private-package-names-leak-serious-authorization-bug/
Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild
A research group has demonstrated a new fingerprinting technique to identify MitM phishing kits in the wild. It uses their intrinsic network-level properties, thus automating the discovery and analysis of phishing websites. The tool – PHOCA – helps discover previously unseen MitM phishing toolkits and even detect/isolate malicious requests coming from such servers.
See the full report here: https://thehackernews.com/2021/11/researchers-demonstrate-new-way-to.html
Zoom patches vulnerabilities in its range of conferencing apps
The popular videoconferencing platform Zoom has patched vulnerabilities in its apps for conferences, negotiations, and recordings. The vulnerabilities made it possible for attackers to inject malicious commands, obtain privileged access, intercept data, and even perform Man-in-the-Middle attacks. Fixing the vulnerabilities requires an update to the apps affected.
See the full report here: https://www.helpnetsecurity.com/2021/11/16/zoom-conferencing-apps-vulnerabilities/
Facebook Bans Pakistani and Syrian Hacker Groups for Abusing its Platform
Meta (formerly Facebook) has anounced that it took action against four malicious cyber groups from Pakistan and Syria who were targeting people in Afghanistan. One of the groups had members posing as young women and tricking the recipients into clicking phishing links or downloading trojanized chat applications; they also operated rogue app stores. Meta also disrupted three hacking networks linked to the Syrian government.
See the full report here: https://thehackernews.com/2021/11/facebook-bans-pakistani-and-syrian.html
TikTok phishing threatens to delete influencers’ accounts - BleepingComputer
A new phishing campaign is targeting high-profile TikTok accounts such as influencers, brand consultants, and production studios. The phishing methods involve either fake "Verified" badges or threats to shut down the account due to violation of platform terms. The end goal could be account takeover or extortion. Ensuring 2-factor authentication and backing up app data are crucial in such contexts.
See the full report here: https://www.bleepingcomputer.com/news/security/tiktok-phishing-threatens-to-delete-influencers-accounts/
Israel's Candiru Spyware Found Linked to Watering Hole Attacks in U.K and Middle East
Israeli spyware vendor Candiru has allegedly waged "watering hole" attacks against high-profile entities in the U.K. and the Middle East. The affected websites belong to media outlets in the U.K., Yemen, and Saudi Arabia, as well as to Hezbollah; to government institutions in Iran, Syria, and Yemen; and others. Watering hole attacks are a form of highly targeted intrusions.
See the full report here: https://thehackernews.com/2021/11/israels-candiru-spyware-found-linked-to.html
Hackers Targeting Myanmar Use Domain Fronting to Hide Malicious Activities
A malicious campaign used a domain associated with the Myanmar Digital News network, a state-owned digital newspaper, to route communications and evade detection. It used a technique called domain fronting for this purpose, and deployed Cobalt Strike payloads as a stepping stone for launching further attacks. Monitoring network traffic even to high reputation domains is needed to identify the potential domain fronting attacks with Cobalt Strike and other offensive tools.
See the full report here: https://thehackernews.com/2021/11/hackers-targeting-myanmar-use-domain.html
Netflix Bait: Phishers Target Streamers with Fake Service Signups
Kaspersky’s researchers observed various lures aimed at targets, depending on their current streaming subscription status. Fake sign-up pages for services like Netflix were used to pry email addresses and credit card information from victims. Current Netflix subs were sent a phishing email requesting they update their billing information. The link leads to a malicious payment confirmation page addressing “costumers” instead of “consumers.”
See the full report here: https://threatpost.com/netflix-bait-phishers-fake-signups/176422/
Hacker Claims Breaking into National Police's Database - English Tempo.co
A self-proclaimed hacker under a Twitter account @son1x666 claimed to have broken into the data of the National Police members in Jakarta. The hacker also claimed that the data breach was carried out alone. The list includes the policemen’s name, rank, work unit, last position, address, ethnicity, and sanctions.
See the full report here: https://en.tempo.co/read/1529867/hacker-claims-breaking-into-national-polices-database
ProxyShell leads to domain-wide ransomware attack - TechTarget
According to a new study released Monday by threat intelligence provider The DFIR Report, the “ProxyShell Leads” vulnerabilities have triggered domain-wide ransomware attacks against victims. An unpatched and unnamed Exchange Server customer was victim to ransomware attacks that exploited the vulnerabilities and compromised the organization domain-wide.
See the full report here: https://www.techtarget.com/searchsecurity/news/252509511/ProxyShell-leads-to-domain-wide-ransomware-attack
Mozilla Firefox 4.0/4.0.1/5.0 Content Security Policy credentials management
A vulnerability was found in Mozilla Firefox 4.0/4.0.1/5.0 (Web Browser) that affects an unknown function of the component Content Security Policy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit is publicly available.
See the full report here: https://vuldb.com/?id.58317