Threat Intelligence Bulletin: 11/26/2021 - 12/02/2021

Breaking News: 2021-11-26 - 2021-12-02

UK.gov emits draft IoT and smartphone security law for Parliamentary scrutiny

The Product Security and Telecommunications Infrastructure (PSTI) Bill has been introduced in the British House of Commons. The Bill is intended to set enhanced security standards in consumer tech gadgetry. It requires consumer product manufacturers to comply with security standards laid down by the Department for Digital, Culture, Media and Sport.

See the full report here: https://www.theregister.com/2021/11/25/product_security_telecoms_bill_parliament/

This New Stealthy JavaScript Loader Infecting Computers with Malware

A previously undocumented JavaScript malware strain – named RATDispenser – is being used as a loader to distribute remote access Trojans (RATs) and information stealers. It is used to get an initial foothold on a system before launching secondary malware that establishes control over the compromised device. Security researchers suspect a malware-as-a-service business model operating here.

See the full report here: https://thehackernews.com/2021/11/this-new-stealthy-javascript-loader.html

Discord malware campaign targets crypto and NFT communities - BleepingComputer

A new malware campaign on Discord uses the Babadeda crypter to hide malware that targets the crypto, NFT, and DeFi communities. It involves distributing remote-access trojans hidden via Babadeda, posing as a legitimate app, on crypto-themed channels. The victims' crypto wallets, funds, and NFT assets could be potential targets.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-malware-campaign-targets-crypto-and-nft-communities/

New Linux malware hides in cron jobs with invalid dates - BleepingComputer

Security researchers have discovered a new remote access trojan (RAT) for Linux, dubbed CronRAT that keeps an almost invisible profile by hiding in tasks scheduled for execution on a non-existent day. This malware targets web stores and enables attackers to steal credit card data by deploying online payment skimmers on Linux servers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-malware-hides-in-cron-jobs-with-invalid-dates/

Trend Micro Antivirus for MAC vulnerable to improper access controls

Trend Micro Incorporated reported this vulnerability to notify users of a security update for Trend Micro Antivirus for MAC. A user who can log in to the system where the affected product is installed may obtain the administrative privilege. As a result, arbitrary code may be executed on the system. The solution to this is to update the software to the latest version according to the information provided by the developer.

See the full report here: https://jvn.jp/en/vu/JVNVU95400836/

A year later, Baltimore County Schools ransomware recovery costs nearly $9.7 million - Fox Baltimore

Baltimore County Public Schools was hit with a ransomware attack on November 24, 2020. According to Baltimore County Public Schools, the cost of ongoing recovery from the ransomware attack totals nearly $9.7 million dollars.The breach lead to weeks of disrupted distance learning – as well as teachers and students needing laptops examined or swapped out.

See the full report here: https://foxbaltimore.com/news/local/a-year-later-bcps-ransomware-recovery-costs-near-97-million

IKEA email systems hit by ongoing cyberattack - BleepingComputer

IKEA is battling an ongoing cyberattack where threat actors are targeting employees in internal phishing attacks using stolen reply-chain emails. When visiting the URLs shared in the phishing email, a browser will be redirected to a download called 'charts.zip' that contains a malicious Excel document. This attachment prompts recipients to click the 'Enable Content' or 'Enable Editing' buttons to properly view it. Once those buttons are clicked, malicious macros will be executed which is later used to install payload on the victim's system. The company has warned all its employees about the attack and are asked to report any suspicious email.

See the full report here: https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/

TrickBot phishing checks screen resolution to evade researchers - BleepingComputer

The TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade detection of security software and analysis by researchers. Recently, a security researcher found that the HTML attachment from a TrickBot malspam campaign behaved differently on a real machine than on a virtual one. The attachment downloaded a malicious ZIP archive on a physical system but redirected to the ABC's (American Broadcasting Company) website in a virtual environment. This tactic is used in various phishing campaigns as a means to avoid investigators.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/

Marine services giant Swire Pacific Offshore hit by ransomware - BleepingComputer

Marine services giant Swire Pacific Offshore (SPO) has suffered a Clop ransomware attack that allowed threat actors to steal company data. The unauthorised access has resulted in the loss of some confidential proprietary commercial information and has resulted in the loss of some personal data. However, the cyberattack has not materially affected SPO's global operations. The Clop ransomware group has claimed responsibility for the attack and posted screenshots of data during the attack. The screenshots included stolen passports, payroll information, ID numbers, bank account details, email addresses, and internal correspondence messages.

See the full report here: https://www.bleepingcomputer.com/news/security/marine-services-giant-swire-pacific-offshore-hit-by-ransomware/

Google Warns Crypto Miners Are Hacking Cloud Accounts

Google released a warning stating that Cryptocurrency miners are using hacked Google Cloud accounts for computationally-intensive mining purposes. Google Cloud is a remote storage platform where customers can keep data and files off-site. The report aims to provide intelligence that allows organizations to keep their cloud environments secure. The company added that 86% of 50 recently compromised Google Cloud accounts were used to perform cryptocurrency mining.

See the full report here: https://www.cnbc.com/2021/11/26/google-warns-crypto-miners-are-hacking-cloud-accounts-.html

Iranian Hackers Are Going After US Critical Infrastructure

The FBI, US Cybersecurity and Infrastructure Security Agency, the UK’s National Cyber Security Center, and the Australian Cyber Security Center published an advisory stating that an advanced-persistent-threat hacking group aligned with the Iranian government is exploiting vulnerabilities in Microsoft Exchange and Fortinet’s FortiOS to gain initial access to systems. These threat actors are actively targeting a broad range of victims across multiple US critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.

See the full report here: https://arstechnica.com/gadgets/2021/11/beware-of-iranian-government-backed-hackers-waging-ransomware-us-warns/

New Windows 10 MDM privesc zero-day gets a free micropatch - BleepingComputer

A security researcher has discovered a local privilege escalation (LPE) zero-day vulnerability in the Mobile Device Management Service impacting Windows 10, version 1809 and later. The security flaw resides under the "Access work or school" settings, and it bypasses a patch released by Microsoft to address an information disclosure bug tracked as CVE-2021-24084. Free unofficial patches have been released to protect Windows users. It could be installed by registering a 0patch account and installing the 0patch agent.

See the full report here: https://www.bleepingcomputer.com/news/security/new-windows-10-mdm-privesc-zero-day-gets-a-free-micropatch/

North Korea-linked Zinc group posed as Samsung recruiters to target security firms

North Korean state-sponsored hackers posed as Samsung recruiters and sent fake job offers to employees at South Korean security companies that sell anti-malware software, Google said this week in the first edition of its new Threat Horizons report. Google said that the emails included a PDF allegedly claiming to be of a job description for a role at Samsung; however, the PDFs were malformed and did not open in a standard PDF reader.

See the full report here: https://securityaffairs.co/wordpress/125071/apt/north-korea-zinc-targets-security-firms.html?utm_source=rss&utm_medium=rss&utm_campaign=north-korea-zinc-targets-security-firms

Halo Infinite Players Are Reporting A Rise In Hackers, Ask To Opt Out Of Cross-Play - TheGamer

Halo Infinite players are reporting that hackers have breached the game, prompting some to request the option to opt out of crossplay.As reported by Eurogamer, clip of hackers acting with aimbots has begun appearing on the Halo Subreddit, with players exhibiting aimbots and wallhacks in action during multiplayer matches. Players are particularly disappointed that Halo Infinite currently doesn’t have a report button, meaning cheaters can get away with it.

See the full report here: https://www.thegamer.com/halo-infinite-cheating-rise/

Butler Co. Community College hit with ransomware attack - WPXI Pittsburgh

Butler County Community College has temporarily halted classes and closed its campus in the wake of a ransomware attack. The college is currently restoring databases, hard drives, servers, and other devices affected by the attack, with the help of a regional cybersecurity firm.

See the full report here: https://www.wpxi.com/news/local/butler-co-community-college-hit-with-ransomware-attack/YQAX3PU6V5FT7L4BZNDCLZXDRI/

Warzone fans urge devs to increase block list as hackers run riot - Dexerto

Rampant hacking has forced players of Call of Duty: Warzone to request an increase in the size of their blocked players list. Warzone players are only able to block and ignore around 200 accounts before their lists are filled up.

See the full report here: https://www.dexerto.com/call-of-duty/warzone-fans-urge-devs-to-increase-block-list-as-hackers-run-riot-1708758/

Gamers in the crosshairs as hackers play spoilsport - Livemint

As the Indian gaming market grows, cyberattacks on gamers have become rampant. As per a report by security firm NortonLifeLock, three in four gamers in India have experienced some form of a cyberattack on their gaming account and four in five gamers lost a little under INR 8,000 on average because of these attacks.

See the full report here: https://www.livemint.com/technology/tech-news/gamers-in-the-crosshairs-as-hackers-play-spoilsport-11638130891655.html

Wind turbine maker Vestas confirms recent security incident was ransomware

Vestas – the wind turbine manufacturer – confirmed that its recent "cyber security incident" was a ransomware attack that compromised data and affected inner systems. The company announced that almost all its IT systems are operational now. The attack didn't impact wind turbine operations, and manufacturing, construction, and services teams were unaffected.

See the full report here: https://www.theregister.com/2021/11/29/wind_turbine_maker_vestas_confirms/

APT37 targets journalists with Chinotto multi-platform malware - BleepingComputer

North Korean hacking group APT37 is using a malware – called Chinotto – capable of infecting Windows and Android devices. The malware lets the hackers control compromised devices, spy on their users via screenshots, deploy additional payloads, harvest data of interest, and upload it to attacker-controlled servers.

See the full report here: https://www.bleepingcomputer.com/news/security/apt37-targets-journalists-with-chinotto-multi-platform-malware/

Panasonic discloses data breach after network hack - BleepingComputer

Panasonic Corporation confirmed a security breach on its network on November 11, 2021. Unknown threat actors were able to gain access to servers on its network. The multinational conglomerate is currently investigating the scope and impact of the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/panasonic-discloses-data-breach-after-network-hack/

Stealthy WIRTE hackers target governments in the Middle East - BleepingComputer

A hacking group called WIRTE is attacking governments and high-profile public/private entities in the Middle East. The group has been conducting attacks since at least 2019, using malicious Excel 4.0 macros. The observed targets include diplomatic and financial institutions, government, law firms, military organizations, and technology companies.

See the full report here: https://www.bleepingcomputer.com/news/security/stealthy-wirte-hackers-target-governments-in-the-middle-east/

Zoom finally adds automatic updates to Windows, macOS clients - BleepingComputer

Zoom announced the release of an automatic update feature designed to streamline the update process for desktop clients. The new feature is currently available only for desktop Zoom clients on Windows and macOS, with the Linux platform not currently supported. New features and functionality but are also used to patch software bugs and other vulnerabilities that can be exploited by hackers to launch cyberattacks and infect your devices with malware.

See the full report here: https://www.bleepingcomputer.com/news/security/zoom-finally-adds-automatic-updates-to-windows-macos-clients/

Unpatched Windows Zero-Day Allows Privileged File Access

An unpatched Windows security vulnerability could allow for details disclosure and area privilege escalation (LPE), scientists have warned. The issue (CVE-2021-24084) has but to get an formal fix, generating it a zero-working day bug – but a micropatch has been rolled out as a quit-hole measure.

See the full report here: https://threatpost.com/unpatched-windows-zero-day-privileged-file-access/176609/

Dark web market Cannazon shuts down after massive DDoS attack - BleepingComputer

Cannazon, one of the largest dark web marketplaces shut down last week after suffering a debilitating distributed denial of service attack. As the admins explained in a message signed with the market's PGP key, they are officially retiring and claim not to be pulling an exit scam on their vendors.

See the full report here: https://www.bleepingcomputer.com/news/security/dark-web-market-cannazon-shuts-down-after-massive-ddos-attack/

Researchers Flag 300K Banking Trojan Infections from Google Play in 4 Months

Researchers from Threat Fabric reported that these threat groups have honed their ability to use Google Play to propagate banking trojans. Overcoming Google Play app restrictions, attackers have successfully racked up more than 300,000 banking trojan installations over just the past four months in the official Android app marketplace.

See the full report here: https://threatpost.com/banking-trojan-infections-google-play/176630/

Yanluowang Ransomware Tied to Thieflock Threat Actor

A threat actor previously tied to the Thieflock ransomware operation may now be using the emerging Yanluowang ransomware in a series of attacks against U.S. corporations. The novel ransomware has been used to target primarily financial companies, but also manufacturing, IT services, consultancy and engineering companies.

See the full report here: https://threatpost.com/yanluowang-ransomware-thieflock-threat-actor/176640/

FBI seized roughly $2.3 million in cryptocurrency tied to ransomware attacks - CNN

A recently unsealed court document confirmed that US law enforcement seized roughly $2.3 million in cryptocurrency tied to ransomware attacks committed by a Russian resident. The seized cryptocurrency wallet can be traced to attacks performed by the notorious ransomware gang, REvil.

See the full report here: https://www.cnn.com/2021/11/30/politics/cryptocurrency-seized-fbi-ransomeware-attacks/index.html

Ransomware attack exposed personal info of Hancock unit owners - Loop North News

A ransomware attack on a property management company in Chicago exposed personal information about unit owners and prospective unit owners at John Hancock Center. Cancelled checks, credit reports, and loan documents were exposed in the attack.

See the full report here: https://www.loopnorth.com/news/hancock1130.htm

8-year-old HP printer vulnerability affects 150 printer models - BleepingComputer

Security researchers have discovered several vulnerabilities affecting at least 150 multi-function (print, scan, fax) HP printers. For two of the most critical flaws, HP has released fixes in the form of firmware updates. One involves two exposed physical ports that grant full access to the device. The second one is a buffer overflow vulnerability on the font parser.

See the full report here: https://www.bleepingcomputer.com/news/security/8-year-old-hp-printer-vulnerability-affects-150-printer-models/

DNA testing firm discloses data breach affecting 2.1 million people - BleepingComputer

An Ohio-based DNA testing company – DNA Diagnostics Center (DDC) – has disclosed a hack that affected 2,102,436 people. The hackers accessed information including full names, credit and debit card numbers, CVV, and financial account numbers. No genetic testing data was exposed, as it is stored in a different system.

See the full report here: https://www.bleepingcomputer.com/news/security/dna-testing-firm-discloses-data-breach-affecting-21-million-people/

New EwDoor Botnet Targeting Unpatched AT&T Network Edge Devices

A newly discovered botnet is targetting appliances belonging to telecom service provider AT&T, by exploiting a four-year-old flaw (CVE-2017-6079). EwDoor, the botnet, is capable of staging distributed denial-of-service (DDoS) attacks and targeted unpatched Ribbon Communications EdgeMarc appliances. It can self-update, download files, obtain a reverse shell on the compromised machine, and execute arbitrary payloads.

See the full report here: https://thehackernews.com/2021/12/new-ewdoor-botnet-targeting-unpatched.html

Mozilla fixes critical bug in cross-platform cryptography library - BleepingComputer

Mozilla has addressed a critical memory-corruption vulnerability affecting its cross-platform Network Security Services (NSS) set of cryptography libraries. Tracked as CVE-2021-43527, it can lead to a heap-based buffer overflow in specific cases, potentially causing program crashes and arbitrary code execution. All versions released since October 2012 are vulnerable, but the flaw doesn't affect the Mozilla Firefox web browser.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-fixes-critical-bug-in-cross-platform-cryptography-library/

Malicious Android app steals Malaysian bank credentials, MFA codes - BleepingComputer

An Android app – pretending to be a housekeeping service – is being used to steal credentials from the customers of eight Malaysian banks. The app is advertised via social media to promote the malicious APK, "Cleaning Service Malaysia." Some red flags would be the disproportionately high privileges/permissions sought by the app and the low follower count (and account age) of the promoting accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-android-app-steals-malaysian-bank-credentials-mfa-codes/

Emotet now spreads via fake Adobe Windows App Installer packages - BleepingComputer

Emotet – the notorious malware infection – is now distributed through malicious Windows App Installer packages that pretend to be Adobe PDF software. The malicious package looks like a legitimate Adobe application, with a legitimate Adobe PDF icon, a valid certificate that marks it as a Trusted App, and fake publisher information. Once installed, it will deploy malware and potentially lead to ransomware attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/

Planned Parenthood LA discloses data breach after ransomware attack - BleepingComputer

Planned Parenthood Los Angeles (PPLA) has disclosed a data breach due to a ransomware attack in October 2021. The attack exposed the personal information of about 400,000 patients – including name, address, insurance information, date of birth, and clinical data. If patients receive any emails claiming to be from PPLA and asking for sensitive information, they should immediately contact Planned Parenthood to see if the emails are legitimate.

See the full report here: https://www.bleepingcomputer.com/news/security/planned-parenthood-la-discloses-data-breach-after-ransomware-attack/