Threat Intelligence Bulletin: 12/03/2021 - 12/09/2021

Phishing Ecosystem Series: Using and Monetizing Victim Data

For non-targeted phishing attacks, threat actors try to increase the impact of their campaign using the various TTPs and technologies covered within the previous advisories in this series. The main aim for any threat actor operating a phishing campaign is to ensure the maximum number of victims enter their sensitive data into their phishing pages. Once this information or “victim data” has been collected, the threat actor must then monetize this information, which can be achieved in multiple ways.

From simply using the data directly to make fraudulent purchases or cashing out accounts, to selling pre-packaged collections of data to others- there are many methods of seeing fiscal returns from phishing attacks, and defrauding companies and victims.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Avoid opening unsolicited attachments and never click suspicious links
• Do not share passwords, and do not reuse the same password on different websites and applications.
• If you are alerted or suspect a compromised account, change the password immediately.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Details

Monetization will take different forms depending on the capabilities of the threat actor operating the phishing campaign, but is done swiftly. Victim data will quickly age out, as the likelihood increases over time that the victim will realize they have fallen for a phishing attack and update their credentials, freeze financial accounts, or replace credit cards.

In order to facilitate these transactions and buying and selling victim data, threat actors will join discussions across multiple dark web and covert channels. Many forums and marketplaces exist dedicated to selling victim data, from chat rooms or forum threads to search engines specifically designed to aid threat actors in locating credentials or accounts derived from phishing attacks.

Figure 1: Online search engine for finding stores, markets and covert channels selling access or credentials for specific platforms
Source: ZeroFox Threat Research

It is not uncommon to find legitimate commerce platforms– designed for small businesses to easily set up online stores– being abused in order to sell compromised accounts and victim data. These stores offer quick and easy access to victim data, with transactions being processed directly from within the platform under their own refund and payment protection policies. Many of these store fronts also support leaving reviews of sellers, allowing threat actors purchasing data to quickly see if a seller is potentially scamming others and either providing invalid credentials, none at all, or legitimate data.

Figure 2: Feedback section of online storefront allegedly selling compromised account details
Source: ZeroFox Threat Research

Another popular vector for buying and selling victim data is within encrypted messaging apps such as Telegram. Within these covert channels, data being sold is often referred to as “fullz” or “dumps,” a slang term meaning the package being sold contains complete credential and/or credit card information from a victim. Even packages which are no longer valid still fetch a price within these markets. This data is referred to as “dead fullz”, meaning it’s no longer “live”. These packages are commonly used by threat actors to commit identity theft, refund fraud, card cloning, credit fraud, opening mule accounts and many other forms of scams and fraud.

“Fullz” are sold either in bulk for a set cost, or on a per-account basis with varying cost based on the value or assets of the compromised account. This is standard for accounts with direct access to monetary funds such as banks. Alternatively some buyers and sellers offer instead to “cash out”, or withdraw funds from the account, in exchange for taking a percentage of the total amount obtained. This can range between 20-50% of the total amount “cashed out”.

Figure 3: Access to a compromised bank account being sold via Telegram bot (left), conversation between buyer/seller of cloned credit cards (right)
Source: ZeroFox Threat Research

More advanced threat actors take advantage of messaging app platforms capabilities, using publicly available APIs and automation frameworks to create closed access, fully automated channels to sell victim data. Many of these advanced channels integrate third-party services, in order to create unique accounts and crypto wallet addresses for each visitor, where they can top up with credits and use them to purchase victim data.

Figure 4: Telegram bot shop menu (left), dynamically generated cryptocurrency wallet address details to use within the store (right)
Source: ZeroFox Threat Research

Buying and selling account details for highstreet restaurant, grocery and food/drink delivery services has proved to be increasingly popular, with a large interest in this form of PII package growing during the pandemic. These packages are sold to be used in conjunction with what are referred to as “methods”- guides which the threat actor should follow in order to successfully perform fraudulent activities with the provided information. These guides will contain step by step instructions on how they take the stolen information, perform a fraudulent transaction, and then cover their tracks or bypass security controls and processes in order to avoid suspicion and subsequent investigation.

Many food delivery apps are targeted with this type of fraud. Threat actors can use the package and methods in order to place large orders for food, or purchase gift cards to redeem on another account. This effectively allows threat actors to convert a £5-£10 GBP “fullz” package to up to £100 GBP worth of consumable goods.

Figure 5: A screenshot shared within a covert channel dedicated to selling victim data, showing a successful transaction redeeming a gift card obtained by fraudulent means.
Source: ZeroFox Threat Research

Financial transactions between buyers and sellers of victim data can take place through the use of multiple platforms. Popular online payment systems and apps designed to transfer cash quickly are often used, alongside cryptocurrency platforms. Many marketplaces and commerce platforms abused for these types of transactions directly integrate with these payment platforms to automate transactions, allowing threat actors to simply list their information and send victim data to purchasers after the transaction has completed.

Conclusion

As almost all new businesses today have some form of online presence or interface with its customers, the potential targets for phishing and fraud will continue to increase. Businesses internal processes and checks are still vulnerable to social engineering or clever manipulation to take advantage and exploit potential weaknesses. ZeroFox assesses with a high likelihood that this will continue, however, by understanding the TTPs associated with this type of fraud, businesses can ensure their processes and procedures are robust enough to prevent this type of activity.

Breaking News: 2021-12-03 - 2021-12-09

Researchers discover 14 new data-stealing web browser attacks - BleepingComputer

IT security researchers from Ruhr-Universität Bochum (RUB) and the Niederrhein University of Applied Sciences have discovered 14 new types of 'XS-Leak' cross-site leak attacks against modern web browsers, including Google Chrome, Microsoft Edge, Safari, and Mozilla Firefox. These types of side-channel attacks are called 'XS-Leaks,' and allow attacks to bypass the 'same-origin' policy in web browsers so that a malicious website can steal info in the background from a trusted website where the user enters information. The web browser development teams have been informed and are now fixing the issues.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-discover-14-new-data-stealing-web-browser-attacks/

Omicron Phishing Scam Already Spotted in UK

The Omicron COVID-19 variant anxiety has inspired new phishing scam that offers fake NHS tests to steal data. The threat actors are contacting people across the U.K. using text messages, email or phone calls to distribute the fake test kits specifically designed to detect the Omicron variant. These pandemic-related phishing campaigns mostly rely on the victim’s anxiety to cause them overlook obvious signs of fraud.

See the full report here: https://threatpost.com/omicron-phishing-scam-uk/176771/

FBI: Cuba ransomware group hit 49 critical infrastructure organizations - ZDNet

The Cuba ransomware, reported by FBI for the group has attacked 49 entities covering financial, government, healthcare, manufacturing, and information technology sectors through using the Hancitor and MimiKatz malware to gain entry to Windows systems and made at least $43.9 million in ransom payments. Hancitor malware actors uses several ways to gain initial access to a victim's network further ransomware installs and executes a CobaltStrike beacon. The group typically targets companies in the US, South America and Europe.

See the full report here: https://www.zdnet.com/article/fbi-cuba-ransomware-hit-49-critical-infrastructure-organizations/

Hospital Ransomware Attacks Mitigated by Downtime System From Taylor Healthcare - Business Wire

Taylor Healthcare enhanced its proprietary DowntimeDoc™ technology solution to help combat the rising incidence of hospital ransomware attacks. DowntimeDoc is a software system to maintain normal operations during network outages. This software resides within individual computer workstations throughout a hospital. In the event of a ransomware attack cause server access lost, hospitals are able to use DowntimeDoc to access and print the critical documents needed to sustain operations. DowntimeDoc helps healthcare systems maintain the quality of patient care in those times of crisis.

See the full report here: https://www.businesswire.com/news/home/20211202005116/en/Hospital-Ransomware-Attacks-Mitigated-by-Downtime-System-From-Taylor-Healthcare

Warning: Yet Another Zoho ManageEngine Product Found Under Active Attacks

Zoho warned that a newly patched critical flaw in its Desktop Central and Desktop Central MSP is being actively exploited by malicious actors. The flaw tracked as CVE-2021-44515, is an authentication bypass vulnerability that circumvent authentication protections and execute arbitrary code in the Desktop Central MSP server. Through exploitation, the attackers can gain unauthorized access to the product by sending a specially crafted request leading to remote code execution. Zoho strongly advise customers to update their installations to the latest build as soon as possible.

See the full report here: https://thehackernews.com/2021/12/warning-yet-another-zoho-manageengine.html

Pegasus Spyware Reportedly Hacked iPhones of U.S. State Department and Diplomats

According to open-source reports, several U.S. Embassy and State Department employees have been notified by the Apple company that their iPhones may have been targeted by an unknown attacker using state-sponsored spyware, Pegasus, created by the controversial NSO Group, an Israeli company. In response to the reports, the NSO Group said it will investigate the matter and take legal action, if necessary, against customers for using its tools illegally.

See the full report here: https://thehackernews.com/2021/12/pegasus-spyware-reportedly-hacked.html

Microsoft reverses Windows 11's annoying default browser setting changes

With the release of the Windows 11 Insider build 22509, Microsoft has reversed its decision that required users to specifically choose their default programs. This restriction was implemented after realizing that adware and other unwanted programs began hijacking default program settings without permission. Now, the decision is being reversed and again a 'Set default' button will allow users to configure their default web browser quickly.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-reverses-windows-11s-annoying-default-browser-setting-changes/

Microsoft Exchange servers hacked to deploy BlackByte ransomware - BleepingComputer

The BlackByte ransomware gang is actively breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities. The BlackByte ransomware executable handles both privilege escalation and the ability to worm or perform the lateral movement, within the compromised environment. The ProxyShell vulnerabilities were fixed by security updates released in April and May 2021. It is recommended to apply the security updates.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/

Pakistan Embassy Serbia’s Twitter ‘hacked from Karachi’ - Samaa News

The Twitter handle of the Pakistan Embassy in Serbia was hacked and posted a tweet that claimed to be the non-payment of the embassy staff’s salaries and read that the inflation in the country has broken all previous records. This tweet has been deleted after the Pakistan embassy in Serbia regained control of its Twitter handle.

See the full report here: https://www.samaa.tv/news/2021/12/pakistan-embassy-serbias-twitter-goes-rogues-tweets-against-govt/

Pak Hackers Targeting Indian, Afghan Government, Military Officials: Report - NDTV

A report by a security website the hackernews has revealed that Pakistani hackers are targeting government and military officials based in Afghanistan and India to steal sensitive Google, Twitter, and Facebook credentials. The APT group known as SideCopy is using lures like archive files embedded in LNK, Microsoft Publisher, or Trojanized Applications.

See the full report here: https://www.ndtv.com/india-news/pakistani-hackers-targeting-indian-afghan-government-military-officials-report-2637197

New Twitter phishing campaign targets verified accounts - BleepingComputer

A new phishing campaign is targeting verified Twitter accounts, that is, accounts with a blue badge and checkmark. The phishing email urges users to "update" their details to retain their verified status. The email links to compromised websites that collect the users' secret credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/new-twitter-phishing-campaign-targets-verified-accounts/

Convincing Microsoft phishing uses fake Office 365 spam alerts - BleepingComputer

A phishing campaign is using fake Office 365 notifications to steal Microsoft credentials. The phishing email uses the official Office 365 logo and links to Microsoft's privacy statement and acceptable use policy to seem legitimate. It asks users to "review" blocked spam messages, but leads to a phishing landing site.

See the full report here: https://www.bleepingcomputer.com/news/security/convincing-microsoft-phishing-uses-fake-office-365-spam-alerts/

Malicious Excel XLL add-ins push RedLine password-stealing malware - BleepingComputer

Cybercriminals are distributing malicious Excel XLL files (via online forums and contact forms) to propagate the RedLine malware. RedLine is an information-stealing Trojan that steals personal and financial credentials and executes malicious commands. Users should delete such emails and report them, if they receive any.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-excel-xll-add-ins-push-redline-password-stealing-malware/

Hackers take $196 million from crypto exchange Bitmart, security firm says - CNBC

Hackers have stolen $196 million from crypto trading platform Bitmart, a security firm PeckShield Inc. said on Twitter on December 3, raising the issue of crypto frauds once again even as Bitcoin (BTC) recovered to $49,000 in the last 24 hours on December 6, after last week’s fall.

See the full report here: https://www.cnbc.com/2021/12/05/hackers-take-196-million-from-crypto-exchange-bitmart-in-large-breach.html

US military's hacking unit publicly acknowledges taking offensive action to disrupt ransomware operations - CNN

Cyber Command, the US military's hacking unit, has taken offensive action to disrupt cybercriminal groups that have launched ransomware attacks on US companies, a spokesperson for the command confirmed to CNN Sunday. The spokesperson declined to specify what actions the command had taken.

See the full report here: https://www.cnn.com/2021/12/05/politics/us-cyber-command-disrupt-ransomware-operations/index.html

Ransomware attack hits French-Public School Board - Cornwall Seaway News

Ransomware attack hits French-Public School Board, employee and student data stolen. The board issued a press release and said that it had paid the attackers and the data that had been stolen was deleted. The board is also providing those with compromised data free credit monitoring services for 24 months.

See the full report here: https://www.cornwallseawaynews.com/2021/12/04/ransomware-attack-hits-french-public-school-board/

Russian hacking group uses new stealthy Ceeloader malware - BleepingComputer

The hacking group Nobelium is using a new custom "Ceeloader" malware as it continues to breach government and enterprise networks. The malware is heavily obfuscated, and mixes calls to the Windows API with large blocks of junk code to evade detection. It supports the execution of shellcode payloads directly in memory.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hacking-group-uses-new-stealthy-ceeloader-malware/

Malicious KMSPico Windows Activator Stealing Users' Cryptocurrency Wallets

A malware dubbed "CryptBot" is targeting users trying to activate pirated copies of Windows. The malware masquerades as KMSPico, a tool used to illegally activate full features of pirated software. It can then steal information such as browser credentials, cryptocurrency wallets, credit cards information, and more.

See the full report here: https://thehackernews.com/2021/12/malicious-kmspico-windows-activator.html

Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies

Security researchers reported that several companies have exposed sensitive information to the public internet, via misconfigured Kafdrop instances. Kafdrop is a management interface for Apache Kafka, used for managing data streams. Kafdrop should be redeployed behind an app server, with an active and configured authentication module.

See the full report here: https://threatpost.com/apache-kafka-cloud-clusters-expose-data/176778/

Hundreds of SPAR stores shut down, switch to cash after cyberattack - BleepingComputer

Over 300 SPAR shops in England are facing severe operational problems following a cyberattack. It has forced many stores to close or switch to cash-only payments. The attack reportedly carries signs of a ransomware attack that has locked down crucial IT systems.

See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-spar-stores-shut-down-switch-to-cash-after-cyberattack/

France warns of Nobelium cyberspies attacking French orgs - BleepingComputer

The Agence nationale de la sécurité des systèmes d'information (ANSSI) is a French service created on 7 July 2009 with responsibility for computer security. ANSSI reported that the Russian-backed Nobelium hacking group has been targeting French organizations since February 2021. It is unclear how Nobelium compromised email accounts belonging to French organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/france-warns-of-nobelium-cyberspies-attacking-french-orgs/

LINE Pay leaks around 133,000 users' data to GitHub, of all places

Line Pay is a payment service that allows you to make purchases from Line Pay Merchants. The firm has announced that around 133,000 users' payment details were mistakenly published on GitHub between September and November of this year. Among the leaked details were the date, time, and amount of transactions, plus user and franchise store identification numbers.

See the full report here: https://www.theregister.com/2021/12/07/line_pay_leaks_around_133000/

Hackers pretending to be Iranian govt use SMS messages to steal credit card info, create botnet - ZDNet

Security company Check Point Research has highlighted a hacking campaign that involves cyberattackers impersonating Iranian government bodies. The threat actors tend to aim at the mobile devices which are infected through SMS messages. The victims are brought to an urge to download the Android applications related to official Iranian services which allow hackers to access the victim's personal messages.

See the full report here: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/

Microsoft Seizes 42 Websites From a Chinese Hacking Group - The New York Times

Microsoft has seized 42 U.S.-based websites from a Chinese hacking group to disrupt the group’s intelligence-gathering operations. These websites were operated by a hacker group known as Nickel or APT15. A federal court in Virginia reportedly granted Microsoft’s request to take over the websites.

See the full report here: https://www.nytimes.com/2021/12/06/business/microsoft-china-hackers.html

Cyberattack Hits Maryland Department of Health; Government Agencies Increasingly Targets of Hackers - CBS Baltimore

Maryland Department of Health has been hit by a cyberattack due to which the Covid-19 infection metrics on its website have not been updated in days with a warning message. Some pages have been redirected to the main state government web page while servers are offline. People are having trouble getting key Medicaid information because of the hack.

See the full report here: https://baltimore.cbslocal.com/2021/12/06/cyberattack-hits-maryland-department-of-health-government-agencies-increasingly-targets-of-hackers/

Nordic Choice Hotels hit by Conti ransomware, no ransom demand yet - BleepingComputer

A ransomware attack from the Conti group has impacted the guest reservation and room key card systems at Nordic Choice Hotels. Nordic Choice Club members, as well as current hotel guests, fall in the scope of the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/nordic-choice-hotels-hit-by-conti-ransomware-no-ransom-demand-yet/

QNAP warns users of bitcoin miner targeting their NAS devices - BleepingComputer

QNAP has warned customers of attacks on their NAS (network-attached storage) devices with cryptomining malware. The cryptominer will mine for bitcoin on the compromised systems, using up to 50% of CPU resources. Restarting the devices, changing passwords, and following other security best practices can secure the devices.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-users-of-bitcoin-miner-targeting-their-nas-devices/

STOP Ransomware vaccine released to block encryption - BleepingComputer

German security company G DATA has released a tool that will block STOP Ransomware from encrypting victims' files after infection. Instead of a personal ID, the ransom notes will contain a string that files were protected by the vaccine.

See the full report here: https://www.bleepingcomputer.com/news/security/stop-ransomware-vaccine-released-to-block-encryption/

27 flaws in USB over network SDK affect millions of cloud users - BleepingComputer

Security researchers have discovered 27 vulnerabilities in Eltima SDK, a library used by cloud providers to remotely mount a local USB device. These vulnerabilities reportedly allow attackers to escalate privileges, leading to potential disabling of security products and system overwrite. Installing the released patches is essential to guard against such vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/27-flaws-in-usb-over-network-sdk-affect-millions-of-cloud-users/

New Cerber ransomware targets Confluence and GitLab servers - BleepingComputer

Cerber ransomware is a type of malware (malicious software) that encrypts files and then holds them hostage, demanding a ransom payment in exchange. It targets Atlassian Confluence and GitLab servers using remote code execution vulnerabilities and creates ransom notes named $$RECOVERY_README$$.html and appends the .locked extension to encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cerber-ransomware-targets-confluence-and-gitlab-servers/

Windows 10 Drive-By RCE Triggered by Default URI Handler

Researchers have discovered a drive-by remote code execution (RCE) bug in Windows 10 via Internet Explorer 11/Edge Legacy – the EdgeHTML-based browser that’s currently the default browser on Windows 10 PCs – and Microsoft Teams. The vulnerability is triggered by an argument injection, which is a type of attack that involves tampering with a page’s input parameters.

See the full report here: https://threatpost.com/windows-10-rce-url-handler/176830/

Google Disrupts Botnet Targeting Windows Machines

On Tuesday, Google disclosed it recently disrupted a massive network of computers infected by Glupteba. The company estimates the malware has infected approximately one million Windows PCs globally, which would make it one of the largest known botnets to date. A botnet is a network of computers or internet-connected devices all infected by malware that is under the control of a single party.

See the full report here: https://www.darkreading.com/threat-intelligence/google-disrupts-botnet-targeting-windows-machines

Grafana fixes zero-day vulnerability after exploits spread over Twitter - BleepingComputer

Grafana Labs has rolled out updates for affected versions 8.0.0-beta1 through 8.3.0 to fix a high-severity, zero-day vulnerability that enabled remote access to local files. Grafana Labs published a blog post today explaining that the problem was with the URL for installed plug-ins, which was vulnerable to path traversal attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/grafana-fixes-zero-day-vulnerability-after-exploits-spread-over-twitter/

SonicWall ‘strongly urges’ customers to patch critical SMA 100 bugs - BleepingComputer

SonicWall has advised organizations using SMA 100 series appliances to immediately install patches for multiple security flaws. These flaws have CVSS scores ranging from medium to critical. SonicWall reportedly hasn't found any evidence of these vulnerabilities being exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-strongly-urges-customers-to-patch-critical-sma-100-bugs/

Tor’s main site blocked in Russia as censorship widens - BleepingComputer

The Tor Project's main website, torproject.org, is actively blocked by Russia's largest internet service providers. Tor is commonly used for online anonymity and to bypass censorship. This blocking occurred simultaneously with the recent banning of several VPN services in Russia.

See the full report here: https://www.bleepingcomputer.com/news/security/tor-s-main-site-blocked-in-russia-as-censorship-widens/

Trickbot-Infected Machines Drop Emotet Samples

Researchers at Check Point Research have observed that the Trickbot botnet has been spreading samples of Emotet. The reaserchers also added that it has spotted more than 140,000 victims affected by Trickbot worldwide since global efforts aimed to take down the botnet in October 2020. Emotet, another prolific threat, was taken down in January 2021 due to a join operation of law enforcement agencies around the world.

See the full report here: https://www.darkreading.com/threat-intelligence/trickbot-infected-machines-drop-emotet-samples

Hackers infect random WordPress plugins to steal credit cards - BleepingComputer

Bank card swipers are being injected into random plugins of e-commerce WordPress websites, hiding from detection whereas stealing buyer fee particulars. The most recent pattern is injecting card skimmers into WordPress plugin recordsdata, avoiding the closely-monitored ‘wp-admin’ and ‘wp-includes’ core directories the place most injections are short-lived.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-infect-random-wordpress-plugins-to-steal-credit-cards/

Malicious npm Code Packages Built for Hijacking Discord Servers

Malicious packages in the Node.js package manager (npm) code repository are trying to harvest Discord tokens, which can be used to take over users’ accounts and servers. The payloads vary from infostealers up to remote-access backdoors.

See the full report here: https://threatpost.com/malicious-npm-code-packages-discord/176886/