Threat Intelligence Bulletin: 12/17/2021 - 12/22/2021

Breaking News: 2021-12-17 - 2021-12-22

Lenovo laptops vulnerable to bug allowing admin privileges - BleepingComputer

Lenovo laptops are vulnerable to a privilege elevation bug that allows attackers to execute commands with admin privileges. The flaws affect the ImControllerService component of all Lenovo System Interface Foundation versions below 1.1.20.3. All Windows users running older versions should upgrade to the latest available version.

See the full report here: https://www.bleepingcomputer.com/news/security/lenovo-laptops-vulnerable-to-bug-allowing-admin-privileges/

Gumtree classifieds site leaked personal info via the F12 key - BleepingComputer

Security researchers have discovered a potential data leak in the British classifieds site Gumtree.com, where personally identifiable data of advertisers could be accessed by simply pressing F12 on the keyboard. The leaked information includes the sellers' full names, email IDs, and locations.

See the full report here: https://www.bleepingcomputer.com/news/security/gumtree-classifieds-site-leaked-personal-info-via-the-f12-key/

‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems

The spyware dubbed “PseudoManuscrypt” is being used in a vast campaign targeting government organizations and industrial control systems (ICS). Fake pirated software installer archives are used to download the spyware onto targets' systems, which then provides the attackers with virtually full control of the infected system.

See the full report here: https://threatpost.com/pseudomanuscrypt-mass-spyware-campaign/177097/

‘Tropic Trooper’ Reemerges to Target Transportation Outfits

The attack group Earth Centaur, previously known as Tropic Trooper, is targeting transportation and government agencies. The group is attempting to breach sensitive transportation-related data like flight schedules and financial planning documents. It has also developed its own tool for cleaning up its tracks on the targeted computer.

See the full report here: https://threatpost.com/tropic-trooper-transportation/177106/

Phorpiex Botnet Variant Spread Across 96 Countries

Security researchers have observed a new variant of the Phorpiex botnet targeting cryptocurrency users and stealing funds through a technique called "cryptocurrency clipping." The threat has been seen in 96 countries, with most victims in Ethiopia, Nigeria, and India.

See the full report here: https://www.darkreading.com/attacks-breaches/phorpiex-botnet-variant-spread-across-96-countries

Google Calendar now lets you block invitation phishing attempts - BleepingComputer

Google has introduced a new feature to block unwanted calendar invitations, commonly used by threat actors in phishing and malicious campaigns, from being added to your Google Calendar. This was achieved by improving the "Automatically add invitations" setting.

See the full report here: https://www.bleepingcomputer.com/news/security/google-calendar-now-lets-you-block-invitation-phishing-attempts/

Facebook disrupts operations of seven surveillance-for-hire firms - BleepingComputer

Meta (formerly Facebook) on Friday said it has disabled seven 'surveillance-for-hire' entities, that targeted individuals including politicians, election officials, human rights activists, and celebrities in over 100 countries on behalf of their clients. The company has also alerted people targeted with their surveillance tools.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-disrupts-operations-of-seven-surveillance-for-hire-firms/

Rappler comes under cyberattack - INQUIRER.net

Rappler is a Philippine online news website based in Pasig, Metro Manila founded by Maria Ressa along with a group of fellow Filipino journalists. The news website was hit with a cyberattack (distributed denial of service (DDOS) attack) which disrupted the normal functioning of the website.

See the full report here: https://newsinfo.inquirer.net/1528653/rappler-comes-under-cyberattack

Coombe hospital: Ransomware cyberattack hits Coombe hospital, IT services locked down as precaution - Independent.ie

The Coombe Women & Infants University Hospital is a teaching hospital providing a range of medical services to both women and newborn infants in Dublin, Ireland. The hospital has confirmed that it has been the subject of a ransomware cyberattack. On a precautionary basis, the hospital was isolated and the IT services were locked down. The hospital is working with the HSE to resolve the issue.

See the full report here: https://www.independent.ie/news/ransomware-cyberattack-hits-coombe-hospital-it-services-locked-down-as-precaution-41156106.html

VERA Files overcomes cyberattack - Vera Files

VERA Files detected a distributed denial-of-service attack (DDoS) attack on its server at 5:47 a.m., Philippine time, on Dec. 16 (9:47 p.m., Dec. 15 GMT). A DDoS attack is an attempt to overwhelm a website through repeated automated requests for data from multiple sources. The VERA Files site is back even as the attack has not completely stopped.

See the full report here: https://verafiles.org/articles/vera-files-overcomes-cyberattack

Conti ransomware uses Log4j bug to hack VMware vCenter servers - BleepingComputer

Conti ransomware operation is using the critical Log4Shell exploit to gain rapid access to internal VMware vCenter Server instances and encrypt virtual machines. The vulnerability is tracked as CVE-2021-44228 and an exploit code has emerged in the public space on December 9. Many vendors have been affected by Log4Shell and rushed to patch their products or provide workarounds and mitigations for customers. VMware is one of them, listing 40 vulnerable products. While the company provided mitigations or fixes, a patch for vCenter versions impacted has yet to become available.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-uses-log4j-bug-to-hack-vmware-vcenter-servers/

Logistics giant warns of BEC emails following ransomware attack - BleepingComputer

Hellmann Worldwide is warning customers of an increase in fraudulent calls and emails regarding payment transfer and bank account changes after a recent ransomware attack. The attack took place on December 9 and forced the logistics company to shut down its systems to contain the spread of the virus. The actors had exfiltrated sensitive files from the accessed servers to be used as a pressure lever in the ransom payment negotiation stage. The data breach is still under investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/logistics-giant-warns-of-bec-emails-following-ransomware-attack/

TinyNuke Banking Malware Targets French Organizations

The TinyNuke, a banking malware is now back after dropped in 2019 and aims their attack on French users working in manufacturing, technology, construction, and business services to steal credentials and other private information and deliver additional payloads. In most of the recent campaigns the actor has stayed consistent with using URLs to ZIP files and the continued use of Tor for C2 communications. The malware can be used for data and financial theft, and compromised machines may be added to a botnet under the control of the threat actor.

See the full report here: https://securityaffairs.co/wordpress/125604/malware/tinynuke-malware-re-emerged.html

New Android Joker App Tricks 500000 Users, Steals Money! Uninstall Now - iTech Post

A new Android Joker app, named Color Message, deceived 500,000 Android users. Joker, a trojan infection, usually attached to Google Play Store apps to make it appear legitimate and effects Android users. Joker was recently discovered hidden in an app that was downloaded 500,000 times. Joker is classified as fleeceware since its primary function is to imitate clicks and intercept SMS messages to manipulate users into subscribing to unwanted paid premium services.The program could disguise its icon once installed, making it difficult to delete. Since it poses a threat to several Android users, Color Message has been removed from Google Play Store and people who have downloaded it should delete it right now.

See the full report here: https://www.itechpost.com/articles/108340/20211217/new-android-joker-app-tricks-500-000-users-steals-money.htm

Facebook locks out 1,500 fake accounts used by cyber-spy firms to snoop on people, alerts 50k potential targets

Facebook successor Meta has cancelled 1,500 social media accounts used by seven surveillance-for-hire firms to conduct online attacks against government critics and members of civil society. These accounts were primarily used to observe targets and lure them into visiting malicious websites, or receiving booby-trapped messages, typically, that compromise their devices and online profiles.The global surveillance-for-hire industry targets people to collect intelligence, manipulate and compromise their devices and accounts across the internet.

See the full report here: https://www.theregister.com/2021/12/17/cyber_spying_firms_facebook_meta/

Hacker group claims to have stolen user data from Israeli hiking websites - The Times of Israel

An unknown hacker group Sharp Boys claimed to have stolen the personal data of 3 million users from a pair of Israeli hiking companies namely Lametayel, a chain of stores that sells outdoor equipment, and the Tiuli hiking website. Security researchers linked Sharp Boys with Black Shadow threat group as its methods were similar to this group which is reported Iran-linked hackers who use cyber attacks for criminal ends.

See the full report here: https://www.timesofisrael.com/hacker-group-claims-to-have-stolen-user-data-from-israeli-hiking-websites/

Credit card info of 1.8 million people stolen from sports gear sites - BleepingComputer

The cyberattack on our four affiliated online sports gear sites resulted in the disclosure of financial data of 1,813,224 customers. A law firm investigating the attack confirms the data theft. The company sent notices to the affected individuals on December 16th, 2021 but has not offered an identity protection service this time.

See the full report here: https://www.bleepingcomputer.com/news/security/credit-card-info-of-18-million-people-stolen-from-sports-gear-sites/

Citizen Lab Exposes Cytrox as Vendor Behind 'Predator' iPhone Spyware

In a joint report by Citizen Lab along with Meta company exposed Cytrox that is responsible for a piece of iPhone eavesdropping malware that was planted on phones belonging to two notable Egyptians. The malware, called Predator, was able to infect the then-latest iOS version (14.6) using single-click links sent via WhatsApp. Targets of Cytrox and its customers included politicians and journalists around the world, including in Egypt and Armenia.

See the full report here: https://www.securityweek.com/citizen-lab-exposes-cytrox-vendor-behind-predator-iphone-spyware

Bad things come in threes: Apache reveals another Log4J bug

The Apache Software Foundation (ASF) has revealed a third bug in its Log4 Java-based open-source logging library Log4j. In certain scenarios, the bug (CVE-2021-45105) can lead to an infinite recursion and a DoS condition on the server. Users need to download the latest version (2.17.0) of Log4J tp patch the flaw.

See the full report here: https://www.theregister.com/2021/12/19/log4j_new_flaw_cve_2021_45105/

Hacker steals Sydney man's life savings after simjacking - 9News

An Australian man lost around $35,000 after a simswapping attack. The hacker siphoned off the money to a cryptocurrency exchange called CoinJar, and then converted it into Bitcoin. The victim has managed to recover most of his lost $35,000 from his banks.

See the full report here: https://www.9news.com.au/national/optus-sim-swap-hack-robs-sydney-man-of-life-savings/4e1dcac8-a6e7-4030-a4a0-b18c87bbb019

Russian hackers post police data online after raid - The Times

A Russian-based group of hackers, known as Clop, demanded a ransom from the company, based in Bathgate, West Lothian, after accessing its confidential information. When the company refused to pay, the group uploaded hundreds of files to a hidden area of the internet accessible only through a specialized web browser.

See the full report here: https://www.thetimes.co.uk/article/russian-hackers-post-police-data-online-after-raid-z80vdzmg8

PKK hackers admit they obtained data from public institutions | Daily Sabah - Daily Sabah

PKK hackers admit that they obtained data from the websites of public institutions and organizations. The group also shared information through the social media website ANF to make PKK propaganda.

See the full report here: https://www.dailysabah.com/politics/war-on-terror/pkk-hackers-admit-they-obtained-data-from-public-institutions

Pro Wrestling Tees Owner Confirms Data Breach, Provides Details In Press Release - Wrestling Headlines

Pro Wrestling Tees is a website and store for professional wrestlers to sell their merchandise and is the largest website of its kind. The firm has alerted its customers that the store suffered a security breach back in November, which saw a small portion of credit card numbers kept compromised due to a malware virus.

See the full report here: https://wrestlingheadlines.com/pro-wrestling-tees-owner-confirms-data-breach-provides-details-in-press-release/

Phishing attacks impersonate Pfizer in fake requests for quotation - BleepingComputer

Scammers are impersonating the pharmaceutical company Pfizer in an elaborate phishing campaign. The phishing emails have subject lines typically involving urgent quotations, invitations to bid, and industrial equipment supply-related topics. The receipients are then asked to send their quotes to impersonated domain addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-attacks-impersonate-pfizer-in-fake-requests-for-quotation/

Experts Discover Backdoor Deployed on the U.S. Federal Agency's Network

A U.S. agency was reportedly targeted by a backdoor attack, in a potential APT-type operation. An Avast report states that the attack could have given total visibility of the network and complete control of a system. Avast claimed that it made its findings public after unsuccessful attempts to directly notify the agency.

See the full report here: https://thehackernews.com/2021/12/experts-discover-backdoor-deployed-on.html

New Mobile Network Vulnerabilities Affect All Cellular Generations Since 2G

Researchers have identified vulnerabilities in mobile networks which could be used to launch denial-of-service (DoS) and man-in-the-middle (MitM) attacks. The flaws have been observed in handover, a fundamental mechanism in modern cellular networks. The problem reportedly affects all generations since 2G (GSM), and remains unsolved so far.

See the full report here: https://thehackernews.com/2021/12/new-mobile-network-vulnerabilities.html

Lights Out: Cyberattacks Shut Down Building Automation Systems

The firm, located in Germany, discovered that it suddenly lost contact with hundreds of its building automation system (BAS) devices — light switches, motion detectors, shutter controllers, and others — after a rare cyberattack locked the company out of the BAS it had constructed for an office building client. There are no clues so far to trace back to the attackers.

See the full report here: https://www.darkreading.com/attacks-breaches/lights-out-cyberattacks-shut-down-building-automation-systems

Log4j vulnerability now used to install Dridex banking malware - BleepingComputer

The Dridex malware is a banking trojan initially developed to steal online banking credentials from victims. Nonetheless, over time, the malware has developed to be a loader that downloads numerous modules that can be utilized to carry out completely different malicious habits, similar to putting in extra payloads, spreading to different gadgets, taking screenshots, and extra. Risk actors now exploit the vital Apache Log4j vulnerability named Log4Shell to contaminate weak gadgets with the infamous Dridex banking trojan or Meterpreter.

See the full report here: https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/

Meta sues people behind Facebook and Instagram phishing - BleepingComputer

Meta, formerly known as Facebook, said Monday it's suing people who are behind a phishing scheme to steal usernames and passwords from its platforms. The lawsuit, filed in a federal court in Northern California, says that since 2019 more than 39,000 websites have been created that impersonated the login pages for Facebook, Instagram, Messenger, and WhatsApp.

See the full report here: https://www.bleepingcomputer.com/news/security/meta-sues-people-behind-facebook-and-instagram-phishing/

Microsoft warns of easy Windows domain takeover via Active Directory bugs - BleepingComputer

Microsoft has released security updates to address the two security vulnerabilities tracked as CVE-2021-42287 and CVE-2021-42278. Microsoft explains in an advisory published today that when combining these two vulnerabilities, an attacker can create a straight path to a Domain Admin user in an Active Directory environment that hasn’t applied these new updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-easy-windows-domain-takeover-via-active-directory-bugs/

Secret Backdoors Found in German-made Auerswald VoIP System

Researchers have discovered two secrets, undocumented backdoor login accounts for a widely used VoIP (voice over Internet Protocol ) system made by Auerswald. RedTeam Pentesting said it uncovered the backdoor after it began to take a closer look into a service Auerswald provides in the event a customer were to lose access to their administrator account, in which case the password associated with a privileged account can be reset by reaching out to the manufacturer.

See the full report here: https://thehackernews.com/2021/12/secret-backdoors-found-in-german-made.html

TellYouThePass ransomware revived in Linux, Windows Log4j attacks - BleepingComputer

Threat actors have revived an old and relatively inactive ransomware family known as TellYouThePass, deploying it in attacks against Windows and Linux devices targeting a critical remote code execution bug in the Apache Log4j library.

See the full report here: https://www.bleepingcomputer.com/news/security/tellyouthepass-ransomware-revived-in-linux-windows-log4j-attacks/

Belgian defence ministry admits attackers accessed its computer network by exploiting Log4j vulnerability

Belgium's Ministry of Defense was recently hacked by attackers exploiting the massive vulnerability in Apache logging library log4j that has become a worldwide security concern, according to multiple reports.

See the full report here: https://www.theregister.com/2021/12/21/belgium_defence_ministry_log4j_exploited/

Garrett walk-through metal detectors can be remotely manipulated - BleepingComputer

Security researchers have discovered numerous vulnerabilities in walk-through metal detectors made by Garret, the U.S.-based manufacturer. These allow attackers to execute commands or read/modify information on the Garret iC Module version 5.0. Admins of walk-through Garrett metal detectors should upgrade their iC Module CMA software to the latest available version.

See the full report here: https://www.bleepingcomputer.com/news/security/garrett-walk-through-metal-detectors-can-be-remotely-manipulated/

$8.2M Lost as Visor Finance Suffers Latest DeFi Hack - Crypto Briefing

An Ethereum-based DeFi (decentralized finance) project, called Visor Finance, lost funds valued at $8.2 million after an attack. Hackers stole the VISR tokens today after exploiting a reentrancy bug. The Visor team has announced that it will arrange a migration date based on a snapshot taken before the hack, allowing users to redeem their funds.

See the full report here: https://cryptobriefing.com/8-2m-lost-visor-finance-suffers-latest-defi-hack/

Hackers Nab $150K From Twitch Founder's NFT Project - TheStreet

Hackers stole funds worth over $150,000 (in the form of the cryptocurrency SOL) after hijacking a Discord bot for the NFT distribution project by Twitch co-founder Justin Kan. The bot was used to send fake URLs, inviting people to send funds to "mint" (create) and receive NFTs (non-fungible tokens). The team has announced that it will reimburse all victims of the attack.

See the full report here: https://www.thestreet.com/technology/hackers-nab-150k-from-twitch-founders-nft-project