Threat Intelligence Bulletin: 12/23/2021 - 12/29/2021

Breaking News: 2021-12-23 - 2021-12-29

Attackers bypass Microsoft patch to deliver Formbook malware

Researchers at Sophos Labs have detected a novel exploit that can bypass a patch for a vulnerability (CVE-2021-40444) affecting the MS Office file format. The attackers took a publicly available proof-of-concept Office exploit and used it to deliver Formbook malware.

See the full report here: https://www.helpnetsecurity.com/2021/12/22/cve-2021-40444-patch-bypass/

All in One SEO Plugin Bug Threatens 3M Websites with Takeovers

A WordPress plugin bug was discovered in the Hashthemes Demo Importer offering, which allowed users with simple subscriber permissions to wipe sites of all content. The plugin can send commands to various REST API endpoints, and it performs a permissions check to make sure no one's doing anything they're not allowed to do. Researchers have said that All in One SEO users should update to the patched version to be safe.

See the full report here: https://threatpost.com/all-in-one-seo-plugin-bug-threatens-3m-wordpress-websites-takeovers/177240/

Microsoft Customer Source Code Exposed via Azure App Service Bug

Azure App Service, otherwise known as Azure Web Apps, is a cloud-based platform for hosting Web applications and websites. Researchers at Wiz research team have discovered a security flaw in Azure App Service that exposed the source code of customer applications written in PHP, Python, Ruby, or Node that was deployed using "Local Git."

See the full report here: https://www.darkreading.com/threat-intelligence/microsoft-customer-source-code-exposed-via-azure-app-service-bug

Critical Apache HTTPD Server Bugs Could Lead to RCE, DoS

Security researchers have disclosed two critical bugs in the Apache HTTP web server – HTTPD, which are unrelated to the Log4Shell vulnerability. The bugs (CVE-2021-44790 and CVE-2021-44224) could enable attackers to trigger denial of service (DoS) or bypass security policies. Apache has announced that it will release fixes for these two bugs.

See the full report here: https://threatpost.com/apache-httpd-server-bugs-rce-dos/177234/

NVIDIA discloses applications impacted by Log4j vulnerability - BleepingComputer

NVIDIA has released a security advisory detailing the products affected by the Log4Shell vulnerability. Consumer products are generally unaffected, while some enterprise applications include Apache Log4j and would need to be updated.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-discloses-applications-impacted-by-log4j-vulnerability/

CISA releases Apache Log4j scanner to find vulnerable apps - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has announced the release of a scanner for identifying web services impacted by two Apache Log4j remote code execution vulnerabilities. The tool enables security teams to scan network hosts for Log4j RCE exposure and spot critical web application firewall (WAF) bypasses.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-releases-apache-log4j-scanner-to-find-vulnerable-apps/

Researchers Disclose Unpatched Vulnerabilities in Microsoft Teams Software

Researchers from cybersecurity firm Positive Security discovered four vulnerabilities in the Teams business communication software that could allow accessing internal Microsoft services, spoofing the link preview, and, for Android users, leaking their IP address, and triggering a DoS condition on their Teams app/channels. The vulnerabilities reside in the Microsoft Team link preview feature, experts reported them to Microsoft in March 2021, but the company will not fix three of them.

See the full report here: https://thehackernews.com/2021/12/researchers-disclose-unpatched.html

Apple fixes macOS security flaw behind Gatekeeper bypass - BleepingComputer

The Gatekeeper bypass bug was discovered and reported to Apple by Box Offensive Security Engineer. Apple has addressed a macOS vulnerability that unsigned and unnotarized script-based apps which could exploit to bypass all macOS security protection mechanisms even on fully patched systems.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-macos-security-flaw-behind-gatekeeper-bypass/

AvosLocker ransomware reboots in Safe Mode to bypass security tools - BleepingComputer

In a recent wave of attacks, AvosLocker ransomware is rebooting systems into Windows Safe Mode to disable endpoint security solutions. Running the systems into safe mode will allow the malware to encrypt victims’ files without any interference because endpoint security products do not run in Safe Mode.

See the full report here: https://www.bleepingcomputer.com/news/security/avoslocker-ransomware-reboots-in-safe-mode-to-bypass-security-tools/

‘Spider-Man: No Way Home’ Download Installs Cryptominer

A torrent download of Spider-Man: No Way Home is circulating the internet, and is infected with a persistent Monero cryptominer. The malware is a new edition of a previously known malware that was disguised as "windows updater" and "discord app." It would drain power and CPU capacity without the victim's knowledge.

See the full report here: https://threatpost.com/spider-man-no-way-home-download-installs-cryptominer/177254/

Stealthy BLISTER malware slips in unnoticed on Windows systems - BleepingComputer

Security researchers have uncovered a malicious campaign that relies on a valid code-signing certificate to disguise malicious code as legitimate executables. A payload, called Blister, acts as a loader for other malware. The campaign has been operational for at least three months.

See the full report here: https://www.bleepingcomputer.com/news/security/stealthy-blister-malware-slips-in-unnoticed-on-windows-systems/

Gatonet: Anatel found spyware on a popular device in Brazil - National - Lodi Valley News.com

Brazilian authorities have discovered spyware in devices known as “channel launchers”, also called “gatonet." It allows criminals to take control of a TV box to capture user data and information, such as financial records or files and photos. It can potentially lead to even Distributed Denial of Service (DDoS) attacks.

See the full report here: https://www.lodivalleynews.com/gatonet-anatel-found-spyware-on-a-popular-device-in-brazil-national/

Log4j exploit takes down Ministry of Defense email servers in Belgium - SC Magazine

There’s been a lot of Log4j news over the past few days, the most important being the report that the email system at the Belgian Ministry of Defense (Defence) was down for several days because of an attack through Log4j. The first reports of Log4j being detected in-use against a government agency so soon after the release of the exploit. The Belgian government’s response around 'quarantine' suggests that they build the targeted environments using a defense-in-depth approach, allowing them to selectively isolate network segments and systems to prevent lateral movement from an intrusion.

See the full report here: https://www.scmagazine.com/analysis/cloud-security/log4j-exploit-takes-down-ministry-of-defense-email-servers-in-belgium

Global IT services provider Inetum hit by ransomware attack - BleepingComputer

French IT services company Inetum Group was hit by a ransomware attack last week that affected some of its operations in France and did not spread to larger infrastructures used by the customers. Inetum is active in more than 26 countries, providing digital services to companies in various sectors. None of the main infrastructures, communication, collaboration tools or delivery operations for Inetum clients has been affected. The Group’s crisis unit acted quickly to protect client’s sensitive connections and the operational teams isolated all servers on the affected network and terminated client VPN connections.

See the full report here: https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/

Blackmagic fixes critical DaVinci Resolve code execution flaws - BleepingComputer

Two remote code execution security vulnerabilities tracked as CVE-2021-40417 and CVE-2021-40418, address in the highly popular DaVinci Resolve software version 17.3.1.0005 that would allow attackers to gain code execution on unpatched systems. DaVinci Resolve is a non-linear video editing application. These two flaws caused by weaknesses found in DaVinci Resolve's DPDecoder service and are triggered by a heap-based buffer overflow when decoding a video file or an incorrect UUID when parsing video files. Users are advised to update to DaVinci Resolve 17.4.3 for their platform to fix these vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/blackmagic-fixes-critical-davinci-resolve-code-execution-flaws/

Japan Defense Ministry Finds Security Threat in Hack - Bloomberg

A cyberattack on Mitsubishi Electric Corp. in January last year included data files that may impact Japan’s national security, the Defense Ministry said. Last Friday, the ministry said its probe of the incident found 59 of the almost 20,000 files accessed in the attack were problematic. Mitsubishi Electric reported that it was the target of a cyberattack in which client data may have been lost, but not the confidential defense or infrastructure information was accessed. They were advised to properly manage data and plans to set new standards for data security within the fiscal year itself. The ministry has taken necessary preservative measures on the affected information.

See the full report here: https://www.bloomberg.com/news/articles/2021-12-25/japan-defense-ministry-finds-security-threat-in-hack-dec-24

Android banking trojan spreads via fake Google Play Store page - BleepingComputer

An Android banking trojan targeting Itaú Unibanco, a large financial services provider in Brazil has deployed an unusual trick to spread to devices. The actors have set up a page similar to Android's official Google Play app store and the malware pretends to be the official banking app for Itaú Unibanco. If the user intall the app, they are offered to download the APK and upon execution, it attempts to open the real Itaú app from the actual Play Store. It uses the actual app to perform fraudulent transactions by changing the user's input fields. The websites used to distribute the malicious APKs have been reported and taken offline for now, but the actors may return through different domains.

See the full report here: https://www.bleepingcomputer.com/news/security/android-banking-trojan-spreads-via-fake-google-play-store-page/

Telegram Abused to Steal Crypto-Wallet Credentials - Threatpost

Security researchers have blamed attackers with the Telegram handle "Smokes Night" for spreading the Echelon infostealer malware and targeting Telegram users' crypto-wallets. The malware is being spread in order to deceive new or unsuspecting users of a cryptocurrency discussion channel on the messaging platform.

See the full report here: https://threatpost.com/telegram-steal-crypto-wallet-credentials/177266/

Instagram account of Pakistan embassy in Argentina hacked: FO - Daily Pakistan Global

The Instagram account of the Embassy of Pakistan in Argentina (@PakinArgentina) has been hacked and has been reported to Instagram. Pakistan's mission in Argentina on its Instagram page has posted a cryptic message and blamed the Imran Khan government calling for "political substitution in Islamabad".

See the full report here: https://en.dailypakistan.com.pk/23-Dec-2021/instagram-account-of-pakistan-embassy-in-argentina-hacked-fo

Capital One to Pay Out $190M After Hacker Breached Millions of Customers' Data - Newsweek

Capital One and its cloud provider, Amazon Web Services (AWS), have agreed to pay $190 million to settle a class-action lawsuit related to a data breach that occurred in July 2019. Around 140,000 Social Security numbers and 80,000 connected bank account details from Capital One credit card holders were accessed illegally. The hacker was arrested, and the stolen data was recovered before it could be distributed or utilized for fraudulent activities, according to Capital One.

See the full report here: https://www.newsweek.com/capital-one-pay-out-190m-after-hacker-breached-millions-customers-data-1662784

New Rook Ransomware borrows code from Babuk

Rook, a new ransomware operation initially discovered by researcher Zach Allen, has caught the attention of security researchers due to its shameless claim of a desperate need to make "a lot of money" by hacking corporate networks. The security experts analyzed the samples and found many code similarities between Rook and Babuk, a hacking tool whose source code was posted on a hacking site in September 2021. Indicators of Compromise (IoCs) for the new threat were also revealed by researchers.

See the full report here: https://securityaffairs.co/wordpress/125988/malware/rook-ransomware-based-on-babuk.html?utm_source=rss&utm_medium=rss&utm_campaign=rook-ransomware-based-on-babuk

The British Council falls victim to two successful ransomware attacks - SecurityBrief Australia

The British Council has disclosed that it fell victim to two successful ransomware attacks over the past five years. The attacks led to a total of 12 days of downtime, but no ransom was paid in either incident. The Council also faced six unsuccessful ransomware attacks in the period.

See the full report here: https://securitybrief.co.nz/story/the-british-council-falls-victim-to-two-successful-ransomware-attacks

Consumer Data Breach Alert: SCUF Gaming International, LLC - JD Supra

On October 21, 2021, SCUF Gaming sent out more than 30,000 data breach notification letters to affected parties, informing them that their information may have been compromised. This particular breach is especially concerning, as the compromised information includes customers’ names, email addresses, billing addresses, credit card numbers, expiration dates, and CVV numbers.

See the full report here: https://www.jdsupra.com/legalnews/consumer-data-breach-alert-scuf-gaming-8772795/

Hackers Made More Than US$110000 In Cryptocurrency With Hijacked HP Servers - Lowyat.NET

For one group of hackers, however, hacking into a datacentre full of HP servers and transforming them into miners was clearly a very lucrative choice. In total, the hackers made off with approximately US$110000 (~RM461450) worth of the currency, before scurrying away into the darknet.

See the full report here: https://www.lowyat.net/2021/261769/hackers-made-more-than-us110000-in-cryptocurrency-with-hijacked-hp-servers/

Monkey Kingdom, Hong Kong NFT project, victimized in $1.3 million phishing hack - Micky News

Hackers reportedly stole $1.3 million from the community funds of Monkey Kingdom, a Solana non-fungible token (NFT) project backed by American DJ Steve Aoki. The intrusion began with the vulnerability of Grape, a popular method for validating users on Solana. Monkey Kingdom’s team has set up a compensation fund for the victims.

See the full report here: https://micky.com.au/monkey-kingdom-hong-kong-nft-project-victimized-in-1-3-million-phishing-hack/

QNAP NAS devices hit in surge of ech0raix ransomware attacks - BleepingComputer

Users of QNAP network-attached storage (NAS) devices are facing attacks on their systems by the eCh0raix ransomware, also known as QNAPCrypt. The malware has reportedly encrypted pictures and documents on the victim systems. Users should follow QNAP's recommendations to ensure proper protection of their NAS devices.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-nas-devices-hit-in-surge-of-ech0raix-ransomware-attacks/

Shutterfly Acknowledges Hit by Ransomware Attack - GovInfoSecurity.com

A ransomware attack has disrupted some operations of the photo-sharing and publishing company Shutterfly. This incident has not impacted the Shutterfly.com, Snapfish, TinyPrints or Spoonflower sites, the company reported.

See the full report here: https://www.bankinfosecurity.com/shutterfly-hit-by-ransomware-attack-a-18206

UK Police Data Leaked to Dark Web; Russian Hackers Hold 13 Million Records to Ransom - CPO Magazine

Hackers have leaked a sampling of 13 million records of UK police data after a ransomware attack and are threatening to release more data. The records were stolen from a police contractor, Scotland-based IT support firm Dacoll Group.

See the full report here: https://www.cpomagazine.com/cyber-security/uk-police-data-leaked-to-dark-web-russian-hackers-hold-13-million-records-to-ransom/

Samsung's Galaxy Store is distributing apps that could infect phones with malware - Android Police

Samsung's Galaxy Store is dispersing applications that could contaminate telephones with malware. Android Police's Max Weinbach first noted the issue last night, spotting a few Showbox-based apps distributed on the Galaxy Store, some of which trigger Google's Play Protect warning when installed.

See the full report here: https://www.androidpolice.com/samsung-galaxy-store-malware-movie-piracy-showbox/

Logistics giant DW Morgan exposed 100 GB worth of clients' data - HackRead

According to the security researchers at Website Planet Security Team, the database containing more than 100 GB worth of data of the logistic giant D.W. Morgan, with 2.5 million files detailing financial, shipment, transportation, personal and sensitive records belonging to D.W. Morgan’s employees and clients worldwide has been compromised.

See the full report here: https://www.hackread.com/logistics-giant-d-w-morgan-exposed-clients-data/

LastPass users warned their master passwords are compromised - BleepingComputer

Numerous LastPass users have reported that their master passwords have been compromised. They received email warnings that someone tried to log into their accounts from not-so-known locations. The email notifications also mentioned that their login attempts have been blocked as they were made from unfamiliar locations worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/

New Flagpro malware linked to Chinese state-backed hackers - BleepingComputer

BlackTech, a cyber-espionage APT (advanced persistent threat) group, is targeting Japanese companies using malware called Flagpro. The attacks begin with a phishing email carrying a malicious ZIP/RAR attachment. The targeted entities are from various sectors, including defense technologies, media, and communications.

See the full report here: https://www.bleepingcomputer.com/news/security/new-flagpro-malware-linked-to-chinese-state-backed-hackers/

New Apache Log4j Update Released to Patch Newly Discovered Vulnerability

The Apache Software Foundation (ASF) rolled out fresh patches to contain an arbitrary code execution flaw in Log4j (CVE-2021-44832), making it the fifth security flaw to be discovered in a month. The vulnerability impacts all versions of the logging library from 2.0-alpha7 to 2.17.0, with the exception of 2.3.2 and 2.12.4.

See the full report here: https://thehackernews.com/2021/12/new-apache-log4j-update-released-to.html

SLGA investigating after computer system hacked - paNOW

The Saskatchewan Liquor and Gaming Authority (SLGA) was the target of a hack on Christmas day. The Authority stated that the matter is currently under investigation and there's no evidence yet of misuse of any personal data of employees or customers.

See the full report here: https://panow.com/2021/12/28/slga-investigating-after-computer-system-hacked/