Threat Intelligence Bulletin: 12/30/2021 - 01/06/2022

Breaking News: 2021-12-30 - 2022-01-06

University loses 77TB of research data due to backup error - BleepingComputer

The Kyoto University in Japan has lost about 77TB of research data due to an error in the backup system of its Hewlett-Packard supercomputer. The incident occurred between December 14 and 16, 2021, and resulted in 34 million files from 14 research groups being wiped from the system and the backup file. All affected users have been individually notified of the incident via email.

See the full report here: https://www.bleepingcomputer.com/news/security/university-loses-77tb-of-research-data-due-to-backup-error/

APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools

Researchers from CrowdStrike Falcon OverWatch recently disrupted the threat actors using Log4Shell exploit tools on a vulnerable VMware installation during an attack that involved of a large undisclosed academic institution. The threat group behind this is suspected to be Aquatic Panda, which is a China-based APT with a dual mission of intelligence collection and industrial espionage. The researchers have notified the organization of the activity so the target could begin their incident response protocol.

See the full report here: https://threatpost.com/aquatic-panda-log4shell-exploit-tools/177312/

Netgear leaves vulnerabilities unpatched in Nighthawk router - BleepingComputer

Researchers have found six high-risk vulnerabilities in the latest firmware version for the Netgear Nighthawk R6700v3 router. Nighthawk R6700 is a popular dual-bank WiFi router advertised with gaming-focused features, smart parental controls, and internal hardware that is sufficiently powerful to accommodate the needs of home power users. The recently disclosed flaws affect firmware version 1.0.4.120, which is the latest release for the device. Users are advised to change the default credentials to something unique and strong and follow recommended security practices for more robust defense against malware infections.

See the full report here: https://www.bleepingcomputer.com/news/security/netgear-leaves-vulnerabilities-unpatched-in-nighthawk-router/

Hackers steal, put up for sale KP police data - Pakistan Today

A security researcher stated that a foreign-origin hacker is selling 1,400+ official documents including facial records belonging to Khyber Pakhtunkhwa police. The hackers also shared a sample of the sensitive data that can be sorted based on gender, district, police station, crimes, etc.

See the full report here: https://www.pakistantoday.com.pk/2021/12/30/hackers-steal-put-up-for-sale-kp-police-data/

AvosLocker ransomware gang releases a free decryptor after an affiliate hit US gov agency

According to cyber secuity open source sites, the AvosLocker ransomware operators accidently hit a US governement entity. Sooner, the attackers released a free decryptor to the government entity fearing the reaction of US law enforcement.

See the full report here: https://securityaffairs.co/wordpress/126154/cyber-crime/avoslocker-ransomware-gang-free-decryptor.html?utm_source=rss&utm_medium=rss&utm_campaign=avoslocker-ransomware-gang-free-decryptor

Vice Society hacks Norwegian newspaper, takes credit for Spar attack - SiliconANGLE News

The ransomware group Vice Society has claimed responsibility for an attack on a Spar wholesaler in the United Kingdom that happened in Dec 2021 and is being linked to an attack on a Norwegian newspaper. Due to the ransomware attack, some Spar locations were forced to close, while others remained open but only accepted cash payments. According to HIPAA Journal, the group is known for stealing data from victims' computers before encrypting files with ransomware. This is known as a "double-tap" ransomware attack.

See the full report here: https://siliconangle.com/2021/12/30/vice-society-hacks-norwegian-newspaper-takes-credit-spar-attack/

Broward Health: Hacker accessed employee, patient data, but no evidence of misuse - WSVN 7News | Miami News, Weather, Sports | Fort Lauderdale

According to Broward Health officials, Hackers broke into the company's network and acquired staff and patient data. The statement released by the company itself stated that hackers accessed their network through the office of a third-party medical provider, who is granted access to the system to deliver healthcare services. Officials said there is no evidence indicating any of the information accessed by the hacker has been misused.

See the full report here: https://wsvn.com/news/local/broward/broward-health-hacker-accessed-employee-patient-data-but-no-evidence-of-misuse/

Uber ignores vulnerability that lets you send any email from Uber.com - BleepingComputer

A vulnerability has been discovered in Uber's email system allows people to send emails on behalf of Uber. This vulnerability can reportedly be abused by threat actors to email 57 million Uber users and drivers whose information was leaked in the 2016 data breach. Uber users should be careful of potential phishing emails.

See the full report here: https://www.bleepingcomputer.com/news/security/uber-ignores-vulnerability-that-lets-you-send-any-email-from-ubercom/

Microsoft fixed a Y2K-style bug that broke Exchange email - Engadget

Microsoft has released a temporary fix for a bug that broke email delivery for on-premises Exchange 2016 and 2019 servers on New Year's Day. Exchange was reportedly trying to store version date checks for its antivirus scanning engine in a 32-bit integer variable — but any date from January 1, 2022 onward was too large for this.

See the full report here: https://www.engadget.com/microsoft-exchange-year-2022-bug-fix-215225070.html

Ministry to issue guidelines against ransomware attacks on hospitals - The Japan News

Japan's Health, Labor and Welfare Ministry will compile information security guidelines for hospitals, following numerous ransomware attacks on medical institutions. The guidelines will reportedly include aspects of data storage, email best practices, anti-ransomware software, and cyberattack drills.

See the full report here: https://the-japan-news.com/news/article/0008144344

Jerusalem Post Hacked on Anniversary of Iran General's Killing - Bloomberg

Hackers targeted the website of Israeli newspaper Jerusalem Post, replacing its content with an image that threatened a site associated with Israel's undeclared nuclear weapons program. This occured on the 2-year anniversary of the death of Qassem Soleimani, the Iranian general killed by a US drone strike in Iraq.

See the full report here: https://www.bloomberg.com/news/articles/2022-01-03/jerusalem-post-hacked-on-iran-general-s-killing-anniversary

Portuguese media group Impresa knocked offline in ransomware attack - SiliconANGLE News

Impresa is Portugal’s largest media company and the owner of the SIC television channels and the Expresso weekly newspaper. It has been struck by a ransomware attack taking its websites and online streaming services offline. The attack is being credited to a little-known ransomware gang that goes by the name of Lapsus$.

See the full report here: https://siliconangle.com/2022/01/02/portuguese-media-group-impresa-knocked-offline-ransomware-attack/

Escape From Tarkov Servers Are Under Attack - Future Game Releases

Escape from Tarkov is a multiplayer first-person shooter video game in development by Battlestate Games for Windows. This game is facing a server choke. This issue is not only caused by player overload but also due to anonymous and organized denial-of-service (DDOS) attacks.

See the full report here: https://www.futuregamereleases.com/2022/01/escape-from-tarkov-servers-under-attack/

Twitter accounts of Indian Medical Association, 2 others compromised, hackers rename it 'Elon Musk' - India Today

Hackers attacked the Twitter accounts of the Indian Council of World Affairs (ICWA), the Indian Medical Association (IMA), and Mann Desi Mahila Bank. The three accounts that the hackers hacked had posts that were promoting cryptocurrencies. The hackers changed the name of this Twitter handle to Elon Musk.

See the full report here: https://www.indiatoday.in/india/story/twitter-indian-council-of-world-affairs-hackerd-elon-musk-crypto-1895208-2022-01-03

Exclusive: NASA Director Twitter account hacked by Powerful Greek Army

The Twitter account of Parimal Kopardekar who is the NASA Director and Sr Technologist for the Air Transporation System was hacked by the Powerful Greek Army group. According to reports they had no intention of doing anything bad with the NASA director’s account but rather to test security flaws.

See the full report here: https://securityaffairs.co/wordpress/126243/hacking/nasa-director-hacked-by-powerful-greek-army.html?utm_source=rss&utm_medium=rss&utm_campaign=nasa-director-hacked-by-powerful-greek-army

Apple iOS vulnerable to HomeKit 'doorLock' denial of service bug - BleepingComputer

Apple HomeKit is a software framework that lets iPhone and iPad users control smart home appliances from their devices. A denial of service vulnerability named 'doorLock' was discovered in Apple HomeKit, affecting iOS versions 14.7 through 15.2. According to Trevor Spinolas (security researcher), Apple has continually pushed the security update but it remains unresolved.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-ios-vulnerable-to-homekit-doorlock-denial-of-service-bug/

Purple Fox malware distributed via malicious Telegram installers - BleepingComputer

Purple Fox is an active malware campaign targeting Windows machines. A malicious Telegram for Desktop installer distributes the Purple Fox malware to install further malicious payloads on infected devices. The installer is a compiled AutoIt script named "Telegram Desktop.exe" that drops two files, an actual Telegram installer, and a malicious downloader.

See the full report here: https://www.bleepingcomputer.com/news/security/purple-fox-malware-distributed-via-malicious-telegram-installers/

Florida's Broward Health Confirms October 2021 Breach

Florida's Broward Health hospital system has notified employees and patients of a data breach that occurred on Oct. 15 and compromised a wide range of personal and medical information. The attacker gained entry to the Broward Health network via the office of a third-party medical provider.

See the full report here: https://www.darkreading.com/attacks-breaches/florida-s-broward-health-confirms-october-2021-breach

Fraudulent QR codes found on Austin parking pay stations - AustinTexas.gov

Miscreants put fraudulent QR codes on over two dozen pay stations across Austin, Texas. People attempting to pay for parking using those QR codes may have been directed to a fraudulent website and submitted payment to the miscreants' accounts. Authorities are currently investigating the matter.

See the full report here: https://www.austintexas.gov/news/fraudulent-qr-codes-found-austin-parking-pay-stations

Another year, another hack: Algorand's DeFi platform Tinyman exploited for $3m - AMBCrypto News

Tinyman, a decentralized trading platform built on the Algorand network, lost $3 million after an attack. The attacker exploited some vulnerabilities in the smart contracts that provided unauthorized access to pools from which they could extract tokens.

See the full report here: https://ambcrypto.com/another-year-another-hack-algorands-defi-platform-tinyman-exploited-for-3m/

$1.9 Million Worth Of NFTs Stolen And Re-Sold By Hacker - TheGamer

A collector lost 16 NFTs (non-fungible tokens) valued at $1.9 million after a phishing attack. However, the marketplace OpenSea froze the NFTs after the hackers put them back up for sale.

See the full report here: https://www.thegamer.com/nft-stolen-two-million-dollars/

Data Skimmer Hits 100+ Sotheby’s Real-Estate Websites

Sotheby’s real-estate websites are being infected with data-stealing skimmers, as part of a supply-chain attack via a weaponized cloud video player. The skimmer code harvests information that victims load into contact pages, including names, email IDs, and phone numbers. To mitigate such effects, website administrators can conduct web content integrity checks on a regular basis.

See the full report here: https://threatpost.com/data-skimmer-sothebys-real-estate-websites/177347/

North Korea hackers weaponize holiday cheer in latest cyberattack against Russia | NK PRO - NK News

A suspected North Korea-backed hacking group recently targeted Russian diplomats with a modified version of the Konni malware. The attack was conducted through spear-phishing attacks disguised as New Year’s greeting cards. The attack reportedly contained a new variant of the group’s usual remote access trojan (RAT).

See the full report here: https://www.nknews.org/pro/north-korea-hackers-weaponize-holiday-cheer-in-latest-cyberattack-against-russia/

East Bay Dasher loses earnings, gets kicked off DoorDash after hackers take over his account - KGO-TV

DoorDash, the food delivery service, has warned its drivers of a new phishing scam. Scammers posing as DoorDash support staff claim to be helping drivers with their accounts, but end up stealing their money. If someone calls saying they're DoorDash support, the company advises its "Dashers" to hang up and contact DoorDash directly through the app.

See the full report here: https://abc7news.com/7-on-your-side-7oys-michael-finney-doordash/11425938/

UScellular discloses data breach after billing system hack - BleepingComputer

United States Cellular Corporation is an American mobile network operator headquartered in Chicago, Illinois. The firm said in its data breach notification letters sent to 405 impacted individuals that the attackers also ported some of the affected customers' numbers using personal information stolen in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/uscellular-discloses-data-breach-after-billing-system-hack/

Have I Been Pwned warns of DatPiff data breach impacting millions - BleepingComputer

The DatPiff database was first sold privately and then publicly sold on hacking forums in July 2020. The stolen DatPiff database contains 7,476,940 member records, including a user's email address, password, username, and security question.

See the full report here: https://www.bleepingcomputer.com/news/security/have-i-been-pwned-warns-of-datpiff-data-breach-impacting-millions/

Solana hit with another network incident causing degraded performance - Cointelegraph

Solana is a decentralized blockchain built to enable scalable, user-friendly apps for the world. It has suffered an incident that clogged the network and caused transactions to fail, with users debating whether it was caused by another DDos attack or if it was just network issues.

See the full report here: https://cointelegraph.com/news/solana-hit-with-another-network-incident-causing-degraded-performance

Emergency Windows Server update fixes Remote Desktop issues - BleepingComputer

Microsoft has released an emergency out-of-band update to address a Windows Server bug. The bug can lead to Remote Desktop connection and performance issues. The update will not install automatically on affected systems; users can download the update from the Microsoft Update Catalog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/emergency-windows-server-update-fixes-remote-desktop-issues/

Microsoft code-sign check bypassed to drop Zloader malware - BleepingComputer

A malicious campaign is exploiting Microsoft's digital signature verification to deploy malware payloads and steal user credentials from victims across the world. It is reportedly conducted by the group MalSmoke and uses the banking malware Zloader to drop further payloads on infected devices.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-code-sign-check-bypassed-to-drop-zloader-malware/

iOS malware can fake iPhone shut downs to snoop on camera, microphone - BleepingComputer

Researchers have developed a technique ("NoReboot") that fakes a shutdown or reboot of iPhones. This can prevent malware from being removed via rebooting and allow hackers to secretly snoop on microphones. Because it does not exploit any flaws on the iOS and instead relies on human-level deception, it cannot be patched by Apple.

See the full report here: https://www.bleepingcomputer.com/news/security/ios-malware-can-fake-iphone-shut-downs-to-snoop-on-camera-microphone/

Vodafone accidentally sent a customer personal details of 18 other accounts - Stuff.co.nz

Vodafone spokesman​ confirmed that the telco had sent a PDF containing the name, address, and phone numbers for 18 customer accounts to the woman along with her e-bill. The company believed it was a one-off breach. There was no credit card or banking information involved in this incident.

See the full report here: https://www.stuff.co.nz/business/industries/127445790/vodafone-accidentally-sent-a-customer-personal-details-of-18-other-accounts

‘Elephant Beetle’ Lurks for Months in Networks

Researchers have identified a threat group that’s been quietly siphoning off millions of dollars from financial- and commerce-sector companies. They rely on an arsenal of more than 80 unique tools and scripts to operate undetected “for vast amounts of time” as they patiently plant their bogus transactions.

See the full report here: https://threatpost.com/elephant-beetle-months-networks-financial/177393/

1.1M Compromised Accounts Found at 17 Major Companies

An investigation conducted by the office of New York Attorney Genreal Letitia James revealed that 1.1 million online customer account were compromised in credential stuffing cyberattacks on 17 well-known companies, according to a report released on Wednesday that includes tips on how companies can avoid future attacks.

See the full report here: https://threatpost.com/compromised-accounts-17-major-companies/177417/

Honda, Acura cars hit by Y2K22 bug that rolls back clocks to 2002 - BleepingComputer

Honda and Acura cars have been hit with the Year 2022 bug, aka Y2K22, that resets the navigation system's clock to January 1st, 2002, with no way to change it. Honda and Acura car owners report that the Y2K22 bug affects almost all older cars, including Honda Pilot, Odyssey, CRV, Ridgeline, Odyssey and Acura MDX, RDX, CSX, and TL models.

See the full report here: https://www.bleepingcomputer.com/news/technology/honda-acura-cars-hit-by-y2k22-bug-that-rolls-back-clocks-to-2002/

Breaking News: 2021-12-30 - 2022-01-06

Researchers Caught Multiple Backdoors In Auerswald VoIP Phone System - Cyber Security News

Security researchers have discovered backdoors in Auerswald VoIP appliances, which could provide adversaries administrative access to the device’s web-based management application. Users should update their devices to the latest firmware release 8.2B, which patches the vulnerability.

See the full report here: https://latesthackingnews.com/2021/12/30/researchers-caught-multiple-backdoors-in-auerswald-voip-phone-system

Sega left a huge database of user information open to hackers - TechRadar

Sega Europe sells games in the EMEA region (Europe, Middle East, Africa) and in CIS countries. Researchers have found out that Sega Europe could have easily fallen victim to a data breach as the company had left sensitive files stored insecurely on a publicly accessible database.

See the full report here: https://www.techradar.com/news/sega-left-a-huge-database-of-user-information-open-to-hackers

RedLine Malware Steals Emails, Passwords of More Than 440,000 Accounts! How to Check Yours on 'Have I Been Pwned' - Tech Times

The Redline malware has been used to steal email addresses and passwords from more than 400,000 email accounts. The stolen data is collected into an archive, called "logs," and uploaded to a remote server from where the attacker can later collect them.

See the full report here: https://www.techtimes.com/articles/269950/20211230/redline-malware-steals-emails-passwords-more-440-000-accounts-check.htm

Firmware attack can drop persistent malware in hidden SSD area - BleepingComputer

Korean researchers have developed a set of assaults in opposition to some solid-state drives (SSDs) that might enable planting malware in a location that is past the attain of the person and safety options. Flex capacity is a feature in SSDs from Micron Technology that enables storage devices to automatically adjust the sizes of raw and user-allocated space.

See the full report here: https://www.bleepingcomputer.com/news/security/firmware-attack-can-drop-persistent-malware-in-hidden-ssd-area/

New iLOBleed Rootkit Targeting HP Enterprise Servers with Data Wiping Attacks

iLOBleed, is a previously undetected rootkit that was spotted targeting the HP Enterprise’s Integrated Lights-Out (iLO) server management technology to tamper with the firmware modules and wipe data off the infected systems. The attacks were spotted by Iranian cybersecurity firm Amnpardaz, this is the first time ever that malware targets iLO firmware.

See the full report here: https://thehackernews.com/2021/12/new-ilobleed-rootkit-targeting-hp.html

University loses 77TB of research data due to backup error - BleepingComputer

The Kyoto University in Japan has lost about 77TB of research data due to an error in the backup system of its Hewlett-Packard supercomputer. The incident occurred between December 14 and 16, 2021, and resulted in 34 million files from 14 research groups being wiped from the system and the backup file. All affected users have been individually notified of the incident via email.

See the full report here: https://www.bleepingcomputer.com/news/security/university-loses-77tb-of-research-data-due-to-backup-error/

APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools

Researchers from CrowdStrike Falcon OverWatch recently disrupted the threat actors using Log4Shell exploit tools on a vulnerable VMware installation during an attack that involved of a large undisclosed academic institution. The threat group behind this is suspected to be Aquatic Panda, which is a China-based APT with a dual mission of intelligence collection and industrial espionage. The researchers have notified the organization of the activity so the target could begin their incident response protocol.

See the full report here: https://threatpost.com/aquatic-panda-log4shell-exploit-tools/177312/

Netgear leaves vulnerabilities unpatched in Nighthawk router - BleepingComputer

Researchers have found six high-risk vulnerabilities in the latest firmware version for the Netgear Nighthawk R6700v3 router. Nighthawk R6700 is a popular dual-bank WiFi router advertised with gaming-focused features, smart parental controls, and internal hardware that is sufficiently powerful to accommodate the needs of home power users. The recently disclosed flaws affect firmware version 1.0.4.120, which is the latest release for the device. Users are advised to change the default credentials to something unique and strong and follow recommended security practices for more robust defense against malware infections.

See the full report here: https://www.bleepingcomputer.com/news/security/netgear-leaves-vulnerabilities-unpatched-in-nighthawk-router/

Hackers steal, put up for sale KP police data - Pakistan Today

A security researcher stated that a foreign-origin hacker is selling 1,400+ official documents including facial records belonging to Khyber Pakhtunkhwa police. The hackers also shared a sample of the sensitive data that can be sorted based on gender, district, police station, crimes, etc.

See the full report here: https://www.pakistantoday.com.pk/2021/12/30/hackers-steal-put-up-for-sale-kp-police-data/

AvosLocker ransomware gang releases a free decryptor after an affiliate hit US gov agency

According to cyber secuity open source sites, the AvosLocker ransomware operators accidently hit a US governement entity. Sooner, the attackers released a free decryptor to the government entity fearing the reaction of US law enforcement.

See the full report here: https://securityaffairs.co/wordpress/126154/cyber-crime/avoslocker-ransomware-gang-free-decryptor.html?utm_source=rss&utm_medium=rss&utm_campaign=avoslocker-ransomware-gang-free-decryptor

Vice Society hacks Norwegian newspaper, takes credit for Spar attack - SiliconANGLE News

The ransomware group Vice Society has claimed responsibility for an attack on a Spar wholesaler in the United Kingdom that happened in Dec 2021 and is being linked to an attack on a Norwegian newspaper. Due to the ransomware attack, some Spar locations were forced to close, while others remained open but only accepted cash payments. According to HIPAA Journal, the group is known for stealing data from victims' computers before encrypting files with ransomware. This is known as a "double-tap" ransomware attack.

See the full report here: https://siliconangle.com/2021/12/30/vice-society-hacks-norwegian-newspaper-takes-credit-spar-attack/

Broward Health: Hacker accessed employee, patient data, but no evidence of misuse - WSVN 7News | Miami News, Weather, Sports | Fort Lauderdale

According to Broward Health officials, Hackers broke into the company's network and acquired staff and patient data. The statement released by the company itself stated that hackers accessed their network through the office of a third-party medical provider, who is granted access to the system to deliver healthcare services. Officials said there is no evidence indicating any of the information accessed by the hacker has been misused.

See the full report here: https://wsvn.com/news/local/broward/broward-health-hacker-accessed-employee-patient-data-but-no-evidence-of-misuse/

Uber ignores vulnerability that lets you send any email from Uber.com - BleepingComputer

A vulnerability has been discovered in Uber's email system allows people to send emails on behalf of Uber. This vulnerability can reportedly be abused by threat actors to email 57 million Uber users and drivers whose information was leaked in the 2016 data breach. Uber users should be careful of potential phishing emails.

See the full report here: https://www.bleepingcomputer.com/news/security/uber-ignores-vulnerability-that-lets-you-send-any-email-from-ubercom/

Microsoft fixed a Y2K-style bug that broke Exchange email - Engadget

Microsoft has released a temporary fix for a bug that broke email delivery for on-premises Exchange 2016 and 2019 servers on New Year's Day. Exchange was reportedly trying to store version date checks for its antivirus scanning engine in a 32-bit integer variable — but any date from January 1, 2022 onward was too large for this.

See the full report here: https://www.engadget.com/microsoft-exchange-year-2022-bug-fix-215225070.html

Ministry to issue guidelines against ransomware attacks on hospitals - The Japan News

Japan's Health, Labor and Welfare Ministry will compile information security guidelines for hospitals, following numerous ransomware attacks on medical institutions. The guidelines will reportedly include aspects of data storage, email best practices, anti-ransomware software, and cyberattack drills.

See the full report here: https://the-japan-news.com/news/article/0008144344

Jerusalem Post Hacked on Anniversary of Iran General's Killing - Bloomberg

Hackers targeted the website of Israeli newspaper Jerusalem Post, replacing its content with an image that threatened a site associated with Israel's undeclared nuclear weapons program. This occured on the 2-year anniversary of the death of Qassem Soleimani, the Iranian general killed by a US drone strike in Iraq.

See the full report here: https://www.bloomberg.com/news/articles/2022-01-03/jerusalem-post-hacked-on-iran-general-s-killing-anniversary

Portuguese media group Impresa knocked offline in ransomware attack - SiliconANGLE News

Impresa is Portugal’s largest media company and the owner of the SIC television channels and the Expresso weekly newspaper. It has been struck by a ransomware attack taking its websites and online streaming services offline. The attack is being credited to a little-known ransomware gang that goes by the name of Lapsus$.

See the full report here: https://siliconangle.com/2022/01/02/portuguese-media-group-impresa-knocked-offline-ransomware-attack/

Escape From Tarkov Servers Are Under Attack - Future Game Releases

Escape from Tarkov is a multiplayer first-person shooter video game in development by Battlestate Games for Windows. This game is facing a server choke. This issue is not only caused by player overload but also due to anonymous and organized denial-of-service (DDOS) attacks.

See the full report here: https://www.futuregamereleases.com/2022/01/escape-from-tarkov-servers-under-attack/

Twitter accounts of Indian Medical Association, 2 others compromised, hackers rename it 'Elon Musk' - India Today

Hackers attacked the Twitter accounts of the Indian Council of World Affairs (ICWA), the Indian Medical Association (IMA), and Mann Desi Mahila Bank. The three accounts that the hackers hacked had posts that were promoting cryptocurrencies. The hackers changed the name of this Twitter handle to Elon Musk.

See the full report here: https://www.indiatoday.in/india/story/twitter-indian-council-of-world-affairs-hackerd-elon-musk-crypto-1895208-2022-01-03

Exclusive: NASA Director Twitter account hacked by Powerful Greek Army

The Twitter account of Parimal Kopardekar who is the NASA Director and Sr Technologist for the Air Transporation System was hacked by the Powerful Greek Army group. According to reports they had no intention of doing anything bad with the NASA director’s account but rather to test security flaws.

See the full report here: https://securityaffairs.co/wordpress/126243/hacking/nasa-director-hacked-by-powerful-greek-army.html?utm_source=rss&utm_medium=rss&utm_campaign=nasa-director-hacked-by-powerful-greek-army

Apple iOS vulnerable to HomeKit 'doorLock' denial of service bug - BleepingComputer

Apple HomeKit is a software framework that lets iPhone and iPad users control smart home appliances from their devices. A denial of service vulnerability named 'doorLock' was discovered in Apple HomeKit, affecting iOS versions 14.7 through 15.2. According to Trevor Spinolas (security researcher), Apple has continually pushed the security update but it remains unresolved.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-ios-vulnerable-to-homekit-doorlock-denial-of-service-bug/

Purple Fox malware distributed via malicious Telegram installers - BleepingComputer

Purple Fox is an active malware campaign targeting Windows machines. A malicious Telegram for Desktop installer distributes the Purple Fox malware to install further malicious payloads on infected devices. The installer is a compiled AutoIt script named "Telegram Desktop.exe" that drops two files, an actual Telegram installer, and a malicious downloader.

See the full report here: https://www.bleepingcomputer.com/news/security/purple-fox-malware-distributed-via-malicious-telegram-installers/

Florida's Broward Health Confirms October 2021 Breach

Florida's Broward Health hospital system has notified employees and patients of a data breach that occurred on Oct. 15 and compromised a wide range of personal and medical information. The attacker gained entry to the Broward Health network via the office of a third-party medical provider.

See the full report here: https://www.darkreading.com/attacks-breaches/florida-s-broward-health-confirms-october-2021-breach

Fraudulent QR codes found on Austin parking pay stations - AustinTexas.gov

Miscreants put fraudulent QR codes on over two dozen pay stations across Austin, Texas. People attempting to pay for parking using those QR codes may have been directed to a fraudulent website and submitted payment to the miscreants' accounts. Authorities are currently investigating the matter.

See the full report here: https://www.austintexas.gov/news/fraudulent-qr-codes-found-austin-parking-pay-stations

Another year, another hack: Algorand's DeFi platform Tinyman exploited for $3m - AMBCrypto News

Tinyman, a decentralized trading platform built on the Algorand network, lost $3 million after an attack. The attacker exploited some vulnerabilities in the smart contracts that provided unauthorized access to pools from which they could extract tokens.

See the full report here: https://ambcrypto.com/another-year-another-hack-algorands-defi-platform-tinyman-exploited-for-3m/

$1.9 Million Worth Of NFTs Stolen And Re-Sold By Hacker - TheGamer

A collector lost 16 NFTs (non-fungible tokens) valued at $1.9 million after a phishing attack. However, the marketplace OpenSea froze the NFTs after the hackers put them back up for sale.

See the full report here: https://www.thegamer.com/nft-stolen-two-million-dollars/

Data Skimmer Hits 100+ Sotheby’s Real-Estate Websites

Sotheby’s real-estate websites are being infected with data-stealing skimmers, as part of a supply-chain attack via a weaponized cloud video player. The skimmer code harvests information that victims load into contact pages, including names, email IDs, and phone numbers. To mitigate such effects, website administrators can conduct web content integrity checks on a regular basis.

See the full report here: https://threatpost.com/data-skimmer-sothebys-real-estate-websites/177347/

North Korea hackers weaponize holiday cheer in latest cyberattack against Russia | NK PRO - NK News

A suspected North Korea-backed hacking group recently targeted Russian diplomats with a modified version of the Konni malware. The attack was conducted through spear-phishing attacks disguised as New Year’s greeting cards. The attack reportedly contained a new variant of the group’s usual remote access trojan (RAT).

See the full report here: https://www.nknews.org/pro/north-korea-hackers-weaponize-holiday-cheer-in-latest-cyberattack-against-russia/

East Bay Dasher loses earnings, gets kicked off DoorDash after hackers take over his account - KGO-TV

DoorDash, the food delivery service, has warned its drivers of a new phishing scam. Scammers posing as DoorDash support staff claim to be helping drivers with their accounts, but end up stealing their money. If someone calls saying they're DoorDash support, the company advises its "Dashers" to hang up and contact DoorDash directly through the app.

See the full report here: https://abc7news.com/7-on-your-side-7oys-michael-finney-doordash/11425938/

UScellular discloses data breach after billing system hack - BleepingComputer

United States Cellular Corporation is an American mobile network operator headquartered in Chicago, Illinois. The firm said in its data breach notification letters sent to 405 impacted individuals that the attackers also ported some of the affected customers' numbers using personal information stolen in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/uscellular-discloses-data-breach-after-billing-system-hack/

Have I Been Pwned warns of DatPiff data breach impacting millions - BleepingComputer

The DatPiff database was first sold privately and then publicly sold on hacking forums in July 2020. The stolen DatPiff database contains 7,476,940 member records, including a user's email address, password, username, and security question.

See the full report here: https://www.bleepingcomputer.com/news/security/have-i-been-pwned-warns-of-datpiff-data-breach-impacting-millions/

Solana hit with another network incident causing degraded performance - Cointelegraph

Solana is a decentralized blockchain built to enable scalable, user-friendly apps for the world. It has suffered an incident that clogged the network and caused transactions to fail, with users debating whether it was caused by another DDos attack or if it was just network issues.

See the full report here: https://cointelegraph.com/news/solana-hit-with-another-network-incident-causing-degraded-performance

Emergency Windows Server update fixes Remote Desktop issues - BleepingComputer

Microsoft has released an emergency out-of-band update to address a Windows Server bug. The bug can lead to Remote Desktop connection and performance issues. The update will not install automatically on affected systems; users can download the update from the Microsoft Update Catalog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/emergency-windows-server-update-fixes-remote-desktop-issues/

Microsoft code-sign check bypassed to drop Zloader malware - BleepingComputer

A malicious campaign is exploiting Microsoft's digital signature verification to deploy malware payloads and steal user credentials from victims across the world. It is reportedly conducted by the group MalSmoke and uses the banking malware Zloader to drop further payloads on infected devices.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-code-sign-check-bypassed-to-drop-zloader-malware/

iOS malware can fake iPhone shut downs to snoop on camera, microphone - BleepingComputer

Researchers have developed a technique ("NoReboot") that fakes a shutdown or reboot of iPhones. This can prevent malware from being removed via rebooting and allow hackers to secretly snoop on microphones. Because it does not exploit any flaws on the iOS and instead relies on human-level deception, it cannot be patched by Apple.

See the full report here: https://www.bleepingcomputer.com/news/security/ios-malware-can-fake-iphone-shut-downs-to-snoop-on-camera-microphone/

Vodafone accidentally sent a customer personal details of 18 other accounts - Stuff.co.nz

Vodafone spokesman​ confirmed that the telco had sent a PDF containing the name, address, and phone numbers for 18 customer accounts to the woman along with her e-bill. The company believed it was a one-off breach. There was no credit card or banking information involved in this incident.

See the full report here: https://www.stuff.co.nz/business/industries/127445790/vodafone-accidentally-sent-a-customer-personal-details-of-18-other-accounts

‘Elephant Beetle’ Lurks for Months in Networks

Researchers have identified a threat group that’s been quietly siphoning off millions of dollars from financial- and commerce-sector companies. They rely on an arsenal of more than 80 unique tools and scripts to operate undetected “for vast amounts of time” as they patiently plant their bogus transactions.

See the full report here: https://threatpost.com/elephant-beetle-months-networks-financial/177393/

1.1M Compromised Accounts Found at 17 Major Companies

An investigation conducted by the office of New York Attorney Genreal Letitia James revealed that 1.1 million online customer account were compromised in credential stuffing cyberattacks on 17 well-known companies, according to a report released on Wednesday that includes tips on how companies can avoid future attacks.

See the full report here: https://threatpost.com/compromised-accounts-17-major-companies/177417/

Honda, Acura cars hit by Y2K22 bug that rolls back clocks to 2002 - BleepingComputer

Honda and Acura cars have been hit with the Year 2022 bug, aka Y2K22, that resets the navigation system's clock to January 1st, 2002, with no way to change it. Honda and Acura car owners report that the Y2K22 bug affects almost all older cars, including Honda Pilot, Odyssey, CRV, Ridgeline, Odyssey and Acura MDX, RDX, CSX, and TL models.

See the full report here: https://www.bleepingcomputer.com/news/technology/honda-acura-cars-hit-by-y2k22-bug-that-rolls-back-clocks-to-2002/