Threat Intelligence Bulletin: 01/07/2022 - 01/13/2022

An Overview of the Pharmaceutical Industry Threat Landscape

The pharmaceutical industry gained significant attention with the outbreak of the coronavirus (COVID-19) crisis. At the onset of the pandemic, demand from the pharmaceutical industry increased due to the need for COVID-19 treatment medication and prevention kits. The pharmaceutical industry endured a major shift in the threat landscape compared to the early stages of the pandemic from March 2020 to September 2021. Advanced Persistent Threat (APT) groups and cyber criminals targeted pharmaceutical companies to steal highly sensitive information, such as drug formulas and COVID-19 research and development data, which are extremely valuable to cybercriminals for financial gain, nation-state-backed actors to support their political agenda, and hacktivists to support their cause of economic or social awareness.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Limit file egress by size and type.
• Disable macros whenever possible.
• Avoid opening unsolicited attachments and never click suspicious links
• Enforce best practices on passwords, such as complexity, forced expiration, and prohibiting password reuse.
• Do not share passwords, and do not reuse the same password on different websites and applications.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• Disable unused ports on Internet-facing devices.
• Disable port echoing on all Internet-facing devices
• Use a VPN for internal network connections.
• If a workstation is infected with malware, quarantine it on a private network segment with no external connections.
• If you are alerted or suspect a compromised account, change the password immediately.
• Segment critical network resources using zero-trust configurations.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.

Details

According to publicly available reports, a large percentage of the workforce shifted to remote working locations in the pandemic to follow COVID-19 health and safety guidelines. This was opportunistic for the threat actors as it provided a wider attack surface due to a dispersed workforce. During this time, phishing attacks were the most common vector to conduct malicious activity. Threat actors leveraged critical security vulnerabilities in the deployment of remote working systems and networks by organizations and businesses to support staff working from home and stole sensitive information to fulfill their motives.

Based on this surge, the United States (US) government quickly released a joint alert contributed by the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC).

The most common attack techniques used by the attackers were phishing, malware distribution, and the use of typo-squatting domains. The malware associated with some pharmaceutical-themed attacks included Agent Tesla (a keylogger malware), Get2 loader malware (Get2 loader has been observed loading the GraceWire Trojan), and TrickBot malware.

Some examples of reported attacks included ransomware attacks on a pharmaceutical company, biotechnology firm, and an attempted attack on the World Health Organization (WHO).

In the second quarter of 2020, cyber criminals targeted medical research organizations by luring victims with spear phishing techniques using COVID-19-themed malicious attachments. In one instance, APT32, a Vietnam-based threat actor group, targeted the Chinese government to steal COVID-19 treatment-related research with the METALJACK malware. At the same time, CISA, along with the National Security Agency (NSA) and cybersecurity authorities in the UK and Canada, attributed an attack to APT29 (also known as Cozy Bear) for targeting COVID-19 research and vaccine development facilities with cyber threats, such as a custom remote access trojan (RAT) known as WellMess and WellMail. The technique in the initial infection used mass scanning of vulnerable systems and then exploited critical vulnerabilities. APT29 was successful in using published exploits for products like Citrix, Pulse Secure, FortiGate, Zimbra to gain initial access in the organization. Moderna, a biotechnology company, also fell victim to a cyberattack conducted by China-based threat actors.

Some pharmaceutical companies that publicly disclosed their efforts in vaccine research and development became new targets for attackers. One example of this was when pharmaceutical company LUPIN reported a cybersecurity breach, right after releasing the Favipiravir drug used to treat mild to moderate cases of COVID-19. Although LUPIN was not directly involved with vaccination manufacturing, the launch of Favipiravir may have motivated threat actors to target the company for vaccine information.

Other examples of pharmaceutical companies, and companies working closely with pharmaceutical companies, exhibiting COVID-19-themed cyber threats include the following:

• India-based pharmaceutical company, Dr Reddy’s Laboratories, fell victim to a ransomware attack in October 2020 after getting approval to conduct phase 2/3 trials in India of Sputnik V, a COVID-19 vaccine developed by a Russian research institute. The company temporarily shut down several production facilities and isolated all data centres. In addition, it closed plants in the US, UK, Brazil, India, and Russia.
• US-based temperature-controlled warehousing operator and transportation company Americold, suffered a ransomware attack in late 2020, as the company had been in talks to store and transport COVID-19 vaccines.
• In December 2020, the European Medicines Agency (EMA) faced a data breach where documents relating to the Pfizer/BioNTech vaccine had been unlawfully accessed.
• The North Korea-based threat actor group, Lazarus Group, targeted a pharmaceutical company, as well as a government health ministry, dealing with the COVID-19 response with the mere objective of intellectual property theft. Suspected North Korean threat actors targeted AstraZeneca, a known COVID-19 vaccine manufacturer.

In the fourth quarter of 2020, after observing and analysing the scope of cyber attacks on pharmaceutical companies, many cyber security companies released advisories, reports and guidelines to protect valuable healthcare assets.

However, compared to previous quarters, there were minimal publicly disclosed cyber attacks targeting pharmaceutical organizations for COVID-19-related data in the third quarter of 2021. Instead, there was a surge in mobile phishing and malware attacks due to increased use of personal mobile devices for work. In the pharmaceutical industry, mobile devices are used across the entire supply chain, and proprietary data is stored in cloud services with the help of these mobile devices. Attackers that use social engineering techniques can compromise these devices easily. In these attacks, cybercriminals mostly deliver malware like Monokle, SilkBean and Wroba trojan. All three types of malware are Android surveillanceware containing comprehensive RAT functionality, including:

• Keylogging
• Taking photos and videos
• Retrieving application history from web browsers, social media services, and instant messengers
• Location tracking

With the second wave of the pandemic in 2021, Chinese threat actor group APT10, also known as Stone Panda, identified gaps and vulnerabilities in the IT infrastructure and supply chain software of Bharat Biotech and the Serum Institute of India (SII). Both companies were involved in COVID-19 vaccination development and manufacturing. Security researchers assess that the motivation for the threat was to steal intellectual data related to the COVID-19 vaccine for a competitive advantage, as well as financial gain.

Pharmaceutical Industry Attack Surface Breakdown

Due to new health and safety guidelines as a result of COVID-19, such as social distancing and remote working environments, many businesses relied heavily on internet-connected devices to facilitate business operations. However, this widened the attack surface for potential threats to businesses including the pharmaceutical industry.

In remote working scenarios, commonly targeted assets and applications were interconnected devices running on the cloud, health information exchanges with third parties, and publicly-exposed systems.

The common MITRE ATT&CK framework tactics, techniques and procedures used by threat actors were: Enterprise:

• Initial Access (TA0001): Phishing (T1566) - Spear-phishing Spear Phishing Attachment (T1566.001), Spear Phishing Link (T1566.002)
• Execution (TA0002): User Execution (T1204)
• Defense Evasion (TA0005): Regsvr32 (T1218.010)
• Lateral Movement (TA0008): Remote Services (T1021) - Remote Desktop Protocol (T1021.001) Mobile:
• Command and Control (TA0037): Standard Cryptographic Protocol (T1521)

Due to increased development of linked Operational Technology systems and devices, traditional security methods were unable to secure the extended attack surface. This caused challenges for the pharmaceutical industry during the pandemic that included:

• Counterfeit and drug diversion in developing countries
• Technology and network collaboration for safe vaccine distribution
• Upgrade older technology systems to accommodate new security frameworks
• Illegal vaccine distribution, including selling fake vaccines at higher prices
• Cybercriminals spreading misinformation about vaccine safety
• Vulnerable open ports with remote desktop and administrative tools affected supply chain companies
• Insufficient email security, lacking basic DNS-based email security protocols.

Pharmaceutical Threat Landscape Trend Analysis

Cyber criminals typically create attacks based on current events and topics that gain their target's interest. The urgent demand for the pharmaceutical and medical industries to cope with the COVID-19 pandemic lured cyber criminals to target organizations within this industry vertical.

Some cyber criminals collected information against pharmaceutical companies and research organizations to get as much valuable data as possible to attack their specific targets or to engage in fraudulent activities etc. Coronavirus-related information was of immense importance for the nation state actors in the second quarter of 2020 when the pandemic started as this information needed to get ahead in the global race of vaccine research and development. After a period in which threat actors were particularly interested in COVID-19 data, cybercriminals moved their attention to companies who work with the government on vaccine development and distribution. The attackers now intended to disrupt vaccine production and distribution by attacking pharmaceutical companies, prompting them to shut down operations and supply chain companies to miss deadlines on vaccine deliveries. This would result in financial loss and reputational damage to the companies, revealing that the attackers were clearly monitoring the activities of the pharmaceutical companies and picking their targets very carefully.

Figure 1: Timeline demonstrating frequent attacks on pharmaceutical organizations between March 2020 to March 2021
Source: ZeroFox Threat Intelligence

From the timeline in Figure 1, it is clear that pharmaceutical companies were targeted based on their role and involvement in COVID-19 response between March 2020 to March 2021. The cyber attacks on this industry will continue to be a susceptible target for the foreseeable future as a new COVID-19 variant, Omicron, has affected many individuals. Threat actors have already deployed phishing scams using an Omicron variant theme.

According to a report published by IBM's X-Force research group in 2020, countries with a greater COVID-19 outbreak tended to have increased malicious activities related to COVID-19 threats.

Figure 2. Top countries with malicious COVID-19 cyber activities, based on Quad 9 data
Source: IBM X-Force

Impact on COVID19 Supply chain

When COVID-19 vaccines were manufactured after the trials, attackers were quick to understand that the supply chain sector would be an ideal target for cyber attacks, due to dependency on mobile devices for inventory and communications in this sector. During this time, organizations followed COVID-19 health and safety guidelines by having a limited onsite staff perform operations to maintain social distancing. Therefore, it was easier for a remote attacker to gain entry into the system by physical and virtual means as not many staff are monitoring the assets and operations of the organization.

With the rise of teleworking infrastructure, threat actors used social engineering techniques to exploit vulnerabilities in remote working tools and software by targeting users with various types of phishing such as SMS-based phishing, credential theft, and phishing emails to distribute malware. With financial-gain being a motivational factor, observations indicate that some APT groups were more interested in stealing COVID-19 research for a geopolitical advantage, as the information could be useful for domestic research into COVID-19 treatment. Although COVID-19-themed cyber attacks started in the beginning of 2020, the attack on supply chains emerged in the middle of 2020. It is notable that a delay in the distribution of vaccines could lead to the spread of more COVID-19 infections. In addition, the third party vendors remotely delivered their services to healthcare organizations which also increased the attack surface to some extent due to remote working environments.

Conclusion

Based on ZeroFox analyses, it is clear that cyber criminals primarily targeted pharmaceutical companies' sensitive data for financial gain, one of which was through ransomware attacks where operators demanded a ransom payment in exchange for stolen data. Then, they focused on research related data that could lead to business loss and ultimately financial loss for the organization. Companies in the pharmaceutical industry cannot afford to lose valuable data, access to critical systems, or disruptions in their operations, especially during the pandemic. This situation requires an immediate incident response plan to deal with any kind of cyberattack on a real time basis. The increasing rate of cyberattacks is becoming a major risk to public safety and national security due to a wider attack surface. With all above observations, it is speculated that the pharmaceutical industry will continue to be on the target list of the attackers and could be hit with cyber attacks in the future.

Breaking News: 2022-01-07 - 2022-01-13

Multiple High-Profile FIFA Ultimate Team Traders Hacked in the Same Week - IGN

Several high-profile traders in FIFA Ultimate Team have been attacked by hackers recently, who are stealing their FIFA points and in-game currency. Many of the top 100 traders have been targeted, including current top Ultimate Team trader on PlayStation, FUT Donkey.

See the full report here: https://www.ign.com/articles/fifa-ultimate-team-trader-hack

Delhi Police bust gang involved in hacking online competitive exams; 6 held - Hindustan Times

The Delhi Police has busted an interstate module that hacked into various online competitive examination websites and manipulated the results for candidates across India. The arrested men include hackers, solvers, trainers, and coaching-institute owners. The group had claimed access to several popular exams, including GMAT, JEE, Comptia, and more.

See the full report here: https://www.hindustantimes.com/cities/delhi-news/delhi-police-bust-gang-involved-in-hacking-online-competitive-exams-six-held-101641409885168.html

FinalSite ransomware attack shuts down thousands of school websites - BleepingComputer

FinalSite, a leading school website services provider, has reportedly suffered a ransomware attack. The attack disrupted access to websites for thousands of schools worldwide. The threat actors and the total scope of the attack have not been publicly revealed yet.

See the full report here: https://www.bleepingcomputer.com/news/security/finalsite-ransomware-attack-shuts-down-thousands-of-school-websites/

Google Docs Comments Weaponized in New Phishing Campaign

A phishing campaign is using the commenting feature in Google Docs to convince targets to click malicious links. The attacker creates a Google Docs document, adds a comment containing a malicious link, and tags the target using an "@". Because the generated email notification comes from Google, it evades most anti-spam filters.

See the full report here: https://www.darkreading.com/attacks-breaches/google-docs-comments-weaponized-in-new-phishing-campaign

Night Sky is the latest ransomware targeting corporate networks - BleepingComputer

A new ransomware product called "Night Sky" targets corporate networks and attempts to steal data for double-extortion attacks. Night Sky has created a Tor data leak site that currently includes two victims, one from Bangladesh and another from Japan.

See the full report here: https://www.bleepingcomputer.com/news/security/night-sky-is-the-latest-ransomware-targeting-corporate-networks/

FlexBooker discloses data breach, over 3.7 million accounts impacted - BleepingComputer

FlexBooker is a company that provides a cloud-based online scheduling and booking service. It has been disclosed that it has exposed the personal details of more than 3.7 million users. The data is now being traded on hacker forums.

See the full report here: https://www.bleepingcomputer.com/news/security/flexbooker-discloses-data-breach-over-37-million-accounts-impacted/

US online pharmacy Ravkoo links data breach to AWS portal incident - BleepingComputer

Ravkoo is a digital SaaS platform for prescription fulfillment, with over 400 distribution centers nationwide in over 110 major cities, providing free, same-day, or next-day prescription delivery to patients' doorsteps. The firm has disclosed that it suffered from a data breach after the company's AWS hosted cloud prescription portal was involved in a security incident that may have led to personal and health information being accessed.

See the full report here: https://www.bleepingcomputer.com/news/security/us-online-pharmacy-ravkoo-links-data-breach-to-aws-portal-incident/

Google Voice Authentication Scam Leaves Victims on the Hook

The Google Voice service offers virtual phone numbers that can be used to make domestic and international calls or send and receive text messages from a browser. The FBI is seeing so much activity around malicious Google Voice activity, where victims are associated with fraudulent virtual phone numbers, that it sent out an alert this week.

See the full report here: https://threatpost.com/google-voice-authentication-scam/177421/

France hits Facebook and Google with $210 million in fines - BleepingComputer

France’s National Commission on Informatics and Liberty (CNIL) which is the country's data privacy and protection body have announced a 60 million euro ($68 million) sanction against Facebook and a 150 million euro ($170 million) penalty against Google. The fines are for making it difficult for website visitors to reject tracking cookies by hiding the option behind multiple clicks.

See the full report here: https://www.bleepingcomputer.com/news/legal/france-hits-facebook-and-google-with-210-million-in-fines/

Google Releases New Chrome Update to Patch Dozens of New Browser Vulnerabilities

Google has released updates for its Chrome web browser to fix 37 security issues. Chrome users are recommended to update to the latest version (97.0.4692.71) for Windows, Mac, and Linux by heading to Settings > Help > 'About Google Chrome' to mitigate any potential risk of active exploitation.

See the full report here: https://thehackernews.com/2022/01/google-releases-new-chrome-update-to.html

Attack misuses Google Docs comments to spew out “massive wave” of malicious links

A massive wave of malicious hackers exploiting the comment feature in Google Docs to spread malicious content and phishing messages into the inboxes of unsuspecting targeted users. The flaw can be exploited by cybercriminals to send messages to just about any email address, and yet the emails are actually sent from Google and so may appear trustworthy. This exploit may also present additional challenges for email-filtering solutions that treat Google as a trusted sender. It hit over 500 inboxes across 30 tenants, with hackers using over 100 different Gmail accounts. Concerned users can protect themselves by being cautious about clicking on suspicious links.

See the full report here: https://www.tripwire.com/state-of-security/featured/attack-misuses-google-docs-comments-to-spew-out-malicious-links/

Patchwork APT caught in its own web

The threat actor named “Patchwork“ has been active since December 2015 and usually targets via spear phishing attacks by using malicious RTF files to drop a variant of the BADNEWS (Ragnatela) Remote Administration Trojan (RAT).The actor has targeted several faculty members or the first time whose research focus is on molecular medicine and biological science. The group makes use of virtual machines and VPNs to both develop, push updates and check on their victims. Patchwork, like some other East Asian APTs is not as sophisticated as their Russian and North Korean counterparts.

See the full report here: https://blog.malwarebytes.com/threat-intelligence/2022/01/patchwork-apt-caught-in-its-own-web/

Grass Valley reveals extent of data breach - YubaNet

A data security incident has been identified and addressed by The City of Grass Valley. In this incident, an unauthorized person obtained access to certain computer systems and transferred files contained some Personal Identifiable Information related to individuals associated with Grass Valley outside of its network. Grass Valley began notifying victims and recommends them to remain vigilant for incidents of fraud. Grass Valley is also offering victims whose SSN or driver’s license number was involved in the incident a complimentary one-year membership with Experian’s® IdentityWorksSM. This product helps detect possible misuse of personal information and provides identity protection support.

See the full report here: https://yubanet.com/regional/grass-valley-reveals-extent-of-data-breach/

FluBot malware now targets Europe posing as Flash Player app - BleepingComputer

The widely distributed FluBot malware continues to evolve, with new campaigns distributing the malware as Flash Player and the developers adding new features. FluBot is an Android banking trojan that steals credentials by displaying overlay login forms against many banks worldwide. According to the researchers ar MalwareHunterTeam, the new FluBot campaigns are distributed using SMS texts with a malicious link. When recipients click on the link, they are brought to a page offering a fake Flash Player APK that installs the FluBot malware on the Android device. Users are advised to avoid installing APK files from unusual sources.

See the full report here: https://www.bleepingcomputer.com/news/security/flubot-malware-now-targets-europe-posing-as-flash-player-app/

3.7M FlexBooker Records Dumped on Hacker Forum

A threat group that identifies itself as Uawrongteam is dumping data stolen from FlexBooker, a popular online appointment scheduling tool for booking services ranging from counseling to haircuts, on a cybercriminal forum. FlexBooker sent a notification to its users, explaining that its Amazon AWS servers were compromised by what the company was able to identify as a distributed denial-of-service (DDoS) attack. FlexBooker customers include the brands GoDaddy, Chipotle, Bausch Lomb and Krewe.

See the full report here: https://threatpost.com/flexbooker-records-dumped-hacker-forum/177460/

Cyberattackers Hit Data of 80K Fertility Patients

Fertility Centers of Illinois (FCI) reported a data breach on December 27, 2021 that impacted the health information of nearly 80,000 patients. According to FCI’s data breach notice, the organization first detected suspicious activity on its internal systems on Feb. 1, 2021. A subsequent investigation indicated that security systems had blocked attackers from accessing patient EMR (electronic medical records) systems. However, the intruder(s) managed to access administrative files and folders. As of now, the organization is not aware of any actual or attempted misuse of patient information due to this incident.

See the full report here: https://threatpost.com/cyberattackers-data-80k-patients-fertility-centers-illinois/177467/

Hackers Have Been Sending Malware-Filled USB Sticks to U.S. Companies Disguised as Presents

According to the FBI, a hacking group has been sending malware-infected USB devices to companies in the defence, transportation, and insurance industries. FIN7, the hacking group behind this criminal behaviour, has made considerable efforts to make their packages appear legitimate. In some cases, items were portrayed as being sent by the US Department of Health and Human Services, with messages stating that the drives included critical information about COVID-19 guidelines.

See the full report here: https://gizmodo.com/hackers-have-been-sending-malware-filled-usb-sticks-to-1848323578

Facebook Launches 'Privacy Center' to Educate Users on Data Collection and Privacy Options

Meta Platforms, formerly known as Facebook, announced the launch of a centralised Privacy Center with the goal of educating people about how it gathers and handles personal information across its social media apps. The learning hub is expected to be limited to a small group of people who use Facebook on the desktop in the United States at first, with plans to expand to a larger group of users and more of Facebook's apps in the coming months.

See the full report here: https://thehackernews.com/2022/01/facebook-launches-privacy-center-to.html

Trojanized dnSpy app drops malware cocktail on researchers, devs

Hackers recently launched a sophisticated malware campaign aimed at cybersecurity researchers and developers, spreading a malicious version of the dnSpy.NET tool to install cryptocurrency stealers, remote access trojans, and miners. dnSpy is a popular debugger and .NET assembly editor used to debug, modify, and decompile .NET programs. Cybersecurity researchers commonly use this program when analyzing .NET malware and software.

See the full report here: https://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/

Log4J-Related RCE Flaw in H2 Database Earns Critical Rating

JFrog security researchers discovered a critical flaw in the H2 open-source Java SQL database similar to the Log4J vulnerability, but do not pose a widespread threat. However, this flaw (CVE-2021-42392) does not pose the same risk as the previously identified in Log4Shell due to a few conditions and factors. The JFrog team recommends that all users of the H2 database, upgrade to version 2.0.206, which fixes CVE-2021-42392 by limiting JNDI URLs to use the local java protocol only, denying any remote LDAP/RMI queries.

See the full report here: https://threatpost.com/log4j-related-flaw-h2-database/177448/

Kuwait webs in grip of hackers - ARAB TIMES - KUWAIT NEWS - Arab Times Kuwait English Daily

According to the Al-Qabas daily, the Dark Web site known for selling and trading stolen data revealed proof that 887 Kuwaiti websites had fallen into the hands of vested interests and had been hacked over the past days, as well as a massive amount of data and information, including more than 4,360 files. The hacked websites ranged from the government to commercial institutions, and they worked in industries such as education, communications, and online shopping.

See the full report here: https://www.arabtimesonline.com/news/kuwait-webs-in-grip-of-hackers/

Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps - BleepingComputer

Developers of open-source libraries "colors" and "faker" intentionally introduced an infinite loop that disrupted thousands of projects that depend on these libraries. This was reportedly a stance taken by the developer against the use of such open-source software by commercial entities.

See the full report here: https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

Amazon Denies Wikileaks Hackers Caused Outage - TNT Magazine

Amazon has denied speculations that it faced a DDOS attack launched by Wikileaks-supporting hackers. The company instead stated that the brief stoppage was due to a power outage. Amazon was among the first American companies to stop providing services to WikiLeaks.

See the full report here: https://www.tntmagazine.com/archive/amazon-denies-wikileaks-hackers-caused-outage/

Australian Bunnings Customers Appear To Be Caught Up in FlexBooker Breach - Gizmodo Australia

Bunnings Group, trading as Bunnings Warehouse, is an Australian household hardware chain. Bunnings has become the latest known victim of the Flexbooker data breach. The reports indicate that private customer data has been exposed.

See the full report here: https://www.gizmodo.com.au/2022/01/bunnings-customers-flexbooker-breach/

Minnesota trucking company hit in 2nd ransomware attack - FreightWaves

Minnesota trucking company Bay & Bay Transportation says it was recently targeted in a ransomware attack for the second time since 2018. The company was targeted by a ransomware gang called Conti. The ransomware group acts as a service provider — provides malware, an extortion platform, and support to affiliates, who get a percentage of the payments made by victims.

See the full report here: https://www.freightwaves.com/news/minnesota-trucking-company-hit-in-2nd-ransomware-attack

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

Researchers have discovered inconsistencies in 16 URL parsing libraries that could be exploited to bypass validations. Such vulnerabilites can be used by threat actors to cause denial-of-service conditions, information leaks, or possibly remote code execution.

See the full report here: https://thehackernews.com/2022/01/researchers-find-bugs-in-over-dozen.html

WordPress 5.8.3 security update fixes SQL injection, XSS flaws - BleepingComputer

WordPress has released a new version that addresses four vulnerabilities (three of which are rated of high importance). None of these have been observed to be actively exploited in the wild. It is recommended that all WordPress site owners upgrade to version 5.8.3.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-583-security-update-fixes-sql-injection-xss-flaws/

Abcbot botnet has now been linked to Xanthe cryptojacking group

Security researchers have identified a link between the Abcbot botnet and the cryptojacking group Xanthe. This indicates that the same threat actor is likely responsible for both Xanthe and Abcbot. Meanwhile, the group seems to be shifting its objective from mining cryptocurrency on compromised hosts to other activities, such as DDoS attacks.

See the full report here: https://www.zdnet.com/article/abcbot-botnet-has-now-been-linked-to-xanthe-cryptojacking-group/

Microsoft: powerdir bug gives access to protected macOS user data - BleepingComputer

TCC (Transparency, Consent, and Control ) is a security tech designed to block apps from accessing sensitive user data by allowing macOS users to configure privacy settings for the apps installed on their systems and devices connected to their Macs, including cameras and microphones. Microsoft says threat actors could use a macOS vulnerability to bypass TCC technology to access users protected data.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-powerdir-bug-gives-access-to-protected-macos-user-data/

Linux version of AvosLocker ransomware targets VMware ESXi servers - BleepingComputer

AvosLocker is a new ransomware that was first observed on July 4, 2021, and follows the RaaS model. It has added support for encrypting Linux systems to its recent malware variants, specifically targeting VMware ESXi virtual machines.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-version-of-avoslocker-ransomware-targets-vmware-esxi-servers/

Jackson Hospital IT department investigates possible computer hack - WMBB - mypanhandle.com

The IT department of Jackson Hospital shut down its servers after an outside vendor notified the hospital administrators at about 11:00 Sunday night about the potential presence of ransomware. Now they are starting to slowly reboot the hospital’s entire computer system.

See the full report here: https://www.mypanhandle.com/news/local-news/jackson-county/jackson-hospital-it-department-investigates-possible-computer-hack/

Firefox Focus now blocks cross-site tracking on Android devices - BleepingComputer

Mozilla has added Total Cookie Protection to Firefox Focus, its lightweight browser for mobile platforms. This feature forces all sites to keep their cookies in separate jars, blocking attempts to track users across the web and build browsing profiles.

See the full report here: https://www.bleepingcomputer.com/news/security/firefox-focus-now-blocks-cross-site-tracking-on-android-devices/

‘Wormable’ Flaw Leads January 2022 Patch Tuesday

Microsoft's latest Patch Tuesday provides fixes for six zero-day vulnerabilities and plugs nearly 120 security holes in Windows and supported software. One of the flaws is “wormable,” meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.

See the full report here: https://krebsonsecurity.com/?p=58072

New KCodes NetUSB Bug Affect Millions of Routers from Different Vendors

Researchers have discovered a high-severity flaw (CVE-2021-45608) in KCodes' NetUSB component, which is used in routers from Netgear, TP-Link, etc. It can allow attackers to execute malicious code remotely in the kernel. The only fix is to update the firmware of the router, if an update is available.

See the full report here: https://thehackernews.com/2022/01/new-kcodes-netusb-bug-affect-millions.html

Clarins hit by security breach, SG customers' personal details at risk - Marketing Interactive

Clarins is a family-run French multinational cosmetics company, which was founded in Paris. The firm has suffered a data security breach caused by a critical vulnerability in a widely used software known as Log4j. The compromised data may contain Singapore customers' personal information.

See the full report here: https://www.marketing-interactive.com/clarins-suffers-hit-by-security-breach-sg-customers-personal-details-at-risk

Critical SonicWall NAC Vulnerability Stems from Apache Mods

Security researchers at Rapid7 have discovered the flaws in Sonic Wall’s Secure Mobile Access (SMA) 100 series of devices, which includes SMA 200, 210, 400, 410, and 500v. SonicWall critical flaw allows unauthenticated remote code execution (RCE) on affected devices.

See the full report here: https://threatpost.com/sonicwall-nac-vulnerability-apache-mods/177529/

New RedLine malware version spread as fake Omicron stat counter - BleepingComputer

RedLine info-stealer is being distributed via emails using a fake COVID-19 Omicron stat counter app as a lure. RedLine targets user account credentials stored on the browser, VPN passwords, credit card details, cookies, IM content, FTP credentials, cryptocurrency wallet data, and system information.

See the full report here: https://www.bleepingcomputer.com/news/security/new-redline-malware-version-spread-as-fake-omicron-stat-counter/

Hackers Use Cloud Services to Distribute Nanocore, Netwire, and AsyncRAT Malware

Hackers are using public cloud services from Amazon and Microsoft to deliver commodity remote access trojans (RATs) such as Nanocore, Netwire, and AsyncRAT. Thus, they don't need to host their own servers and also evade detection by security solutions while conducting spear-phishing attacks.

See the full report here: https://thehackernews.com/2022/01/hackers-use-cloud-services-to.html

Hackers take over diplomat's email, target Russian deputy minister - BleepingComputer

Hackers have compromised the email account of a staff member of Russia’s Ministry of Foreign Affairs (MID) and deployed spear-phishing attacks against the country’s diplomats. The malware used was Konni, which is a remote administration tool (RAT) associated with North Korean hackers known as APT37.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-take-over-diplomats-email-target-russian-deputy-minister/

OceanLotus hackers turn to web archive files to deploy backdoors - BleepingComputer

The threat actor group OceanLotus is using the web archive file format (.MHT and .MHTML) to deploy backdoors to compromised systems. This helps them evade detection by antivirus solutions tools, which flag the more commonly abused document formats.

See the full report here: https://www.bleepingcomputer.com/news/security/oceanlotus-hackers-turn-to-web-archive-files-to-deploy-backdoors/

New Windows KB5009543, KB5009566 updates break L2TP VPN connections - BleepingComputer

After installing the recent Windows update, Windows users find their L2TP VPN connections broken when attempting to connect using the Windows VPN client. The bug is not affecting all VPN devices and seems only to be affecting users using the built-in Windows VPN client to make the connection.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-kb5009543-kb5009566-updates-break-l2tp-vpn-connections/

Magniber ransomware using signed APPX files to infect systems - BleepingComputer

The Magniber gang is known for its use of vulnerabilities to breach systems and deploy their ransomware. It has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.

See the full report here: https://www.bleepingcomputer.com/news/security/magniber-ransomware-using-signed-appx-files-to-infect-systems/

Apple fixes doorLock bug that can disable iPhones and iPads - BleepingComputer

Apple has released security updates to address a persistent denial of service (DoS) dubbed doorLock that would altogether disable iPhones and iPads running HomeKit on iOS versions 14.7 and later. The doorLock vulnerability will crash affected iOS and iPadOS devices when processing maliciously crafted HomeKit accessory names.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-fixes-doorlock-bug-that-can-disable-iphones-and-ipads/