Threat Intelligence Bulletin: 01/14/2022 - 01/20/2022

REvil Takedown: Temporary or Permanent?

On January 14, 2022, Russia’s Federal Security Service (FSB) announced that it had arrested several alleged members of the REvil ransomware group. Although several affiliates were arrested in 2021 globally, this event is notable in that it marks the first time that Russia has publicly cooperated with a request to take action against ransomware operators within its borders. The actions taken against REvil come after a period of inactivity by the group caused by an unidentified third party gaining control of its Tor onion domain in October. ZeroFox does not expect the arrests by the FSB to have a lasting impact on the activities of the threat actors behind REvil or to suppress the broader ransomware threat in the long term.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up to date with all patches and rule sets.
• Enable two-factor authentication for all organizational accounts to help mitigate phishing and credential stuffing attacks.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Avoid opening unsolicited attachments and never click suspicious links.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Review network logs for potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of the relevant entities receives an alert, ZeroFox Intel Research and Analysis recommends immediate password changes for the affected account.

What Happened?

On January 14, 2022, Russia’s FSB announced that it had arrested several alleged members of the REvil ransomware group – also known as Sodinokibi – after raids covering 25 locations and 14 individuals. In the announcement, the FSB also stated that the search was conducted after an appeal by U.S. authorities.¹ ZeroFox has reported on more than 150 victims of REvil between January and October 2021, including large-scale attacks on JBS Foods and Kaseya. Out of the 14 people arrested, eight names were made public:

• Bessonov, Andrey
• Golovachuk, Mikhail A.
• Khansvyarov, Ruslan A.
• Korotayev, Dmitry V.
• Malozemov, Alexei V.
• Muromsky, Roman
• Puzyrevsky, D.D.
• Zayets, Artem N.

Each of the suspects has been jailed for two months and is under investigation for “Illegal Circulation of Payments” which could result in up to eight years in prison and up to one million rubles (roughly USD 13,000) in fines. Although only 14 alleged members have been arrested, FSB claims to have identified the entire REvil group. The raids followed multiple requests by the United States for the Kremlin to help shut down such groups. These latest arrests come on the heels of a worldwide crackdown on ransomware groups in 2021, including Europol reportedly arresting seven affiliates between February and November and the U.S. arrest of one affiliate and the indictment of another.^{2 3}

What Does This Mean?

Although these arrests may be detrimental or even fatal to the REvil brand, ZeroFox does not expect them to have a lasting impact on the activities of the threat actors behind the operation or to suppress the broader ransomware threat in the long term. These individuals’ roles within REvil’s collective have not yet been disclosed, though it is unlikely they are core members. REvil’s malicious activity dropped in Q4 2021, likely in part due to growing retaliatory action by U.S. authorities.⁴ ZeroFox assesses that this latest disruption will likely drive core members to rebrand their operation before restarting malicious activities.

As Russia has repeatedly ignored calls to take action against ransomware operators based within its borders,⁵ the timing of the disruption indicates ulterior political motives rather than the start of a true Russian law enforcement campaign against domestic cyber threat actors. Specifically, these arrests were announced on the same day that the U.S. accused Russia of sending saboteurs into Ukraine to create a pretext for invasion, and hackers shut down dozens of Ukrainian government websites — an attack alleged by Kyiv to have originated in Russia.⁶ Russia may seek to leverage disruptive activity for diplomatic purposes, particularly amidst escalating tensions on the border with Ukraine and threats of sanctions against Russia.⁷

Is This the End of REvil?

ZeroFox assesses that, although the arrests of any affiliate or operator of a ransomware group within Russia sends a message, it is unlikely that the recent efforts against REvil will be the end of the group, as the arrested individuals are not believed to be “core” members that operated this ransomware-as-a-service (RaaS).⁸ It is also not uncommon for affiliates or members of ransom groups to operate within multiple groups at once. If the remaining members do not continue operations as REvil or rebrand—as they have previously done after operating as Gandcrab⁹— they may continue to conduct attacks through other new or existing groups.

In September 2021, shortly after the group returned from a brief hiatus, a forum user by the name of “lo0o0o0ong” accused REvil of creating a backdoor in its ransomware. With the way REvil performed file encryption, the group’s operators could recover victims’ encrypted files without the assistance of their affiliates. This opened the door to REvil potentially bypassing the affiliate and taking the full ransom payment for themselves. In later posts, LockBit representative “LockBitSupp” also seemed to confirm that REvil had been scamming affiliates in this manner.

Figure 1. LockBit representative LockBitSupp seemingly confirming complaints of REvil taking over ransom negotiations and payments
Source: ZeroFox Research

In October 2021, a member of REvil posted on underground forums that an unknown third party had compromised the private key for their Tor hidden service after the disappearance of one of their members. After this incident, the group stopped all public ransom activity. ZeroFox has not seen any activity from REvil since October 4, 2021.

Figure 2. Actor 0_neday announcing that a third party obtained the private key to REvil’s Tor hidden service
Source: ZeroFox Research

1: hXXp://www[.]fsb[.]ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html
2: hXXps://www[.]europol.europa.eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged
3: hXXps://krebsonsecurity[.]com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/
4: hXXps://www[.]independent.co.uk/news/world/americas/us-politics/revil-ransomware-attacks-russia-hack-b1953821.html
5: ​​hXXps://www[.]reuters[.]com/technology/ biden-pressed-putin-call-act-ransomware-attacks-white-house-2021-07-09/
6: hXXps://www[.]nytimes[.]com/2022/01/14/us/politics/russia-ukraine-us-intelligence.html
7: hXXps://www[.]nytimes[.]com/2022/01/08/us/politics/us-sanctions-russia-ukraine.html
8: hXXps://twitter[.]com/y_advintel/status/1482376988933464071
9: hXXps://www[.]darkreading[.]com/attacks-breaches/ gandcrab-devlopers-behind-destructive-revil-ransomware

Breaking News: 2022-01-14 - 2022-01-20

Ukranian police arrests ransomware gang that hit over 50 firms - BleepingComputer

Ukrainian police have arrested a group responsible for ransomware attacks on at least 50 companies in the U.S. and Europe (with losses estimated at over a million U.S. dollars). The strain of the ransomware used in their attacks hasn't been revealed yet, but the attack mode was spam emails.

See the full report here: https://www.bleepingcomputer.com/news/security/ukranian-police-arrests-ransomware-gang-that-hit-over-50-firms/

Researchers Decrypted Qakbot Banking Trojan’s Encrypted Registry Keys

Cybersecurity researchers have decoded the mechanism by which the Qakbot (also known as QBot, QuackBot and Pinkslipbot) banking trojan handles the insertion of encrypted configuration data into the Windows Registry. The SHA1 hash result will be used as a derived key to decrypt the registry key value data, the researchers stated.

See the full report here: https://thehackernews.com/2022/01/researchers-decrypted-qakbot-banking.html

North Korea kicked off internet by suspected DDOS attack - NK News

Crucial servers inside North Korea were reportedly unreachable for several hours, resulting in North Korea temporarily disappearing from the internet. The patterns of failing connectivity indicate a distributed denial-of-service (DDOS) attack.

See the full report here: https://www.nknews.org/?p=909950

New GootLoader Campaign Targets Accounting, Law Firms

The GootLoader malware gang is actively targeting employees of law and accounting firms with malicious downloads. WordPress vulnerabilities let the attackers easily hijack sites offering sample business agreements. The best way for accounting and law firms to protect their systems is to stop employees from downloading files from the web.

See the full report here: https://threatpost.com/gootloader-accounting-law-firms/177629/

Hackers are exploiting Adobe Creative Cloud to harvest user credentials - TechRadar

Hackers are utilizing the popularity of Adobe Creative Cloud to bypass email security solutions and harvest user credentials. They are importing malicious PDF files into Adobe's cloud storage and sharing them via Adobe Creative Cloud. This allows them to evade Advanced Threat Protection (ATP) and other endpoint protection software.

See the full report here: https://www.techradar.com/news/hackers-are-exploiting-adobe-creative-cloud-to-harvest-user-credentials

Microsoft Defender weakness lets hackers bypass malware detection - BleepingComputer

Threat actors can take advantage of a weakness that affects Microsoft Defender antivirus on Windows to learn locations excluded from scanning and plant malware there. This affects Windows 10 21H1 and Windows 10 21H2.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-weakness-lets-hackers-bypass-malware-detection/

Microsoft pulls new Windows Server updates due to critical bugs - BleepingComputer

Windows Server admins have been struggling with severe issues with their servers following the release of the January Patch Tuesday, which includes KB5009624 for Windows Server 2012 R2, KB5009557 for Windows Server 2019, and KB5009555 for Windows Server 2022. Admins were complaining of Hyper-V no longer starting on servers, main controllers going through an endless reboot loop, and ReFS volumes becoming inaccessible and showing as RAW file systems.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-pulls-new-windows-server-updates-due-to-critical-bugs/

AWS fixes security flaws that exposed AWS customer data - BleepingComputer

AWS Glue security issue has been addressed by Amazon Web Services. This issue allowed attackers to access and alter data linked to other AWS customer accounts. AWS Glue is a serverless cloud data integration service that helps discover, prepare, and combine data for app development, machine learning, and analytics.

See the full report here: https://www.bleepingcomputer.com/news/security/aws-fixes-security-flaws-that-exposed-aws-customer-data/

Android users can now disable 2G to block Stingray attacks - BleepingComputer

Users can now disable 2G connections on Android, which come with a host of privacy and security problems exploited by cell-site simulators. A cell-site simulator, also known as “stingray” or IMSI Catcher, is a device that masquerades as a cell tower, forcing cell phones in their range to connect to it.

See the full report here: https://www.bleepingcomputer.com/news/security/android-users-can-now-disable-2g-to-block-stingray-attacks/

Goodwill discloses data breach on its ShopGoodwill platform - BleepingComputer

American nonprofit Goodwill has disclosed a data breach that affected the accounts of customers using its ShopGoodwill.com e-commerce auction platform. The incident resulted in the exposure of personal contact information to an unauthorized third party. This contact information included your first and last name, email address, phone number, and mailing address. The company confirmed that no payment information was exposed in the incident as they are not stored on its servers.

See the full report here: https://www.bleepingcomputer.com/news/security/goodwill-discloses-data-breach-on-its-shopgoodwill-platform/

Critical Cisco Contact Center Bug Threatens Customer-Service Havoc

Cisco has disclosed a critical security bug affecting Unified Contact Center Enterprise (UCCE) portfolio that could allow attackers to access and modify agent resources, telephone queues and other customer-service systems and access personal information on companies’ customers. The bug is tracked as CVE-2022-20658 with a CVSS score of 9.6 out of 10 and could allow authenticated, remote attackers to elevate their privileges to administrator, with the ability to create other administrator accounts. Cisco has released patches to address this vulnerability.

See the full report here: https://threatpost.com/critical-cisco-contact-center-bug/177681/

Multiple Ukrainian government websites hacked and defaced - BleepingComputer

The Ukrainian cyber-police announced that at least 15 websites belonging to various Ukrainian public institutions were compromised, defaced, and subsequently taken offline. This included the websites of the ministry of foreign affairs, agriculture, education and science, security and defense, and the online portal for the cabinet of ministers. According to some sources, all the compromised Ukrainian sites were using an outdated version of the October CMS, vulnerable to CVE-2021-32648, which is a critical authentication flaw allowing an attacker to send a specially crafted request to perform a password reset on the platform, thus taking over admin accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/multiple-ukrainian-government-websites-hacked-and-defaced/

Qlocker ransomware returns to target QNAP NAS devices worldwide - BleepingComputer

Threat actors behind the Qlocker ransomware are targeting QNAP Network Attached Storage (NAS) devices that are open to the Internet. Attackers were using the CVE-2021-28799 hard-coded credentials vulnerability in the HBS 3 Hybrid Backup Sync software to get access to customers' devices and lock their files, according to QNAP.

See the full report here: https://www.bleepingcomputer.com/news/security/qlocker-ransomware-returns-to-target-qnap-nas-devices-worldwide/

US Military Ties Prolific MuddyWater Cyberespionage APT to Iran

According to the US Cyber Command, MuddyWater is an advanced persistent threat (APT) cyberespionage actor that has historically targeted government victims in the Middle East. MuddyWater has been spotted employing a number of ways to keep access to victim networks.

See the full report here: https://threatpost.com/us-military-ties-muddywater-cyberespionage-apt-iran/177633/

SnatchCrypto campaign plants backdoors in crypto startups, DeFi, blockchain networks

Researchers have identified a new campaign aimed at emptying the cryptocurrency wallets of organizations in the banking and crypto sectors. The effort, dubbed SnatchCrypto, is the work of BlueNoroff, an advanced persistent threat (APT) group suspected of being linked to the Lazarus APT, according to Kaspersky experts. The victim countries include Russia, Poland, the United States, Hong Kong, Singapore, China, and other countries.

See the full report here: https://www.zdnet.com/article/snatchcrypto-campaign-plants-backdoors-in-crypto-exchanges-defi-blockchain-networks/

Researchers develop CAPTCHA solver to aid dark web research

A group of researchers from the Universities of Arizona, Georgia, and South Florida have developed a machine-learning-based CAPTCHA solver that can answer 94.4 percent of real problems on dark websites, according to the researchers. The study's purpose was to develop a system that might automate cyber threat intelligence, which now relies on humans to manually solve CAPTCHAs.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-develop-captcha-solver-to-aid-dark-web-research/

Microsoft Finds Destructive Malware in Attacks Targeting Ukraine - Bloomberg

Microsoft Corp. has observed “destructive malware” in systems belonging to several Ukrainian government agencies and organizations that work with the authorities. The malware is disguised as ransomware but, if activated, it would render the infected computer system inoperable. Microsoft has already built and deployed protections for this malware into Microsoft 365 Defender Endpoint Detection and Anti-virus protections wherever these products are deployed, both on-premises and in the cloud. There is no indication so far that these attacks utilize any vulnerability in Microsoft products and services.

See the full report here: https://www.bloomberg.com/news/articles/2022-01-16/microsoft-finds-destructive-malware-in-attacks-targeting-ukraine

AWS fixes security flaws allowing access to AWS customer data - BleepingComputer

Amazon Web Services (AWS) has addressed an AWS Glue security issue that allowed attackers to access and alter data linked to other AWS customer accounts. AWS Glue is a serverless cloud data integration service. The flaw found in an exploitable AWS Glue feature and an internal service API misconfiguration that allowed Orca Security researchers to escalate privileges and further gain unrestricted access to all service resources. AWS added that their findings were uncovered using only Orca Security-owned AWS accounts. The AWS Glue service team deployed full mitigation for the Superglue vulnerability in just a few days, preventing potential attackers from accessing AWS Glue customers' data.

See the full report here: https://www.bleepingcomputer.com/news/security/aws-fixes-security-flaws-allowing-access-to-aws-customer-data/

GootLoader Hackers Targeting Employees of Law and Accounting Firms

A campaign by GootLoader, a stealthy malware setting their sights on employees of accounting and law firms for widespread cyberattacks to infect systems with ransomware or other lethal malware. Malware can be delivered via many methods, including poisoned search results, fake updates, and trojanized applications downloaded from malicious sites . The Goal of GootLoader could be intelligence gathering and also to deliver additional damaging payloads, including Cobalt Strike and ransomware. To mitigate such threats, the organizations put in place a vetting process for business agreement samples, train employees to open documents only from trusted sources.

See the full report here: https://thehackernews.com/2022/01/gootloader-hackers-targeting-employees.html

Raspberry Pi Can Detect Malware Using Electromagnetic Waves, Say Researchers - India Times

Raspberry Pi, a computer that is largely used for experimental pet projects by people can now be used to discover malware by employing the power of electromagnetic waves in high precision. It was developed by a team from the Research Institute of Computer Science and Random Systems (IRISA) in France, the malware detection mechanism used Raspberry Pi to scan devices for specific electromagnetic waves. The researchers claimed to have recorded 100,000 traces of an Internet of Things (IoT) device that was infected with multiple malware samples. The mechanism worked for the team was able to predict three common types of malware with an accuracy of 99.82%.

See the full report here: https://www.indiatimes.com/technology/news/raspberry-pi-can-detect-malware-559086.html

New Unpatched Apple Safari Browser Bug Allows Cross-Site User Tracking

A bug in Apple Safari 15's implementation of the IndexedDB API could reportedly be abused by threat actors. A malicious website can use it to track users' online activity in the browser and even reveal their identity.

See the full report here: https://thehackernews.com/2022/01/new-unpatched-apple-safari-browser-bug.html

eNom data center migration mistakenly knocks sites offline - BleepingComputer

A data center migration from eNom web hosting provider caused unexpected domain resolution problems, affecting hundreds of domains. It resulted in customers not being able to access their websites and emails.

See the full report here: https://www.bleepingcomputer.com/news/security/enom-data-center-migration-mistakenly-knocks-sites-offline/

Hackers target Twitter account of Thai Revenue Department - The Thaiger

According to the Anti-Fake News Centre of Thailand, the hackers deleted almost all previous legitimate tweets by the Revenue Department and changed the name of the account to Revenue/NFT. The Thai Revenue Department has warned the public to be extremely wary of information appearing on its Twitter account after it was attacked by unknown hackers.

See the full report here: https://thethaiger.com/news/national/twitter-account-of-thai-revenue-department-hacked

Shentel email service interrupted by ransomware attack | Nvdaily | nvdaily.com - Northern Virginia Daily

Due to a ransomware attack on the company’s third-party email provider (Mail2World), Shentel email customers have been without access to their email accounts for several days. The firm has put up a message on its website stating that the issue is being worked on and data is safe.

See the full report here: https://www.nvdaily.com/nvdaily/shentel-email-service-interrupted-by-ransomware-attack/article_4798579e-a98c-5e3b-bd21-3cb6ee1481d0.html

Umbrella company Parasol Group confirms cyber attack as 'root cause' of prolonged network outage

Parasol Group, an umbrella company, has confirmed that it found unauthorised activity from an intruder on its network. The company stated this as an explanation for why it had to shut down parts of its systems last week. The company's investigations indicate customers' personal information has not been extracted during the incident.

See the full report here: https://www.theregister.com/2022/01/17/umbrella_company_parasol_group_confirms/

Dark Web's Largest Marketplace for Stolen Credit Cards is Shutting Down

UniCC, the biggest dark web marketplace for stolen credit and debit cards, is shutting down operations. The group has been functional since 2013 and has reportedly earned $358 million (in various cryptocurrencies) from its operations.

See the full report here: https://thehackernews.com/2022/01/dark-webs-largest-marketplace-for.html

Chrome Limits Websites' Direct Access to Private Networks for Security Reasons

Google Chrome will prohibit public websites from directly accessing endpoints located within private networks. This change will be rolled out in two phases (Chrome 98 and Chrome 101) in the coming months.

See the full report here: https://thehackernews.com/2022/01/chrome-limits-websites-access-to.html

Cyber espionage campaign targets renewable energy companies - BleepingComputer

A large-scale cyber-espionage campaign has been discovered that primarily targets renewable energy and industrial technology organizations. The campaign's targets include Schneider Electric, Honeywell, Huawei, and other prominent entities. The goal is apparently to steal login credentials of personnel at such organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/cyber-espionage-campaign-targets-renewable-energy-companies/

Zoho plugs another critical security hole in Desktop Central - BleepingComputer

Zoho has addressed a new critical severity vulnerability that affects the company's Desktop Central and Desktop Central MSP unified endpoint management (UEM) solutions. It has tracked the security flaw as CVE-2021-44757. If exploited, this vulnerability may allow an attacker to read unauthorized data or write an arbitrary zip file on the server.

See the full report here: https://www.bleepingcomputer.com/news/security/zoho-plugs-another-critical-security-hole-in-desktop-central/

DHL dethrones Microsoft as most imitated brand in phishing attacks - BleepingComputer

DHL took over the top spot of Check Point Research's list of the most imitated brands among cybercriminals this year, surpassing Microsoft and Google as the brand used most often in phishing emails and scams.

See the full report here: https://www.bleepingcomputer.com/news/security/dhl-dethrones-microsoft-as-most-imitated-brand-in-phishing-attacks/

Microsoft releases emergency fix for January Windows update issues - BleepingComputer

Microsoft has released emergency out-of-band (OOB) updates to address multiple issues caused by Windows Updates issued during the January 2021 Patch Tuesday. This update addresses issues related to VPN connectivity, Windows Server Domain Controllers restarting, Virtual Machines start failures and ReFS-formatted removable media failing to mount.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-oob-updates-for-january-windows-update-issues/

Nintendo warns of spoofed sites pushing fake Switch discounts - BleepingComputer

Nintendo Co., Ltd. is a Japanese multinational video game company headquartered in Kyoto, Japan. It develops video games and video game consoles. It is warning online shoppers of fake websites selling discounted Switch consoles. It also alerted customers of the risks behind buying from fake sites, including the theft of personal and financial information that could allow the attackers to use it for fraudulent purposes, including identity theft.

See the full report here: https://www.bleepingcomputer.com/news/security/nintendo-warns-of-spoofed-sites-pushing-fake-switch-discounts/

Fashion giant Moncler confirms data breach after ransomware attack - BleepingComputer

Italian fashion giant Moncler has confirmed a data breach after files were stolen by the AlphV/BlackCat ransomware operation in December. Some data relating to employees, customers, and other business partners has been leaked on the dark web. However, no data regarding credit cards or other payment methods is involved.

See the full report here: https://www.bleepingcomputer.com/news/security/fashion-giant-moncler-confirms-data-breach-after-ransomware-attack/

Earth Lusca Hackers Aimed at High-Value Targets in Government and Private Sectors

A threat actor – Earth Lusca – is striking organizations across the world in a campaign seemingly aimed at both espionage and monetary profits. Its targets include high-value entities such as government and educational institutions, religious movements, pro-democracy and human rights organizations, media bodies, and cryptocurrency companies.

See the full report here: https://thehackernews.com/2022/01/earth-lusca-hackers-aimed-at-high-value.html

Researchers Bypass SMS-based Multi-Factor Authentication Protecting Box Accounts

Cybersecurity researchers discovered a bug in the multi-factor authentication (MFA) mechanism of Box, the cloud-based content-management company. This could allow an attacker to use stolen credentials to compromise a Box account and access sensitive data without access to the victim's phone. The bug has subsequently been patched by Box.

See the full report here: https://thehackernews.com/2022/01/researchers-bypass-sms-based-multi.html

S. Korea's spy agency detects malware infection in over 100 local IoT devices - Yonhap News

South Korea's state intelligence agency said that it has identified more than 100 sets of Internet of Things (IoT) equipment in the country that have been infected with malware. The infected equipment, which can be used in distributed denial-of-service (DDoS) attacks to disrupt server traffic, includes CCTVs, internet routers, and digital video recorders.

See the full report here: https://en.yna.co.kr/view/AEN20220119005100325

Beijing 2022 Winter Olympics app bursting with privacy risks - BleepingComputer

'My 2022' which is the official app for Beijing 2022 Winter Olympics was found to be insecure when it comes to protecting the sensitive data of its users. The app's encryption system carries a significant flaw that enables middle-men to access documents, audio, and files in cleartext form.

See the full report here: https://www.bleepingcomputer.com/news/security/beijing-2022-winter-olympics-app-bursting-with-privacy-risks/

New White Rabbit ransomware linked to FIN8 hacking group - BleepingComputer

According to recent research findings, a new ransomware family called 'White Rabbit' appeared in the wild which could be a side-operation of the FIN8 hacking group. FIN8 is a financially motivated actor who has been spotted targeting financial organizations, primarily by deploying POS malware that can steal credit card details.

See the full report here: https://www.bleepingcomputer.com/news/security/new-white-rabbit-ransomware-linked-to-fin8-hacking-group/

Red Cross cyberattack exposes data of 515,000 people seeking missing family - BleepingComputer

The International Committee of the Red Cross has been the victim of a cyber-attack in which hackers seized the data of more than 515,000 extremely vulnerable people, some of whom had fled conflicts. There is no evidence so far that the compromised information had been leaked or put in the public domain.

See the full report here: https://www.bleepingcomputer.com/news/security/red-cross-cyberattack-exposes-data-of-515-000-people-seeking-missing-family/

DDoS IRC Bot Malware Spreading Through Korean WebHard Platforms

Threat actors are using IRC (Internet Relay Chat) bots to launch distributed denial-of-service (DDoS) attacks in South Korea. They are uploading malware-filled games to webhards (web hard drives or remote file hosting services). Users should be cautious with executables downloaded from a file-sharing website.

See the full report here: https://thehackernews.com/2022/01/ddos-irc-bot-malware-spreading-through.html

OpenSubtitles Hacked With A Data Breach Of 7 Million Subscribers - Fossbytes

OpenSubtitles, a website that provides free subtitles for movie fans, has disclosed that it was hacked last year and subsequently paid a ransom to silence the hacker about the attack. The data of 6,783,158 users who were registered on its site was stolen following the incident. The exposed information included email, username, and MD5 password hashes.

See the full report here: https://fossbytes.com/opensubtitles-hacked-data-breach-7-million-users/

Donot Team APT will strike gov't, military targets for years - until they succeed

Researchers have detailed the inner workings of Donot Team (also known as APT-C-35 and SectorE02). The threat group is notorious for persistently striking the same targets for years, if needed, till it is able to break through. Its primary focus is governmental and military entities in South Asian countries.

See the full report here: https://www.zdnet.com/article/donot-team-apt-will-strike-govt-targets-for-years-until-they-succeed/

Marketing giant RRD confirms data theft in Conti ransomware attack - BleepingComputer

RR Donnelly (RRD) is a leading integrated services company offering communications, commercial printing, and marketing to enterprise clients. The firm has confirmed that threat actors stole data in a December cyberattack. The company also stated that they are taking all appropriate measures to protect its and clients' information.

See the full report here: https://www.bleepingcomputer.com/news/security/marketing-giant-rrd-confirms-data-theft-in-conti-ransomware-attack/

Office 365 phishing attack impersonates the US Department of Labor - BleepingComputer

A new phishing campaign involves impersonating the United States Department of Labor to steal Office 365 credentials from people. The attackers use fake domains, such as dol-gov[.]com, dol-gov[.]us, and bids-dolgov[.]us to mislead victims. These malicious sites prompt the victims to log in using Microsoft Office 365 credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-attack-impersonates-the-us-department-of-labor/

Microsoft: Hackers Exploiting New SolarWinds Serv-U Bug Related to Log4j Attacks - The Hacker News

Microsoft unveiled details of a new security vulnerability (tracked as CVE-2021-35247 (CVSS score: 5.3)) in SolarWinds Serv-U software on Wednesday. This flaw affected Serv-U version 15.2.5 and earlier and is addressed in Serv-U version 15.3. It is said to have been weaponized by threat actors to take advantage of Log4j’s flaws and spread attacks that invade the target.

See the full report here: https://thehackernews.com/2022/01/microsoft-hackers-exploiting-new.html

Russian Hackers Heavily Using Malicious Traffic Direction System to Distribute Malware

A platform called Prometheus is being marketed in Russian underground forums as a traffic distribution service (TDS). It apparently enables phishing redirection on a mass scale to rogue landing pages designed to deploy malware payloads on the targeted systems.

See the full report here: https://thehackernews.com/2022/01/russian-hackers-heavily-using-malicious.html

Crypto.com CEO admits hundreds of customer accounts were hacked - TechCrunch

Crypto.com, one of the world's largest cryptocurrency exchanges has reportedly suffered a hack, with at least $15 million worth of ETH stolen. The issue came to light when users began reporting that their funds were missing, even with those accounts where two-factor authorization was enabled. Crypto.com tweeted that it was pausing withdrawals after it received complaints from users.

See the full report here: https://techcrunch.com/2022/01/19/crypto-com-ceo-admits-hundreds-of-customer-accounts-were-hacked/

Zoom vulnerabilities impact clients, MMR servers

Zoom has patched two vulnerabilities that could have led to remote exploitation in clients and MMR (Multimedia Router) servers. The bugs related to a buffer overflow issue and an information leak security flaw.

See the full report here: https://www.zdnet.com/article/zoom-vulnerabilities-impact-clients-mmr-servers/

APS Resolves Ransomware Attack — Albuquerque Public Schools - Albuquerque Public Schools

School officials in Albuquerque, New Mexico had canceled classes for Thursday, Jan. 13, and Friday, Jan. 14 due to a cyberattack. The school officials came up with a workaround that allowed schools to open on Tuesday, Jan. 18. Due to the ongoing investigation, more details about the ransomware attack could not be disclosed.

See the full report here: https://www.aps.edu/news/news-from-2021-2022/aps-resolves-ransomware-attack

New BHUNT Password Stealer Malware Targeting Cryptocurrency Wallets

A new evasive crypto wallet stealer, BHUNT, has been spotted active in the wild. It targets wallet contents, passwords stored in the browser, and passphrases captured from the clipboard. It is suspected to be delivered via cracked software installers.

See the full report here: https://thehackernews.com/2022/01/new-bhunt-password-stealer-malware.html