Threat Intelligence Bulletin: 01/21/2022 - 01/27/2022

The Underground Economist: Volume 1, Issue 8

Welcome back to The Underground Economist, Issue 8, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of January 24, 2022.

New Shop Selling Stolen Credentials From Other Deep Web Marketplaces

New and untested threat actor “AccountzClub” announced the first official Deep Web shop brokering in compromised login credentials for other Deep Web marketplaces, on the English language Deep Web marketplace “KickAss”. The new shop, dubbed “Accountz Club”, features heavily discounted accounts for various Deep Web stores, including:

• Cc2btc[.]com
• Cvv2finder[.]hk
• Fullzinfo[.]com
• Genesis[.]market

Due to the criminal nature of these Deep Web stores, many do not require multi-factor authentication, making it easier for threat actors to compromise user accounts. Most of these stores do not allow users to withdraw funds from their accounts, allowing a threat actor with compromised login credentials to spend the remaining balances on various illicit items and services.

The actor’s announcement comes approximately one month after ZeroFox researchers observed logs containing similar account credentials for other Deep Web stores being sold on the botnet logs marketplace amigos[.]to, which subsequently halted operations permanently in December 2021.

Original post from threat actor “AccountzClub” announcing new Deep Web shop

Former Doxbin Owner Leaks Plaintext Passwords Of Users

In early January 2022, threat actor and former Doxbin owner “White” leaked a database containing the plaintext passwords of approximately 2,500 threat actors who use the website to post the personal information of their victims (AKA doxes). The leak will likely lead to new doxes being published across various Deep and Dark Web sources, as Doxbin has locked the accounts of all users who logged into the platform between November 9, 2021 and January 4, 2022.

During this stretch of time, “White” broke Doxbin by altering the source code, got doxed, and eventually sold the website back to the two original owners. In response to “White” leaking the database, current Doxbin owners and administrators “brenton” and “kt” revealed the identity of the threat actor as a 16-year-old living in the U.K. The two also promised to upload the full dox containing information about “White” to Doxbin, as they continue their work to repair the damage caused by the actor.

Original post from threat actors “brenton” and “kt” detailing the Doxbin ordeal

Actor Shares List Of 450,000 WordPress Websites

Well-regarded threat actor “joseph_salazar” recently shared a list containing the IP addresses of 450,000 hosts running WordPress sites, on the Russian language Deep Web forum xss[.]is. This could signal an increase in cyberattacks against WordPress websites. The actor claimed they used Shodan to detect the vulnerable WordPress websites in more than a dozen countries, including:

• Canada
• China
• United States
• Australia
• India

Within a week of sharing the list, new and untested threat actor “Zerrious” advertised a tool to compromise WordPress websites on XSS. The tool leverages lists containing compromised account credentials compiled from different data breaches (AKA combo lists) to perform credential stuffing attacks, with successful attempts granting threat actors access to the admin panels of valid WordPress sites. The actor charged approximately $30 USD per month for the tool.

Post from threat actor “Zerrious” advertising their tool to compromise WordPress accounts, less than one-week after the original threat actor, “joseph_salazar”, shared their list of IP addresses for WordPress sites

New Shop Emerges Selling Stolen Payment Card Data

New and untested threat actor “A L C A P O N E” advertised their new automated marketplace, which brokers in stolen payment card data, on the Russian language Deep Web carding forum club2crd[.]su. It should be noted that there has not been a large, high-quality vendor of payment card data since “Joker’s Stash” shut down in February 2021. However, with viable replacement shops like amigos[.]to already failing to fill the void, ZeroFox researchers assess that there is a chance for this new shop, dubbed “Cartel”, to step in.

The actor claimed the shop features:

• Firsthand skimmed cards with very high approval ratings
• Cards from various countries
• No resellers
• Products that are updated daily

2022 Beijing Olympics - Event Assessment

In this Event Assessment report, the ZeroFox Intelligence team provides an in-depth analysis of possible cyber and physical security concerns associated with the Beijing 2022 Olympic Games.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

• https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+-+Event+Assessment+-+2022+Winter+Olympics.pdf

Executive Summary

The 2022 Winter Olympics, officially known as the XXIV Olympic Winter Games and commonly known as Beijing 2022, will occur from 4 to 20 February 2022, in Beijing and towns in the neighboring Hebei province in the People’s Republic of China (PRC). Beijing 2022 will be open to spectators, but only if they live in mainland China due to rigorous COVID-19 procedures, which are yet to be announced. While the preparations are still unfolding, China has made clear that containing the virus is its top priority, as a result, athletes and visitors will face severe restrictions on their movement and a level of control never seen at the Games.

Breaking News: 2022-01-21 - 2022-01-27

WordPress plugin flaw puts users of 20,000 sites at phishing risk - BleepingComputer

The WordPress WP HTML Mail plugin had a high-severity flaw that could lead to code injection and the distribution of convincing phishing email. The bug was patched in version 3.1. WordPress site administrators should verify that they're running the latest version of the plugin.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-plugin-flaw-puts-users-of-20-000-sites-at-phishing-risk/

Cisco bug gives remote attackers root privileges via debug mode - BleepingComputer

Cisco has fixed a critical security flaw discovered in the Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software. It enables unauthenticated attackers to gain remote code execution (RCE) with root-level privileges on devices running the vulnerable software.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-bug-gives-remote-attackers-root-privileges-via-debug-mode/

Indonesia's central bank confirms ransomware attack, Conti leaks data - BleepingComputer

Indonesia’s central bank has been attacked by ransomware, but the risk from the attack had been mitigated and did not affect its public services as per the report from the bank officials. The Conti ransomware group has claimed the attack after leaking some files allegedly stolen from Bank Indonesia's network.

See the full report here: https://www.bleepingcomputer.com/news/security/indonesias-central-bank-confirms-ransomware-attack-conti-leaks-data/

VPNLab.net Shut Down for Helping Hackers Spread Ransomware - PCMag

Europol has taken down popular VPN service provider VPNLab.net following allegations about its connivance with ransomware hackers. According to the law enforcement agency, the firm was allegedly helping hackers in the distribution of malicious files and ransomware.

See the full report here: https://www.pcmag.com/news/vpnlabnet-shut-down-for-helping-hackers-spread-ransomware

Suspected hacking of central Japan's hospital server disrupts medical services - The Mainichi - The Mainichi

Kasugai Rehabilitation Hospital, in Japan, announced on Jan. 20 that it had temporarily shut down its server after experiencing trouble in the electronic medical chart and medical accounting systems. The officials have reported the damage to Aichi Prefectural Police as unauthorized access from outside was suspected.

See the full report here: https://mainichi.jp/english/articles/20220121/p2a/00m/0na/002000c

FBI links Diavol ransomware to the TrickBot cybercrime group - BleepingComputer

Diavol ransomware encrypts files of users by making use of user-mode Asynchronous Procedure Calls (APCs) with an asymmetric encryption algorithm. The FBI has formally linked the Diavol ransomware operation to the TrickBot Group, the malware developers behind the notorious TrickBot banking trojan.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/

Interpol Busted 11 Members of Nigerian BEC Cybercrime Gang

Law enforcement officials have arrested 11 people reportedly involved in business email compromise (BEC) attacks targeting more than 50,000 victims. Six of the 11 suspects are believed to be a part of a Nigerian cybercriminal gang, SilverTerrier (also known as TMT).

See the full report here: https://thehackernews.com/2022/01/interpol-busted-11-members-of-nigerian.html

New BHUNT Malware Targets Cryptocurrency Wallets via Software Installs – Bitcoin News - Bitcoin News

BHUNT, a new kind of malware which steals password targeting multiple cryptocurrency wallets via infected software installs. Once installed, the software can transfer the funds of the users to another wallet, and also steal other private data residing in the infected computer. The recommended way to defend against BHUNT is to avoid installing software from untrusted sources and to keep security solutions up to date.

See the full report here: https://news.bitcoin.com/new-bhunt-malware-targets-cryptocurrency-wallets-via-software-installs/

Critical Bugs in Control Web Panel Expose Linux Servers to RCE Attacks

Two critical security vulnerabilities in Control Web Panel that could be abused as part of an exploit chain to achieve pre-authenticated remote code execution on affected servers. Control Web Panel is an open-source Linux control panel software used for deploying web hosting environments. CVE-2021-45467 concerns a case of a file inclusion flaw, which occurs when a web application is tricked into exposing or running arbitrary files on the web server. CVE-2021-45466, a file write vulnerability which gains full remote code execution on the server.

See the full report here: https://thehackernews.com/2022/01/critical-bugs-in-control-web-panel.html

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting (XSS) bug discovered in the WordPress WP HTML Mail plugin for personalized emails. The new vulnerability tracked as CVE-2022-0218, due to a faulty configuration in the REST-API which leads to a malicious JavaScript injection into the mail template that would execute anytime a site administrator accessed the HTML mail editor. The WordPress site owners are recommended to verify their site has been updated to the latest patched version 3.1to avoid the exploitation.

See the full report here: https://threatpost.com/wordpress-insecure-plugin-rest-api/177866/

Ukraine: Wiper malware masquerading as ransomware hits government organizations

A number of official websites have recently been hacked, including those of the Ministry of Foreign Affairs, the Ministry of Education and Science, and others. On the home pages of several websites, provocative statements were posted. The content of the sites was not changed, and no data was lost, according to the Computer Emergency Response Team of Ukraine (CERT-UA). Customers who have been targeted/affected have been contacted by Microsoft, and victims in Ukraine are being advised to use the provided IOCs to determine whether their systems and networks have been compromised.

See the full report here: https://www.helpnetsecurity.com/2022/01/17/ukraine-wiper-malware/

McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges

McAfee has addressed two high-severity issues in its Agent component, one of which, CVE-2022-0166, might allow attackers to gain SYSTEM rights and execute arbitrary code. The second vulnerability in the Agent is CVE-2021-31854, which may be used by a local user to inject arbitrary shellcode into a file, according to McAfee's alert. The issues occur in versions of McAfee Agent prior to 5.7.5, which is utilized in McAfee Endpoint Security and other McAfee products, according to McAfee's bulletin.

See the full report here: https://threatpost.com/mcafee-bug-windows-system-privileges/177857/

CISA adds 17 vulnerabilities to list of bugs exploited in attacks - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) recently added seventeen actively exploited vulnerabilities to the "Known Exploited Vulnerabilities Catalog," which is a list of vulnerabilities that have been seen exploited by threat actors in attacks and must be patched by the Federal Civilian Executive Branch (FCEB) agencies. All security professionals and administrators should evaluate the Known Exploited Vulnerabilities Catalog and fix any vulnerabilities they find in their environment.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-17-vulnerabilities-to-list-of-bugs-exploited-in-attacks/

OpenSubtitles Hacked- Data Breach Affected 7 Million Subscribers - HackRead

OpenSubtitles, a most popular subtitles websites has acknowledged the data breach and confirmed that hackers managed to steal and leak email, hashed passwords, and usernames of almost 7 million users. Since OSS didn’t implement robust security measures, the attackers could compromise the website by hacking a SuperAdmin’s low security password and accessing user data after performing SQL injection. But the website admin OSS has confirmed that credit card details weren’t compromised in the attack because these are stored on another platform. Even after a ransom demand has been paid the attackers still leaked the data online.

See the full report here: https://www.hackread.com/opensubtitles-hacked-data-breach-user-leak/

Cisco Issues Patch for Critical RCE Vulnerability in RCM for StarOS Software

Cisco Systems has rolled out fixes for multiple vulnerabilities affecting Redundancy Configuration Manager (RCM) for Cisco StarOS Software that could be weaponized by an unauthenticated, remote attacker to execute arbitrary code and take over vulnerable machines. Cisco stated that vulnerability was discovered during internal security testing and also mentioned no evidence of active exploitation in malicious attacks found.

See the full report here: https://thehackernews.com/2022/01/cisco-issues-patch-for-critical-rce.html

Critical Vulnerability Found That Could Put 21M Metamask Users' Data at Risk - BeInCrypto

Metamask crypto wallet users could be at risk of losing all their digital assets or even physical threats due to a vulnerability in the popular Web 3.0 wallet. This vulnerability is very sophisticated and more powerful than the Mirai botnet attack in Oct 2016. Attackers can simply create a non-fungible token (NFT) and get a user’s IP address by transferring free ownership of the digital art. We can expect the fix release in Q2 2022.

See the full report here: https://beincrypto.com/critical-vulnerability-found-that-could-put-21m-metamask-users-data-at-risk/

Australian Prime Minister's WeChat Shanghaied by Chinese patriots

Australian Prime Minister Scott Morrison's WeChat account has been taken over by some unauthorized entities. They rebranded the account to "Australian Chinese new life" and used it to post advice on living in Australia for the nation's Chinese community.

See the full report here: https://www.theregister.com/2022/01/24/australian_prime_ministers_wechat_taken/

Crypto YouTubers fall victim to hacking and scamming attempt - Cointelegraph

Several popular cryptocurrency-related YouTube accounts were hacked on January 23, and unauthorized videos were posted from the accounts. These posts directed viewers to send money (in the form of prominent cryptocurrencies) to the hacker's wallet to receive a new cryptocurrency.

See the full report here: https://cointelegraph.com/news/crypto-youtubers-fall-victim-to-hacking-and-scamming-attempt

NDRF Twitter handle hacked; restored later - The Indian Express

The National Disaster Response Force (NDRF) Director General Atul Karwal said on Sunday that its Twitter handle was hacked. The cyberattack at the handle ‘@NDRFHQ’ took place around 10:45 pm on Saturday with some random messages being posted and the display name and photo being changed.

See the full report here: https://indianexpress.com/article/india/ndrf-twitter-handle-hacked-restored-7738313/

Molerats cyberespionage group uses public cloud services as attack infrastructure

Cyberespionage group Molerats has been observed abusing legitimate cloud services, like Google Drive and Dropbox as attack infrastructure. MoleRATs is an Arabic-speaking, politically motivated group of hackers that has been active since 2012. According to the researchers, the threat actors switched the distribution method in December 2021 and applied minor changes in the .NET backdoor.

See the full report here: https://securityaffairs.co/wordpress/127076/apt/molerats-apt-public-cloud.html

FBI warns of malicious QR codes used to steal your money - BleepingComputer

The FBI has warned Americans that scammers are tampering with QR codes to steal login and financial information from people. Victims scanning the seemingly legitimate codes get redirected to phishing sites that prompt visitors enter login and financial data. It is crucial to pay attention to the URL generated after scanning QR codes and always be cautious when entering data after scanning a QR code.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-malicious-qr-codes-used-to-steal-your-money/

Canada's foreign ministry hacked, services hit - Reuters

Hackers have launched a cyberattack on Canada's foreign ministry last week due to which some services are still down. According to the officials, critical services are currently functioning but some access to the internet and internet-based services are currently not working.

See the full report here: https://www.reuters.com/technology/canadas-foreign-ministry-hacked-services-hit-2022-01-24/

High-Severity Rust Programming Bug Could Lead to File, Directory Deletion

The maintainers of the Rust programming language have released a security update for a high-severity vulnerability, tracked as CVE-2022-21658. The bug could be abused by a malicious party to delete files and directories from a vulnerable system.

See the full report here: https://thehackernews.com/2022/01/high-severity-rust-programming-bug.html

Emotet Now Using Unconventional IP Address Formats to Evade Detection

Threat actors that deploy the Emotet malware botnet are using unconventional IP address formats to sidestep detection by security solutions. Their unconventional use of hexadecimal and octal IP addresses are likely intended at evading solutions reliant on pattern matching.

See the full report here: https://thehackernews.com/2022/01/emotet-now-using-unconventional-ip.html

Unusual ‘Donald Trump’ Packer Malware Delivers RATs, Infostealers

A new .NET malware packer – DTPacker – is being used to deliver a variety of remote access trojans (RATs) and infostealers. One notable campaign used fake Liverpool Football Club sites to lure users to download DTPacker, and then delivered the Agent Tesla RAT.

See the full report here: https://threatpost.com/donald-trump-packer-malware-infostealers/177887/

Malicious PowerPoint files used to push remote access trojans - BleepingComputer

The malicious PowerPoint phishing attachment contains obfuscated macro executed via a combination of PowerShell and MSHTA, both built-in Windows tools. Phishing campaigns use malicious PowerPoint documents to distribute various types of malware, including remote access and information-stealing trojans.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-powerpoint-files-used-to-push-remote-access-trojans/

Hackers say they encrypted Belarusian Railway servers in protest - BleepingComputer

A group of hackers has claimed that they breached and encrypted servers belonging to the Belarusian Railway. However, Belarusian Railway has not issued an official statement. The company has alerted its passengers on the website of the ongoing problems with issuing electronic travel documents.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-say-they-encrypted-belarusian-railway-servers-in-protest/

Threat Actors Use Microsoft OneDrive for Command-and-Control in Attack Campaign

An advanced persistent threat actor is using Microsoft OneDrive services for command-and-control (C2) purposes in a sophisticated cyberespionage campaign aimed at high-ranking government and defense industry officials of a West Asian nation, in what is believed to be the first known use of the tactic. Trellix researchers who have been following the campaign have connected it to APT28, a threat actor. According to the security provider, victims of the attacks have been notified of the attacks and given instructions on how to remove all known attack components from their networks.

See the full report here: https://www.darkreading.com/attacks-breaches/threat-actors-use-microsoft-onedrive-for-command-and-control-in-attack-campaign

New DazzleSpy malware targets macOS users in watering hole attack - BleepingComputer

A new watering hole assault has been detected that infects macOS users and visitors to a Hong Kong pro-democracy radio station's website with the DazzleSpy malware. It's part of the same operation that Google's Project Zero recently revealed, which used Chrome and Windows zero-days to hack into Windows and Android devices, according to ESET experts who have been examining the campaign. Watering hole attacks employ exploits targeting CVE-2021-1789, an arbitrary code execution weakness that occurs when parsing web content and affects Safari versions prior to 14.1.

See the full report here: https://www.bleepingcomputer.com/news/security/new-dazzlespy-malware-targets-macos-users-in-watering-hole-attack/

Watch out for this Android malware that can wipe your device after stealing your data - Phandroid.com

The new updated BRATA variant Android malware has been reported recently, which has the capability of evading antivirus scanners and to stay in device even after performing factory reset. Much like its predecessors, it has been designed to steal information, such as bank login details by overlaying pages for specific banks to trick people into entering sensitive information. It can also be used to remotely wipe your device as a kill-switch so that users will lose all their data in the process. To avoid this, users are recommended to download application only for authorized Android play store.

See the full report here: https://phandroid.com/2022/01/26/watch-out-for-this-android-malware-that-can-wipe-your-device-after-stealing-your-data/

McAfee Agent up to 5.7.4 on Windows Deployment cleanup.exe code injection

A critical Privilege Escalation Vulnerability has been found in McAfee Agent up to 5.7.4 on windows affecting the cleanup.exe of the component "Deployment Handler". This vulnerability has been fixed in version 5.7.5.

See the full report here: https://vuldb.com/?id.191225

Linux system service bug gives root on all major distros, exploit released - BleepingComputer

A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today. Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/

New DeadBolt ransomware targets QNAP devices, asks 50 BTC for master key - BleepingComputer

A new DeadBolt ransomware group is encrypting QNAP NAS devices worldwide using what they claim is a zero-day vulnerability in the device's software. The attacks started on January 25th, with QNAP devices, suddenly finding their files encrypted and file names appended with a .deadbolt file extension.

See the full report here: https://www.bleepingcomputer.com/news/security/new-deadbolt-ransomware-targets-qnap-devices-asks-50-btc-for-master-key/

Nobel Foundation site hit by DDoS attack on award day - BleepingComputer

The Nobel Foundation and the Norwegian Nobel Institute have disclosed a cyber-attack that unfolded during the award ceremony on December 10, 2021. The Nobel prize ceremony is being live-streamed from Oslo and Stockholm, and as such, DDoS attacks can interrupt the video feed and possibly even blemish the prestige of the institution.

See the full report here: https://www.bleepingcomputer.com/news/security/nobel-foundation-site-hit-by-ddos-attack-on-award-day/

Vietnamese lose VND24.4 trillion because of computer malware in 2021 - Vietnamnet

According to Bkav, in 2021, the damage caused by computer viruses to Vietnamese users continued to be at a high level of VND24.4 trillion ($1.06 billion). The three most common forms of scams in the past year were: calls to inform people that they won prizes; requests to buy goods to continue getting prizes; and sending prize-winning messages via Facebook.

See the full report here: https://vietnamnet.vn/en/sci-tech-environment/vietnamese-lose-vnd24-4-trillion-because-of-computer-malware-in-2021-811182.html

Millions of Routers, IoT Devices at Risk as Malware Source Code Surfaces on GitHub - DARKReading

Threat actors have uploaded on GitHub the source code of a malware ("BotenaGo") sample targeting millions of routers and Internet of Things (IoT) devices. Oher criminals can now quickly develop new variants of the tool or use it as is in their own attacks.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/source-code-for-malware-targeting-millions-of-routers-iot-devices-uploaded-to-github

Chaes banking trojan hijacks Chrome with malicious extensions - BleepingComputer

A large-scale campaign involving over 800 compromised WordPress websites is spreading banking trojans. The target is the credentials of Brazilian e-banking users. Security researchers have identified five malicious Chrome browser extensions installed on victim's devices as part of this attack.

See the full report here: https://www.bleepingcomputer.com/news/security/chaes-banking-trojan-hijacks-chrome-with-malicious-extensions/

UAMS Notifies Patients of Personal Information Breach - UAMS News

The University of Arkansas for Medical Sciences (UAMS) has discovered a breach of patient information. No credit card, debit card, bank account, address, driver’s license, Social Security numbers, or medical records were involved in this breach.

See the full report here: https://news.uams.edu/2022/01/21/uams-notifies-patients-of-personal-information-breach/

German govt warns of APT27 hackers backdooring business networks - BleepingComputer

The BfV German domestic intelligence services have warned about the attackers using the HyperBro remote access trojans (RAT). HyperBro helps the threat actors maintain persistence on the victims' networks by acting as an in-memory backdoor with remote administration capabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/german-govt-warns-of-apt27-hackers-backdooring-business-networks/

Apple fixes new zero-day exploited to hack macOS, iOS devices - BleepingComputer

Apple has released security updates to fix two zero-day vulnerabilities. One of them is a memory corruption bug in the IOMobileFrameBuffer affecting iOS, iPadOS, and macOS Monterey. The other is a Safari WebKit bug in iOS and iPadOS that allowed websites to track browsing activity and users' identities in real-time.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-new-zero-day-exploited-to-hack-macos-ios-devices/