Threat Intelligence Bulletin: 01/28/2022 - 02/03/2022
|by Alpha Team
Russia-Ukraine Conflict: Disinformation Campaigns and Cyber Attacks Likely in the Near Term
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Executive Summary
As the conflict in Ukraine unfolds, businesses operating in Ukraine or with strategic interests in the region are concerned about cyber risks stemming from the geopolitical situation in Eastern Europe. Even if any military conflict remains confined within Ukraine's borders, cyber attacks waged by the Kremlin will have a spillover effect worldwide. ZeroFox assesses that Russia is likely to sponsor cyber attacks against the Ukrainian public sector and critical infrastructure that will enable Russia to operate under a veil of plausible deniability, avoiding direct repercussions for such attacks as observed in the past. Retaliatory cyber attacks against the United States and NATO allies are also possible. U.S. and British officials continue to warn large organizations, particularly utility companies, about the potential for cyber attacks launched by the Russian government. In tandem with cyber attacks, ZeroFox assesses that Russia will continue to wage its information operations campaign against Ukraine to destabilize its domestic policy, hinder business, worsen the investment climate, and scare off trading partners and foreign investors. Any ongoing disinformation efforts could provide the foundation for a physical invasion down the road and paint Ukraine as the aggressor in the border conflict. Similarly, Russia will likely focus its rhetoric on the United States or NATO in its continued efforts to sow confusion and division and weaken geopolitical influence on the ongoing conflict.
The security situation in Ukraine continues to be unpredictable due to the increased threat of Russian military action and can deteriorate with little notice. Daily life in Ukrainian cities, however, currently continues without signs of panic. No food shortages, utility interruptions, runs on banks, or mass exodus from the country have been reported. Nevertheless, organizations conducting business in Ukraine should exercise caution and consider the possibility of collateral damage from future cyber attacks via service providers or business partners in Ukraine.
Cyber Attacks Likely to Precede Large-Scale Military Actions
As evidenced in its previous efforts in Ukraine, Georgia, Belarus, and the Baltics, cyber aggression is as much a part of the Russian strategy as any possible military action. Russian state-sponsored Advanced Persistent Threat (APT) actors have continuously demonstrated sophisticated tradecraft and cyber capabilities by compromising third-party infrastructure and software, developing and deploying custom malware, and maintaining persistent, undetected, long-term access in compromised networks. Russian APT actors frequently utilize common but effective tactics—such as spear phishing, brute force, and exploiting known vulnerabilities—to gain initial access to target networks. While most of the cyber aggression efforts are likely to be focused on Ukraine, as the country has always been a cyberwar testing ground for Russia, U.S. agencies are advising organizations to be on alert for attacks from Russian state-sponsored hackers in light of the escalation of the Eastern European conflict.1 In the same vein, Britain's National Cyber Security Centre has warned large organizations to bolster their cybersecurity resilience amid the deepening tensions over Ukraine.
In mid-January 2022, cyber criminals defaced more than 70 Ukrainian government websites and compromised at least 10 networks with destructive malware dubbed WhisperGate. WhisperGate is strategically similar to the NotPetya wiper used to attack Ukraine in 2017; both wipers masquerade as ransomware and target the master boot record instead of encrypting it. While the tactic of disguising wiper malware as ransomware is not a new one and was employed by actors linked to nation-states, the malware used in the 2022 attacks notably has more components designed to inflict additional damage.2 The use of wiper malware indicates that attackers were motivated by destruction versus financial gain. Security researchers assess that the attackers used stolen credentials in the campaign and likely had access to the victims' networks months before the attack, consistent with sophisticated APT operations.3 The government of Ukraine has already formally accused Russia of masterminding these attacks.4 Fortunately, the attacks did not lead to any catastrophic disruptions or data leaks; however, given the spillover effect and multi-billion dollar losses associated with NotPetya in 2017, businesses with a connection to Ukraine should consider isolating and monitoring networks connected to Ukrainian entities. While it is unlikely that WhisperGate will directly target organizations outside of Ukraine, organizations should consider their possibility of collateral damage via service providers or business partners in Ukraine.
In addition, cyber espionage efforts by Russia-linked groups against organizations in Ukraine are likely. Since at least 2013, security researchers have been tracking a campaign organized by a collective known as Gamaredon, which is responsible for a number of malicious phishing campaigns that have been primarily aimed at Ukrainian institutions with the goal of harvesting classified information from compromised Windows systems for geopolitical gains.5 Ukrainian officials allege that Gamaredon is responsible for launching espionage and intelligence-gathering attacks on Ukrainian military forces.6 Some security researchers worry the attacks might signal a larger operation, and ZeroFox continues to monitor for any future campaigns.
Cyber Attacks Against Critical Infrastructure Are Likely
While ZeroFox is not aware of any planned attacks on the critical infrastructure or aviation networks in Ukraine, cyber attacks from Russia against the Ukrainian public sector and critical infrastructure are likely based on the history of Russia’s actions against Ukraine since 2014. Such attacks are particularly difficult to deter given the relative lack of consequences expected as compared to a traditional attack, which would be treated as an act of war. The Russian government maintains an array of offensive cyber tools ranging from low-level denial-of-service capabilities to destructive attacks that it could employ against the Ukrainian public sector and critical infrastructure networks. For example, Russia reportedly conducted cyber attacks on Ukrainian power grid operators in 2015 and 2016 that elicited little Western response.7 International laws to address nation-state-sponsored attacks are still in their infancy, and investigators are rarely able to trace hacks back to specific individuals or connect hackers to governments, despite evidence indicating such connections. Ukrainian and U.S. officials have credited the previous grid hacks to Russia, linking the malware observed in the affected systems to Russian nation-state cyber actors and assessed that these actors conducted cyber campaigns against Ukrainian critical infrastructure.8
While the Russian government commonly operates through its intelligence services, it also uses cyber criminal groups to achieve its goals, which allows the Kremlin to maintain plausible deniability. On January 14, 2022, Russia arrested several members of the Russia-based ransomware collective REvil, which was responsible for the 2021 ransomware attacks against JBS Foods and Colonial Pipeline.9 Such an unprecedented move caused cybersecurity analysts to question Russia's motives, including speculation it was designed to make it easier for the government to deny a connection to any future cyber attacks.
U.S. officials have issued alerts to U.S. critical infrastructure operators and local governments about the potential for cyber attacks launched by the Russian government in response to any U.S. or NATO involvement in the ongoing conflict in Ukraine. As seen in the past, shortly after attacks on the Ukrainian power grid in 2015 and 2016, Russian malware was discovered inside at least 10 utility companies, including the operator of a nuclear plant in Kansas.10 These incidents took place in the wake of a political revolution in Ukraine, the annexation of Crimea, and amid military clashes in Ukraine's Donetsk and Luhansk regions.
Russia Steps Up Information Campaigns Amid Tensions
Russia has weaponized false narratives in cyberspace through the development of a disinformation and propaganda ecosystem to create doubt about what is true. Such strategies seek to manipulate information and relationships and weaken countries' geopolitical control. A solid example was the anti-Western disinformation campaigns that took place during the 2014 annexation of the Crimean Peninsula along with military operations in eastern Ukraine, which sowed fear across the local population that the Ukrainian and Western governments were threatening their lives and freedoms. Various social media, chat platforms, and state-backed media outlets continue to push the same narrative in 2022—while overplaying NATO and U.S. interference in Ukraine and overhyping its collective threat to the Russian-speaking population. ZeroFox assesses that Russia will focus on the United States or NATO in its continued efforts to sow confusion and prevent a unified response to Russian aggression in Ukraine. At a moment of more fragile alliances and complicated political environments between European nations and the United States, the Kremlin can achieve important goals by shaping public conversation and perception as the conflict in eastern Ukraine unfolds.
Over the past eight years, much of the Russian propaganda efforts have been aimed at a domestic audience in Russia and pro-Moscow Ukrainians. These efforts have focused on disparaging the Ukrainian government and accusing it of a humanitarian crisis in eastern Ukraine, where Ukrainian government forces have been battling Russia-led separatists. Russian propaganda efforts have included conducting damaging social media operations, using overt and covert online Russia-supported media outlets, hosting conferences and roundtables designed to influence attendees into falsely believing that Ukraine—not Russia— is at fault for heightened tensions in the region, and leveraging cyber operations to deface media outlets or spread fake bomb threats.11 In the first few weeks of 2022 alone, Ukrainian police investigated over 3,000 fake bomb threats aimed at sowing panic among the public. Ukrainian authorities blame Russia for the false alerts as part of the country’s so-called hybrid war in Ukraine.
After invading Ukraine in 2014, the Russian government and state-controlled disinformation outlets began to label anyone who questioned Russia's actions as Russophobes.12 Disinformation surrounding the 2014 downing of Malaysia Airlines flight 17 with a Buk missile over eastern Ukraine—in which Russia refutes a joint international investigation conclusion that flight MH17 was shot down by a missile from an area under control of Russia-backed militants— is an example of the attempt to discredit the criminal trial, deny responsibility, and distort the narrative away from the Kremlin.13 Reportedly, the Buk missile was brought in from the territory of the Russian Federation and, after having shot down flight MH17, was taken back to the Russian Federation. Russia continues to deny any involvement and does not accept responsibility for shooting down this civilian plane, which resulted in the loss of 298 passengers. The aftermath of the MH17 disaster was a case study in using a multitude of different communication channels to achieve a common goal: the discrediting of all those who claimed that Russia played some part in the attack and instead accusing the Ukrainian military of the attack.
Ukrainian authorities have taken numerous steps to counter the threat of Russian information warfare inside Ukraine, including blocking Russian TV channels and social media platforms since the early years of the conflict. However, Ukraine struggles to fight back in the international arena, where—despite regional variations in language and approach—the core Russian narratives employed from country to country have remained familiar throughout 2022: portraying Ukraine as a failed state led astray by both the United States and the West and overrun by far-right extremists. The narrative that U.S. soldiers are fighting on Ukrainian soil still appears to be a prominent theme across multiple Russian online publications. Furthermore, in 2022, Russia’s propaganda efforts rely heavily on the allegation that NATO made a commitment to the Soviet Union in 1990 that the military alliance would not expand. Moscow’s messaging on NATO expansion is meant to reinforce the idea that Russia was wronged by a broken promise—likely to redirect attention from the 100,000 troops amassed on the Ukrainian border.14 Many of the countries once affiliated with the Soviet Union have since joined NATO, but Ukraine has not. As the conflict in the region escalates, ZeroFox assesses that Russia will continue to wage its information operations campaign against Ukraine to create polarization, destabilize its domestic policy, hinder business, worsen the investment climate, and ultimately drive away trading partners and foreign investors.
Recommendations
The security situation in Ukraine continues to be unpredictable due to the increased threat of Russian military action and can deteriorate with little notice. ZeroFox recommends that organizations continually evaluate potential exposures in the region and elevate their level of security around the connections, software, and processes that link them to Ukraine, as well as ensure proper personnel security and evacuation plans are in place.
Organizations with interests in Ukraine should carefully monitor and isolate systems with connections to Ukraine due to the ongoing challenges. As the Cybersecurity and Infrastructure Security Agency has cautioned, organizations should adopt a heightened state of awareness and conduct proactive threat hunting. More specific recommendations for critical infrastructure providers include logical zoning of operational technology and industrial control systems based on operational necessity and risk and defining acceptable communication conduits between the zones.15 As a matter of best practice, organizations should create a patch management plan that includes updates to approved software and allows time for testing before a full rollout. Critical and internet-facing systems should be grouped for priority, allowing the organization to react in a timely manner. Organizations should also have a robust log collection strategy, enforce strong passwords and multi-factor authentication, use security solutions like antivirus software, and block unnecessary ports and protocols. Organizations should be extra vigilant and maintain current backups of business-critical systems and data, exercise restoration processes before they are needed, and ensure that backups cannot be impacted by ransomware-style or wiper malware attacks.
1: https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
2: https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
3: https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html
4: https://www.bbc.com/news/world-europe-59992531; https://thedigital.gov.ua/news/rosiya-mae-namir-zniziti-doviru-do-vladi-feykami-pro-vrazlivist-kritichnoi-informatsiynoi-infrastrukturi-ta-zliv-danikh-ukraintsiv; https://www.pravda.com.ua/news/2022/01/16/7320557/
5: https://thehackernews.com/2021/11/ukraine-identifies-russian-fsb-officers.html
6: https://cert.gov.ua/article/10702
7: https://jsis.washington.edu/news/cyberattack-critical-infrastructure-russia-ukrainian-power-grid-attacks/
8: https://www.cisa.gov/uscert/ics/alerts/IR-ALERT-H-16-056-01
9: https://www.zdnet.com/article/white-house-says-person-behind-colonial-pipeline-ransomware-attack-nabbed-during-russian-raid/
10: https://www.bloomberg.com/news/features/2022-01-26/what-happens-when-russian-hackers-cyberattack-the-u-s-electric-power-grid
11: https://www.state.gov/russias-top-five-persistent-disinformation-narratives/
12: https://www.state.gov/russias-top-five-persistent-disinformation-narratives/
13: https://foreignpolicy.com/2016/09/29/how-mh17-gave-birth-to-the-modern-russian-spin-machine-putin-ukraine/
14: https://www.theglobeandmail.com/world/article-moscow-has-ramped-up-disinformation-campaign-playing-a-role-in/
15: https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
Breaking News: 2022-01-28 - 2022-02-03
Lazarus hackers use Windows Update to deploy malware - BleepingComputer
North Korean-backed hacking group Lazarus has added the Windows Update client to its list of living-off-the-land binaries (LoLBins). The group is now actively using it to execute malicious code on Windows systems.
See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-windows-update-to-deploy-malware/
Data Breach Alert: Midland University | Console and Associates, PC - JDSupra - JD Supra
Midland University has disclosed that it was recently a victim of a malware attack. As a result of the breach, the names, addresses, driver’s license numbers, state identification numbers, and Social Security numbers of certain individuals were compromised.
See the full report here: https://www.jdsupra.com/legalnews/data-breach-alert-midland-university-7261788/
Apple and Tesla supplier Delta Electronics struck by Conti ransomware attack - SiliconANGLE News
Taiwanese Apple Inc. and Tesla Inc. supplier Delta Electronics Inc. has been struck by a Conti ransomware attack. Delta is a major supplier of power components to both Apple and Tesla and makes a variety of products. The ransomware affected non-critical information systems. The firm has notified law enforcement agencies and hired information systems advisors to investigate the attack and to improve network security.
See the full report here: https://siliconangle.com/2022/01/27/apple-tesla-supplier-delta-electronics-struck-conti-ransomware-attack/
Konni remote access Trojan receives 'significant' upgrades
The Konni Remote Access Trojan is reportedly under active development and has received significant updates recently. It has now evolved into a stealthier version of itself, researchers say.
See the full report here: https://www.zdnet.com/article/konni-remote-access-trojan-receives-significant-upgrades/
105 million Android users targeted by subscription fraud campaign - BleepingComputer
A premium services subscription scam – Dark Herring – used 470 Google Play Store apps and affected over 100 million users since March 2020. The scam operators fraudulently signed victims up for premium services and cashed the subscriptions.
See the full report here: https://www.bleepingcomputer.com/news/security/105-million-android-users-targeted-by-subscription-fraud-campaign/
Microsoft warns of multi-stage phishing campaign leveraging Azure AD - BleepingComputer
A large-scale, multi-phase phishing campaign is using stolen credentials to register devices and send phishing emails. Malicious DocuSign-themed emails are used as part of the campaign. The attack reportedly affected only accounts that didn't have multi-factor authentication (MFA) protection.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-multi-stage-phishing-campaign-leveraging-azure-ad/
Lazarus APT Uses Windows Update to Spew Malware
Lazarus Group is using Windows Update to spray malware in a campaign powered by a GitHub command-and-control (C2) server, researchers have found. On Thursday, the Malwarebytes Threat Intelligence team reported that they discovered the North Korean state advanced persistent threat (APT) group’s latest living-off-the-land technique while analyzing a spear-phishing campaign that its researchers discovered 10 days ago, on Jan. 18. The focus of the campaign, in which the APT masqueraded as American global security and aerospace giant Lockheed Martin is in keeping with Lazarus’ taste for infiltrating the military.
See the full report here: https://threatpost.com/lazarus-apt-windows-update-malware-github/178096/
Finland warns of Facebook accounts hijacked via Messenger phishing - BleepingComputer
Finland's National Cyber Security Centre (NCSC-FI) warns of an ongoing phishing campaign attempting to hijack Facebook accounts by impersonating victims' friends in Facebook Messenger chats. In the alert, the NCSC-FI says that all Facebook users who received messages from online acquaintances asking for their phone numbers and a verification number delivered via SMS are the targets of this ongoing scam. Once hijacked, the Facebook accounts will target other potential victims from their friend list in similar scams.
See the full report here: https://www.bleepingcomputer.com/news/security/finland-warns-of-facebook-accounts-hijacked-via-messenger-phishing/
Microsoft mitigates largest DDoS attack 'ever reported in history' - BleepingComputer
Microsoft says its Azure DDoS protection platform mitigated a massive 3.47 terabits per second (Tbps) distributed denial of service (DDoS) attack targeting an Azure customer from Asia in November. It was a distributed attack that originated from approximately 10,000 sources and multiple countries across the globe, including the United States, China, South Korea, Russia, Thailand, India, Vietnam, Iran, Indonesia, and Taiwan.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-mitigates-largest-ddos-attack-ever-reported-in-history/
US bans major Chinese telecom over national security risks - BleepingComputer
The Federal Communications Commission (FCC) has revoked China Unicom Americas' license, one of the world's largest mobile service providers, over "serious national security concerns." This effectively bans the telecom company from providing domestic and international telecommunication services within the United States. China Unicom Americas is the largest foreign subsidiary of China Unicom (short for China United Network Communications Group), a Chinese state-owned telecom company. Its network infrastructure covers over 30 countries and regions, and it owns more than 40 submarine and 20 terrestrial cable systems.
See the full report here: https://www.bleepingcomputer.com/news/security/us-bans-major-chinese-telecom-over-national-security-risks/
NCSC alerts UK orgs to brace for destructive Russian cyberattacks - BleepingComputer
The UK’s National Cyber Security Centre (NCSC) is urging organizations to bolster security and prepare for a potential wave of destructive cyberattacks after recent breaches of Ukrainian entities. The NCSC openly warns that Russian state-sponsored threat actors will likely conduct the attacks and reminds of the damage done in previous destructive cyberattacks, like NotPetya in 2017 and the GRU campaign against Georgia in 2019. These warnings come after Ukrainian government agencies and corporate entities suffered cyberattacks where websites were defaced, and data-wiping malware was deployed to destroy data and make Windows devices inoperable.
See the full report here: https://www.bleepingcomputer.com/news/security/ncsc-alerts-uk-orgs-to-brace-for-destructive-russian-cyberattacks/
EU to create pan-European cyber incident coordination framework - BleepingComputer
The European Systemic Risk Board (ESRB) proposed a new systemic cyber incident coordination framework that would allow EU relevant authorities to coordinate better when responding to major cross-border cyber incidents impacting the Union's financial sector. ESRB is an independent EU body established in 2010 that oversees the European Union's financial system to prevent and mitigate systemic risk. ESRB's recommendation comes in the context of an increased risk to the EU's financial stability from an increasing number of continuously evolving cyber threats.
See the full report here: https://www.bleepingcomputer.com/news/security/eu-to-create-pan-european-cyber-incident-coordination-framework/
Hackers are taking over CEO accounts with rogue OAuth apps - BleepingComputer
Threat analysts have observed a new campaign named ‘OiVaVoii’, targeting company executives and general managers with malicious OAuth apps and custom phishing lures sent from hijacked Office 365 accounts. According to a report from Proofpoint, the campaign is still ongoing, though Microsoft is monitoring the activity and has already blocked most of the apps. The impact of executive account takeovers ranges from lateral movement on the network and insider phishing to deploying ransomware and business email compromise incidents.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-are-taking-over-ceo-accounts-with-rogue-oauth-apps/
Hackers Using Device Registration Trick to Attack Enterprises with Lateral Phishing - The Hacker News
Microsoft has revealed the details of a large-scale, multi-phase phishing effort that leverages stolen credentials to register devices on a victim's network, allowing spam emails to spread further. The organizations that are being targeted are mostly in Australia, Singapore, Indonesia, and Thailand. Users were sent a DocuSign-branded phishing bait with a link that, when clicked, took them to a rogue website impersonating the Office 365 login page, allowing the attackers to steal their credentials. To fight against these types of threat efforts, Microsoft recommends following security best practices.
See the full report here: https://thehackernews.com/2022/01/hackers-using-device-registration-trick.html
Windows vulnerability with new public exploits lets you become admin - BleepingComputer
An exploit for a Windows local privilege elevation vulnerability has been publicly released, allowing anyone to get admin access on Windows 10. With the release of these exploits and the availability of patches from Microsoft that address the flaws exposed in the January 2022 upgrades, it is now strongly recommended that administrators install the updates rather than waiting until February 8th Patch Tuesday.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-vulnerability-with-new-public-exploits-lets-you-become-admin/
NCC raises alarm over new SMS-based malware, Tanglebot on Android phones by cybercriminals - Nairametrics
The Nigerian Communications Commission (NCC) has issued a public alert on TangleBot, a new high-risk, critical, and SMS-based virus that has infected Android mobile devices. When an unknowing user clicks on a malicious link disguised as Covid-19 vaccination appointment-related information in an SMS message or information about upcoming fake local power outages, TangleBot Android malware is installed. The Nigerian Communications Commission (NCC) warns Nigeria's millions of telecom customers to be aware of these cybercriminals' schemes.
See the full report here: https://nairametrics.com/2022/01/29/ncc-raises-alarm-over-new-sms-based-malware-tanglebot-on-android-phones-by-cybercriminals/
BRATA Banking Malware Is Now Capable Of Wiping Android Phones - Screen Rant
BRATA, a dangerous Android malware that tricks users into handing over sensitive financial data by logging the victim’s keystrokes. BRATA was mainly being delivered via the Google Play Store, and its variants were mainly distributed as fake updates for popular apps. BRATA as now evolved and added two new severe capabilities. First, the malware can reset the victim's phone to factory settings, deleting any trace of infection and unauthorized transactions. Second, the malware has also gained GPS tracking ability to trace victims.
See the full report here: https://screenrant.com/android-banking-malware-steals-data-wipes-phone/
WhisperGate Malware Corrupts Computers in Ukraine
A new malware family named WhisperGate being used in an ongoing operation targeting multiple industries in Ukraine, including government, non-profit, and information technology organizations. The malware is a 3-stage master boot record (MBR) wiper designed to destroy a victim’s MBR and corrupt files on attached storage devices. WhisperGate wipes and corrupts a Windows system to the point where files and drives are no longer recoverable or usable.
See the full report here: https://www.recordedfuture.com/whispergate-malware-corrupts-computers-ukraine/
Ransomware attack took down R2 trillion investment company for five days - MyBroadband
Curo Fund Services was unable to access its systems for five days as a result of the ransom attack. Curo has around R2 trillion in assets under its management. In this attack no individual customer data or investments were compromised and their money was also not at risk, but the outage prevented Curo’s financial service provider clients from processing investment-related instructions or offering other services. Curo launched an investigation to establish the origin, nature and scope of this incident and also implemented additional security measures to protect against further unauthorised access. They also working with cybersecurity specialists to isolate the infected system and then restore their systems safely.
See the full report here: https://mybroadband.co.za/news/security/432056-ransomware-attack-took-down-r2-trillion-investment-company-for-five-days.html
Researchers use GPU fingerprinting to track users online - BleepingComputer
An international research team explored the use of people's GPUs (graphics processing units) to create unique fingerprints and use them for persistent web tracking. The team used WebGL (Web Graphics Library) – a cross-platform API for rendering 3D graphics in the browser – for creating distinctive fingerprints.
See the full report here: https://www.bleepingcomputer.com/news/security/researchers-use-gpu-fingerprinting-to-track-users-online/
FTC: Americans lost $770 million from social media fraud surge - BleepingComputer
Over 95,000 US consumers reported losses of around $770 million in 2021 after getting scammed on social media platforms, the US Federal Trade Commission has revealed. Bogus investment opportunities, romance scams, and online shopping fraud were the most prominent methods of defrauding the victims.
See the full report here: https://www.bleepingcomputer.com/news/security/ftc-americans-lost-770-million-from-social-media-fraud-surge/
New Zealand tourism businesses facing cybersecurity challenges - Australasian Leisure Management
New Zealand tourism businesses are being warned to secure their social media accounts and IT systems in the wake of a series of cyberattacks. The hackers made themselves an administrator on the person’s enterprise web page and used the bank card particulars related to the enterprise web page to purchase Facebook promoting.
See the full report here: https://www.ausleisure.com.au/news/new-zealand-tourism-businesses-facing-cybersecurity-challenges/
Ethical hacker helps recover millions lost in StableMagnet rug pull - Bankless Times
An anonymous ethical hacker shared insights with CoinTelegraph into how he tracked down a group of DeFi scammers, who were behind the $27+ million StableMagnet rug pull. Eventually, part of the funds was recovered and returned to investors.
See the full report here: https://www.banklesstimes.com/news/2022/01/30/ethical-hacker-helps-recover-millions-lost-in-stablemagnet-rug-pull/
Russian 'Gamaredon' hackers use 8 new malware payloads in attacks - BleepingComputer
Russia-linked hackers known as "Gamaredon" (also known as Armageddon or Shuckworm) deployed eight custom binaries in cyber-espionage operations against Ukrainian entities. These attacks reportedly began last July, via spear-phishing emails that carried macro-laced Word documents.
See the full report here: https://www.bleepingcomputer.com/news/security/russian-gamaredon-hackers-use-8-new-malware-payloads-in-attacks/
Apple Pays $100,500 Bounty to Hacker Who Found Way to Hack MacBook Webcam
Apple has paid a bug bounty of $100,500 to a security researcher who reported bugs (subsequently patched) that exposed the Safari browser to attack. The bugs specifically related to ShareBear, an iCloud file-sharing mechanism. They potentially allowed malicious actors to access users' online accounts, microphone, and webcam.
See the full report here: https://thehackernews.com/2022/01/apple-pays-100500-bounty-to-hacker-who.html
Unsecured AWS server exposed 3TB in airport employee records
An unsecured server, belonging to Securitas (a security-solutions provider), has exposed sensitive data belonging to airport employees across Colombia and Peru. The exposed data dates back to 2018, and contains sensitive and personally identifiable information (PII), including photographs of airline employees, planes, fueling lines, and luggage handling.
See the full report here: https://www.zdnet.com/article/unsecured-aws-server-exposed-airport-employee-records-3tb-in-data/
277,000 routers exposed to Eternal Silence attacks via UPnP - BleepingComputer
Malicious campaign "Eternal Silence" turns routers into proxy servers. A vulnerability in the Universal Plug and Play (UPnP) feature allows the actor to use them to launch malicious attacks while hiding the location of the threat actors.
See the full report here: https://www.bleepingcomputer.com/news/security/277-000-routers-exposed-to-eternal-silence-attacks-via-upnp/
Microsoft Office 365 to add better protection for priority accounts - BleepingComputer
Microsoft is updating Microsoft Defender for Office 365 with differentiated protection for enterprise accounts tagged as critical for an organization. It plans to make this generally available to customers worldwide in March. It also helps prioritize alerts and threat investigations involving the organization's most visible and/or targeted executive-level users.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-to-add-better-protection-for-priority-accounts/
CISA adds 8 vulnerabilities to list of actively exploited bugs - BleepingComputer
The US Cybersecurity & Infrastructure Security Agency (CISA) has added eight more flaws to its catalog of exploited vulnerabilities that are known to be used in attacks.These flaws allow the takeover of mobile devices, network access, the ability to execute commands remotely.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-8-vulnerabilities-to-list-of-actively-exploited-bugs/
600K WordPress sites impacted by critical plugin RCE vulnerability - BleepingComputer
A popular WordPress plugin used in over a million sites has been found to have a critical remote code execution (RCE) vulnerability in versions 5.0.4 and older. The flaw allows an unauthenticated user to perform a local file inclusion attack, such as a PHP file, to execute code on the site.
See the full report here: https://www.bleepingcomputer.com/news/security/600k-wordpress-sites-impacted-by-critical-plugin-rce-vulnerability/
Samba bug can let remote attackers execute code as root - BleepingComputer
Samba is an SMB networking protocol re-implementation that provides file sharing and printing services across many platforms, allowing Linux, Windows, and macOS users to share files over a network. It has addressed a critical severity vulnerability that can let attackers gain remote code execution with root privileges on servers running vulnerable software.
See the full report here: https://www.bleepingcomputer.com/news/security/samba-bug-can-let-remote-attackers-execute-code-as-root/
FBI warns of fake job postings used to steal money, personal info - BleepingComputer
The FBI has warned people that scammers continue to post fraudulent job offerings to steal candidates' personal information or money. The Bureau advised job seekers to verify openings advertised on recruitment sites by reaching out to the company's HR department or on official sites.
See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-job-postings-used-to-steal-money-personal-info/
Malicious CSV text files used to install BazarBackdoor malware - BleepingComputer
A new phishing campaign is using malicious CSV text files to infect users' devices with the BazarBackdoor malware. BazarBackdoor is a stealthy backdoor malware created by the TrickBot group to provide threat actors remote access to a device. The phishing emails pretend to be "Payment Remittance Advice" with links to remote sites that download a CSV file with executable elements.
See the full report here: https://www.bleepingcomputer.com/news/security/malicious-csv-text-files-used-to-install-bazarbackdoor-malware/
Powerful new Oski variant ‘Mars Stealer’ grabbing 2FAs and crypto - BleepingComputer
A powerful malware called Mars Stealer has been observed in the wild, and appears to be a redesign of the Oski malware. It is an information-stealing malware that steals data from all popular web browsers, two-factor authentication plugins, and cryptocurrency extensions and wallets.
See the full report here: https://www.bleepingcomputer.com/news/security/powerful-new-oski-variant-mars-stealer-grabbing-2fas-and-crypto/
Cyberspies linked to Memento ransomware use new PowerShell malware - BleepingComputer
The hacking group tracked as APT35 is deploying a new backdoor called PowerLess. The group uses this malware to deploy additional modules, including info stealers and keyloggers. The malware is adept at evading detection by security solutions.
See the full report here: https://www.bleepingcomputer.com/news/security/cyberspies-linked-to-memento-ransomware-use-new-powershell-malware/
British Council exposed more than 100,000 files with student records - BleepingComputer
British Council, the global organization for promoting British culture, the English language, and education opportunities, was leaking over 144,000 files containing student records. A cybersecurity firm revealed student names, IDs, usernames and email addresses, and other personal information were compromised.
See the full report here: https://www.bleepingcomputer.com/news/security/british-council-exposed-more-than-100-000-files-with-student-records/
SolarMarker Malware Uses Novel Techniques to Persist on Hacked Systems
The operators behind the SolarMarker information stealer and backdoor have been found leveraging stealthy tricks to establish long-term persistence on compromised systems. Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
See the full report here: https://thehackernews.com/2022/02/solarmarker-malware-uses-novel.html
MuddyWater hacking group targets Turkey in new campaign - BleepingComputer
The Iranian-backed MuddyWater hacking group is conducting a new malicious campaign targeting private Turkish organizations and governmental institutions. When conducting attacks, the threat actors use various file types like PDFs, XLS files, and Windows executables to deploy obfuscated PowerShell-based downloaders and gain initial access to targeted networks.
See the full report here: https://www.bleepingcomputer.com/news/security/muddywater-hacking-group-targets-turkey-in-new-campaign/
New SureMDM Vulnerabilities Could Expose Companies to Supply Chain Attacks
A number of security vulnerabilities have been disclosed in 42 Gears' SureMDM device management solutions that could be weaponized by attackers to perform a supply chain compromise against affected organizations. 42Gears claims that SureMDM is used by over 10,000 companies worldwide.
See the full report here: https://thehackernews.com/2022/01/new-suremdm-vulnerabilities-could.html
UEFI firmware vulnerabilities affect at least 25 computer vendors - BleepingComputer
UEFI (Unified Extensible Firmware Interface) software is an interface between a device’s firmware and the operating system, which handles the booting process, system diagnostics, and repair functions. Researchers from firmware protection company Binarly have discovered critical vulnerabilities in the UEFI firmware.
See the full report here: https://www.bleepingcomputer.com/news/security/uefi-firmware-vulnerabilities-affect-at-least-25-computer-vendors/
SEO poisoning pushes malware-laced Zoom, TeamViewer, Visual Studio installers - BleepingComputer
The threat actors perform search engine optimization (SEO) techniques to legitimate compromised sites into search results for popular applications. The targeted keywords are for popular applications like Zoom, Microsoft Visual Studio 2015, TeamViewer, and others.
See the full report here: https://www.bleepingcomputer.com/news/security/seo-poisoning-pushes-malware-laced-zoom-teamviewer-visual-studio-installers/
ESET antivirus bug let attackers gain Windows SYSTEM privileges - BleepingComputer
Slovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. It enables attackers to escalate privileges to NT AUTHORITY\SYSTEM account rights.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/eset-antivirus-bug-let-attackers-gain-windows-system-privileges/
Arid Viper hackers strike Palestine with political lures and Trojans
Cybersecurity researchers have spotted a new campaign launched by Arid Viper cyberattack group, a.k.a. Desert Falcon, targeting Palestinian organizations and activists. The initial attack vector is phishing emails intended to deploy remote access trojan (RAT) malware that takes hold of the target systems.
See the full report here: https://www.zdnet.com/article/arid-viper-hackers-strike-palestine-with-political-lures-and-trojans/
Business services provider Morley discloses ransomware incident - BleepingComputer
U.S.-based business service provider Morley Companies has disclosed a ransomware attack and subsequent data breach that happened in August 2021, in which personal information of 521,046 individuals were stolen. The company serves Fortune 500 brands in industries such as automotive, chemical, financial, insurance, healthcare, technology, and communications.
See the full report here: https://www.bleepingcomputer.com/news/security/business-services-provider-morley-discloses-ransomware-incident/
KP Snacks giant hit by Conti ransomware, deliveries disrupted - BleepingComputer
KP Snacks, a producer of popular British snacks, has been hit by the Conti ransomware group. The company's internal network was reportedly breached, with threat actors gaining access to and encrypting sensitive files. The attack has led to cancellation and delays in the company's distribution process.
See the full report here: https://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/
Office 365 boosts email security against MITM, downgrade attacks - BleepingComputer
Microsoft has added SMTP MTA Strict Transport Security (MTA-STS) support to Exchange Online to boost email security for Office 365 customers. This solves several SMTP security problems, including expired TLS certificates, the lack of support for secure protocols, and certificates not issued by trusted third parties or matching server domain names.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/office-365-boosts-email-security-against-mitm-downgrade-attacks/
Wormhole cryptocurrency platform hacked to steal $326 million - BleepingComputer
A hacker stole 120,000 wrapped Ethereum (wETH), worth around $326 million, on the Solana blockchain after exploiting a vulnerability in the Wormhole cross-chain crypto platform. This is the second-largest attack ever on DeFi services. A Wormhole representative has reportedly offered the hacker a $10 million bug bounty under a whitehat agreement if they return the wETH and provide details of the exploit.
See the full report here: https://www.bleepingcomputer.com/news/cryptocurrency/wormhole-cryptocurrency-platform-hacked-to-steal-326-million/
Walmart Dissects New 'Sugar' Ransomware
Security researchers at Walmart have analyzed the workings of a new ransomware family named Sugar, which is available as ransomware-as-a-service (RaaS). It was first observed in November 2021 and is written in Delphi. The researchers deduced that the Sugar ransomware and its crypter are the work of the same developer, or the crypter is offered to affiliates as part of the service.
See the full report here: https://www.securityweek.com/walmart-dissects-new-sugar-ransomware
Tags: weekly bulletin, all industries, global