Threat Intelligence Bulletin: 02/04/2022 - 02/10/2022

Flash Report: German Energy Firms Hit by BlackCat Ransomware

A series of cyber attacks targeting energy companies in Europe has authorities on high alert, given rising fuel prices and the threat of supply disruption should the political crisis in Ukraine escalate into conflict. On February 3, 2022, German authorities implicated the BlackCat ransomware group as a suspect in a recent ransomware attack against two German oil companies that has already caused a major impact on crude supply. The attack echoes the widespread disruption caused by the Colonial Pipeline ransomware attack in 2021; security researchers indicate that BlackCat is likely a rebrand of DarkSide, the threat actor group responsible for that incursion.

Other companies across Europe have also experienced cyber attacks in recent days, including international terminals operated by SEA-invest in Belgium and tank terminals operated by Dutch company Evos. However, it has not been confirmed if these are related to the German attacks. The attacks are mainly affecting the loading and unloading of cargo at the impacted facilities; if normal operations do not resolve soon, these impacts are expected to spread into the shipping and logistics sector. The targeting of oil distribution facilities at a time when a lack of oil supply is leading to high prices is noteworthy, as it could be designed to worsen the price problem. These attacks also come at a time of heightened tensions between Europe and Russia over Ukraine. If the hacks are linked to Russian threat actors, such targeting may be designed to emphasize potential consequences for European leaders who have been weakened politically by high energy prices.

ZeroFox predicts supply chain compromises will continue on an upward trajectory in terms of frequency, scale, and sophistication in 2022. The use of third-party compromises as a means to distribute ransomware is likely to increase, driven in part by increasingly lucrative Ransomware-as-a-Service offerings lowering the barriers to entry for threat actors while putting effective malware in the hands of more operators. With supply chain issues affecting multiple aspects of the global trade, ransomware-related attacks are likely to generate significant media coverage—possibly acting as a mitigating factor, as threat actors look to avoid attention from authorities.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
• Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above-average size—particularly those in a compressed format, such as .zip, .rar, .tar, .7z, or .gz.
• Avoid opening unsolicited attachments and never click suspicious links.
• Enforce best practices on passwords, such as complexity, forced expiration, and prohibiting password reuse.
• Do not share passwords, and do not reuse the same password on different websites and applications.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• If a workstation is infected with malware, quarantine it on a private network segment with no external connections.

Details

On January 29, 2022, Oiltanking GmbH Group and Mabanaft GmbH & Co. KG Group—which operate under the same Hamburg-based parent, Marquard & Bahls—reported a ransomware attack launched by the BlackCat ransomware group (also known as ALPHV) that disrupted IT systems and impacted the companies’ supply chains. As over 200 gas stations were affected by the attack, the companies were forced to declare a force majeure for the majority of inland supply activities in Germany, resulting in the energy company Shell re-routing its oil supplies to other depots. Parallels in disruption can be drawn between the attacks on these German companies and a devastating ransomware attack on Colonial Pipeline that crippled its business services and left significant parts of the East Coast without access to gas for over five days.

BlackCat operators use various techniques commonplace in the ransomware space, including encrypting and leaking target data; naming and shaming its victims on its leak site; selling the leaked data to the highest bidder, and offering DDoS attack capabilities in its toolkit. What is notable is that BlackCat payloads are written in Rust, a more secure programming language. This is consistent with an observed trend of cyber criminals adopting various programming languages likely to hamper reverse engineering efforts by security researchers.

The group’s data leak site publicly lists new victims across a wide range of industries, including communications, technology, manufacturing, retail, and financial services. ZeroFox has been tracking BlackCat’s activities since December 8, 2021, when newly-registered forum actor "ransom" advertised an ALPHV-ng ransomware affiliate program on the multi-language cyber criminal forum RAMP actively seeking partners and offering lucrative payouts. Since December 2021, ZeroFox has observed 30 instances of BlackCat attacks across multiple regions; over 46 percent of its victims have been located in the United States. The total number of victims, including those that have paid a ransom to avoid exposure, is likely greater.

Figure 1. BlackCat’s activity per country.
Source: ZeroFox Research

ZeroFox has previously collected sample ransom notes affiliated with BlackCat dating to December 2021 and January 2022.

Figure 2. A BlackCat alert in the ZeroFox Platform.
Source: ZeroFox Research

Figure 3. A BlackCat ransom note template as extracted by the Triage sandbox service.
Source: Triage

IOCs

SHA256

• 40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5
• 1724730c8d2f3e034e1b87154d7a8af0f7801380bd2da3429fd3f27b9bdd7ddc
• 59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f
• 40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5
• d767524e1bbb8d50129485ffa667eb1d379c745c30d4588672636998c20f857f
• 2587001d6599f0ec03534ea823aab0febb75e83f657fadc3a662338cc08646b0
• f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb
• f7a038f9b91c40e9d67f4168997d7d8c12c2d27cd9e36c413dd021796a24e083
• e7060538ee4b48b0b975c8928c617f218703dab7aa7814ce97481596f2a78556

Flash Report: High Severity Path-Traversal Vulnerability Affects Argo CD Users

A newly-discovered zero-day vulnerability in Argo CD, used by organizations for deploying applications to Kubernetes, can be leveraged in attacks to disclose sensitive information and continues to highlight ongoing issues with insecure software supply chains.

CVE-2022-24348 could allow an attacker to hop across multiple application-development environments and extract sensitive information, such as passwords, tokens, and API keys. The high-severity vulnerability affects all versions of the tool. Argo has released patches for this bug in versions 2.1.9, 2.2.4, and 2.3.0. Argo CD is used by at least 191 organizations; it is a continuous-delivery platform deployed as a Kubernetes controller in the cloud used to deploy applications and monitor them in real-time. At the moment, ZeroFox is not aware of any threat actors exploiting this vulnerability, however, one ransomware group circulated the disclosure on February 7, 2022—likely in an effort to raise awareness about the vulnerability.

As an increasing number of organizations are moving workloads to cloud resources and Kubernetes, this vulnerability once again underscores risks associated with insecure software supply chains. The issue is being tackled by organizations in the federal and private sectors; the White House recently hosted an open source security summit, with members from across both sectors convening to discuss how best to tackle flaws in community-driven software. On February 1, 2022, the Open Source Security Foundation (OpenSSF)—backed by the Linux Foundation, Microsoft, and Google—launched a new project designed to secure the software supply chain.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Install updates from Argo CD, as there is no workaround.
• Regularly audit your tech stack to understand where your third party/supply chain vulnerabilities might be.

Details

The path-traversal vulnerability allows malicious actors to load a Kubernetes Helm Chart YAML file to the vulnerability and “hop” from their application ecosystem to other applications' data outside of the user's scope. The impact can become especially critical in environments that make use of encrypted value files (e.g., using plugins with git-crypt or SOPS) containing sensitive or confidential data and decrypting that information to disk before rendering the Helm chart. There are no workarounds for the issue, and Argo CD has urged its users to update their installations. Patches have been released for Argo CD v2.1.9, v2.2.4, and v2.3.0.

Successful exploitation of the vulnerability could have serious consequences ranging from privilege escalation and sensitive information disclosure to lateral movement attacks and exfiltration of tokens from other applications.

Figure 1. CVE-2022-24348 Attack Flow
Source: Apiiro

At the moment, ZeroFox is not aware of any threat actors exploiting this vulnerability, however, a news article generated some interest across covert channels and was re-posted to multiple chat platforms, including the private Telegram channel for a newly-emerged ransomware group called LAPSUS$. ZeroFox will continue to monitor for any further discussions.

Figure 2. Vulnerability disclosure posted to the LAPSUS$ private chat channel
Source: ZeroFox Threat Hunting Module

Super Bowl LVI - Event Assessment

In this Event Assessment report, the ZeroFox Intelligence team provides an in-depth analysis of possible cyber and physical security concerns associated with Super Bowl LVI.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

• https://zf-dashboard-media.s3.amazonaws.com/intel/Super+Bowl+LVI+-+Event+Assessment.pdf

Executive Summary

Super Bowl LVI is scheduled to take place on February 13, 2022, at the SoFi Stadium in Inglewood, California, the home stadium of the Rams, marking the secondconsecutive and second overall Super Bowl to feature a team playing in its home stadium. Unlike the previous year, attendance at the game will not be limited due to COVID-19 impact, however vaccine, masking, and testing requirements are in place.

Super Bowl LVI is categorized by the U.S. Department of Homeland Security (DHS) as being of the highest threat level to public safety, and security is expected to be heavy within Los Angeles and the surrounding region. At the time of this report, there were no credible threats associated with the Super Bowl; however, attendees and locals need to be aware of possible physical security and cyber-related concerns surrounding the event.

Meet Kraken: A New Golang Botnet in Development

In late October 2021, ZeroFox Research discovered a previously unknown botnet called Kraken. Though still under active development, Kraken already features the ability to download and execute secondary payloads, run shell commands, and take screenshots of the victim’s system. It currently makes use of SmokeLoader—a piece of malware used to install other malicious software—to spread, quickly gaining hundreds of bots each time a new command and control server is deployed. Despite having the same name, it should not be confused with the Kraken botnet from 2008 as they have little else in common.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up to date with all patches and rule sets.
• Enable two-factor authentication for all organizational accounts to help mitigate phishing and credential stuffing attacks.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Avoid opening unsolicited attachments and never click suspicious links.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Review network logs for potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Details

Since October 2021, ZeroFox Research has been tracking Kraken – a previously unknown botnet targeting Windows that is currently under active development. Although the bot is basic in functionality, the author has been experimenting with new features while altering others. Current iterations of Kraken feature the ability to:

• Maintain persistence
• Collect information about the host for registration (varies per version)
• Download and execute files
• Run shell commands
• Steal various cryptocurrency wallets
• Take screenshots

“Open Source” Beginnings

While Kraken’s source code was likely not intended to be viewable by the public, the author originally uploaded the project to a fairly active GitHub profile on October 10, 2021. The project itself only had two commits, was extremely basic, and pre-dated any binaries ZeroFox observed in the wild. The source, however, was still similar enough to expedite some parts of our early analysis.

Figure 1. GitHub repository page for an early version of Kraken
Source: ZeroFox Research

Observed Infection Vector

Thanks to a tip by @abuse_ch, ZeroFox learned that Kraken originally spread in self-extracting RAR SFX files downloaded by SmokeLoader. These SFX files contained a UPX-packed version of Kraken, RedLine Stealer, and another binary used to delete Kraken. Current versions of Kraken are now downloaded by SmokeLoader directly. Kraken binaries are still UPX-packed but are now further protected by the Themida packer as well.

Figure 2. Screenshot of a Kraken SFX archive’s contents
Source: ZeroFox Research

Installation and Persistence

During Kraken’s installation phase, it attempts to move itself into %AppData%\Microsoft. The file name is hardcoded, though the author has changed it a few times. ZeroFox has observed file names such as taskhost.exe, Registry.exe, and Windows Defender GEO.exe.

To stay hidden, Kraken runs the following two commands:

1. powershell -Command Add-MpPreference -ExclusionPath %APPDATA%\Microsoft
2. attrib +S +H %APPDATA%\Microsoft<EXE_NAME>

The PowerShell command tells Microsoft Defender not to scan Kraken's installation directory, while the attrib command is used to hide the copied EXE file from an Explorer window that has not enabled the “Show hidden files, folders, and drives” option.

Kraken also makes use of the Windows Run registry key to ensure it starts every time the victim logs in.

Figure 3. Kraken’s Run key persistence
Source: ZeroFox Research

A mix of fake and real information is stored in a new registry key under HKEY_CURRENT_USER\Software; it is all currently unused after saving it during the installation. The name of the key is another hardcoded value, though it has also changed occasionally. Early versions of Kraken observed by ZeroFox created a key with the name “Networking Service” or some slight variation, such as “Networking5 Servic1e” and “Netrworking5r Servirc1er”.

Figure 4. Kraken registry information
Source: ZeroFox Research

Aside from the hard-coded name for the registry key, the following information shown in Figure 4 has remained the same in every version ZeroFox has encountered in the wild:

• ID - obfuscated UUID
• INSTALL - installation timestamp
• LAST - empty
• NAME - obfuscated binary and Run key name (minus file extension)
• REMASTER - always “nil”
• VERSION - always “0.5.6”

Features

Kraken’s feature set is fairly basic for a botnet. Although not present in earlier builds, the bot is capable of collecting information about the infected host and sending it back to the command and control (C2) server during registration. The information collected seems to vary from build to build, though ZeroFox has observed the following being collected:

• Hostname
• Username
• Build ID (TEST_BUILD_ + the timestamp of the first run)
• CPU details
• GPU details
• Operating system and version

The botnet also features the ability to download and execute files. Originally, Kraken contained separate but similar functions for downloading files for different situations, such as updating the bot itself, executing secondary payloads, and receiving files through direct socket connection.

These functions have since been combined into one, while the redundant functions were removed.

Kraken’s operators are able to run shell commands on infected hosts from the dashboard as well, returning the results back to the C2 server.

SSH brute-forcing functionality was added to some builds but was quickly removed. This function was hardcoded to attempt logging in as the root user of a given target and assumed a server would be listening on the default port. ZeroFox did not see any evidence of this feature being used, likely explaining its quick removal.

Immediately upon execution, Kraken takes a screenshot to send to the C2. A “ScreenShot” command also exists if the operator decides to take screenshots of the victim’s system on demand.

The most recent feature addition is the ability to steal various cryptocurrency wallets from the following locations:

• %AppData%\Zcash
• %AppData%\Armory
• %AppData%\bytecoin
• %AppData%\Electrum\wallets
• %AppData%\Ethereum\keystore
• %AppData%\Exodus\exodus.wallet
• %AppData%\Guarda\Local Storage\leveldb
• %AppData%\atomic\Local Storage\leveldb
• %AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb

Currently supported commands are:

• Position - Unknown
• ScreenShot - take a screenshot
• SHELL - run a Windows shell command with cmd
• UPLOAD - download and execute an EXE

Figure 5. Original regular expressions used to parse received commands
Source: ZeroFox Research

Dashboards

Multiple versions of the administration panel or dashboard have been created since October 2021. While the original code found on GitHub did include a server, it did not have a web-based interface for interacting with the botnet.

Kraken Panel

ZeroFox observed two versions of this panel. The first panel was fairly simple and required no authentication to view statistics. Uploading files or interacting with the botnet in any way, however, did require a “unique key” and a “team” value to be provided.

Figure 6. English-translated version of the first C2 panel
Source: ZeroFox Research

The second version of the Kraken Panel appeared near the end of November 2021. Although this version required authentication, the operator(s) did not stick with it for very long.

Figure 7. Login page for the second version of the Kraken Panel
Source: ZeroFox Research

Anubis Panel

The current version of the C2 has undergone a total redesign—complete with a new name, Anubis. The Anubis Panel does not currently require authentication and provides far more information to the operator(s) than the original Kraken Panel. In addition to the previously provided statistics, it is now possible to view command history and victim information.

Figure 8. Dashboard for the Anubis Panel
Source: ZeroFox Research

An update to the Anubis Panel added the ability for operators to be more selective when choosing targets for commands. In all versions up until recently, the operators had to choose the number of victims to target with the command. This latest update allows commands to be run on specifically-chosen targets by external IP address or geolocation.

Figure 9. Selecting a victim by external IP to run a shell command
Source: ZeroFox Research

The Anubis Panel also allows operators to view task or command history via the dashboard and TASK page. The page showed information such as the ID generated for the task, the command being sent, how many victims the command should be sent to, the targeted geolocation, and a timestamp of when the task was initiated.

Initially, every task investigated by ZeroFox resulted in a version of RedLine Stealer being downloaded and executed on the victim’s machine. Some shell commands were observed as well, though these were only used to download more RedLine payloads using curl.

Figure 10. TASK page showing command history
Source: ZeroFox Research

As the operators behind Kraken continued to expand and gather more victims, ZeroFox began observing other generic information stealers and cryptocurrency miners being deployed. As of this writing, the botnet appears to be collecting around USD 3,000 every month.

Figure 11. Mining statistics from the cryptocurrency mining pool Ethermine
Source: ZeroFox Research

Bonus

After the screenshot functionality was added, ZeroFox discovered a screenshot of what is likely the operator’s own desktop or development machine. Although the operator was not listed among the victims in the dashboard, a screenshot likely taken during a period of testing was still available. Several items of interest can be seen in Figure 12 below, including:

• A batch script used to build and UPX-pack the bot
• A partial view of the source code
• SQLite database files related to Kraken on the desktop
• Binaries matching file names of RedLine payloads ZeroFox received
• A directory that existed on one of the C2s – “Particles.js” directory
• Name of the botnet in the file path of the Explorer window
• Social media the operator may have been logged into (VK tab)
• Current file name of the bot when uploaded to the C2 – “build_dl”

Figure 12. Screenshot of the actor’s desktop
Source: ZeroFox Research

After moving the C2 to another server, the operator left a second screenshot available.

Figure 13. Second screenshot of the actor’s desktop
Source: ZeroFox Research

Conclusion

While in development, Kraken C2s seem to disappear often. ZeroFox has observed dwindling activity for a server on multiple occasions, only for another to appear a short time later using either a new port or a completely new IP. By using SmokeLoader to spread, Kraken quickly gains hundreds of new bots each time the operator changes the C2. Monitoring commands sent to Kraken victims from October 2021 through December 2021 revealed that the operator had focused entirely on pushing information stealers – specifically RedLine Stealer. It is currently unknown what the operator intends to do with the stolen credentials that have been collected or what the end goal is for creating this new botnet.

MITRE ATT&CK

IOCs

IP Addresses

• 65.21.105.85
• 91.206.14.151
• 95.181.152.184
• 185.112.83.22
• 185.112.83.96
• 185.206.212.165
• 213.226.71.125

SHA256 Hashes

• 1d772f707ce74473996c377477ad718bba495fe7cd022d5b802aaf32c853f115
• d742a33692a77f5caef5ea175957c98b56c2dc255144784ad3bade0a0d50d088
• ddf039c3d6395139fd7f31b0a796a444f385c582ca978779aae7314b19940812
• dcaaef3509bc75155789058d79f025f14166386cec833c2c154ca34cfea26c52
• 54d36e5dce2e546070dc0571c8b3e166d6df62296fa0609a325ace23b7105335
• 095c223b94656622c81cb9386aefa59e168756c3e200457e98c00b609e0bb170
• 0f0cabb24d8cc93e5aed340cfc492c4008509f1e84311d61721a4375260a0911
• 2ced68e4425d31cca494557c29a76dfc3081f594ff01549e41d2f8a08923ef61
• 3215decffc40b3257ebeb9b6e5c81c45e298a020f33ef90c9418c153c6071b36
• ef3e0845b289f1d3b5b234b0507c554dfdd23a5b77f36d433489129ea722c6bb
• 7c76ca5eb757df4362fabb8cff1deaa92ebc31a17786c89bde55bc53ada43864
• 48c2f53f1eeb669fadb3eec46f7f3d4572e819c7bb2d39f22d22713a30cc1846
• 43f46a66c821e143d77f9311b24314b5c5eeccfedbb3fbf1cd484c9e4f537a5d
• 8c4294e3154675cd926ab6b772dbbe0e7a49cae16f4a37d908e1ca6748251c43

Breaking News: 2022-02-04 - 2022-02-10

DHS Launches Cyber Safety Review Board to Analyze Major Vulnerability Events

The U.S. Department of Homeland Security has established the Cyber Safety Review Board (CSRB), with the role to assess significant cybersecurity events so as to protect networks and infrastructure in the United States. It has been initially tasked to investigate the response and handling of the Log4j vulnerability.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/cyber-safety-review-board-to-analyze-major-vulnerability-events

Cisco fixes critical bugs in SMB routers, exploits available - BleepingComputer

Cisco has released patches for 15 vulnerabilities in the Small Business RV Series router platform. Five of these vulnerabilities are rated Critical, and proof-of-concept exploit code is available for several of the vulnerabilities fixed in these updates. Users should apply these updates to secure their networks.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-bugs-in-smb-routers-exploits-available/

Intuit warns of phishing emails threatening to delete accounts - BleepingComputer

Intuit Inc. is an American business that specializes in financial software.The firm has notified customers of an ongoing phishing campaign impersonating the company and trying to lure victims with fake warnings that their accounts have been suspended.

See the full report here: https://www.bleepingcomputer.com/news/security/intuit-warns-of-phishing-emails-threatening-to-delete-accounts/

State hackers' new malware helped them stay undetected for 250 days - BleepingComputer

A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies. The malware has been used in a campaign against targets in Taiwan.

See the full report here: https://www.bleepingcomputer.com/news/security/state-hackers-new-malware-helped-them-stay-undetected-for-250-days/

Zimbra zero-day vulnerability actively exploited to steal emails - BleepingComputer

Zimbra is an open-source collaboration suite and email platform that provides users with video conferencing, chat, file sharing, and cloud storage, as well as an email server and a web client. A cross-site scripting (XSS) vulnerability in the Zimbra email platform is currently actively exploited in attacks targeting European media and government organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/zimbra-zero-day-vulnerability-actively-exploited-to-steal-emails/

Microsoft disables MSIX protocol handler abused in Emotet attacks - BleepingComputer

Microsoft has disabled the MSIX ms-appinstaller protocol handler exploited in malware attacks to install malicious apps directly from a website via a Windows AppX Installer spoofing vulnerability. The decision comes after the company released security updates to address the flaw (tracked as CVE-2021-43890) during the December 2021 Patch Tuesday and provided workarounds to disable the MSIX scheme without deploying the patches.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-msix-protocol-handler-abused-in-emotet-attacks/

CISA orders federal agencies to patch actively exploited Windows bug - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch their systems against an actively exploited Windows vulnerability that enables attackers to gain SYSTEM privileges. Per a binding operational directive (BOD 22-01) issued in November and today's announcement, all Federal Civilian Executive Branch Agencies (FCEB) agencies are now required to patch all systems against this vulnerability, tracked as CVE-2022-21882 within two weeks, until February 18th.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-patch-actively-exploited-windows-bug/

Argo CD vulnerability leaks sensitive info from Kubernetes apps - BleepingComputer

A vulnerability in Argo CD, used by thousands of organizations for deploying applications to Kubernetes, can be leveraged in attacks to disclose sensitive information such as passwords and API keys. Tracked as CVE-2022-24348, the path-traversal flaw was discovered by the security research team at Apiiro and can lead to privilege escalation, information disclosure, and lateral movement attacks. Threat actors can exploit the vulnerability by loading a malicious Kubernetes Helm Chart YAML file onto the target system, allowing the extraction of sensitive information from other applications.

See the full report here: https://www.bleepingcomputer.com/news/security/argo-cd-vulnerability-leaks-sensitive-info-from-kubernetes-apps/

Wormhole restores stolen $326 million after major crypto bailout - BleepingComputer

Cryptocurrency platform Wormhole has recovered upwards of $326 million stolen in this week's crypto hack, thanks to a major bailout. Being a cross-chain crypto platform, Wormhole allows users to transfer cryptocurrency across different blockchains, such as Ethereum, Solana, and Binance Smart Chain, among others. It does this by locking the original token in a smart contract and then minting a "wrapped" version of the stored token that can be transferred to another blockchain.

See the full report here: https://www.bleepingcomputer.com/news/security/wormhole-restores-stolen-326-million-after-major-crypto-bailout/

FBI's warning about Iranian firm highlights common cyberattack tactics - CSO Online

The US Federal Bureau of Investigation (FBI) has released a warning outlining the TTP (tactics, techniques, and protocols) of Iran-based Emennet Pasargad, reportedly a cybersecurity and intelligence firm servicing Iranian government agencies, to help recipients inform and defend themselves against the group’s malicious activities. In the FBI's Private Industry Notification, the agency confirms that two Iranian nationals employed by Emennet were charged with cyber intrusion and fraud, voter intimidation, interstate threats, and conspiracy by the US Department of Justice.

See the full report here: https://www.csoonline.com/article/3649348/fbis-warning-about-iranian-firm-highlights-common-cyberattack-tactics.html

Initial Access Broker Involved in Log4Shell Attacks Against VMware Horizon Servers

Prophet Spider, an initial access broker organization, has been linked to a series of malicious operations that take advantage of the Log4Shell vulnerability in unpatched VMware Horizon Servers. According to fresh data released today by BlackBerry Research & Intelligence and Incident Response (IR) teams, cybercriminals have been exploiting the flaw to download a second-stage payload onto victims' PCs. As a result of the attack on Horizon servers, VMware has advised its clients to apply the updates as soon as possible.

See the full report here: https://thehackernews.com/2022/01/initial-access-broker-involved-in.html

LockBit ransomware gang claims to have stolen data from PayBito crypto exchange

The LockBit ransomware gang claims to have hacked the PayBito crypto exchange and taken user data. PayBito is a bitcoin and cryptocurrency exchange that accepts Bitcoin Cash, Bitcoin, Ethereum, HCX, Litecoin, and Ethereum Classic, among other cryptocurrencies. The creators of the Lockbit ransomware claim to have stolen a database containing personal information from over 100,000 consumers around the world. The FBI issued a flash alert with technical information about the LockBit ransomware operation.

See the full report here: https://securityaffairs.co/wordpress/127683/cyber-crime/lockbit-ransomware-hit-paybito.html

Another Israeli Firm, QuaDream, Caught Weaponizing iPhone Bug for Spyware

A now-patched security weakness in Apple iOS was used by a different surveillance firm QuaDream to hack into the company's devices, which was previously discovered to be exploited by Israeli company NSO Group.  The REIGN, QuaDream's spyware,  REIGN, works similarly to NSO Group's Pegasus in that it gives its users complete control over their devices.

See the full report here: https://thehackernews.com/2022/02/another-israeli-firm-quadream-caught.html

U.S. Authorities Charge 6 Indian Call Centers Scamming Thousands of Americans

A number of call centres in India, as well as their directors, have been charged with placing tens of millions of scam calls targeted at scamming thousands of Americans. The US Justice Department stated in a statement that India-based call centres scam U.S. people, often the elderly, by deceiving victims over the phone with schemes such as Social Security and IRS impersonation, as well as loan fraud.

See the full report here: https://thehackernews.com/2022/02/us-authorities-charge-6-indian-call.html

New SEO Poisoning Campaign Distributing Trojanized Versions of Popular Software - The Hacker News

Mandiant researchers released a report stating that an ongoing search engine optimization (SEO) poisoning attack campaign has been observed, exploiting users' trust in legitimate software applications to trick them into installing BATLOADER malware on infected workstations. The threat actor exploited SEO terms like 'free productivity apps installation' or 'free software development tools installation' to attract consumers to a compromised website and download a malicious installer.

See the full report here: https://thehackernews.com/2022/02/new-seo-poisoning-campaign-distributing.html

Man used stolen credit card details from Telegram on taxi rides and Burger King, gets jail - CNA

A person has been sentenced to imprisonment in Singapore after making purchases using stolen credit card information. He had obtained the credentials from a Telegram group chat and used them for taxi bookings and Burger King orders.

See the full report here: https://www.channelnewsasia.com/singapore/man-used-stolen-credit-card-details-telegram-taxi-rides-and-burger-king-gets-jail-2483386

BlackCat (ALPHV) ransomware linked to BlackMatter, DarkSide gangs

The ransomware gang BlackCat – which recently attacked Oiltanking, a German petrol distributor, and Mabanaft GmbH, an oil supplier – has confirmed to comprise former members of BlackMatter/DarkSide. BlackCat (or ALPHV) is a new feature-rich ransomware operation developed in the Rust programming language, which is unusual for ransomware infections.

See the full report here: https://www.bleepingcomputer.com/news/security/blackcat-alphv-ransomware-linked-to-blackmatter-darkside-gangs/

Washington state Department of Licensing hit by a potential data breach - SiliconANGLE News

The Washington Department of Licensing has disclosed a potential data breach that may have exposed the details of around 250,000 professional licenses. The data may include social security numbers, dates of birth, driver's license numbers, and other personally-identifying information.

See the full report here: https://siliconangle.com/2022/02/06/washington-department-licensing-hit-potential-data-breach/

New Mexico health insurance company sued over data breach [The Santa Fe New Mexican] - Insurance News Net

A lawsuit has been filed against the insurance firm True Health New Mexico stating that about 63,000 patients' personal information might have been stolen. The result of the True Health breach is that people with compromised information are forced to go through the expense and hassle of canceling accounts and documents, obtaining new ones, and carefully monitoring their online profiles for years.

See the full report here: https://insurancenewsnet.com/oarticle/new-mexico-health-insurance-company-sued-over-data-breach-the-santa-fe-new-mexican

New CapraRAT Android Malware Targets Indian Government and Military Personnel

A politically motivated advanced persistent threat group is reportedly using a new remote access trojan (RAT) called CapraRAT in its espionage attacks aimed at Indian military and diplomatic entities. The RAT can be used to exfiltrate information from targeted Windows systems, including screenshots, keystrokes, and files from removable drives.

See the full report here: https://thehackernews.com/2022/02/new-caprarat-android-malware-targets.html

Microsoft fixes Windows Active Directory bug caused by Jan updates - BleepingComputer

Microsoft has released a patch for an issue triggered by last month's Windows updates, which affects apps using Microsoft .NET when acquiring or setting Active Directory Forest Trust Information. This issue affects Windows Server platforms, including Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-active-directory-bug-caused-by-jan-updates/

Roaming Mantis Expands Android Backdoor to Europe

The Roaming Mantis Android malware campaign has entered Europe, particularly France, with over 65,000 downloads of the group’s remote access trojan (RAT) last month. The group is known for its "smishing" (SMS-based phishing) attacks, where SMSs contain a URL to a malicious page.

See the full report here: https://threatpost.com/roaming-mantis-android-backdoor-europe/178247/

Free decryptor released for TargetCompany ransomware victims - BleepingComputer

Avast has released a decryption tool using which victims of the TargetCompany ransomware can recover their files. TargetCompany is a new ransomware strain that has been observed since mid-2021. TargetCompany ransomware victims can download the decryption tool from Avast's servers to decrypt entire disk partitions using the instructions displayed within the tool's user interface.

See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-targetcompany-ransomware-victims/

Puma hit by data breach after Kronos ransomware attack - BleepingComputer

Sportswear manufacturer Puma was hit by a data breach following the ransomware attack that hit Kronos. The attackers stole personal information belonging to Puma employees and their dependents from the Kronos Private Cloud (KPC) cloud environment before encrypting the data.

See the full report here: https://www.bleepingcomputer.com/news/security/puma-hit-by-data-breach-after-kronos-ransomware-attack/

Medusa Malware Joins Flubot’s Android Distribution Network

Flubot, the Android spyware that's been spreading virally since last year, has hitched its infrastructure wagon up to another mobile threat known as Medusa. If a victim falls for the ruse, the malware is installed, which adds the infected device to a botnet.

See the full report here: https://threatpost.com/medusa-malware-flubot-android-distribution/178258/

FBI Publishes Indicators of Compromise for LockBit 2.0 Ransomware

The FBI has issued a flash bulletin that details the specific indicators of compromise (IoCs) associated with LockBit 2.0 ransomware. The bulletin also includes recommendations to protect networks and mitigate the risk of compromise.

See the full report here: https://www.darkreading.com/threat-intelligence/fbi-publishes-indicators-of-compromise-for-lockbit-2-0-ransomware

DPD Group parcel tracking flaw may have exposed customer data - BleepingComputer

DPD Group is a parcel delivery service with a global presence, shipping around two billion parcels annually worldwide. An unauthenticated API call vulnerability in DPD Group’s package tracking system could have been exploited to access the personally identifiable details of its clients.

See the full report here: https://www.bleepingcomputer.com/news/security/dpd-group-parcel-tracking-flaw-may-have-exposed-customer-data/

Russia arrests third hacking group, reportedly seizes carding forums - BleepingComputer

Six people have been reportedly arrested on the advice of the Russian Ministry of Internal Affairs. They have been part of a hacking group involved in the theft and selling of stolen credit cards.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-arrests-third-hacking-group-reportedly-seizes-carding-forums/

Update your Chrome browser now, warns Cert-In

Government cybersecurity agency - CERT-In is asking users to update to the latest Google Chrome browser version - Google Chrome 98. CERT- In has issued a 'high severity' warning to people that if users do not update then hackers may take advantage of this to steal the data.

See the full report here: https://www.deccanherald.com/business/technology/update-your-chrome-browser-now-warns-cert-in-1078999.html

Microsoft Disables Internet Macros in Office Apps by Default to Block Malware Attacks

Microsoft is taking steps to disable Visual Basic for Applications (VBA) macros by default across its products, for documents downloaded from the internet. The attempt is to eliminate an entire class of attack vector, as threat actors often use macros for delivering malware, leading to compromised identity, data loss, and even remote access.

See the full report here: https://thehackernews.com/2022/02/microsoft-disables-internet-macros-in.html

Qbot needs only 30 minutes to steal your credentials, emails - BleepingComputer

The notorious malware Qbot (or Qakbot/QuakBot) is being used to conduct high-speed attacks. Threat actors using this malware reportedly need just about 30 minutes to steal browser data and emails from Outlook and jump on to an adjacent workstation under an hour. This high-speed lateral movement becomes extremely challenging for defense teams to manage if there's no network segmentation to protect the workstations.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-needs-only-30-minutes-to-steal-your-credentials-emails/

Palestinian Hackers Use New NimbleMamba Implant in Recent Attacks

The advanced persistent threat (APT) group Molerats (or TA402) is using a previously undocumented impant called NimbleMamba in their latest campaign. The campaign reportedly involved a sophisticated attack chain targeting Middle Eastern governments, foreign-policy think tanks, and an airline company.

See the full report here: https://thehackernews.com/2022/02/palestinian-hackers-using-new.html

Vodafone Portugal 4G and 5G services down after cyberattack - BleepingComputer

A cyberattack has disrupted the 4G/5G data networks, SMS texts, and television services of Vodafone Portugal. The company has stated that there is no evidence yet of any customer data being breached in the attack. Meanwhile, the Lapsus$ group has reportedly mentioned they "don't confirm or deny" yet whether they were responsible for the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/vodafone-portugal-4g-and-5g-services-down-after-cyberattack/

Mozilla fixes Firefox bug letting you get Windows admin privileges - BleepingComputer

Mozilla has released a patch for a high-severity privilege-escalation vulnerability (CVE-2022-22753) in the Mozilla Maintenance Service. This vulnerability could let an attacker escalate their privileges to NT AUTHORITY\SYSTEM account rights (the highest level of privileges on a Windows system). This bug only affects Firefox on Windows.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-bug-letting-you-get-windows-admin-privileges/

Microsoft February 2022 Patch Tuesday fixes 48 flaws, 1 zero-day - BleepingComputer

Microsoft released patches for 48 flaws, including one zero-day vulnerability, in the February 2022 Patch Tuesday. None of these vulnerabilities were classified as Critical. In addition, 22 Microsoft Edge vulnerabilities were also fixed.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2022-patch-tuesday-fixes-48-flaws-1-zero-day/

Google fixes remote escalation of privileges bug on Android - BleepingComputer

Google has included fixes for two critical vulnerabilities as part of the February 2022 Android security updates. One critical bug, CVE-2021-39675, affects only Android 12. The second, CVE-2021-30317, affects a closed-source component of Qualcomm, so Android devices that use Qualcomm hardware are vulnerable. Google has reportedly not observed any evidence of active exploitation of these bugs.

See the full report here: https://www.bleepingcomputer.com/news/security/google-fixes-remote-escalation-of-privileges-bug-on-android/

Canadian sentenced for his role in Netwalker ransomware attacks | IT World Canada News

A Canadian man got a six-year jail term for working with the Netwalker ransomware gang on their attacks on 17 Canadian organizations including the Northwest Territories Power Corporation and the College of Nurses of Ontario. According to the U.S. DoJ, he earned about $27.6 million through these attacks.

See the full report here: https://www.itworldcanada.com/article/canadian-sentenced-for-his-role-in-netwalker-ransomware-attacks/472760

Data Breach Alert: Suncoast Skin Solutions | JD Supra

U.S.-based dermatology business Suncoast Skin Solutions filed a data breach disclosure. The breach, which happened in July 2021 and was discovered in January 2022, resulted in the names and Social Security numbers of 8,099 people being compromised.

See the full report here: https://www.jdsupra.com/legalnews/data-breach-alert-suncoast-skin-1065925/

Data Breach at iRISE Florida Spine and Joint Institute, LLC | JD Supra

U.S.-based healthcare business iRISE Florida Spine and Joint Institute has filed a data breach disclosure. The reach and impact of the breach, which happened in February 2021 and discovered in November 2021, is yet to be assessed, said the company.

See the full report here: https://www.jdsupra.com/legalnews/data-breach-at-irise-florida-spine-and-6095131/

Georgia voter info posted online after breach of software company

U.S.-based voting software company EasyVote Solutions disclosed a data breach that happened on January 31, which exposed the information about some voters in Georgia state. Information such as names, addresses, races and birthdates were shared to an online forum.

See the full report here: https://www.ajc.com/politics/georgia-voter-info-posted-online-after-breach-of-software-company/R4HBSYYBYBB6NPTIJDZ67A4WVA/

Data breach at Ohlone College compromises students', staff personal information

Ohlone Community College District, a U.S.-based public community college, suffered a data breach in which its staff and students were affected. The information stolen includes "pretty much everything" needed for identity theft.

See the full report here: https://www.ktvu.com/news/data-breach-at-ohlone-college-compromises-students-staff-personal-information

Over 6,000 Memorial Hermann patients’ information leaked in contractor’s data breach, vendor says

Advent Health Partners, contracted vendor of U.S.-based healthcare service Memorial Hermann Health System, suffered a data breach. The incident has exposed protected health information of 6,260 patients.

See the full report here: https://www.click2houston.com/news/local/2022/02/08/over-6000-memorial-hermann-patients-information-leaked-in-contractors-data-breach-vendor-says/

WOLF HALDENSTEIN ADLER FREEMAN & HERZ LLP: Morley Companies, Inc. Data Breach Investigation Alert

U.S.-based consumer rights law firm Wolf Haldenstein Adler Freeman & Herz has started investigations on the Morley Companies data brech. Morley provides business services to dozens of Fortune 500 companies, many of which are under data breach threat.

See the full report here: https://www.marketscreener.com/news/latest/WOLF-HALDENSTEIN-ADLER-FREEMAN-HERZ-LLP-Morley-Companies-Inc-Data-Breach-Investigation-Alert--37830642/

European, U.S. regulators tell banks to prepare for Russian cyberattack threat

The European Central Bank, the central bank of the 19 European Union countries that use the euro, has warned against potential Russian cyberattacks on European banks. The EU banking institutions have started mounting their defence.

See the full report here: https://www.reuters.com/markets/europe/european-us-regulators-tell-banks-prepare-russian-cyberattack-threat-2022-02-09/

Molerats hackers deploy new malware in highly evasive campaign

Palestinian APT group Molerats was spotted using a new implant named 'NimbleMamba' in a cyber-espionage campaign to control internet traffic, say reasearchers. Three variations of the infection chain are targeting Middle Eastern governments, foreign policy think tanks, and a state-owned airline.

See the full report here: https://www.bleepingcomputer.com/news/security/molerats-hackers-deploy-new-malware-in-highly-evasive-campaign/

Justice Department Says It Seized $3.6 Billion Worth of Bitcoin Stolen in 2016 Hack

The U.S. has recovered about $3.6 billion in Bitcoin stolen from the Bitfinex currency exchange in 2016, a move claimed to be the largest financial seizure ever. Bitfinex is the exchange affiliated with the world’s biggest stablecoin, Tether.

See the full report here: https://www.wsj.com/articles/justice-department-says-it-seized-3-6-billion-in-stolen-cryptocurrency-exchange-hack-11644339381

Donation site for Ottawa truckers’ ‘Freedom Convoy’ protest exposed donors’ data – TechCrunch

People who donated to support the truckers currently participating in Canada's “Freedom Convoy” could have had their passport and driver licenses photos exposed due to a security lapse on the donation site GiveSendGo. The source of data: an exposed Amazon S3 bucket.

See the full report here: https://techcrunch.com/2022/02/08/ottawa-trucker-freedom-convoy-exposed-donation/