Threat Intelligence Bulletin: 02/11/2022 - 02/17/2022

Flash Report: BlackByte Ransomware Claims Responsibility for Attack on San Francisco 49ers

TLP: WHITE

Threat actors leveraging BlackByte ransomware claimed to have exfiltrated data in an attack targeting the San Francisco 49ers (49ers) of the National Football League. The method of intrusion has not yet been disclosed, and the ransom demand is unknown. A statement made by the 49ers indicates that it believes the attack is limited to its own corporate network and has not spread to third-party affiliates. The ransomware strain, identified as early as July 2021, operates as part of a ransomware-as-a-service (RaaS) operation and is known to leverage double extortion tactics to pressure victims into making ransom payments. ZeroFox has detected approximately 50 BlackByte victims since its initial identification, predominantly targeting organizations in the manufacturing, retail, and construction industries, and typically targeting those based in the U.S.-Canada region.

Recommendations

• Back up critical data regularly, including password-protected backup copies kept offline.
• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, or the cloud).
• Ensure proper network segmentation.
• Patch disclosed vulnerabilities with updated software versions as quickly as practical.
• Disable PowerShell wherever possible to limit the possibility of operators employing lateral movement modules.
• Never download email attachments from unknown senders or click links from untrusted sources. Provide user training programs to fight against phishing or social engineering attacks used to obtain critical information that can lead to system compromise.
• Enable multi-factor authentication wherever possible.
• Disable unused remote access/RDP ports and monitor remote access/RDP logs.
• Leverage threat intelligence services and maintain situational awareness of Tactics, Techniques, and Procedures related to ransomware groups.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Analyst Commentary

Reporting indicates that on February 12, 2022, the San Francisco 49ers confirmed they had been impacted by a “network security incident that resulted in a temporary disruption to certain systems” on their corporate network. On the evening of February 12, 2022, the BlackByte ransomware group claimed responsibility for the incident, listing the National Football League team as a victim on their dark web leak site, and began leaking files they claimed to have stolen; while the initial leak is a 292MB archive file that threat actors are claiming are stolen 2020 invoices, it is highly likely that they have stolen considerably more data and are using this sample as proof of compromise in double extortion tactics. BlackByte has been observed stealing gigabytes of data from previous victims.

The method of intrusion has not yet been disclosed. However, reporting indicates that BlackByte operators typically target Windows-based networks by leveraging vulnerabilities to gain access to corporate networks. BlackByte operators have been known to leverage a suite of ProxyShell Microsoft Exchange Server vulnerabilities as an intrusion vector. After gaining initial access to a network, threat actors tend to move laterally throughout a network and attempt to gain access to accounts with higher privileges through privilege escalation efforts before exfiltrating and encrypting files. In statements made by the 49ers, the incident is believed to have been limited to their corporate IT network, with no indication that it is spread to third-party affiliates. The ransom demand made to the 49ers is currently not known.

San Francisco 49ers listed as a victim on BlackByte leak site
Source: ZeroFox Intelligence

The attack took place the day before SuperBowl LVI and the day after the FBI issued an advisory warning about the prevalence of BlackByte ransomware. It is likely the authorities had advanced warning of, or suspected an attack may be scheduled to take place over SuperBowl LVI weekend. The FBI advisory is also likely to contain tactics and indicators of compromise from the current 49ers attack. ZeroFox has included a sample of possible indicators of compromise at the end of this report; see the FBI’s alert for full details.

Reporting indicates that BlackByte ransomware was identified as early as July 2021. ZeroFox has detected approximately 50 BlackByte victims since its launch, targeting organizations in the manufacturing, retail, and construction industries, and typically targeting those based in the U.S.-Canada region. In October 2021, a free decryptor was released on GitHub after the BlackByte operation reused the same encryption key in multiple attacks, allowing some victims to recover their files for free. Threat actors later rectified the encryption reuse mistake.

BlackByte Ransomware Attacks, Top 5 Industries: Feb 2021 - Feb 2022
Source: ZeroFox Intelligence

Reporting indicates that BlackByte operates a RaaS operation where ransomware is rented to affiliates who deploy the malware against victims. These affiliates exfiltrate files from compromised networks, which the BlackByte gang uses as leverage in negotiations, threatening victims that they will release the stolen files on a dark web leak site if they fail to pay ransom demands.

Indicators of Compromise

schtasks.exe /DELETE /TN "\"Raccine Rules Updater\"" /F

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

powershell.exe Set-MpPreference -EnableControlledFolderAccess Disabled

cmd.exe /c netsh advfirewall firewall set rule "group=\"Network Discovery\"" new enable=Yes

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v 

LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

powershell.exe Install-WindowsFeature -Name \"RSAT-AD-PowerShell\" –IncludeAllSubFeature

powershell.exe Import-Module ActiveDirectory;Get-ADComputer -Filter * -Properties * | FT Name

cmd.exe /c powershell -command "$x = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String
('VwBpA'+'G4ARAB'+'lAGYA'+'ZQB'+'uAG'+'QA'));Stop-Service -Name $x;Set-Service -StartupType Disabled $x"

powershell.exe $x = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String
('RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAg'+'AFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8AC'+
'AARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkA'+'F8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA=='));Invoke-Expression $x

Breaking News: 2022-02-11 - 2022-02-17

Critical RCE Flaws in 'PHP Everywhere' Plugin Affect Thousands of WordPress Sites

Researchers have discovered critical security vulnerabilities in a WordPress plugin used by more than 30,000 websites worldwide. Successful exploitation of the vulnerabilities could result in the execution of malicious PHP code that could even achieve a complete site takeover. Users are advised to update to version 3.0.0 of the plugin.

See the full report here: https://thehackernews.com/2022/02/critical-rce-flaws-in-php-everywhere.html

SAP Patches Severe ‘ICMAD’ Bugs

SAP has released patches for three critical vulnerabilites relating to its Internet Communication Manager (ICM). These bugs could allow attackers to hijack identities, steal data, and severely affect business operations. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) had recently issued a security advisory on patching these ICMAD vulnerabilites.

See the full report here: https://threatpost.com/sap-patches-severe-icmad-bugs/178344/

Apple patches new zero-day exploited to hack iPhones, iPads, Macs - BleepingComputer

Apple has released fixes for a zero-day vulnerability that has been under active exploitation in the wild. The bug (CVE-2022-22620) is a WebKit Use After Free issue that could lead to operating-system crashes and code execution on compromised devices.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-patches-new-zero-day-exploited-to-hack-iphones-ipads-macs/

Microsoft starts killing off WMIC in Windows, will thwart attacks - BleepingComputer

Microsoft is starting to remove the Windows Management Instrumentation Command-line (WMIC) tool, wmic.exe, which will be superseded by Windows PowerShell for WMI. The tool was considered a LOLBIN (living-off-the-land binary), thiat is, a Microsoft-signed executable that threat actors abuse to evade detection while performing malicious tasks.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-starts-killing-off-wmic-in-windows-will-thwart-attacks/

Decryptor Keys Published for Maze, Egregor, Sekhmet Ransomwares

The ransomware gang Maze has reportedly announced that it has terminated its ransomware operations and published the decryptor keys for the Maze/Egregor/Sekhmet ransomware strains. This group was a pioneer in "double extortion": encrypting victims' files and threatening to leak the files online if payments were not made.

See the full report here: https://threatpost.com/decryptor-keys-maze-egregor-sekhmet-ransomwares/178363/

Qbot, Lokibot malware switch back to Windows Regsvr32 delivery - BleepingComputer

Threat actors are reportedly spreading malware, in a method dubbed Squiblydoo, via Microsoft Office documents using regsvr32.exe. Because regsvr32 is a Windows tool used for routine operations, this method allows the malware operation to evade detection and blacklisting.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-lokibot-malware-switch-back-to-windows-regsvr32-delivery/

Microsoft fixes Defender flaw letting hackers bypass antivirus scans - BleepingComputer

Microsoft has fixed a vulnerability in the Microsoft Defender Antivirus on Windows that allowed attackers to plant and execute malicious payloads without triggering Defender's malware-detection engine. The flaw relates to the security settings of a registry key that contained the locations excluded from Microsoft Defender scanning.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-defender-flaw-letting-hackers-bypass-antivirus-scans/

CISA, FBI, NSA Issue Advisory on Severe Increase in Ransomware Attacks

A joint advisory from the cybersecurity authorities from Australia, the U.K., and the U.S have highlighted the evolving techniques/targets of ransonware gangs and recommended mitigation measures. The advisory underscored the shifting focus to mid-sized victim companies and the use of "triple extortion."

See the full report here: https://thehackernews.com/2022/02/cisa-fbi-nsa-issue-advisory-on-severe.html

Hacking group 'ModifiedElephant' evaded discovery for a decade - BleepingComputer

Researchers have discovered an advanced persistent threat (APT) actor operating in utmost secrecy for over a decade. Coded ModifiedElephant, this group of hackers employs readily-available trojans through spear-phishing.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-modifiedelephant-evaded-discovery-for-a-decade/

Thousands of npm accounts use email addresses with expired domains

An academic research project found that 2,818 project maintainers were still using an email address for their accounts that had an expired domain, some of which they found on sale on sites like GoDaddy. The research team has notified GitHub, which owns npm. npm announced plans to enforce 2FA for developers, and the process was scheduled to take place in multiple stages.

See the full report here: https://malware.news/t/thousands-of-npm-accounts-use-email-addresses-with-expired-domains/57347/1

Twitter is down with "Something went wrong" errors

Twitter experienced a worldwide service disruption making it impossible for users to read tweets on the web and load threads using the mobile app. Users reported that the app prevented them from sending the tweets, were logged out, and, a few were unable to log back into their accounts. Twitter fixed the technical bug that was preventing timelines from loading and Tweets from posting.

See the full report here: https://www.bleepingcomputer.com/news/technology/twitter-is-down-with-something-went-wrong-errors/

Croatian phone carrier data breach impacts 200,000 clients

Croatian phone carrier 'A1 Hrvatska' has disclosed a data breach exposing the personal information of 10% of its customers, roughly 200,000 people. The exposed information includes full names, personal identification numbers, physical addresses, and telephone numbers. The company has confirmed the breach and emphasizes that information on bank cards or online accounts hasn't been compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/croatian-phone-carrier-data-breach-impacts-200-000-clients/

Critical MQTT-Related Bugs Open Industrial Networks to RCE Via Moxa

Critical security vulnerabilities in Moxa’s MXview web-based network management system open the door to unauthenticated remote code execution (RCE) as SYSTEM on any unpatched MXview server, researchers warned this week. The five bugs, affecting versions 3.x to 3.2.2, score a collective 10 out of 10 on the CVSS vulnerability-severity scale. The bugs are patched in MXview version 3.2.4.

See the full report here: https://threatpost.com/critical-mqtt-bugs-industrial-rce-moxa/178399/

FritzFrog P2P Botnet is back and targets Healthcare, Education and Government Sectors

FritzFrog P2P botnet is back with a new variant, targeting servers belonging to entities in the healthcare, education, and government sectors. The new campaign was spotted in early December 2021, the attack chain starts with an SSH brute force, then the malware drops and executes a file on the server. In December the botnet registered a 10x growth in its infection rate peaking at 500 incidents per day in January 2022.

See the full report here: https://securityaffairs.co/wordpress/127909/malware/fritzfrog-p2p-botnet-resurfaced.html

Israel's Mossad used Pegasus spyware to hack cellphones unofficially - Haaretz

Several workers of the NSO Group revealed that Mossad, Israel's national intelligence agency, used NSO's Pegasus spyware to hack cellphones unofficially under the agency's previous director, Yossi Cohen. Because of their confidentiality agreements with the corporation, the employees were asked to stay anonymous. According to a revelation published by the financial daily Calcalist, the police utilized Pegasus without a warrant to hack the phones of Israelis who were neither criminals nor under criminal investigation.

See the full report here: https://www.haaretz.com/israel-news/.premium-israel-s-mossad-used-pegasus-spyware-to-hack-cellphones-unofficially-1.10608145

Shields Up: CISA Warns American Companies About Russian Hacking - PCMag AU

The US Cybersecurity and Infrastructure Agency (CISA) warns that American businesses should be extra vigilant about suspected Russian hacking attempts as the tension with Russia rises.  According to CISA, all businesses, regardless of size, take a more proactive approach to cybersecurity and protecting their most valuable assets. On its website, CISA provides advice to review the January alert related to Understanding and Mitigating Russian State-Sponsored Cyber Threats to US Critical Infrastructure.

See the full report here: https://au.pcmag.com/security/92433/shields-up-cisa-warns-american-companies-about-russian-hacking

Hackers Rigged Hundreds of Ecommerce Sites to Steal Payment Info - WIRED

Sansec, the security firm, uncovered the latest wave of infections and added that the compromised sites were all loading malicious scripts hosted at the domain naturalfreshmall[.]com. The Natural Fresh skimmer displays a bogus payment popup, circumventing the security of a hosted payment form (PCI compliant). The attackers combined a SQL injection with a PHP object injection attack in a Magento plug-in known as Quickview and using the exploits to run malicious code directly on the web server, according to the researchers.

See the full report here: https://arstechnica.com/information-technology/2022/02/hundreds-of-e-commerce-sites-booby-trapped-with-payment-card-skimming-malware/

Data Breach Exposes Booking Details of 19 Million Customers - BankInfoSecurity.com

A major data breach involving over 172 GB of data and an estimated 19 million users has been discovered. According to analysts, the victims are mostly users of the online appointment business FlexBooker. Hackers might have used the exposed data to commit several of the most frequent types of fraud against anyone using a FlexBooker-enabled website, including identity theft, fraud, and financial schemes.

See the full report here: https://www.bankinfosecurity.com/data-breach-exposes-booking-details-19-million-customers-a-18505

Critical Magento 0-Day Vulnerability Under Active Exploitation — Patch Released

Adobe has released patches for a security vulnerability relating to its Commerce and Magento Open Source products. The flaw (CVE-2022-24086, CVSS: 9.8/10) is an improper input validation issue that could be weaponized to achieve arbitrary code execution. The company stated that it's aware of the bug being exploited in the wild.

See the full report here: https://thehackernews.com/2022/02/critical-magento-0-day-vulnerability.html

NFL's San Francisco 49ers hit by Blackbyte ransomware attack - BleepingComputer

The San Francisco 49ers team is currently investigating a cyberattack that disrupted a part of its IT network. The BlackByte ransomware gang claimed responsibility and leaked some files that were allegedly stolen in the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/nfls-san-francisco-49ers-hit-by-blackbyte-ransomware-attack/

Microsoft is making it harder to steal Windows passwords from memory - BleepingComputer

Microsoft is enabling a Microsoft Defender "Attack Surface Reduction" security rule by default as an enhanced security measure. This is an attempt to block hackers' attempts to steal Windows credentials from the LSASS process. The full Attack Surface Reduction feature is only supported on Windows Enterprise licenses running Microsoft Defender as the primary antivirus.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-is-making-it-harder-to-steal-windows-passwords-from-memory/

CISA urges orgs to patch actively exploited Windows SeriousSAM bug - BleepingComputer

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added another 15 security issues actively used in cyberattacks to the catalog of vulnerabilities. Prominent among them is a Microsoft Windows SAM (Security Accounts Manager) vulnerability (CVE-2021-36934, patched last year) that allows unauthorized access to Registry database files.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-urges-orgs-to-patch-actively-exploited-windows-serioussam-bug/

QNAP extends critical updates for some unsupported NAS devices - BleepingComputer

QNAP has extended support and will keep issuing security updates for some end-of-life network-attached storage (NAS) devices until October 2022. These devices will only receive security updates addressing high severity and critical vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-extends-critical-updates-for-some-unsupported-nas-devices/

Sports brand Mizuno hit with ransomware attack delaying orders - BleepingComputer

A ransomware attack on the Japanese sports brand Mizuno has reportedly affected its business operations. The attack has led to phone outages, website issues, problems in printing shipping labels, and order delays.

See the full report here: https://www.bleepingcomputer.com/news/security/sports-brand-mizuno-hit-with-ransomware-attack-delaying-orders/

Ukraine says it’s targeted by ‘massive wave of hybrid warfare’ - BleepingComputer

The Security Service of Ukraine (SSU) is reportedly monitoring and dismantling bot farms targetting its social networks and mass media, as part of countering a "wave of hybrid warfare." The agency recently dismantled two bot farms that controlled 18,000 social network accounts and spread disinformation.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-says-it-s-targeted-by-massive-wave-of-hybrid-warfare-/

Google Chrome emergency update fixes zero-day exploited in attacks - BleepingComputer

Google has released Chrome 98.0.4758.102 for Windows, Mac, and Linux to patch a high-severity zero-day vulnerability, as well as seven other bugs. The high-severity flaw (CVE-2022-0609) is a "Use after free in Animation" bug and is being exploited by attackers. Users should update their Chrome browser as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-zero-day-exploited-in-attacks/

Hackers Snagged $36 Million in Crypto in Breach of IRA Financial - Bloomberg

Hackers have reportedly stolen $21 million in BTC and $15 million in ETH from the accounts of IRA Financial Trust customers. IRA allows its customers to purchase cryptocurrency through a partnership with the cryptocurrency exchange Gemini Trust Co. Meanwhile, Gemini has stated that it wasn’t breached, and offered to assist IRA Financial Trust in its investigation.

See the full report here: https://www.bloomberg.com/news/articles/2022-02-14/ira-financial-hacked-36-million-in-cryptocurrency-stolen

Zero-Day Bugs Spotted In Nooie Baby Monitor Await Patches - Cyber Security News

Security researchers have disclosed zero-day vulnerabilities affecting Nooie baby monitors, which would allow threat actors to access feeds and execute malicious code. The bugs haven't been patched till the time of the report. Users are advised to isolate their baby monitors for safety.

See the full report here: https://latesthackingnews.com/2022/02/14/zero-day-bugs-spotted-in-nooie-baby-monitors/

High-Severity RCE Security Bug Reported in Apache Cassandra Database Software

Researchers have revealed details of a now-patched high-severity security vulnerability in Apache Cassandra, the open-source NoSQL database management system. A successful attack would allow the adversary to disable the security manager and run arbitrary shell commands on the server. Users should upgrade to versions 3.0.26, 3.11.12, and 4.0.2 to avoid possible exploitation.

See the full report here: https://thehackernews.com/2022/02/high-severity-rce-security-bug-reported.html

BlackCat (ALPHV) claims Swissport ransomware attack, leaks data - BleepingComputer

The BlackCat (or ALPHV) ransomware group has claimed responsibility for the recent cyberattack on the aviation services company, Swissport. The ransomware group has posted a small set of sample files that was allegedly obtained via the attack, and stated its willingness to sell the full 1.6 TB data set.

See the full report here: https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/

Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

Security researchers have analyzed the workings of the sophisticated and modular backdoor, ShadowPad. The analysis revealed activities linked to threat groups affiliated with the Chinese Ministry of State Security (MSS) civilian intelligence agency and the People's Liberation Army (PLA).

See the full report here: https://thehackernews.com/2022/02/researchers-link-shadowpad-malware.html

Unskilled hacker linked to years of attacks on aviation, transport sectors - BleepingComputer

A threat actor has been using Microsoft Word documents to deliver a remote access tool (RAT), in an effort spanning over 5 years and involving hundreds of thousands of emails to hundreds of organizations globally. The attacker is likely based in Nigeria and targeted the aviation, aerospace, transportation, manufacturing, and defense industries.

See the full report here: https://www.bleepingcomputer.com/news/security/unskilled-hacker-linked-to-years-of-attacks-on-aviation-transport-sectors/

Ukrainian military agencies, banks hit by DDoS attacks, defacements - BleepingComputer

Distributed Denial-of-Service (DDoS) attacks are reportedly targeting Ukraine's Ministry of Defense, armed forces, and two state-owned banks (Privatbank and Oschadbank). Moreover, disinformation campaigns are allegedly spreading false news about bank ATMs being out of service.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-military-agencies-banks-hit-by-ddos-attacks-defacements/

CISA tells agencies to patch actively exploited Chrome, Magento bugs - BleepingComputer

The US Cybersecurity and Infrastructure Security Agency (CISA) has added nine new flaws to its collection of actively exploited vulnerabilities, including two recently patched zero-days impacting Google Chrome and Adobe Commerce/Magento. All Federal Civilian Executive Branch Agencies (FCEB) have been instructed to patch these vulnerabilities by March 1, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-tells-agencies-to-patch-actively-exploited-chrome-magento-bugs/

EU Data Protection Watchdog Calls for Ban on Pegasus-like Commercial Spyware

The European Data Protection Supervisor (EDPS) has called for a ban on the development and the use of Pegasus-like commercial spyware in the region. The authority stated that the technology's unprecedented level of intrusiveness could endanger users' right to privacy.

See the full report here: https://thehackernews.com/2022/02/eu-data-protection-watchdog-calls-for.html

VMware Issues Security Patches for High-Severity Flaws Affecting Multiple Products

VMware has patched several high-severity vulnerabilities affecting ESXi, Workstation, Fusion, Cloud Foundation, and NSX Data Center for vSphere. Successful exploitation of the flaws could allow a malicious actor to escalate privileges, execute malicious code, and cause a denial-of-service (DoS) condition. These bugs haven't been observed to be exploited in the wild.

See the full report here: https://thehackernews.com/2022/02/vmware-issues-security-patches-for-high.html

Emotet Now Spreading Through Malicious Excel Files

Security researchers have discovered that the Emotet malware is currently being propagated via malicious Excel files. This malware campaign is notorious for modifying and changing its attack vectors to avoid detection.

See the full report here: https://threatpost.com/emotet-spreading-malicious-excel-files/178444/

Red Cross: State hackers breached our network using Zoho bug - BleepingComputer

The International Committee of the Red Cross (ICRC) has disclosed that it was likely targeted by a state-backed hacking group. The organization discovered that intruders were able to maintain access to its servers for 70 days after the initial breach on November 9, 2021. In the attack, the threat actors exploited a vulnerability (CVE-2021-40539) in Zoho's ManageEngine ADSelfService Plus enterprise password management solution.

See the full report here: https://www.bleepingcomputer.com/news/security/red-cross-state-hackers-breached-our-network-using-zoho-bug/

TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands

Cyberattackers are reportedly targeting 60 high-profile companies with the TrickBot malware, with the goal to attack those companies’ customers. The prominent companies on the list include Amazon, American Express, JPMorgan Chase, Microsoft, Navy Federal Credit Union, PayPal, RBC, Yahoo and others.

See the full report here: https://threatpost.com/trickbot-amazon-paypal-top-brands/178483/

FBI: Cybercriminals Using Virtual Meeting Platforms to Wage BEC Attacks

Scammers are posing as senior executives of organizations in virtual meeting platforms and tricking employees into sending them money, the FBI has warned. With the rise in the number of people working from home, some business email compromise (BEC) scammers moved their attack vectors to virtual meeting platforms.

See the full report here: https://www.darkreading.com/attacks-breaches/cybercriminals-abuse-virtual-meeting-platforms-in-bec-attacks

US says Russian state hackers breached defense contractors - BleepingComputer

The FBI, NSA, and CISA have observed regular targeting of U.S. cleared defense contractors (CDCs) by Russian state-sponsored cyber actors, for at least the past two years. These persistent intrusions have enabled the attackers to acquire sensitive, unclassified information, as well as CDC-proprietary and export-controlled technology, the advisory stated.

See the full report here: https://www.bleepingcomputer.com/news/security/us-says-russian-state-hackers-breached-defense-contractors/

Researcher 'reverses' redaction, extracts words from pixelated image - BleepingComputer

A security researcher has demonstrated a way to successfully recover text that had been redacted using pixelation. The researcher also released a GitHub tool that can be used to reconstruct text from obscure, pixelated images. Pixelation or blurring is often used as a redaction technique when publishing sensitive information online.

See the full report here: https://www.bleepingcomputer.com/news/security/researcher-reverses-redaction-extracts-words-from-pixelated-image/