Threat Intelligence Bulletin: 02/25/2022 - 03/03/2022

Russia-Ukraine Conflict Cyber Updates

TLP: WHITE

February 24, 2022, through March 1, 2022, saw a flurry of cyber activity related to the ongoing conflict between Russia and Ukraine. Amid speculation that there would be a massive cyberwar between Russia and the rest of the world, several hacktivist and threat actor groups decided to make their positions on the conflict known. In a message that would be considered highly unusual for a government official, the Ukrainian Vice Prime Minister and Minister of Digital Transformation made a plea to the public for “digital talent” to coordinate their efforts against designated Russian targets. World governments were far from the only ones to take action against Russia; social media giants Meta, Twitter, and YouTube took various steps to protect their users from disinformation campaigns and block Russian state-owned accounts from earning money through advertisements.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Scope Note

This report focuses on the various cyber activity taking place between February 24, 2022, and March 1, 2022, as it pertains to the Russia-Ukraine conflict.

Key Findings

• Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.
• While several hacktivist groups have announced support for Ukraine, very few threat actors or ransomware groups have publicly voiced support for Russia as many expected them to do.
• In a highly unusual move for a government official, Ukraine’s Vice Prime Minister made a public plea for assistance in targeting Russian-owned entities via cyberattacks.
• Amidst widespread sanctions against Russian government officials, oligarchs, and organizations, social media companies also began to take action to protect users by clearly labeling state-affiliated accounts and limiting the ability for Russian-owned media accounts to earn money through advertising on multiple social media platforms.
• Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.

Disclaimer Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:45 AM (EST) on March 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Details

Cyber Activity

On February 26, 2022, Mykhailo Fedorov, Ukraine’s Vice Prime Minister and Minister of Digital Transformation, made a public plea for “digital talent” amid the ongoing Russia-Ukraine conflict. His social media posting linked to a public Telegram channel titled IT Army of Ukraine. “There will be tasks for everyone. We continue to fight on the cyber front.” Tasks listed in the channel are being posted in both Ukrainian and English “For all IT specialists from other countries.”

Hacktivist groups and threat actors alike have begun making their respective stances known, with several choosing between Russia or Ukraine. Security researchers began tracking several threat actors and hacktivist groups to gather information on group location, types of attacks used, and which side of the conflict each group supports (if any). Updates to the list may be made as more activity is discovered.

Figure 1. A list of hacking groups and threat actors that have made announcements regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Anonymous declared themselves “officially in cyber war against the Russian government” on February 24, 2022. The following days proved to be a busy time for the group, as they are believed to be responsible for multiple DDoS attacks causing outages for Russian government websites. In addition to the typical DDoS attacks seen by the collective, multiple Russian state TV outlets were hacked over the weekend to broadcast Ukrainian music and national symbols, a database for the Russian Ministry of Defense was leaked, and multiple Russian news sites were defaced to display anti-war messages.

Ransomware groups, typically known for claims of political neutrality, have also started getting involved. Conti, one of the largest ransomware groups currently operating, released a statement on February 25, 2022, announcing the group’s “full support of Russian government.” The announcement went on to state, “If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy.”

Figure 2. Conti's original statement regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Later that same day, Conti appeared to walk back their initial full support for the Russian government and posted a new message claiming that they do not ally with any government and condemn the war. However, Conti stated that any attacks against Russian citizens or critical infrastructure in any Russian-speaking parts of the world would be met with retaliation by the group.

Figure 3. Conti's revised statement regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

In a blow to the Conti group, roughly one year’s worth of chat logs were leaked online, potentially revealing behind-the-scenes information the group may not want to be made publicly available. These chat logs were sent to various journalists and security researchers to be analyzed. Malware library vx-underground published a copy on their website for anyone to download on February 27, 2022, and later announced on Twitter that they were the target of a DDoS attack.

The LockBit ransomware group also released a statement on February 27, 2022, seemingly in response to questions they were receiving. The group claims to be “apolitical” with members geographically located across the world.

Figure 4. LockBit's response to questions about the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Members of the CoomingProject reportedly voiced their willingness to help the Russian government should any cyberattacks target the country.

Figure 5. CoomingProject voicing their support of the Russian government
Source: DarkTracer

The CoomingProject claims to be a ransomware group, however, researchers widely believe the group mainly takes advantage of previous leaks to extort their victims. Any Russia-Ukraine involvement by the group may be limited, as hacking group AgainstTheWest is claiming to have identified several members of the CoomingProject and passed the details to law enforcement agencies in France.

On February 28, 2022, ZeroFox observed an update on the Intel Repository leak site publishing information about a Russian defense manufacturer. The actor indicated the data was leaked in support of Ukraine. The alleged leaked file belongs to a defense manufacturer working for the Russian government, and the actor obtained it from the AgainstTheWest (ATW) hacking group.

Figure 6. HackingGroup AgainstTheWest announces they have sent French law enforcement details on members of the CoomingProject
Source: Cyber, etc...

On February 25, 2022, ZeroFox observed forum user “NetSec” posting dumps for 53 million Ukrainian citizens. NetSec has also claimed to dump usernames and passwords related to the Federal Security Service (FSB) of Russia.

Figure 7. An alert in the ZeroFox platform showing the dump containing 53 million Ukrainian citizens
Source: ZeroFox Intelligence

Response from Social Media Companies

Twitter began taking steps on February 25, 2022, to combat misinformation on the platform. The official Twitter Safety account detailed the steps being taken, including disrupting attempts to amplify misinformation; detecting platform manipulation; taking enforcement action against accounts attempting to push misleading narratives; and temporarily pausing advertisements in Russia and Ukraine to “ensure critical public safety information is elevated and ads don’t detract from it.” Twitter later announced on February 28, 2022, that labels were being added to tweets linking to Russian state-affiliated media websites.

Facebook’s parent company, Meta, announced on February 28, 2022, that it had identified and taken steps to remove anti-Ukrainian propaganda across its multiple platforms. This effort comes after a separate campaign was identified compromising Ukrainian journalists and government officials. The actor behind the campaign was given the name “Ghostwriter” by security researchers.

YouTube took steps on February 27, 2022, to stop running ads by Russian state-backed media and other accounts affected by current sanctions. Access to RT, previously known as Russia Today, and “a number of other channels” will also be restricted from within Ukraine.

Analyst Commentary

The last several days have seen heightened activity for cyberattacks related to the ongoing conflict in Ukraine. In addition to the previously observed finance, government, and energy industries being targeted within Russia and Ukraine, ZeroFox has also observed Russian state-owned media and several other Russian organizations targeted by hacking groups. Some of the currently unverified victims include AMD Russia, Yandex, and Mail.ru.

The Conti ransomware group may have followed up on a set of very aggressive public announcements after its internal chat logs were leaked and subsequently shared by vx-underground. Shortly after sharing the files, the vx-underground website became the target of a DDoS attack but did not appear to be knocked offline at any point. This has been the only instance of possible retaliation by known threat actor groups observed by ZeroFox to date.

Long-simmering tension between Russia and Ukraine brought widespread speculation that any perceived aggression from either side could erupt into a massive cyberwar that spilled over to affect the rest of the world. As of this report’s writing, ZeroFox has only observed minimal attacks by Russia against organizations outside of Ukraine.

Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.

ZeroFox is continuing to monitor the situation in Ukraine with regards to cyber activity against Russia, Ukraine, and the actors who may wish to target organizations around the world due to connections with either country.

Recommendations

Organizations can protect themselves by continuing to have employees stay vigilant for the usual cyber threats. To that end, ZeroFox recommends the following measures continue to be taken:

• Continue to push for multi-factor authentication (MFA) everywhere possible to reduce the chance of compromised credentials being used by threat actors.
• Be wary of attachments from unknown or unexpected senders, especially those asking for recipients to enable macros through the “enable content” button in the Microsoft Office suite of applications.
• Services should only be exposed to the internet when absolutely necessary to reduce an organization’s remotely-available attack surface.
• Use built-in operating system features, such as Windows’ System Resource Usage Monitor (SRUM) and previously-installed third-party security solutions, to create a baseline of known or typical activity on corporate workstations and servers.
• Monitor and log network, workstation, and server activity and alert on all suspicious events.
• Create and maintain a regular patch cycle policy, allowing the necessary time for testing and gradual rollout of the most critical systems.
• Backups should be conducted on a regular basis using the popular “3-2-1 Rule.” This means having three copies of data on at least two separate types of media and at least one copy stored completely offline.
• Corporate “gold images” should be regularly updated and maintained in the event that a large number of corporate systems need to be rebuilt quickly.
• Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response and notification procedures.

The Cybersecurity & Infrastructure Security Agency (CISA) also provides guidance related to the ongoing conflict. In addition to this, CISA also has several excellent resources related to preparare against ransomware attacks and breaking down how foreign influence and mis-, dis-, and malinformation campaigns work.

A defense-in-depth security strategy is most effective, and the best way for organizations to protect themselves is by continuing to build upon the security posture already in place.

Please note that this information is current as of the ZeroFox Intelligence collection conclusion at 8:45 AM (EST) on March 1, 2022.

Russia-Ukraine Conflict: Supply Chain Impacts

TLP: WHITE

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

• https://zf-dashboard-media.s3.amazonaws.com/intel/Russia-Ukraine+Conflict+-+Supply+Chain+Impacts+March+2+2022.pdf

Scope Note

This Intelligence Brief focuses on the various supply chain impacts resulting from the current Russia-Ukraine conflict.

Executive Summary

The primary considerations for supply chains will be the valuable commodities produced by Russia and Ukraine and the impacts the Russia-Ukraine conflict will have on the already beleaguered global trade network. Russia is a major energy producer, and the conflict will worsen the energy price surge; Ukraine is an agricultural superpower, and the conflict will limit food supplies—both of which will worsen global inflation. The conflict also will exacerbate supply chain problems like shortages, high shipping costs, and backed-up ports that have plagued global trade since the start of the pandemic.

Key Findings

• Russia’s invasion of Ukraine is threatening supply chains that have still not recovered from the COVID-19 pandemic.
• This conflict will likely accelerate inflation, hurt financial markets, and slow the economic recovery for consumers worldwide—first in energy-dependent Europe, then in Africa, the Middle East, and Asia, all of which depend on Russia and Ukraine for food. However, no region will be immune, as nearly every country relies on Russian or Ukrainian commodities for vital sectors.
• It will be more difficult and expensive to get vital commodities like oil, which is over USD 110 a barrel, and liquified natural gas (LNG), which increased in price by 60 percent since the conflict broke out
• Russia and Ukraine’s geographic location also exacerbates global supply chain problems, as it links Europe and Asia by land and air; the crisis also exposes vital shipping routes to conflict.
• Transportation will now have new and dangerous obstacles to contend with, in addition to closed airspace—which will make trade difficult and more expensive.
• With Western sanctions more drastic than originally forecasted, anticipate additional economic drags from weaker consumer confidence that will hurt already fragile economies.
• The longer-term effects of the sanctions against Russia are already starting to become clear, and Western companies and investors are backing away from the country.
• The next few weeks will determine whether the global economy enters the worst-case scenario: a global recession with accompanying stagflation.

Disclaimer Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EST) on March 2, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Please note that this information is current as of the ZeroFox Intelligence collection conclusion at 10:00 AM (EST) on March 2, 2022.

Breaking News: 2022-02-25 - 2022-03-03

Dubai-based Gems Education hit by cyber attack - The National

Gems Education, the largest education operator in the UAE has been hit by a cyberattack. The firm has confirmed that it had a minimal impact on the group’s operations. It has also mentioned that the investigation was in progress and is yet to confirm whether any personal or financial data has been breached.

See the full report here: https://www.thenationalnews.com/business/technology/2022/02/24/dubai-based-gems-education-hit-by-cyber-attack/

New Flaws Discovered in Cisco's Network Operating System for Switches

Cisco has released software updates to address four security vulnerabilities in its software. They are marked down as CVE-2022-20650, CVE-2022-20625, CVE-2022-20624, and CVE-2022-20623. These vulnerabilities could be weaponized by malicious actors to take control of affected systems if left unattended.

See the full report here: https://thehackernews.com/2022/02/new-flaws-discovered-in-ciscos-network.html

Zenly Social-Media App Bugs Allow Account Takeover

Zenly, a social app from Snap that allows users to see the locations of friends and family on a live map, contains a pair of vulnerabilities that could endanger those being tracked. A pair of bugs in the app reveal phone numbers and allow account hijacking.

See the full report here: https://threatpost.com/zenly-bugs-account-takeover/178646/

Defense contractors hit by stealthy SockDetour Windows backdoor - BleepingComputer

A new malware named SockDetour has been found on systems belonging to US defense contractors. SockDetour allows attackers to remain stealthily on compromised Windows servers by loading flawlessly in legitimate service processes and using legitimate processes' network sockets to establish its own encrypted C2 channel.

See the full report here: https://www.bleepingcomputer.com/news/security/defense-contractors-hit-by-stealthy-sockdetour-windows-backdoor/

CISA Alerts on Actively Exploited Flaws in Zabbix Network Monitoring Platform

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of two security flaws impacting Zabbix open-source enterprise monitoring platform. Successful attacks could allow an unauthenticated actor to escalate privileges and gain admin access to the Zabbix Frontend as well as make configuration changes. Users should update to the latest versions (versions 5.4.9, 5.0.9 and 4.0.37).

See the full report here: https://thehackernews.com/2022/02/cisa-alerts-on-actively-exploited-flaws.html

Microsoft App Store Sizzling with New ‘Electron Bot’ Malware

A backdoor malware, Electron Bot, has infiltrated Microsoft’s official store by cloning popular games. This malware allows remote execution and enables its operators to register new accounts, log in, comment on, and like other social media posts – all in real time. Microsoft has stated that it is investigating this issue and will take appropriate action to protect customers.

See the full report here: https://threatpost.com/microsoft-app-store-electron-bot-malware/178629/

Microsoft Exchange servers hacked to deploy Cuba ransomware - BleepingComputer

The Cuba ransomware operation is exploiting Microsoft Exchange vulnerabilities to gain initial access to corporate networks and encrypt devices. It uses these vulnerabilities to deploy web shells, RATs, and backdoors to establish a foothold on the target network. The operation is primarily targeting the United States, followed by Canada.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/

US and UK expose new malware used by MuddyWater hackers - BleepingComputer

A joint advisory issued by U.S. and U.K. cybersecurity officials disclosed details about new malware deployed by the Iranian-backed hacking group, MuddyWater. The group is reportedly targeting government and private-sector organizations across sectors—including telecommunications, defense, local government, and oil and natural gas—all over the world.

See the full report here: https://www.bleepingcomputer.com/news/security/us-and-uk-expose-new-malware-used-by-muddywater-hackers/

Citibank phishing baits customers with fake suspension alerts - BleepingComputer

A large-scale phishing campaign is targeting customers of Citibank. Its customers targeted in these attacks are informed that their account has been put on hold due to a suspicious transaction or a login attempt from someone else.

See the full report here: https://www.bleepingcomputer.com/news/security/citibank-phishing-baits-customers-with-fake-suspension-alerts/

NHS urges orgs to apply security update for Okta Client RCE bug - BleepingComputer

The UK's NHS Digital agency is warning organizations to apply new security updates for a remote code execution vulnerability in the Windows client for the Okta Advanced Server Access authentication management platform. In an NHS Digital Cyber Alert released yesterday, all organizations are advised to apply the latest patches for the Okta Advanced Server Client to fix an RCE vulnerability disclosed last week. Okta Advanced Server Access is a popular identity and authentication management platform that provides secure single sign-on (SSO) to servers, applications, and cloud services, such as Amazon AWS.

See the full report here: https://www.bleepingcomputer.com/news/security/nhs-urges-orgs-to-apply-security-update-for-okta-client-rce-bug/

CISA warns of actively exploited vulnerabilities in Zabbix servers - BleepingComputer

A notification from the U.S. Cybersecurity Infrastructure and Security Agency (CISA) warns that threat actors are exploiting vulnerabilities in the Zabbix open-source tool for monitoring networks, servers, virtual machines, and cloud services. The agency is asking federal agencies to patch any Zabbix servers against security issues tracked as CVE-2022-23131 and CVE-2022-23134, to avoid significant risk from malicious cyber actors. The same warning comes from the Computer Emergency Response Team (CERT) of Ukraine, which notes that one of the vulnerabilities has a critical severity score of 9.1 out of 10.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-vulnerabilities-in-zabbix-servers/

TrickBot malware operation shuts down, devs move to BazarBackdoor - BleepingComputer

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families. In 2021, TrickBot attempted to launch their ransomware operation called Diavol, which has never really picked up steam, possibly because one of its developers was arrested. Despite numerous takedown attempts by law enforcement, TrickBot had successfully rebuilt its botnet and continued to terrorize Windows networks.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-operation-shuts-down-devs-move-to-bazarbackdoor/

GPU giant Nvidia is investigating a potential cyberattack - BleepingComputer

US chipmaker giant Nvidia confirmed yesterday it's currently investigating an "incident" that reportedly took down some of its systems for two days. Systems impacted in what looks like a cyberattack include the company's developer tools and email systems, as first reported by The Telegraph. The reported outage is the result of a network intrusion, and it is still not known if any business or customer data was stolen during the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/gpu-giant-nvidia-is-investigating-a-potential-cyberattack/

Ransomware gangs, hackers pick sides over Russia invading Ukraine - BleepingComputer

Hacker crews are picking sides as the Russian invasion into Ukraine continues, issuing bans and threats for supporters of the opposite side. This week, an administrator of the database sharing and marketplace Raidforums announced that it would close its door on users connecting from Russia, clearly expressing its position against Kremlin’s actions. The Conti ransomware group stated their full support of the Russian government and threatened with cyberattacks against anyone launching attacks against Russia.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gangs-hackers-pick-sides-over-russia-invading-ukraine/

HermeticWiper: New data‑wiping malware hits Ukraine - We Live Security

According to ESET Research, a hack involving new data-wiping malware named HermeticWiper attacked a number of institutions in Ukraine, affecting hundreds of Computers on their networks. HermeticWiper exploited genuine disc management software drivers. The wiper abuses legal drivers from the EaseUS Partition Master software to corrupt data. It also appears that the threat actors got access to a victim's network before releasing the malware.

See the full report here: https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine/

Apple Pay payments suspended in Russia with local banks hit by sanctions

Following Russia's invasion of Ukraine, the United States and the European Union put economic sanctions on the country, including a restriction on foreign transactions through Russian banks. Apple Pay, Google Pay, and other digital wallets have all been suspended in Russia as a result. VTB Group, Sovcombank, Novikombank, Promsvyazbank, and Otkritie are among the banks affected, according to the Russian Central Bank. Economic sanctions have also been placed on Russia by the United Kingdom, Japan, and Australia.

See the full report here: https://9to5mac.com/2022/02/25/apple-pay-payments-suspended-in-russia-with-local-banks-hit-by-sanctions/

260,000 confidential attorney discipline records published after data breach, State Bar says - Press-Enterprise

The State Bar of California announced Saturday, Feb. 26 that a website that aggregates court cases nationwide had published 260,000 secret attorney discipline records. The State Bar was the first to notice the data breach by shadowy judyrecords.com recently. Until official charges are filed and a court case is started, all attorney disciplinary investigations are kept confidential under state law.

See the full report here: https://www.ocregister.com/2022/02/26/260000-confidential-attorney-discipline-records-published-after-data-breach-state-bar-says

Microsoft: January Windows Server updates cause Netlogon issues - BleepingComputer

Microsoft Windows Server security updates released on and since the January 2022 Patch Tuesday might prevent applications and network appliances like Riverbed SteelHead WAN Optimizers from creating Netlogon secure channels if installed on domain controllers. Netlogon is a remote procedure call (RPC) interface and Windows Server process that authenticates services and users on Windows domain-based networks. Affected apps and network appliances will need an update from their developer or manufacturer to resolve this issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-january-windows-server-updates-cause-netlogon-issues/

Anonymous hacked the Russian Defense Ministry and is targeting Russian companies

Anonymous collective has hacked the Russian Defense Ministry and the database of the website of the Ministry of Defense of Russia in response to the Ukraine invasion. The Russian Government’s portal, and the websites of other ministries are running very slow. Anonymous has pointed out that it is not targeting Russian citizens, but only their government and also they are launching its offensive against those countries that are supporting military operations in Ukraine, like Belarus. The collective is also leaking around 200GB of emails from Belarusian weapons maker Tetraedr. GazpromEN has been also taken offline in support of the people living in Ukraine.

See the full report here: https://securityaffairs.co/wordpress/128428/hacking/anonymous-russian-defense-ministry.html

Chipmaker giant Nvidia hit by a ransomware attack

The chipmaker giant Nvidia was victim of a ransomware attack that impacted some of its developer tools and email systems, but business and commercial activities were not affected. The company is investigating the incident to determine the extent of the intrusion. The Lapsus$ ransomware gang is claiming responsibility for this attack, the group announced to have stolen 1 TB of data from Nvidia’s network. The ransomware gang leaked online credentials for all Nvidia employees.

See the full report here: https://securityaffairs.co/wordpress/128456/cyber-crime/nvidia-ransomware-attack.html

NCC warns telecoms operators, subscribers of new malware - Guardian Nigeria

Nigerian Communications Commission’s Computer Security Incident Response Team (CSIRT) has discovered newly hatched malicious software that steals users’ banking app login credentials on Android devices. The malicious software called “Xenomorph” targeted 56 financial institutions from Europe and has a high impact and high vulnerability rate.

See the full report here: https://guardian.ng/news/ncc-warns-telecoms-operators-subscribers-of-new-malware/

Russian hackers take credit for McDonald's ransomware attack - Komando

A Russian group called Snatch took the credit for a recent hack on the McDonald’s Corporation. According to National Cybersecurity News, Snatch stole 500GB of data and demanded payment on the Dark Web.

See the full report here: https://www.komando.com/security-privacy/russia-mcdonalds-ransomware-attack/827761/

Workers sent home as Bridgestone investigates hack - Southern Standard

The tire and rubber technologies company Bridgestone has announced that it is currently investigating a potential security incident. The company disclosed that it has disconnected many manufacturing and retreading facilities in Latin America and North America from its network to contain and prevent any potential impact.

See the full report here: https://www.southernstandard.com/top-stories/workers-sent-home-bridgestone-investigates-hack/

Conti ransomware's internal chats leaked after siding with Russia

Over 60,000 private messages among members of the Conti ransomware operation were leaked soon after the gang publicly sided with Russia over the invasion of Ukraine. Conti had initially announced full support for the Russian government, but later toned down their message, saying that they condemn the war but would retaliate if the West attacks Russian infrastructure.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/

Toyota shutters 14 plants after probable cyberattack

Kojima Industries’ is a Toyota subsidiary that manufacturers interior and exterior car parts and participates in Toyota’s just-in-time supply chains. According to a local media report, Toyota has closed all 14 plants it operates in Japan due to what it has described as a “system failure” at Kojima Industries Corporation. This system failure is due to a cyberattack.

See the full report here: https://www.theregister.com/2022/03/01/toyota_shuts_plants/

Axis Communications shares details on disruptive cyberattack - BleepingComputer

The Swedish manufacturer of network cameras, access control systems, and surveillance network appliances suffered a cyberattack on Sunday, February 20, 2021, forcing it to shut down all systems to limit the impact. Axis is a subsidiary of Canon that accommodates customers' needs in a wide range of industries.

See the full report here: https://www.bleepingcomputer.com/news/security/axis-communications-shares-details-on-disruptive-cyberattack/

Insurance giant AON hit by a cyberattack over the weekend - BleepingComputer

AON is a multinational professional services firm offering a wide array of solutions, including business insurance, reinsurance, cybersecurity consulting, risk solutions, healthcare insurance, and wealth management products. It has suffered a cyberattack that impacted a "limited" number of systems. The firm has not provided any details of the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/insurance-giant-aon-hit-by-a-cyberattack-over-the-weekend/

New 'FoxBlade' malware used to target Ukraine before invasion - SiliconANGLE News

Researchers at the Microsoft Threat Intelligence Center have detailed a new form of malware named “FoxBlade” that was used against targets in Ukraine in the hours before the start of the Russian invasion. The malware is described as a Trojan that can use computers for distributed denial-of-service attacks without the owners’ knowledge.

See the full report here: https://siliconangle.com/2022/02/28/new-foxblade-malware-used-target-ukraine-invasion/

TeaBot malware slips back into Google Play Store to target US users - BleepingComputer

The TeaBot banking trojan was spotted in Google Play Store where it posed as a QR code app and spread to more than 10,000 devices. Researchers found that TeaBot posed as an app named ‘QR Code & Barcode – Scanner’, which appears as a legitimate QR code scanning utility.

See the full report here: https://www.bleepingcomputer.com/news/security/teabot-malware-slips-back-into-google-play-store-to-target-us-users/

Microsoft Accounts Targeted by Russian-Themed Credential Harvesting

Phishing emails to Microsoft users warning of Moscow-led account hacking have started to make the rounds, looking to lift credentials and other personal details. According to Malwarebytes, the mail explicitly targets Microsoft account holders and Outlook is sending the emails directly to the spam folder.

See the full report here: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/

This JavaScript scanner hunts down malware in libraries

The Wormhole file transfer web app plans to introduce a security scanning app also called Socket to defend against supply-chain attacks in the JavaScript ecosystem. The Socket is currently available as an integrated GitHub app.

See the full report here: https://www.theregister.com/2022/03/01/socket_npm_dependency_scanner/

Reality Winner's Twitter account was hacked to target journalists - BleepingComputer

The Twitter account of former intelligence specialist, Reality Winner was hacked over the weekend by threat actors looking to target journalists at prominent media organizations. Hackers changed the profile name to "Feedback Team" to impersonate Twitter staff before sending out suspicious DMs to verified users.

See the full report here: https://www.bleepingcomputer.com/news/security/reality-winners-twitter-account-was-hacked-to-target-journalists/

Google TAG removes fraudulent 'influence' operations linked to Belarus, Moldova, Ukraine

Google's Threat Analysis Group (TAG) has taken down a "coordinated influence operation" connected to Belarus, Moldova, and Ukraine. This step was taken to tackle the spread of misinformation considering the current Russia-Ukraine conflict.

See the full report here: https://www.zdnet.com/article/google-tag-removes-out-fraudulent-influence-operations-linked-to-belarus-moldova-ukraine/

'Help Ukraine' crypto scams emerge as Ukraine raises over $37 million - BleepingComputer

Malicious campaigns are attempting to steal money and credentials from people wishing to donate money to the Ukrainian cause, by posting cryptocurrency wallet addresses that are not linked to the Ukrainian government. People looking to donate to Ukraine should only use the official wallet addresses published by the Ukrainian government and refrain from engaging with any suspicious donation emails or social media posts.

See the full report here: https://www.bleepingcomputer.com/news/security/help-ukraine-crypto-scams-emerge-as-ukraine-raises-over-37-million/

CISA and FBI warn of potential data wiping attacks spillover - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint cybersecurity advisory where it warned US organizations that data-wiping attacks targeting Ukraine could spill over to targets from other countries. It shared malware information relating to the recent HermeticWiper and WhisperGate attacks and indicators of compromise (IOCs) to help organizations detect and block such malware.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-and-fbi-warn-of-potential-data-wiping-attacks-spillover/

New worm and data wiper malware seen hitting Ukrainian networks - BleepingComputer

Security researchers are investigating whether IsaacWiper – a new form of malware (not attributed to any known actor yet) – is linked with HermeticWiper, which was recently deployed against Ukrainian organizations. IsaacWiper was seen in a Ukrainian governmental organization that was not affected by HermeticWiper.

See the full report here: https://www.bleepingcomputer.com/news/security/new-worm-and-data-wiper-malware-seen-hitting-ukrainian-networks/

Hundreds of eBike phishing sites abuse Google Ads to push scams - BleepingComputer

Scammers are abusing Google Ads and search engine optimization techniques to lure Indian victims to phishing sites mimicking electric-bike brands like Revolt and Ather. The campaign involves over 200 malicious sites and has affected tens of thousands of victims.

See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-ebike-phishing-sites-abuse-google-ads-to-push-scams/

Daxin Espionage Backdoor Ups the Ante on Chinese Malware

Backdoor.Daxin, a sophisticated piece of malware used by China-linked threat actors, appears to be optimized for use against hardened government targets. This allows the attackers to burrow deep into a target’s network and exfiltrate data without raising suspicions. The USP of Daxin lies in its stealth and communications capabilities.

See the full report here: https://threatpost.com/daxin-espionage-backdoor-chinese-malware/178706/

RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!

Popular communication platforms such as WhatsApp and BlueJeans could be vulnerable to five bugs recently identified in PJSIP, a widely used open-source multimedia communication library. These bugs would allow an attacker to cause arbitrary code execution in applications that use the PJSIP library. The bugs have been patched in version 2.12 of PJSIP.

See the full report here: https://threatpost.com/rce-bugs-whatsapp-popular-voip-apps-patch-now/178719/

Over 100,000 medical infusion pumps vulnerable to years old critical bug - BleepingComputer

Security researchers have discovered that tens of thousands of medical infusion pumps are vulnerable to six critical-severity flaws (CVSS score: 9.8/10). The most prevalent among them is CVE-2019-12255, a memory corruption bug in the VxWorks real-time operating system (RTOS) used for embedded devices.

See the full report here: https://www.bleepingcomputer.com/news/security/over-100-000-medical-infusion-pumps-vulnerable-to-years-old-critical-bug/

Phishing attacks target countries aiding Ukrainian refugees - BleepingComputer

A spear-phishing campaign is targeting European governmental entities that are managing the logistics of refugees fleeing Ukraine. In this campaign, the attackers are using a possibly compromised Ukrainian armed service member’s email account to send malware downloaders as attachments. Security researchers haven't been able to attribute the attacks to a specific state-sponsored hacking group yet.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-attacks-target-countries-aiding-ukrainian-refugees/

Logan Health cyberattack, server hack leads to data access of 214K people - SC Media

Logan Health Medical Center has notified 213,543 patients, employees, and business associates that their personal and health data was compromised, after a sophisticated cyberattack on its IT systems which led to the hack of a file server containing protected health information.

See the full report here: https://www.scmagazine.com/analysis/breach/logan-health-cyberattack-server-hack-leads-to-data-access-of-214k-people