Threat Intelligence Bulletin: 03/04/2022

Russia-Ukraine Conflict: Situational Updates

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russian-Ukraine conflict.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Intelligence+Brief+-+Russia-Ukraine+Conflict+Updates+March+7+2022.pdf

Executive Summary

Russian forces are continuing to mass northwest of Kyiv and will likely begin a concerted effort to encircle the city in the next 72 hours. In addition, the humanitarian situation in Ukraine is deteriorating–Russia has fired on evacuation corridors, and Mariupol has been without water and power for nearly a week. The U.S. Congress is pressuring the White House to support an import ban on Russian oil, but a similar move by the European Union (EU) is less likely due to lack of German support. Further, NATO has rejected requests from the Ukrainian government to introduce a no-fly zone due to the likelihood it would lead to military escalation.

Russia-Ukraine Conflict: Cyber Updates on APT Activity

TLP: AMBER

In this briefing, ZeroFox Intelligence provides a cybersecurity update on the Russian-Ukraine conflict.

Standing Intelligence Requirements

GEO DDW

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Intelligence+Brief+-+Russia-Ukraine+Conflict+IOC+Updates.pdf

Executive Summary

The Gamaredon Group is one of the most active, existing advanced persistent threats (APT) targeting Ukraine and has been pursuing access to organizations in Ukraine or entities related to Ukrainian affairs since at least 2014. Given its pro-Russian activities, ZeroFox anticipates additional malicious cyber activities against targets in Ukraine and the West, as geopolitical tensions continue to be unresolved. Since February 1, 2022, ZeroFox has observed over 470 Indicators of Compromise (IOCs) associated with the group’s infrastructure. This is an extremely aggressive APT group with little or no reduction in its activity.

Microsoft Patch Tuesday 03/09/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for March 2022 contained 71 vulnerabilities in total, with:

3 vulnerabilities rated as Critical
68 vulnerabilities rated as Important

Most notable vulnerabilities

Microsoft has listed 3 publicly disclosed zero-day vulnerabilities (CVE-2022-21990, CVE-2022-24459, and CVE-2022-24512) among the bugs fixed in the March Patch Tuesday security update. None of these vulnerabilities are actively exploited in the wild. However, public proof-of-concept exploits are available for CVE-2022-21990 and CVE-2022-24459.

The critical bugs patched in this batch of updates are tracked as CVE-2022-22006, CVE-2022-24501, and CVE-2022-23277. All of them can lead to remote code execution in the event of a successful attack.

CVE-2022-21990

CVE-2022-21990 (CVSS score: 8.8) is a Security Bypass vulnerability in the Remote Desktop Client. Because of this flaw, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system – after persuading a victim to open specially-crafted content.

The following products are affected:

Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Remote Desktop client for Windows Desktop
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 1809 for 32-bit Systems

CVE-2022-24459

CVE-2022-24459 (CVSS score: 7.8) is a Privilege Escalation vulnerability in the Windows Fax and Scan Service. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, as a result of this bug. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 10 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems

CVE-2022-24512

CVE-2022-24512 (CVSS score: 6.3) is a Security Bypass vulnerability in Microsoft .NET and Visual Studio. As a consequence of this vulnerability, the Microsoft .NET framework could allow a remote authenticated attacker to execute arbitrary code on the system – after sending a specially-crafted request.

The following products are affected:

Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 - 16.6)
.NET Core 3.1
.NET 6.0
.NET 5.0
Microsoft Visual Studio 2022 version 17.0
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

CVE-2022-24501

CVE-2022-24501 (CVSS score: 7.8) is a Security Bypass vulnerability in VP9 Video Extensions. Because of this bug, Microsoft VP9 Video Extensions could allow a remote attacker to execute arbitrary code on the system – by persuading a victim to open specially-crafted content.

The following product is affected:

VP9 Video Extensions

CVE-2022-23277

CVE-2022-23277 (CVSS score: 8.8) is a Security Bypass vulnerability in Microsoft Exchange Server. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, after the attacker sends a specially-crafted request.

The following products are affected:

Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2016 Cumulative Update 22
Microsoft Exchange Server 2019 Cumulative Update 10
Microsoft Exchange Server 2016 Cumulative Update 21
Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-22006

CVE-2022-22006 (CVSS score: 7.8) is a Security Bypass vulnerability in HEVC Video Extensions. As a result of this bug, Microsoft HEVC Video Extensions could allow a remote attacker to execute arbitrary code on the system – by persuading a victim to open specially-crafted content.

The following product is affected:

HEVC Video Extension

CVE-2022-24508

CVE-2022-24508 (CVSS score: 8.8) is a Security Bypass vulnerability in Windows SMBv3 Client/Server. Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code, because of an error in the SMBv3 Client/Server. By sending a specially-crafted SMB packet to a computer connected to an SMB Server, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems

Users should apply the latest security patches specified in Microsoft's March Patch Tuesday update and follow the recommended mitigations and workarounds to protect themselves from these and other vulnerabilities.

Russia-Ukraine Conflict: Supply Chain Updates

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a supply chain update on the Russian-Ukraine conflict.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Intelligence+Brief+-+Russia-Ukraine+Conflict+Supply+Chain+Updates+March+9+2022.pdf

Executive Summary

Nearly two weeks since Russia’s military escalation, impacts on the global economy are becoming clearer. While the economic impact on Russia and Ukraine has been staggering, they do not have enormous economies and account for less than two percent GDP worldwide; the countries with the two largest economies—the United States and China—have limited trade exposure to the region. Outside of Russia’s major trading partners in Europe, the economic effects have been limited to rising commodity prices’ impact on inflation and supply chains. However, the longer-term economic impacts from higher energy prices could shift from lowering Western growth to causing a global recession. Therefore, expect Western nations to push for alternative energy sources that reduce energy income for the Russian state while sourcing energy production elsewhere.

Russia-Ukraine Conflict: Situational Updates

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russian-Ukraine conflict.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Intelligence+Brief_+Russia-Ukraine+Conflict+Updates+March+10+2022.pdf

Executive Summary

A concerted Russian assault in Kyiv is anticipated but depends on their success encircling the city, which has been slowed in recent days. Mariupol continues to face a humanitarian crisis amid Russian bombardment. The first high-level negotiations between Ukrainian and Russian foreign ministers concluded with no ceasefire agreement. More than two million refugees have left Ukraine since fighting began, with more than half of those having fled to Poland.

Breaking News: 2022-03-04 - 2022-03-10

U.S. Senate Passes Cybersecurity Bill to Strengthen Critical Infrastructure Security

The U.S. Senate unanimously passed the "Strengthening American Cybersecurity Act" to strenghten the cybersecurity of critical infrastructure in the country. The Act requires entities to report a cyber-security incident to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours. The legislation now needs to be passed by the House before it's officially signed into law.

See the full report here: https://thehackernews.com/2022/03/us-senate-passes-cybersecurity-bill-to.html

Critical Patches Issued for Cisco Expressway Series, TelePresence VCS Products

Cisco has released patches for two critical security vulnerabilities (CVE-2022-20754 and CVE-2022-20755; CVSS scores: 9.0) affecting Expressway Series and Cisco TelePresence Video Communication Server (VCS). These flaws could be exploited by an attacker to gain elevated privileges and execute arbitrary code. The company stated that it has found no evidence of malicious exploitation of the vulnerabilities.

See the full report here: https://thehackernews.com/2022/03/critical-patches-issued-for-cisco.html

Researchers Demonstrate New Side-Channel Attack on Homomorphic Encryption

Security researchers have claimed to demonstrate the first side-channel attack on homomorphic encryption that could be exploited to leak data as the encryption process is underway. Homomorphic Encryption is a form of encryption that allows certain types of computation to be performed directly on encrypted data without having to decrypt it in the first place.

See the full report here: https://thehackernews.com/2022/03/researchers-demonstrate-new-side.html

Free decryptor released for HermeticRansom victims in Ukraine - BleepingComputer

Avast has released a decryptor for the HermeticRansom ransomware strain used in targeted attacks against Ukrainian systems over the past several days. The decryptor is offered as a free-to-download tool from Avast's website and can help victims restore their data.

See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-hermeticransom-victims-in-ukraine/

Amazon Alexa can be hijacked via commands from own speaker

According to infosec researchers from Royal Holloway (University of London), Amazon Alexa devices could wake themselves up and start executing audio commands issued by a remote attacker. Triggering the attack is as simple as using an Alexa-enabled device to start playing crafted audio files to itself.

See the full report here: https://www.theregister.com/2022/03/03/amazon_alexa_speaker_vuln/

Michigan Medicine data breach may affect health information of nearly 3,000 patients - MLive.com

The Ann Arbor-based hospital system notified about 2,920 patients about an employee email account that was accessed by a cyber attacker and used to send phishing emails, according to a news release. The phishing emails contained job-related communications for coordination and care of patients, the release states.

See the full report here: https://www.mlive.com/news/ann-arbor/2022/03/michigan-medicine-data-breach-may-affect-health-information-of-nearly-3000-patients.html

Social media accounts of Embassy of Pakistan in Algeria hacked - ANI News

Several social media accounts of the Embassy of Pakistan in Algeria have been hacked. The spokesperson of the Ministry of Foreign Affairs alerted the people that messages being posted from the accounts are not from the embassy.

See the full report here: https://www.aninews.in/news/world/asia/social-media-accounts-of-embassy-of-pakistan-in-algeria-hacked20220302161145

Schneider Relay Flaws Can Allow Hackers to Disable Electrical Network Protections - SecurityWeek

Vulnerabilities discovered by researchers in some of Schneider Electric’s Easergy relays can allow hackers to disable protections for electrical networks. An attacker could exploit the security hole to cause the relay to reboot, or they can gain full control of the device.

See the full report here: https://www.securityweek.com/schneider-relay-flaws-can-allow-hackers-disable-electrical-network-protections

Free HermeticRansom Ransomware Decryptor Released

A free decryptor is out to unlock ransomware found piggybacking on the HermeticWiper data wiper malware that ESET and Broadcom’s Symantec discovered targeting machines at financial, defence, aviation, and IT services outfits in Ukraine, Lithuania and Latvia last week. Avast Threat Labs had spotted the new ransomware strain last Thursday, Feb. 24. Avast, which named the new strain HermeticRansom, on Thursday released a free decryptor that incorporated a decryption script CrowdStrike released to GitHub, a user-friendly GUI and a set of instructions on its use.

See the full report here: https://threatpost.com/free-hermeticransom-ransomware-decryptor-released/178762/

Cisco joins long list of security companies supporting Ukraine - BleepingComputer

Cisco has joined the growing list of security and technology companies that no longer offer services in Russia after they invaded Ukraine. In response to the grave situation, the booming hacking activities, the malware distribution campaigns, the defacement attacks, DDoS attacks, and internet access blockages, many cybersecurity companies have stepped up their effort to support Ukrainians.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-joins-long-list-of-security-companies-supporting-ukraine/

Russia blocks access to Facebook, Twitter, foreign news outlets - BleepingComputer

Russia has blocked access to the Facebook social network after Meta, Facebook's parent company, deactivated or restricted access to accounts belonging pr-Kremlin media outlets and news agencies, including RIA Novosti, Sputnik, and Russia Today. The Russian telecom watchdog added that the decision was taken to prevent blocking the free flow of information and obstructing the access of Russian users to Russian media across foreign social platforms.

See the full report here: https://www.bleepingcomputer.com/news/technology/russia-blocks-access-to-facebook-twitter-foreign-news-outlets/

Hackers leak 190GB of alleged Samsung data, source code - BleepingComputer

The Lapsus$ data extortion group leaked today a huge collection of confidential data they claim to be from Samsung Electronics, the South Korean giant consumer electronics company. It is unclear if Lapsus$ contacted Samsung for a ransom, as they claimed in the case of Nvidia.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-190gb-of-alleged-samsung-data-source-code/

Ukraine to join NATO intel-sharing cyberdefense hub - BleepingComputer

While Ukraine is yet to become a member of the North Atlantic Treaty Organization (NATO), the country has been accepted as a contributing participant to the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). CCDCOE is a NATO-accredited cyberdefense hub that member nations use for research, training, and exercises covering several areas, including technology, strategy, operations, and law. Although this does not make Ukraine a NATO member, it will likely tighten collaboration and allow it to gain access to NATO member nations' cyber-expertise and share its own.

See the full report here: https://www.bleepingcomputer.com/news/government/ukraine-to-join-nato-intel-sharing-cyberdefense-hub/

Leaked stolen Nvidia cert can sign Windows malware

An Nvidia code-signing certificate was among the mountain of files stolen and leaked online by criminals who ransacked the GPU giant's internal systems. At least two binaries not developed by Nvidia, but signed this week with its stolen cert, making them appear to be Nvidia programs, have appeared in malware sample database VirusTotal.

See the full report here: https://www.theregister.com/2022/03/05/nvidia_stolen_certificate/

CISA warns organizations to patch 95 actively exploited bugs - BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 95 vulnerabilities to its list of actively exploited security issues, the largest number since issuing the binding operational directive (BOD) last year. Despite some of them being known for almost two decades, the agency notes that the bugs pose a significant risk to the federal enterprise.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-organizations-to-patch-95-actively-exploited-bugs/

Russia-Ukraine war exploited as lure for malware distribution - BleepingComputer

Threat actors are distributing malware using phishing themes related to the invasion of Ukraine, aiming to infect their targets with remote access trojans (RATs) such as Agent Tesla and Remcos. Using this theme, threat actors are sending malicious emails that install RATs on target systems to gain remote access, steal sensitive information, conduct network reconnaissance, disable security software, and generally prepare the ground for more potent payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-ukraine-war-exploited-as-lure-for-malware-distribution/

Lapsus$ gang leaks data allegedly stolen from Samsung Electronics

The Lapsus$ ransomware gang claims to have stolen a huge trove of sensitive data from Samsung Electronics and leaked 190GB of alleged Samsung data as proof of the hack. The gang announced the availability of the sample data on its Telegram channel and shared a Torrent file to download it. They also shared an image of the source code included in the stolen data.

See the full report here: https://securityaffairs.co/wordpress/128712/cyber-crime/samsung-electronics-lapsus-ransomware.html

Lapsus$ gang leaks data allegedly stolen from Samsung Electronics

See the full report here: https://securityaffairs.co/wordpress/128712/cyber-crime/samsung-electronics-lapsus-ransomware.html

Lapsus$ gang leaks data allegedly stolen from Samsung Electronics

See the full report here: https://securityaffairs.co/wordpress/128712/cyber-crime/samsung-electronics-lapsus-ransomware.html

Imperva Thwarts 2.5 Million RPS Ransom DDoS Extortion Attacks

Imperva, a cybersecurity company, recently mitigated a ransom distributed denial-of-service (DDoS) attack against an unnamed website that peaked at 2.5 million requests per second (RPS). Evidence indicated that the DDoS attacks were launched by the Mris botnet, which has continued to exploit a now-addressed security vulnerability in Mikrotik routers (CVE-2018-14847) to strike targets. Indonesia was the leading source of the attacks, followed by the United States, China, Brazil, India, Colombia, Russia, Thailand, Mexico, and Argentina.

See the full report here: https://thehackernews.com/2022/03/imperva-thwarts-25-million-rps-ransom.html

Hackers Breach Russian Space Research Institute Website

According to screenshots and archived data, hackers have compromised a website connected to Russia's Space Research Institute (IKI), which designs and builds scientific instruments for space experiments. On Twitter, the hackers who claimed responsibility for the breach went by the handle v0g3lsec.

See the full report here: https://www.vice.com/en/article/z3n8ea/hackers-breach-russian-space-research-institute-website

SharkBot malware hides as Android antivirus in Google Play - BleepingComputer

SharkBot banking malware has infiltrated Google Play, the official Android app repository, masquerading as an antivirus with system cleaning capabilities. The presence of this trojan app in the Play Store demonstrates that malware distributors can still circumvent Google's automatic defences. According to NCC researchers, the money transfer feature is still available in the most recent version of SharkBot but is only used in a few cases of advanced attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/sharkbot-malware-hides-as-android-antivirus-in-google-play/

Mon Health System data breach may have impacted 400000 people - Times-West Virginian

The Morgantown-based health care services company discovered the hack on Dec. 18, when some of its IT systems were disrupted, but learned of the potential data theft only a couple of weeks later. According to the report in Security Week magazine, the data breach may have resulted in patient information as well as employee, provider, and contractor data being stolen.

See the full report here: https://www.timeswv.com/news/monday_news/mon-health-system-data-breach-may-have-impacted-400-000-people/article_e563304c-9dcc-11ec-8fff-07ae7c66dbcd.html

Adafruit discloses data leak from ex-employee's GitHub repo - BleepingComputer

Adafruit, a New York-based producer of open-source hardware components, has disclosed a data leak that occurred due to a publicly-viewable GitHub repository. The data set did not contain any user passwords or financial information such as credit cards, the company stated. However, names, email addresses, shipping/billing addresses, and order details were exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/adafruit-discloses-data-leak-from-ex-employees-github-repo/

Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs - BleepingComputer

Mozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to fix two critical zero-day vulnerabilities actively exploited in attacks. When threat actors exploit this type of bug, it can cause the program to crash while at the same time allowing commands to be executed on the device without permission.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-9702-fixes-two-actively-exploited-zero-day-bugs/

Microsoft fixes critical Azure bug that exposed customer data - BleepingComputer

Microsoft has addressed a vulnerability in the Azure Automation service that could have allowed attackers to take complete control over other Azure customers' data. The vulnerability is dubbed as AutoWarp by Orca Security's Cloud Security Researcher.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-critical-azure-bug-that-exposed-customer-data/

Rompetrol gas station network hit by Hive ransomware - BleepingComputer

A subsidiary of KMG International, Rompetrol announced today that it is dealing with a "complex cyberattack" that forced it to shut down its websites and the Fill&Go service at gas stations.

See the full report here: https://www.bleepingcomputer.com/news/security/rompetrol-gas-station-network-hit-by-hive-ransomware/

Dozens of COVID passport apps put user's privacy at risk - BleepingComputer

Digital passport apps store proof of a person's COVID-19 vaccination status, full name, ID number, date of birth, and other personally identifiable information (PII) encoded in a QR code or displayed directly in the app. Symantec's team looked into 40 digital vaccine passport apps and ten validation (scanner) applications and found that 27 suffer from some of the following privacy and security risks.

See the full report here: https://www.bleepingcomputer.com/news/security/dozens-of-covid-passport-apps-put-users-privacy-at-risk/

Ukrainian CERT Warns Citizens of Phishing Attacks Using Compromised Accounts

Ukraine's Computer Emergency Response Team (CERT-UA) warned of new phishing attacks aimed at its citizens by leveraging compromised email accounts belonging to three different Indian entities with the goal of compromising their inboxes and stealing sensitive information.

See the full report here: https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html

Critical Bugs in TerraMaster TOS Could Open NAS Devices to Remote Hacking

Researchers have disclosed details of critical security vulnerabilities in TerraMaster network-attached storage (TNAS) devices that could be abused to attain unauthenticated remote code execution with the highest privileges. The flaws were patched in TOS version 4.2.30 released last week.

See the full report here: https://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html

FBI: Ransomware gang breached 52 US critical infrastructure orgs - BleepingComputer

The RagnarLocker ransomware has breached at least 52 U.S. entities across 10 critical infrastructure sectors, including manufacturing, energy, financial services, government, and information technology. This was disclosed in a flash alert focusing on providing indicators of compromise (IOCs) that organizations can use to detect and block RagnarLocker ransomware attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/

New Linux bug gives root on all major distros, exploit released - BleepingComputer

A Linus vulnerability (CVE-2022-0847, "Dirty Pipe") allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root. It affects Linux Kernel 5.8 and later versions, even on Android devices. The bug has been fixed in Linux kernels 5.16.11, 5.15.25, and 5.10.102.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-bug-gives-root-on-all-major-distros-exploit-released/

Hackers Targeted U.S. LNG Producers in Run-Up to Ukraine War

Security researchers have discovered that hackers gained access to more than 100 computers belonging to current and former employees of 21 major energy companies, in a two-week blitz in February. The hackers compromised some of the target machines themselves and, for others, bought access to specific computers that were already infected by others.

See the full report here: https://www.bloomberg.com/news/articles/2022-03-07/hackers-targeted-u-s-lng-producers-in-run-up-to-war-in-ukraine

E-commerce giant Mercado Libre confirms source code data breach - BleepingComputer

Argentinian e-commerce giant Mercado Libre has confirmed "unauthorized access" to a part of its source code this week. Mercado additionally says data of around 300,000 of its users was accessed by threat actors.

See the full report here: https://www.bleepingcomputer.com/news/security/e-commerce-giant-mercado-libre-confirms-source-code-data-breach/

Microsoft Patches Critical Exchange Server Flaw

Microsoft has issued security updates for 71 software vulnerabilities, three of which were critical and one that has a known proof-of-concept available in the public domain. CVE-2022-23277, CVE-2022-21990, and CVE-2022-24508 are the most notable flaws fixed by Microsoft.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-critical-exchange-server-flaw

Medical and IoT Devices From More Than 100 Vendors Vulnerable to Attack

More than 150 Internet of Things (IoT) devices — including many that are used in the healthcare sector — from over 100 companies are at heightened risk of attack from a set of seven vulnerabilities in a third-party remote access component in the devices.Three of the bugs are rated as critical because they enable attackers to remotely execute malicious code on vulnerable devices to take full control of them.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/medical-and-iot-devices-from-more-than-100-vendors-vulnerable-to-attack

HP patches 16 UEFI firmware bugs allowing stealthy malware infections - BleepingComputer

HP has disclosed 16 high-impact UEFI firmware vulnerabilities that could allow threat actors to infect devices with malware that gain high privileges and remain undetectable by installed security software. These vulnerabilities affect multiple HP models, including laptops, desktop computers, PoS systems, and edge computing nodes.

See the full report here: https://www.bleepingcomputer.com/news/security/hp-patches-16-uefi-firmware-bugs-allowing-stealthy-malware-infections/

At least 6 US state governments hacked by China, says cyber firm - WIAT - CBS42.com

According to a report released by a private cybersecurity firm, hackers working on behalf of the Chinese government broke into the computer networks of at least six state governments in the United States in the last year. The hacking operations done are both for old-fashioned espionage purposes and for financial gain.

See the full report here: https://www.nxsttv.com/nmw/news/at-least-6-us-state-governments-hacked-by-china-says-cyber-firm/

Chinese phishing actors consistently targeting EU diplomats - BleepingComputer

According to a new report by Proofpoint, the China-aligned group tracked as TA416 (aka Mustang Panda) has been consistently targeting European diplomats since August 2020, with the most recent activity involving refreshed lures to coincide with the Russian invasion of Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-phishing-actors-consistently-targeting-eu-diplomats/

Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

Researchers have disclosed three security vulnerabilities affecting the Pascom Cloud Phone System (CPS) that could be combined to achieve a full pre-authenticated remote code execution of affected systems. Pascom Cloud Phone System is an integrated collaboration and communication solution that allows businesses to host and set up private telephone networks across different platforms as well as facilitate the monitoring, maintenance, and updates associated with the virtual phone systems.

See the full report here: https://thehackernews.com/2022/03/critical-rce-bugs-found-in-pascom-cloud.html

Critical Bugs Could Let Attackers Remotely Hack, Damage APC Smart-UPS Devices

Three high-impact security vulnerabilities have been disclosed in APC Smart-UPS devices that could be abused by remote adversaries as a physical weapon to access and control them in an unauthorized manner.CVE-2022-22805 (CVSS score: 9.0) – TLS buffer overflow, CVE-2022-22806 (CVSS score: 9.0) – TLS authentication bypass, and CVE-2022-0715 (CVSS score: 8.9) – Unsigned firmware upgrade that can be updated over the network are the names of the vulnerability.

See the full report here: https://thehackernews.com/2022/03/critical-bugs-could-let-attackers.html

Russian government sites hacked in supply chain attack - BleepingComputer

Russia says some of its federal agencies' websites were compromised in a supply chain attack on Tuesday after unknown attackers hacked the stats widget used to track the number of visitors by multiple government agencies. The attackers published their own content and blocked access to the websites.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-government-sites-hacked-in-supply-chain-attack/

Most ServiceNow Instances Misconfigured, Exposed

ServiceNow is a $4.5 billion company whose software helps enterprises with their digital workflows. Approximately 70 percent of ServiceNow implementations are vulnerable to malicious data extraction as customers aren’t locking down access correctly.

See the full report here: https://threatpost.com/most-servicenow-instances-misconfigured-exposed/178827/

Google: Chinese hackers target Gmail users affiliated with US govt - BleepingComputer

Google's Threat Analysis Group has warned multiple Gmail users that they were targeted in phishing attacks conducted by a Chinese-backed hacking group tracked as APT31. The company stated that it doesn't have any evidence to suggest that this campaign was related to the current war in Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chinese-hackers-target-gmail-users-affiliated-with-us-govt/

Intel, AMD, Arm warn of new speculative execution CPU bugs - BleepingComputer

CPU manufacturers Intel, AMD, and Arm have published advisories to tackle recently discovered issues that allow leaking of sensitive information despite isolation-based protections. This comes after security researchers disclosed a new way to bypass existing hardware-based defenses for speculative execution in modern computer processors and provided a proof-of-concept.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-amd-arm-warn-of-new-speculative-execution-cpu-bugs/

SEC proposes four-day rule for public companies to report cyberattacks

The US Securities and Exchange Commission (SEC) has proposed a new rule that mandates cybersecurity incident disclosure within four business days after the organization determines that it has experienced a material cybersecurity incident. This would be an amendment to the reporting requirements for Form 8-K, which public companies file to publicly announce corporate changes or big events that may affect shareholders.

See the full report here: https://www.theregister.com/2022/03/09/sec_cyberattack_disclosure/

Nearly 30% of critical WordPress plugin bugs don't get a patch - BleepingComputer

A newly released whitepaper states that 29% of the critical flaws in WordPress plugins never received a security update. The paper listed five critical-severity vulnerabilities in 2021, affecting 55 WordPress themes – with the most impactful concerning the abuse of file upload features.

See the full report here: https://www.bleepingcomputer.com/news/security/nearly-30-percent-of-critical-wordpress-plugin-bugs-dont-get-a-patch/

CISA updates Conti ransomware alert with nearly 100 domain names - BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated the alert on Conti ransomware with indicators of compromise (IoCs) consisting of close to 100 domain names used in malicious operations. The agency also stated that Conti has hit more than 1,000 organizations across the world, the most prevalent attack vectors being TrickBot malware and Cobalt Strike beacons.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/