Threat Intelligence Bulletin: 03/11/2022 - 03/17/2022
|by Alpha Team
Russia-Ukraine Conflict: Supply Chain Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a supply chain update on the Russian-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
China’s zero-tolerance COVID-19 policy is being implemented on the coastal cities of Shanghai and Shenzhen, meaning economic activity has come to a halt. If exceptions are not made for ports, expect far greater supply chain problems than anything caused by the Russia-Ukraine crisis, particularly for the United States. A previous partial lockdown of the port caused global supply chain issues that took two months to resolve, and this lockdown is more extreme. The Biden administration has quietly been pushing for consequential improvements to U.S. supply chains to make them more resilient to geopolitical crises, but they will take years to implement. Globally, commodities prices remain elevated, even if oil and natural gas prices drop. The impact this has on food prices will be consequential, particularly for emerging markets where food makes up the bulk of their purchases. Global social unrest in countries where food and transportation has become unaffordable is likely.
Russia-Ukraine Conflict: Situational Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russian-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
Ukrainian and Russian delegations have reportedly made progress in negotiations, but a peace settlement remains a distant prospect due to non-negotiable demands on both sides of the conflict. The United States announced USD 800 million in immediate military aid to Ukraine, and an additional USD 13.6 billion is allocated to Ukraine as part of a federal funding bill. Russian President Vladimir Putin said that he will increase public sector salaries, pensions, and the minimum wage to counteract the effects of Western sanctions.
Breaking News: 2022-03-11 - 2022-03-17
Mitel VoIP systems used in staggering DDoS attacks
Miscreants have launched massive, amplified distributed denial-of-service attacks by exploiting a vulnerability in Mitel collaboration systems. Mitel is working with customers regarding the vulnerability – tracked as CVE-2022-26143 – including releasing a patch. In lab tests, the researchers were able to push the hardware to generate massive amounts of traffic in response to what they described as "comparatively small request payloads.
See the full report here: https://www.theregister.com/2022/03/10/mitel_amplification_ddos_attack/
Qakbot Botnet Sprouts Fangs, Injects Malware into Email Threads
The Qakbot botnet is getting more dangerous as the malware is now hijacking email threads to download malicious DLLs that inject password-stealing code into webpages, among other foul things. The Sophos researchers managed to decrypt the malicious modules and to decode the botnet’s command and control C2) system to figure out interpret how Qakbot receives its marching orders.
See the full report here: https://threatpost.com/qakbot-botnet-sprouts-fangs-injects-malware-into-email-threads/178845/
Iranian Hackers Targeting Turkey and Arabian Peninsula in New Malware Campaign
MuddyWater, an Iranian state-sponsored threat actor, has been blamed for a new wave of attacks targeting Turkey and the Arabian Peninsula with the goal of deploying remote access trojans (RATs) on compromised systems. MuddyWater is also thought to be a collection of disparate teams working independently rather than a single threat actor group.
See the full report here: https://thehackernews.com/2022/03/iranian-hackers-targeting-turkey-and.html
Microsoft confirms Intune enrollment issue on Android devices - BleepingComputer
Microsoft has confirmed a new known issue causing Microsoft Intune enrollment problems on some Android devices after upgrading from Android 11 to Android 12. Affected products include some OPPO, OnePlus, and Realme devices enrolled as Android Enterprise personally-owned work profile. Impacted customers should install the latest OS updates as soon as they're released.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-intune-enrollment-issue-on-android-devices/
Russia creates its own TLS certificate authority to bypass sanctions - BleepingComputer
Russia has created its own trusted TLS certificate authority (CA) to solve website access problems as the sanctions on the country are preventing certificate renewals. Certificate authorities are supposed to be universally trusted. However, due to the nature of the current conflict, it is unlikely for major browser vendors to add them to their root certificate stores.
See the full report here: https://www.bleepingcomputer.com/news/security/russia-creates-its-own-tls-certificate-authority-to-bypass-sanctions/
Malware disguised as security tool targets Ukraine's IT Army - BleepingComputer
Threat actors are targeting the Ukrainian IT Army by promoting a fake DDoS tool on Telegram. The tool mimics a "legitimate" DDoS tool called Liberator, which is a website bomber for use against Russian propaganda outlets. However, after installation, it steals the user's data from browsers, VPN tools, Discord, filesystem locations, and cryptocurrency wallets, and send it to a remote address.
See the full report here: https://www.bleepingcomputer.com/news/security/malware-disguised-as-security-tool-targets-ukraines-it-army/
Corporate website contact forms used to spread BazarBackdoor malware - BleepingComputer
Threat actors are spreading the stealthy BazarBackdoor malware via website contact forms to evade detection, in a change from the previously used phishing emails. This malware, originally developed by the TrickBot group, provides threat actors remote access to an internal device that can be used as a launchpad for further lateral movement within a network.
See the full report here: https://www.bleepingcomputer.com/news/security/corporate-website-contact-forms-used-to-spread-bazarbackdoor-malware/
Russian defense firm Rostec shuts down website after DDoS attack - BleepingComputer
Rostec, a Russian state-owned aerospace and defence conglomerate, said its website was taken down following a cyberattack. The state defence company says its website has been under constant siege since late February when Russia invaded its neighbour Ukraine without provocation.
See the full report here: https://www.bleepingcomputer.com/news/security/russian-defense-firm-rostec-shuts-down-website-after-ddos-attack/
New ONE PIECE anime episodes delayed after Toei cyberattack - BleepingComputer
Anime giant Toei suffered a weekend cyberattack causing delays in airing new episodes of popular anime series, including ONE PIECE and Delicious Party Precure. According to the announcement by both Toei and ONE PIECE, the anime studio detected unauthorized access to their systems on Mach 6th, 2022. The next day, the company issued a notice stating they had to shut down all internal systems as a safety precaution and launched an investigation into the incident.
See the full report here: https://www.bleepingcomputer.com/news/security/new-one-piece-anime-episodes-delayed-after-toei-cyberattack/
Finnish govt agency warns of unusual aircraft GPS interference - BleepingComputer
Finland's Transport and Communications Agency, Traficom, has issued a public announcement informing of an unusual spike in GPS interference near the country's eastern border. The origin of the interference remains unknown, but based on numerous reports submitted to the agency from various sources, it has started during the weekend and is still ongoing.
See the full report here: https://www.bleepingcomputer.com/news/technology/finnish-govt-agency-warns-of-unusual-aircraft-gps-interference/
DuckDuckGo down-ranks sites spreading Russian propaganda - BleepingComputer
The DuckDuckGo web search engine is now demoting websites known to spread Russian propaganda following Russia's invasion of Ukraine, according to the company's founder and CEO, Gabriel Weinberg. Besides demoting disinformation-linked sites in results, the search engine is now also started displaying information boxes at the top of the page to help users find accurate information for rapidly unfolding topics.
See the full report here: https://www.bleepingcomputer.com/news/technology/duckduckgo-down-ranks-sites-spreading-russian-propaganda/
LockBit ransomware gang claims attack on Bridgestone Americas - BleepingComputer
A cyberattack on Bridgestone Americas, one of the largest manufacturers of tires in the world, has been claimed by the LockBit ransomware gang. It is unclear what data LockBit stole from Bridgestone or how detrimental leaking it would be to the company.
See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-attack-on-bridgestone-americas/
Singapore uncovers four critical vulnerabilities in Riverbed software
Singapore's Cyber Security Group, an agency charged with securing the nation's cyberspace, has uncovered four critical flaws in code from network software company Riverbed. The vulnerable application is SteelCentral AppInternals, formerly referred to as AppInternals Xpert, provided by Riverbed's Aternity division. AppInternals provides application performance monitoring and diagnostics and is part of SteelCentral.
See the full report here: https://www.theregister.com/2022/03/11/riverbed_vulnerabilities/
Android malware Escobar steals your Google Authenticator MFA codes
The Aberebot Android banking trojan has made comeback under the name 'Escobar' with new features, including stealing Google Authenticator multi-factor authentication codes. The new features in the latest Aberebot version also include taking control of the infected Android devices using VNC, recording audio, and taking photos, while also expanding the set of targeted apps for credential theft. The main goal of the trojan is to steal enough information to allow the threat actors to take over victims' bank accounts, siphon available balances, and perform unauthorized transactions.
See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/
Cybercriminals are posing as Ukraine fundraisers to steal cryptocurrency
During Russia's invasion of the country, Ukraine and charities supporting the country have turned to cryptocurrency donations. Ukraine announced that as an incentive to donors, it would send free tokens of a new government-sponsored cryptocurrency. Scammers prey on users who pretend to be in need of donations, users who pretend to be companies collecting donations, and users who offer to assist others in creating fake donation websites. According to experts, the best way to avoid scams is for donors and businesses to be wary of fraudsters and to only trust verified organisations.
See the full report here: https://www.cyberscoop.com/cybercriminals-are-posing-as-ukraine-fundraisers-to-steal-cryptocurrency/
Ubisoft suffered a cyber security incident that caused a temporary disruption
Ubisoft suffered a "cyber security incident" that had a severe impact on games, systems, and services. The incident has been acknowledged by the company, and an investigation is ongoing. LAPSUS$, a data extortion group, claimed to have hacked the company. There is currently no evidence of a data breach during the incident, and the services are operational as usual.
See the full report here: https://securityaffairs.co/wordpress/128929/hacking/ubisoft-cyber-security-incident.html
Algeria accuses Morocco hackers of hacking Justice Ministry Twitter account - Middle East Monitor
The official Algerian radio station accused Moroccan hackers of hacking the Algerian Justice Ministry's Twitter account and posting anti-Ukraine posts. The Algerian Ministry of Justice confirmed that it would file a lawsuit in response to the cyberattack on Algerian government institutions.
See the full report here: https://www.middleeastmonitor.com/20220312-algeria-accuses-morocco-hackers-of-hacking-justice-ministry-twitter-account/
Russia to create its own security certificate authority, alarming experts
Since Russia's invasion of Ukraine, crippling sanctions imposed by Western governments and enterprises have afflicted the country, causing website access issues and preventing the renewal of Transport Layer Security (TLS) security certificates. Recently, the Russian government issued an online notice on its public services homepage about its plans that they will create their own domestic certificate authority. Security researchers are alarmed with this decision as one could use the certificate authority to launch man-in-the-middle attacks on people if you have control over it.
See the full report here: https://www.cyberscoop.com/russia-tls-security-certificate-authority/
Android malware Escobar steals your Google Authenticator MFA codes
The Aberebot Android banking trojan has made comeback under the name 'Escobar' with new features, including stealing Google Authenticator multi-factor authentication codes. The new features in the latest Aberebot version also include taking control of the infected Android devices using VNC, recording audio, and taking photos, while also expanding the set of targeted apps for credential theft. The main goal of the trojan is to steal enough information to allow the threat actors to take over victims' bank accounts, siphon available balances, and perform unauthorized transactions.
See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/
Fake Valorant cheats on YouTube infect you with RedLine stealer - BleepingComputer
Security researchers in Korea have discovered a malware distribution operation on YouTube that leverages Valorant cheat lures to fool gamers into downloading RedLine, a strong information stealer. The videos that promote these tools are often stolen from elsewhere and are re-posted from malicious users on newly created channels to act as lures.
See the full report here: https://www.bleepingcomputer.com/news/security/fake-valorant-cheats-on-youtube-infect-you-with-redline-stealer/
Toyota Motor supplier Denso hit by ransomware attack - NHK WORLD
A hacker group Pandore has claimed to have stolen 1.4 terabytes of data from the Japanese auto-parts maker Denso. The group stated that the stolen data contains purchase orders, emails and drawings and has demanded a ransom for it. Denso has reportedly confirmed unauthorized access to the network of its business base in Germany and is investigating the impact.
See the full report here: https://www3.nhk.or.jp/nhkworld/en/news/20220313_23/
Raccoon Stealer Crawls Into Telegram
Raccoon Stealer, a credential stealer believed to be operatated by Russia-affiliated cybercriminals, is now abusing Telegram for command-and-control (C2). It can steal passwords, cookies, files from crypto wallets, and more, and even download and execute arbitrary files by command from its C2.
See the full report here: https://threatpost.com/raccoon-stealer-telegram/178881/
Researchers Find New Evidence Linking Kwampirs Malware to Shamoon APT Hackers
Security researchers have observed overlapping source code and techniques between the operators of Shamoon and Kwampirs families of malware, indicating that they are the same group or really close collaborators. Last year, the U.S. government had connected Shamoon to Iranian state-sponsored actors, while Kwampirs was connected to a threat group known as Orangeworm.
See the full report here: https://thehackernews.com/2022/03/researchers-find-new-evidence-linking.html
New Linux Bug in Netfilter Firewall Module Lets Attackers Gain Root Access
A newly disclosed security flaw (CVE-2022-25636) in the Linux kernel could be used by a local adversary to gain elevated privileges on vulnerable systems to execute arbitrary code, escape containers, or induce a kernel panic. It impacts Linux kernel versions 5.4 through 5.6.10 and is a result of a heap out-of-bounds write in the netfilter subcomponent in the kernel.
See the full report here: https://thehackernews.com/2022/03/new-linux-bug-in-netfilter-firewall.html
QNAP warns severe Linux bug affects most of its NAS devices - BleepingComputer
QNAP has warned users that most of its Network Attached Storage (NAS) devices are impacted by the Linux vulnerability "Dirty Pipe." Affecting Linux Kernel 5.8 and later versions, this bug allows attackers with local access to gain root privileges. Until QNAP releases security updates to address the vulnerability, users should ensure that their NAS device is not exposed to Internet attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-severe-linux-bug-affects-most-of-its-nas-devices/
Personal info from 287,000 patients compromised in hack of Denver cardio practice - Becker's ASC Review
In a January hacking incident, South Denver Cardiology Associates, situated in Littleton, Colo., reported sensitive patient data was exposed. According to HHS figures, the hack puts the personal information of 287,652 patients in jeopardy. Some of those files included patient information, such as names, birthdates, Social Security numbers, driver's license numbers, patient account numbers, health insurance information, and clinical care information including physician names, dates and types of service, and diagnoses.
See the full report here: https://www.beckersasc.com/cardiology/personal-info-from-287-000-patients-compromised-in-hack-of-denver-cardio-practice.html
Fake antivirus updates used to deploy Cobalt Strike in Ukraine - BleepingComputer
Threat actors are sending bogus Windows antivirus updates that install Cobalt Strike and other malware, according to Ukraine's Computer Emergency Response Team. The phishing emails are sent to Ukrainian state bodies and propose downloading "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
See the full report here: https://www.bleepingcomputer.com/news/security/fake-antivirus-updates-used-to-deploy-cobalt-strike-in-ukraine/
New CaddyWiper data wiping malware hits Ukrainian networks - BleepingComputer
In attacks targeting Ukrainian enterprises, a newly found data-destroying malware was identified wiping data across systems on infected networks. CaddyWiper will use the DsRoleGetPrimaryDomainInformation() function to check if a device is a domain controller, despite being meant to erase data across Windows domains. The data on the domain controller will not be removed if this is the case.
See the full report here: https://www.bleepingcomputer.com/news/security/new-caddywiper-data-wiping-malware-hits-ukrainian-networks/
NASA in 'serious jeopardy' due to big black hole in security
An audit has noted that the vast majority of NASA tech is not classified. The unclassified information includes scientific, engineering, or research data; human resources files; or procurement sensitive information. Because that infrastructure is not classified, it's not covered by the insider threat program. The auditors recommend that NASA extend its insider threat defenses to cover unclassified information.
See the full report here: https://www.theregister.com/2022/03/15/nasa_insider_threat_audit/
German government advises against using Kaspersky antivirus - BleepingComputer
Germany's Federal Office for Information Security, BSI, is warning companies against using Kaspersky antivirus products due to threats made by Russia against the EU, NATO, and Germany. Kaspersky, the Moscow-based cybersecurity and antivirus company, has a history of controversy over its possible relationship with the Russian government.
See the full report here: https://www.bleepingcomputer.com/news/security/german-government-advises-against-using-kaspersky-antivirus/
Cyberattacks Against Israeli Government Sites: ‘Largest in the Country’s History’
The Israel National Cyber Directorate confirmed on Monday that a denial-of-service (DDoS) attack against a telecommunications provider took down several government as well non-governmental sites. Security experts suspect that the attacks were in retaliation for Israel’s reported attempt to breach Iran’s nuclear infrastructure.
See the full report here: https://threatpost.com/cyberattacks-israeli-government-sites-largest/178927/
New Linux botnet exploits Log4J, uses DNS tunneling for comms - BleepingComputer
Researchers at Qihoo 360's Network Security Research Lab (360 Netlab) have dubbed the newly discovered virus B1txor20. It targets Linux ARM and X64 CPU architecture systems. The botnet infects new hosts with exploits targeting the Log4J vulnerability, a very enticing attack vector given that the insecure Apache Log4j logging module is used by dozens of businesses.
See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-botnet-exploits-log4j-uses-dns-tunneling-for-comms/
OpenSSL patches crash-me bug triggered by rogue certs
A bug in OpenSSL certificate parsing leaves systems open to denial-of-service attacks from anyone wielding an explicit curve. This parsing happens prior to the verification of the certificate's signature. Possibly exploitable situations include TLS clients consuming server certificates (and vice-versa), hosting providers accepting keys from customers, certificate authorities parsing cert requests from subscribers, or "anything else which parses ASN.1 elliptic curve parameters."
See the full report here: https://www.theregister.com/2022/03/15/openssl_bug_dos/
FBI warns of MFA flaw used by state hackers for lateral movement - BleepingComputer
According to the FBI, Russian state-sponsored hackers obtained access to a non-governmental organization's (NGO) cloud by registering their own device in the organization's Duo MFA system, which was exploited by incorrect default multifactor authentication (MFA) protocols. They gained access to the network by using credentials obtained through a brute-force password guessing attempt to get access to an un-enrolled and dormant account that had not yet been disabled in the organization's Active Directory.
See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-mfa-flaw-used-by-state-hackers-for-lateral-movement/
Massive phishing campaign uses 500+ domains to steal credentials - BleepingComputer
Security researchers at cyber intelligence company Prevailion earlier this year identified a massive phishing operation focused on collecting credentials of Naver users. Infrastructure overlaps tied to the TrickBot botnet can be seen in large-scale phishing activity employing hundreds of domains to steal credentials for Naver, a Google-like web platform in South Korea.
See the full report here: https://www.bleepingcomputer.com/news/security/massive-phishing-campaign-uses-500-plus-domains-leading-to-fake-login-pages/
Unpatched RCE Bug in dompdf Project Affects HTML to PDF Converters
Researchers discovered an unpatched security vulnerability in "dompdf," a PHP-based HTML to PDF converter, that might lead to remote code execution in some configurations if properly exploited. The flaw allows a malicious party to upload font files with a .php extension to the web server, which can then be activated by using an XSS vulnerability to inject HTML into a web page before it's rendered as a PDF.
See the full report here: https://thehackernews.com/2022/03/unpatched-rce-bug-in-dompdf-project.html
LokiLocker ransomware family spotted with built-in wiper
Security researchers have identified a ransomware family targeting English-speaking victims that is capable of erasing all non-system files from infected Windows PCs. LokiLocker, a ransomware-as-a-service (RaaS) family with possible origins in Iran, was first seen in the wild in mid-August 2021.
See the full report here: https://www.theregister.com/2022/03/16/blackberry_lokilocker_ransomware/
Multiple Flaws Uncovered in ClickHouse OLAP Database System for Big Data
Researchers have discovered seven new security flaws in ClickHouse, an open-source database management system. These flaws can be used to crash servers, expose memory contents, or even lead to the execution of arbitrary code. The vulnerabilities require authentication, but can be triggered by any user with read permissions.
See the full report here: https://thehackernews.com/2022/03/multiple-flaws-uncovered-in-clickhouse.html
‘CryptoRom’ Crypto-Scam is Back via Side-Loaded Apps
Using the TestFlight and WebClips apps, scammers are circumventing Apple's App Store security and stealing thousands of dollars in cryptocurrencies from the unsuspecting. They’re leveraging new iOS features – TestFlight and WebClips – to get fake apps onto victims’ phones without being subject to the rigorous app store approval process.
See the full report here: https://threatpost.com/cryptorom-crypto-scam-side-loaded-apple-apps/178942/
Emotet malware campaign impersonates the IRS for 2022 tax season - BleepingComputer
The Emotet malware botnet is taking advantage of the 2022 tax season in the United States by sending out malicious emails posing as the Internal Revenue Service, which is supposed to be issuing tax forms or federal returns. Emotet is a malware infection distributed through phishing emails with attached Word or Excel documents containing malicious macros.
See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-campaign-impersonates-the-irs-for-2022-tax-season/
CISA adds 15 vulnerabilities to list of flaws exploited in attacks - BleepingComputer
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added 15 vulnerabilities to the Known Exploited Vulnerabilities Catalog, bringing it to a total of 504 flaws. Organizations are advised to monitor that list and ensure they have addressed all security gaps on their systems.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-15-vulnerabilities-to-list-of-flaws-exploited-in-attacks/
Hundreds of GoDaddy-hosted sites backdoored in a single day - BleepingComputer
Security researchers have spotted attacks featuring a backdoor payload in hundreds of websites hosted on GoDaddy. The attacks affect internet service resellers such as MediaTemple, tsoHost, 123Reg, Domain Factory, Heart Internet, and Host Europe Managed WordPress. The backdoor is a 2015 Google search SEO-poisoning tool implanted on the wp-config.php.
See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-godaddy-hosted-sites-backdoored-in-a-single-day/
SolarWinds warns of attacks targeting Web Help Desk instances - BleepingComputer
SolarWinds has warned customers of attacks targeting internet-exposed Web Help Desk (WHD) instances and advised removing them from publicly accessible infrastructure. The company urged users who cannot immediately remove WHD instances from internet-exposed servers to deploy EDR (endpoint detection and response) software and monitor them for attack attempts.
See the full report here: https://www.bleepingcomputer.com/news/security/solarwinds-warns-of-attacks-targeting-web-help-desk-instances/
Unsecured Microsoft SQL, MySQL servers hit by Gh0stCringe malware - BleepingComputer
Threat actors behind the GhostCringe remote access trojan are targeting poorly secured database servers with weak account credentials and no oversight. Admins should install latest updates, set strong passwords, place database servers behind a firewall, and monitor all actions to guard against such attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/unsecured-microsoft-sql-mysql-servers-hit-by-gh0stcringe-malware/
Meta takes down deepfake of Ukraine’s President Zelensky surrendering – TechCrunch
Meta removed an altered video falsely depicting the Ukrainian President ordering troops to surrender – for breaking its rules against “manipulated media." The video initially appeared on a reportedly compromised website of a TV channel.
See the full report here: https://techcrunch.com/2022/03/16/facebook-zelensky-deepfake/
Tags: weekly bulletin, all industries, global