Threat Intelligence Bulletin: 03/25/2022 - 03/31/2022
|by Alpha Team
Intellectual Property Implications of Russia's Invasion of Ukraine
TLP: WHITE
In this briefing, ZeroFox Intelligence provides an update on the intellectual property implications of Russia's invasion of Ukraine.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on March 25, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Executive Summary
In response to sanctions levied against Russia by Western nations following Russia's invasion of Ukraine, the Russian government and courts have made a series of decisions encouraging domestic entities to appropriate trademarks and patents from multinational companies with Western ties. Well-known brands such as McDonald's and Starbucks have already seen their branding appear in new trademark applications filed by Russian applicants. Protecting intellectual property within Russia could become increasingly difficult and expensive for companies with ties to countries that the Russian government considers to be "unfriendly." Companies should give these challenges careful consideration when making decisions about whether to continue operations in Russia.
Anonymous Deep Web Expansion Met with Skepticism
TLP: WHITE
In this briefing, ZeroFox Intelligence provides an update #OpRedScare, a call to arms by Anonymous to disable Russian and Belarusian infrastructure.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:40 PM (EDT) on March 29, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Executive Summary
On March 18, 2022, hacktivist group Anonymous posted a call to arms on a deep web forum to disable Russian and Belarusian infrastructure that they dubbed #OpRedScare. Responses to the post indicate that active underground community members are critical of Anonymous’ mission, techniques and tradecraft. However, the resulting chatter clearly showed that those in the pro-Ukraine camp continue to support taking disruptive cyber actions against Russia, Russia-based entities, and businesses they judge are too supportive of Russia.
Russia-Ukraine Conflict: Situational Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on March 31, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Executive Summary
A negotiated end to the war is unlikely in the near term, despite signs of progress from March 29, 2022, talks in Istanbul. Ukraine has proposed a military alliance to guarantee its security against Russian aggression, but its adoption is improbable due to the requirement of Western military intervention. Sweden and Finland are reassessing their neutrality and considering applications for NATO admission. Russia will likely conquer Mariupol soon and redeploy other forces to Donetsk and Luhansk regions.
Breaking News: 2022-03-25 - 2022-03-31
UK Ministry of Defence takes recruitment system offline, confirms data leak
The UK Ministry of Defence has suspended online application and support services for the British Army's Defence Recruitment System (DRS). The Army had shut down its career website and DRS as a precautionary measure after being informed of a breach and potential data compromise. The Army is reportedly using paper systems currently to manage its recruitment activity.
See the full report here: https://www.theregister.com/2022/03/24/ministry_of_defence/
Vidar spyware is now hidden in Microsoft help files
The Vidar malware (Windows spyware and information stealer) is being reportedly hidden in Microsoft Compiled HTML Help (CHM) files to avoid detection in email spam/phishing campaigns. The email campaign uses a generic subject line and an attachment, "request.doc," which is actually a .iso disk image.
See the full report here: https://www.zdnet.com/article/vidar-spyware-is-now-hidden-in-microsoft-help-files/
Hackers steal from hackers by pushing fake malware on forums - BleepingComputer
Hackers are reportedly trying to install clipboard stealers (which can then be used to steal from victims' cryptocurrency wallets) on systems of other hackers by posting fake links on hacker forums. The fake links claim to be cracked RATs (remote access trojans) and malware building tools.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-from-hackers-by-pushing-fake-malware-on-forums/
GitHub explains the cause behind the past week's outages - BleepingComputer
GitHub has explained that its recent outages were caused by resource contention issues with its primary MySQL cluster called "MySQL1." The outages occurred on March 16,17, 22, and 23. The company is auditing its systems during peak hours, rerouting traffic to other database to reduce load, and increasing infrastructure and sharding to improve performance.
See the full report here: https://www.bleepingcomputer.com/news/technology/github-explains-the-cause-behind-the-past-weeks-outages/
Malicious Microsoft Excel add-ins used to deliver RAT malware - BleepingComputer
Phishing emails are being used to distribute a new version of the JSSLoader remote access trojan (RAT) via malicious Microsoft Excel addins. JSSLoader is a small, lightweight RAT that can perform data exfiltration, establish persistence, fetch and load additional payloads, and auto-update itself.
See the full report here: https://www.bleepingcomputer.com/news/security/malicious-microsoft-excel-add-ins-used-to-deliver-rat-malware/
Lapsus$ suspects arrested for Microsoft, Nvidia, Okta hacks - BleepingComputer
Seven people linked to the Lapsus$ gang have been reportedly arrested by the City of London Police. A minor in Oxford, England, is believed to be among the leaders of the group. The group, meanwhile had stated that some of its members were taking a vacation until March 30.
See the full report here: https://www.bleepingcomputer.com/news/security/lapsus-suspects-arrested-for-microsoft-nvidia-okta-hacks/
Microsoft Azure developers targeted by 200-plus data-stealing npm packages
Over 200 malicious npm packages have been removed two days after they were made available to the public. These uploads consisted PII (personally identifiable information) stealers and were part of a targeted attack on developers who use Microsoft Azure.
See the full report here: https://www.theregister.com/2022/03/24/developers_using_microsoft_azure_targeted/
Morgan Stanley client accounts breached in social engineering attacks - BleepingComputer
Some customers of Morgan Stanley Wealth Management had their accounts compromised via a vishing (or voice phishing, a type of social engineering attack) campaign in February 2022. The organization disabled the accounts of all customers affected by these attacks and stated that its systems remain secure.
See the full report here: https://www.bleepingcomputer.com/news/security/morgan-stanley-client-accounts-breached-in-social-engineering-attacks/
Microsoft: Recent Windows Server updates cause DNS issues - BleepingComputer
Microsoft has addressed a known bug causing DNS resolution issues on Windows Server 2019 systems. Users who installed the updates released on January 25 and later could have faced these DNS-resolution problems. Microsoft has fixed this issue via the Known Issue Rollback (KIR) feature.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-recent-windows-server-updates-cause-dns-issues/
North Korean hackers exploit Chrome zero-day weeks before patch - BleepingComputer
Security researchers, including those from Google's Threat Analysis Group, had observed two North Korea–backed hacker groups exploiting a recently patched Chrome zero-day bug (CVE-2022-0609) before the patch was released. The victims were targeted via emails, fake websites, or compromised legitimate websites that would ultimately activate the exploit kit for the bug.
See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-exploit-chrome-zero-day-weeks-before-patch/
Western Digital My Cloud OS update fixes critical vulnerability - BleepingComputer
Western Digital has released patches for a bug (CVE-2022-23121; CVSS v3 score of 9.8) in its new My Cloud OS firmware. The bug was exploited by bug hunters during the Pwn2Own 2021 hacking competition to achieve remote code execution.
See the full report here: https://www.bleepingcomputer.com/news/security/western-digital-my-cloud-os-update-fixes-critical-vulnerability/
US DoJ reveals Russian supply chain attack targeting energy sector
error_no_summary
See the full report here: https://www.theregister.com/2022/03/25/us_indicts_russian_state_hackers/
US says Kaspersky poses unacceptable risk to national security - BleepingComputer
The Federal Communications Commission (FCC) added Russian cybersecurity firm Kaspersky to its Covered List, saying it poses unacceptable risks to U.S. national security. Kaspersky services covered by this decision include information security products, solutions, and services supplied by Kaspersky or any linked companies, including subsidiaries or affiliates. FCC's national security ban list was also expanded to include Chinese state-owned mobile service providers China Mobile International USA and China Telecom Americas.
See the full report here: https://www.bleepingcomputer.com/news/security/us-says-kaspersky-poses-unacceptable-risk-to-national-security/
DOJ Indicts Russian Gov’t Employees Over Targeting Power Sector
The U.S. Department of Justice (DOJ) has indicted four Russian government employees in connection to plots to cyber-fry critical infrastructure in the United States and beyond, including at least one nuclear power plant. The campaigns involved one of the most dangerous malware ever encountered in the operational technology and energy sectors: Triton, aka Trisis, a Russia-linked malware used to shut down an oil refinery in 2017 and another Mideast target in 2019.
See the full report here: https://threatpost.com/doj-indicts-russian-govt-employees-over-targeting-power-sector/179108/
Honda bug lets a hacker unlock and start your car via replay attack - BleepingComputer
Researchers have disclosed a 'replay attack' vulnerability affecting select Honda and Acura car models, that allows a nearby hacker to unlock your car and even start its engine from a short distance. The attack consists of a threat actor capturing the RF signals sent from your key fob to the car and resending these signals to take control of your car's remote keyless entry system. The vulnerability, according to researchers, remains largely unfixed in older models.
See the full report here: https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/
Microsoft: Windows 7 recovery app fails after January updates - BleepingComputer
Microsoft says Windows 7 recovery discs created using the Control Panel Backup and Restore app will fail to start after installing Windows updates released since January 11, 2022. However, while Microsoft did not explain why this happens, it said the recovery discs would work on systems where the problematic updates weren't installed.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-7-recovery-app-fails-after-january-updates/
URL rendering trick enabled WhatsApp, Signal, iMessage phishing - BleepingComputer
A rendering technique affecting the world's leading messaging and email platforms, including Instagram, iMessage, WhatsApp, Signal, and Facebook Messenger, allowed threat actors to create legitimate-looking phishing messages for the past three years. The vulnerabilities are rendering bugs resulting in the apps' interface incorrectly displaying URLs with injected RTLO (right to left override) Unicode control characters, making the user vulnerable to URI spoofing attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/url-rendering-trick-enabled-whatsapp-signal-imessage-phishing/
Public Redis exploit used by malware gang to grow botnet - BleepingComputer
The Muhstik malware gang is now actively targeting and exploiting a Lua sandbox escape vulnerability in Redis after a proof-of-concept exploits was publicly released. The vulnerability is tracked as CVE-2022-0543 and was discovered in February 2022, affecting both Debian and Ubuntu Linux distributions. Users should update the Redis package to the latest available version or switch to non-vulnerable tools such as Bionic or Trusty.
See the full report here: https://www.bleepingcomputer.com/news/security/public-redis-exploit-used-by-malware-gang-to-grow-botnet/
Emergency Google Chrome update fixes zero-day used in attacks - BleepingComputer
Google has released Chrome 99.0.4844.84 for Windows, Mac, and Linux users to address a high-severity zero-day bug exploited in the wild. The zero-day bug fixed yesterday (tracked as CVE-2022-1096) is a high severity type confusion weakness in the Chrome V8 JavaScript engine reported by an anonymous security researcher. Google is aware that an exploit for CVE-2022-1096 exists in the wild.
See the full report here: https://www.bleepingcomputer.com/news/security/emergency-google-chrome-update-fixes-zero-day-used-in-attacks/
FCC adds Kaspersky to Covered List due to unacceptable risks to national security
The Federal Communications Commission (FCC) added multiple Kaspersky products and services like AO Kaspersky Lab, China Telecom (Americas) Corp, and China Mobile International USA Inc to its Covered List saying that they pose risks to U.S. national security. FCC also banned Kaspersky security solutions and services supplied by Kaspersky or any linked companies. According to (7) BSI law, the BSI warns against the use of Kaspersky Antivirus and recommends replacing it asap with defence solutions from other vendors.
See the full report here: https://securityaffairs.co/wordpress/129496/security/us-fcc-bans-kaspersky.html
Microsoft releases emergency security update for Edge - Ghacks
Microsoft released a security update for its Edge web browser that addresses the CVE 2022 1096 vulnerability. Edge users may want to manually check for updates in order to install the security update as soon as possible. The update is available for all desktop operating systems supported by Edge and should install Edge version 99.0.1150.55. The Microsoft Edge web browser is based on Chromium, the same core that Google's Chrome web browser is based on. Google is aware of the existence of a CVE-2022-1096 exploit in the wild.
See the full report here: https://www.ghacks.net/2022/03/27/microsoft-releases-emergency-security-update-for-edge/
Western Digital fixes critical bug giving root on My Cloud NAS devices - BleepingComputer
Western Digital has patched a critical severity vulnerability that allowed attackers to gain root-level remote code execution on unpatched My Cloud OS 5 devices. This vulnerability is an out-of-bounds heap read/write (CVE-2021-44142) in the Samba vfs fruit VFS module. Unauthenticated threat actors can use it in low-complexity attacks against My Cloud devices running vulnerable firmware versions.
See the full report here: https://www.bleepingcomputer.com/news/security/western-digital-fixes-critical-bug-giving-root-on-my-cloud-nas-devices/
CISA adds 66 new flaws to the Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities Catalog with 66 new flaws. To protect their networks from attacks exploiting the flaws in the catalog, federal agencies must address the identified vulnerabilities by the deadline, April 15, 2022. Private organizations should also review the Catalog and address any vulnerabilities in their infrastructure, according to experts. With the most recent additions, the CISA Catalog now has 570 entries.
See the full report here: https://securityaffairs.co/wordpress/129502/hacking/cisa-known-exploited-vulnerabilities-catalog-66.html
Bengaluru: Nimhans sees ransomware attack; IT cell checks spread - Times of India
The premier mental health institute Nimhans in Bengaluru faced a cybersecurity threat following a ransomware attack earlier this week via malicious malware in an email accessed. Nimhans employees are provided with instructions to follow by its IT cell to prevent lateral spread followed by mitigations, but there is no clarity on the extent of damage caused. There are concerns about the leak of crucial patient data and functioning of the casualty department. Their website was reportedly inaccessible for three days as the servers were disconnected.
See the full report here: https://timesofindia.indiatimes.com/city/bengaluru/nimhans-sees-ransomware-attack-it-cell-checks-spread/articleshow/90467176.cms
Another Chinese Hacking Group Spotted Targeting Ukraine Amid Russia Invasion
The second China-based hacking group called Scarab has been linked to a custom backdoor dubbed HeaderTip as part of a campaign targeting Ukraine after Mustang Panda to capitalize on the conflict. This campaign outlining as a spear-phishing that leads to the delivery of a RAR archive file, which comes with an executable that's designed to open a decoy file while stealthily dropping a malicious DLL called HeaderTip in the background.
See the full report here: https://thehackernews.com/2022/03/another-chinese-hacking-group-spotted.html
Malware disguised as cryptocurrency wallets used to steal from iOS and Android users - Android Police
The influx of new investors on Cryptocurrency has given scammers a much larger field of victims to target through Android and iOS apps looked like legit crypto wallets, but they were carrying malware payloads and being distributed through sketchy websites to steal crypto. Eset has discovered dozens of such Android and iOS apps were able to steal the seed phrases of their unwitting victims, giving them access to their real wallets.
See the full report here: https://www.androidpolice.com/malware-cryptocurrency-wallets-steal-from-ios-and-android-users/
Critical Sophos Firewall vulnerability allows remote code execution - BleepingComputer
Sophos has fixed a critical remote code execution bug (CVE-2022-1040) affecting Sophos Firewall versions 18.5 MR3 (18.5.3) and earlier. Sophos had also resolved two high-severity vulnerabilities (CVE-2022-0386 and CVE-2022-0652) impacting Sophos UTM (Unified Threat Management) appliances, a few days ago.
See the full report here: https://www.bleepingcomputer.com/news/security/critical-sophos-firewall-vulnerability-allows-remote-code-execution/
Hive ransomware ports its Linux VMware ESXi encryptor to Rust - BleepingComputer
The Hive ransomware group has converted its VMware ESXi Linux encryptor to the Rust programming language. Also, the operation now requires the attacker to supply the user name and login password as a command-line argument when launching the malware – making it harder for security researchers to snoop on victim's ransom negotiations.
See the full report here: https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/
CISA warns orgs to patch actively exploited Chrome, Redis bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal civilian agencies to patch a Google Chome zero-day (CVE-2022-1096) and a critical Redis vulnerability (CVE-2022-0543) by April 18. The agency has added 30 more vulnerabilities to its Known Exploited Vulnerabilities Catalog.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-to-patch-actively-exploited-chrome-redis-bugs/
Windows 11 KB5011563 update fixes SMB, DirectX blue screens - BleepingComputer
As part of Microsoft's scheduled March 2022 monthly "C" updates, Microsoft has released the optional KB5011563 cumulative update preview for Windows 11. The updates contain fixes to stop errors triggering blue screens of death (BSOD) and other issues. The scheduled "C" non-security preview releases are optional and used to test bug fixes and performance improvements ahead of the general release.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5011563-update-fixes-smb-directx-blue-screens/
Hacked WordPress sites force visitors to DDoS Ukrainian targets - BleepingComputer
Security researchers have observed WordPress sites containing a malicious script that uses visitors' browsers to perform distributed denial-of-service (DDoS) attacks. Hackers are compromising such sites to conduct DDoS attacks on pro-Ukraine sites without the victims' knowledge (aside from possibly noticing their browser slowing down).
See the full report here: https://www.bleepingcomputer.com/news/security/hacked-wordpress-sites-force-visitors-to-ddos-ukrainian-targets/
Microsoft Exchange targeted for IcedID reply-chain hijacking attacks - BleepingComputer
Threat actors are abusing stolen email credentials to send phishing emails with malicious attachments, and thus distribute the IcedID malware. IcedID is a modular banking trojan mainly used to deploy second-stage malware, such as other loaders or ransomware.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-targeted-for-icedid-reply-chain-hijacking-attacks/
'Purple Fox' Hackers Spotted Using New Variant of FatalRAT in Recent Malware Attacks
The Purple Fox malware operation is now using a new variant of a remote access trojan called FatalRAT. The operaters distribute these trojanized software packages in the guise of legitimate application installers. The group is also trying to bypass detection mechanisms by targeting them with customized signed kernel drivers.
See the full report here: https://thehackernews.com/2022/03/purple-fox-hackers-spotted-using-new.html
Experts Detail Virtual Machine Used by Wslink Malware Loader for Obfuscation
Security researches have analysed the structure of an advanced multi-layered virtual machine (VM) used by the Wslink malware to evade detection. The strength of this obfuscation technique lies in the fact that the ISA (instruction set architecture) of the VM is unknown to any prospective reverse engineer.
See the full report here: https://thehackernews.com/2022/03/experts-detail-virtual-machine-used-by.html
Transparent Tribe APT returns to strike India's government and military
The Transparent Tribe advanced persistent threat (APT) group is deploying a fake version of Kavach, a multi-factor authentication (MFA) application, to target Indian government and military bodies. The legitimate Kavach app is reportedly widely used by India's military for accessing government resources.
See the full report here: https://www.zdnet.com/article/transparent-tribe-apt-returns-to-strike-indias-government-and-military/
Hackers Gaining Power of Subpoena Via Fake “Emergency Data Requests”
Hackers are using compromised police email systems to generate and send fake Emergency Data Requests (EDRs) to internet service providers, phone companies, and social media firms. The attackers, moreover, craft these fake requests with an urgent tone – possibly making it sound like a matter of life and death – to coerce target organisations to take action with less due diligence.
See the full report here: https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/
Europol dismantles massive call center investment scam operation - BleepingComputer
Europol has arrested 108 people linked to an international call center operation that duped victims – and thus generated an illicit income of up to €3,000,000 per month – with fake investment opportunities in cryptocurrency, commodities, and foreign currencies. The officials seized cash, luxury vehicles, and €95,000 in cryptocurrencies, and froze the group's bank accounts.
See the full report here: https://www.bleepingcomputer.com/news/security/europol-dismantles-massive-call-center-investment-scam-operation/
CISA warns of attacks targeting Internet-connected UPS devices - BleepingComputer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy has issued a joint advisory highlighting threat actors' use of internet-connected uninterruptible power supply (UPS) devices to conduct attacks, often through unchanged default usernames and passwords. The advisory recommended ways for organizations to mitigate attacks against such devices.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-attacks-targeting-internet-connected-ups-devices/
FBI warns election officials of credential phishing attacks - BleepingComputer
The Federal Bureau of Investigation (FBI) has warned U.S. election officials that compromised email accounts belonging to government officials and email addresses spoofing American businesses are being used to conduct a widespread phishing campaign. Officials in at least nine states received invoice-themed phishing emails containing links to websites intended to steal login credentials.
See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-election-officials-of-credential-phishing-attacks/
Shutterfly discloses data breach after Conti ransomware attack - BleepingComputer
Shutterfly has disclosed that its network was breached on December 3, 2021 in a Conti ransomware attack. Documents stolen during the attack may have contained employees' personal information, including names, salary, and compensation information. Shutterfly is offering two years of free credit monitoring from Equifax for those affected.
See the full report here: https://www.bleepingcomputer.com/news/security/shutterfly-discloses-data-breach-after-conti-ransomware-attack/
$620 million in crypto stolen from Axie Infinity's Ronin bridge - BleepingComputer
Possibly the largest cryptocurrency hack in history – worth about $620 million – took place on March 23, but it went unnoticed till yesterday. The hacker stole 173,600 ETH and 25.5 M USDC tokens from Axie Infinity's Ronin network bridge (an Ethereum sidechain). The bridge has been shut down for now as the incident is being investigated.
See the full report here: https://www.bleepingcomputer.com/news/cryptocurrency/620-million-in-crypto-stolen-from-axie-infinitys-ronin-bridge/
Critical SonicOS Vulnerability Affects SonicWall Firewall Appliances
SonicWall has released security updates for a critical flaw (CVE-2022-22274; CVSS score: 9.4) which could allow an unauthenticated, remote attacker to execute arbitrary code and cause a denial-of-service (DoS) condition. The bug affects 31 SonicWall Firewall devices running versions 7.0.1-5050 and earlier, 7.0.1-R579 and earlier, and 6.5.4.4-44v-21-1452 and earlier. The company stated that no evidence of proof-of-concept (PoC) or active exploitation of the bug has been found.
See the full report here: https://thehackernews.com/2022/03/critical-sonicos-vulnerability-affects.html
Log4JShell Used to Swarm VMware Servers with Miners, Backdoors
Security researchers have observed that the remote code execution Log4j vulnerability in the the Java logging library is still under active attack, particularly via cryptocurrency mining bots. Researchers also suspect that initial access brokers (IABs) are using the vulnerability to deliver backdoors, with the potential to conduct ransomware attacks in future.
See the full report here: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/
Wyze Cam flaw lets hackers remotely access your saved videos - BleepingComputer
A bug in Wyze Cam, the smart home security camera, allowed remote users to access the contents of the local memory card (SD card) without requiring authentication. Security updates have been released for Wyze Cam v2 and v3 to fix the bug.
See the full report here: https://www.bleepingcomputer.com/news/security/wyze-cam-flaw-lets-hackers-remotely-access-your-saved-videos/
New Malware Loader 'Verblecon' Infects Hacked PCs with Cryptocurrency Miners
A threat actor is using a sophisticated malware loader, "Verblecon," to install cryptocurrency miners on compromised systems and steal Discord tokens. However, the payload has polymorphic qualities to evade signature-based detections and can be used for more serious attacks, including ransomware and espionage.
See the full report here: https://thehackernews.com/2022/03/new-malware-loader-verblecon-infects.html
Electric Vehicle DC charging tripped by a wireless hack
Researchers have identified a vulnerability in the Combined Charging System of electric vehicles (EVs) that has the potential to abort charging. The team was able to abort the charging process from up to 10 meters away from the target with a power budget of 10mW. The Combined Charging System (CCS) is one of the standards in the EV charging world, and allows DC fast charging.
See the full report here: https://www.theregister.com/2022/03/30/brokenwire/
Mars Stealer malware pushed via OpenOffice ads on Google - BleepingComputer
A new Mars Stealer campaign is reportedly using Google Ads advertising to rank cloned OpenOffice sites high on Canadian search results. The OpenOffice installer on the fake site is, in reality, a Mars Stealer executable packed with the Babadeda crypter or the Autoit loader.
See the full report here: https://www.bleepingcomputer.com/news/security/mars-stealer-malware-pushed-via-openoffice-ads-on-google/
Hive ransomware uses new 'IPfuscation' trick to hide payload - BleepingComputer
The Hive ransomware gang is using a new obfuscation technique to hide the malicious nature of their code from security software and evade detection. This technique involves IPv4 addresses and a series of conversions that eventually lead to downloading a Cobalt Strike beacon.
See the full report here: https://www.bleepingcomputer.com/news/security/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload/
Globant confirms hack after Lapsus$ leaks 70GB of stolen data - BleepingComputer
Globant, an IT and software consultancy firm, has issued a press release confirming that some of the company source code has been exposed to an unauthorized party, after being breached by the Lapsus$ group. The company stated that the intruder on its systems accessed certain source code and project-related documentation for a very limited number of clients.
See the full report here: https://www.bleepingcomputer.com/news/security/globant-confirms-hack-after-lapsus-leaks-70gb-of-stolen-data/
FBI disrupts BEC cybercrime gangs targeting victims worldwide - BleepingComputer
A three-month-long operation called "Eagle Sweep" – aimed to tackle business email compromise (BEC) schemes – has led to the arrest of 65 suspects in the United States, Nigeria, South Africa, Cambodia, and Canada. BEC actors financially dupe employees of companies by pretending to be a business partner or a firm submitting a legitimate payment order.
See the full report here: https://www.bleepingcomputer.com/news/legal/fbi-disrupts-bec-cybercrime-gangs-targeting-victims-worldwide/
US national emergency extended due to elevated malicious cyber activity - BleepingComputer
The U.S. government extended the state of national emergency (declared on April 1, 2015) to deal with severe cyber threats to the country's national security, foreign policy, and economy. Such threats include critical infrastructure breaches, denial of service attacks, and data theft incidents.
See the full report here: https://www.bleepingcomputer.com/news/security/us-national-emergency-extended-due-to-elevated-malicious-cyber-activity/
Google: Russian phishing attacks target NATO, European military - BleepingComputer
A report by the Google Threat Analysis Group (TAG) highlighted credential phishing attacks coordinated by a Russian-based threat group (COLDRIVER) against a NATO Center of Excellence and Eastern European militaries. A group linked to China was also observed targeting government and military organizations from Ukraine, Russia, Kazakhstan, and Mongolia.
See the full report here: https://www.bleepingcomputer.com/news/security/google-russian-phishing-attacks-target-nato-european-military/
Tags: weekly bulletin, all industries, global