Threat Intelligence Bulletin: 04/01/2022 - 04/07/2022
|by Alpha Team
Flash Report: Spring4Shell
TLP: WHITE
In this briefing, ZeroFox Intelligence provides information on Spring4Shell (CVE-2022-22965), a vulnerability within the Spring Core Framework that could enable remote code execution.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecra in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 9:00 AM (EDT) on April 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Key Findings
- A zero-day vulnerability dubbed “Spring4Shell” enables remote code execution in the Spring Core Framework.
- The vulnerability impacts Spring Model-View-Controller (MVC) and Spring WebFlux applications running with certain configurations.
- The vulnerability, now tracked as CVE-2022-22965, is caused by unsafe deserialization of passed arguments.
- Patches have been released to address vulnerabilities in versions of Spring Framework (5.3.18 and 5.2.20) and Spring Boot (2.5.12 and 2.6.6)
Russia-Ukraine Conflict: Situational Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
View the full brief here.
Executive Summary
Russia’s withdrawal from the Kyiv outskirts revealed significant destruction to the surrounding towns, including hundreds of dead civilians found in Bucha, Irpin, and Borodyanka. Western leaders responded by introducing new sanctions to target Russian banks and the family of top Russian officials. The Russian military is shifting forces to southeast, where its effort will focus on conquering the Donetsk and Luhansk regions. Mariupol continues to hold out against the ongoing Russian siege, but the coast is blockaded by the Russian Black Sea Fleet, and Ukrainian forces cannot be resupplied.
Breaking News: 2022-04-01 - 2022-04-07
Apple Issues Patches for 2 Actively Exploited Zero-Days in iPhone, iPad and Mac Devices
Apple has released emergency patches for two zero-day flaws in its mobile and desktop operating systems that may have been exploited in the wild. One of the bugs is an out-of-bounds write vulnerability in AppleAVD that could allow an application to execute arbitrary code with kernel privileges. Another patched bug relates to an out-of-bounds read issue in the Intel Graphics Driver module, enabling a malicious actor to read kernel memory.
See the full report here: https://thehackernews.com/2022/03/apple-issues-patches-for-2-actively.html
CISA orders agencies to patch actively exploited Sophos firewall bug - BleepingComputer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has advised federal civilian agencies to patch a critical Sophos firewall bug (CVE-2022-1040) and seven other vulnerabilities by April 21. These bugs are being exploited in ongoing attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-actively-exploited-sophos-firewall-bug/
Vulnerabilities in Rockwell Automation PLCs Could Enable Stuxnet-Like Attacks
Security researchers have observed two serious vulnerabilities – CVE-2022-1161 and CVE-2022-1159 – in Rockwell Automation's programmable logic controller (PLC) platform. These bugs can give attackers a way to modify automation processes and potentially disrupt industrial operations, cause physical damage to factories, or take other malicious actions. Rockwell Automation has published advisories on the two flaws for its customers.
See the full report here: https://www.darkreading.com/vulnerabilities-threats/vulnerabilities-in-rockwell-automation-plcs-could-enable-stuxnet-like-attacks
Zyxel patches critical bug affecting firewall and VPN devices - BleepingComputer
Network equipment company Zyxel has released patches for a critical-severity vulnerability (CVE-2022-0342) that could give attackers administrator-level access to affected devices. There is no evidence of active exploitation of these bugs in attacks; however, users should install the firmware updates for optimal protection.
See the full report here: https://www.bleepingcomputer.com/news/security/zyxel-patches-critical-bug-affecting-firewall-and-vpn-devices/
QNAP Customers Adrift, Waiting on Fix for OpenSSL Bug
QNAP had warned its clients that a recently disclosed vulnerability (CVE-2022-0778; CVSS score: 7.5) affects most of its network-attached storage (NAS) devices. However, there is no mitigation available as the company has not released a patch yet. This OpenSSL vulnerability can trigger an infinite loop that creates a denial-of-service (DoS) scenario.
See the full report here: https://threatpost.com/qnap-customers-adrift-fix-openssl-bug/179197/
Calendly actively abused in Microsoft credentials phishing - BleepingComputer
Calendly – a popular calendar app used for scheduling meetings and appointments – is being used to initiate phishing attacks. The campaign involves asking the victim to enter Microsoft SharePoint credentials to view Calendly-hosted content, leading to harvesting of the credentials.
See the full report here: https://www.bleepingcomputer.com/news/security/calendly-actively-abused-in-microsoft-credentials-phishing/
New Python-based Ransomware Targeting JupyterLab Web Notebooks
Security researchers have observed the first-ever Python-based ransomware strain specifically designed to target exposed Jupyter notebooks. The ransomware sample was observed via a honeypot server and did not leave a ransom note.
See the full report here: https://thehackernews.com/2022/03/new-python-based-ransomware-targeting.html
Palo Alto Networks error exposed customer support cases, attachments - BleepingComputer
A bug in the support dashboard of Palo Alto Networks has reportedly exposed thousands of customer support tickets to an unauthorized individual. The exposed information included names and contact information of the person creating support tickets, as well as conversations between Palo Alto Networks staff members and the customer.
See the full report here: https://www.bleepingcomputer.com/news/security/palo-alto-networks-error-exposed-customer-support-cases-attachments/
Nvidia DGX systems prone to side channel, covert attacks
Security researchers have observed that Nvidia's ultra-dense GPU-driven AI training and inference systems are prone to covert and side channel attacks. The issue is more significant for pre-Ampere GPU generation DGX machines.
See the full report here: https://www.theregister.com/2022/03/31/dgx-security-attack-vulnerability/
Chinese hacking group uses new 'Fire Chili' Windows rootkit - BleepingComputer
The Chinese hacking group Deep Panda is targeting VMware Horizon servers with the Log4Shell exploit to deploy a new rootkit named "Fire Chili." The rootkit is signed by valid digital certificates, allowing it to bypass detection by security software and load into Windows without any warnings.
See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hacking-group-uses-new-fire-chili-windows-rootkit/
New BlackGuard password-stealing malware sold on hacker forums - BleepingComputer
Hacker forums are being used to sell BlackGuard – a new information-stealing malware that can snatch sensitive information from a broad range of applications, pack everything in a ZIP archive and send it to the C2 (command and control infrastructure) of the malware-as-a-service (MaaS) operation. Blackguard is rapidly gaining popularity, especially after the shutdown of Raccoon Stealer.
See the full report here: https://www.bleepingcomputer.com/news/security/new-blackguard-password-stealing-malware-sold-on-hacker-forums/
Viasat confirms satellite modems were wiped with AcidRain malware - BleepingComputer
Viasat – the communications company providing satellite broadband services – confirmed that a type of data destroying malware (dubbed AcidRain) was deployed on modems using legitimate management commands. AcidRain is designed to brute-force device file names and wipe every file it can find, making it easy to redeploy in future attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/viasat-confirms-satellite-modems-were-wiped-with-acidrain-malware/
Spring patches leaked Spring4Shell zero-day RCE vulnerability
Spring has released emergency updates to fix "Spring4Shell" – a zero-day remote code execution (RCE) vulnerability – which has publicly available exploit code. The bug (CVE-2022-22965) affects Spring MVC and Spring WebFlux applications on JDK 9.
See the full report here: https://www.bleepingcomputer.com/news/security/spring-patches-leaked-spring4shell-zero-day-rce-vulnerability/
Phishing uses Azure Static Web Pages to impersonate Microsoft
Threat actors are using Microsoft Azure Static Web Apps' custom branding and web hosting features to host static landing phishing pages. These pages are then used to steal Microsoft, Office 365, Outlook, and OneDrive credentials from victims.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/phishing-uses-azure-static-web-pages-to-impersonate-microsoft/
Russian-linked Android malware records audio, tracks your location - BleepingComputer
A previously unknown Android malware has been linked to the Turla hacking group after discovering the app used infrastructure previously attributed to the threat actors. Turla is a Russian state-supported hacking group known for using custom malware to target European and American systems, primarily for espionage.
See the full report here: https://www.bleepingcomputer.com/news/security/russian-linked-android-malware-records-audio-tracks-your-location/
DPRK hackers go after crypto assets using trojanized DeFi Wallet app - BleepingComputer
Hackers associated with the North Korean government have been distributing a trojanized version of the DeFi Wallet for storing cryptocurrency assets to gain access to the systems of cryptocurrency users and investors. The threat actor relied in this attack on web servers located in South Korea to push the malware and to communicate with the installed implants.
See the full report here: https://www.bleepingcomputer.com/news/security/dprk-hackers-go-after-crypto-assets-using-trojanized-defi-wallet/
Sitel on Okta breach: "spreadsheet" did not contain passwords - BleepingComputer
Okta's outsourced provider of support services, Sitel (Sykes) has shared more information this week in response to the leaked documents that detailed the various incident response tasks carried out by Sitel after the Lapsus$ hack. The documents, leaked by a researcher online, perpetuated the myth that Sitel stored its domain admin passwords extracted from LastPass in an Excel spreadsheet, a claim now dispelled by Sitel.
See the full report here: https://www.bleepingcomputer.com/news/security/sitel-on-okta-breach-spreadsheet-did-not-contain-passwords/
Zyxel urges customers to patch critical firewall bypass vulnerability
Zyxel is urging customers to immediately patch a critical vulnerability in the vendor's firewall software. In a security advisory published this week, the Taiwanese networking giant said the security flaw can lead to the circumvention of firewall protection in Zyxel USG, ZyWALL, FLEX, ATP, VPN, and NSG product lines. Tracked as CVE-2022-0342 and issued a critical severity score of 9.8, the vulnerability is described as an authentication bypass caused by a proper access control mechanism failure.
See the full report here: https://www.zdnet.com/article/zyxel-urges-customers-to-patch-critical-firewall-bypass-vulnerability/
Critical GitLab vulnerability lets attackers take over accounts - BleepingComputer
GitLab has addressed a critical severity vulnerability that could allow remote attackers to take over user accounts using hardcoded passwords. The bug (discovered internally and tracked as CVE-2022-1162) affects both GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw results from static passwords accidentally set during OmniAuth-based registration in GitLab CE/EE.
See the full report here: https://www.bleepingcomputer.com/news/security/critical-gitlab-vulnerability-lets-attackers-take-over-accounts/
Trend Micro fixes actively exploited remote code execution bug - BleepingComputer
Japanese cybersecurity software firm Trend Micro has patched a high severity security flaw in the Apex Central product management console that can let attackers execute arbitrary code remotely. The vulnerability (CVE-2022-26871) is a high severity arbitrary file upload weakness in the file handling module that unauthenticated attackers can abuse for remote code execution.
See the full report here: https://www.bleepingcomputer.com/news/security/trend-micro-fixes-actively-exploited-remote-code-execution-bug/
Beastmode botnet boosts DDoS power with new router exploits - BleepingComputer
A Mirai-based distributed denial-of-service (DDoS) botnet tracked as Beastmode (aka B3astmode) has updated its list of exploits to include several new ones, three of them targeting various models of Totolink routers. Totolink is a popular electronics sub-brand belonging to Zioncom that recently released firmware updates to fix three critical-severity vulnerabilities. By taking control of the vulnerable routers, Beastmode has access to hardware resources that allow it to launch DDoS attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/beastmode-botnet-boosts-ddos-power-with-new-router-exploits/
Anonymous leaked 15 GB of data allegedly stolen from the Russian Orthodox Church
Anonymous leaked 15GB of data stolen from the Russian Orthodox Church's charitable wing & released roughly 57,500 emails. Anonymous continues to target Russian government entities and private businesses, this week the group claimed to have hacked the private firms Thozis Corp and Marathon Group owned by oligarchs.
See the full report here: https://securityaffairs.co/wordpress/129760/hacktivism/anonymous-hacked-russian-orthodox-church.html
New Hacking Campaign by Transparent Tribe Hackers Targeting Indian Officials - The Hacker News
Transparent Tribe, a highly active APT group likely a Pakistani origin has been attributed to yet another campaign designed to backdoor targets of interest with a Windows-based remote access trojan named CrimsonRAT. Their primary targets have been government and military personnel in Afghanistan and India. The latest attacks involves making use of fake domains that mimic legitimate government and related organizations to deliver the malicious payloads to run arbitrary code on the infected system.
See the full report here: https://thehackernews.com/2022/03/new-hacking-campaign-by-transparent.html
UK charges two teenagers linked to the Lapsus$ hacking group
A 16-year-old and a 17-year-old teenagers from the UK were charged with helping the Lapsus$ extortion gang have been released on bail after appearing in the Highbury Corner Magistrates Court. As a result of Lapsus$ being on the radar of international law enforcement since they attacked high-profile tech companies worldwide, seven people aged 16 to 21 believed to be connected to the gang were arrested by the City of London Police last week. While it's still unclear how many active members the gang has and what roles each of them plays.
See the full report here: https://www.bleepingcomputer.com/news/security/uk-charges-two-teenagers-linked-to-the-lapsus-hacking-group/
Trezor wallets hacked? Don’t be duped by phishing attack email
A phishing email, impersonating Trezor sent to their customers claiming that Trezor has been making physical USB-like devices to protect the cryptocurrency and tokens of users, which results in security incident that breached the data of 106.856 of its customers. Trezor is an hardware wallet used to manage & trade cryptocurrencies. Since Trezor couldn’t assess the scope of the data breach, a recent wallet accessed using Trezor Suite, must results in their cryptocurrency assets are at risk of being stolen.
See the full report here: https://grahamcluley.com/trezor-wallets-hacked-dont-be-duped-by-phishing-attack-email/
CYBERSECURITY: US claims South Africa targeted in Russia's global hack attack campaigns - Daily Maverick
South Africa has emerged as one of about 135 countries targeted by Russian government employees as part of two massive hacking campaigns aimed at disrupting energy companies and critical infrastructure, according to the US. According to the Federal Bureau of Investigation (FBI) in the United States, this access would allow the Russian government to disrupt and damage such systems, if it so desired.
See the full report here: https://www.dailymaverick.co.za/article/2022-04-03-us-claims-south-africa-targeted-in-russias-global-hack-attack-campaigns/
Employment scams mostly targeting college students, company finds
According to a recently published Proofpoint report, college students and recent graduates are primarily targeted with fake job offers from employers who cater to younger audiences. Scammers use university email addresses to target current college students and recent graduates. T hreat actors lure users to share personal information by posing as job applicants or modelling contracts and spoofing employer or university career centre emails.
See the full report here: https://edscoop.com/employment-scams-mostly-targeting-college-students-company-finds/
New spear phishing campaign targets Russian dissidents
The Malwarebytes Threat Intelligence team has observed geopolitical conflict-related activity. They recently discovered a new campaign aimed at Russian citizens and government entities. Based on the analyzed email samples, the threat actor is most likely targeting people who oppose the Russian government. The spear phishing emails warn recipients that they will face criminal charges if they use websites, social networks, instant messengers, or VPN services that have been banned by the Russian government. To learn more, victims are enticed to open a malicious attachment or link, only to become infected with Cobalt Strike.
See the full report here: https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/
15-Year-Old Bug in PEAR PHP Repository Could've Enabled Supply Chain Attacks
A 15-year-old security vulnerability has been disclosed in the PEAR PHP repository, which could permit an attacker to carry out a supply chain attack, including obtaining unauthorized access to publish rogue packages and execute arbitrary code. PEAR, short for PHP Extension and Application Repository, is a framework and distribution system for reusable PHP components.
See the full report here: https://thehackernews.com/2022/04/15-year-old-bug-in-pear-php-repository.html
Newly found Android malware records audio, tracks your location - BleepingComputer
Security researchers have identified a malicious APK named “Process Manager” that acts as Android spyware, uploading information to the threat actors. Once installed, it attempts to hide using a gear-shaped icon, pretending to be a system component.
See the full report here: https://www.bleepingcomputer.com/news/security/newly-found-android-malware-records-audio-tracks-your-location/
New Borat remote access malware is no laughing matter - BleepingComputer
A remote access trojan (RAT) named Borat lets its operators choose their compilation options to create small payloads that feature precisely what they need for highly tailored attacks. It allows remote threat actors to take complete control of victim’s mouse and keyboard, access files and network points, and hide any signs of their presence.
See the full report here: https://www.bleepingcomputer.com/news/security/new-borat-remote-access-malware-is-no-laughing-matter/
Emma Sleep Company admits checkout cyber attack
Emma Sleep Company has confirmed that it suffered a Magecart attack, which enabled the attackers to skim customers' credit or debit card data from its website. The company stated that the attack was highly targeted and affected customers in 12 countries.
See the full report here: https://www.theregister.com/2022/04/04/emma_the_sleep_company_admits/
Mailchimp: Crook stole cryptocurrency clients' mailing-list subscriber info
Mailchimp has confirmed that an unauthorized person gained access to one of its internal tools and used it to steal data belonging to 100-plus high-value customers in cryptocurrency and finance-related industries. It is suspected that this incident is linked to the recent phishing attack on customers of Trezor, a cryptocurrency hardware-wallet maker.
See the full report here: https://www.theregister.com/2022/04/05/mailchimp_confirms_breach/
WhatsApp voice message phishing emails push info-stealing malware - BleepingComputer
Security researchers have discovered a new WhatsApp-based phishing campaign involving a sender acting as a "Whatsapp Notifier" service. Because the campaign uses an (likely compromised) email address belonging to the Center for Road Safety of the Moscow Region, security solutions don't flag or block the messages.
See the full report here: https://www.bleepingcomputer.com/news/security/whatsapp-voice-message-phishing-emails-push-info-stealing-malware/
FIN7 hackers evolve toolset, work with multiple ransomware gangs - BleepingComputer
Security researchers have published a new set of indicators of compromise relating to the Russian-speaking financially motivated threat actor group FIN7 (a.k.a. Carbanak). The researchers have also found evidence of FIN7 intrusions detected right before incidents with ransomware like Maze, Ryuk, Darkside, and BlackCat/ALPHV.
See the full report here: https://www.bleepingcomputer.com/news/security/fin7-hackers-evolve-toolset-work-with-multiple-ransomware-gangs/
VMware patches Spring4Shell RCE flaw in multiple products - BleepingComputer
VMware has published security updates for the critical remote code execution vulnerability tracked as CVE-2022-22965 (also known as Spring4Shell). Where a fix is not available, VMware released a workaround as a temporary solution.
See the full report here: https://www.bleepingcomputer.com/news/security/vmware-patches-spring4shell-rce-flaw-in-multiple-products/
Establishment of the Bureau of Cyberspace and Digital Policy - United States Department of State
The Bureau of Cyberspace and Digital Policy (CDP), established by the U.S. Department of State, has commenced operations. The bureau includes three policy units: International Cyberspace Security, International Information and Communications Policy, and Digital Freedom.
See the full report here: https://www.state.gov/establishment-of-the-bureau-of-cyberspace-and-digital-policy/
CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the recently disclosed vulnerability affecting the Spring Framework (CVE-2022-22965) to its Known Exploited Vulnerabilities Catalog. The agency also added to the catalog two zero-day flaws patched by Apple last week (CVE-2022-22674 and CVE-2022-22675) and a critical bug in D-Link routers (CVE-2021-45382) that has been actively weaponized by the Beastmode Mirai-based DDoS campaign.
See the full report here: https://thehackernews.com/2022/04/cisa-warns-of-active-exploitation-of.html
Ukraine spots Russian-linked 'Armageddon' phishing attacks - BleepingComputer
The Russian threat group Armageddon (Gamaredon) is reportedly sending phishing emails on the topic “Information on war criminals of the Russian Federation” to various government agencies in Ukraine. The goal is to infect the victims' systems with espionage-focused malware.
See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-spots-russian-linked-armageddon-phishing-attacks/
Cash App notifies 8.2 million US customers about data breach - BleepingComputer
Cash App has informed its 8.2 million current and former U.S. customers of a data breach that included customers' full names, brokerage account numbers, portfolio values, and holdings. The breach occurred on December 10, 2021, after a former employee downloaded internal Cash App reports.
See the full report here: https://www.bleepingcomputer.com/news/security/cash-app-notifies-82-million-us-customers-about-data-breach/
Australia warns of money recovery phishing luring past victims - BleepingComputer
Scammers are approaching past victims of scams – posing as a money recovery firm, law office, or government task force that helps with the recovery of previously stolen funds – and stealing their money, personal details, and other sensitive data.
See the full report here: https://www.bleepingcomputer.com/news/security/australia-warns-of-money-recovery-phishing-luring-past-victims/
Intel shuts down all business operations in Russia - BleepingComputer
Intel is shutting down all business operations in Russia, a month after its decision to suspend all shipments to customers in Russia and Belarus. The company stated that it is working on supporting all of its Russian employees during the shutdown and have implemented business continuity plans to minimize disruption.
See the full report here: https://www.bleepingcomputer.com/news/technology/intel-shuts-down-all-business-operations-in-russia/
Feds slay dark-web souk Hydra: Servers and $25m in crypto-coins seized
German federal police, in coordination with U.S. law enforcement, seized Hydra servers and cryptocurrency wallets containing $25 million in BTC, thus shutting down the online marketplace. Hydra was the longest-running known dark-web marketplace, trafficking in illegal drugs and money-laundering services.
See the full report here: https://www.theregister.com/2022/04/05/us_germany_hydra/
Researchers Trace Widespread Espionage Attacks Back to Chinese 'Cicada' Hackers
A Chinese advanced persistent threat group Cicada (or APT10) is engaging in espionage campaigns on government, legal, religious, and non-governmental organizations in various countries. This group was previously focused on Japan, but its victim list now includes entities in the U.S., Canada, Hong Kong, Turkey, Israel, India, Montenegro, and Italy as well.
See the full report here: https://thehackernews.com/2022/04/researchers-trace-widespread-espionage.html
Microsoft detects Spring4Shell attacks across its cloud services
Microsoft is observing ongoing attacks deploying Spring4Shell (CVE-2022-22965) exploits against its cloud infrastructure. The company stated that any system using JDK 9.0 or later and using the Spring Framework or derivative frameworks should be considered vulnerable.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-detects-spring4shell-attacks-across-its-cloud-services/
Ukraine Warns of Cyber attack Aiming to Hack Users' Telegram Messenger Accounts
Criminals are reportedly sending messages with malicious links to Ukrainian people, in order to gain unauthorized access to the their Telegram accounts, including the possibility to transfer a one-time code from SMS. The attacks originate with Telegram messages alerting recipients that a login had been detected from a new device located in Russia.
See the full report here: https://thehackernews.com/2022/04/ukraine-warns-of-cyber-attack-aiming-to.html
Hackers Distributing Fake Shopping Apps to Steal Banking Data of Malaysian Users
Hackers are setting up fraudulent but legitimate-looking websites to trick users into downloading the apps, with the goal to steal banking data from people. The campaign has impersonated cleaning services such as Maid4u, Grabmaid, Maria's Cleaning, Maid4u, YourMaid, Maideasy and MaidACall and a pet store named PetsMore.
See the full report here: https://thehackernews.com/2022/04/hackers-distributing-fake-shopping-apps.html
UK retail chain The Works shuts down stores after cyberattack - BleepingComputer
UK retail chain The Works was forced to shut down several stores due to issues caused by a cybersecurity incident involving unauthorized access to its computer systems. The attack had reportedly affected replenishment deliveries, extended online order fulfillment times, and compromised the safety of payments.
See the full report here: https://www.bleepingcomputer.com/news/security/uk-retail-chain-the-works-shuts-down-stores-after-cyberattack/
New FFDroider malware steals Facebook, Instagram, Twitter accounts - BleepingComputer
A new information stealer – FFDroider – is stealing credentials and cookies stored in browsers. The attackers are focusing on stealing credentials for social media accounts and eCommerce sites, including Facebook, Instagram, Amazon, eBay, Etsy, Twitter, and the portal for the WAX Cloud wallet.
See the full report here: https://www.bleepingcomputer.com/news/security/new-ffdroider-malware-steals-facebook-instagram-twitter-accounts/
Israeli officials are being catfished by AridViper hackers
AridViper (also known as APT-C-23, Desert Falcon, and Two-tailed Scorpion) is reportedly targeting high-ranking Israeli officials in a new cyberespionage campaign. The campaign – Operation Bearded Barbie – targets select Israeli individuals to compromise their PCs and mobile devices, spy on their activities, and steal sensitive data.
See the full report here: https://www.zdnet.com/article/israeli-officials-are-being-spied-on-by-aridviper-hackers/
Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group | Recorded Future
Network intrusions have been spotted in at least 7 Indian power distribution centres. All of them are located in North India, in proximity to the disputed India-China border in Ladakh.
See the full report here: https://www.recordedfuture.com/continued-targeting-of-indian-power-grid-assets/
Beware Ukraine-themed fundraising scams
An average of 315 new Ukraine themed domains have been observed per day since February 24. 77% of these domains appear to be suspicious based on early indicators.
See the full report here: https://blog.malwarebytes.com/scams/2022/04/beware-ukraine-themed-fundraising-scams/
Tags: weekly bulletin, all industries, global