Threat Intelligence Bulletin: 04/15/2022 - 04/21/2022

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-04-21a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on April 21, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The Russian battleship Moskva sank in the Black Sea one week ago, but Russia has not released any casualty figures and continues to suppress information about the disaster. U.S. President Joseph Biden confirmed on April 21, 2022, that the U.S. was putting together another military and humanitarian aid package for Ukraine worth approximately USD 1.3 billion. Russia’s offensive in the Donbas began with heavy air and artillery bombardment on the frontline, but with limited progress by its forces on the ground. Mariupol’s last defenders and an estimated 1,000 civilians are trapped inside the Azovstal steel factory, the last point of Ukrainian control in the city, while Russian President Vladimir Putin has already declared Mariupol’s “liberation”.

The Underground Economist: Volume 2, Issue 1

Welcome back to The Underground Economist, Volume 2, Issue 1, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of February 4, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 2

Welcome back to The Underground Economist, Volume 2, Issue 2, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of February 18, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 3

Welcome back to The Underground Economist, Volume 2, Issue 3, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of March 4, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 4

Welcome back to The Underground Economist, Volume 2, Issue 4, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of March 18, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 5

Welcome back to The Underground Economist, Volume 2, Issue 5, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of April 1, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 6

Welcome back to The Underground Economist, Volume 2, Issue 6, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of April 15, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Breaking News: 2022-04-15 - 2022-04-21

Critical Auth Bypass Bug Reported in Cisco Wireless LAN Controller Software

Cisco has released patches to contain a critical security vulnerability (CVE-2022-20695; CVSS score of 10) affecting the Wireless LAN Controller (WLC). The bug could be abused by an unauthenticated, remote attacker to take control of an affected system.

See the full report here: https://thehackernews.com/2022/04/critical-auth-bypass-bug-reported-in.html

Google Releases Urgent Chrome Update to Patch Actively Exploited Zero-Day Flaw

Google has issued emergency patches to address two security bugs in its Chrome web browser, one of which (CVE-2022-1364) is being actively exploited in the wild. Users are recommended to update to version 100.0.4896.127 for Windows, Mac and Linux to thwart potential threats.

See the full report here: https://thehackernews.com/2022/04/google-releases-urgent-chrome-update-to.html

Hackers target Ukrainian govt with IcedID malware, Zimbra exploits - BleepingComputer

Hackers are targeting Ukrainian government agencies with new attacks exploiting Zimbra exploits and phishing attacks pushing the IcedID malware. The Computer Emergency Response Team of Ukraine (CERT-UA) attributed the IcedID phishing attack to the UAC-0041 threat cluster, previously connected with AgentTesla distribution.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-ukrainian-govt-with-icedid-malware-zimbra-exploits/

Hetzner lost customer data and gave 20€ as compensation - BleepingComputer

Hetzner Online GmbH, a German cloud services provider, suffered a rare occurrence of multiple hardware failures that have wiped some customers' snapshots, with no way of recovering them. The company reportedly told some customers this week that their data had been irreversibly lost and provided them 20€ compensation in online credit.

See the full report here: https://www.bleepingcomputer.com/news/security/hetzner-lost-customer-data-and-gave-20-as-compensation/

Atlassian finally explains the cause of ongoing cloud outage - BleepingComputer

Atlassian has disclosed how hundreds of customer sites were deleted accidentally, triggering a weeks-long incident the company is still working to address. The outage resulted from communication issues between two Atlassian teams who were working on deactivating the standalone legacy "Insight – Asset Management" app.

See the full report here: https://www.bleepingcomputer.com/news/technology/atlassian-finally-explains-the-cause-of-ongoing-cloud-outage/

FBI: Payment app users targeted in social engineering attacks - BleepingComputer

The FBI has warned American users of digital payment apps of social engineering attacks using fake bank fraud alerts. The attackers call victims who respond to their phishing messages from phone numbers spoofing the banks' legitimate 1-800 support number.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-payment-app-users-targeted-in-social-engineering-attacks/

Wind turbine firm Nordex hit by Conti ransomware attack - BleepingComputer

Nordex – a developer and manufacturer of wind turbines – had recently suffered a cyberattack, and the company had shut down its IT systems to prevent its spread. The Conti ransomware operation has now claimed responsibility for the cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/wind-turbine-firm-nordex-hit-by-conti-ransomware-attack/

CISA orders agencies to fix actively exploited VMware, Chrome bugs - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has added nine more security flaws to its list of actively exploited bugs, including a VMware privilege escalation flaw (CVE-2022-22960) and a Google Chrome zero-day (CVE-2022-1364) that could be used for remote code execution. All Federal Civilian Executive Branch Agencies (FCEB) need to mitigate the flaws by May 6, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-fix-actively-exploited-vmware-chrome-bugs/

'Mute' button in conferencing apps may not actually mute your mic - BleepingComputer

Researchers have observed that pressing mute on video conferencing apps does not prevent audio from being transmitted to the apps' servers, either continually or periodically. The apps tested in this phase of the study were Zoom, Slack, MS Teams/Skype, Google Meet, Cisco Webex, BlueJeans, WhereBy, GoToMeeting, Jitsi Meet, and Discord.

See the full report here: https://www.bleepingcomputer.com/news/security/mute-button-in-conferencing-apps-may-not-actually-mute-your-mic/

T-Mobile customers warned of unblockable SMS phishing attacks - BleepingComputer

An ongoing phishing campaign targets T-Mobile customers with malicious links using unblockable texts sent via SMS group messages. To defend against ongoing "smishing" attacks, people should avoid clicking any links received from unknown contacts via text message.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-customers-warned-of-unblockable-sms-phishing-attacks/

Feds offer $5m reward for info on North Korean cyber crooks

The U.S. State Department has announced a reward up to $5 million for information that leads to the disruption of financial mechanisms of people engaged in supporting North Korea via money laundering, exportation of luxury goods to North Korea, specified cyber-activity and actions that support WMD proliferation.

See the full report here: https://www.theregister.com/2022/04/15/feds_north_korea_bounty/

GitHub Says Hackers Breached Dozens of Organizations Using Stolen OAuth Access Tokens

GitHub has revealed that an attacker abused stolen OAuth user tokens to download data from dozens of organizations, including NPM. OAuth access tokens are used to authorize access to specific parts of a user's data and communicate without having to share the actual credentials.

See the full report here: https://thehackernews.com/2022/04/github-says-hackers-breach-dozens-of.html

Karakurt revealed as data extortion arm of Conti cybercrime syndicate

Security researchers have discovered a connection between Conti ransomware and the recently emerged Karakurt data extortion group. Karakurt is a gang active since at least June 2021 that focuses on stealing data from companies and forcing them into paying a ransom by threatening to publish the information.

See the full report here: https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/

New Industrial Spy stolen data market promoted through cracks, adware

A new stolen data marketplace has been launched, called Industrial Spy. Industrial Spy promotes itself as a marketplace where businesses can purchase their competitors' data to gain access to trade secrets, manufacturing diagrams, accounting reports, and client databases.

See the full report here: https://www.bleepingcomputer.com/news/security/new-industrial-spy-stolen-data-market-promoted-through-cracks-adware/

Researchers Share In-Depth Analysis of PYSA Ransomware Group

Security reseachers have analyzed the functioning of the PYSA ransomware operation, which attacks the government, healthcare, and educational sectors in the U.S. and Europe. The group is known to carefully research high-value targets before launching its attacks, compromising enterprise systems and forcing organizations to pay large ransoms to restore their data.

See the full report here: https://thehackernews.com/2022/04/researchers-share-in-depth-analysis-of.html

Unofficial Windows 11 upgrade installs info-stealing malware - BleepingComputer

A malicious website, featuring the official Microsoft logos, favicons, and a “Download Now” button, is offering fake updates to Windows 11. The campaign infects victims' systems with malware that steals browser data and cryptocurrency wallets.

See the full report here: https://www.bleepingcomputer.com/news/security/unofficial-windows-11-upgrade-installs-info-stealing-malware/

Hackers steal $655K after picking MetaMask seed from iCloud backup - BleepingComputer

Users are advised to exclude MetaMask from iCloud backups via Settings > Profile > iCloud > Manage Storage > Backups. The advisory comes after a MetaMask user lost over $655k as a result of a phishing attack.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-655k-after-picking-metamask-seed-from-icloud-backup/

Free decryptor released for Yanluowang ransomware victims - BleepingComputer

The Rannoh decryption tool can now be used for decrypting files locked by the Yanluowang ransomware strain. Kaspersky was able to provide this functionality after it found a vulnerability in Yanluowang ransomware's encryption algorithm.

See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-yanluowang-ransomware-victims/

US warns of Lazarus hackers using malicious cryptocurrency apps - BleepingComputer

The North Korean hacking group, Lazarus, is targeting organizations in the cryptocurrency and blockchain industries with trojanized cryptocurrency applications. Intrusions begin with spearphishing messages sent to employees of cryptocurrency companies.

See the full report here: https://www.bleepingcomputer.com/news/security/us-warns-of-lazarus-hackers-using-malicious-cryptocurrency-apps/

Newly found zero-click iPhone exploit used in NSO spyware attacks - BleepingComputer

Security researchers have discovered a new zero-click iMessage exploit that was used to install NSO Group spyware on targeted iPhones. This iOS zero-click security flaw (HOMAGE) affects some versions before iOS 13.2.

See the full report here: https://www.bleepingcomputer.com/news/security/newly-found-zero-click-iphone-exploit-used-in-nso-spyware-attacks/

Okta says Lapsus$ breach hit just two customers

Okta has disclosed that its recent breach, in which hackers were able to access the laptop of a third-party customer support engineer, lasted 25 minutes and impacted two active customer tenants. The incident occurred on January 21, when the Lapsus$ group had remote access to a laptop of a Sitel customer support engineer.

See the full report here: https://www.zdnet.com/article/okta-says-lapsus-breach-hit-just-two-customers/

CISA warns of attackers now exploiting Windows Print Spooler bug

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new security flaws to its list of actively exploited bugs, including a local privilege escalation bug in the Windows Print Spooler (CVE-2022-22718). The relevant agencies CISA need to patch the bug by May 10.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-attackers-now-exploiting-windows-print-spooler-bug/

QNAP urges customers to disable UPnP port forwarding on routers

QNAP advised its customers to disable Universal Plug and Play (UPnP) port forwarding on their routers. It is recommended that QNAP NAS stay behind the router and firewall without a public IP address, the company elaborated. UPnP is a set of insecure network protocols with no encryption and authentication that comes with support for peer-to-peer communications between devices.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-urges-customers-to-disable-upnp-port-forwarding-on-routers/

Lenovo UEFI firmware driver bugs affect over 100 laptop models

Lenovo has published a security advisory highlighting three security issues that impact its Unified Extensible Firmware Interface (UEFI). These issues affect more than 100 consumer laptop models, including IdeaPad 3, Legion 5 Pro-16ACH6 H, and Yoga Slim 9-14ITL05. Lenovo recommends that users of the affected devices update the system firmware version to the latest available version.

See the full report here: https://www.bleepingcomputer.com/news/security/lenovo-uefi-firmware-driver-bugs-affect-over-100-laptop-models/

Emotet botnet switches to 64-bit modules, increases activity

The Emotet malware had a rapid increase in activity from February to March 2022, going from 3,000 to 30,000 emails. Security researchers suspect that it will soon switch to new payloads that are detected by fewer antivirus engines.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-botnet-switches-to-64-bit-modules-increases-activity/

New stealthy BotenaGo malware variant targets DVR devices

Researchers have discovered a new variant of BotenaGo that appears to have been derived from the source code leaked in October last year. It targets Lilin security camera DVR devices using a two-year-old critical remote code execution flaw. BotenaGo is a relatively new malware written in Golang, Google’s open-source programming language.

See the full report here: https://www.bleepingcomputer.com/news/security/new-stealthy-botenago-malware-variant-targets-dvr-devices/

Russian state hackers hit Ukraine with new malware variants

A Russian state-sponsored threat group Gamaredon is reportedly using new variants of the custom Pteredo backdoor in attacks against targets in Ukraine. All the different payloads deployed against Ukrainian targets recently performed similar tasks, but each communicates with a different command and control (C2) server address.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-state-hackers-hit-ukraine-with-new-malware-variants/

FBI warns of ransomware attacks targeting US agriculture sector

The FBI, in a joint flash alert with the United States Department of Agriculture (USDA) and the Cybersecurity and Infrastructure Security Agency (CISA), alerted organizations engaged in the food and agricultural sector about potential ransomware attacks during the harvest and planting seasons. The time-sensitive nature of their role in agricultural production makes such organizations lucrative targets for threat actors.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-ransomware-attacks-targeting-us-agriculture-sector/

REvil's TOR sites come alive to redirect to new ransomware operation

REvil ransomware’s servers in the TOR network are back up after months of inactivity, with a new leak site listing a large catalog of victims from past REvil attacks and two new ones. Security researchers have noticed the new REvil leak site being promoted on RuTOR, a forum marketplace.

See the full report here: https://www.bleepingcomputer.com/news/security/revils-tor-sites-come-alive-to-redirect-to-new-ransomware-operation/

Five Eyes Nations Warn of Russian Cyber Attacks Against Critical Infrastructure

Authorities from Australia, Canada, New Zealand, the United Kingdom, and the United States have issued a joint cybersecurity advisory on increased malicious attacks from Russian state-sponsored actors and criminal groups. It noted that such actors have the ability to compromise IT networks, maintain long-term persistence, steal sensitive data while remaining hidden, and disrupt and sabotage industrial control systems.

See the full report here: http://thehackernews.com/2022/04/five-eyes-nations-warn-of-russian-cyber.html

Microsoft Exchange servers hacked to deploy Hive ransomware

A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon. ProxyShell is a set of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31297) in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/

Microsoft Defender flags Google Chrome updates as suspicious

Since yesterday, Microsoft Defender for Endpoint has been tagging Google Chrome updates delivered via Google Update as suspicious activity. Microsoft stated that the updates were erroneously triggered by a false positive and not due to malicious activity, and the company has updated the logic for this alert to resolve the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-flags-google-chrome-updates-as-suspicious/

Amazon Web Services fixes container escape in Log4Shell hotfix

Security researchers discovered that Amazon's Log4Shell hot-fix solutions (issued in December 2021) would keep searching for Java processes and patch them on the fly without ensuring that the patched processes run under the restrictions imposed to the container. A proof-of-concept (PoC) exploit was also presented to demonstrate the container escape scenario. Following this, Amazon Web Services (AWS) has fixed four security issues in its hot patch.

See the full report here: https://www.bleepingcomputer.com/news/security/amazon-web-services-fixes-container-escape-in-log4shell-hotfix/

Researchers Detail Bug That Could Paralyze Snort Intrusion Detection System

A now-patched security vulnerability (CVE-2022-20685) in the Snort intrusion detection and prevention system could trigger a denial-of-service (DoS) condition and render it powerless against malicious traffic. Snort is an open-source intrusion detection system (IDS) and intrusion prevention system (IPS), maintained by Cisco.

See the full report here: https://thehackernews.com/2022/04/researchers-detail-bug-that-could.html