Threat Intelligence Bulletin: 04/22/2022 - 04/28/2022

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-04-28a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on April 28, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Russian state-owned corporation Gazprom suspended natural gas deliveries to Poland and Bulgaria, citing the two countries’ refusal to pay for gas in Russian rubles. U.S. President Joseph Biden requested USD 33 billion in funding from Congress to support Ukraine, including USD 20 billion for military support. Russian President Vladimir Putin declared that Russia would respond to any perceived outside intervention in Ukraine, and Russian Foreign Minister Sergei Lavrov warned that the conflict risks escalating into nuclear war. The Russian offensive in the Donbas has not achieved strategic breakthroughs and may lack the capacity to achieve the desired envelopment of Ukrainian forces.

Breaking News: 2022-04-22 - 2022-04-28

QNAP asks users to mitigate critical Apache HTTP Server bugs

QNAP has recommended mitigation measures for two critical Apache HTTP Server security vulnerabilities (CVE-2022-22721 and CVE-2022-23943; CVSS base score: 9.8) that affect network-attached storage (NAS) devices. Unauthenticated attackers can exploit the vulnerabilities remotely in low-complexity attacks without requiring user interaction. The company plans to release security updates in the near future.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-asks-users-to-mitigate-critical-apache-http-server-bugs/

Critical bug in Android could allow access to users' media files

Android devices running on Qualcomm and MediaTek chipsets were reportedly vulnerable to remote code execution due to a flaw in the implementation of the Apple Lossless Audio Codec (ALAC). The ALAC flaws (CVE-2021-0674, CVE-2021-0675, and CVE-2021-30351) were fixed by MediaTek and Qualcomm in December 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-bug-in-android-could-allow-access-to-users-media-files/

Unpatched Bug in RainLoop Webmail Could Give Hackers Access to all Emails

An unpatched high-severity security flaw (CVE-2022-29360) in the open-source RainLoop web-based email client could be used to steal emails from victims' inboxes. The flaw relates to a stored cross-site-scripting (XSS) vulnerability affecting the latest version of RainLoop (v1.16.0).

See the full report here: https://thehackernews.com/2022/04/unpatched-bug-in-rainloop-webmail-could.html

Cisco Umbrella default SSH key allows theft of admin credentials

Cisco has released security updates to address a high severity vulnerability (CVE-2022-20773) in the Cisco Umbrella Virtual Appliance (VA). A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. The bug affects the Cisco Umbrella VA for Hyper-V and VMWare ESXi running software versions earlier than 3.3.2.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-umbrella-default-ssh-key-allows-theft-of-admin-credentials/

Docker servers hacked in ongoing cryptomining malware campaign

Operators of the Lemon_Duck botnet are attacking Docker APIs on Linux servers, to mine Monero cryptocurrency. The threat actor is reportedly hiding their wallets behind proxy pools.

See the full report here: https://www.bleepingcomputer.com/news/security/docker-servers-hacked-in-ongoing-cryptomining-malware-campaign/

Hackers Sneak "More_Eggs" Malware Into Resumes Sent to Corporate Hiring Managers

The more_eggs malware operation is targeting hiring managers with fake resumes – going against the more common trope of targeting jobseekers with fake job offers. This malware is a stealthy, modular backdoor suite capable of stealing valuable information and conducting lateral movement across the compromised network.

See the full report here: https://thehackernews.com/2022/04/hackers-sneak-moreeggs-malware-into.html

T-Mobile confirms Lapsus$ hackers breached internal systems

T-Mobile has confirmed that the Lapsus$ extortion gang breached its network recently, using stolen credentials and gained access to internal systems. The Lapsus$ hackers reportedly didn't steal sensitive customer or government information during the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-confirms-lapsus-hackers-breached-internal-systems/

Atlassian Drops Patches for Critical Jira Authentication Bypass Vulnerability

Atlassian has issued patches for a bug (CVE-2022-0540; rated 9.9 on the CVSS scoring system) that resides in Jira's authentication framework, Jira Seraph. A remote, unauthenticated attacker could exploit this bug by sending a specially crafted HTTP request to bypass authentication and authorization requirements in WebWork actions using an affected configuration.

See the full report here: https://thehackernews.com/2022/04/atlassian-drops-patches-for-critical.html

Hack DHS bug hunters find 122 security flaws in DHS systems

Bug bounty hunters enrolled in the “Hack DHS” bug bounty program found 122 security vulnerabilities in external Department of Homeland Security (DHS) systems, 27 of them rated as critical. This bug bounty program was announced in December 2021 and builds upon the experience of similar efforts across the U.S. federal government (e.g., the “Hack the Pentagon” program) and the private sector.

See the full report here: https://www.bleepingcomputer.com/news/security/hack-dhs-bug-hunters-find-122-security-flaws-in-dhs-systems/

CISA adds 7 vulnerabilities to list of bugs exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its list of actively exploited security issues. The relevant agencies have to patch these bugs by May 16, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-7-vulnerabilities-to-list-of-bugs-exploited-in-attacks/

French hospital group disconnects Internet after hackers steal data

The GHT Coeur Grand Est. Hospitals and Health Care group has disconnected all incoming and outgoing internet connections after discovering a cyberattack. GHT is a hospital network located in Northeast France consisting of nine locations, 6,000 employees, and approximately 3,370 beds.

See the full report here: https://www.bleepingcomputer.com/news/security/french-hospital-group-disconnects-internet-after-hackers-steal-data/

Emotet malware infects users again after fixing broken installer

Emotet malware distributors had halted its new email campaign last Friday (April 22, 2022) after discovering that a bug was preventing users from becoming infected. Emotet has since fixed the bug and started spamming users with malicious emails containing password-protected zip files and shortcut attachments.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-infects-users-again-after-fixing-broken-installer/

Crooks steal NFTs worth $3m in Bored Ape Yacht Club heist

Crooks stole non-fungible tokens (NFTs) reportedly worth about $3 million after breaking into the Bored Ape Yacht Club's Instagram account and posting a malicious link. Bored Ape Yacht Club, or BAYC, is a collection of pictures that depict primates in various poses and costumes, and each picture sells for thousands of dollars.

See the full report here: https://www.theregister.com/2022/04/26/nft_theft_bored_ape_yacht_club/

North Korean State Actors Deploying Novel Malware to Spy on Journalists

APT37/Ricochet Chollimia, a state-backed group linked to the Democratic People's Republic of Korea is reportedly deploying a novel malware strain called Goldbackdoor, a variation of Bluelight malware, on journalists.

See the full report here: https://www.darkreading.com/attacks-breaches/dprk-state-actors-deploying-novel-malware-to-spy-on-journalists

Researchers Report Critical RCE Vulnerability in Google's VirusTotal Platform

A now-patched high-severity flaw (CVE-2021-22204; CVSS score: 7.8) could allow attackers to execute commands remotely within the VirusTotal platform and gain access to its various scan capabilities. VirusTotal, part of Google's Chronicle security subsidiary, is a malware-scanning service that analyzes suspicious files and URLs and checks for viruses using more than 70 third-party antivirus products.

See the full report here: https://thehackernews.com/2022/04/researchers-report-critical-rce.html

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System

Microsoft disclosed two privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) in the Linux operating system. These bugs could potentially allow threat actors to deploy payloads and perform other malicious actions via arbitrary root code execution. The vulnerabilities are rooted in a systemd component called networkd-dispatcher. Users of networkd-dispatcher should update their instances to the latest version.

See the full report here: https://thehackernews.com/2022/04/microsoft-discovers-new-privilege.html

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages

A logical flaw in NPM could enable malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them. After security researchers discovered this supply chain threat (dubbed "Package Planting"), NPM fixed the underlying issue.

See the full report here: https://thehackernews.com/2022/04/npm-bug-allowed-attackers-to-distribute.html

Emotet malware now installs via PowerShell in Windows shortcut files

The Emotet malware campaign has switched to a new technique that uses PowerShell commands attached to the LNK file to download and execute a script on the infected computer. This is the first time that Emotet utilized Windows shortcuts to directly execute PowerShell commands. The countries most affected by Emotet via the new technique are Mexico, Italy, Japan, Turkey, and Canada.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-now-installs-via-powershell-in-windows-shortcut-files/

Coca-Cola investigates hackers' claims of breach and data theft

Coca-Cola is currently investigating reports of a cyberattack on its network, after the Stormous gang claimed to have breached some of the company's servers and stolen 161 GB of data. The threat actors listed a cache of the data for sale on their leak site, for the price of 1.65 BTC (around $64,000).

See the full report here: https://www.bleepingcomputer.com/news/security/coca-cola-investigates-hackers-claims-of-breach-and-data-theft/

American Dental Association hit by new Black Basta ransomware

The American Dental Association (ADA) was hit by a cyberattack, causing it to shut down portions of its network while investigating the attack. The ADA is a dentist and oral hygiene advocacy association, with 175,000 members. A new ransomware gang known as Black Basta has claimed responsibility for the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/

Hackers exploit critical VMware RCE flaw to install backdoors

An Iranian hacking group APT35, or “Rocket Kitten,” is exploiting a critical remote code execution (RCE) vulnerability, CVE-2022-22954, that affects VMware Workspace ONE Access. This bug was addressed by VMWare in a security update earlier this month.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-vmware-rce-flaw-to-install-backdoors/

New Black Basta ransomware springs into action with a dozen breaches

Black Basta, a new ransomware gang, has been attacking companies worldwide since around the second week of April, 2022. Based on how quickly Black Basta amassed victims and the style of its negotiations, security researchers suspect it to be a rebrand of an experienced operation.

See the full report here: https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/

Onyx ransomware destroys large files instead of encrypting them

Onyx, a new ransomware operations, reportedly encrypts victims’ files smaller than 200 MB in size but overwrites any files larger than 200 MB with random data. Thus, even if a victim pays, the decryptor can recover only the smaller encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/psa-onyx-ransomware-destroys-large-files-instead-of-encrypting-them/

Russian govt impersonators target telcos in phishing attacks

A new financially motivated hacking group, Hive0117, is impersonating the Russian Government’s Federal Bailiffs Service in a phishing campaign on telecommunication service providers and industrial firms in Lithuania, Estonia, and Russia. The goal is to deploy the DarkWatchman malware – a lightweight, stealthy JavaScript RAT (remote access tool) with a C# keylogger – on the victim’s computers.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-govt-impersonators-target-telcos-in-phishing-attacks/

RIG Exploit Kit drops RedLine malware via Internet Explorer bug

A campaign is leveraging CVE-2021-26411 (an Internet Explorer bug that causes memory corruption when viewing a specially crafted website) via the RIG Exploit Kit to deliver the RedLine stealer malware. RedLine is a cheap but powerful info-stealing malware which can be used to collect sensitive user details such as cryptocurrency wallet keys, credit card details, and account credentials stored on web browsers.

See the full report here: https://www.bleepingcomputer.com/news/security/rig-exploit-kit-drops-redline-malware-via-internet-explorer-bug/

CloudFlare Thwarts Record DDoS Attack Peaking at 15 Million Requests Per Second

The web infrastructure and website security company Cloudflare reported that it acted to mitigate one of the largest HTTPS distributed denial-of-service (DDoS) attacks on record: a 15.3 million request-per-second (RPS) attack. The attack lasted less than 15 seconds and targeted an unnamed Cloudflare customer operating a crypto launchpad. HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS encrypted connection.

See the full report here: https://thehackernews.com/2022/04/cloudflare-thwarts-record-ddos-attack.html

QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available

QNAP is updating its QTS and QuTS operating systems after Netatalk released patches to contain seven security flaws in its software. Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like operating systems to serve as file servers for Apple macOS computers. The flaws have been patched so far in QTS 4.5.4.2012 build 20220419 and later.

See the full report here: https://thehackernews.com/2022/04/qnap-advises-to-mitigate-remote-hacking.html

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware

A China-linked government-sponsored threat actor ( Bronze President / Mustang Panda / TA416, / HoneyMyte / RedDelta / PKPLUG) is possibly targeting Russian government officials with an updated version of a remote access trojan called PlugX. Active since at least July 2018, this group has a history of conducting espionage operations by leveraging custom and publicly available tools to compromise, maintain long-term access, and collect data from targets of interest.

See the full report here: https://thehackernews.com/2022/04/chinese-hackers-targeting-russian.html