Threat Intelligence Bulletin: 04/29/2022 - 05/05/2022

The Underground Economist: Volume 2, Issue 7

Welcome back to The Underground Economist, Volume 2, Issue 7, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of April 29, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-05-05a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on May 5, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Russia is unlikely to announce a general military mobilization during the May 9, 2022 Victory Day celebrations, as it would risk losing public support for the conflict and incur high military and economic costs. The sixth European Union sanctions package includes phasing out imports of Russian petroleum products by the end of 2022, but the proposed sanctions face opposition from multiple member states. Russian forces entered the besieged Azovstal metallurgical complex for the first time on May 4, 2022; one day after Ukraine completed an evacuation of 156 people trapped in the complex.

Breaking News: 2022-04-29 - 2022-05-05

Ukraine targeted by DDoS attacks from compromised WordPress sites

Unknown threat actors are compromising WordPress sites to perform DDoS (distributed denial of service) attacks on pro-Ukraine sites and the government web portal. Ukraine's computer emergency response team (CERT-UA) has published an announcement relating to the ongoing attacks, and has provided a detection tool to help website administrators scan their sites.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-targeted-by-ddos-attacks-from-compromised-wordpress-sites/

New Bumblebee malware replaces Conti's BazarLoader in cyberattacks

Bumblebee, a newly observed malware in phishing attacks, is being used by several threat actors previously observed delivering BazaLoader and IcedID. The emergence of Bumblebee in phishing campaigns in March 2022 coincides with a drop in using BazarLoader for delivering file-encrypting malware. BazarLoader is the work of the TrickBot botnet developers, who are now working for the Conti syndicate.

See the full report here: https://www.bleepingcomputer.com/news/security/new-bumblebee-malware-replaces-contis-bazarloader-in-cyberattacks/

Microsoft fixes ExtraReplica Azure bugs that exposed user databases

Microsoft has addressed a chain of critical vulnerabilities in the Azure Database for PostgreSQL Flexible Server that could let malicious users escalate privileges and gain access to other customers' databases. Since the company has already addressed the security flaws on all vulnerable database servers, customers are not required to take any measures to protect their data. However, Microsoft recommends deploying PostgreSQL flexible servers on Azure virtual networks (VNet), which provide private and secure network communication.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-extrareplica-azure-bugs-that-exposed-user-databases/

Synology warns of critical Netatalk bugs in multiple products

Synology – which specializes in network-attached storage (NAS) appliances – has warned customers that some of its NAS appliances are exposed to attacks exploiting multiple critical Netatalk vulnerabilities. Netatalk is an AFP (Apple Filing Protocol) open-source implementation that allows systems running *NIX/*BSD to act as AppleShare file servers (AFP) for macOS clients. Synology is working on developing patches for the bugs.

See the full report here: https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/

Austin Peay State University resumes after ransomware attack

Austin Peay State University (APSU), located in Clarksville, Tennessee, advised its students, staff, and faculty to disconnect their computers and devices from the university network as a precaution after it was hit by a ransomware attack. Details of the threat actors and the ransom demand are not publicly available yet.

See the full report here: https://www.bleepingcomputer.com/news/security/austin-peay-state-university-resumes-after-ransomware-cyber-attack/

Experts Detail 3 Hacking Teams Working Under the Umbrella of TA410 Group

Security researchers have analysed the workings of TA410 – an umbrella group comprising three teams dubbed FlowingFrog, LookingFrog, and JollyFrog. The group uses a new version of the FlowCloud malware, which comes with the ability to record audio using a computer's microphone, monitor clipboard events, and control attached camera devices to take pictures.

See the full report here: https://thehackernews.com/2022/04/experts-detail-3-hacking-teams-working.html

Russian hackers compromise embassy emails to target governments

APT29 (a.k.a., Cozy Bear or Nobelium) is reportedly targeting diplomats and government agencies through phishing campaigns using Atlassian Trello and other cloud service platforms. The emails pretend to carry important policy updates and originate from legitimate email addresses belonging to embassies.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-compromise-embassy-emails-to-target-governments/

Fake Windows 10 updates infect you with Magniber ransomware

People’s computers are being infected by the Magniber ransomware after installing what is believed to be Windows 10 cumulative or security update. These updates are distributed under various names, such as Win10.0_System_Upgrade_Software.msi and Security_Upgrade_Software_Win10.0.msi.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/

Atlassian doubles the number of orgs affected by two week outage

Atlassian has disclosed that its cloud outage has impacted almost double the number of customers it initially estimated – bringing the current number to 883 sites (representing 775 customers). In early April, a maintenance script accidentally wiped hundreds of customer sites due to communication issues between two Atlassian teams working on deactivating a legacy app.

See the full report here: https://www.bleepingcomputer.com/news/technology/atlassian-doubles-the-number-of-orgs-affected-by-two-week-outage/

Online library app Onleihe faces issues after cyberattack on provider

The services of a library lending app, Onleihe, has been affected after a cyberattack on its vendor, EKZ – for which LockBit 2.0 claimed responsibility. Onleihe is an app that allows users to connect to local libraries and borrow eBooks, eMagazines, and audiobooks.

See the full report here: https://www.bleepingcomputer.com/news/security/online-library-app-onleihe-faces-issues-after-cyberattack-on-provider/

India to require cybersecurity incident reporting within six hours

The Indian government has issued new directives requiring organizations to report cybersecurity incidents to India's Computer Emergency Response Team (CERT-In) within six hours. The new guidelines also include a section on VPS (virtual private server) and VPN (virtual private network) service providers, who will now be obliged to maintain a record of their users.

See the full report here: https://www.bleepingcomputer.com/news/security/india-to-require-cybersecurity-incident-reporting-within-six-hours/

Pegasus spyware: Spain's prime minister and defence minister's phones infected by spying software

The cellphones of the prime minister and the defense minister were infected last year with Pegasus spyware. The spyware is supposedly only available to government agencies. Prime Minister Pedro Sánchez’s mobile phone was breached twice in May 2021, and Defense Minister Margarita Robles’ device was targeted once the following month.

See the full report here: https://www.euronews.com/next/2022/05/02/pegasus-spyware-spain-s-prime-minister-and-defence-minister-s-phones-infected-by-spying-so

Weekend cyber attack: Kellogg Community College (KCC) closes campuses

Ransomware attack has forced Kellogg Community College to shut down its main campus in Battle Creek and all satellite locations until further notice. KCC officials say technology issues that began on April 29 were due to a cyber attack that continues to affect the college's systems.

See the full report here: https://thecollegiatelive.com/2022/05/kcc-closes-after-malware-attack-grcc-reminds-campus-community-to-take-precautions/

Chinese hackers tap antivirus products to target telecom sector

A Chinese-aligned cyberespionage group has been observed striking the telecommunication sector in Central Asia with versions of malware such as ShadowPad and PlugX. Researchers traced the intrusions to an actor it tracks under the name "Moshen Dragon," with tactical overlaps between the collective and another threat group referred to as Nomad Panda (aka RedFoxtrot).

See the full report here: https://thehackernews.com/2022/05/chinese-hackers-caught-exploiting.html

AvosLocker ransomware variant trick antivirus software to disable protection

Cybersecurity researchers have disclosed a new variant of the AvosLocker ransomware that disables antivirus solutions to evade detection after breaching target networks by taking advantage of unpatched security flaws.

See the full report here: https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html

Two decentralized finance platforms lose $90 million to hackers

U.S.-based decentralized finance platforms Rari Capital and Saddle Finance were attacked this weekend by hackers who ended up stealing a total of $90 million. Rari Capital confirmed reports from several blockchain security companies on April 30 that about $80 million worth of cryptocurrency was stolen through their platform.

See the full report here: https://therecord.media/hackers-steal-90-million-from-defi-platforms-rari-capital-and-saddle-finance/

Trinidad’s largest supermarket chain crippled by cyberattack

Massy Stores, the largest supermarket chain in Trinidad, struggles to recover from a cyberattack that caused outages at all of its locations throughout the country this weekend. The company has released a statement saying it was experiencing “technical challenges” with its front-end checkout systems that made it so products could not be purchased from its supermarkets and pharmacies.

See the full report here: https://therecord.media/trinidads-largest-supermarket-chain-crippled-by-cyberattack/#:~:text=Massy%20Stores%20did%20not%20respond,continued%20to%20suffer%20from%20outages.

Researchers find over 400 vulnerabilities in U.S. defense industrial base bug bounty effort

A year-long bug bounty program that scrutinized a fraction of the massive U.S. defense industrial base turned up more than 400 valid vulnerabilities. Nearly three hundred security researchers took 12 months to spot 1,015 vulnerabilities in the networks of participating defense contractors, 401 of which were deemed actionable and required remediation.

See the full report here: https://www.hackerone.com/vulnerability-disclosure/announcing-results-12-month-dib-vdp-pilot

FBI warns of possible cyber attacks on U.S. farming co-ops

Citing ransomware attacks against six grain cooperatives during the fall 2021 harvest and two attacks already in early 2022, the FBI is advising that additional cyberattacks targeting farm cooperatives could affect the planting season by disrupting the supply of seeds and fertilizer.

See the full report here: https://www.farmprogress.com/farm-operations/cyberattacks-could-affect-planting-season

Aruba and Avaya network switches are vulnerable to RCE attacks

Security researchers have discovered five vulnerabilities in network equipment from Aruba and Avaya that could allow malicious actors to execute code remotely on the devices. The set of bugs has been dubbed “TLStorm 2.0” as the discovery is in the same class of issues as the misuse of the NanoSSL TLS library.

See the full report here: https://www.bleepingcomputer.com/news/security/aruba-and-avaya-network-switches-are-vulnerable-to-rce-attacks/

Google SMTP relay service abused for sending phishing emails

Since April 2022, a sudden uptick has been observed in threat actors abusing Google's SMTP (Simple Mail Transfer Protocol) relay service, to send malicious emails. Threat actors can use Google's SMTP relay service to spoof other Gmail tenants without being detected, when those domains do not have a DMARC policy with the “reject” directive.

See the full report here: https://www.bleepingcomputer.com/news/security/google-smtp-relay-service-abused-for-sending-phishing-emails/

New ransomware strains linked to North Korean govt hackers

Security researchers have linked APT38, a North Korean-sponsored hacking group with Beaf, PXJ, ZZZZ, and ChiChi ransomware families. The group is known for its focus on targeting and stealing funds from financial institutions worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomware-strains-linked-to-north-korean-govt-hackers/

Conti, REvil, LockBit ransomware bugs exploited to block encryption

A security researcher has found that samples from Conti, REvil, LockBit, Black Basta, LockiLocker, and AvosLocker ransomware strains are vulnerable to DLL hijacking, a method usually used by attackers to inject malicious code into a legitimate application. Once the exploit DLL is loaded, the ransomware process should terminate before starting the data encryption operation.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-revil-lockbit-ransomware-bugs-exploited-to-block-encryption/

Unpatched DNS bug affects millions of routers and IoT devices

A vulnerability in the domain name system (DNS) component of a popular C standard library (uClibc) may put millions of IoT devices at DNS poisoning attack risk. The library and its fork (uClibc-ng) are widely used by major vendors like Netgear, Axis, and Linksys, as well as Linux distributions suitable for embedded applications.

See the full report here: https://www.bleepingcomputer.com/news/security/unpatched-dns-bug-affects-millions-of-routers-and-iot-devices/

Cisco fixes NFVIS bugs that help gain root and hijack hosts

Cisco has addressed several security flaws in the Enterprise NFV Infrastructure Software (NFVIS). Two of them (CVE-2022-20777 and CVE-2022-20779) can be exploited by attackers to run commands with root privileges or to escape the guest virtual machine (VM) and fully compromise NFVIS hosts. Cisco stated that there is no proof-of-concept exploit code and no ongoing exploitation in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-nfvis-bugs-that-help-gain-root-and-hijack-hosts/

F5 warns of critical BIG-IP RCE bug allowing device takeover

A critical vulnerability in the iControl REST component F5 in BIG-IP (CVE-2022-1388; CVSS v3 rating of 9.8) could be exploited by an attacker, potentially leading to a complete system takeover. Because of the severity of the vulnerability and the widespread deployment of BIG-IP products in critical environments, CISA (Cybersecurity and Infrastructure Security Agency) has also issued an alert relating to this bug.

See the full report here: https://www.bleepingcomputer.com/news/security/f5-warns-of-critical-big-ip-rce-bug-allowing-device-takeover/

Critical RCE Bug Reported in dotCMS Content Management Software

A critical flaw, tracked as CVE-2022-26352, in dotCMS could enable an adversary to execute arbitrary commands on the underlying system. dotCMS is an open-source content management system written in Java and reportedly used by over 10,000 clients globally.

See the full report here: https://thehackernews.com/2022/05/critical-rce-bug-reported-in-dotcms.html

Attackers hijack UK NHS email accounts to steal Microsoft logins

Email accounts belonging to over 100 employees of the National Health System (NHS) in the U.K. are being hijacked and used by threat actors in phishing campaigns. In most cases, the phishing messages sent fake alerts for new document delivery that linked to fraudulent pages asking for Microsoft credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-hijack-uk-nhs-email-accounts-to-steal-microsoft-logins/

Heroku admits to customer database hack after OAuth token theft

The Salesforce-owned cloud platform Heroku has disclosed the compromise of an internal customer database. The company acknowledged that the GitHub integration OAuth tokens stolen last month were used by attackers to exfiltrate customers' hashed and salted passwords from a database.

See the full report here: https://www.bleepingcomputer.com/news/security/heroku-admits-to-customer-database-hack-after-oauth-token-theft/