Threat Intelligence Bulletin: 05/06/2022 - 05/12/2022

Q1 Financial Sector: Financial Quarterly Threat Landscape

Product Serial: S-2022-05-06a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Financial Quarterly Threat Landscape for Q1 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on April 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assessed the developments to key cyber threats facing the financial sector from Q4 2021 through Q1 2022. Financial organizations faced a persistent threat from social engineering campaigns targeting them directly or impersonating them to entice customer engagement. Although the threat from Initial Access Brokers (IABs) may have decreased, the threat from vulnerability exploitation very likely increased. Botnet and malware deployment against targets in the financial sector remained high, including use of banking trojans against customers. Despite a drop in the number of ransomware and digital extortion attacks against financial sector organizations in Q1 2022, they remained some of the most significant threats to the sector.

Q1 Retail Sector: Retail Quarterly Threat Landscape

Product Serial: S-2022-05-11e

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Retail Quarterly Threat Landscape for Q1 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on April 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assessed the developments to key cyber threats facing the retail sector from Q4 2021 through Q1 2022. There was a persistent threat from social engineering campaigns targeting organizations, as well as impersonating them to target customers in Q1 2022. Although the threat from Initial Access Brokers (IABs) may have decreased, the threat from vulnerability exploitation very likely increased. Botnet and malware deployment against targets in the retail sector remained high, including from skimmers and banking trojans. Despite a drop in the number of ransomware and digital extortion attacks against retail organizations in Q1 2022, they remained some of the most significant threats to the sector. In addition, ongoing geopolitical conflicts and COVID-19 lockdowns continue to have significant impacts on production and logistics in the retail sector supply chain.

Q1 Public Sector: Public Sector Quarterly Threat Landscape

Product Serial: S-2022-05-12c

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Public Sector Quarterly Threat Landscape for Q1 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on April 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assessed the developments to key cyber threats facing the public sector from Q4 2021 through Q1 2022. Organizations faced a persistent threat from social engineering campaigns which both targeted officials and impersonated government entities to entice victim engagement. Although the threat from Initial Access Brokers (IABs) may have decreased, the threat from vulnerability exploitation very likely increased. Botnet and malware deployment against targets in the public sector remained high. Despite a drop in the number of ransomware and digital extortion attacks against public sector organizations in Q1 2022, they remained some of the most significant threats to the sector.

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-05-12a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 12, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Russian President Vladimir Putin did not declare war on Ukraine or announce a general mobilization during his May 9, 2022, Victory Day speech. However, U.S. intelligence officials still believe that he intends to again expand the war beyond the Donbas if the Russian military’s ongoing offensive is successful. Russian state-owned gas corporation Gazprom announced sanctions against Yamal pipeline operators on May 11, 2022, that will stop gas from flowing to European customers through the pipeline. The Russia-installed military-civilian administration in the Kherson region announced their intent to join Russia, which suggests that a regional independence referendum is imminent.

Breaking News: 2022-05-06 - 2022-05-12

VHD Ransomware Linked to North Korea’s Lazarus Group

Financial transactions and similarities to previous malware in its source code link a recently emerged ransomware strain called VHD to the North Korean threat actors, also known as Unit 180 or APT35, researchers say

See the full report here: https://threatpost.com/vhd-ransomware-lazarus-group/179507/

FBI alert warns of BlackCat ransomware that compromised 60 organizations in 4 months

The Federal Bureau of Investigation (FBI) published a flash alert on the BlackCat ransomware group, also known as Noberus and AlphaV.

See the full report here: https://www.cpomagazine.com/cyber-security/fbi-alert-warns-of-blackcat-ransomware-that-compromised-60-organizations-in-4-months/

Heroku resets user passwords after concluding April cyber-attack ran deep

Heroku, the Salesforce-owned cloud application platform, began the forced reset of user passwords on May 4 after recently disclosing a cyber-attack.

See the full report here: https://portswigger.net/daily-swig/heroku-resets-user-passwords-after-concluding-april-cyber-attack-ran-deep

Global car rental company Sixt confirms cyber-attack

Car rental company Sixt confirmed that it had detected IT irregularities and had been subject to a cyber-attack.Sixt has more than 2,000 locations across 110 countries.

See the full report here: https://www.cshub.com/attacks/news/iotw-car-rental-customers-face-chaos-during-sixt-cyber-attack

Massive Brazilian health ministry hack used privileged access

Datasus, the computerized system managing all of Brazil’s public health databases, had suffered a massive hacking attack, erasing its cloud storage and internal environment, including a wealth of Covid vaccination data.

See the full report here: https://brazilian.report/liveblog/2022/05/05/health-ministry-hack-privileged-access/

Russian hacking group threatens to shut down hospital ventilators in Britain

Russian hacking group threatens to shut down hospital ventilators in Britain after 'officers arrested hacker for helping to cripple Romanian government'.

See the full report here: https://www.dailymail.co.uk/news/article-10787595/Sinister-Russian-hacking-group-threatens-shut-hospital-ventilators-Britain.html

Catalan: Spain spy chief admits legally hacking some phones

Spain's top intelligence official acknowledged that her agency had hacked into the cellphones of “some” of the dozens of politicians reported to be targeted by spyware but she said it had proper judicial authorization.

See the full report here: https://abcnews.go.com/International/wireStory/hacked-phones-put-spanish-intelligence-agency-scrutiny-84512989

New Raspberry Robin worm uses Windows Installer to drop malware

Researchers discovered a new Windows malware with worm capabilities that spreads using external USB drives.

See the full report here: https://www.bleepingcomputer.com/news/security/new-raspberry-robin-worm-uses-windows-installer-to-drop-malware/

New NetDooka malware spreads via poisoned search results

A new malware framework known as NetDooka has been discovered being distributed through the PrivateLoader pay-per-install (PPI) malware distribution service, allowing threat actors full access to an infected device.

See the full report here: https://www.bleepingcomputer.com/news/security/new-netdooka-malware-spreads-via-poisoned-search-results/

Researchers disclose years-old vulnerabilities in Avast and AVG Antivirus

Two high-severity security vulnerabilities, which went undetected for several years, have been discovered in a legitimate driver that's part of Avast and AVG antivirus solutions

See the full report here: https://thehackernews.com/2022/05/researchers-disclose-10-year-old.html

Experts uncover new espionage attacks by Chinese 'Mustang Panda' hackers

China-based threat actor known as Mustang Panda has been observed refining and retooling its tactics and malware to strike entities located in Asia, the European Union, Russia, and the U.S.

See the full report here: https://thehackernews.com/2022/05/experts-uncover-new-espionage-attacks.html

Critical Cisco NFVIS software flaw let attacker injects commands at the root level; patch issued

Cisco has released an update to the Enterprise NFV Infrastructure Software (NFVIS) that addresses several security flaws found by researchers.

See the full report here: https://gbhackers.com/cisco-nfvis-software-flaw/

Ferrari subdomain hijacked to push fake Ferrari NFT collection

A Ferrari subdomain (forms.ferrari.com) was reportedly hijacked to host a scam that promoted a fake Ferrari NFT collection. The hacked Ferrari subdomain has now been taken down and throws an HTTP 403 error code. The Ethereum wallet associated with the scam collected a few hundred dollars before the hacked subdomain was shut down.

See the full report here: https://www.bleepingcomputer.com/news/security/ferrari-subdomain-hijacked-to-push-fake-ferrari-nft-collection/

Trend Micro antivirus modified Windows registry by mistake — How to fix

A bug in Trend Micro’s Apex One endpoint security solution reportedly caused Microsoft Edge updates to be tagged as malware and the Windows registry to be incorrectly modified. The company published an advisory urging customers to update their products and to ensure that their version of Smart Scan Agent Pattern is 17.541.00 or later and Smart Scan Pattern is 21474.139.09 or later.

See the full report here: https://www.bleepingcomputer.com/news/security/trend-micro-antivirus-modified-windows-registry-by-mistake-how-to-fix/

Caramel credit card stealing service is growing in popularity

Caramel skimmer-as-a-service, a credit card skimmer operated by a Russian cybercrime organization named “CaramelCorp,” is growing in popularity. The Caramel service only sells to Russian-speaking threat actors, and a lifetime subscription (worth $2,000) promises full customer support, code upgrades, and evolving anti-detection measures.

See the full report here: https://www.bleepingcomputer.com/news/security/caramel-credit-card-stealing-service-is-growing-in-popularity/

NIST updates guidance for defending against supply-chain attacks

The National Institute of Standards and Technology (NIST) has released updated guidance on identifying and responding to supply chain cybersecurity risks. The 326-page document covers information ranging from evaluating foreign control over a software/product's development to risks associated with using external IT service providers. NIST also plans to release a quick-start guide to help organizations who are just starting their C-SCRM (Cybersecurity Supply Chain Risk Management) endeavors.

See the full report here: https://www.bleepingcomputer.com/news/security/nist-updates-guidance-for-defending-against-supply-chain-attacks/

US agricultural machinery maker AGCO hit by ransomware attack

AGCO, a leading U.S.-based agricultural machinery producer, suffered a ransomware attack that affected some of the company's production facilities. The FBI had recently warned the American agricultural sector that ransomware attacks were targeting it.

See the full report here: https://www.bleepingcomputer.com/news/security/us-agricultural-machinery-maker-agco-hit-by-ransomware-attack/

QNAP fixes critical QVR remote command execution vulnerability

QNAP has released a security advisory for a critical security issue that allows remote execution of arbitrary commands on vulnerable QVR systems. The vulnerability (CVE-2022-27588, with a critical severity score of 9.8) affects QVR versions older than 5.1.6 build 20220401. The QVR IP video surveillance system is designed for monitoring home and office environments.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-fixes-critical-qvr-remote-command-execution-vulnerability/

Exploits created for critical F5 BIG-IP flaw, install patch immediately

Security researchers have been able to create exploits for a recently disclosed critical remote code execution vulnerability (CVE-2022-1388) in the BIG-IP iControl REST authentication component. F5 BIG-IP admins should install the latest security updates as threat actors can exploit the bug to gain initial access to networks and then spread laterally to other devices.

See the full report here: https://www.bleepingcomputer.com/news/security/exploits-created-for-critical-f5-big-ip-flaw-install-patch-immediately/

Ukrainian CERT Warns Citizens of a New Wave of Attacks Distributing Jester Malware

An email campaign with the subject line "chemical attack" (and containing a link to a macro-enabled Microsoft Excel file) is infecting vulnerable target systems with an information-stealing malware called Jester Stealer. Jester Stealer has features to steal and transmit login credentials, cookies, and credit card information along with data from password managers, chat messengers, email clients, crypto wallets, and gaming apps to the attackers.

See the full report here: https://thehackernews.com/2022/05/ukrainian-cert-warns-citizens-of-new.html

Google Docs crashes on seeing "And. And. And. And. And."

A bug in Google Docs is causing it to crash when a specific series of words, including "And. And. And. And. And." is typed, with "Show grammar suggestion" turned on. Google is reportedly working on a fix for the bug.

See the full report here: https://www.bleepingcomputer.com/news/technology/google-docs-crashes-on-seeing-and-and-and-and-and/

Costa Rica declares national emergency after Conti ransomware attacks

Costa Rica has declared a national emergency following cyberattacks from the Conti ransomware group on several government bodies. Conti had claimed a ransomware attack against Costa Rican government entities last month and demanded a $10 million ransom, which the government declined to pay. The group claims to have leaked 97% of a 672 GB data dump allegedly containing information stolen from government agencies.

See the full report here: https://www.bleepingcomputer.com/news/security/costa-rica-declares-national-emergency-after-conti-ransomware-attacks/

Lincoln College to close after 157 years due ransomware attack

Lincoln College in Illinois will cease all academic activity at the end of the spring semester because of the financial impact of a recent ransomware attack as well as the COVID-19 pandemic. Lincoln College was hit by a cyberattack in December 2021, which made the systems required for recruitment, retention, and fundraising efforts inoperable.

See the full report here: https://www.bleepingcomputer.com/news/security/lincoln-college-to-close-after-157-years-due-ransomware-attack/

Hackers exploiting critical F5 BIG-IP bug, public exploits released

Threat actors are exploiting a bug (CVE-2022-1388) affecting F5 BIG-IP modules to drop webshells for prolonged backdoor access. Last week, F5 released patches for the security issue (9.8 severity rating), which affects the BIG-IP iControl REST authentication component.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-f5-big-ip-bug-public-exploits-released/

Experts Sound Alarm on DCRat Backdoor Being Sold on Russian Hacking Forums

An actively maintained remote access trojan, DCRat (or DarkCrystal RAT), is being sold for incredibly cheap prices, like 4,200 RUB ($40) for a lifetime subscription, on the popular Russian hacking forum lolz[.]guru.

See the full report here: https://thehackernews.com/2022/05/experts-sound-alarm-on-dcrat-backdoor.html

Microsoft releases fixes for Azure flaw allowing RCE attacks

Microsoft has released security updates for a bug (CVE-2022-29972, dubbed SynLapse) affecting Azure Synapse and Azure Data Factory pipelines that could let attackers execute remote commands across Integration Runtime (IR) infrastructure. Microsoft stated that customers using Azure cloud or hosting their own on-premises with auto-updates turned on don't need to take any further action to mitigate this flaw. Self-host IR customers with auto-update not on should update their self-hosted IRs to the latest version (5.17.8154.2).

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-releases-fixes-for-azure-flaw-allowing-rce-attacks/

Microsoft fixes new NTLM relay zero-day in all Windows versions

Microsoft has fixed a actively exploited Windows LSA (Local Security Authority) spoofing zero-day bug (CVE-2022-26925). The bug affects all Windows versions, including client and server platforms, starting from Windows 7 and Windows Server 2008 to Windows 11 and Windows 2022.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-new-ntlm-relay-zero-day-in-all-windows-versions/

German automakers targeted in year-long malware campaign

As part of an ongoing phishing campaign, threat actors have cloned the websites of at least 14 German organizations connected to the auto-making industry (including car manufacturers and car dealerships). These sites are used to send phishing emails written in German and host the malware payloads downloaded to targeted systems.

See the full report here: https://www.bleepingcomputer.com/news/security/german-automakers-targeted-in-year-long-malware-campaign/

US, EU blame Russia for cyberattack on satellite modems in Ukraine

The European Union has formally accused Russia of coordinating the cyberattack that hit Viasat’s KA-SAT satellite broadband service just before the invasion of Ukraine. The attack reportedly affected thousands of Ukrainian customers and tens of thousands of other broadband customers across Europe.

See the full report here: https://www.bleepingcomputer.com/news/security/us-eu-blame-russia-for-cyberattack-on-satellite-modems-in-ukraine/

FluBot Android malware targets Finland in new SMS campaigns

The FluBot Android malware is engaging in a new campaign that relies on SMS and MMS for distribution, with thousands of malicious messages currently circulating to potential victims. The goal is to steal financial account credentials of its victims by overlaying phishing pages on top of legitimate banking and cryptocurrency applications.

See the full report here: https://www.bleepingcomputer.com/news/security/flubot-android-malware-targets-finland-in-new-sms-campaigns/

Experts Detail Saintstealer and Prynt Stealer Info-Stealing Malware Families

Cybersecurity researchers have dissected the inner workings of an information-stealing malware called Saintstealer. The malware can capture a wide range of information, from taking screenshots to gathering passwords, cookies, and autofill data stored in Chromium-based browsers. Saintstealer is equipped with anti-analysis checks, opting to terminate itself if it's running either in a sandboxed or virtual environment.

See the full report here: https://thehackernews.com/2022/05/experts-detail-saintstealer-and-prynt.html

HP fixes bug letting attackers overwrite firmware in over 200 models

HP has released BIOS updates to fix two high-severity vulnerabilities (CVE-2021-3808 and CVE-2021-3809; CVSS 3.1 base score of 8.8 for both). The affected products include business notebooks, business desktop PCs, retail PoS computers, workstations, and thin client PCs.

See the full report here: https://www.bleepingcomputer.com/news/security/hp-fixes-bug-letting-attackers-overwrite-firmware-in-over-200-models/

New stealthy Nerbian RAT malware spotted in ongoing attacks

Security researchers have discovered a new remote access trojan (RAT) called Nerbian RAT, which is written in Go. It features anti-detection and analysis tools, a keylogger that stores keystrokes in encrypted form, and a screen-capturing tool that works on all OS platforms. The distribution campaign impersonates the World Health Organization (WHO), and pretends to be sending COVID-19 information to the targets.

See the full report here: https://www.bleepingcomputer.com/news/security/new-stealthy-nerbian-rat-malware-spotted-in-ongoing-attacks/

CISA tells federal agencies to fix actively exploited F5 BIG-IP bug

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the critical-severity CVE-2022-1388 affecting BIG-IP network devices to its list of actively exploited bugs. All Federal Civilian Executive Branch Agencies (FCEB) agencies must patch the bug by May 31, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-tells-federal-agencies-to-fix-actively-exploited-f5-big-ip-bug/

FBI, CISA, and NSA warn of hackers increasingly targeting MSPs

In a joint advisory, cybersecurity authorities from the United Kingdom, Australia, Canadia, New Zealand, and the United States warned managed service providers (MSPs) and their customers of supply chain attacks by threat actors to exploit provider-customer network trust relationships. The advisory provides measures on securing sensitive information and data via transparent discussions centered around re-evaluating security processes and contractual commitments to accommodate the customers' risk tolerance.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-cisa-and-nsa-warn-of-hackers-increasingly-targeting-msps/

Bitter cyberspies target South Asian govts with new malware

Bitter, an APT (advanced persistent threat) group focused on cyberespionage, has been targeting various organizations within the Bangladeshi government since at least August 2021. The campaign started with spear-phishing emails sent via spoofed email addresses impersonating Pakistani government organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/bitter-cyberspies-target-south-asian-govts-with-new-malware/

New IceApple exploit toolset deployed on Microsoft Exchange servers

A highly sophisticated post-exploitation framework – IceApple – is being deployed on Microsoft Exchange servers. The framework is being reportedly deployed after the threat actor obtains initial access to the network (in various activity sectors: technology, academic, and government).

See the full report here: https://www.bleepingcomputer.com/news/security/new-iceapple-exploit-toolset-deployed-on-microsoft-exchange-servers/

Intel Memory Bug Poses Risk for Hundreds of Products

Intel reported a memory bug (CVSS score of 7) affecting microprocessor firmware used in hundreds of products. The vulnerability resides inside some Intel Optane SSD and Intel Optane Data Center (DC) products, and could allow privilege escalation, denial of service (DoS), or information disclosure.

See the full report here: https://threatpost.com/intel-memory-bug-poses-risk-for-hundreds-of-products/179595/