Recent RansomHouse Ransomware Gang Activity

Product Serial: B-2022-05-13a

TLP: WHITE

In this briefing, ZeroFox Intelligence takes a look at recent activity on the RansomHouse leak site and their potential connection to APT group FIN8.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EDT) on May 13, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On May 10, 2022, ZeroFox observed several updates on the RansomHouse leak site revealing multiple victims. Two of the four victims, Jefferson Credit Union and the Saskatchewan Liquor and Gaming Authority, were listed with links available to download all of their stolen data. There was no link to the data of the other two victims, AHS Aviation Handling Services and Dellner, but the site claims to have “evidence” that these entities have been breached. RansomHouse may be connected to APT group FIN8, as evidenced by shared infrastructure and malware used by the WhiteRabbit ransomware.

New REvil Version Identified

Product Serial: F-2022-05-13a

TLP: WHITE

After halting all public activity in October 2021, REvil appears to have resumed operations in April 2022. ZeroFox has observed multiple updates to REvil’s leak site since then, with five new victims appearing since the site came back online, including Unicity International, U.S.-based manufacturer of wellness supplements, and Ludwig Freytag Group, a Germany-based construction company.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on May 13, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• Updated samples indicate REvil or someone close to the group has resumed operations.
• REvil joins a growing list of ransom families requiring predetermined command line arguments to function.
• REvil no longer refuses to run based on an infected systems’ language.
• An unused configuration element introduced previously is now populated with credentials.

Q1 Manufacturing Sector: Manufacturing Quarterly Threat Landscape

Product Serial: S-2022-05-13a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Manufacturing Quarterly Threat Landscape for Q1 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on April 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assessed the developments to key cyber threats facing the manufacturing sector from Q4 2021 through Q1 2022, focusing on threats to Information Technology (IT) infrastructure. Manufacturers faced a persistent threat from social engineering campaigns and while the threat from Initial Access Brokers (IABs) may have decreased, this is likely to be temporary. The threat from vulnerability exploitation very likely increased. Botnet and malware deployment against targets in the manufacturing sector remained high. Despite a drop in the number of ransomware and digital extortion attacks against manufacturing organizations in Q1 2022, it remains the most frequently targeted sector.

Q1 Energy Sector: Energy Quarterly Threat Landscape

Product Serial: S-2022-05-13b

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Energy Quarterly Threat Landscape for Q1 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on April 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assessed the developments to key cyber threats facing the energy sector from Q4 2021 through Q1 2022, focusing on threats to Information Technology (IT) infrastructure. Energy organizations faced a persistent threat from social engineering campaigns from cyber criminals and advanced persistent threat groups. While the threat from Initial Access Brokers (IABs) may have decreased, the threat from vulnerability exploitation very likely increased. Botnet and malware deployment against targets in the energy sector remained high. Despite a drop in the number of ransomware and digital extortion attacks against energy sector organizations in Q1 2022, they remained some of the most significant threats to the sector.

Vulnerabilities in TLS Communications

Product Serial: B-2022-05-16a

TLP: WHITE

Transport Layer Security (TLS) 1.0 and 1.1 have been strongly recommended for deprecation in order to adhere to new industry standards, mitigate risks of cyberattacks, and minimize the risk of misconfigurations.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 16, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Transport Layer Security (TLS) 1.0 and 1.1 have been strongly recommended for deprecation in order to adhere to new industry standards, mitigate risks of cyberattacks, and minimize the risk of misconfigurations. Recent developments, dubbed “TLStorm 2.0,” involved several critical vulnerabilities in TLS communications in multiple models of network switches, emphasizing the urgency of updating from outdated TLS versions to more secure versions. Most notably, these vulnerabilities include the possibility of hackers intercepting and decrypting traffic between a user's browser and an SSL-secured website.

Microsoft Patch Tuesday 05/11/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for May 2022 contained 74 vulnerabilities in total, with:

• 6 vulnerabilities rated as Critical
• 45 vulnerabilities rated as High

The patched bugs include 3 zero-day vulnerabilities. One of these vulnerabilities, CVE-2022-26925, is being actively exploited in the wild. The other zero-days are two publicly exposed bugs: a denial of service vulnerability in Hyper-V and a new remote code execution vulnerability in Azure Synapse and Azure Data Factory.

Most notable vulnerabilities

Microsoft has listed 3 zero-day vulnerabilities (CVE-2022-26925, CVE-2022-22713, and CVE-2022-29972) among the bugs fixed in the May Patch Tuesday security update.

The other significant bugs patched in this batch of updates include a bug (CVE-2022-26937) affecting services using the Windows Network File System (NFS), as well as two privilege escalation (CVE-2022-29104 and CVE-2022-29132) and two information disclosure (CVE-2022-29114 and CVE-2022-29140) bugs in the Print Spooler component.

CVE-2022-26925

CVE-2022-26925 (CVSS score: 8.1) is a Windows LSA (Local Security Authority) Spoofing vulnerability. Because of this bug, Microsoft Windows could allow a remote attacker to conduct spoofing attacks. This bug is being actively exploited in the wild.

The following products are affected:

• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 7 for x64-based Systems Service Pack 1
• Windows 8.1 for 32-bit systems
• Windows 8.1 for x64-based systems
• Windows RT 8.1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows Server, version 20H2 (Server Core Installation)

CVE-2022-22713

CVE-2022-22713 (CVSS score: 5.6) is a Denial of Service vulnerability in Windows Hyper-V. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

The following products are affected:

• Windows 10 Version 21H2 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for x64-based Systems
• Windows 10 Version 21H1 for x64-based Systems

CVE-2022-29972

CVE-2022-29972 (CVSS score: 8.4) is a remote code execution vulnerability in Azure Synapse and Azure Data Factory. Magnitude Simba Amazon Redshift ODBC Driver could allow a local attacker to execute arbitrary code on the system, caused by an argument injection vulnerability in the browser-based authentication component.

The following product is affected:

• Self-hosted Integration Runtime

CVE-2022-26937

CVE-2022-26937 (CVSS score: 9.8) is a Windows Network File System Remote Code Execution vulnerability. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows Server, version 20H2 (Server Core Installation)

The Underground Economist: Volume 2, Issue 8

Welcome back to The Underground Economist, Volume 2, Issue 6, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of May 13, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-05-19a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 19, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The Russian Defense Ministry said that 1,730 Ukrainian defenders of Mariupol’s Azovstal steel plant have left the complex since evacuations began on May 16, 2022. It is unclear how a prisoner exchange between Ukraine and Russia will proceed, and some evacuees will likely face criminal proceedings in Russia on charges of association with the Azov Battalion. Sweden and Finland formally submitted their applications for NATO membership on May 18, 2022, but their quick approval may be held up by Turkish opposition. The first war crimes trial for a captured Russian soldier began in Kyiv on May 13, 2022, and the soldier has since pleaded guilty to charges of killing a civilian.

Breaking News: 2022-05-13 - 2022-05-19

Iranian hackers exposed in a highly targeted espionage campaign

The Iranian hacking group APT34 (Oilrig) used novel anti-detection and anti-analysis techniques in an attack on a Jordanian diplomat. APT34 has been previously linked to the Iranian government and is reportedly a capable threat actor that does not leave many traces behind.

See the full report here: https://www.bleepingcomputer.com/news/security/iranian-hackers-exposed-in-a-highly-targeted-espionage-campaign/

Eternity malware kit offers stealer, miner, worm, ransomware tools

A modular malware toolkit which can include an info-stealer, a coin miner, a clipper, a ransomware program, a worm spreader, and a DDoS (distributed denial of service) bot is being promoted on Telegram with the launch of Eternity Project – a new malware-as-a-service. The ransomware module offers an option to set a timer that renders the target files completely unrecoverable when it expires.

See the full report here: https://www.bleepingcomputer.com/news/security/eternity-malware-kit-offers-stealer-miner-worm-ransomware-tools/

Zyxel fixes firewall flaws that could lead to hacked networks

A recently patched critical flaw (CVE-2022-30525; CVSS v3 score: 9.8) in Zyxel firewall could have allowed threat actors to gain full access to devices and internal corporate networks. The bug is an unauthenticated remote command injection via the HTTP interface, affecting Zyxel firewalls supporting Zero Touch Provisioning (ZTP).

See the full report here: https://www.bleepingcomputer.com/news/security/zyxel-fixes-firewall-flaws-that-could-lead-to-hacked-networks/

BPFdoor: Stealthy Linux malware bypasses firewalls for remote access

A passive Linux/Unix backdoor called BPFdoor has been targeting Linux and Solaris systems without being noticed for more than five years. The malware reportedly does not need to open ports, can’t be stopped by firewalls, and can respond to commands from any IP address on the web.

See the full report here: https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malware-bypasses-firewalls-for-remote-access/

DEA Investigating Breach of Law Enforcement Data Portal

The U.S. Drug Enforcement Administration (DEA) is reportedly investigating reports that hackers gained login credentials for an authorized user of esp.usdoj.gov, which is the Law Enforcement Inquiry and Alerts (LEIA) system managed by the DEA. Security researchers believe that this access can be used not only to view sensitive information, but also submit false records to law enforcement and intelligence agency databases.

See the full report here: https://krebsonsecurity.com/2022/05/dea-investigating-breach-of-law-enforcement-data-portal/

Europe Agrees to Adopt New NIS2 Directive Aimed at Hardening Cybersecurity

The European Parliament announced a provisional agreement aimed at improving cybersecurity and resilience of both public and private sector entities in the European Union. The revised directive, "NIS2" (network and information systems), sets ground rules, requiring companies in energy, transport, financial markets, health, and digital infrastructure sectors to adhere to risk-management measures and reporting obligations.

See the full report here: https://thehackernews.com/2022/05/europe-agrees-to-adopt-new-nis2.html

SonicWall strongly urges admins to patch SSLVPN SMA1000 bugs

SonicWall advised its customers to patch three security flaws (including the high-severity CVE-2022-22282) affecting the following SMA 1000 Series models: 6200, 6210, 7200, 7210, 8000v (ESX, KVM, Hyper-V, AWS, Azure). SonicWall reportedly found no evidence that these vulnerabilities are being exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-strongly-urges-admins-to-patch-sslvpn-sma1000-bugs/

Microsoft fixes new PetitPotam Windows NTLM Relay attack vector

As part of the May 2022 Patch Tuesday security updates, Microsoft fixed a Windows LSA Spoofing Vulnerability (CVE-2022-26925) that was a previously unfixed vector for the PetitPotam attack. The PetitPotam attack allowed unauthenticated users to use the EfsRpcOpenFileRaw function of the MS-EFSRPC API to force a device to perform NTLM authentication against attacker-controlled servers.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-new-petitpotam-windows-ntlm-relay-attack-vector/

Fake Pixelmon NFT site infects you with password-stealing malware

Threat actors have copied the legitimate pixelmon.club website and created a fake version at pixelmon[.]pw to distribute password-stealing malware. Pixelmon is a popular NFT project with close to 200,000 Twitter followers and over 25,000 Discord members.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/

Italian CERT: Hacktivists hit govt sites in "Slow HTTP" DDoS attacks

Italy's Computer Security Incident Response Team (CSIRT) has disclosed recent DDoS attacks against the country's government, ministry, parliament, and army websites, using the Slow HTTP technique. The pro-Russia Killnet group has claimed responsibility for the attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/italian-cert-hacktivists-hit-govt-sites-in-slow-http-ddos-attacks/

Microsoft: Sysrv botnet targets Windows, Linux servers with new exploits

A new variant of the the Sysrv botnet (Sysrv-K) scans for WordPress configuration files and their backups to steal database credentials, later used to take over the webserver. The botnet is scanning the Internet for vulnerable Windows and Linux enterprise servers and infects them with Monero (XMRig) miners and self-spreader malware payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-sysrv-botnet-targets-windows-linux-servers-with-new-exploits/

Fake Binance NFT Mystery Box bots steal victim's crypto wallets

Threat actors are creating YouTube videos to entice potential victims into downloading and installing Redline malware on their computer, in the guise of Binance NFT Mystery Box bots. Binance mystery boxes are sets of random non-fungible token (NFT) items that people buy, hoping they'll receive a unique or rare item at a bargain price.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-binance-nft-mystery-box-bots-steal-victims-crypto-wallets/

US links Thanos and Jigsaw ransomware to 55-year-old doctor

The U.S. Department of Justice stated that a cardiologist residing in Venezuela created and rented Jigsaw and Thanos ransomware, and also trained cybercriminals on their use. Jigsaw ransomware includes a "Doomsday" counter that will delete a certain number of files from the victims' drives every hour until the ransom is paid, and Thanos is a Ransomware-as-a-Service (RaaS) operation advertised on Russian-speaking hacker forums.

See the full report here: https://www.bleepingcomputer.com/news/security/us-links-thanos-and-jigsaw-ransomware-to-55-year-old-doctor/

Apple emergency update fixes zero-day used to hack Macs, Watches

Apple has released security updates to address a zero-day vulnerability (CVE-2022-22675) that may have been actively exploited. The bug is an out-of-bounds write issue in the AppleAVD (a kernel extension for audio and video decoding) that allows apps to execute arbitrary code with kernel privileges.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-emergency-update-fixes-zero-day-used-to-hack-macs-watches/

CISA warns not to install May Windows updates on domain controllers

Patches for two elevations of privilege vulnerabilities in Windows Kerberos and Active Directory Domain Services (tracked as CVE-2022-26931 and CVE-2022-26923) are reportedly causing authentication problems when deployed on Windows Server domain controllers. So, The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has removed CVE-2022-26925 from its catalog of known exploited vulnerabilities. However, CISA noted that installation of these updates on client Windows devices and non-domain controller Windows Servers will not cause this issue and is still strongly encouraged.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-not-to-install-may-windows-updates-on-domain-controllers/

HTML attachments remain popular among phishing actors in 2022

Statistical data from Kaspersky indicates that using HTML attachments in malicious emails continues to be popular, with 2 million such emails detected in the first four months of 2022. In phishing emails, HTML files are commonly used to redirect users to malicious sites, download files, or to even display phishing forms locally within the browser.

See the full report here: https://www.bleepingcomputer.com/news/security/html-attachments-remain-popular-among-phishing-actors-in-2022/

Ukraine supporters in Germany targeted with PowerShell RAT malware

A free-to-download file "2022-Q2-Bedrohungslage-Ukraine" in the website collaboration-bw[.]de is being used to target pro-Ukraine Germans with a custom PowerShell RAT (remote access trojan).

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-supporters-in-germany-targeted-with-powershell-rat-malware/

Sophos antivirus driver caused BSODs after Windows KB5013943 update

Sophos has released a fix for a known issue triggering blue screens of death (BSODs) on Windows 11 systems running Sophos Home antivirus software after installing the KB5013943 update – due to the hmpalert.sys Windows driver used by Sophos Home. The fix will apply automatically to all impacted systems, with users prompted to restart their devices as soon as the patch is applied.

See the full report here: https://www.bleepingcomputer.com/news/software/sophos-antivirus-driver-caused-bsods-after-windows-kb5013943-update/

Engineering firm Parker discloses data breach after ransomware attack

The Parker-Hannifin Corporation, an Ohio-based corporation specializing in advanced motion and control technologies, announced a data breach exposing employees' personal information after a Conti ransomware attack. The stolen files reportedly included information (personally identifiable information and financial account information) related to current and former employees enrolled in Parker's Group Health Plans and their dependents.

See the full report here: https://www.bleepingcomputer.com/news/security/engineering-firm-parker-discloses-data-breach-after-ransomware-attack/

North Korean devs pose as US freelancers and aid DRPK govt hackers

Skilled I.T. workers from the Democratic People’s Republic of Korea (DPRK) are reportedly targeting freelance jobs at organizations in other countries and, in some instances, using the privileged access gained as contractors to facilitate malicious cyber intrusions. The U.S. Department of State, the U.S. Department of the Treasury, and the Federal Bureau of Investigation (FBI) issued an advisory providing red flag indicators for companies to protect against such intrusions.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-devs-pose-as-us-freelancers-and-aid-drpk-govt-hackers/

Cybersecurity agencies reveal top initial access attack vectors

An joint advisory released by agencies from the United States, Canada, New Zealand, the Netherlands, and the United Kingdom includes guidance to mitigate routinely exploited weak security controls, poor security configurations, and bad security practices. The advisory lists the top ten initial access vectors targeted by malicious actors and preventive measures.

See the full report here: https://www.bleepingcomputer.com/news/security/cybersecurity-agencies-reveal-top-initial-access-attack-vectors/

Hackers can steal your Tesla Model 3, Y using new Bluetooth attack

Security researchers have developed a tool to carry out a Bluetooth Low Energy (BLE) relay attack that bypasses all existing protections to authenticate on target devices. Both the Tesla Model 3 and Model Y use a BLE-based entry system, so the attack could be used to unlock and start the cars.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-steal-your-tesla-model-3-y-using-new-bluetooth-attack/

NVIDIA fixes ten vulnerabilities in Windows GPU display drivers

NVIDIA has released a security update addressing four high-severity and six medium-severity bugs in its GPU drivers, which can lead to denial of service, information disclosure, elevation of privileges, code execution, and other security incidents. The updates are available for Tesla, RTX/Quadro, NVS, Studio, and GeForce software products, covering driver branches R450, R470, and R510.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-fixes-ten-vulnerabilities-in-windows-gpu-display-drivers/

CISA warns admins to patch actively exploited Spring, Zyxel bugs

The Cybersecurity and Infrastructure Security Agency (CISA) has added two more vulnerabilities to its list of actively exploited bugs: a code injection bug (CVE-2022-22947) in the Spring Cloud Gateway library and a command injection flaw (CVE-2022-30525) in Zyxel firmware for business firewalls and VPN devices. Relevant agencies have to fix these flaws by June 6, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-spring-zyxel-bugs/

Hackers target Tatsu WordPress plugin in millions of attacks

Hackers are exploiting a remote code execution vulnerability (CVE-2021-25094) – which has been patched in April 2022 – in the Tatsu Builder plugin for WordPress. Tatsu Builder is a popular plugin that offers template editing features integrated into the web browser.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-tatsu-wordpress-plugin-in-millions-of-attacks/

Russian Conti Ransomware Gang Threatens to Overthrow New Costa Rican Government

The Conti ransomware gang has raised its ransom demand to $20 million in return for a decryption key to unlock the systems of the Costa Rican government, following a cyberattack on April 19. The group claims to have insiders in the government and has threatened to “overthrow the government by means of a cyber attack” if its demands are not met.

See the full report here: https://thehackernews.com/2022/05/russian-conti-ransomware-gang-threatens.html

Chinese "Space Pirates" are hacking Russian aerospace firms

A Chinese hacking group dubbed “Space Pirates” is conducting espionage operations focusing on stealing confidential information from companies in the aerospace field. The APT (advanced persistent threat) group has been seen targeting government agencies and enterprises involved in IT services, aerospace, and electric power industries located in Russia, Georgia, and Mongolia, since at least 2019.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-space-pirates-are-hacking-russian-aerospace-firms/

VMware patches critical auth bypass flaw in multiple products

VMware warned customers to immediately patch a critical authentication bypass vulnerability (CVE-2022-22972) affecting local domain users in multiple products. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate, the company stated.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-patches-critical-auth-bypass-flaw-in-multiple-products/

Microsoft warns of brute-force attacks targeting MSSQL servers

Microsoft warned of brute-forcing attacks targeting internet-exposed and poorly secured Microsoft SQL Server (MSSQL) database servers using weak passwords – using the legitimate sqlps.exe tool as a LOLBin (living-off-the-land binary). To defend their MSSQL servers against such attacks, admins are advised not to expose them to the internet, use a strong admin password that can't be guessed or brute-forced, and place the server behind a firewall.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-brute-force-attacks-targeting-mssql-servers/

Spanish police dismantle phishing gang that emptied bank accounts

The Spanish police has arrested 13 people and investigating seven others for participating in a phishing gang that stole online bank credentials. The gang reportedly stole at least 443,600 Euros ($466,000) from nearly 150 victims as part of these phishing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/spanish-police-dismantle-phishing-gang-that-emptied-bank-accounts/

Critical Jupiter WordPress plugin flaws let hackers take over sites

A set of (patched) bugs, including a critical vulnerability (CVE-2022-1654; CVSS score of 9.9) affect the Jupiter Theme and JupiterX Core plugins for WordPress, and could allow any authenticated user to gain administrative privileges. The only way to address the security problems is to update to the latest available versions as soon as possible or deactivate the plugin and replace the site's theme.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-jupiter-wordpress-plugin-flaws-let-hackers-take-over-sites/

US recovers $15 million from global Kovter ad fraud operation

The U.S. government has recovered over $15 million from Swiss bank accounts belonging to operators behind the “3ve” online advertising fraud scheme. At its peak, the 3ve ad fraud campaign, also known as Eve, infected over 1.7 million devices with the Kovter botnet, a click-fraud malware that would quietly run in the background while connecting to sites to consume advertisements.

See the full report here: https://www.bleepingcomputer.com/news/security/us-recovers-15-million-from-global-kovter-ad-fraud-operation/

DHS orders federal agencies to patch VMware bugs within 5 days

The Cybersecurity and Infrastructure Security Agency (CISA) ordered Federal Civilian Executive Branch (FCEB) agencies today to urgently update or remove VMware products from their networks by May 23 due to an increased risk of attacks. CISA issued the Emergency Directive 22-03 after VMware patched two new vulnerabilities (CVE-2022-22972 and CVE-2022-22973).

See the full report here: https://www.bleepingcomputer.com/news/security/dhs-orders-federal-agencies-to-patch-vmware-bugs-within-5-days/

CISA shares guidance to block ongoing F5 BIG-IP attacks

In a joint advisory, the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) warned admins of active attacks targeting a critical F5 BIG-IP network security vulnerability (CVE-2022-1388). The advisory also features Snort and Suricate signatures to detect compromised systems and detailed incident response recommendations in the event of a breach.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-shares-guidance-to-block-ongoing-f5-big-ip-attacks/

Almost 2 million Texans affected by Texas Department of Insurance data breach

A massive security breach at the Texas Department of Insurance leaked the personal information of almost 2 million Texans for nearly three years, according to a state audit released last week. The personal information of 1.8 million workers who have filed compensation claims — including Social Security Numbers, addresses, dates of birth, phone numbers and information about workers’ injuries — was accessible online to members of the public from March 2019 to January 2022.

See the full report here: https://www.kxan.com/news/texas/almost-2-million-texans-affected-by-texas-department-of-insurance-data-breach/