Threat Intelligence Bulletin: 05/20/2022 - 05/26/2022

Russia-Ukraine Conflict: Situational Updates

Product Serial: B-2022-05-26b

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 26, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The Russia-enforced blockade of Ukraine’s Black Sea coast has prevented Ukraine from exporting an estimated 20 million tons of grain, and European Union (EU)-proposed plans to circumvent the blockade face significant short-term obstacles. Ukrainian and Russian leaders dismissed an Italian peace proposal, and Ukrainian President Volodymyr Zelensky compared suggestions that Ukraine give up Crimea to the appeasement of Nazi Germany. Russian forces in the Donbas are likely close to surrounding Severodonetsk and have successfully broken Ukrainian lines around Popasna.

Anticipated Ramifications of Expanded NATO Membership

Product Serial: B-2022-05-26a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides an analysis of the anticipated ramifications of expanded NATO membership.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Executive Summary

On May 18, 2022, Finland and Sweden both formally submitted their applications to join the North Atlantic Treaty Organization (NATO) at its headquarters in Brussels; their successful ascension would double the length of NATO’s border with Russia. Both countries will now enter a formal application process that requires all NATO members' approval. The process could take six to 12 months. NATO members, led by the United States and the United Kingdom, have promised to protect Finland and Sweden during the application process. Russia threatened immediate retaliation, including unspecified military-technical measures over the applications. NATO enlargement was cited as one of the primary reasons for Russia’s war in Ukraine, and Russia is opposed to the bloc gaining new members, particularly along its 800-mile border with Finland. Russia could use military, economic, political, or cyber measures to decentivize non-NATO members from joining the military alliance.

Union of European Football Associations (UEFA) Champions League Final

A-2022-05-25a

TLP: GREEN

In this assessment, ZeroFox Intelligence provides an in-depth analysis of possible physical and cyber security concerns associated with the 2022 UEFA Champions League Final.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full assessment here.

Executive Summary

The 2022 UEFA Champions League Final (“the Final”) between Liverpool Football Club (FC) and Real Madrid will take place at 8:00 PM on May 28, 2022, at Stade de France in Paris, France. The Final’s move from Russia to France over Russia’s invasion of Ukraine increases the likelihood of Russian-affiliated cyber and political proxies finding ways to disrupt the match, amplify negative messaging, and promote more direct, violent action. Additionally, ZeroFox Intelligence assesses that major violent protests in the run-up to the Final are unlikely; however, the wave of election-related protests across Paris could exacerbate any peaceful march or protests pertaining to the most recent change to the Champions League format. Although ZeroFox Intelligence has not observed any chatter in Clear, Deep, or Dark Web platforms calling for the circumvention of security measures in place at Stade de France, ZeroFox posits that any operational systems with internet connectivity at the Stade de France venue are susceptible to a disruptive cyber attack.

Key Points

• The Final’s move from Russia to France in late February 2022 over Russia’s invasion of Ukraine makes the event a likely target of Russian cyber threat actors, who also reportedly targeted the 2018 final in Kyiv. Scenes of pro-Ukraine solidarity are expected at the event, although there are no Ukrainian or Russian players. Russian-affiliated threat actor groups have recently attempted to disrupt European competitions but have not expressed intent to target the Final as of this writing.
• ZeroFox Intelligence assesses that major physical protests at the Final are unlikely; however, they are possible given the wave of election-related protests across Paris each weekend during the election cycle and recent protests across stadiums in Europe against UEFA for attempts to change the Champions League format. Liverpool supporters have been among the most vocal opponents of previous non-UEFA reforms.
• Although ZeroFox Intelligence has not observed any chatter in Clear, Deep, or Dark Web platforms calling for the circumvention of security measures in place at Stade de France, ZeroFox posits that any operational systems with internet connectivity at the Stade de France venue are susceptible to a disruptive cyber attack. A compromise of an Internet of Things (IoT)-connected lighting system has perhaps the most potential to disrupt the Final.
• Although no chatter about planned terrorist attacks has been identified, lone-wolf attackers are of the utmost concern. One form of inspiration could be the ongoing trial of Abdeslam, which attracts widespread media attention on key dates.

Breaking News: 2022-05-20 - 2022-05-26

Conti ransomware shuts down operation, rebrands into smaller units

The Conti ransomware gang is splintering into smaller semi-autonomous and autonomous groups, and has partnered with other smaller ransomware operations, including HelloKitty, AvosLocker, Hive, BlackCat, and BlackByte. The smaller ransomware gangs gain an influx of experienced Conti pentesters, negotiators, and operators, while the Conti syndicate gains mobility and greater evasion of law enforcement by splitting into smaller cells, managed by central leadership.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-shuts-down-operation-rebrands-into-smaller-units/

Netgear fixes bad Orbi firmware update that locked admin console

Netgear is rolling out patches to affected customers to resolve issues affecting the Orbi RBK85x and RBK75x Series Mesh WiFi 6 Systems. The company has not provided any details as to what caused the issue in the first place.

See the full report here: https://www.bleepingcomputer.com/news/technology/netgear-fixes-bad-orbi-firmware-update-that-locked-admin-console/

Microsoft emergency updates fix Windows AD authentication issues

Microsoft has released emergency out-of-band (OOB) updates to address Active Directory (AD) authentication issues after installing Windows Updates issued during the May 2022 Patch Tuesday on domain controllers. These OOB Windows updates are available only via the Microsoft Update Catalog and will not be offered through Windows Update.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-emergency-updates-fix-windows-ad-authentication-issues/

Media giant Nikkei’s Asian unit hit by ransomware attack

The Nikkei group has disclosed that its headquarters in Singapore was hit by a ransomware attack on May 13, 2022. Nikkei Group Asia immediately shut down the affected server and took other measures to minimize the impact, and is currently investigating if the attackers accessed any customer data.

See the full report here: https://www.bleepingcomputer.com/news/security/media-giant-nikkei-s-asian-unit-hit-by-ransomware-attack/

Microsoft detects massive surge in Linux XorDDoS malware activity

The XorDDoS malware has seen a 254% increase in activity during the past six months. XorDDoS is known for targeting a wide range of Linux system architectures, from ARM (IoT) to x64 (servers), and compromising vulnerable ones in SSH brute-force attacks. Its evasion capabilities include obfuscating the malware's activities, evading rule-based detection mechanisms and hash-based malicious file lookup, as well as using anti-forensic techniques to break process tree-based analysis

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-detects-massive-surge-in-linux-xorddos-malware-activity/

U.S. DOJ will no longer prosecute ethical hackers under CFAA

The U.S. Department of Justice (DOJ) has announced new policies under which software testing, investigation, security flaw analysis, and network breaches intended to promote the security and safety of the target devices or services are not to be prosecuted by federal prosecutors. The policy does not give a pass to hacking under the pretense of conducting security research while using that research to extort companies.

See the full report here: https://www.bleepingcomputer.com/news/security/us-doj-will-no-longer-prosecute-ethical-hackers-under-cfaa/

Lazarus hackers target VMware servers with Log4Shell exploits

The North Korean hacking group Lazarus has been targeting vulnerable VMware products via Log4Shell (CVE-2021-44228) since April 2022. The threat actors exploit the vulnerability through Vmware Horizon’s Apache Tomcat service to execute a PowerShell command – ultimately installing the NukeSped backdoor on the server.

See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-target-vmware-servers-with-log4shell-exploits/

Microsoft Teams, Windows 11 hacked on first day of Pwn2Own

On the first day of Pwn2Own Vancouver 2022, contestants successfully exploited 16 zero-day bugs to hack multiple products, including Microsoft's Windows 11 operating system and the Teams communication platform.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-teams-windows-11-hacked-on-first-day-of-pwn2own/

QNAP alerts NAS customers of new DeadBolt ransomware attacks

QNAP, the Taiwan-based network-attached storage (NAS) manufacturer, urged all NAS users to check and update QTS to the latest version as soon as possible, and avoid exposing their NAS to the internet – to guard against ongoing attacks pushing DeadBolt ransomware payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-alerts-nas-customers-of-new-deadbolt-ransomware-attacks/

High-Severity Bug Reported in Google's OAuth Client Library for Java

Google addressed a high-severity flaw (CVE-2021-22573, rated 8.7 out of 10) in its OAuth client library for Java, which relates to an authentication bypass in the library that stems from an improper verification of the cryptographic signature. Users of the google-oauth-java-client library are recommended to update to version 1.33.3, released on April 13, 2022, to mitigate any potential risk.

See the full report here: https://thehackernews.com/2022/05/high-severity-bug-reported-in-googles.html

Ransomware attack exposes data of 500,000 Chicago students

The Chicago Public School (CPS) district has disclosed that a ransomware attack (in December 2021) on its vendor, Battelle for Kids, exposed the stored data of 495,448 students and 56,138 employees in its school system. The data stored on Battelle for Kids' servers was for school years 2015 through 2019 and exposed students' personal information and assessment scores.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-exposes-data-of-500-000-chicago-students/

Malicious PyPI package opens backdoors on Windows, Linux, and Macs

Threat actors uploaded a malicious package named “pymafka” onto PyPI – which is a repository of open-source packages that developers can use to share their work or benefit from the work of others. The typo-squatted package (sounding similar to PyKafka, a widely used Apache Kafka client) reached a download count of 325 before it got removed.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-pypi-package-opens-backdoors-on-windows-linux-and-macs/

PDF smuggles Microsoft Word doc to drop Snake Keylogger malware

Security researchers have discovered PDFs being used as a transport for documents with malicious macros that download and install information-stealing malware on victim's machines. The deployed shellcode exploits CVE-2017-11882, a remote code execution bug in Equation Editor fixed in November 2017 but still available for exploitation in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/pdf-smuggles-microsoft-word-doc-to-drop-snake-keylogger-malware/

Google: Predator spyware infected Android devices using zero-days

State-backed threat actors reportedly used zero-day exploits targeting Chrome and the Android OS to install Predator spyware implants on fully up-to-date Android devices. The government-backed malicious actors who purchased and used these exploits to infect Android targets with spyware are from Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia, according to Google's analysis.

See the full report here: https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/

Cisco urges admins to patch IOS XR zero-day exploited in attacks

Cisco has addressed a zero-day vulnerability (CVE-2022-20821) in its IOS XR router software that allowed unauthenticated attackers to remotely access Redis instances running in NOSi Docker containers. The IOS XR Network OS is deployed on multiple Cisco router platforms, including NCS 540 & 560, NCS 5500, 8000, and ASR 9000 series routers.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-urges-admins-to-patch-ios-xr-zero-day-exploited-in-attacks/

Backdoor baked into premium school management plugin for WordPress

Security researchers have discovered a backdoor in a premium WordPress plugin, School Management (published by Weblizar), which enables a threat actor to execute PHP code without authenticating. The plugin is a complete solution that comes with an Android and iOS app to provide various access levels to users such as admins, teachers, accountants, students, parents, librarians, and receptionists.

See the full report here: https://www.bleepingcomputer.com/news/security/backdoor-baked-into-premium-school-management-plugin-for-wordpress/

Russian Sberbank says it’s facing massive waves of DDoS attacks

Russia's banking and financial services company Sberbank is being targeted in a wave of DDoS attacks – following the Russian invasion of Ukraine. Sberbank reportedly repelled the biggest DDoS attack it ever encountered, measured at 450GB/sec, on May 6, 2022. Sberbank is Russia's largest financial company and the third-largest in Europe, with total assets counting over $570 billion.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-sberbank-says-it-s-facing-massive-waves-of-ddos-attacks/

Canada bans Huawei and ZTE from 5G networks over security concerns

After a thorough review from Canada's independent security agencies, the Government of Canada announced its intention to ban the use of Huawei and ZTE telecommunications equipment and services across the country's 5G and 4G networks. The government expressed concerns about Huawei and ZTE being potentially compelled to comply with extrajudicial directions from foreign governments in ways that would conflict with Canadian laws or would be detrimental to Canadian interests.

See the full report here: https://www.bleepingcomputer.com/news/security/canada-bans-huawei-and-zte-from-5g-networks-over-security-concerns/

Fake Windows exploits target infosec community with Cobalt Strike

A threat actor published two proof-of-concept exploits on GitHub for the Windows CVE-2022-24500 and CVE-2022-26809 vulnerabilities on GitHub. However, these proof-of-concept exploits were fake and installed Cobalt Strike beacons on people's devices.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/

GM credential stuffing attack exposed car owners' personal info

U.S. car manufacturer General Motors disclosed that it detected malicious login activity between April 11 and April 29, 2022, and confirmed that hackers redeemed customer reward points for gift cards in some cases. However, these breaches are reportedly not a result of General Motors being hacked but rather are caused by a wave of credential stuffing attacks targeting customers.

See the full report here: https://www.bleepingcomputer.com/news/security/gm-credential-stuffing-attack-exposed-car-owners-personal-info/

Photos of abused victims used in new ID verification scam

Users on online dating apps are being approached by catfishing profiles who ask the users to prove that they are not a former sex offender by subscribing to fake verification services. When approached by a scammer or a dubious profile, users should follow the steps set out by the legitimate dating platform to report the suspicious user to the platform.

See the full report here: https://www.bleepingcomputer.com/news/security/photos-of-abused-victims-used-in-new-id-verification-scam/

Hackers can hack your online accounts before you even register them

Security researchers have analyzed 75 popular online services and found that at least 35 are vulnerable to account pre-hijacking attacks. A successful attack could allow the attacker to read/modify sensitive information associated with the account (e.g., messages, billing statements, usage history, etc.) or perform actions using the victim's identity. To deal with the risk of pre-hijacked accounts, users can immediately set up MFA (multi-factor authentication) on their accounts, which should also force all previous sessions to be invalidated.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-hack-your-online-accounts-before-you-even-register-them/

New RansomHouse group sets up extortion market, adds first victims

A new data-extortion operation named RansomHouse has appeared on the darknet, with the Saskatchewan Liquor and Gaming Authority (SLGA) apparently being its first victim. The new operation claims not to use any ransomware and instead focuses on breaching networks through alleged vulnerabilities to steal a target's data.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomhouse-group-sets-up-extortion-market-adds-first-victims/

Russian hackers perform reconnaissance against Austria, Estonia

In a new reconnaissance campaign, the Russian hacking group Turla (believed to have strong ties to Russia’s FSB) was observed targeting the Austrian Economic Chamber, a NATO platform, and the Baltic Defense College.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-perform-reconnaissance-against-austria-estonia/

Trend Micro fixes bug Chinese hackers exploited for espionage

Trend Micro has patched a DLL (Dynamic Link Library) hijacking flaw in Trend Micro Security used by a Chinese threat group (Moshen Dragon) to side-load malicious DLLs and deploy malware. Any user with an active internet connection should receive the update shortly if they have not yet already received it, the company stated.

See the full report here: https://www.bleepingcomputer.com/news/security/trend-micro-fixes-bug-chinese-hackers-exploited-for-espionage/

Researchers to release exploit for new VMware auth bypass, patch now

Security researchers have managed to create a working proof-of-concept (PoC) exploit code for a VMware bug (CVE-2022-22972) and will likely release a technical report at the end of the week. The flaw affects VMware Workspace ONE Access, Identity Manager, and vRealize Automation, and attackers with access to the appliance interface can use it to bypass authentication to reach local domain users.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-to-release-exploit-for-new-vmware-auth-bypass-patch-now/

DuckDuckGo browser allows Microsoft trackers due to search agreement

Security researchers have discovered that the DuckDuckGo Privacy Browser allowed Microsoft trackers to continue running in specific sites, while blocking Google and Facebook trackers. The company stated that the browser intentionally allows Microsoft trackers in specific sites because of a search syndication agreement.

See the full report here: https://www.bleepingcomputer.com/news/security/duckduckgo-browser-allows-microsoft-trackers-due-to-search-agreement/

Hackers target Russian govt with fake Windows updates pushing RATs

A previously undetected APT (advanced persistent threat) group, believed to be operating from China, is targeting Russian government agencies with phishing emails to install remote access malware. The attacks were conducted between February and April 2022, via four separate spear-phishing campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-russian-govt-with-fake-windows-updates-pushing-rats/

CISA adds 41 vulnerabilities to list of bugs used in cyberattacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added 41 vulnerabilities to its catalog of known exploited flaws. Two prominent bugs in the list are a Cisco IOS XR vulnerability (CVE-2022-20821) and two Android Linux Kernel flaws (CVE-2021-1048 and CVE-2021-0920). CISA has instructed federal agencies to apply security updates for the Android and Cisco vulnerabilities by June 13, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-41-vulnerabilities-to-list-of-bugs-used-in-cyberattacks/

US Senate: Govt’s ransomware fight hindered by limited reporting

The U.S. federal government lacks comprehensive data on ransomware attacks and use of cryptocurrency in ransom payments, a report published by the Chairman of the Senate Homeland Security and Governmental Affairs Committee stated. The report is the result of an investigation into how cryptocurrency facilitates cybercrime and the increase of ransomware attacks in recent years.

See the full report here: https://www.bleepingcomputer.com/news/security/us-senate-govt-s-ransomware-fight-hindered-by-limited-reporting/

Popular Python and PHP libraries hijacked to steal AWS keys

A popular PyPI package “ctx” has been compromised sometime this month, with newly published malicious versions exfiltrating developers’ environment variables to an external server. “ctx” is a minimal Python module that lets developers manipulate their dictionary objects in a variety of ways.

See the full report here: https://www.bleepingcomputer.com/news/security/popular-python-and-php-libraries-hijacked-to-steal-aws-keys/

New Chaos Ransomware Builder Variant "Yashma" Discovered in the Wild

Cybersecurity researchers have disclosed details of Yashma, the sixth version (v6.0) of the Chaos ransomware line. Chaos is a customizable ransomware builder that emerged in underground forums in mid 2021.

See the full report here: https://thehackernews.com/2022/05/new-chaos-ransomware-builder-variant.html

Screencastify Chrome extension flaws allow webcam hijacks

The Screencastify Chrome extension has fixed a cross-site scripting (XSS) vulnerability that allowed malicious sites to hijack users' webcams and steal recorded videos. However, security researchers claim that the bug could still allow an employee or compromised site to silently record videos from Screencastify users’ devices.

See the full report here: https://www.bleepingcomputer.com/news/security/screencastify-chrome-extension-flaws-allow-webcam-hijacks/

New Zoom Flaws Could Let Attackers Hack Victims Just by Sending them a Message

Zoom has resolved four security vulnerabilities (CVE-2022-22784, CVE-2022-22785, CVE-2022-22786, and CVE-2022-22787) which could be exploited to compromise a user over chat – by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages – and execute malicious code. Users are recommended to update to the latest version (5.10.0) to mitigate any potential threats arising out of active exploitation of the flaws.

See the full report here: https://thehackernews.com/2022/05/new-zoom-flaws-could-let-attackers-hack.html

BPFDoor malware uses Solaris vulnerability to get root privileges

The threat actor (Red Menshen) behind the BPFdoor malware for Linux and Solaris leveraged an old vulnerability (CVE-2019-3010) to achieve persistence on targeted systems. BPFDoor – a recently discovered custom backdoor that was undetected but in use for at least five years – can't be stopped by firewalls; it can function without opening any ports and does not need a command and control server as it can receive commands from any IP address on the web.

See the full report here: https://www.bleepingcomputer.com/news/security/bpfdoor-malware-uses-solaris-vulnerability-to-get-root-privileges/

Tails 5.0 Linux users warned against using it "for sensitive information"

After two critical zero-day bugs in the Firefox JavaScript engine (CVE-2022-1802 and CVE-2022-1529) were exploited in Pwn2Own 2022 Vancouver, developers of the Tails Linux distro advised users – who use Tor Browser for sensitive information – not to use Tails until the release of version 5.1 (on May 31). While the bugs have been patched by Mozilla, the developers cannot deliver patches until the next release, as Tails is a live Linux distro.

See the full report here: https://www.bleepingcomputer.com/news/security/tails-50-linux-users-warned-against-using-it-for-sensitive-information/

New "Cheers" Linux ransomware targets VMware ESXi servers

A new ransomware named Cheers is targeting vulnerable VMware ESXi servers, with each encrypted file having a “.Cheers” extension appended to its filename. VMware ESXi is a virtualization platform commonly used by large organizations worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cheers-linux-ransomware-targets-vmware-esxi-servers/

New ChromeLoader malware surge threatens browsers worldwide

The ChromeLoader malware – used to target both Windows and macOS systems so as to manipulate Chrome and Safari web browsers and redirect user traffic to advertising sites – is witnessing a surge in detection. ChromeLoader is a browser hijacker that can modify the victim's web browser settings to show search results that promote unwanted software, fake giveaways and surveys, and adult games and dating sites.

See the full report here: https://www.bleepingcomputer.com/news/security/new-chromeloader-malware-surge-threatens-browsers-worldwide/

Darknet market Versus shuts down after hacker leaks security flaw

Versus, a popular darknet market, has shut down operations after a hacker leaked a PoC (proof of concept) on how to access the file system of the site's server on Dread, a darknet social media space. Versus had launched three years ago and offered drugs, coin mixing, hacking services, stolen payment cards, and exfiltrated databases.

See the full report here: https://www.bleepingcomputer.com/news/security/darknet-market-versus-shuts-down-after-hacker-leaks-security-flaw/

Hacker says hijacking libraries, stealing AWS keys was ethical research

A hacker (or security researcher) stated that his recent hijack of the Python and PHP libraries, “ctx” and “PHPass,” was a bug bounty exercise and no malicious activity was intended. The claimed rationale for stealing the AWS tokens was to demonstrate the maximum impact of the exploit.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-says-hijacking-libraries-stealing-aws-keys-was-ethical-research/

SpiceJet airline passengers stranded after ransomware attack

SpiceJet has informed its customers that an attempted ransomware attack – which its IT team reportedly managed to defeat – has impacted some of its systems and caused delays to flight departure timings.

See the full report here: https://www.bleepingcomputer.com/news/security/spicejet-airline-passengers-stranded-after-ransomware-attack/

Interpol arrests alleged leader of the SilverTerrier BEC gang

Nigerian police have arrested a person believed to be leading a prominent business email compromise (BEC) group known as SilverTerrier or TMT. The SilverTerrier BEC group used various aliases to register more than 240 domain names, 50 of them serving as command and control servers for malware such as ISRStealer, Pony, and LokiBot.

See the full report here: https://www.bleepingcomputer.com/news/security/interpol-arrests-alleged-leader-of-the-silverterrier-bec-gang/

Mozilla fixes Firefox, Thunderbird zero-days exploited at Pwn2Own

Mozilla has released security updates to address zero-day vulnerabilities (CVE-2022-1802 and CVE-2022-1529) exploited during the Pwn2Own Vancouver 2022 hacking contest. The zero-days have been fixed in Firefox 100.0.2, Firefox ESR 91.9.1, Firefox for Android 100.3, and Thunderbird 91.9.1.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-thunderbird-zero-days-exploited-at-pwn2own/