The Underground Economist: Volume 2, Issue 9

Welcome back to The Underground Economist, Volume 2, Issue 6, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of May 27, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Follina Vulnerability

Product Serial: F-2022-06-01a

TLP: WHITE

In this report, ZeroFox Intelligence provides a brief look at CVE-2022-30190, a vulnerability in the Microsoft Support Diagnostic Tool (MSDT) protocol handler.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on June 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On May 27, 2022, security researcher “nao_sec” shared a malicious Word document that had been discovered taking advantage of Windows’ Microsoft Support Diagnostic Tool (MSDT). The document abused Microsoft Word’s ability to load remote document templates to retrieve a HTML file from a web server. The retrieved HTML document contained embedded JavaScript to trigger ms-msdt protocol via a window.location.href reference to execute a PowerShell script. PowerShell is a cross-platform command line interpreter and scripting language created by Microsoft that is installed by default in Windows. This vulnerability, dubbed “Follina,” has been used in the wild. For example, a known Chinese APT, TA413, has been observed exploiting Follina while impersonating the “Women Empowerments Desk” of the Central Tibetan Administration.

Breaking News: 2022-05-27 - 2022-06-02

Critical "Pantsdown" BMC Vulnerability Affects QCT Servers Used in Data Centers

Security researchers have disclosed that the "Pantsdown" Baseboard Management Controller (BMC) flaw (CVE-2019-6260; CVSS score: 9.8) can affect Quanta Cloud Technology (QCT) servers. A baseboard management controller is a specialized system used for remote monitoring and management of servers, including controlling low-level hardware settings as well as installing firmware and software updates.

See the full report here: https://thehackernews.com/2022/05/critical-pantsdown-bmc-vulnerability.html

Intuit warns of QuickBooks phishing threatening to suspend accounts

Tax software vendor Intuit has warned QuickBooks customers that they are being targeted in an ongoing series of phishing attacks impersonating the company and trying to lure them with fake account suspension warnings. Intuit advised its customers who received such phishing messages not to click any embedded links or open attachments.

See the full report here: https://www.bleepingcomputer.com/news/security/intuit-warns-of-quickbooks-phishing-threatening-to-suspend-accounts/

OAS platform vulnerable to critical RCE and API access flaws

The Open Automation Software (OAS) platform versions 16.00.0112 and below are vulnerable to a range of high and critical severity bugs – including CVE-2022-26833 (CVSS severity rating of 9.4). The OAS platform is a widely used data connectivity solution that unites industrial devices (PLCs, OPCs, Modbus), SCADA systems, IoTs, network points, custom applications, custom APIs, and databases under one system.

See the full report here: https://www.bleepingcomputer.com/news/security/oas-platform-vulnerable-to-critical-rce-and-api-access-flaws/

Zyxel warns of flaws impacting firewalls, APs, and controllers

Zyxel has highlighted four medium-severity flaws (CVE-2022-26531, CVE-2022-26531, CVE-2022-26532, and CVE-2022-0910) in its firewall, Access Point (AP), and AP controller products. Network admins should upgrade their devices as soon as possible to patch these flaws.

See the full report here: https://www.bleepingcomputer.com/news/security/zyxel-warns-of-flaws-impacting-firewalls-aps-and-controllers/

Industrial Spy data extortion market gets into the ransomware game

The Industrial Spy data extortion marketplace has launched its own ransomware operation. Industrial Spy started as a new data extortion marketplace called Industrial Spy that allowed threat actors, and possibly even business competitors, to purchase data stolen from companies. The data offered for sale ranged from “premium” data for millions of dollars to individual files for $2.

See the full report here: https://www.bleepingcomputer.com/news/security/industrial-spy-data-extortion-market-gets-into-the-ransomware-game/

New ERMAC 2.0 Android malware steals accounts, wallets from 467 apps

The ERMAC Android banking trojan has released version 2.0, increasing the number of applications targeted from 378 to 467 and covering a much wider range of apps to steal account credentials and crypto wallets. The first malware campaign utilizing the new ERMAC 2.0 malware is a fake Bolt Food application targeting the Polish market.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ermac-20-android-malware-steals-accounts-wallets-from-467-apps/

Microsoft shares mitigation for Windows KrbRelayUp LPE attacks

Microsoft has shared guidance on protecting Windows enterprise environments from KrbRelayUp attacks that enable attackers to gain SYSTEM privileges on Windows systems with default configurations. Microsoft stated that this privilege escalation tool doesn't work against organizations with cloud-based Azure Active Directory environments.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shares-mitigation-for-windows-krbrelayup-lpe-attacks/

Clop ransomware gang is back, hits 21 victims in a single month

The Clop ransomware group added 21 new victims to its data leak site in April 2022, after its operations seemed to remain halted for several months. However, researchers aren’t sure whether this is a sign of the group’s comeback or a part of shutdown operations (wherein a ransomware gang would likely publish the data of all previously unpublished victims).

See the full report here: https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/

FBI warns of hackers selling credentials for U.S. college networks

The Federal Bureau of Investigation (FBI) has issued an alert about Russian cybercriminal forums selling usernames and passwords giving access to colleges and universities based in the United States. Credential harvesting against an organization is often a byproduct of spear-phishing, ransomware, or other cyber intrusion tactics, the FBI stated.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-selling-credentials-for-us-college-networks/

GitHub: Attackers stole login details of 100K npm user accounts

GitHub has revealed that an attacker stole the login details of roughly 100,000 npm accounts during a mid-April security breach, with the help of stolen OAuth app tokens issued to Heroku and Travis-CI. After the breach was discovered, GitHub, Travis CI, and Heroku revoked all OAuth tokens to block further hacking attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/github-attackers-stole-login-details-of-100k-npm-user-accounts/

Microsoft finds severe bugs in Android apps from large mobile providers

Security researchers have discovered high-severity vulnerabilities (CVE-2021-42598, CVE-2021-42599, CVE-2021-42600, and CVE-2021-42601) in a mobile framework owned by mce Systems, and used by Android apps from several large international mobile service providers. The vulnerable apps reportedly come pre-installed as system applications on devices from several telecommunications operators, including AT&T, TELUS, Rogers Communications, Bell Canada, and Freedom Mobile.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-finds-severe-bugs-in-android-apps-from-large-mobile-providers/

BlackCat/ALPHV ransomware asks $5 million to unlock Austrian state

The ALPHV ransomware gang offered to provide a working decryption tool for $5 million, after attacking the Austrian federal state Carinthia. The state press representative stated that there is currently no evidence that BlackCat actually managed to steal any data from the state's systems and that the plan is to restore the machines from available backups.

See the full report here: https://www.bleepingcomputer.com/news/security/blackcat-alphv-ransomware-asks-5-million-to-unlock-austrian-state/

EnemyBot malware adds exploits for critical VMware, F5 BIG-IP flaws

New variants of EnemyBot incorporate exploits for 24 vulnerabilities, including CVE-2022-22954 (a critical remote code execution bug affecting VMware Workspace ONE Access and VMware Identity Manager) and CVE-2022-1388 (another critical remote code execution flaw affecting F5 BIG-IP). Patching software products as soon as updates become available and monitoring network traffic, including outbound connections, are some of the days to defend our networks and systems against such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/enemybot-malware-adds-exploits-for-critical-vmware-f5-big-ip-flaws/

Italy warns organizations to brace for incoming DDoS attacks

Italian cybersecurity officials have warned people of signs and threats of imminent attacks against various organizations in Italy, after the pro-Russia group Killnet threatened massive and unprecedented attacks against the country. Killnet announced “Operation Panopticon” last week, calling for 3,000 "cyber fighters" to volunteer.

See the full report here: https://www.bleepingcomputer.com/news/security/italy-warns-organizations-to-brace-for-incoming-ddos-attacks/

Three Nigerians arrested for malware-assisted financial crimes

Three Nigerian men have been arrested for the suspected use of remote access trojans (RATs), including Agent Tesla, to reroute financial transactions and steal account credentials. Agent Tesla is a RAT that serves as a powerful information-stealer and keylogger that can steal credentials stored in web browsers, email clients, FTP, and other software.

See the full report here: https://www.bleepingcomputer.com/news/security/three-nigerians-arrested-for-malware-assisted-financial-crimes/

New Microsoft Office zero-day used in attacks to execute PowerShell

A new Microsoft Office zero-day bug, dubbed “Follina,” is being used to execute malicious PowerShell commands via Microsoft Diagnostic Tool (MSDT) simply by opening a Word document. This zero-day opens the door to a new critical attack vector leveraging Microsoft Office programs as it works without elevated privileges, bypasses Windows Defender detection, and does not need macro code to be enabled to execute binaries or scripts.

See the full report here: https://www.bleepingcomputer.com/news/security/new-microsoft-office-zero-day-used-in-attacks-to-execute-powershell/

Google quietly bans deepfake training projects on Colab

Google has banned deepfake projects on its Colaboratory (Colab) service – which allows researchers to run Python code directly through the browser while using free computing resources to power their projects. Many users were reportedly using pre-trained models with Colab to jump-start their high-resolution deepfake projects. Deepfakes can be trained to swap faces on video clips, adding realistic facial expressions to make the fake result appear genuine.

See the full report here: https://www.bleepingcomputer.com/news/technology/google-quietly-bans-deepfake-training-projects-on-colab/

New "GoodWill" Ransomware Forces Victims to Donate Money and Clothes to the Poor

A new ransomware strain called GoodWill claims to be interested in helping the less fortunate, rather than extorting victims for financial motivations. Its multiple-paged ransom note requires victims to carry out three socially-driven activities to be able to obtain the decryption kit. There are no known victims of GoodWill and their exact tactics, techniques, and procedures (TTPs) used to facilitate the attacks are unclear as yet.

See the full report here: https://thehackernews.com/2022/05/new-goodwill-ransomware-forces-victims.html

Over 3.6 million MySQL servers found exposed on the Internet

Cybersecurity analysts have found 3.6 million exposed MySQL servers using the default port, TCP port 3306. Failing to secure MySQL database servers can result in data breaches, destructive attacks, ransom demands, remote access trojan (RAT) infections, or even Cobalt Strike compromises.

See the full report here: https://www.bleepingcomputer.com/news/security/over-36-million-mysql-servers-found-exposed-on-the-internet/

Costa Rica’s public health agency hit by Hive ransomware

All computer systems on the network of Costa Rica's public health service were reportedly offline following a Hive ransomware attack. The incident comes after Costa Rica declared a national emergency following Conti ransomware attacks that hit multiple government bodies, including the Costa Rican Social Security Fund (CCSS).

See the full report here: https://www.bleepingcomputer.com/news/security/costa-rica-s-public-health-agency-hit-by-hive-ransomware/

Hanesbrands discloses ransomware attack

American multinational clothing company Hanesbrands has disclosed a cyberattack that occured on May 24, 2022. Forensic investigation and assessment of the impact of this event are ongoing, the company stated.

See the full report here: https://journalnow.com/business/local/hanesbrands-discloses-ransomware-attack-its-unclear-whether-company-paid-the-ransom/article_6e5cdc1a-e0e7-11ec-ab26-a389c6b692c7.html

Microsoft shares mitigation for Office zero-day exploited in attacks

Microsoft has shared mitigation measures to block attacks exploiting a newly discovered Microsoft Office zero-day flaw (CVE-2022-30190) abused in the wild to execute malicious code remotely. Users can block attacks exploiting the bug by disabling the MSDT URL protocol, which malicious actors use to launch troubleshooters and execute code on vulnerable systems.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-office-zero-day-exploited-in-attacks/

Voting software in some states is vulnerable to hacking, U.S. cyber agency says

Electronic voting machines from a leading vendor used in at least 16 American states have software vulnerabilities that leave them susceptible to hacking if unaddressed, the U.S. Cybersecurity and Infrastructure Agency has reportedly stated in an advisory.

See the full report here: https://fortune.com/2022/05/31/voting-software-vulnerable-hacking/

Hackers steal WhatsApp accounts using call forwarding trick

Malicious actors could hijack a victim’s WhatsApp account and gain access to personal messages and contact list – using mobile carriers’ automated service to forward calls to a different phone number, and WhatsApp’s option to send a one-time password (OTP) verification code via voice call.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-whatsapp-accounts-using-call-forwarding-trick/

Windows MSDT zero-day now exploited by Chinese APT hackers

The China-linked TA413 APT group is reportedly using the Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution flaw (CVE-2022-30190) in attacks against the international Tibetan community. The campaigns impersonate the “Women Empowerments Desk” of the Central Tibetan Administration and use the domain tibet-gov.web[.]app.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-msdt-zero-day-now-exploited-by-chinese-apt-hackers/

FBI warns of Ukrainian charities impersonated to steal donations

The Federal Bureau of Investigation (FBI) has warned the public of fraudulent schemes seeking donations or other financial assistance related to the crisis in Ukraine. These scams involve crooks impersonating the Ukrainian government, the Ukraine Crisis Relief Fund, the Act for Peace, and UNICEF.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-ukrainian-charities-impersonated-to-steal-donations/

New XLoader botnet uses probability theory to hide its servers

A new version of the XLoader botnet malware uses probability theory to hide its command and control servers. This helps the malware operators continue using the same infrastructure without the risk of losing nodes due to blocks on identified IP addresses while also reducing the chances of being tracked and identified.

See the full report here: https://www.bleepingcomputer.com/news/security/new-xloader-botnet-uses-probability-theory-to-hide-its-servers/

Hackers steal a ‘very large’ batch of private data from Australia’s disability scheme

Hackers have stolen medical records and other sensitive information belonging to participants of Australia’s National Disability Insurance Scheme.

See the full report here: https://www.vice.com/en/article/88gwjv/hackers-have-stolen-a-very-large-batch-of-private-data-from-australias-disability-scheme

SideWinder Hackers Launched Over a 1,000 Cyber Attacks Over the Past 2 Years

An advanced persistent threat (APT) group known as SideWinder (a.k.a. Rattlesnake or T-APT-04) has been linked to over 1,000 attacks since April 2020. It has targeted targeting military, defense, aviation, IT, and legal firms in Afghanistan, Bangladesh, Nepal, and Pakistan, and is expanding to other countries, including Singapore.

See the full report here: https://thehackernews.com/2022/05/sidewinder-hackers-launched-over-1000.html

FBI seizes domains used to sell stolen data, DDoS services

The U.S. government announced the seizure of three domains used for selling personal information stolen in data breaches and provide DDoS attack services – WeLeakInfo.to, ipstress.in, and ovh-booter.com. The domains were seized following a joint law enforcement operation in coordination with the National Police Corps of the Netherlands and the Federal Police of Belgium.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-seizes-domains-used-to-sell-stolen-data-ddos-services/

New Windows Search zero-day added to Microsoft protocol nightmare

A new Windows Search zero-day vulnerability can be used to automatically open a search window containing remotely-hosted malware executables simply by launching a Word document. Threat actors can abuse this bug to create elaborate phishing campaigns that automatically launch Windows Search windows on recipients' devices to trick them into launching malware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-windows-search-zero-day-added-to-microsoft-protocol-nightmare/

Hundreds of Elasticsearch databases targeted in ransom attacks

Security researchers have identified more than 450 cases of ransom demands after threat actors attacked exposed Elasticsearch databases. No database should be public-facing unless it’s essential for their role. Moreover, if remote access is required, admins should set up multi-factor authentication for authorized users and restrict access to relevant individuals only.

See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-elasticsearch-databases-targeted-in-ransom-attacks/

US govt: Paying Karakurt extortion ransoms won’t stop data leaks

Several U.S. federal agencies warned organizations today against paying ransom demands made by the Karakurt gang, which is the the data extortion arm of the Conti ransomware gang. In a joint advisory, the agencies provided detailed information on the tactics used by Karakurt operators during all attack stages, indicators of compromise, and mitigation measures to prevent or block their hacking attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-paying-karakurt-extortion-ransoms-won-t-stop-data-leaks/

RuneScape phishing steals accounts and in-game item bank PINs

Cybersecurity researchers have discovered a new RuneScape-themed phishing campaign that targets players of both the Old School and the standard (RuneScape 3) editions via a fake email change notice.

See the full report here: https://www.bleepingcomputer.com/news/security/runescape-phishing-steals-accounts-and-in-game-item-bank-pins/

Windows MSDT zero-day vulnerability gets free unofficial patch

The 0patch micropatching service has released free and unofficial micropatches for some versions of Windows impacted by the Follina security bug (CVE-2022-30190). 0patch has added sanitization of the user-provided path (currently missing in the Windows script) to avoid rendering the Windows diagnostic wizardry inoperable across the OS for all applications.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-msdt-zero-day-vulnerability-gets-free-unofficial-patch/

New Unpatched Horde Webmail Bug Lets Hackers Take Over Server by Sending Email

An unpatched security vulnerability (CVE-2022-30287) in the open-source Horde Webmail client could be exploited to achieve remote code execution on the email server by sending a specially crafted email to a victim.

See the full report here: https://thehackernews.com/2022/06/new-unpatched-horde-webmail-bug-lets.html

FluBot Android Spyware Taken Down in Global Law Enforcement Operation

An international law enforcement operation involving 11 countries has reportedly been successful in taking down the mobile malware threat called FluBot. The malware primarily spread via SMS-based phishing messages that trick unsuspecting recipients into clicking on a link to download the malware-laced apps.

See the full report here: https://thehackernews.com/2022/06/flubot-android-spyware-taken-down-by.html