Threat Intelligence Bulletin: 06/03/2022 - 06/09/2022

Breaking News: 2022-06-03 - 2022-06-09

Evil Corp switches to LockBit ransomware to evade sanctions

To distance themselves from known tooling and evade the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctions, the Evil Corp cybercrime group is now deploying LockBit ransomware. Another possibility for the switch is that it may provide Evil Corp with enough free resources to develop a new ransomware strain from scratch.

See the full report here: https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-lockbit-ransomware-to-evade-sanctions/

Critical Atlassian Confluence zero-day actively used in attacks

Hackers are actively exploiting a new (unpatched) Atlassian Confluence zero-day vulnerability (CVE-2022-26134). The bug is a critical unauthenticated, remote code execution vulnerability tracked in both Confluence Server and Data Center. Users can make their servers inaccessible by restricting Confluence Server and Data Center instances from the internet or disabling Confluence Server and Data Center instances, till a patch is released.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-now-hacks-corporate-websites-to-show-ransom-notes/

Microsoft blocks Polonium hackers from using OneDrive in attacks

Microsoft has blocked a hacking group Polonium from using the OneDrive cloud storage platform for malicious operations that targeted Israel's critical manufacturing, IT, and defense industry sectors since February 2022. Microsoft urged customers to ensure that Microsoft Defender Antivirus uses the latest security intelligence updates (1.365.40.0 or later) and that multi-factor authentication (MFA) is enforced for all remote connectivity.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-blocks-polonium-hackers-from-using-onedrive-in-attacks/

Chinese LuoYu hackers deploy cyber-espionage malware via app updates

A hacking group LuoYu is infecting victims with WinDealer information stealer malware deployed by switching legitimate app updates with malicious payloads in man-on-the-side attacks. The group actively monitor their targets' network traffic for app update requests linked to popular Asian apps such as QQ, WeChat, and WangWang and replaces them with WinDealer installers.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-luoyu-hackers-deploy-cyber-espionage-malware-via-app-updates/

Conti ransomware targeted Intel firmware for stealthy attacks

Conti ransomware developers had reportedly created proof-of-concept (PoC) code that leveraged Intel’s Management Engine (ME) to overwrite flash and gain SMM (System Management Mode) execution. While the Conti operation appears to have shut down, many of its members have moved to other ransomware operations where they continue to conduct attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-targeted-intel-firmware-for-stealthy-attacks/

Clipminer malware gang stole $1.7M by hijacking crypto payments

Researchers have discovered a large operation of a new cryptocurrency mining malware called Clipminer, which is based on the KryptoCibule malware. The malware has been distributed via game and pirated software cracks, and spread on P2P networks, torrent indexers, or YouTube videos.

See the full report here: https://www.bleepingcomputer.com/news/security/clipminer-malware-gang-stole-17m-by-hijacking-crypto-payments/

Foxconn confirms ransomware attack disrupted production in Mexico

Foxconn electronics manufacturer has confirmed that one of its Mexico-based production plants has been impacted by a ransomware attack, for which LockBit has claimed responsibility. The attacked Foxconn factory is located in Tijuana, Mexico, and is considered a strategic facility that acts a critical supply hub for the California.

See the full report here: https://www.bleepingcomputer.com/news/security/foxconn-confirms-ransomware-attack-disrupted-production-in-mexico/

Exploit released for Atlassian Confluence RCE bug, patch now

A proof-of-concept exploit for the actively exploited Atlassian bug CVE-2022-26134 has been publicly posted. The exploit is being widely spread on social media, with researchers sharing examples of how trivial it is to exploit. Users should install patches to address the security vulnerability in their Confluence or Data Center servers.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-atlassian-confluence-rce-bug-patch-now/

Evasive phishing mixes reverse tunnels and URL shortening services

Reverse tunnel services (such as Ngrok, LocalhostRun, and Cloudflare's Arg0) and URL shorteners (such as Bit.ly, is.gd, and cutt.ly) are being increasingly used in large-scale phishing attacks – instead of registering phishing domains with hosting providers, who are likely to respond to complaints and take down the malicious sites. With reverse tunnels, threat actors can host the phishing pages locally on their own computers and route connections through the external service.

See the full report here: https://www.bleepingcomputer.com/news/security/evasive-phishing-mixes-reverse-tunnels-and-url-shortening-services/

Bored Ape Yacht Club, Otherside NFTs stolen in Discord server hack

Hackers reportedly stole over $257,000 in Ethereum and thirty-two NFTs after the Yuga Lab's Bored Ape Yacht Club and Otherside Metaverse Discord servers were compromised to post a phishing scam. This phishing scam pretended to be an exclusive, limited giveaway for specific NFT holders, and included a link to a webpage that allowed a visitor to mint the free NFT.

See the full report here: https://www.bleepingcomputer.com/news/security/bored-ape-yacht-club-otherside-nfts-stolen-in-discord-server-hack/

SMSFactory Android malware sneakily subscribes to premium services

An Android malware named SMSFactory makes victims send premium text messages and make calls to premium phone numbers, resulting in a waste of money. A variant that can also reportedly steal the contact list on compromised devices.

See the full report here: https://www.bleepingcomputer.com/news/security/smsfactory-android-malware-sneakily-subscribes-to-premium-services/

Novartis says no sensitive data was compromised in cyberattack

Pharmaceutical giant Novartis has stated that no sensitive data was compromised in a recent cyberattack by the Industrial Spy data-extortion gang, even though the gang claims to have stolen data related to RNA and DNA-based drug technology and tests. The group has reportedly started selling data allegedly stolen from Novartis for $500,000 in bitcoins.

See the full report here: https://www.bleepingcomputer.com/news/security/novartis-says-no-sensitive-data-was-compromised-in-cyberattack/

WatchDog hacking group launches new Docker cryptojacking campaign

The WatchDog hacking group is engaging in a new campaign, where it targets exposed Docker Engine API endpoints and Redis servers to mine Monero (XMR) cryptocurrency using victims’ resources.

See the full report here: https://www.bleepingcomputer.com/news/security/watchdog-hacking-group-launches-new-docker-cryptojacking-campaign/

Atlassian fixes Confluence zero-day widely exploited in attacks

Atlassian has released patches for an actively exploited critical zero-day vulnerability in Confluence Server and Data Center (CVE-2022-26134). The Cybersecurity and Infrastructure Security Agency (CISA) has also added the bug to its “Known Exploited Vulnerabilities Catalog.” Customers should upgrade their appliances to versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1, which contain a fix for the bug.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-fixes-confluence-zero-day-widely-exploited-in-attacks/

Microsoft disrupts Bohrium hackers’ spear-phishing operation

The Microsoft Digital Crimes Unit (DCU) has disrupted a spear-phishing operation and taken down 41 domains inked to an Iranian threat actor Bohrium – members of which pose as recruiters and send malware-laden malicious emails to victims.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-disrupts-bohrium-hackers-spear-phishing-operation/

GitLab security update fixes critical account take over flaw

GitLab has released a critical security update for multiple versions of its Community and Enterprise Edition products to address eight vulnerabilities. One of the bugs (CVE-2022-1680) has a severity score of 9.9. All GitLab users should move to the latest available versions as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/gitlab-security-update-fixes-critical-account-take-over-flaw/

Unpatched Critical Flaws Disclosed in U-Boot Bootloader for Embedded Devices

Two unpatched security bugs (CVE-2022-30790 – CVSS score: 9.6; CVE-2022-30552 – CVSS score: 7.1) have been disclosed in the open-source U-Boot boot loader. U-Boot is a boot loader used in Linux-based embedded systems such as ChromeOS as well as ebook readers such as Amazon Kindle and Kobo eReader.

See the full report here: https://thehackernews.com/2022/06/unpatched-critical-flaws-disclosed-in-u.html

CISA Warned About Critical Vulnerabilities in Illumina's DNA Sequencing Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Food and Drug Administration (FDA) have issued an advisory about five critical security flaws – CVE-2022-1517 (CVSS score: 10.0); CVE-2022-1518 (CVSS score: 10.0); CVE-2022-1519 (CVSS score: 10.0); CVE-2022-1521 (CVSS score: 9.1); CVE-2022-1524 (CVSS score: 7.4) – in Illumina's next-generation sequencing (NGS) software. While there is no evidence that the flaws are being exploited in the wild, it's recommended that customers apply the software patch released by Illumina last month to mitigate any potential risk.

See the full report here: https://thehackernews.com/2022/06/cisa-warned-about-critical.html

Windows zero-day exploited in US local govt phishing attacks

Local governments in at least two U.S. states were targeted by a phishing campaign using malicious Rich Text Format (RTF) documents designed to exploit a critical Windows zero-day vulnerability (CVE-2022-30190, a.k.a. Follina). The attackers used salary increase promises to bait employees to open the lure documents, which would deploy a Powershell script as the final payload.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-zero-day-exploited-in-us-local-govt-phishing-attacks/

QBot now pushes Black Basta ransomware in bot-powered attacks

Security researchers have discovered a new partnership between Qakbot and Black Basta ransomware gang, with Black Basta using the Windows malware to spread laterally throughout a victim network. The Qakbot trojan has varying attack pathways, each with its own opportunities for detection, but they all begin with the arrival of a malicious email. So, avoiding opening attachments or clicking on embedded links in suspicious emails is a good tactic to stay protected.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-now-pushes-black-basta-ransomware-in-bot-powered-attacks/

Mandiant: “No evidence” we were hacked by LockBit ransomware

Cybersecurity firm Mandiant is investigating the LockBit ransomware gang's claims that it hacked the company's network, and stated that no evidence has been found yet to support the gang’s claims. The LockBit ransomware gang claimed on its data leak site that 356,841 files from Mandiant will be leaked online. However, what it posted instead was a note announcing that it is independent and not linked to the Evil Corp (Maksim Yakubets) group – which Mandiant researchers recently claimed.

See the full report here: https://www.bleepingcomputer.com/news/security/mandiant-no-evidence-we-were-hacked-by-lockbit-ransomware/

Italian city of Palermo shuts down all systems to fend off cyberattack

The municipality of Palermo in Southern Italy suffered a cyberattack that took its services, public websites, and online portals offline. Italy had recently received threats from the Killnet group, a pro-Russian hacktivist that attacks countries that support Ukraine in the ongoing war.

See the full report here: https://www.bleepingcomputer.com/news/security/italian-city-of-palermo-shuts-down-all-systems-to-fend-off-cyberattack/

New "DogWalk" Windows zero-day bug gets free unofficial patches

0patch has released free unofficial patches for a Windows zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT) dubbed DogWalk. This path traversal vulnerability affects all Windows versions

See the full report here: https://www.bleepingcomputer.com/news/security/new-dogwalk-windows-zero-day-bug-gets-free-unofficial-patches/

US seizes SSNDOB market for selling personal info of 24 million people

A joint operation between the U.S. Federal Bureau of Investigation, the Internal Revenue Service, the Department of Justice, and the Cyprus Police helped shut down SSNDOB, an online marketplace that sold the names, social security numbers, and dates of birth of approximately 24 million American people.

See the full report here: https://www.bleepingcomputer.com/news/security/us-seizes-ssndob-market-for-selling-personal-info-of-24-million-people/

US: Chinese govt hackers breached telcos to snoop on network traffic

Chinese-backed threat actors have compromised major telecommunications companies and network service providers to steal credentials and harvest data, reported a joint advisory by U.S. federal agencies. The agencies advised organizations to apply security patches as soon as possible, disable unnecessary ports and protocols to shrink their attack surface, and replace end-of-life network infrastructure that no longer receives security patches, among other defensive measures.

See the full report here: https://www.bleepingcomputer.com/news/security/us-chinese-govt-hackers-breached-telcos-to-snoop-on-network-traffic/

New SVCReady malware loads from Word doc properties

Security researchers have discovered a malware loader SVCReady – which uses VBA macro code to execute shellcode stored in the properties of a Word document that arrives on the target as an email attachment.

See the full report here: https://www.bleepingcomputer.com/news/security/new-svcready-malware-loads-from-word-doc-properties/

Qbot malware now uses Windows MSDT zero-day in phishing attacks

TA570, a Qbot affiliate, is exploiting the Follina (CVE-2022-30190) Windows security flaw to deploy Qbot malware via malicious Microsoft Office .docx documents in an ongoing phishing campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-malware-now-uses-windows-msdt-zero-day-in-phishing-attacks/

Linux version of Black Basta ransomware targets VMware ESXi servers

Security researchers have observed new Black Basta ransomware binaries specifically targeting VMWare ESXi servers. Black Basta thus becomes the latest ransomware gang – after others such as LockBit, HelloKitty, BlackMatter, REvil, AvosLocker, RansomEXX, and Hive – to add support for encrypting VMware ESXi virtual machines (VMs) running on enterprise Linux servers.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-version-of-black-basta-ransomware-targets-vmware-esxi-servers/

Online gun shops in the US hacked to steal credit cards

Two American gun shops, Rainier Arms and Numrich Gun Parts, that operate e-commerce sites have disclosed data breaches resulting from card skimmer infections on their sites.

See the full report here: https://www.bleepingcomputer.com/news/security/online-gun-shops-in-the-us-hacked-to-steal-credit-cards/

Shields Health Care Group data breach affects 2 million patients

Shields Health Care Group (Shields) suffered a data breach that exposed the data of approximately two million people (including personal and medical data) in the United State. Shield became aware of the cyberattack on March 28, 2022, and hired cybersecurity specialists to determine the scope of the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/shields-health-care-group-data-breach-affects-2-million-patients/

Massive Facebook Messenger phishing operation generates millions

A massive phishing operation is tricking millions of Facebook and Messenger users into clicking on phishing pages, entering their account credentials, and seeing advertisements.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-facebook-messenger-phishing-operation-generates-millions/

Emotet malware now steals credit cards from Google Chrome users

The Emotet botnet is deploying a credit card stealer to harvest credit card information stored in Google Chrome user profiles. Emotet is known for dropping Qbot and Trickbot malware trojan payloads on victims' compromised computers, which are used to deploy additional malware, including Cobalt Strike beacons and different ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-credit-cards-from-google-chrome-users/

Cuba ransomware returns to extorting victims with updated encryptor

Security researchers have observed the Cuba ransomware group deploying a new version of its malware in recent attacks. The malware now terminates processes including Outlook, MS Exchange, and MySQL before encryption – to prevent those applications from locking files and preventing them from being encrypted. Cuba ransomware has no available decryptor that victims can use to recover their files for free.

See the full report here: https://www.bleepingcomputer.com/news/security/cuba-ransomware-returns-to-extorting-victims-with-updated-encryptor/

Poisoned CCleaner search results spread information-stealing malware

A powerful information stealer is being distributed in the guise of a pirated copy of CCleaner Pro Windows, in a malware campaign dubbed FakeCrack. The malware can harvest personal data and cryptocurrency assets and route internet traffic through data-snatching proxies.

See the full report here: https://www.bleepingcomputer.com/news/security/poisoned-ccleaner-search-results-spread-information-stealing-malware/

Linux botnets now exploit critical Atlassian Confluence bug

Several botnets are targeting a critical remote code execution vulnerability (CVE-2021-26084) to infect Linux servers running unpatched Atlassian Confluence Server and Data Center installs. After proof-of-concept exploits were published online, cybersecurity researchers detected an almost ten-fold increase in active exploitation, with over 200 IP addresses attempting to exploit it.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-botnets-now-exploit-critical-atlassian-confluence-bug/