zerofox logo
Advisories

Threat Intelligence Bulletin: 06/10/2022 - 06/16/2022

|by Alpha Team

banner image

The Underground Economist: Volume 2, Issue 10

Welcome back to The Underground Economist, Volume 2, Issue 10, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of June 10, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Microsoft Patch Tuesday 06/15/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for June 2022 contained 59 vulnerabilities in total, with:

  • 3 vulnerabilities rated as Critical
  • 43 vulnerabilities rated as High

The patched bugs include one zero-day vulnerability known as 'Follina' zero-day vulnerability. Tracked as CVE-2022-30190, the zero-day bug relates to a remote code execution vulnerability affecting the Windows Support Diagnostic Tool (MSDT) when it's invoked using the "ms-msdt:" URI protocol scheme from an application such as Word.

Most notable vulnerabilities

Microsoft has listed one zero-day vulnerability among the bugs fixed in the June Patch Tuesday security update. Known as 'Follina' zero-day vulnerability, the widely-exploited and reported bug is tracked as CVE-2022-30190 in the June update.

The other significant bugs patched in this batch of updates include a Windows Hyper-V Remote Code Execution Vulnerability (CVE-2022-30163), a Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVE-2022-30139), and a Windows Network File System Remote Code Execution Vulnerability (CVE-2022-30136)

CVE-2022-30190

CVE-2022-30190 is a remote code execution vulnerability that is tapped when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.

Discovered in May, this vulnerability was used in attacks that executed malicious PowerShell commands via the Windows Microsoft Diagnostic Tool (MSDT). Threat actors quickly realized its potential and began tapping it in wide-cast phishing attacks that distributed QBot, targeted U.S. government agencies, and targeted Ukrainian media organizations.

On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding this vulnerability and on Tuesday June 14, 2022, Windows updates were issued to address this.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

Reference: https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190

Breaking News: 2022-06-10 - 2022-06-16

Chinese hacking group Aoqin Dragon quietly spied orgs for a decade

Security researchers have discovered a Chinese-speaking threat actor, Aoqin Dragon, that has been conducting cyber-espionage operations on government, education, and telecommunication organizations based in Singapore, Hong Kong, Vietnam, Cambodia, and Australia since at least 2013.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hacking-group-aoqin-dragon-quietly-spied-orgs-for-a-decade/

New Symbiote malware infects all running processes on Linux systems

Security researchers have discovered a Linux malware, Symbiote, that infects all running processes on compromised systems, steals account credentials, and gives its operators backdoor access. It acts as a system-wide parasite, reportedly leaving no identifiable signs of infection even during in-depth inspections.

See the full report here: https://www.bleepingcomputer.com/news/security/new-symbiote-malware-infects-all-running-processes-on-linux-systems/

Bizarre ransomware sells decryptor on Roblox Game Pass store

A ransomware strain called WannaFriendMe (which impersonates the Ryuk ransomware, but is actually a variant of the Chaos ransomware) is selling its decryptor on the Roblox gaming platform using the in-game Robux currency. Roblox is an online kids gaming platform where members can create their own games and monetize them by selling Game Passes.

See the full report here: https://www.bleepingcomputer.com/news/security/bizarre-ransomware-sells-decryptor-on-roblox-game-pass-store/

Vice Society ransomware claims attack on Italian city of Palermo

The Vice Society ransomware group has claimed responsibility for the recent cyber attack on the city of Palermo in Italy and has threatened to publish all stolen documents by June 12, 2022, if the ransom is not paid.

See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-ransomware-claims-attack-on-italian-city-of-palermo/

Dark web sites selling alleged Western weapons sent to Ukraine

Darkweb marketplaces are listing military-grade weapons allegedly sent from Western countries to support the Ukrainian army in the ongoing war. However, it is not yet certain whether these weapons are listed by scammers, pro-Russian disinformation propagators, or someone actually in possession of the military supplies.

See the full report here: https://www.bleepingcomputer.com/news/security/dark-web-sites-selling-alleged-western-weapons-sent-to-ukraine/

Researchers Disclose Critical Flaws in Industrial Access Control System from Carrier

Security researchers have identified eight zero-day vulnerabilities in Carrier's LenelS2 HID Mercury access control system, which is used widely in healthcare, education, transportation, and government facilities. The bugs could be reportedly weaponized by a malicious actor to gain full system control, including the ability to manipulate door locks.

See the full report here: https://thehackernews.com/2022/06/researchers-disclose-critical-flaws-in.html

PyPI package 'keep' mistakenly included a password stealer

PyPI bundles ‘maintain,’ ‘pyanxdns,’ ‘api-res-py’ were located to have a password-stealer and also a backdoor as a result of the existence of harmful ‘demand’ reliance within some variations.

See the full report here: https://www.bleepingcomputer.com/news/security/pypi-package-keep-mistakenly-included-a-password-stealer/

Hello XD ransomware now drops a backdoor while encrypting

Cybersecurity researchers report increased activity of the Hello XD ransomware, whose operators are now deploying an upgraded sample featuring stronger encryption.

See the full report here: https://unit42.paloaltonetworks.com/helloxd-ransomware/

Confluence servers hacked to deploy AvosLocker, Cerber2021 ransomware

Ransomware gangs now target a recently patched and actively exploited remote code execution (RCE) vulnerability affecting Atlassian Confluence Server and Data Center instances for initial access to corporate networks

See the full report here: https://www.bleepingcomputer.com/news/security/confluence-servers-hacked-to-deploy-avoslocker-cerber2021-ransomware/

MIT Researchers Discover New Flaw in Apple M1 CPUs That Can't Be Patched

MIT researchers have discovered a vulnerability in Apple’s M1 chips that can potentially never be fixed, which could allow attackers to break through the chips’ last line of security defences.

See the full report here: https://thehackernews.com/2022/06/mit-researchers-discover-new-flaw-in.html

Personal data of Malaysians for sale online

An Open Systems Intelligence (OSINT) tool available on the publicly accessible Internet, provides data on Malaysian citizens

See the full report here: https://asianews.network/personal-data-of-malaysians-found-on-sale-at-website/

Karakurt data extortion group: US agencies issue joint alert

Joint Cybersecurity Advisory by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Treasury, and the Financial Crimes Enforcement Network (FinCEN) warned businesses about the tactics, techniques, and procedures (TTPs) of the Karakurt data extortion group.

See the full report here: https://www.cisa.gov/uscert/ncas/alerts/aa22-152a

Microsoft: Exchange servers hacked to deploy BlackCat ransomware

BlackCat ransomware affiliates are now attacking Microsoft Exchange servers using exploits targeting unpatched vulnerabilities

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackcat-ransomware/

Chinese 'Gallium' Hackers Using New PingPull Malware in Cyberespionage Attacks

Chinese state-sponsored hacking group Gallium has been spotted using a new remote access trojan against financial institutions and government entities

See the full report here: https://thehackernews.com/2022/06/chinese-gallium-hackers-using-new.html

Microsoft: Ransomware groups, nation-states exploiting Atlassian Confluence vulnerability

Microsoft warns of ransomware groups and nation-state actors exploiting a widespread zero-day vulnerability in all supported versions of Atlassian Confluence Server and Data Center unveiled late last month

See the full report here: https://therecord.media/microsoft-ransomware-groups-nation-states-exploiting-atlassian-confluence-vulnerability/

Emotet Malware Evolves To Steal Data From Chrome Browser

The notorious Emotet malware recently drew further attention for targeting the Google Chrome browser. Researchers observed that the malware now targets Chrome to steal stored data, mainly credit card data.

See the full report here: https://latesthackingnews.com/2022/06/13/emotet-malware-evolves-to-steal-data-from-chrome-browser/

Kaiser Permanente data breach exposes health data of 69K people

Kaiser Permanente, one of America's leading not-for-profit health plans and health care providers, has recently disclosed a data breach that exposed the health information of more than 69,000 individuals.

See the full report here: https://www.bleepingcomputer.com/news/security/kaiser-permanente-data-breach-exposes-health-data-of-69k-people/

Researchers Detail PureCrypter Loader Cyber Criminals Using to Distribute Malware

Cybersecurity researchers have detailed the workings of a fully-featured malware loader dubbed PureCrypter that's being purchased by cyber criminals to deliver remote access trojans (RATs) and information stealers.

See the full report here: https://thehackernews.com/2022/06/researchers-detail-purecrypter-loader.html

Ransomware gang creates site for employees to search for their stolen data

The ALPHV ransomware gang, a.k.a. BlackCat, has created a dedicated website that allows the customers and employees of their victim to check if their data was stolen in an attack

See the full report here: https://krebsonsecurity.com/2022/06/ransomware-group-debuts-searchable-victim-data/

This new Linux rootkit malware is already targeting victims

A new rootkit affecting Linux(opens in new tab) systems has been discovered that is capable of both loading, and hiding, malicious programs

See the full report here: https://www.techradar.com/in/news/this-new-linux-rootkit-malware-is-already-targeting-victims

RansomHouse Group hits African retail major Shoprite Group

The Shoprite Group released a statement announcing a cyberattack. The RansomHouse ransomware group took credit for the attack.

See the full report here: https://therecord.media/large-supermarket-chain-in-southern-africa-hit-with-ransomware/

Microsoft June 2022 Patch Tuesday fixes 1 zero-day, 55 flaws

Microsoft has announced fixes for 55 vulnerabilities, including fixes for the Windows MSDT 'Follina' zero-day vulnerability and new Intel MMIO flaws.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2022-patch-tuesday-fixes-1-zero-day-55-flaws/

Android malware on the Google Play Store gets 2 million downloads

Researchers discover adware and information-stealing malware on the Google Play Store, with at least five still available and having amassed over two million downloads.

See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-on-the-google-play-store-gets-2-million-downloads/

In-CERT flags severe vulnerabilities in four versions of Android

The Indian Computer Emergency Response Team (CERT-In) has found multiple security vulnerabilities in four versions of Google’s Android operating system — 10, 11, 12 and 12L.

See the full report here: https://www.cnbctv18.com/technology/google-android-10-11-12-12l-have-severe-vulnerabilities-according-to-cert-in-13812102.htm

Chinese threat actor employs fake removable devices as lures in cyber-espionage campaign

Researchers spot an China-based APT actor that has been spying on organizations across multiple countries for the past 10 years

See the full report here: https://www.darkreading.com/attacks-breaches/chinese-threat-actor-employs-fake-removable-devices-as-lures-in-cyber-espionage-campaign

Accellion agrees to $8.1 million settlement over data breach

Victims of an ransomware attack that targeted Accelion Inc. asked a federal judge for preliminary approval of a $8.1 million deal with the file-sharing company over a data breach that compromised the sensitive personal data of over 9 million individuals

See the full report here: https://news.bloomberglaw.com/privacy-and-data-security/accellion-agrees-to-8-1-million-settlement-over-data-breach

Dark web brokers sell access to company networks and systems for just $2K

Dark web brokers will sell access to company networks and systems for an average of $2,000 to $4,000, find researchers

See the full report here: https://securelist.com/initial-access-data-price-on-the-dark-web/106740/

Malaysian Hacktivist group DragonForce issues a clarion call to other hackers to target India

Malaysian threat actor group DragonForce has issued a clarion call to other hacking groups, human rights organisations, and activists all around the world to the Anti-India campaign that goes by the hashtag #OpsPatuk.

See the full report here: https://www.timesnownews.com/technology-science/malaysian-hacktivist-group-dragon-force-issues-a-clarion-call-to-other-hackers-to-target-india-article-92227286

Developer directory Travis CI API hit by hackers

The Travis CI API is leaking thousands of user tokens, allowing threat actors easy access to sensitive data in GitHub, AWS, and Docker Hub

See the full report here: https://www.techradar.com/news/another-top-developer-directory-has-been-hit-by-hackers

Hackers now use MetaMask, Coinbase wallet copycats to nab crypto

Hackers have been cloning the wallet interface of reputable applications like MetaMask, Coinbase Wallet, TokenPocket, and imToken

See the full report here: https://coinquora.com/hackers-now-use-metamask-coinbase-wallet-copycats-to-nab-crypto/

Five-star hotel’s business account hacked, customers lose money

The Google Business Account of Hotel Crowne Plaza was hacked by unknown persons between June 2 and June 7

See the full report here: https://www.newindianexpress.com/cities/kochi/2022/jun/16/kerala-5-star-hotels-business-account-hacked-customers-lose-money-2466068.html

Hackers exploit three-year-old Telerik flaws to deploy Cobalt Strike

A threat actor known as ‘Blue Mockingbird’ targets Telerik UI vulnerabilities to compromise servers, install Cobalt Strike beacons, and mine Monero by hijacking system resources.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-three-year-old-telerik-flaws-to-deploy-cobalt-strike/

A ragtag band of hackers is waging cyberwar on Putin’s supply lines

Hackers spoil Russian President Putin's plans to taq Belarus in the war on Ukraine

See the full report here: https://www.bloomberg.com/news/features/2022-06-15/ukraine-war-attracts-belarusian-hackers-in-fight-vs-putin

U.S. luxury resort hit by unusual cyberattack; employee data, guest names posted on public internet

Hackers apparently breached The Allison Inn & Spa, demanding that the property negotiate to keep employee and guest records confidential

See the full report here: https://tdn.com/prominent-oregon-resort-hit-by-unusual-cyberattack-employee-data-guests-names-posted-on-public-internet/article_216ac136-ecd8-11ec-8453-ab5247ba5078.html

Tags: all industries, weekly bulletin, global