Threat Intelligence Bulletin: 06/17/2022

Implications of the Upcoming Uyghur Forced Labor Prevention Act

Product Serial: B-2022-06-17a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides an in-depth analysis on the implications of the Uyghur Forced Labor Prevention Act.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Executive Summary

The Uyghur Forced Labor Prevention Act (UFLPA) goes into effect in the United States on June 21, 2022. The federal law bans goods originating from the Xinjiang Uyghur Autonomous Region (Xinjiang) of China with the aim of ensuring no private or public American enterprises fund forced labor. Activist groups and Western leaders allege China is behind a campaign of repression in Xinjiang, targeting Uyghurs and members of other Muslim minority groups in the region by forcing them into religious indoctrination camps and to work under abusive and harsh labor conditions. While UFLPA only applies to the Xinjiang Region, enforcing it will be difficult. China goes to great lengths to disguise the provenance of its products, and finished products are often made in different regions or countries, which obfuscates their origin. If the United States takes a firm stance on enforcing UFLPA, it could cause supply chain and reputational risks for countless businesses and the wider global economy. China’s USD 500 billion in annual exports to the United States is at risk if regulators determine Uyghur forced labor is used across the global production line. A reciprocal response from China could start a wider trade war with the West, which will face pressure to adopt U.S. positions. This will likely result in ongoing inflation and supply chain problems, which were initially caused by COVID-19 and then worsened by Russia’s war in Ukraine.

Botnet Breach Disclosure: Logs_9Gb.7z

On May 12, 2022, Telegram channel "agg_logs" posted a botnet breach package titled "Logs_9Gb.7z". ZeroFox analyzed the data from 8,525 infected machines and attributed it to at least five (5) malware families. Preliminary analysis suggests that the infections probably occurred between September 2021 through May 2022.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account

Details

On May 12, 2022, ZeroFox detected a an alleged botnet breach package shared on Telegram channel "agg_logs". Preliminary ZeroFox analysis suggests that Redline, Vidar, META, Mars, and Raccoon stealer malware families were used to infect victim machines. The compromised data was extracted from at least 8,525 user machines.

Breach Disclosure: Star Hero

In May 2022, a threat actor posted a data breach package on a Deep Web forum targeting Star Hero, a video-making mobile application for Android platform. The data dump includes 3GB of 46,000 users' account information and plain text passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Details

On May 30, 2022, BreachForums actor "LeakBase" posted an alleged data breach package associated with Star Hero (starhero[.]in), an Indian social media platform to create, share, and discover short videos. ZeroFox discovered that another threat actor "Chucky" shared the same dump in the same forum. ZeroFox extracted 9,342 usernames and/or email addresses. Of this total, an assessed 7,924 records contained plain-text passwords. Other notable compromised data fields include name, gender, and phone number.

Breach Disclosure: Quebec

On June 3, 2022, a threat actor posted a data breach package on a Russian language forum targeting Quebec, the official website of the Gouvernement du Québec. The information obtained from the breach package includes users' names, telephone numbers, email addresses, and physical addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On May 4, 2022, French media outlet ZATAZ reported an alleged data leak from Quebec (quebec[.]ca), a Government information and services page that brings several hundred Québec government websites and services together, operating from Canada. The alleged leak resulted in the exfiltration of at least 190,000 Canadian users information from the site. On June 3, 2022, threat actor "milka" shared what they claimed was the same Québec government data on popular Russian language Dark Web forum, XSS. ZeroFox extracted 192,591 email addresses from this shared leak. Other notable compromised data fields include name, gender, phone number, and address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Treading on the Boundaries: How Pro-Russian Threat Actors are Exacerbating NATO Geopolitical Tensions

Product Serial: B-2022-06-23a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides insight into heightened tensions between NATO, Russia, and pro-Russian threat actors due to the European Union’s ban on the rail transport of EU-sanctioned goods passing through Lithuania from Russia.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00PM (EDT) on June 22, 2022 ; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On June 18, 2022, Lithuanian officials announced their intent to implement the European Union’s (EU) ban on the rail transport of EU-sanctioned goods that pass through Lithuania en route from Russia to the Kaliningrad enclave. Russia has threatened to forcefully respond to the move, though the Lithuanian government has said that they are simply following EU sanctions requirements. On June 21, 2022, pro-Russia cyber threat actor Killnet announced that it had attacked two Lithuanian telecommunications companies and encouraged other pro-Russia groups to target Lithuania in response to the rail transport ban. This issue has also provoked fear among Western observers that Russia could target Lithuania with military action, though this remains highly unlikely given Russia’s reluctance to provoke a collective defense response from NATO enshrined in Article 5 of the Washington Treaty.

Poland has a similar logistical relationship with Kaliningrad; although the country has not yet announced a policy of enforcing Western sanctions on the enclave, the option to do so remains viable as Russian provocations by its proxy Belarus continue along Poland’s border. If Poland pursues a similar policy to Lithuania, it will be seen by Russia as an escalation and risks exposing Polish business and government entities to similar retaliation. Russia has been escalating its retaliatory response against NATO and EU members in recent weeks including cutting off energy supplies and continuing with confrontational military exercises. There have also been similar low-scale cyber actions likely carried out by pro-Russian threat actors against government websites of other EU and NATO members.

Breach Disclosure: Fotor Data Breach

On June 7, 2022, a threat actor on a cybercrime forum posted a data breach package targeting Fotor (fotor[.]com), a free online photo editor. The leaked data dump claims to contain approximately 7,000,000 user records.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 7, 2022, a newly registered threat actor "ougogz" from BreachForums posted a data breach package targeting Fotor (fotor[.]com), an online photo editor operating from Seattle, United States. The threat actor noted that the data dump is from October 14, 2020, which includes approximately 7,000,000 lines of users' personal information. The data dump was also circulated in a Russian Telegram channel "Утечки информации" (translated as "Information leaks"- hxxps[:]//t[.]me/dataleak) on October 19, 2020. From the package shared on BreachForums, ZeroFox extracted 6,954,936 email addresses. No passwords were found in this breach.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Skolkovo Moscow School of Management

On May 18, 2022, a threat actor on a cybercrime forum posted a data breach package targeting Skolkovo Moscow School of Management (skolkovo[.]ru), the largest private business school in Russia. The leaked data dump claims to contain approximately 623,000 user records.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On May 18, 2022, a newly registered threat actor "Addka72424" from the BreachForums posted a data breach package targeting Skolkovo Moscow School of Management (skolkovo[.]ru), a graduate business school located in Moscow, Russia. The threat actor noted that the data dump is approximately from September 2021, which includes 623 thousand records with the personal information of the site users, applicants, and course participants. The data dump was also circulated in a Russian Telegram channel "Утечки информации" ( translated as "Information leaks"- hxxps[:]//t[.]me/dataleak/2606) on May 19, 2022. From the package shared on BreachForums, ZeroFox extracted 393,016 email addresses. Of this total, an assessed 30,849 records contained hashed passwords. Other notable compromised data fields in this package include name, gender, date of birth, and phone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: 529K Crypto Combolists from XSS

On May 20, 2022, a cyber criminal posted a combolist package which claims to contain at least 529,000 emails and passwords on the Russian language forum "XSS". A combolist is a list of compromised login credentials containing users email addresses and passwords. Combolists are often generated by threat actors from a variety of sources to be used in credential stuffing attacks. ZeroFox emphasizes that threat actors often misrepresent the authenticity of some email and password combinations and in some cases completely make up passwords on these lists. From this package, ZeroFox extracted 568,849 email addresses and plain-text passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

A threat actor "Perseus" who is currently banned on the Russian languague forum XSS has posted a combolist package titled "Crypto_529k". ZeroFox extracted 568,849 email addresses from more that 100 uniquie email domains and identified passwords in human readable format.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-06-17 - 2022-06-23

Microsoft 365 function leaves SharePoint, OneDrive files open to ransomware attacks

SharePoint and OneDrive libraries can be encrypted in ransomware attack, researchers say.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/office-365-files-stored-in-the-cloud-vulnerable-to-ransomware-encryption

Another 1.3M patients added to data breach tally of ransomware attack on Eye Care Leaders

Approximately 1.29 million patients of Texas Tech University Health Sciences Center have been added to the ongoing fallout from the Eye Care Leaders ransomware attack and data theft from December 2021

See the full report here: https://www.scmagazine.com/analysis/ransomware/another-1-3m-patients-added-to-data-breach-tally-of-ransomware-attack-on-eye-care-leaders

Ransomware attack on Montrose Environmental Group disrupts lab testing services

Montrose Environmental Group, a US-based provider of environmental services, has revealed it was hit by a ransomware attack last weekend that disrupted its laboratory testing operations.

See the full report here: https://portswigger.net/daily-swig/ransomware-attack-on-montrose-environmental-group-disrupts-lab-testing-services

Customers sue 365 Data Centers over alleged ransomware which caused outage

According to a legal action, 365 Data Centers failed to secure its systems properly, leading to a ranswomware attack which caused a signifiant outage to 365's retail colocation services.

See the full report here: https://www.datacenterdynamics.com/en/news/customers-sue-365-data-centers-over-alleged-ransomware-and-outage/

San Diego family care agrees to $1 million settlement to resolve class action data breach lawsuit

San Diego Family Care, a Californian provider of medical, dental, & mental health services, has agreed to settle a class action lawsuit filed by patients affected by a data breach in 2020.

See the full report here: https://www.hipaajournal.com/san-diego-family-care-agrees-to-1-million-settlement-to-resolve-class-action-data-breach-lawsuit/

This new Android malware bypasses multi-factor authentication to steal your passwords

Cybersecurity researchers uncover MaliBot, a powerful new Android malware. Be careful what you download, and from where.

See the full report here: https://www.zdnet.com/article/this-new-android-malware-bypasses-multi-factor-authentication-to-steal-your-passwords/

Russian RSocks botnet disrupted after hacking millions of devices

An international law-enforcement operation has disrupted the Russian RSocks malware botnet used to hijack millions of computers, Android smartphones, and IoT (Internet of Things) devices worldwide. The botnet was used to convert residential computers into proxy servers, allowing the botnet's customers to use them for malicious activity or to appear as coming from a residential IP address.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-rsocks-botnet-disrupted-after-hacking-millions-of-devices/

QNAP "thoroughly investigating" new DeadBolt ransomware attacks

QNAP has warned customers to update their network-attached storage (NAS) devices to the latest firmware version to defend against a new campaign of attacks pushing DeadBolt ransomware. The company has also advised customers to ensure that their devices are not exposed to remote access over the Internet.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-thoroughly-investigating-new-deadbolt-ransomware-attacks/

New MaliBot Android banking malware spreads as a crypto miner

A new Android banking malware named MaliBot, which poses as a cryptocurrency mining app or the Chrome web browser, is targeting users in Italy and Spain. The distribution of MaliBot takes place via websites that promote cryptocurrency applications in the form of APKs that victims download and install manually.

See the full report here: https://www.bleepingcomputer.com/news/security/new-malibot-android-banking-malware-spreads-as-a-crypto-miner/

Anker Eufy smart home hubs exposed to RCE attacks by critical flaw

Security researchers have discovered three security bugs CVE-2022-21806 (critical; CVSS: 10.0), CVE-2022-26073 (CVSS: 7.4), and CVE-2022-25989 (CVSS: 7.1) in Eufy Homebase 2, Anker’s central smart home device hub. Homebase operates as a central station for Eufy devices, and it connects to the cloud to provide services that enhance the functionality of those products, give users remote control via an app, etc.

See the full report here: https://www.bleepingcomputer.com/news/security/anker-eufy-smart-home-hubs-exposed-to-rce-attacks-by-critical-flaw/

Sophos Firewall zero-day bug exploited weeks before fix

Security researchers have detailed an attack from a Chinese advanced persistent threat (APT) group DriftingCloud that exploited a zero-day vulnerability in Sophos Firewall (CVE-2022-1040) for over three weeks before Sophos released a patch.

See the full report here: https://www.bleepingcomputer.com/news/security/sophos-firewall-zero-day-bug-exploited-weeks-before-fix/

QNAP NAS devices targeted by surge of eCh0raix ransomware attacks

The ech0raix ransomware is targeting vulnerable QNAP Network Attached Storage (NAS) devices. ech0raix (also known as QNAPCrypt) had hit QNAP customers in multiple large-scale waves starting in the middle of 2019, and repeating in 2020 and 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-nas-devices-targeted-by-surge-of-ech0raix-ransomware-attacks/

Android-wiping BRATA malware is evolving into a persistent threat

The threat actor behind BRATA banking trojan has evolved their tactics and improved the malware with information-stealing capabilities. The malware has been updated with new phishing techniques, new classes to request additional permissions on the device, and now also drops a second-stage payload from the command and control (C2) server.

See the full report here: https://www.bleepingcomputer.com/news/security/android-wiping-brata-malware-is-evolving-into-a-persistent-threat/

New phishing attack infects devices with Cobalt Strike

Security researchers have discovered a spam campaign that delivers the “Matanbuchus” malware to drop Cobalt Strike beacons on compromised machines. Matanbuchus is a malware-as-a-service (MaaS) project that launches executables directly into system memory.

See the full report here: https://www.bleepingcomputer.com/news/security/new-phishing-attack-infects-devices-with-cobalt-strike/

Cisco says it won’t fix zero-day RCE in end-of-life VPN routers

Cisco has advised owners of end-of-life Small Business RV routers to upgrade to newer models after disclosing a vulnerability (CVE-2022-20825; CVSS severity rating of 9.8) that will not be patched. The vulnerability impacts four Small Business RV Series models: RV110W Wireless-N VPN Firewall, the RV130 VPN Router, the RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-says-it-won-t-fix-zero-day-rce-in-end-of-life-vpn-routers/

730K WordPress sites force-updated to patch critical plugin bug

WordPress sites using the forms builder plugin Ninja Forms have been force-updated to addresses a critical security vulnerability likely exploited in the wild. The vulnerability is a code injection vulnerability affecting multiple Ninja Forms releases, starting with version 3.0 and up.

See the full report here: https://www.bleepingcomputer.com/news/security/730k-wordpress-sites-force-updated-to-patch-critical-plugin-bug/

New DFSCoerce NTLM Relay attack allows Windows domain takeover

Security researchers have discovered a new DFSCoerce Windows NTLM relay attack that uses MS-DFSNM, Microsoft's Distributed File System, to completely take over a Windows domain. Many organizations utilize Microsoft Active Directory Certificate Services, a public key infrastructure (PKI) service that is used to authenticate users, services, and devices on a Windows domain.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-dfscoerce-ntlm-relay-attack-allows-windows-domain-takeover/

Windows emergency update fixes Microsoft 365 issues on Arm devices

Microsoft has released out-of-band (OOB) Windows updates to address a known issue that would cause Azure Active Directory and Microsoft 365 sign-in issues on Arm devices after installing the June 2022 Patch Tuesday updates. The updates will be automatically installed via Windows Update and can also be downloaded and installed manually via the Microsoft Update Catalog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-emergency-update-fixes-microsoft-365-issues-on-arm-devices/

Flagstar Bank discloses data breach impacting 1.5 million customers

Flagstar Bank, a Michigan-based financial services provider, has informed 1.5 million customers of a data breach (in December 2021) where threat actors accessed sensitive customer details, including full names and social security numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/flagstar-bank-discloses-data-breach-impacting-15-million-customers/

New "BidenCash" site sells your stolen credit card for just 15 cents

A carding site called “BidenCash” is leaking credit card details at cheap prices, to gain popularity. On June 16, BidenCash gave away a CSV file containing names, addresses, telephone numbers, over 3 million email addresses, and over a thousand credit card numbers for free to promote their platform.

See the full report here: https://www.bleepingcomputer.com/news/security/new-bidencash-site-sells-your-stolen-credit-card-for-just-15-cents/

Microsoft 365 credentials targeted in new fake voicemail campaign

A new phishing campaign is using fake voicemail notifications to lure victims into opening a malicious HTML attachment and then steal their Microsoft Office 365 and Outlook credentials. The campaign is targeting people from the military, security software, manufacturing supply chain, healthcare, and pharmaceutical sectors in the United States.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-365-credentials-targeted-in-new-fake-voicemail-campaign/

Google Researchers Detail 5-Year-Old Apple Safari Vulnerability Exploited in the Wild

Security researchers have detailed a bug (CVE-2022-22620; CVSS score: 8.8) in Apple Safari that was exploited in the wild earlier this year. The issue was completely patched when the vulnerability was initially reported in 2013, but was reintroduced three years later during large refactoring efforts, the researchers said.

See the full report here: https://thehackernews.com/2022/06/google-researchers-detail-5-year-old.html

New Hertzbleed side-channel attack affects Intel, AMD CPUs

Security researchers have disclosed a new side-channel attack known as Hertzbleed that allows remote attackers to steal cryptographic keys by observing variations in CPU frequency enabled by dynamic voltage and frequency scaling (DVFS). DVFS is a power management throttling feature used by modern CPUs to ensure that the system doesn't go over thermal and power limits during high loads, as well as to reduce overall power consumption during low CPU loads.

See the full report here: https://www.bleepingcomputer.com/news/security/new-hertzbleed-side-channel-attack-affects-intel-amd-cpus/

Over a Dozen Flaws Found in Siemens' Industrial Network Management System

Cybersecurity researchers have disclosed details about 15 security flaws – tracked from CVE-2021-33722 through CVE-2021-33736 – in Siemens SINEC network management system (NMS). The bugs were addressed by Siemens in version V1.0 SP2 Update 1 as part of patches shipped on October 12, 2021.

See the full report here: https://thehackernews.com/2022/06/over-dozen-flaws-found-in-siemens.html

Cloudflare fixes outage that knocked popular services offline

The internet infrastructure firm Cloudflare has resolved a widespread outage that affected a large number of services and websites dependent on it for about an hour. Cloudflare’s technology powers numerous other sites and services across the internet, and the outage affected a range of different sites (FTX, Discord, Omegle, DoorDash, NordVPN, Feedly, and many more) in many parts of the world.

See the full report here: https://techcrunch.com/2022/06/20/cloudflare-outage-knocks-popular-services-offline/

Microsoft Exchange servers hacked by new ToddyCat APT gang

Security researchers have discovered that an advanced persistent threat (APT) group dubbed ToddyCat has been targeting Microsoft Exchange servers since at least December 2020. The researchers also observed a previously unknown passive backdoor (Samurai) and new trojan malware dubbed Ninja Trojan.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-by-new-toddycat-apt-gang/

Yodel parcel company confirms cyberattack is disrupting delivery

A recent cyberattack has disrupted operations of the U.K.-based Yodel delivery service company, leading to delays in parcel distribution. The company has not published details about the incident but advised its clients to avoid responding to unsolicited communications asking for personal information.

See the full report here: https://www.bleepingcomputer.com/news/security/yodel-parcel-company-confirms-cyberattack-is-disrupting-delivery/

Russian govt hackers hit Ukraine with Cobalt Strike, CredoMap malware

Russian hacking groups are reportedly exploiting the Follina (CVE-2022-30190) vulnerability in new phishing campaigns to install the CredoMap malware and Cobalt Strike beacons – by sending emails containing a malicious document name "Nuclear Terrorism A Very Real Threat.rtf." The payload is an info-stealer that APT28 used against Ukrainian targets in May this year.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-govt-hackers-hit-ukraine-with-cobalt-strike-credomap-malware/

Phishing gang behind millions in losses dismantled by police

European law enforcement officials have dismantled an organised crime group involved in phishing, fraud, scams, and money laundering. The group stole several million euros using banking credentials harvested as part of large-scale email, SMS, and mobile messaging phishing campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-gang-behind-millions-in-losses-dismantled-by-police/

Massive Cloudflare outage caused by network configuration error

Cloudflare suffered an outage yesterday that affected traffic in 19 of its data centers and hundreds of major online platforms and services. This outage was caused by a change that was part of a long-running project to increase resilience in the busiest locations, the company stated.

See the full report here: https://www.bleepingcomputer.com/news/technology/massive-cloudflare-outage-caused-by-network-configuration-error/

Icefall: 56 flaws impact thousands of exposed industrial devices

Fifty-six vulnerabilities – collectively called Icefall – affect operational technology (OT) equipment used in various critical infrastructure environments. These bugs impact devices from ten vendors: Honeywell, Motorola, Omron, Siemens, Emerson, JTEKT, Bentley Nevada, Phoenix Contract, ProConOS, and Yokogawa. Icefall impacts a wide range of devices used in numerous industrial sectors, making them highly attractive especially to state-sponsored adversaries.

See the full report here: https://www.bleepingcomputer.com/news/security/icefall-56-flaws-impact-thousands-of-exposed-industrial-devices/

Updated Emotet banking trojan more effective, proliferates through Excel macros

In its new iteration, Emotet is able to access and use spreadsheets, documents and other Microsoft programs, bypassing entry security.

See the full report here: https://www.scmagazine.com/analysis/malware/updated-emotet-banking-trojan-more-effective-proliferates-through-excel-macros

Google removes photo app from playstore over malware concerns

PIP Pic-Camera Photo Editor has been removed from the Google Play Store over warnings it contains dangerous malware.

See the full report here: https://tickernews.co/google-removes-android-photo-app-over-malware-concerns/

Video game hacked; Items worth $2 million on the line

Counter-Strike: Global Offensive community's most prolific item collector, with an inventory worth over $2 million USD, has had his account hacked.

See the full report here: https://www.gamesradar.com/csgos-biggest-item-collector-has-reportedly-been-hacked-with-dollar2-million-of-items-on-the-line/

NSA shares tips on securing Windows devices with PowerShell

The National Security Agency (NSA) and cyber security centres in the United States (CISA), New Zealand (NZ NCSC), and the United Kingdom (NCSC-UK) issued an advisory recommending system administrators to use PowerShell to prevent and detect malicious activity on Windows machines.

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-shares-tips-on-securing-windows-devices-with-powershell/

Chinese hackers target script kiddies with info-stealer trojan

The Chinese "Tropic Trooper" hacking group is loading a new variant of the Yahoyah trojan into a greyware tool named “SMS Bomber,” which is used for denial of service (DoS) attacks against phones. Such tools are commonly used by beginner threat actors to launch attacks against sites.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-target-script-kiddies-with-info-stealer-trojan/

MEGA fixes critical flaws that allowed the decryption of user data

MEGA, a New Zealand-based cloud storage and file hosting service, has released a security update to address a set of severe vulnerabilities that could have exposed encrypted user data. Researchers had shown that vulnerabilities in the encryption algorithm allowed them to access users' encrypted data. The company claims that there are no signs of user accounts or data being accessed inappropriately, either from insiders or outsiders.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-reveals-cause-behind-this-week-s-microsoft-365-outage/

Critical PHP flaw exposes QNAP NAS devices to RCE attacks

QNAP has warned customers that some of its Network Attached Storage (NAS) devices are vulnerable to attacks exploiting a three-year-old critical PHP vulnerability (CVE-2019-11043). Devices with default configurations are not impacted by the bug, the company stated. To secure the devices, QNAP recommends regularly updating the system to the latest version to benefit from vulnerability fixes.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-php-flaw-exposes-qnap-nas-devices-to-rce-attacks/