Threat Intelligence Bulletin: 06/24/2022

Breach Disclosure: Jardinerie Lardon

On April 20, 2022, a user of the XSS forum posted a data breach package targeting Jardinerie Lardon, a gardening company in France. The data dump was from July 22, 2020, and included a database with 56,064 lines of user information. The data dump was also circulated on other deep web forums and platforms. From this package, ZeroFox extracted 23,118 email addresses and 22,804 associated passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

In July 2022, the French gardening company Jardinerie Lardon suffered a data breach. On April 20, 2022, a threat actor called "Amunet" from the Russian-speaking forum XSS posted a package related to the Jardinerie Lardon data breach, containing 56,064 lines of user information. The same breach package was also posted on various other forums, such as Leet (on Jun 16, 2022, by the threat actor "hacxx"), BreachForums (on April 23, 2022, by the threat actor "copy") and a Telegram channel named "Data Leak Monitor" (on April 20, 2022). From this package, ZeroFox extracted 23,118 email addresses and found that 22,804 records contained plain-text passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Raccoon Stealer Version 2.0

Product Serial: B-2022-06-30a

TLP: WHITE

After the group's initial hiatus, Raccoon Stealer has returned with a brand new version 2.0. In this briefing, ZeroFox Intelligence provides a technical analysis of this new version.

Standing Intelligence Requirements

MAL

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Executive Summary

On June 4, 2022, ZeroFox Intelligence discovered a then-unknown information stealer being distributed by ProCrackerz, a website distributing fake software cracks and key generators (keygens). The earliest known instance of this information stealer observed by ZeroFox Intelligence was a sample uploaded to VirusTotal on April 19, 2022. Twitter user @James_inthe_box suggested the name “Recordbreaker” for it based on the use of “record” as the User-Agent string in each sample. In May 2022, logs for sale with “Raccoon Stealer V2.0” branding were discovered that matched what ZeroFox Intelligence was observing with Recordbreaker. Due to this and multiple other private confirmations, ZeroFox Intelligence asserts with MEDIUM confidence that Raccoon Stealer has returned and that Recordbreaker is actually Raccoon Stealer version 2.0.

Details

Raccoon Stealer version 2.0 is capable of targeting Chromium and Mozilla-based browsers by looking for well-known file names in specific directories. For Chromium-based browsers, threat actors using Raccoon Stealer 2.0 have the ability to specify a list of Chrome extension IDs and associated files as well. In ZeroFox Intelligence’s observations, these consisted entirely of cryptocurrency extensions. Raccoon Stealer 2.0 attempts to collect credentials, cookies, autofill data, credit cards, and data associated with specified Chrome extensions. For Mozilla browsers such as Firefox, only credentials, cookies, and autofill data were targeted. Other applications like Telegram and specific cryptocurrency applications can be targeted as well. To ensure that all cryptocurrency wallets are collected, a separate function exists solely to collect “wallet.dat” files. For any applications or files without specific support, a generic “grbr_” function exists to allow actors to specify files by path and a name or pattern.

Breach Disclosure: MGM Resorts

On May 22, 2022, a the Telegram Channel "Kingsman" posted a data breach package targeting MGM Resorts, a hotel and entertainment company operating in multiple locations and headquartered from Las Vegas, Nevada, United States. The data dump was also shared in BreachForums on May 20, 2022. The same data leak information was also shared in BreachForums on May 31, 2022 by the threat actor "beniaretz". From this package, ZeroFox extracted 24,836,265 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

MGM Resorts, a hotel and entertainment company headquartered in Las Vegas, United States, faced a data breach. On May 22, 2022, the Telegram Channel "Kingsman" posted a data package relating to this breach. The data dump was shared through four separate files. The data dump was also shared on BreachForums on May 20, 2022, by the threat actor "Calssara," who noted that the data dump is from July 2019. The same data leak was also shared on BreachForums on May 31, 2022, by the threat actor "beniaretz." The threat actor "beniaretz" from BreachForums noted that the data dump was initially stolen from the breach monitoring website DataViper via NightLion's online handle on July 14, 2020, and it which includes 8.7GB (142,479,938 records) with user information such as full name, date of birth, phone number and email address. From this package, ZeroFox extracted 24,836,265 email addresses. No passwords were found in this breach.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 2, Issue 11

Welcome back to The Underground Economist, Volume 2, Issue 11, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of June 24, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Breach Disclosure: BidenCash

On June 16, 2022, an actor "BidenCash" from the Russian-speaking forum XSS posted a data breach package titled "BidenCash - 7.9m card holders leak! BANK NAME + HOLDER NAME + ADDRESS." From this package, ZeroFox extracted 3,080,233 email addresses. No passwords were found in the breach. Notable compromised data fields in this package include name, address, phone number, and bank name.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

An actor ("BidenCash") has leaked data from what they claim to be 7.9 million card holders, on the underground forum called XSS. From this package, ZeroFox extracted 3,080,233 email addresses. The headers in the breached data package include name, address, city, state, country, phone, pin code, email, bank, issuer, class, and type.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Telegram Users' Data Leak

On June 5, 2022, a threat actor "youling11" from the Russian-speaking deep web forum XSS posted a data leak package titled "13 550 555 Telegram users." From this package, ZeroFox extracted 1,077,483 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package include name and phone number.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

A user on XSS, a Russian-speaking underground forum, shared a package contaning names, phone numbers, and email addresses, and other fields – with the filename "13 550 555 Telegram users." ZeroFox extracted 1,077,483 email addresses from the package.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: PurePC

On May 27, 2022, a user "Kuant" on BreachForums posted a data breach package targeting the organization PurePC, a Poland-based news and media site covering technological innovations. The user noted that the data dump includes more than 125,000 users' information. The data dump was also circulated in a deep web forum Leakbase on May 28, 2022, by the threat actor "XenForo". From the package shared on BreachForums, ZeroFox extracted 125,575 email addresses and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

After a data breach in a Poland-based technology news website called PurePC, threat actors circulated the stolen data on several internet forums popular among the digital underground, such as BreachForums and Leakbase. From BreachForums, ZeroFox extracted email addresses, usernames, and hashed passwords of 125,575 subscribers to the site.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: T-Mobile

On May 8, 2022, a threat actor "nightly" from the Russian-speaking deep web forum XSS posted a data breach package targeting the organization T-Mobile, a wireless communications network operator in the United States. The threat actor noted that the data dump includes user account information, call details, and mobile device information. From this package, ZeroFox extracted 39,271 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

T-Mobile, the wireless communications giant and provider of 4G LTE and 5G networks, faced a data breach. The breached data contained employment details (such as job titles and dates of employment), names, email addresses, and other personal details of people working with T-Mobile. The data was circulated on underground forums, and ZeroFox discovered it being shared by a user "nightly" on the Russian-speaking forum XSS. From this package, ZeroFox extracted 39,271 email addresses.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Dryice Solutions Data

On June 7, 2022, a threat actor "fight" from the Russian language deep web forum XSS posted a data breach package targeting the organization Dryice Solutions, an IT services and consulting company specialised in iOS, Android application development services and web application development services operating from Lalitpur, Nepal. The threat actor noted that the data dump is from the year 2017. The data dump was also circulated in BreachForums on June 10, 2022 by the threat actor "Copy". From the package shared on XSS forum, ZeroFox extracted 20,541 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Dryice Solutions, Nepal based IT services and consulting fell victim of a data breach. The stolen data was circulating on multiple underground forums. ZeroFox discovered the data from a threat actor "fight" sharing the data on XSS, a Russian language speaking forum. The same data is also found available with another threat actor "Copy" in BreachForums on June 10, 2022. ZeroFox extracted 20,541 usernames, email addresses, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-06-24 - 2022-06-30

Spyware vendor works with ISPs to infect iOS and Android users

Security researchers have observed instances of spyware vendors collaborating with internet service providers (ISPs) to infect people’s phones with commercial surveillance tools. RCS Labs, an Italian spyware vendor, has reportedly received help from some ISPs to infect Android and iOS users in Italy and Kazakhstan with surveillance tools.

See the full report here: https://www.bleepingcomputer.com/news/security/spyware-vendor-works-with-isps-to-infect-ios-and-android-users/

Scalper bots out of control in Israel, selling state appointments

Operators of scalper bots in Israel are attempting to sell appointments for a range of government agencies for over $100, including passport renewal, the Israeli Ministry of Interior, the Ministry of Transport, National Insurance, Israel Post, and the Israeli state Electricity Company. There’s no easy fix for this, as the state would have to scrap the current online platform, cancel many legitimate appointments, and generally create a highly problematic situation.

See the full report here: https://www.bleepingcomputer.com/news/security/scalper-bots-out-of-control-in-israel-selling-state-appointments/

CISA: Log4Shell exploits still being used to hack VMware servers

CISA warned today that threat actors, including state-backed hacking groups, are still targeting VMware Horizon and Unified Access Gateway (UAG) servers using the Log4Shell (CVE-2021-44228) remote code execution vulnerability. Organizations that haven't yet patched their VMware servers are advised to tag them as hacked and start incident response (IR) procedures.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-log4shell-exploits-still-being-used-to-hack-vmware-servers/

Lithuania warns of rise in DDoS attacks against government sites

The National Cyber Security Center (NKSC) of Lithuania has issued a public warning about a steep increase in distributed denial of service (DDoS) attacks directed against public authorities in the country. Russian hackers hit Lithuanian sites with DDoS attacks after the country’s government imposed a limited goods transportation blockade between Russia and the Kaliningrad exclave as part of EU sanctions.

See the full report here: https://www.bleepingcomputer.com/news/security/lithuania-warns-of-rise-in-ddos-attacks-against-government-sites/

Malicious Windows "LNK" attacks made easy with new Quantum builder

Researchers have spotted a new tool for creating malicious LNKs called Quantum, to deliver payloads for the initial stages of an attack. LNKs are Windows shortcut files that can contain malicious code to abuse legitimate tools on the system, the so-called living-off-the-land binaries (LOLBins). Analysis of recent LNK samples captured in the wild indicates that notorious APT gangs like Lazarus might be using Quantum for their attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-windows-lnk-attacks-made-easy-with-new-quantum-builder/

Automotive hose maker Nichirin hit by ransomware attack

Nichirin-Flex U.S.A, a subsidiary of the Japanese hose maker Nichirin, was hit by a ransomware attack on June 14, 2022, causing the company to take the network offline. Customers should expect delays in getting their orders since the cyberattack also affected product distribution and orders are being fulfilled manually. The U.S. network segment remains isolated from the rest of Nichirin's infrastructure, and there are no signs that the ransomware actors were able to pivot outside of it.

See the full report here: https://www.bleepingcomputer.com/news/security/automotive-hose-maker-nichirin-hit-by-ransomware-attack/

New MetaMask phishing campaign uses KYC lures to steal passphrases

A new phishing campaign is targeting users on Microsoft 365 while spoofing the popular MetaMask cryptocurrency wallet provider and attempting to steal recovery phrases. MetaMask recovery phrases, or seeds, are a series of 12 words that users can use to import an existing crypto wallet on other devices. The phishing email, appearing to be sent from MetaMask support, spoofs a Know Your Customer (KYC) verification request and features convincing branding and no typos or other obvious scam giveaways.

See the full report here: https://www.bleepingcomputer.com/news/security/new-metamask-phishing-campaign-uses-kyc-lures-to-steal-passphrases/

Chinese hackers use ransomware as decoy for cyber espionage

Security researchers have observed two clusters of hacking activity "Bronze Riverside" (APT41) and "Bronze Starlight" (APT10), both using the HUI Loader to deploy remote access trojans, PlugX, Cobalt Strike, and QuasarRAT. These Chinese hacking groups are conducting cyber espionage and stealing intellectual property from Japanese and western companies are deploying ransomware as a decoy.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-ransomware-as-decoy-for-cyber-espionage/

NSO Confirms Pegasus Spyware Used by at least 5 European Countries

The Israeli surveillanceware vendor NSO Group has admitted to the European Union lawmakers that its Pegasus tool was used by at least five countries in the region. The disclosure comes as a special inquiry committee was launched in April 2022 to investigate alleged breaches of E.U. law following revelations that the company's Pegasus spyware is being used to snoop on phones belonging to politicians, diplomats, and civil society members.

See the full report here: https://thehackernews.com/2022/06/nso-confirms-pegasus-spyware-used-by-at.html

Conti ransomware finally shuts down data leak, negotiation sites

The Conti ransomware operation has finally shut down its last public-facing infrastructure (two Tor servers comprising a leak site and a negotiation page). The gang members are now believed to be split into smaller cells that infiltrated other ransomware operations or took over existing ones.

See the full report here: https://www.bleepingcomputer.com/news/security/conti-ransomware-finally-shuts-down-data-leak-negotiation-sites/

LGBTQ+ community warned of extortionists abusing dating apps

The U.S. Federal Trade Commission (FTC) has warned people of extortion scammers targeting the LGBTQ+ community by abusing dating apps like Grindr and Feeld. The victims get blackmailed into paying a ransom, usually in untraceable gift cards, under the threat of having personal photographs leaked to their family, friends, or employers.

See the full report here: https://www.bleepingcomputer.com/news/security/lgbtq-plus-community-warned-of-extortionists-abusing-dating-apps/

Fake copyright infringement emails install LockBit ransomware

LockBit ransomware operators are sending people emails about a copyright violation, allegedly having used media files without the creator's license, and threatening legal action. If the victim opens the attachment (supposed to be a "PDF,” but actually an NSIS installer) to learn what media are being used illegally, the malware will load and encrypt the device with the LockBit 2.0 ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-copyright-infringement-emails-install-lockbit-ransomware/

Clever phishing method bypasses MFA using Microsoft WebView2 apps

A new phishing technique uses Microsoft Edge WebView2 applications to steal victim's authentication cookies, allowing threat actors to bypass multi-factor authentication when logging into stolen accounts. This new social engineering attack is called WebView2-Cookie-Stealer and consists of a WebView2 executable that, when launched, opens up a legitimate website's login form inside the application.

See the full report here: https://www.bleepingcomputer.com/news/security/clever-phishing-method-bypasses-mfa-using-microsoft-webview2-apps/

PyPi python packages caught sending stolen AWS keys to unsecured sites

Multiple malicious Python packages available on the PyPI repository were caught stealing sensitive information like AWS credentials and transmitting it to publicly exposed endpoints accessible by anyone. PyPI is a repository of open-source packages that software developers use to pick the building blocks of their Python-based projects or share their work with the community.

See the full report here: https://www.bleepingcomputer.com/news/security/pypi-python-packages-caught-sending-stolen-aws-keys-to-unsecured-sites/

Automotive fabric supplier TB Kawashima announces cyberattack

TB Kawashima has announced that one of its subsidiaries, a Thai sales company, had been breached. The company informed that the production and sales activities of the Toyota Boshoku Group have not been impacted and all operations are running at normal parameters.

See the full report here: https://www.bleepingcomputer.com/news/security/automotive-fabric-supplier-tb-kawashima-announces-cyberattack/

Russia fines Google for spreading "unreliable’" info defaming its army

Roskomnadzor, Russia's telecommunications watchdog, has fined Google 68 million rubles (roughly $1.2 million) for helping spread what it called "unreliable" information on the war in Ukraine and the failure to remove it from its platforms. Google's Russian subsidiary reportedly filed for bankruptcy on June 16, according to documents filed with Moscow's Arbitration Court after its accounts were frozen.

See the full report here: https://www.bleepingcomputer.com/news/google/russia-fines-google-for-spreading-unreliable-info-defaming-its-army/

Mitel zero-day used by hackers in suspected ransomware attack

Hackers used a zero-day exploit (CVE-2022-29499; CVSS v3 score: 9.8 – critical) on Linux-based Mitel MiVoice VOIP appliances for initial access in what is believed to be the beginning of a thwarted ransomware attack. While no official patch has been released for the bug, Mitel addressed it on April 19, 2022, by releasing a remediation script for MiVoice Connect versions 19.2 SP3 and earlier and R14.x and earlier.

See the full report here: https://www.bleepingcomputer.com/news/security/mitel-zero-day-used-by-hackers-in-suspected-ransomware-attack/

CafePress fined $500,000 for breach affecting 23 million users

The U.S. Federal Trade Commission (FTC) has ordered Residual Pumpkin Entity, the former owner of the CafePress t-shirt and merchandise site, to pay a $500,000 fine for covering up a 2019 data breach impacting more than 23 million customers and failing to protect their data. Residual Pumpkin Entity reportedly stored its customers' Social Security numbers and password reset answers in plain text and longer than necessary.

See the full report here: https://www.bleepingcomputer.com/news/security/cafepress-fined-500-000-for-breach-affecting-23-million-users/

Fast Shop Brazilian retailer discloses "extortion" cyberattack

Fast Shop, one of Brazil's largest retailers, has suffered a cyberattack that led to network disruption and the temporary closure of its online store. The cyberattack impacted the Fast Shop main website, mobile apps, and online ordering system, but didn't impact physical shops.

See the full report here: https://www.bleepingcomputer.com/news/security/fast-shop-brazilian-retailer-discloses-extortion-cyberattack/

LockBit 3.0 introduces the first ransomware bug bounty program

The LockBit ransomware operation has released “LockBit 3.0,” introducing the first ransomware bug bounty program and leaking new extortion tactics and a payment option via the cryptocurrency called Zcash.The cybercrime gang released a revamped ransomware-as-a-service (RaaS) operation called LockBit 3.0 after beta testing for the past two months, with the new version already used in attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomware-bug-bounty-program/

Bank of the West found debit card-stealing skimmers on ATMs

The Bank of the West is warning customers that some of their debit card numbers and PINs have been stolen by skimmers installed on several of the bank's ATMs. The bank claims that it promptly stopped the fraudulent use of stolen card information and actively monitored all accounts that were determined to be compromised. Compromised customers should have their debit cards blocked now and will receive a new debit card and PIN.

See the full report here: https://www.bleepingcomputer.com/news/security/bank-of-the-west-found-debit-card-stealing-skimmers-on-atms/

Android malware ‘Revive’ impersonates BBVA bank’s 2FA app

An Android banking malware named Revive impersonates a 2FA application required to log into BBVA bank accounts in Spain. While it is in an early development phase, it's already capable of advanced functions like intercepting two-factor authentication (2FA) codes and one-time passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-revive-impersonates-bbva-bank-s-2fa-app/

US, Brazil seize 272 websites used to illegally download music

The domains of six websites that streamed and provided illegal downloads of copyrighted music were seized by U.S. Homeland Security Investigations (HSI) and the Department of Justice – following a joint investigation with Brazilian authorities dubbed Operation 404.4. 266 other websites part of the same network were also taken down in Brazil, with six individuals arrested in 30 search and seizure raids across the country.

See the full report here: https://www.bleepingcomputer.com/news/security/us-brazil-seize-272-websites-used-to-illegally-download-music/

Vice Society claims ransomware attack on Med. University of Innsbruck

The Vice Society ransomware gang has claimed responsibility for a recent cyberattack on the Medical University of Innsbruck, Austria, which caused severe IT service disruption and the alleged theft of data. Vice Society has been targeting European organizations lately, focusing specifically on state/public entities and educational institutes.

See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-claims-ransomware-attack-on-med-university-of-innsbruck/

Microsoft Exchange bug abused to hack building automation systems

A Chinese-speaking threat actor has exploited CVE-2021-26855 to hack into the building automation systems of several Asian organizations – backdooring their networks and gaining access to more secured areas in their networks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-bug-abused-to-hack-building-automation-systems/

Cybersecurity Experts Warn of Emerging Threat of "Black Basta" Ransomware

The Black Basta ransomware-as-a-service (RaaS) syndicate has amassed nearly 50 victims in the United States, Canada, the United Kingdom, Australia, and New Zealand within just a few months of its emergence. Black Basta is believed by some to comprise members belonging to the Conti group, who joined after Conti shuttered its operations in response to increased law enforcement scrutiny and a major leak.

See the full report here: https://thehackernews.com/2022/06/cybersecurity-experts-warn-of-emerging.html

Critical Security Flaws Identified in CODESYS ICS Automation Software

CODESYS has released patches for 11 security flaws that, if successfully exploited, could result in information disclosure and a denial-of-service (DoS) condition, among others. CODESYS is a software suite used by automation specialists as a development environment for programmable logic controller applications (PLCs).

See the full report here: https://thehackernews.com/2022/06/critical-security-flaws-identified-in.html

FBI: Stolen PII and deepfakes used to apply for remote tech jobs

The Federal Bureau of Investigation (FBI) has warned people that cybercriminals are increasingly using stolen Personally Identifiable Information (PII) and deepfakes to apply for remote work positions. The targeted remote jobs include positions in the tech field that would allow the malicious actors to gain access to company and customer confidential information after being hired.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-stolen-pii-and-deepfakes-used-to-apply-for-remote-tech-jobs/

Raccoon Stealer is back with a new version to steal your passwords

The Raccoon Stealer malware is back with a second major version circulating on cybercrime forums, offering hackers elevated password-stealing functionality and upgraded operational capacity. The Raccoon Stealer operation shut down in March 2022 when its operators announced that one of the lead developers was killed during Russia’s invasion of Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/raccoon-stealer-is-back-with-a-new-version-to-steal-your-passwords/

Over 900,000 Kubernetes instances found exposed online

Security researchers have found over 900,000 misconfigured Kubernetes clusters exposed on the internet to potentially malicious scans, some even vulnerable to data-exposing cyberattacks. 65% of the clusters (585,000) being located in the United States, 14% in China, 9% in Germany, while Netherlands and Ireland accounted for 6% each. If Kubernetes isn’t configured properly, remote actors might be able to access internal resources and private assets that weren’t meant to be made public.

See the full report here: https://www.bleepingcomputer.com/news/security/over-900-000-kubernetes-instances-found-exposed-online/

Evilnum hackers return in new operation targeting migration orgs

The Evilnum hacking group (an advanced persistent threat, or APT, that has been active since at least 2018) is showing renewed signs of malicious activity, targeting European organizations that are involved in international migration. The targeting and the timing coincided with the Russian invasion of Ukraine, with key migration organizations receiving malicious emails containing macro-laden documents.

See the full report here: https://www.bleepingcomputer.com/news/security/evilnum-hackers-return-in-new-operation-targeting-migration-orgs/

AMD investigates RansomHouse hack claims, theft of 450GB data

Semiconductor giant AMD stated that it is investigating a cyberattack after the RansomHouse gang claimed to be in possession of 450 GB of data stolen from the company last year. The threat actors said they did not contact AMD with a ransom demand as selling the data to other entities or threat actors was more valuable.

See the full report here: https://www.bleepingcomputer.com/news/security/amd-investigates-ransomhouse-hack-claims-theft-of-450gb-data/

MITRE shares this year's list of most dangerous software bugs

MITRE has shared the top 25 most common and dangerous weaknesses impacting software throughout the previous two calendar years. MITRE scored each weakness based on its prevalence and severity after analyzing data for 37,899 CVEs from NIST's National Vulnerability Database (NVD) and CISA's Known Exploited Vulnerabilities (KEV) Catalog.

See the full report here: https://www.bleepingcomputer.com/news/security/mitre-shares-this-years-list-of-most-dangerous-software-bugs/

New ZuoRAT malware targets SOHO routers in North America, Europe

A multistage remote access trojan (RAT) dubbed ZuoRAT has been used to target remote workers via small office/home office (SOHO) routers across North America and Europe undetected since 2020. Two more custom trojans were delivered onto hacked devices during these attacks: one C++ based one named CBeacon targeting Windows workstations and a Go-based one dubbed GoBeacon that could likely infect Linux and Mac systems besides Windows devices.

See the full report here: https://www.bleepingcomputer.com/news/security/new-zuorat-malware-targets-soho-routers-in-north-america-europe/

Malicious Messenger chatbots used to steal Facebook accounts

Facebook Messenger chatbots are being used to impersonate the company's support team and steal credentials used to manage Facebook pages. The phishing attack starts with an email informing the recipient that their Facebook page has violated Community Standards, giving them 48 hours to appeal the decision, or their page will be deleted.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-messenger-chatbots-used-to-steal-facebook-accounts/

CISA Warns of Active Exploitation of 'PwnKit' Linux Vulnerability in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Linux vulnerability (CVE-2021-4034 :CVSS score: 7.8) dubbed PwnKit to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The bug concerns a case of local privilege escalation in polkit's pkexec utility, which allows an authorized user to execute commands as another user. Federal Civilian Executive Branch Agencies are required to mandatorily patch the flaw by July 18, 2022.

See the full report here: https://thehackernews.com/2022/06/cisa-warns-of-active-exploitation-of.html

Walmart denies being hit by Yanluowang ransomware attack

Walmart has denied being hit with a ransomware attack by the Yanluowang gang after the hackers claimed to encrypt thousands of computers. The Yanluowang ransomware operation had published an entry to their data leak site claiming that they breached Walmart and encrypted between 40,000 and 50,000 devices.

See the full report here: https://www.bleepingcomputer.com/news/security/walmart-denies-being-hit-by-yanluowang-ransomware-attack/

Avaya sysadmin indicted for illegally generating, selling VoIP licenses

Three people have been charged for allegedly selling over $88 million worth of software licenses belonging to Avaya Holdings Corporation and face 14 counts of wire fraud and money laundering. Avaya IP Office was a cloud-based, on-premise collaboration and communication product for conferencing, IP calls, and voicemail-to-email, geared towards small and medium-sized businesses.

See the full report here: https://www.bleepingcomputer.com/news/security/avaya-sysadmin-indicted-for-illegally-generating-selling-voip-licenses/

New YTStealer malware steals accounts from YouTube Creators

An information-stealing malware named YTStealer is targeting YouTube content creators and attempting to steal their authentication tokens and hijack their channels. Most of its distribution uses lures impersonating software that edits videos or acts as content for new videos.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ytstealer-malware-steals-accounts-from-youtube-creators/

Ukraine arrests cybercrime gang operating over 400 phishing sites

The Ukrainian cyberpolice force arrested nine members of a criminal group that operated over 400 phishing websites crafted to appear like legitimate EU portals offering financial assistance to Ukrainians. The threat actors used forms on the site to steal visitors' payment card data and online banking account credentials and perform fraudulent, unauthorized transactions like moving funds to accounts under their control.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-arrests-cybercrime-gang-operating-over-400-phishing-sites/

CISA warns orgs to switch to Exchange Online Modern Auth until October

CISA has urged government agencies and private sector organizations using Microsoft's Exchange cloud email platform to quickly switch from Basic Authentication legacy authentication methods without multifactor authentication (MFA) support to Modern Authentication alternatives. Basic Auth (proxy authentication) is an HTTP-based auth scheme used by apps to send credentials in plain text to servers, endpoints, or online services.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-to-switch-to-exchange-online-modern-auth-until-october/

Amazon fixes high-severity vulnerability in Android Photos app

Amazon has confirmed and fixed a vulnerability in its Photos app for Android. Exploiting this bug could have enabled a malicious app installed on the same device to snatch Amazon access tokens used for Amazon APIs authentication.

See the full report here: https://www.bleepingcomputer.com/news/security/amazon-fixes-high-severity-vulnerability-in-android-photos-app/

New UnRAR Vulnerability Could Let Attackers Hack Zimbra Webmail Servers

A new security vulnerability (CVE-2022-30333) in RARlab's UnRAR utility could permit a remote attacker to execute arbitrary code on a system that relies on the binary. The flaw relates to a path traversal vulnerability in the Unix versions of UnRAR that can be triggered upon extracting a maliciously crafted RAR archive.

See the full report here: https://thehackernews.com/2022/06/new-unrar-vulnerability-could-let.html

Microsoft Azure FabricScape bug let hackers hijack Linux clusters

Microsoft has fixed a container escape bug (CVE-2022-30137) dubbed FabricScape in the Service Fabric (SF) application hosting platform that let threat actors escalate privileges to root, gain control of the host node, and compromise the entire SF Linux cluster. Service Fabric is a platform for business-critical applications that hosts over 1 million apps.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-azure-fabricscape-bug-let-hackers-hijack-linux-clusters/