zerofox logo
Advisories

Threat Intelligence Bulletin: 07/08/2022 - 07/14/2022

|by Alpha Team

banner image

Microsoft Patch Tuesday 07/13/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for July 2022 contained 84 vulnerabilities in total, with:

  • 4 vulnerabilities rated as Critical
  • 35 vulnerabilities rated as High
  • 1 actively exploited zero-day vulnerability

This month marks the general availability of Windows Autopatch, first announced in April 2022. This service is available for customers with Windows Enterprise E3 and E5 licenses. Microsoft will continue to release updates on the second Tuesday of every month and Autopatch will streamline updating operations.

Most notable vulnerabilities

Microsoft has listed 4 critical vulnerabilities (CVE-2022-22039, CVE-2022-22038, CVE-2022-22029, and CVE-2022-30221) among the bugs fixed in the July Patch Tuesday security update. The patched bugs also include 1 actively exploited zero-day vulnerability (CVE-2022-22047), which is a Windows Client Server Run-Time Subsystem (CSRSS) elevation of privilege vulnerability.

CVE-2022-22047

CVE-2022-22047 (CVSS score: 7.8) is a Windows CSRSS Elevation of Privilege Vulnerability. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, because of this flaw in the Client/Server component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

This bug is being actively exploited in the wild.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2022-30221

CVE-2022-30221 (CVSS score: 9.3) is a Windows Graphics Component Remote Code Execution Vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Remote Desktop client for Windows Desktop
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2022-22029

CVE-2022-22029 (CVSS score: 9.8) is a Windows Network File System Remote Code Execution Vulnerability. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, because of this flaw in the Network File System. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019

CVE-2022-22039

CVE-2022-22039 (CVSS score: 9.8) is a Windows Network File System Remote Code Execution Vulnerability vulnerability. Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, because of this flaw in the Network File System. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019

CVE-2022-22038

CVE-2022-22038 (CVSS score: 9.8) is a Remote Procedure Call Runtime Remote Code Execution Vulnerability. Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the flaw in the Remote Procedure Call Runtime component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

Users should apply the latest security patches specified in Microsoft's March Patch Tuesday update and follow the recommended mitigations and workarounds to protect themselves from these and other vulnerabilities.

The Underground Economist: Volume 2, Issue 12

Welcome back to The Underground Economist, Volume 2, Issue 12, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of July 8, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Breach Disclosure: Crystalix

On June 17, 2022, the Telegram channel "Dataleak" posted a data breach package targeting Crystalix, a Russia-based gaming website. The data package was also shared in another Telegram channel "Db Leaks." From the package shared on Dataleak, ZeroFox extracted 72,850 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Crystalix, a Russia-based gaming website, suffered a data breach. On June 17, 2022, the data breach package was shared on two Telegram channels: Dataleak and Db Leaks. The package includes 73,470 lines of user information, with headers such as username, password, email address, social media profiles, access keys, and more. From the package shared in the Telegram channel Dataleak, ZeroFox extracted 72,850 usernames, email addresses, and hashed passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: JDBBX

On June 17, 2022, the Telegram channel "Dataleak" posted a data breach package targeting RJDBBX, a China-based gaming website. The data package was shared in another Telegram channel and in the underground forums BreachForums and Forum Team. From the package shared on the Telegram channel "Dataleak," ZeroFox extracted 4,894,097 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

RJDBBX, a China-based gaming website, suffered a data breach. The data breach package was shared on various platforms over the internet, such as on the Telegram channels Dataleak (on June 17, 2022) and Db Leaks (on June 18, 2022), as well as on the underground forums Forum Team (on June 19, 2022) and BreachForums (on June 17, 2022). The threat actor Blood from BreachForums noted that the data dump – which includes 4,896,557 records – is from November 2016. From the package shared on Telegram Channel Dataleak, ZeroFox extracted 4,894,097 usernames, email addresses, and hashed passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Rostelecom Smart Home

On June 17, 2022, the Telegram channel "Dataleak" posted a data breach package targeting Rostelecom Smart Home, a Russia-based smart home management solutions provider. The data package was shared in various Telegram channels and in the underground forum BreachForums. The data package includes 712,999 lines with full name, email address, phone number, hashed password, IP address, date of registration, and last activity information. From this package, ZeroFox extracted 646,739 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Rostelecom Smart Home, a Russia-based smart-home management solutions provider, suffered a data breach. The corresponding data package was shared on various platforms over the internet, such as on the Telegram channels "Dataleak" (on June 17, 2022), Breached Data | Group (on June 8, 2022), Утечки информации (translated as "information leaks" (on June 8, 2022), as well as in an underground forum called BreachForums (on June 9, 2022 – by the threat actor "Addka72424"). The threat actor "Addka72424" from BreachForums noted that the data package is from December 18, 2021. The package includes 712,999 lines – with full name, email address, phone number, hashed (bcrypt) password, IP address, date of registration, and last activity information. From this package, ZeroFox extracted 646,739 email addresses. Of this total, an assessed 262,071 records contain hashed passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: UAE business database

On June 18, 2022, a user on the underground forum BreachForums posted a data package consisting of information related to various business entities in the United Arab Emirates (UAE). From this package, ZeroFox extracted 18,299 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 18, 2022, a threat actor "bary40" posted a data breach package titled "UAE Business Database 20 000" on the underground forum BreachForums. The actor noted that the data package comprised 20,000 records, with headers including Email, Company Name, City/Province, Phone, Sector/Activities, and P.O.Box. From this package, ZeroFox extracted 18,299 email addresses. No passwords were found in this breach.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-07-08 - 2022-07-14

Hackers using 'Brute Ratel C4' Red-Teaming tool to evade detection

The Brute Ratel C4 (BRc4) red-teaming and adversarial attack simulation tool has been used by nation-state attackers to evade detection, find researchers

See the full report here: https://www.securityweek.com/hackers-using-brute-ratel-c4-red-teaming-tool-evade-detection

Blip in U.S. Congress website; Killnet hacking group claims hit

Killnet, a pro-Russian hacker group known for denial-of-service attacks, claimed it carried out the attack that blocked U.S. Congress website for a short while

See the full report here: https://www.foxnews.com/us/congress-website-down-pro-russian-hacking-group-claims-attack

Google warns of serious new chrome hack attack targeting Windows & Android

Google warns of hack attacks been spotted in the wild with Android and Windows users in the crosshairs.

See the full report here: https://www.forbes.com/sites/daveywinder/2022/07/07/google-warns-of-serious-new-chrome-hack-attack-targeting-windows--android/?sh=6e216a695a21

FBI accuses China of trying to ‘ransack’ Western companies through hacking

FBI director Christopher Wray warned Western companies that China aims to “ransack” their intellectual property

See the full report here: https://techcentral.co.za/fbi-accuses-china-of-trying-to-ransack-western-companies-through-hacking/212978/

QNAP warns of new Checkmate ransomware targeting NAS devices

Network-attached storage (NAS) vendor QNAP warned customers to secure their devices against attacks using Checkmate ransomware to encrypt data.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-of-new-checkmate-ransomware-targeting-nas-devices/

Fake copyright complaints push IcedID malware using Yandex Forms

Website owners are being targeted with fake copyright infringement complaints that utilize Yandex Forms to distribute the IcedID banking malware

See the full report here: https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/

Ransomware attack hits Goa’s flood monitoring system; demand crypto as payment

The Indian state government’s water resources department that has been maintaining the data said that all its files have been encrypted and can no longer be accessed

See the full report here: https://www.hindustantimes.com/india-news/ransomware-attack-hits-goa-s-flood-monitoring-system-demand-crypto-as-payment-101657186573577.html

Quantum ransomware attack affects 657 healthcare orgs

A ransomware attack in late February led to a data breach affecting over 600 healthcare organizations

See the full report here: https://www.bleepingcomputer.com/news/security/quantum-ransomware-attack-affects-657-healthcare-orgs/

Matanbuches malware that selling for $2500 in dark-web re-appeared via BeliaDemon Hackers

Matanbuches malware that is distributing over the dark web via Malware-as-a-Service (MaaS) now reappeared via a spear-phishing campaign with malicious attachments

See the full report here: https://cybersecuritynews.com/matanbuches-malware/

Canada’s federal police have been using powerful malware to snoop on people’s communications

The Royal Canadian Mounted Police has admitted to having access to powerful surveillance tech its supposed oversight seems unaware the RCMP possessed

See the full report here: https://www.techdirt.com/2022/07/07/canadas-federal-police-have-been-using-powerful-malware-to-snoop-on-peoples-communications/

Maastricht University wound up earning money from its ransom payment

Maastricht University (UM) has recovered the ransom paid after a ransomware attack (by TA505, or SectorJ04) hit its network in December 2019. The ransom amount (30 BTC) has significantly appreciated in dollar value from the 2019 amount.

See the full report here: https://www.bleepingcomputer.com/news/security/maastricht-university-wound-up-earning-money-from-its-ransom-payment/

CEO charged with sale of counterfeit Cisco devices to govt, health orgs

A person (CEO of a group of dozens of companies) was indicted for allegedly selling more than $1 billion worth of counterfeit Cisco network equipment to customers worldwide. Cheap and modified low-quality networking devices were sold as new and genuine Cisco products through dozens of Amazon and eBay storefronts.

See the full report here: https://www.bleepingcomputer.com/news/technology/ceo-charged-with-sale-of-counterfeit-cisco-devices-to-govt-health-orgs/

Free decryptor released for AstraLocker, Yashma ransomware victims

A cybersecurity firm has released a free decryption tool to help AstraLocker and Yashma ransomware victims recover their files without paying a ransom. The free tool is available for download, and it allows users to recover encrypted files using instructions available in its usage guide.

See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-astralocker-yashma-ransomware-victims/

CEO charged with sale of counterfeit Cisco devices to govt, health orgs

A person (CEO of a group of dozens of companies) was indicted for allegedly selling more than $1 billion worth of counterfeit Cisco network equipment to customers worldwide. Cheap and modified low-quality networking devices were sold as new and genuine Cisco products through dozens of Amazon and eBay storefronts.

See the full report here: https://www.bleepingcomputer.com/news/technology/ceo-charged-with-sale-of-counterfeit-cisco-devices-to-govt-health-orgs/

Free decryptor released for AstraLocker, Yashma ransomware victims

A cybersecurity firm has released a free decryption tool to help AstraLocker and Yashma ransomware victims recover their files without paying a ransom. The free tool is available for download, and it allows users to recover encrypted files using instructions available in its usage guide.

See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-astralocker-yashma-ransomware-victims/

Mangatoon data breach exposes data from 23 million accounts

Comic reading platform Mangatoon has suffered a data breach that exposed information belonging to 23 million user accounts. Mangatoon is a popular iOS and Android app used by millions of users to read online Manga comics. The data breach was conducted by a well-known hacker named "pompompurin," who claims to have stolen the database from an Elasticsearch server that was using weak credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/mangatoon-data-breach-exposes-data-from-23-million-accounts/

New 0mega ransomware targets businesses in double-extortion attacks

A new ransomware operation named "0mega" is targeting organizations worldwide in double-extortion attacks and demanding millions of dollars in ransoms. A ransomware sample for the 0mega operation hasn’t yet been found, so there’s not much information on how files are encrypted.

See the full report here: https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/

Canada's internet outage caused by "maintenance"

Rogers, one of the largest mobile and internet providers in Canada, has apologised for the country-wide outage of its services which began on July 8, 2022 (Friday). The company stated that the failure followed a maintenance update in its core network. Transport, banking and emergency services were all hit by Friday's blackout, with 911 hotlines and bank ATMs reportedly left unavailable.

See the full report here: https://www.bbc.com/news/world-us-canada-62110358

Microsoft rolls back decision to block Office macros by default

Microsoft is rolling back its decision to block VBA macros on downloaded documents by default – based on feedback – until further notice. The company did not explain the reason behind this decision that VBA macros embedded in malicious Office documents will no longer be blocked automatically in Access, Excel, PowerPoint, Visio, and Word.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-back-decision-to-block-office-macros-by-default/

New stealthy OrBit malware steals data from Linux devices

A newly discovered Linux malware (OrBit) is being used to stealthily steal information from backdoored Linux systems and infect all running processes on the machine. While it can gain persistence using two different methods to block removal attempts, OrBit can also be deployed as a volatile implant when copied in shim-memory. It can also hook various functions to evade detection, control process behavior, maintain persistence by infecting new processes, and hide network activity that would reveal its presence.

See the full report here: https://www.bleepingcomputer.com/news/linux/new-stealthy-orbit-malware-steals-data-from-linux-devices/

Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs

Malicious actors are abusing different organizations’ GitHub Actions and Azure virtual machines (VMs) for cloud-based cryptocurrency mining. Cryptojacking groups infiltrate cloud deployments by exploiting a bug within target systems, such as an unpatched vulnerability, weak credentials, or a misconfigured cloud implementation. Some of the prominent actors include 8220, Keksec (or Kek Security), Kinsing, Outlaw, and TeamTNT.

See the full report here: https://thehackernews.com/2022/07/cloud-based-cryptocurrency-miners.html

Hackers can unlock Honda cars remotely in Rolling-PWN attacks

Security researchers have reportedly discovered found a vulnerability (rolling code mechanism, or Rolling-PWN) in several modern Honda car models that allows unlocking the cars or even starting the engine remotely. The vulnerability (CVE-2021-46145 – medium severity) is as an issue related to a non-expiring rolling code and counter resynchronization in the keyfob subsystem in Honda.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-unlock-honda-cars-remotely-in-rolling-pwn-attacks/

Ransomware gang now lets you search their stolen data

Some ransomware and data extortion groups (Karakurt, ALPHV, and LockBit) have added a search function on their leak sites to make it easier to find victims or even specific details. This new strategy puts pressure on the victim to pay the ransom and have the data removed from the internet, and avoid the potential risk of class action lawsuits.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-now-lets-you-search-their-stolen-data/

Microsoft says decision to unblock Office macros is temporary

Microsoft has stated that last week's decision to roll back VBA macro auto-blocking in downloaded Office documents is only a temporary change.The company had announced in February that Microsoft Office would automatically block VBA macros in all documents downloaded from the Internet. However, after this new feature went live for all customers last month, Microsoft warned that this change would be rolled back.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-says-decision-to-unblock-office-macros-is-temporary/

TikTok Postpones Privacy Policy Update in Europe After Italy Warns of GDPR Breach

TikTok agreed to pause a controversial privacy policy update that could have allowed it to serve targeted ads based on users' activity, without their permission to do so. The reversal comes a day after the Italian data protection authority warned the company against the change, citing violations of data protection laws.

See the full report here: https://thehackernews.com/2022/07/tiktok-postpones-privacy-policy-update.html

Microsoft July 2022 Patch Tuesday fixes exploited zero-day, 84 flaws

Microsoft provided fixes for one actively exploited zero-day vulnerability and a total of 84 flaws in the July 2022 Patch Tuesday. Four of the 84 vulnerabilities fixed in today's update are classified as “Critical” as they allow remote code execution. Microsoft also announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2022-patch-tuesday-fixes-exploited-zero-day-84-flaws/

Insurance provider CFC warns of new "BazarCall" ransomware attacks

Specialist insurance provider CFC has warned brokers and clients of an emerging method of ransomware attack, dubbed BazarCall, which is targeting small businesses.

See the full report here: https://www.reinsurancene.ws/cfc-warns-of-new-bazarcall-ransomware-attacks/

New "Luna Moth" hackers breach orgs via fake subscription renewals

A new data extortion group (Luna Moth / Silent Ransom Group (SRG) / TG2729) is breaching companies via phishing campaigns that delivered remote access tools (RATs) – to steal confidential information, threatening victims to make the files publicly available unless they pay a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/new-luna-moth-hackers-breach-orgs-via-fake-subscription-renewals/

Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs

Microsoft disclosed that a series of phishing attacks targeted more than 10,000 organizations starting from September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks. To defend against such attacks, Microsoft recommends using "phish-resistant" MFA implementations with certificate-based authentication and Fast ID Online (FIDO) v2.0 support.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-phishing-bypassed-mfa-in-attacks-against-10-000-orgs/

European Central Bank head targeted in hacking attempt

The European Central Bank president Christine Lagarde was targeted in a hacking attempt but no information was compromised, the bank announced.

See the full report here: https://www.securityweek.com/european-central-bank-head-targeted-hacking-attempt

Hackers impersonate cybersecurity firms in callback phishing attacks

In a new callback phishing campaign, hackers are impersonating CrowdStrike to warn recipients that malicious network intruders have compromised their workstations and that an in-depth security audit is required. When the target calls the numbers, the threat actors use social engineering to convince users to install remote access software on their devices, providing initial access to corporate networks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-impersonate-cybersecurity-firms-in-callback-phishing-attacks/

VMware patches vCenter Server flaw disclosed in November

VMware has released a patch for one of the affected versions for a high-severity privilege escalation flaw – CVE-2021-22048 – in vCenter Server's IWA (Integrated Windows Authentication) mechanism. Successful exploitation enables attackers with non-administrative access to unpatched vCenter Server deployments to elevate privileges to a higher privileged group. According to VMware, the bug can only be exploited from the same physical or logical network on which the targeted server is located as part of high complexity attacks requiring low privileges and no user interaction

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-patches-vcenter-server-flaw-disclosed-in-november/

CISA orders agencies to patch new Windows zero-day used in attacks

CISA has added an actively exploited local privilege escalation vulnerability (CVE-2022-22047) in the Windows Client/Server Runtime Subsystem (CSRSS) to its list of bugs abused in the wild. All Federal Civilian Executive Branch Agencies (FCEB) agencies have to patch this bug by August 2, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-new-windows-zero-day-used-in-attacks/

New "Retbleed" Speculative Execution Attack Affects AMD and Intel CPUs

Chip manufacturers Intel and AMD are releasing software mitigations as part of a coordinated disclosure process to patch a set of issues dubbed “Retbleed” – CVE-2022-29900 (AMD) and CVE-2022-29901 (Intel). Retbleed is the latest addition to a class of Spectre attacks known as Spectre-BTI (CVE-2017-5715 or Spectre-V2), which exploit the side effects of an optimization technique called speculative execution.

See the full report here: https://thehackernews.com/2022/07/new-retbleed-speculative-execution.html

U.S. FTC Vows to Crack Down on illegal Use and Sharing of Citizens' Sensitive Data

The U.S. Federal Trade Commission (FTC) has stated that it will crack down on tech companies' illegal use and sharing of highly sensitive data and false claims about data anonymization. The agency to caution against opaque practices in the "shadowy ad tech and data broker ecosystem," with consumers having little to no knowledge of how their personal data is harvested, used, and processed.

See the full report here: https://thehackernews.com/2022/07/us-ftc-vows-to-crack-down-on-illegal.html

Bandai Namco confirms hack after ALPHV ransomware data leak threat

Video game publisher Bandai Namco has confirmed that it suffered a cyberattack on July 3 that may have resulted in the theft of customers' personal data. The ALPHV ransomware operation claimed to have breached Bandai Namco and stolen corporate data during the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/bandai-namco-confirms-hack-after-alphv-ransomware-data-leak-threat/

New Lilith ransomware emerges with extortion site, lists first victim

A new ransomware operation called Lilith has been launched, and it posted its first victim on a data leak site created to support double-extortion attacks. Lilith is a C/C++ console-based ransomware designed for 64-bit versions of Windows.

See the full report here: https://www.bleepingcomputer.com/news/security/new-lilith-ransomware-emerges-with-extortion-site-lists-first-victim/

New UEFI firmware flaws impact over 70 Lenovo laptop models

The UEFI firmware used in several laptops made by Lenovo is vulnerable to three buffer overflow vulnerabilities (CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 – all of “medium” severity) that could enable attackers to hijack the startup routine of Windows installations. Users of the affected devices are recommended to download the latest available driver version from Lenovo's official software download portal.

See the full report here: https://www.bleepingcomputer.com/news/security/new-uefi-firmware-flaws-impact-over-70-lenovo-laptop-models/

New Android malware on Google Play installed 3 million times

A new Android malware Autolycos has been observed in at least eight Android applications. It secretly subscribes users to premium services, and was found on Google Play Store apps that have been downloaded over 3,000,000 times.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-malware-on-google-play-installed-3-million-times/

Tags: all industries,  global