zerofox logo
Advisories

Threat Intelligence Bulletin: 07/15/2022 - 07/21/2022

|by Alpha Team

banner image

Breach Disclosure: Ford

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "ford.com database." From this package, ZeroFox extracted 25,014 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "ford.com database." From this package, ZeroFox extracted 25,014 email addresses. Other notable compromised data fields in this package included name, mobile number, vehicle number, address, and others. No passwords were found in this breach.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Mercedes

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "mercedes database." From this package, ZeroFox extracted 34,009 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "mercedes database." From this package, ZeroFox extracted 34,009 email addresses. Other notable compromised data fields in this package included name, mobile number, vehicle number, address, and others. No passwords were found in this breach.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Capital Economics

On July 4, 2022, an actor "pompompurin" from the underground forum BreachForums posted a data breach package targeting Capital Economics, a London-based economic research company. The package was shared on several under forums, including on Telegram. The data package included over 263,000 customer records with names, email addresses, employer names, phone numbers, and physical addresses. From the package shared on BreachForums, ZeroFox extracted 263,686 email addresses. Of this total, an assessed 4,735 records contained hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Capital Economics, a London-based economic research company, suffered a data breach. On July 4, 2022, a threat actor "pompompurin" from the underground forum BreachForums posted a data package relating to this breach, stating that the data is from December 2020 and includes 263,000 customer records. The data package was also shared on the underground forum Forum Team (on November 12, 2021, by the threat actor "world_of_fantom"), on Raid Forums (on January 4, 2021, by the threat actor "dbs"), and in a Telegram channel "Breached Data | Group" (on July 12, 2021). The compromised data included headers such as names, email addresses, employer names, phone numbers, and physical addresses. From the package shared on BreachForums, ZeroFox extracted 263,686 email addresses. Of this total, an assessed 4,735 records contained hashed passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Kia

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "kia.com database." From this package, ZeroFox extracted 7,101 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 23, 2022, the Telegram channel "Dataleak" posted a data leak package titled "kia.com database." From this package, ZeroFox extracted 7,101 email addresses. Other notable compromised data fields in this package included name, mobile number, vehicle number, address, and others. No passwords were found in this breach.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: USA_b2c

On June 21, 2022, a user "Tooppaazz" from the Russian-speaking underground forum XSS posted a data leak package titled "USA_b2c." From this package, ZeroFox extracted 8,077,517 email addresses. Other notable compromised data fields in this package included name, gender, address, phone number, and IP address.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 21, 2022, a user "Tooppaazz" from the Russian-speaking underground forum XSS posted a data package titled "USA_b2c." The user's account has been banned from the forum for suspicious trade activity. From the data package, ZeroFox extracted 8,077,517 email addresses. Other notable headings in the package included name, gender, address, phone number, and IP address. No passwords were found in this breach.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Disk Union Data Breach

On June 24, 2022, the Telegram channel "We Leak Database" posted a data breach package targeting Disk Union, a Japanese music store chain that makes vinyl records. The threat actor noted that the package includes 701,000 user records, with passwords stored in plain text. From this package, ZeroFox extracted 700,675 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Disk Union, a Japanese music store chain that makes vinyl records suffered a data breach. The corresponding data package was shared on the Telegram channel "We Leak Database" (on June 24, 2022) by a user, who noted that the data package includes 701,000 user records, with the passwords stored in plain text. The package was also shared on various other platforms on the internet, such as BreachForums (on June 24, 2022, by the user "r4idf0rum5") and XSS (on June 24, 2022, by the user "system45"). From this package, ZeroFox extracted 700,675 usernames, email addresses, and hashed passwords. Other notable compromised data fields in this package included name, phone number, and address.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

European Gas Politics

Product Serial: B-2022-07-20a

TLP: WHITE

In this briefing, ZeroFox Intelligence discusses the uncertainty around Russia resuming natural gas exports to Germany at normal levels through the Nord Stream 1 pipeline once annual maintenance is complete.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Executive Summary

Europe is currently waiting to see if natural gas exports via the Nord Stream 1 pipeline from Russia to Germany resume on July 21, 2022, and at what levels. The pipeline shuts down for 10 days every year for annual maintenance but Europe fears the shutdown will last longer due to Russia’s war in Ukraine. Russia is retaliating against European support for Ukraine by cutting back on contracted volumes of natural gas that Russia supplies to Europe. Russian President Vladimir Putin made it clear he aims to limit Europe’s ability to store gas supplies ahead of the winter, thus driving up prices that will cause economic hardship and political discontent to weaken Europe’s resolve to back Ukraine.

Ahead of the pipeline closure, Russia has been escalating its retaliatory response against NATO and European Union (EU) members. Russia’s primary weapon is cutting off energy supplies, but they are also continuing with confrontational military exercises in tandem with low-scale cyber actions likely carried out by pro-Russian threat actors against other EU and NATO members. Despite the outcome of the pipeline issue, Russia is highly likely to continue using energy supplies as the key retaliatory measure against European support for Ukraine. This could lead to energy rationing and higher prices that make conducting business in Europe difficult. It may also lead to social unrest in addition to wider political and economic issues that weaken Europe.

Breaking News: 2022-07-15 - 2022-07-21

Microsoft links Holy Ghost ransomware operation to North Korean hackers

Security researchers have disclosed that a ransomware operation called HolyGhost (tracked as DEV-0530), which attacks small businesses – banks, schools, manufacturing organizations, and event and meeting-planning companies – in various countries is linked to North Korea. However, the hackers may not be controlled by the North Korean government and may be doing this for their personal financial gain.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-links-holy-ghost-ransomware-operation-to-north-korean-hackers/

PayPal phishing kit added to hacked WordPress sites for full ID theft

A newly discovered phishing kit targeting PayPal users is trying to steal a large set of personal information from victims. The kit is hosted on legitimate WordPress websites that have been hacked, which allows it to evade detection to a certain degree.

See the full report here: https://www.bleepingcomputer.com/news/security/paypal-phishing-kit-added-to-hacked-wordpress-sites-for-full-id-theft/

Mantis botnet behind the record-breaking DDoS attack in June

The massive distributed denial-of-service (DDoS) attack that Cloudflare mitigated in June 2022 originated from a new botnet called Mantis, called "the most powerful botnet to date." The attack peaked at 26 million requests per second that came from 5,067 devices.

See the full report here: https://www.bleepingcomputer.com/news/security/mantis-botnet-behind-the-record-breaking-ddos-attack-in-june/

CoinPayments to shut down in US — 5 days left to withdraw funds

The crypto payments gateway CoinPayments.net is ceasing operations in the United States and has advised users to withdraw their assets before July 19, 2022. The closure announcement via email and the short notice withdrawal have led to some users suspecting a crypto grab or an exit scam.

See the full report here: https://www.bleepingcomputer.com/news/technology/coinpayments-to-shut-down-in-us-5-days-left-to-withdraw-funds/

Former CIA Engineer Convicted of Leaking 'Vault 7' Hacking Secrets to WikiLeaks

A former programmer with the U.S. Central Intelligence Agency (CIA) has been found guilty of leaking a trove of classified hacking tools and exploits dubbed Vault 7 to WikiLeaks. He had been charged in June 2018 with unauthorized disclosure of classified information and theft of classified material, and he also faces a separate trial on charges related to possession of child pornographic photos and videos.

See the full report here: https://thehackernews.com/2022/07/former-cia-engineer-convicted-of.html

Hackers pose as journalists to breach news media org’s networks

Advanced persistent (APT) threat groups from China, North Korea, Iran, and Turkey are targeting journalists and media organizations for their unique access to non-public information that could help expand a cyberespionage operation, often by pretending to be reporters. Some of them masquerade their emails as newsletters from the Guardian or Fox news.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-pose-as-journalists-to-breach-news-media-org-s-networks/

Elastix VoIP systems hacked in massive campaign to install PHP web shells

A large-scale campaign is targeting Elastix VoIP telephony servers with more than 500,000 malware samples, possibly by exploiting a remote code execution (RCE) vulnerability CVE-2021-45461. Elastix is a server software for unified communications used in the Digium phones module for FreePBX.

See the full report here: https://www.bleepingcomputer.com/news/security/elastix-voip-systems-hacked-in-massive-campaign-to-install-php-web-shells/

Password recovery tool infects industrial systems with Sality malware

A threat actor is infecting industrial control systems (ICS) to create a botnet through password "cracking" software for programmable logic controllers (PLCs). The tool deploys Sality, a piece of malware that creates a peer-to-peer botnet for various tasks that require the power of distributed computing to complete faster (e.g. password cracking, cryptocurrency mining). Sality is an old piece of malware that continues to evolve with features that allows it to terminate processes, open connections to remote sites, download additional payloads, or steal data from the host.

See the full report here: https://www.bleepingcomputer.com/news/security/password-recovery-tool-infects-industrial-systems-with-sality-malware/

Attackers scan 1.6 million WordPress sites for vulnerable plugin

A massive campaign has scanned close to 1.6 million WordPress sites for the presence of a vulnerable plugin (Kaswara Modern WPBakery Page Builder) that allows uploading files without authentication. The vulnerability (CVE-2021-24284) would allow an unauthenticated attacker to inject malicious Javascript to sites using any version of the plugin and perform actions like uploading and deleting files, which could lead to complete takeover of the site.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-scan-16-million-wordpress-sites-for-vulnerable-plugin/

Juniper Releases Patches for Critical Flaws in Junos OS and Contrail Networking

Juniper Networks has pushed security updates to address several vulnerabilities affecting multiple products, some of which could be exploited to seize control of affected systems. The most critical of the flaws affect Junos Space and Contrail Networking, with the tech company urging customers to release versions 22.1R1 and 21.4.0, respectively.

See the full report here: https://thehackernews.com/2022/07/juniper-releases-patches-for-critical.html

New Netwrix Auditor Bug Could Let Attackers Compromise Active Directory Domain

Researchers have disclosed details about a security vulnerability in the Netwrix Auditor application that could lead to arbitrary code execution on affected devices. Auditor is an auditing and visibility platform that enables organizations to have a consolidated view of their IT environments from a single console.

See the full report here: https://thehackernews.com/2022/07/new-netwrix-auditor-bug-could-let.html

Hackers can spoof commit metadata to create false GitHub repositories

Security researchers have warned about an emerging new supply chain attack tactic involving spoofed metadata commits to present malicious GitHub repositories as legit

See the full report here: https://www.hackread.com/hackers-spoof-commit-metadata-false-github-repositories/

Conti shut down its ransomware operations. Or did it?

Despite the increased lookout for the Conti ransomware perpetrators after the Costa Rica fiasco, research indicates that it’s still up and running.

See the full report here: https://circleid.com/posts/20220717-conti-ransomware-still-alive-and-kicking

BlazBlue: Central Fiction exploit allows hackers to run files on your PC

BlazBlue: Central Fiction exploit allows a hacker to freely install malware to the host computer, letting them steal passwords or provide them remote access.

See the full report here: https://www.thegamer.com/blazblue-central-fiction-exploit-steam-pc/

WhatsApp malware targeting Indian army personnel detected

Intelligence agencies have detected a malicious malware file ‘CSO_SO on Deputation DRDO. apk’ said to have originated from a suspicious WhatsApp number to target Indian defence personnel.

See the full report here: https://www.newindianexpress.com/cities/delhi/2022/jul/17/security-at-risk-whatsapp-malware-targeting-army-personnel-detected-2477529.html

Hacker posts internal Roblox employee documents online

A hacker has posted what appears to be a cache of internal documents stolen from an employee who works for the massively popular gaming platform Roblox.

See the full report here: https://www.vice.com/en/article/g5vqx3/hacker-posts-internal-roblox-employee-documents-online

Russia fines Google $358 million for not removing banned info

A court in Moscow has imposed a fine of $358 million (21 billion rubles) on Google LLC for failing to restrict access to information considered prohibited in the country. The company has allegedly failed to remove information related to the promotion of extremism/terrorism, harm to minors, the "special military operation" in Ukraine, and more. The Russian Google subsidiary, Google LLC, filed for bankruptcy recently, claiming incapacity to continue business after a series of fines and asset confiscation.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-fines-google-358-million-for-not-removing-banned-info/

FBI Warns of Fake Cryptocurrency Apps Stealing Millions from Investors

The U.S. Federal Bureau of Investigation (FBI) has warned people of malicious cryptocurrency-themed apps to defraud investors. The agency has reportedly observed cyber criminals contacting U.S. investors, claiming to offer legitimate cryptocurrency investment services, and convincing investors to download fraudulent mobile apps.

See the full report here: https://thehackernews.com/2022/07/fbi-warns-of-fake-cryptocurrency-apps.html

Pegasus Spyware Used to Hack Devices of Pro-Democracy Activists in Thailand

At least 30 people (activists, academics, lawyers, and NGO workers) in Thailand have been reportedly targeted via the Pegasus spyware between October 2020 and November 2021. In many cases, the infections allegedly occurred slightly before protests and other political activities by the victims. At least one Pegasus customer is reportedly active in Thailand, although it's not known if it's connected to a specific government agency.

See the full report here: https://thehackernews.com/2022/07/pegasus-spyware-used-to-hack-devices-of.html

Google boots multiple malware-laced android apps from marketplace

Google removed eight Android apps, with 3M cumulative downloads, from its marketplace for being infected with a Joker spyware variant.

See the full report here: https://threatpost.com/google-boots-malware-marketplace/180241/

Roaming Mantis hits Android and iOS users in malware, phishing attacks

After hitting Germany, Taiwan, South Korea, Japan, the US, and the U.K. the Roaming Mantis operation moved to targeting Android and iOS users in France, likely compromising tens of thousands of devices.

See the full report here: https://www.bleepingcomputer.com/news/security/roaming-mantis-hits-android-and-ios-users-in-malware-phishing-attacks/

OpenDocument malware scams target hotels across the world

Security experts have recently discovered hackers on a particularly stealthy mission to compromise hotels in Latin America using OpenDocument text files.

See the full report here: https://www.techradar.com/in/news/opendocument-malware-scams-target-hotels-across-the-world

Malware author implants web shell to target Digium phone software

Researchers reported finding a malware group that targeted the Elastix system used in the Digium VoIP PBX system.

See the full report here: https://www.scmagazine.com/news/network-security/malware-author-implants-web-shell-to-target-digium-phone-software

S’pore organisations among most targeted in the world by ransomware attacks: Study

Ransomware attacks are on the rise, and organisations in Singapore are among the most targeted in the world, according to a recent study.

See the full report here: https://asianews.network/spore-organisations-among-most-targeted-in-the-world-by-ransomware-attacks-study/

CISA releases indicators of compromise for hard-hit VMware Horizon

Federal authorities warn a more complex form of malware is providing advanced persistent threat actors with vast command and control capabilities.

See the full report here: https://www.cybersecuritydive.com/news/cisa-vmware-horizon/627537/

Flipkart-owned Cleartrip reports user data breach

Cleartrip clarified that while some personal details of customers were a part of the leak, no sensitive information was compromised.

See the full report here: https://economictimes.indiatimes.com/tech/startups/travel-booking-website-cleartrip-announces-data-breach-in-internal-systems/articleshow/92957783.cms

Popular vehicle GPS tracker gives hackers admin privileges over SMS

Security researchers have found six vulnerabilities in the MiCODUS MV720 device, a GPS tracker reportedly present in about 1.5 million vehicles in 169 countries. After a successful attack, a threat actor could use the device for tracking or even immobilizing the vehicle carrying it. The bugs haven’t been fixed yet, as per reports.

See the full report here: https://www.bleepingcomputer.com/news/security/popular-vehicle-gps-tracker-gives-hackers-admin-privileges-over-sms/

Belgium says Chinese hackers attacked its Ministry of Defense

Chinese state-backed Advanced Persistent Threats (APT) targeted Belgium’s defense and interior ministries, the country’s foreign minister stated. The threat groups are APT 27, APT 30, APT 31, and UNSC 2814/GALLIUM/SOFTCELL, the minister added. The Chinese Embassy in Belgium denied the accusations.

See the full report here: https://www.bleepingcomputer.com/news/security/belgium-says-chinese-hackers-attacked-its-ministry-of-defense/

Russian hackers use fake DDoS app to infect pro-Ukrainian activists

Security researchers revealed that Russian-backed threat groups are still focusing their attacks on Ukrainian organizations. The Turla Russian APT group has deployed its first Android malware, disguised as a DDoS attack tool.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-ddos-app-to-infect-pro-ukrainian-activists/

Hacking group "8220" grows cloud botnet to more than 30,000 hosts

8220 Gang, a cryptomining gang, is exploiting Linux and cloud app vulnerabilities to grow their botnet to more than 30,000 infected hosts. The group is a low-skilled, financially motivated actor that infects AWS, Azure, GCP, Alitun, and QCloud hosts after targeting publicly available systems running vulnerable versions of Docker, Redis, Confluence, and Apache.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-8220-grows-cloud-botnet-to-more-than-30-000-hosts/

Building materials giant Knauf hit by Black Basta ransomware gang

The Knauf Group has announced that it has been the target of a cyberattack that disrupted its business operations, forcing its global IT team to shut down all IT systems to isolate the incident. Knauf is a German-based multinational building and construction materials producer that holds approximately 81% of the world’s wallboard market.

See the full report here: https://www.bleepingcomputer.com/news/security/building-materials-giant-knauf-hit-by-black-basta-ransomware-gang/

UK heat wave causes Google and Oracle cloud outages

An ongoing heatwave in the United Kingdom has led to Google Cloud and Oracle Cloud outages after cooling systems failed at the companies' data centers. Both companies report that they do not expect any further impact as they work to bring cooling systems back online.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-heat-wave-causes-google-and-oracle-cloud-outages/

EU warns of Russian cyberattack spillover, escalation risks

The Council of the European Union (EU) stated that Russian hackers increasingly attacking essential organizations worldwide could lead to spillover risks and potential escalation. The EU reminded Russia that all United Nations member states must adhere to the UN's Framework of responsible state behavior in cyberspace to ensure international security and peace.

See the full report here: https://www.bleepingcomputer.com/news/security/eu-warns-of-russian-cyberattack-spillover-escalation-risks/

Hackers steal 50,000 credit cards from 300 U.S. restaurants

Two web-skimming campaigns targeting three online ordering platforms (MenuDrive, Harbortouch, and InTouchPOS) led to 50,000 payment cards being stolen from customers of 300 restaurants in the United States. The card information is being sold on various darkweb marketplaces.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-50-000-credit-cards-from-300-us-restaurants/

Air-gapped systems leak data via SATA cable WiFi antennas

A security researcher has reportedly discovered a way (dubbed “SATAn”) to steal data from air-gapped systems by using serial ATA (SATA) cables present inside computers as a wireless antenna that sends out data via radio signals. The maximum distance from the air-gapped computer to the receiver cannot be greater than 120 cm (3.9 ft), or the bit error rate increases too much to ensure the integrity of the message.

See the full report here: https://www.bleepingcomputer.com/news/security/air-gapped-systems-leak-data-via-sata-cable-wifi-antennas/

Russian SVR hackers use Google Drive, Dropbox to evade detection

State-backed hackers part of Russia's Federation Foreign Intelligence Service (SVR) are reportedly using Google Drive cloud storage service to evade detection. APT29 (aka Cozy Bear or Nobelium) used this new tactic in recent campaigns targeting Western diplomatic missions and foreign embassies worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-svr-hackers-use-google-drive-dropbox-to-evade-detection/

New CloudMensis malware backdoors Macs to steal victims’ data

Threat actors are using previously undetected malware to backdoor macOS devices and exfiltrate information in a highly targeted series of attacks. The campaign, dubbed CloudMensis, uses pCloud, Yandex Disk, and Dropbox public cloud storage services for command-and-control (C2) communication.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cloudmensis-malware-backdoors-macs-to-steal-victims-data/

Cyber Fraud Through Misuse of MTNL Name, Logo; Users Alerted

Scammers are abusing the name and logo of MTNL, a state-run telecom service provider in India, to steal people’s information. Mobile customers receive WhatsApp messages on the pretext of KYC (know your customer) updates, which attempt to retrieve confidential information. The police has reminded people that MTNL does not carry out KYC verification over WhatsApp.

See the full report here: https://www.ndtv.com/india-news/cyber-fraud-through-misuse-of-mtnl-name-logo-users-alerted-3173035

Atlassian fixes critical Confluence hardcoded credentials flaw

Atlassian has patched a critical hardcoded credentials vulnerability (CVE-2022-26138) in Confluence Server and Data Center that could let remote, unauthenticated attackers log into vulnerable, unpatched servers. Atlassian stated that it has no evidence that the bug is being exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/

Sharkbot malware found in apps posing as antivirus solutions

Researchers have found the Sharkbot Android malware hiding under the guise of antivirus solutions on Google’s Play Store.

See the full report here: https://securityintelligence.com/news/sharkbot-malware-poses-antivirus-solutions/

Russian hackers behind SolarWinds are now hiding malware in Google Drive

The Russia-linked hacking group behind the infamous SolarWinds espionage campaign is now using Google Drive to stealthily deliver malware to its latest victims.

See the full report here: https://techcrunch.com/2022/07/20/solarwinds-hackers-google-drive-malware/

Suspected Gozi malware gang 'CIO' extradited to US on fraud, hacking charges

A man suspected of providing the IT infrastructure behind the Gozi banking trojan has been extradited to the US to face a string of computer fraud charges.

See the full report here: https://www.theregister.com/2022/07/20/alleged_gozi_malware_cio_extradited/

New Luna ransomware encrypts Windows, Linux, and ESXi systems

A new Rust-based ransomware family dubbed Luna can be used to encrypt devices running several operating systems, including Windows, Linux, and ESXi systems. Using a cross-platform language enables Luna ransomware to evade automated static code analysis attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/new-luna-ransomware-encrypts-windows-linux-and-esxi-systems/

New 'CloudMensis' malware uses cloud storage to spy on Mac users

Researchers have discovered a previously unknown macOS malware that leverages cloud storage to spy on compromised devices.

See the full report here: https://appleinsider.com/articles/22/07/20/new-cloudmensis-malware-uses-cloud-storage-to-spy-on-mac-users

Neopets data breach exposes personal data of 69 million members

Virtual pet website Neopets has suffered a data breach leading to the theft of source code and a database containing the personal information of over 69 million members. A hacker 'TarTarX' has started selling the source code and database for the Neopets.com website for four bitcoins, worth approximately $94,000 at today's prices.

See the full report here: https://www.bleepingcomputer.com/news/security/neopets-data-breach-exposes-personal-data-of-69-million-members/

Four new ransomware groups to be aware of

Here are three ransomware groups spotted recently. They are not believed to be associated with existing ones.

See the full report here: https://www.itworldcanada.com/article/four-new-ransomware-groups-to-be-aware-of/493428

Convincing ‘YouTube’ Google ads lead to Windows support scams

A realistic-looking Google Search YouTube advertisement is redirecting visitors to tech support scams pretending to be security alerts from Windows Defender. This malvertising campaign highlights that threat actors can create ads that impersonate companies to distribute malware, phishing pages, or other types of attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/convincing-youtube-google-ads-lead-to-windows-support-scams/

Cisco fixes bug that lets attackers execute commands as root

Cisco has addressed severe vulnerabilities (including CVE-2022-20857, CVE-2022-20861, and CVE-2022-20858) in the Cisco Nexus Dashboard data center management solution that can let remote attackers execute commands and perform actions with root or Administrator privileges. The company is unaware of publicly available exploits or active exploitation in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-bug-that-lets-attackers-execute-commands-as-root/

LinkedIn remains the most impersonated brand in phishing attacks

LinkedIn retains the top spot for the most impersonated brand in phishing campaigns observed during the second quarter of 2022, maintaining this position for the second quarter in a row. Phishing campaigns using fake LinkedIn emails try to mimic common messages from the platform to its users, such as “You appeared in 8 searchers this week”, or “You have one new message.”

See the full report here: https://www.bleepingcomputer.com/news/security/linkedin-remains-the-most-impersonated-brand-in-phishing-attacks/

FBI recovers $500,000 healthcare orgs paid to Maui ransomware

The FBI and U.S. Justice Department prosecutors have disrupted the activities of a North Korean state-sponsored group deploying ransomware known as Maui. The law enforcement officials were able to recover approximately $500,000 in Bitcoin, paid by victims such as a Kansas hospital and a medical provider in Colorado.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-recovers-500-000-healthcare-orgs-paid-to-maui-ransomware/

Tags: all industries,  global