The Underground Economist: Volume 2, Issue 13

Welcome back to The Underground Economist, Volume 2, Issue 13, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of July 22, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Breaking News: 2022-07-22 - 2022-07-28

WordPress plugin security audit unearths dozens of vulnerabilities impacting 60,000 websites

Researchers have unearthed vulnerabilities in dozens of WordPress plugins, affecting tens of thousands of installations.

See the full report here: https://portswigger.net/daily-swig/wordpress-plugin-security-audit-unearths-dozens-of-vulnerabilities-impacting-60-000-websites

In detail: How Conti ransomware hacked and encrypted the Costa Rican government

Details have emerged on how the Conti ransomware gang breached the Costa Rican government

See the full report here: https://www.bleepingcomputer.com/news/security/how-conti-ransomware-hacked-and-encrypted-the-costa-rican-government/

CNMF discloses malware in Ukraine

U.S. Cyber Command’s Cyber National Mission Force (CNMF), in close coordination with the Security Service of Ukraine, has released a list of indicators of compromise (IOCs) of malware seen in Ukraine

See the full report here: https://www.cisa.gov/uscert/ncas/current-activity/2022/07/21/cnmf-discloses-malware-ukraine

New ‘Lightning Framework’ Linux malware installs rootkits, backdoors

A new and previously undetected malware dubbed 'Lightning Framework' targets Linux systems and can be used to backdoor infected devices using SSH and deploy multiple types of rootkits.

See the full report here: https://www.bleepingcomputer.com/news/security/new-lightning-framework-linux-malware-installs-rootkits-backdoors/

Hackers attempt to infiltrate Ukrainian tech company with backdoor malware

Attackers targeted a large, unnamed software development company in Ukraine that services various state entities with a “fairly uncommon” piece of malware

See the full report here: https://www.cyberscoop.com/ukraine-supply-chain-attack-malware-gomet-backdoor/

Hackers use Evilnum malware to target cryptocurrency and commodities platforms

The advanced persistent threat (APT) actor tracked as Evilnum is once again exhibiting signs of renewed activity aimed at European financial and investment entities.

See the full report here: https://thehackernews.com/2022/07/hackers-use-evilnum-malware-to-target.html

Windows 11 KB5015882 update fixes bugs causing File Explorer to freeze

Microsoft has released the optional KB5015882 Preview cumulative update for Windows 11 with 20 fixes or improvements. This update is part of Microsoft's July 2022 monthly "C" update, allowing users to test the upcoming updates and fixes in the August 2022 Patch Tuesday. Preview updates do not contain security updates and only include bug fixes and performance improvements.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5015882-update-fixes-bugs-causing-file-explorer-to-freeze/

Ex-Coinbase manager charged in first crypto insider-trading case

The U.S. Department of Justice has charged a former Coinbase manager and two co-conspirators with wire fraud conspiracy and scheme to commit insider trading in cryptocurrency assets. This is the first case of its kind in litigation history. Ishan Wahi knew when Coinbase was planning to add new cryptocurrency assets before the company announced it publicly, and allegedly coordinated with his co-conspirators to purchase large amounts in advance.

See the full report here: https://www.bleepingcomputer.com/news/cryptocurrency/ex-coinbase-manager-charged-in-first-crypto-insider-trading-case/

Chrome zero-day used to infect journalists with Candiru spyware

The spyware vendor Candiru reportedly used a zero-day vulnerability (CVE-2022-2294) in Google Chrome to spy on journalists and other high-interest individuals in the Middle East with the “DevilsTongue” spyware. When Google patched the zero-day on July 4, 2022, it disclosed that the flaw was under active exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/chrome-zero-day-used-to-infect-journalists-with-candiru-spyware/

Microsoft Teams outage also takes down Microsoft 365 services

A recent deployment at Microsoft that featured a broken connection to an internal storage service led to a Microsoft 365 outage that affected services that came with Teams integration. Microsoft Word, Office Online, and SharePoint Online and other services were affected.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-outage-also-takes-down-microsoft-365-services/

Microsoft starts blocking Office macros by default, once again

Microsoft announced today that it resumed the rollout of VBA macro auto-blocking in downloaded Office documents after temporarily rolling it back earlier this month following user feedback. The company has improved its user and admin support documentation to make it easier to understand the available options when a macro is blocked.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-starts-blocking-office-macros-by-default-once-again/

New Redeemer ransomware version promoted on hacker forums

A threat actor is promoting a new version of their free-to-use Redeemer ransomware builder on hacker forums. The new version 2.0 release is reportedly written entirely in C++ and works on Windows Vista, 7, 8, 10, and 11, featuring multi-threaded performance and a medium AV detection rate.

See the full report here: https://www.bleepingcomputer.com/news/security/new-redeemer-ransomware-version-promoted-on-hacker-forums/

Amadey malware pushed via software cracks in SmokeLoader campaign

A new version of the Amadey Bot malware is distributed through the SmokeLoader malware, using software cracks and keygen sites as lures.

See the full report here: https://www.bleepingcomputer.com/news/security/amadey-malware-pushed-via-software-cracks-in-smokeloader-campaign/

North Korean hackers attack EU targets with Konni RAT malware

Threat analysts have uncovered a new campaign attributed to APT37, a North Korean group of hackers, targeting high-value organizations in Europe.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-attack-eu-targets-with-konni-rat-malware/

QBot phishing uses Windows Calculator sideloading to infect devices

The operators of the QBot malware have been using the Windows Calculator to side-load the malicious payload on infected computers.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-phishing-uses-windows-calculator-sideloading-to-infect-devices/

An entire Canadian town is being extorted by ransomware cyber criminals

Canada town of St. Marys has been targeted by ransomware group LockBit.

See the full report here: https://www.databreaches.net/an-entire-canadian-town-is-being-extorted-by-ransomware-cyber-criminals/

Policybazaar says its IT system hacked; authorities informed

PB Fintech, the parent company of Policybazaar Insurance Brokers Private Ltd, said that the IT system of the firm was hacked on July 19.

See the full report here: https://www.ndtv.com/business/policybazar-says-its-it-system-compromised-authorities-informed-3189630

Mumbai: Ingenious campaign aimed at hacking computers of engineers uncovered

An ingenious campaign that aims to slip malware into computers of engineers and operators working in industries has come to light.

See the full report here: https://www.freepressjournal.in/mumbai/mumbai-ingenious-campaign-aimed-at-hacking-computers-of-engineers-uncovered

Massive Microsoft 365 outage caused by faulty ECS deployment

Microsoft has revealed that the recent Microsoft 365 worldwide outage was triggered by a faulty Enterprise Configuration Service (ECS) deployment. ECS is an internal central configuration repository designed to enable Microsoft services to make wide-scope dynamic changes across multiple services and features, as well as targeted ones such as specific configurations per tenant or user.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-caused-by-faulty-ecs-deployment/

Digital security giant Entrust breached by ransomware gang

Security firm Entrust has confirmed that it suffered a cyberattack (on June 18, 2022) where threat actors breached its network and stole data from internal systems. It is not known yet if purely corporate data was stolen or customers' and vendors' as well.

See the full report here: https://www.bleepingcomputer.com/news/security/digital-security-giant-entrust-breached-by-ransomware-gang/

Hacker selling Twitter account data of 5.4 million users for $30k

Twitter has reportedly suffered a data breach after threat actors used a vulnerability to build a database of phone numbers and email addresses belonging to 5.4 million accounts, with the data now up for sale on a hacker forum. The bug allows anyone without any authentication to obtain a twitter ID of any user by submitting a phone number/email even if the user has prohibited this action in the privacy settings.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-selling-twitter-account-data-of-54-million-users-for-30k/

SonicWall: Patch critical SQL injection bug immediately

SonicWall has published a security advisory to warn of a critical SQL injection flaw (CVE-2022-22280, severity rating of 9.4) impacting the GMS (Global Management System) and Analytics On-Prem products. SonicWall stated that it is not aware of any reports of active exploitation in the wild or the existence of a proof of concept (PoC) exploit for this vulnerability as of yet, but advises people to upgrade to the patched version immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-patch-critical-sql-injection-bug-immediately/

Hackers breach Ukrainian radio network to spread fake news about Zelenskiy

Ukrainian media group TAVR Media confirmed that it was hacked to spread fake news about President Zelenskiy being in critical condition and under intensive care. The attackers reportedly breached TAVR Media's servers and broadcasting systems to spread fake news suggesting that the President is under intensive care, in critical condition, with Parliament Chairman Ruslan Stefanchuk acting in his stead.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-breach-ukrainian-radio-network-to-spread-fake-news-about-zelenskiy/

Atlassian: Confluence hardcoded password was leaked, patch now!

Atlassian warned customers to immediately patch a critical vulnerability (CVE-2022-26138) that provides remote attackers with hardcoded credentials to log into unpatched Confluence Server and Data Center servers. The company announced that an external party has discovered and publicly disclosed the hardcoded password on Twitter, and the bug is likely to be exploited in the wild now that the hardcoded password is publicly known.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-confluence-hardcoded-password-was-leaked-patch-now/

CosmicStrand UEFI malware found in Gigabyte, ASUS motherboards

Chinese-speaking hackers have been using since at least 2016 malware that lies virtually undetected in the firmware images for some motherboards

See the full report here: https://www.bleepingcomputer.com/news/security/cosmicstrand-uefi-malware-found-in-gigabyte-asus-motherboards/

Source code for Rust-based info-stealer released on hacker forums

The source code for an information-stealing malware coded in Rust has been released for free on hacking forums. Security analysts already report active use

See the full report here: https://www.bleepingcomputer.com/news/security/source-code-for-rust-based-info-stealer-released-on-hacker-forums/

A ‘top tier’ hacking gang is likely to be behind Entrust ransomware attack

Digital identity provider Entrust has confirmed an ongoing ransomware attack which has seen data from its internal systems stolen.

See the full report here: https://techmonitor.ai/technology/cybersecurity/entrust-ransomware-attack

LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities

In June 2022, LockBit revealed version 3.0. Technical analysis of this variant and its behaviors show similarities with BlackMatter ransomware

See the full report here: https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html

Italy investigating ransomware attack on tax agency

LockBit claims Italy’s tax agency as a victim, but the company investigating the alleged attack said Monday there was no evidence of a breach

See the full report here: https://therecord.media/italy-investigating-ransomware-attack-on-tax-agency/

Researcher finds Russia-based ransomware network with foothold in U.S.

A Russia-based ransomware command and control network has been found to have a foothold in at least one U.S. network, according to researchers

See the full report here: https://therecord.media/researcher-finds-russia-based-ransomware-network-with-foothold-in-u-s/

Blue Cross and Blue Shield (BCBS) of Massachusetts reports third-party vendor data breach

Blue Cross and Blue Shield (BCBS) of Massachusetts reported a third-party vendor data breach involving its pension plan payment vendor

See the full report here: https://healthitsecurity.com/news/bcbs-of-massachusetts-reports-third-party-vendor-data-breach

California Privacy Protection Agency Issues Notice of Proposed Rulemaking

The California Privacy Protection Agency has proposed crucial changes to the California Consumer Privacy Act (CCPA) regulations

See the full report here: https://www.jdsupra.com/legalnews/california-privacy-protection-agency-2380592/

CERT-in flags vulnerabilities in Apple Watches running older OS

CERT-In has flagged multiple severe vulnerabilities on Apple Watch models running watchOS versions older than version 8.7

See the full report here: https://thefederal.com/news/cert-in-flags-vulnerabilities-in-apple-watches-running-older-os/

Spotted: Security vulnerability that affect 10% of all NFT projects

Vulnerability allows attackers to claim the best and most valuable NFTs at launch before reselling them for great profit on the secondary market

See the full report here: https://cryptobriefing.com/sayfer-identifies-security-vulnerability-affecting-10-of-all-nft-projects/

Hackers exploited PrestaShop zero-day to breach online stores

Hackers are targeting websites using the PrestaShop platform, via a previously unknown vulnerability chain (CVE-2022-36408) to perform code execution and potentially steal customers' payment information. Users should upgrade all used modules to the latest available version and apply the PrestaShop security update version 1.7.8.7. If the site has already been compromised, applying the security update won't solve the problem.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploited-prestashop-zero-day-to-breach-online-stores/

Hackers scan for vulnerabilities within 15 minutes of disclosure

A recently published security report has revealed how threat actors scan for vulnerable endpoints within 15 minutes of a new CVE being publicly disclosed. Therefore, it is extremely important to keep devices off the Internet if possible, and only expose them through VPNs or other security gateways.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-scan-for-vulnerabilities-within-15-minutes-of-disclosure/

Microsoft: IIS extensions increasingly used as Exchange backdoors

Microsoft has disclosed that attackers increasingly use malicious Internet Information Services (IIS) web server extensions to backdoor unpatched Exchange servers as they have lower detection rates than web shells. In a recent campaign that targeted Microsoft Exchange servers, attackers deployed malicious IIS extensions to gain access to victims' email mailboxes, run commands remotely, and steal credentials and confidential data.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-iis-extensions-increasingly-used-as-exchange-backdoors/

New Android malware apps installed 10 million times from Google Play

Security researchers have discovered malicious Android apps posing as image-editing tools, virtual keyboards, system optimizers, wallpaper changers, etc. Such apps push intrusive ads, subscribe users to premium services, and steal victims' social media accounts. Google has removed most of these apps, but at the time of this report, a few still remain this.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-malware-apps-installed-10-million-times-from-google-play/

Hackers steal $6 million from blockchain music platform Audius

Hackers stole over 18 million AUDIO tokens (worth approximately $6 million) from the decentralized music platform Audius. Audius is a decentralized streaming platform hosted on the Ethereum blockchain where artists can earn AUDIO tokens by sharing their music, and users can earn tokens by curating and listening to content. The platform responded to the hack by freezing several services until the developers could deploy fixes to prevent further theft of tokens.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-6-million-from-blockchain-music-platform-audius/

U.S. doubles reward for tips on North Korean-backed hackers

The U.S. State Department has increased rewards paid to anyone providing information on any North Korean-sponsored threat groups' members to $10 million. Such groups include Andariel, APT38, Bluenoroff, Guardians of Peace, Kimsuky, and the Lazarus Group.

See the full report here: bleepingcomputer.com/news/security/us-doubles-reward-for-tips-on-north-korean-backed-hackers/

Hackers Increasingly Using WebAssembly Coded Cryptominers to Evade Detection

Hackers are abusing WebAssembly (Wasm) on the browser as part of a cryptojacking campaign. WebAssembly, which is supported by all major browsers, is a binary instruction format that offers performance improvements over JavaScript.

See the full report here: https://thehackernews.com/2022/07/hackers-increasingly-using-webassembly.html

Critical FileWave MDM Flaws Open Organization-Managed Devices to Remote Hackers

Researchers have found two vulnerabilities relating to authentication bypass (CVE-2022-34907) and the use of a hard-coded cryptographic key (CVE-2022-34906) in FileWave's mobile device management (MDM) system. These bugs could permit an attacker to abuse the legitimate features to exfiltrate sensitive data and install malicious packages. FileWave MDM is a cross-platform mobile device management solution that allows IT administrators to manage and monitor all of an organization's devices.

See the full report here: https://thehackernews.com/2022/07/critical-filewave-mdm-flaws-open.html

New Facebook malware targets business accounts

A new type of Facebook malware attempts to compromise business accounts for financial gain

See the full report here: https://www.csoonline.com/article/3668002/new-facebook-malware-targets-business-accounts.html

Luca Stealer malware spreads rapidly after code handily appears on GitHub

A new info-stealer malware is spreading rapidly in the wild; the developer behind it recently released the source code on GitHub

See the full report here: https://www.theregister.com/2022/07/26/luca-stealer-rust-cyble/

Anti-vaxxers looking for love found their data exposed

A dating app for the unvaccinated, Unjected, left user data totally unprotected, found researchers

See the full report here: https://gizmodo.com/anti-vax-dating-site-unjected-suffers-data-breach-covid-1849333490

Kansas MSP shuts down cloud services to fend off cyberattack

A managed service provider named NetStandard suffered a cyberattack (believed to be ransomware), causing the company to shut down its MyAppsAnywhere cloud services (consisting of hosted Dynamics GP, Exchange, Sharepoint, and CRM services). MSPs are a high-value target for ransomware gangs as they offer an easy way to encrypt numerous companies at once through a single breach.

See the full report here: https://www.bleepingcomputer.com/news/security/kansas-msp-shuts-down-cloud-services-to-fend-off-cyberattack/

New ‘Robin Banks’ phishing service targets BofA, Citi, and Wells Fargo

A new phishing as a service (PhaaS) platform named “Robin Banks” is offering phishing kits targeting the customers of banks, including Citibank, Bank of America, Capital One, Wells Fargo, PNC, U.S. Bank, Lloyds Bank, the Commonwealth Bank in Australia, and Santander. The group is known for high-quality phishing pages to target customers of large financial organizations. People should never click on links sent via SMS or email, and always confirm that the website landed on is the official one.

See the full report here: https://www.bleepingcomputer.com/news/security/new-robin-banks-phishing-service-targets-bofa-citi-and-wells-fargo/

Spain arrests suspected hackers who sabotaged radiation alert system

The Spanish police have announced the arrest of two hackers suspected to be responsible for cyberattacks on the country's radioactivity alert network (RAR). The suspects allegedly gained illegitimate access to the General Directorate of Civil Protection and Emergencies DGPGE network and attempted to delete the RAR management web application in the control center.

See the full report here: https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-hackers-who-sabotaged-radiation-alert-system/

Microsoft: Windows, Adobe zero-days used to deploy Subzero malware

A threat group Knotweed – which targets European and Central American entities using a malware toolset dubbed Subzero – has been linked to an Austrian spyware vendor. The malware can be used to hack targets' phones, computers, and network and internet-connected devices.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-adobe-zero-days-used-to-deploy-subzero-malware/

Paytm Mall Says User Data 'Safe' After Cyber Breach Affecting 3.4 Million Users Reported

This was stated in response to reports of a data breach that compromised data including phone numbers, email addresses, dates of birth, genders, geographic locations, income levels, names and purchases of nearly 3.4 million users.

See the full report here: https://www.news18.com/news/tech/paytm-mall-says-user-data-safe-after-cyber-breach-affecting-3-4-million-users-reported-5637841.html

This malware is able to survive even if you reinstall Windows

By infecting the UEFI from a motherboardthe rootkit is capable of executing malicious processes from the booting of the operating system

See the full report here: https://www.gearrice.com/update/this-malware-is-able-to-survive-even-if-you-reinstall-windows/

FIN7 threat actors add ransomware to their arsenal

Due to the highly developed tactics and discipline the group has shown over its multi-year history, FIN7’s move into ransomware is cause for concern

See the full report here: https://securityintelligence.com/news/fin7-threat-actors-ransomware-attack/

FileWave fixes bugs that left 1,000+ orgs open to ransomware, data theft

Vulnerabilities in endpoint management software allowed remote attacker bypass authentication and take control of deployment and associated devices

See the full report here: https://www.theregister.com/2022/07/27/filewave_mdm_fixes/