Threat Intelligence Bulletin: 08/12/2022

Breach Disclosure: GeekBrains

On June 3, 2022, and June 23, 2022, the Telegram Channel "Kingsman" posted a data breach package (in two parts) targeting GeekBrains, a Russia-based online educational platform for programmers. From this package, ZeroFox extracted 213,003 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 3, 2022, and June 23, 2022, the Telegram channel Kingsman posted a data breach package (in two parts) targeting GeekBrains, an online educational platform for programmers operating from Russia. The threat actor who posted the package noted that the first part of the data package includes 105,000 lines and the second part contains 107,535 lines of user information – with names, email addresses, and telephone numbers. The data package was also circulated on the underground forum BreachForums (on June 1, 2022, by the threat actor "ougogz") and in the Telegram channel KelvinSecurity - Dark Market & Leaks on June 3, 2022 and June 23, 2022. From the package shared on the Telegram channel Kingsman, ZeroFox extracted 213,003 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include name and phone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Sugar Daddy Catch

On July 4, 2022, a recently registered threat actor "SQLBOY" posted a data breach package targeting the organization Sugar Daddy Catch, a dating website operating from the United States. From this package, ZeroFox extracted 125,500 usernames and/or email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On July 4, 2022, a recently registered threat actor "SQLBOY" posted a data breach package targeting the organization Sugar Daddy Catch (sugardaddycatch[.]com), a dating website operating from the United States. From this package, ZeroFox extracted 125,500 usernames and/or email addresses. Of this total, an assessed 125,497 records contained hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Soar Games

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On July 1, 2022, a reputed threat actor "KillNet" from the BreachForums posted a data breach package targeting Soar Games (soargames.com), a gaming website operating from Canada. The threat actor noted that the data dump is from December 2019 which includes the database with 5M users with email addresses, IP addresses, usernames, passwords. From this package, ZeroFox extracted 4,781,073 usernames, hashed passwords and email addresses. Other notable data fields observed in this package include IP address and security questions.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Turnstiles

On June 18, 2022, a recently registered threat actor "300rur" from BreachForum posted a data breach package targeting Turnstiles, a community organization that arranges excursions to innovative sites in Moscow. The threat actor noted that the data dump includes 146k lines of user information. From the package shared on BreachForum, ZeroFox extracted 146,573 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 18, 2022, a recently registered threat actor "300rur" from BreachForum posted a data breach package targeting Turnstiles (turniketov[.]net), a community organization arranging excursions to innovative sites in Moscow. The threat actor noted that the data dump includes 146k lines of user information. The data dump was also circulated in a Telegram channel "Data1eaks | Утечки баз данных" (hxxps[:]//t[.]me/data1eaks/589) on June 16, 2022. From the package shared on BreachForum, ZeroFox extracted 146,573 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package include gender, date of birth, phone number, and passport detail.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Q2 2022 Public Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-08-05a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Public Sector Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on July 21, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Threat actors continued to exchange ideas on how to maneuver within the economic and political constraints brought about by the conflict in Ukraine in Q2. Public sector organizations faced a persistent threat from social engineering campaigns, with particularly increases in the use of fraudulent applications, fake Windows 11 upgrades, and employment-related scams to steal credentials and deploy trojans. The threat of vulnerability exploitation grew, averaging almost 70 Common Vulnerabilities and Exposures (CVEs) disclosed per day—up from 56 per day at the end of 2021. The pace of vulnerability disclosure likely represents a new normal. The threat to the public sector from Initial Access Brokers (IABs) continued to fall in Q2, despite the market showing signs of resurgence in other sectors. Although spyware received significant media attention in Q2 2022—in particular, long-standing targeting of high-profile public sector individuals globally—this likely represents little change in the scale of threat posed. The threat from ransomware and digital extortion likely increased, with multiple central government and local government entities targeted. Ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. Lastly, while the ongoing war in Ukraine continued to be the primary driver of geopolitical risk, possible EU and NATO expansion—and new sanctions on Russia—will likely trigger Russian-leaning groups to target high-profile entities.

Key Findings

Cybercriminals are concerned with challenges converting cryptocurrency to fiat currency.
Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
The threat from CVEs and previously-unknown software vulnerabilities likely increased.
The threat from IABs continued to fall in the public sector in Q2, despite the IAB market showing signs of resurgence in threats to other sectors.
Although spyware received significant media attention in Q2—in particular, long-standing targeting of high-profile public sector individuals globally—this likely represents little change in the scale of threat posed.
The threat to public sector organizations from ransomware and digital extortion likely increased. Eliciting payment from victims may be getting more difficult.

Q2 2022 Manufacturing Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-07-29a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Manufacturing Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on July 28, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Threat actors continued to exchange ideas on how to maneuver within the economic and political constraints brought about by the conflict in Ukraine in Q2. Manufacturing organizations faced a persistent threat from social engineering campaigns, with particularly increases in the use of fraudulent applications, fake Windows 11 upgrades, and employment-related scams to steal credentials and deploy trojans. The threat of vulnerability exploitation grew, averaging almost 70 Common Vulnerabilities and Exposures (CVEs) disclosed per day—up from 56 per day at the end of 2021. The pace of vulnerability disclosure likely represents a new normal. The threat to the manufacturing sector from Initial Access Brokers (IABs) continued to fall in Q2, despite the market showing signs of resurgence in other sectors. The threat from ransomware and digital extortion likely slightly reduced, though automotive supply chains appeared to be disproportionately impacted. Ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. While the ongoing war in Ukraine continued to be the primary driver of geopolitical risk, possible EU and NATO expansion—and new sanctions on Russia—will likely trigger Russia state-backed groups to target high-profile entities.

Key Findings

Cybercriminals are increasingly concerned with challenges converting cryptocurrency to fiat currency.
Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
The threat from CVEs and previously-unknown software vulnerabilities likely increased.
The threat from IABs continued to fall in Q2, despite the IAB market showing signs of resurgence in threats to other sectors.
There was a negligible change in the threat from botnets, despite widespread media attention.
The threat to manufacturing organizations from ransomware and digital extortion likely slightly decreased. Eliciting payment from victims may be getting more difficult.

Q2 2022 Retail Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-07-29a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Retail Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on July 28, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Threat actors continued to exchange ideas on how to maneuver within the economic and political constraints brought on by the conflict in Ukraine. Social engineering campaigns remained a persistent threat to retail organizations, including increased use of fraudulent applications, fake Windows 11 upgrades, and employment related scams to steal credentials and deploy trojans. Vulnerability exploitation also continued to grow, averaging almost 70 CVEs disclosed per day, up from 56 per day at the end of 2021. The pace of vulnerability disclosure likely represents a new normal. The threat to the retail sector from Initial Access Brokers continued to fall in Q2, despite the market showing signs of resurgence in other sectors. The threat to retail organizations from ransomware and digital extortion likely slightly increased. Ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. While the ongoing war in Ukraine continued to be the primary driver of geopolitical risk, possible EU and NATO expansion - and new sanctions on Russia - will likely trigger Russia state-backed groups to target high profile entities.

Key Findings

Cybercriminals are increasingly concerned with challenges converting cryptocurrency to fiat currency
Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
The threat from Common Vulnerabilities and Exposures and previously unknown software vulnerabilities likely increased.
The threat from IABs continued to fall in Q2, despite the IAB market showing signs of resurgence in threat to other sectors.
There was a negligible change in the threat from botnets, despite widespread media attention
The threat to retail organizations from ransomware and digital extortion likely slightly increased. Eliciting payment from victims may be getting more difficult.

Q2 2022 Healthcare Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-08-05a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Healthcare Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

Executive Summary

Threat actors continued to exchange ideas on how to maneuver within the economic and political constraints brought about by the conflict in Ukraine in Q2. Healthcare sector organizations faced a persistent threat from social engineering campaigns, with particularly increases in the use of fraudulent applications, fake Windows 11 upgrades, and employment-related scams to steal credentials and deploy trojans. The threat of vulnerability exploitation grew, averaging almost 70 Common Vulnerabilities and Exposures (CVEs) disclosed per day—up from 56 per day at the end of 2021. The pace of vulnerability disclosure likely represents a new normal. The threat from Initial Access Brokers (IABs) showed signs of resurgence, though this increase was not seen across all sectors. The threat from malware remained broadly consistent with previous quarters, underpinned by the high rate of new infostealers and trojans emerging and older versions launching new campaigns. Ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. While the ongoing war in Ukraine continued to be the primary driver of geopolitical risk, possible EU and NATO expansion—and new sanctions on Russia—will likely trigger Russia state-backed groups to target high-profile entities.

Key Findings

Cybercriminals are concerned with challenges converting cryptocurrency to fiat currency.
Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
The threat from CVEs and previously-unknown software vulnerabilities likely increased.
The IAB marketplace showed signs of resurgence.
The threat of malware was underpinned by the high rate of new infostealers and trojans emerging and older versions launching new campaigns used to conduct data breaches.
There was a negligible change in the threat to most healthcare organizations from botnets, despite widespread media attention.
The threat to healthcare sector organizations from ransomware and digital extortion likely increased. Eliciting payment from victims may be getting more difficult.

Q2 2022 Financial Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-07-22a

TLP: WHITE

ZeroFox Intelligence is excited to announce the release of our Financial Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

Executive Summary

Botnet and malware deployment also remained high, including infostealers and banking trojans. Conversely, the threat to financial organizations from ransomware and digital extortion likely reduced slightly. Threat actors appear to be changing their extortion tactics due to struggles eliciting payment from victims. While the ongoing war in Ukraine continued to be the primary driver of geopolitical risk, possible EU and NATO expansion - and new sanctions on Russia - will likely trigger Russia state-leaning groups to target high profile entities.

Key Findings

Cybercriminals are increasingly concerned with challenges converting cryptocurrency to fiat currency
Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
The threat from Common Vulnerabilities and Exposures and previously unknown software vulnerabilities likely increased.
The Initial Access Broker marketplace showed signs of resurgence.
There was a negligible change in the threat from botnets, despite widespread media attention.

Profile: Black Basta Ransomware

Product Serial: P-2022-08-16a

TLP: GREEN

In the following profile, ZeroFox Intelligence provides an overview on the Black Basta ransomware group.

Standing Intelligence Requirements

DDW MAL

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:00 AM (EDT) on August 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Black Basta is a highly-effective ransomware strain used by threat actors to infect and extort victims. Consistent with most ransomware collectives, Black Basta operators exfiltrate sensitive corporate data before encrypting devices and leverage double-extortion tactics, threatening to release the exfiltrated data if ransom demands are not met. The ransomware was identified in mid-April 2022 following the first reported incidents of compromise, though evidence indicates it was in development as early as February 2022. The group also made its presence known on the Russian underground forum Exploit.in in late April; ZeroFox Intelligence observed a user with the name “Black Basta” posting an advertisement that offered to purchase and monetize access to corporate networks for a percentage of profits. According to the announcement, the actor was interested in organizations located in the United States, Canada, the United Kingdom, Australia, and New Zealand.

Since its emergence, researchers have linked Black Basta to Conti ransomware, with intelligence suggesting that the group is likely one of several Conti subdivisions forming part of a measured Conti rebranding. Researchers tracking Black Basta’s activity have indicated that the group—which appeared a month before Conti announced its shutdown—has shown signs of overlap with Conti’s tactics, techniques, and procedures (TTPs), citing similarities between the groups’ data leak sites (DLS), payment sites, recovery portals, and negotiation methods. Notably, Conti denied reports linking it to Black Basta in May 2022, though this is to be expected if the group is attempting to hide its affiliations to avoid potential backlash.

ZeroFox Intelligence has identified no evidence directly linking Black Basta to Conti but assesses with moderate confidence that Black Basta likely includes former members of Conti or other previously shuttered groups. ZeroFox Intelligence notes the tendency for ransomware gangs and affiliates to rebrand or restructure to divert attention from authorities or to avoid sanctions. For instance, Darkside—responsible for the Colonial Pipeline attack in May 2021—is considered to have resurfaced as BlackMatter after ceasing its operations due to intense scrutiny from authorities. Likewise, Conti is previously assessed to have succeeded Ryuk ransomware in 2020 and, due to the significant disruption inflicted by the ContiLeaks breach in February 2022, is highly likely to be reshaping the organization again in an attempt to avoid further exposure.

The rate at which Black Basta has accumulated victims and developed its capabilities also indicates the involvement of seasoned ransomware operatives. In the first two months of operating, Black Basta offered its own Ransomware-as-a-Service, partnered with QBot malware, and developed a Linux-based variant to target VMware ESXi virtual machines (VMs) on enterprise servers—putting it on par with groups such as BlackMatter, Hive, and Lockbit. As a result, Black Basta has quickly become one of the most prolific variants. Between April and August 2022, Black Basta accounted for the third-highest number of ransomware incidents among the most notable strains, targeting over 50 organizations globally across multiple industries. ZeroFox Intelligence notes that Black Basta has so far shown a propensity to target organizations within the manufacturing, retail, and construction industries.

Breaking News: 2022-08-12 - 2022-08-18

GitHub's new privacy policy sparks backlash over tracking cookies

GitHub has announced that it would be adding non-essential cookies on some marketing web pages starting from September 1, and offered a thirty-day comment period for users. These non-essential cookies ("tracking cookies") refer to a class of cookies that are shared across multiple websites and web services. The upcoming privacy policy changes received widespread criticism from developers.

See the full report here: https://www.bleepingcomputer.com/news/security/githubs-new-privacy-policy-sparks-backlash-over-tracking-cookies/

Microsoft shares workarounds for Outlook crashing after launch

Microsoft has provided affected customers with several workarounds while it works on a resolution for a known issue causing Outlook for Microsoft 365 to freeze and crash right after opening. Microsoft stated that it's currently investigating this ongoing issue and will update the relevant support article as soon as a fix is available.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-workarounds-for-outlook-crashing-after-launch/

US govt will pay you $10 million for info on Conti ransomware members

The U.S. State Department announced a $10 million reward for information on five high-ranking Conti ransomware members (“Target,” “Tramp,” “Dandis,” “Professor,” and “Reshaev.”) The Conti Ransomware is a notorious ransomware operation believed to be responsible for over 1,000 attacks worldwide and receiving ransom payments of over $150 million.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-will-pay-you-10-million-for-info-on-conti-ransomware-members/

Zimbra auth bypass bug exploited to breach over 1,000 servers

Attackers have been abusing a Zimbra Collaboration Suite remote code execution flaw (CVE-2022-27925) requiring authentication with the help of an auth bypass bug (tracked as CVE-2022-37042 and patched yesterday). Successful exploitation allows the attackers to deploy web shells on specific locations on the compromised servers to gain persistent access. Zimbra is an email and collaboration platform used by more than 200,000 businesses from over 140 countries.

See the full report here: https://www.bleepingcomputer.com/news/security/zimbra-auth-bypass-bug-exploited-to-breach-over-1-000-servers/

FBI: Zeppelin ransomware may encrypt devices multiple times in attacks

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) warned U.S. organizations that attackers deploying Zeppelin ransomware might encrypt their files and shared guidance on mitigating the threat. Zeppelin is a Ransomware as a Service (RaaS) operation whose malware went through several name changes from VegaLocker to Buran, VegaLocker, Jamper, and now Zeppelin.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-zeppelin-ransomware-may-encrypt-devices-multiple-times-in-attacks/

UK NHS service recovery may take a month after MSP ransomware attack

Managed service provider (MSP) Advanced confirmed that a ransomware attack on its systems disrupted emergency services (111) from the United Kingdom's National Health Service (NHS). The MSP stated that it took immediate action to mitigate the risk and isolated Health and Care environments where the incident was detected. Reconnecting to the environments is expected to take at least three to four weeks for customers of the MSP.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-nhs-service-recovery-may-take-a-month-after-msp-ransomware-attack/

eSentire Researchers Unmask the Top Malware Supplier to Russia’s Most Notorious Financial Crime Families: Fin6 and Cobalt Group

Researchers have found the threat actor behind the Golden Chickens malware, the weapon of choice for Russia’s most infamous financial cybercrime families— FIN6 and Cobalt Group. The threat actor goes by the username “badbullzvenom” and has been committing online crimes since at least 2004.

See the full report here: https://www.globenewswire.com/news-release/2022/08/11/2496993/0/en/eSentire-Researchers-Unmask-the-Top-Malware-Supplier-to-Russia-s-Most-Notorious-Financial-Crime-Families-Fin6-and-Cobalt-Group.html

Black Basta: New ransomware threat aiming for the big league

Black Basta was first detected in April 2022, but researchers found evidence the operation was launched in February and it took time to test the new malware strain. It saw immediate success in several months of operation. Some believe it has splintered off from the infamous Conti gang.

See the full report here: https://www.csoonline.com/article/3669256/black-basta-new-ransomware-threat-aiming-for-the-big-league.html

Cyber-Insurance Fail: Most Businesses Lack Ransomware Coverage

Study shows that businesses are increasingly concerned about how they will meet ransomware demands. Only 19 percent of those surveyed have ransomware coverage limits above $600,000, while over half (59%) hoped the government would cover damages when future attacks are linked to other nation-states.

See the full report here: https://www.prnewswire.com/news-releases/blackberry-cyber-insurance-study-reveals-businesses-hope-for-greater-assistance-in-paying-ransomware-demands-301602502.html

Ransomware attack cost Hanesbrands $100 million in sales

Hanesbrands disclosed that a ransomware attack launched in May cost it about $100 million in global underwear sales during the second quarter. The U.S.-based apparel manufacturer reported in a May 31 regulatory filing that it began experiencing the ransomware attack on May 24.

See the full report here: https://journalnow.com/business/local/ransomware-attack-cost-hanesbrands-100-million-in-sales-its-unclear-whether-winston-salem-company-paid/article_864594aa-196f-11ed-8111-433f2a5df7a7.html

Starlink successfully hacked using $25 modchip

A Belgian security researcher has successfully hacked the SpaceX operated Starlink satellite-based internet system using a homemade circuit board that cost around $25 to develop. Lennert Wouters revealed a voltage fault injection attack on a Starlink User Terminal (UT)—or satellite dish people use to access the system – that allowed him to break into the dish and explore the Starlink network from there

See the full report here: https://threatpost.com/starlink-hack/180389/

Atlas MedStaff LLC confirms recent data breach following “sophisticated cyberattack”

Atlas MedStaff LLC reported a data breach with a state attorney general’s office, explaining that, as a result of a recent cyberattack, certain consumer data ended up in the hands of hackers. Atlas has not been confirmed which types of data were compromised.

See the full report here: https://www.jdsupra.com/legalnews/atlas-medstaff-llc-confirms-recent-data-4894412/

Watson Electrical announces data breach following ransomware attack

WECC Holdings, Inc., which does business under the name Watson Electrical, reported a data breach with a state attorney general’s office, explaining that, as a result of a recent ransomware attack, certain consumer data may have ended up in the hands of hackers. It has not been confirmed which types of data were compromised.

See the full report here: https://www.jdsupra.com/legalnews/wecc-inc-d-b-a-watson-electrical-4363990/

Malaysia central bank says investigation ongoing into potential data breach

Malaysia's central bank said the nation's payment systems remain secure despite a potential data breach announced by payment gateway service provider iPay88 (M) Sdn. Bhd. "The breach originated from and is confined to iPay88's payment card systems and does not involve vulnerabilities in the banks' systems," Bank Negara Malaysia (BNM) said in a statement.

See the full report here: https://www.reuters.com/markets/asia/malaysia-cbank-says-investigation-ongoing-into-potential-data-breach-2022-08-12/

Swan Bitcoin discloses data leak due to phishing attack on newsletter provider

Swan Bitcoin, a Bitcoin-specific savings firm, revealed that it has been affected by a recent data breach of its newsletter provider Klaviyo. As per an email seen by Decrypt and shared by the firm on Twitter, Klaviyo informed Swan Bitcoin of a security incident on August 7.

See the full report here: https://decrypt.co/107236/swan-bitcoin-discloses-data-leak-due-phishing-attack-newsletter-provider

Information for more than 18,000 MultiCare patients may have been compromised

A hacker accessed private information for up to 18,615 MultiCare patients. According to MultiCare, third-party entity Avamere Health Services LLC discovered in early 2022 unauthorized access to its network's systems. The data breach impacts beneficiaries of MultiCare's Bundled Payments for Care Improvement Advanced program.

See the full report here: https://www.king5.com/article/news/crime/multicare-data-breach/281-c7af866c-dd2f-4b1e-9c9d-cc4fb9ce1d9b

Access to hacked corporate networks still strong but sales fall

Marketplaces selling initial access to corporate networks have taken a hit, although the number of the offerings remained similar to last quarter. One likely reason is ransomware gangs folding their operations and becoming more cautious with selecting targets, with increasing threat from law enforcement.

See the full report here: https://www.bleepingcomputer.com/news/security/access-to-hacked-corporate-networks-still-strong-but-sales-fall/

Microsoft blocks UEFI bootloaders enabling Windows Secure Boot bypass

Three vendor-specific Unified Extensible Firmware Interface (UEFI) bootloaders that were approved by Microsoft had vulnerabilities that permitted bypassing the Secure Boot feature and executing unsigned code. Microsoft has worked with two of the vendors and released security update KB5012170 to fix the problem. A fix for these bugs should be delivered either by the Original Equipment Manufacturer (OEM) or the OS vendor by updating the UEFI Revocation List - the Secure Boot Forbidden Signature Database (DBX).

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-blocks-uefi-bootloaders-enabling-windows-secure-boot-bypass/

SOVA malware adds ransomware feature to encrypt Android devices

The SOVA Android banking trojan now targets over 200 banking, cryptocurrency exchange, and digital wallet applications, attempting to steal sensitive user data and cookies from them. It now features refactored and improved code that helps it operate more stealthy on the compromised device, and its latest version adds a ransomware module as well.

See the full report here: https://www.bleepingcomputer.com/news/security/sova-malware-adds-ransomware-feature-to-encrypt-android-devices/

Chinese hackers backdoor chat app with new Linux, macOS malware

The Chinese-backed threat group APT27 has reportedly trojanized the instant messenger application MiMi to deliver a new backdoor (dubbed rshell) that can be used to steal data from Linux and macOS systems. Once launched, the malware will harvest and send system information to its C2 server and wait for commands from the APT27 threat actors.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-backdoor-chat-app-with-new-linux-macos-malware/

Over 9,000 VNC servers exposed online without a password

Researchers have discovered at least 9,000 exposed VNC (virtual network computing) endpoints that can be accessed and used without authentication, allowing threat actors easy access to internal networks. Most of the exposed instances are located in China and Sweden, while the United States, Spain, and Brazil followed just behind. Some of these exposed VNC instances are for industrial control systems, which should never be exposed to the Internet.

See the full report here: https://www.bleepingcomputer.com/news/security/over-9-000-vnc-servers-exposed-online-without-a-password/

Google fined $60 million over Android location data collection

Australia has fined Google $60 million for misleading Australian Android users regarding the collection and use of their location data. Google allegedly continued tracking some of its users' Android phones even though they had disabled "Location History" in the device's settings. Google took remedial steps and addressed all issues that led to this fine by 20 December 2018.

See the full report here: https://www.bleepingcomputer.com/news/google/google-fined-60-million-over-android-location-data-collection/

Anonymous poop gifting site hacked, customers exposed

pompompurin, the owner of the hacking forum Breached.co, reportedly discovered an SQL injection vulnerability in a website called ShitExpress and accessed customer messages, email addresses, and other private data associated with customer orders.

See the full report here: https://www.bleepingcomputer.com/news/security/anonymous-poop-gifting-site-hacked-customers-exposed/

Twilio: 125 customers affected by data breach, no passwords stolen

Twilio has reportedly identified 125 customers who had their data accessed during a recent security breach. The company added that the attackers weren't able to gain access to the affected clients' authentication information.

See the full report here: https://www.bleepingcomputer.com/news/security/twilio-125-customers-affected-by-data-breach-no-passwords-stolen/

Palo Alto Networks: New PAN-OS DDoS flaw exploited in attacks

Palo Alto Networks has issued a security advisory warning of an actively exploited high-severity vulnerability (CVE-2022-0028; CVSS v3 – 8.6) impacting PAN-OS, the operating system used by the company's networking hardware products. This bug could let a hacker enlist a Palo Alto Networks PAN-OS device for DDoS attacks, obfuscating the original IP of the threat actor and making remediation more challenging. The company recommends applying a packet-based attack protection workaround to mitigate the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/palo-alto-networks-new-pan-os-ddos-flaw-exploited-in-attacks/

Xiaomi phones with MediaTek chips vulnerable to forged payments

Researchers have found security issues in the payment system present on Xiaomi smartphones that rely on MediaTek chips providing the trusted execution environment (TEE) that is responsible for signing transactions. The bugs could be abused to make the payment service unavailable or to sign transactions from the user’s mobile wallet to the threat actor’s account. Users should apply June Android 2022 security updates, which addresses the CVE-2020-14125 vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/xiaomi-phones-with-mediatek-chips-vulnerable-to-forged-payments/

This String of Emojis Is Actually Malware

Security researchers have found a way to use just a series of emojis to deliver an exploit to a target. The caveat is that there is a specific circumstance that needs to occur for the emoji exploit to work.

See the full report here: https://www.vice.com/en/article/wxnj49/this-string-of-emojis-is-actually-malware

Malicious PyPi packages aim DDoS attacks at Counter-Strike servers

Researchers discovered that a user named "devfather777" published 12 packages that used a name similar to other popular packages to trick software developers into using the malicious versions instead. Typosquatting attacks rely on developers mistakenly using a malicious package with a similar name to a legitimate one.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-aim-ddos-attacks-at-counter-strike-servers/

Security Researchers discovered a new PyPI Package designed to drop fileless cryptominer to Linux systems.

Researchers have discovered a new PyPI package named ‘secretslib‘ that drops fileless cryptominer to the memory of Linux machine systems. The package describes itself as “secrets matching and verification made easy,” it has a total of 93 downloads since August 6, 2020.

See the full report here: https://securityaffairs.co/wordpress/134381/security/pypi-package-fileless-linux-malware.html

Hackers Took Over a Commercial Satellite to Broadcast Hacker Movies

At the DEF CON hacking conference in Las Vegas, Karl Koscher, one of the members of a hacking enthusiasts group called Shadytel, explained how he and his friends were able to legally stream from a satellite in geostationary orbit—35,786 km or 22,236 miles from the surface of the planet.

See the full report here: https://www.vice.com/en/article/y3pwqx/hackers-took-over-a-commercial-satellite-to-broadcast-hacker-movies

Def Con hacker shows John Deere’s tractors can run Doom

Security researcher Sick Codes worked with Doom modder Skelegant to get the game running on a John Deere tractor display and showed off some gameplay at the Def Con hacking conference in Las Vegas.

See the full report here: https://www.theverge.com/2022/8/15/23306650/def-con-hacker-john-deere-tractors-run-doom-right-to-repair

‘Bring on the bugs’: SpaceX will pay you up to $25,000 to hack Starlink

Starlink, which is a division of rocket-ship company SpaceX, is encouraging people to hack its system and suss out its security issues through a bug bounty program. The company made the announcement shortly after a security researcher disclosed that he hacked into Starlink.

See the full report here: https://fortune.com/2022/08/15/space-x-starlink-elon-musk-bug-bounty-hackers/

CS:GO Skins Worth $6 Million Stolen by Hackers From Popular Trading Website

CS:GO skins are a valubale commodity that is a huge part of the game. In fact, it has its own market and associated trading systems. One of the biggest and most popular skin trading website called 'CS.Money' was hacked and skins worth $6,000,000 were stolen.

See the full report here: https://afkgaming.com/csgo/news/csgo-skins-worth-6-million-stolen-by-hackers-from-popular-trading-website

Hackers take control of Thomas More University's Facebook page

Thomas More University, USA, is the latest institution in Greater Cincinnati to be the target of hackers after it lost control of its Facebook page. The private university announced the hack in a post to a different Facebook page also under the university's name.

See the full report here: https://www.cincinnati.com/story/news/local/northern-ky/2022/08/15/hackers-take-control-of-thomas-more-universitys-facebook-page/65404920007/

Pakistan Revenue Board's websites shut down for more than 24 hours

Suspicion of hacking attempts by Indian hackers, the official websites of the Federal Board of Revenue (FBR) were shut down for more than 24 hours on the 75th Independence Day of Pakistan. Media reports quoting officials have claimed that three web portals of FBR remained down on Saturday night and Sunday causing disruptions in the process of payments and filing of income tax returns.

See the full report here: https://minutemirror.com.pk/suspicion-of-hacking-fbrs-websites-shut-down-for-more-than-24-hours-56586/

Credential Theft Is (Still) A Top Attack Method

Recent reports indicate that over 50% of security incidents were caused by credential theft, followed by ransomware and DDoS attacks. A majority of organizations aren't revoking credentials that are no longer needed, meaning passwords can go unattended.

See the full report here: https://thehackernews.com/2022/08/credential-theft-is-still-top-attack.html

Argentina's Judiciary of Córdoba hit by PLAY ransomware attack

An attack by the Play ransomware operation on August 13, 2022, forced Argentina's Judiciary of Córdoba to shut down IT systems and their online portal. The attack affected the Judiciary's IT systems and its databases, and is also forcing the use of pen and paper for submitting official documents.

See the full report here: https://www.bleepingcomputer.com/news/security/argentinas-judiciary-of-c-rdoba-hit-by-play-ransomware-attack/

Monero hard fork makes hackers' favorite coin even more private

Monero, the privacy-oriented cryptocurrency, underwent a planned hard fork to add new features to boost privacy and security. Monero is considered to have superior privacy over other cryptocurrency projects because of its "ring signature" transaction obfuscation mechanism.

See the full report here: https://www.bleepingcomputer.com/news/security/monero-hard-fork-makes-hackers-favorite-coin-even-more-private/

Twilio hack exposed Signal phone numbers of 1,900 users

The recent data breach at Twilio exposed the phone numbers of around 1,900 Signal users. Twilio provides phone number verification services for Signal. Users’ message history, contact lists, profile information, and other personal data were not affected, Signal stated. Signal encourages users to turn on the registration lock option, which allows recovering the profile, settings, contacts, and blocked users. The feature can be enabled or disabled only from the device and requires the Signal PIN as an additional verification layer.

See the full report here: https://www.bleepingcomputer.com/news/security/twilio-hack-exposed-signal-phone-numbers-of-1-900-users/

Microsoft disrupts Russian hackers' operation on NATO targets

Microsoft has disrupted a hacking and social engineering operation linked to a Russian threat actor SEABORGIUM (also known as ColdRiver and TA446) that targets NATO countries. Microsoft has reportedly disabled accounts used for surveillance, phishing, and email collection. Microsoft also shared sixty-nine domains believed to be associated with the threat actor's phishing campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-disrupts-russian-hackers-operation-on-nato-targets/

Russian hackers target Ukraine with default Word template hijacker

A Russian state-backed hacking group Gamaredon (also known as Armageddon or Shuckworm) is reportedly engaged in persistent, long-term operations on Ukrainian entities. An tactic the group uses is the modification of the “Normal.dotm” file on the host. This file is the default Microsoft Word template, so modifying it has the potential to lace all documents created on the compromised machine with malicious code.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-target-ukraine-with-default-word-template-hijacker/

Callback phishing attacks see massive 625% growth since Q1 2021

Hackers are increasingly moving towards hybrid forms of phishing attacks that combine email and voice social engineering calls as a way to breach corporate networks for ransomware and data extortion attacks. The use of “hybrid vishing” reportedly saw a 625% growth in Q2 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/callback-phishing-attacks-see-massive-625-percent-growth-since-q1-2021/

Evil PLC Attack weaponizes PLCs to infect engineering workstations

Most attack scenarios against industrial installations, whether in manufacturing or in critical infrastructure, focus on compromising programmable logic controllers (PLCs) to tamper with the physical processes they control and automate. A hijacked PLC can also be used to compromise engineering workstations, and this opens the door to powerful lateral movement attacks.

See the full report here: https://www.csoonline.com/article/3669914/evil-plc-attack-weaponizes-plcs-to-infect-engineering-workstations.html

Hackers attack UK water supplier but extort wrong company

South Staffordshire Water, a UK company supplying 330 million liters of drinking water to 1.6 consumers daily, has disclosed a cyberattack. The safety and water distribution systems are still operational, so the disruption of the IT systems doesn’t impact the supply of safe water to its customers or those of its subsidiaries, said the company.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-attack-uk-water-supplier-but-extort-wrong-company/

Israeli firm Cellebrite sold phone-hacking tools to Uganda's brutal dictatorship

Israeli cyber company Cellebrite sold technology for hacking into cellphones to the Uganda Police Force, despite reports revealing extensive human right violations by the police. Cellebrite, which specializes in developing tools for digital forensic investigations, has not denied the sale but claims it is scrupulous about legal and ethical use of its products.

See the full report here: https://www.haaretz.com/israel-news/2022-08-16/ty-article/.premium/israeli-firm-cellebrite-sold-phone-hacking-tools-to-ugandas-brutal-dictatorship/00000182-a69b-d14a-abfb-f79f4ae20000

Hackers linked to China have been targeting human rights groups for years

A hacking group linked to China has spent the last three years targeting human rights organizations, think tanks, news media, and agencies of multiple foreign governments, according to a revealing new report. Private contractors and front companies with relatively few resources run long-standing hacking operations and succeed against high-value targets with crude but effective tactics, says the report.

See the full report here: https://www.technologyreview.com/2022/08/16/1057894/hackers-linked-to-china-have-been-targeting-human-rights-groups-for-years/

Rotary India members receive message offering data of other members

Some miscreants hacked into the website of Rotary India club and sent messages to its members saying they are in possession of their personal data and will sell them for Rs 20,000. The private software company, which is in charge of protecting data, approached the police with a written complaint this month.

See the full report here: https://indianexpress.com/article/cities/mumbai/rotary-india-members-receive-message-offering-data-of-other-members-hacking-plaint-filed-8094080/

Argentina judiciary targeted by new ‘Play’ ransomware group

Argentina’s Judiciary of Córdoba has been forced to suspend its information technology services after being targeted in a ransomware attack. The attack is reported to have taken place on Aug. 13 and involves a fairly new ransomware group going by the name of “Play.” As a result of the attack, judiciary employees have been forced to resort to using pen and paper to create and process official documents.

See the full report here: https://siliconangle.com/2022/08/16/argentina-judiciary-targeted-new-play-ransomware-group/

United Health Centers says patient data was stolen

United Health Centers of the San Joaquin Valley, USA, is notifying patients of an encryption-related data breach in which documents with personal and medical information were stolen, it said in a letter on its website. In August 2021, the California community health center experienced technical difficulties and computer disruptions that it found were caused by an "encryption event," the nonprofit said.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/united-health-centers-says-patient-data-was-stolen.html

Novant Health patient information possibly disclosed to Facebook in data breach

Novant Health says letters will be mailed to some of its patients following possible disclosure of protected health information due to an error with an online tracking tool. In May 2020, Novant Health launched a promotional campaign that involved Facebook advertisements. Certain private patient information was transmitted to Facebook’s parent company Meta by mistake.

See the full report here: https://www.fox46.com/organization/novant-health/novant-health-patient-information-possibly-disclosed-to-facebook-in-data-breach/

New MailChimp breach exposed DigitalOcean customer email addresses

A recent MailChimp security breach exposed the email addresses of some customers of DigitalOcean, with a small number receiving unauthorized password resets. DigitalOcean has since switched to another email service provider.

See the full report here: https://www.bleepingcomputer.com/news/security/new-mailchimp-breach-exposed-digitalocean-customer-email-addresses/

ÆPIC and SQUIP Vulnerabilities Found in Intel and AMD Processors

Researchers have disclosed a new bug (CVE-2022-21233, CVSS score: 6.0) affecting Intel CPUs that enables attackers to obtain encryption keys and other secret information from the processors. Dubbed ÆPIC Leak, the weakness is the first-of-its-kind to architecturally disclose sensitive data in a manner similar to an uninitialized memory read in the CPU itself. Researchers also demonstrated the first-ever side channel attack (CVE-2021-46778) on scheduler queues impacting AMD Zen 1, Zen 2, and Zen 3 microarchitectures that could be abused to steal RSA keys.

See the full report here: https://thehackernews.com/2022/08/pic-and-squip-vulnerabilities-found-in.html

Malicious browser extensions targeted almost 7 million people

Close to 7 million people have reportedly attempted to install malicious browser extensions since 2020. Some of the most installed ones are WebSearch, AddScript, and DealPly. To keep browsers free of adware infections, users should only download extensions from the browser's official web store, examine user comments and reviews, and run a background check on the developer/publisher.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-browser-extensions-targeted-almost-7-million-people/

Exploit out for critical Realtek flaw affecting many networking devices

Exploit code has been released for a critical bug (CVE-2022-27255) affecting networking devices with Realtek’s RTL819x system on a chip (SoC). A remote attacker could exploit the bug to compromise vulnerable devices from various original equipment manufacturers (OEMs), ranging from routers and access points to signal repeaters.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-out-for-critical-realtek-flaw-affecting-many-networking-devices/

RTLS systems vulnerable to MiTM attacks, location manipulation

Security researchers have uncovered multiple vulnerabilities impacting UWB (ultra-wideband) RTLS (real-time locating systems), enabling threat actors to conduct man-in-the-middle attacks and manipulate tag geo-location data. RTLS technology is widely used in industrial environments, mass transit, healthcare, and smart city applications. Admins of RTLS systems should use firewalls to restrict access, add intrusion detection systems in the network, and use SSH tunneling with packet synchronization counter-values for data encryption.

See the full report here: https://www.bleepingcomputer.com/news/security/rtls-systems-vulnerable-to-mitm-attacks-location-manipulation/

North Korean hackers use signed macOS malware to target IT job seekers

North Korean hackers from the Lazarus group have been using a signed malicious executable for macOS to impersonate Coinbase and lure in employees in the financial technology sector. Details about this specific social engineering campaign so far were limited to malware for the Windows platform.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-signed-macos-malware-to-target-it-job-seekers/

Malware devs already bypassed Android 13's new security feature

Android malware developers are already adjusting their tactics to bypass a new 'Restricted setting' security feature introduced by Google in the newly released Android 13. Android 13 was released this week, with the new operating system being rolled out to Google Pixel devices and the source code published on AOSP.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-devs-already-bypassed-android-13s-new-security-feature/

Russia-Ukraine cyberwar creates new malware threats

The war in Ukraine has contributed to an uptick in disk-wiping malware. Researchers discovered at least seven new major wiper variants used in targeted campaigns against government, military and private organizations in Ukraine. While these attacks were mainly used to target entities affiliated with Ukraine, these techniques can also be used internationally.

See the full report here: https://venturebeat.com/security/cyber-war-malware/

DarkTortilla' Malware Wraps in Sophistication for High-Volume RAT Infections

Researchers warn of a sophisticated, evasive crypter that several threat actors are using to distribute a range of information stealers and remote-access Trojans (RATs). The crypter, dubbed "DarkTortilla," is pervasive and persistent, and it packs multiple features designed to help it avoid anti-malware and forensics tools.

See the full report here: https://www.darkreading.com/vulnerabilities-threats/darktortilla-sophisticated-malware-rat-infections

Malicious PyPi packages turn Discord into password-stealing malware

A dozen malicious PyPi packages have been discovered installing malware that modifies the Discord client to become an information-sealing backdoor and stealing data from web browsers and Roblox. The twelve packages were uploaded to the Python Package Index (PyPI) on August 1, 2022, by a user named “scarycoder”.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-turn-discord-into-password-stealing-malware/

Cybercriminals Developing BugDrop Malware to Bypass Android Security Features

In a sign that malicious actors continue to find ways to work around Google Play Store security protections, researchers have spotted a previously undocumented Android dropper trojan that's currently in development. The dropper app is explicitly designed to defeat new features introduced in the upcoming version of Android that aim to make it difficult for malware to request Accessibility Services privileges from victims.

See the full report here: https://thehackernews.com/2022/08/cybercriminals-developing-bugdrop.html

Use of wipers expanding beyond Ukraine to 24 countries

The use of wiper malware is increasingly expanding beyond the Ukraine conflict, according to research released today by cybersecurity giant Fortinet, with new variants popping up at an unprecedented rate. Wiper malware has been used heavily by hacking groups supporting Russia’s invasion of Ukraine.

See the full report here: https://therecord.media/fortinet-use-of-wipers-expanding-beyond-ukraine-to-24-countries/

Suspects behind malware that forces users to watch ads on phone nailed

Two men have been taken into custody for allegedly developing malicious mobile apps that force users to watch advertisements on their phones, Shanghai police said. This is the first ever criminal case in Shanghai involving illegal control of mobile phone operating systems.

See the full report here: https://www.shine.cn/news/metro/2208179333/

Scammers Distribute Fake Microsoft Office USB Sticks With Malware

Scammers from the U.K. send USB drives with Microsoft's Office suites in seemingly real Microsoft packaging to random addresses trying to make victims think that they received a legitimate Office Professional Plus (worth $439) by mistake. After the victim plugs the USB drive into their PC, it is not an Office launch installation wizard but encourages people to call a fake support line. The latter then persuades the casualty to hand over remote access to the PC and provide them payment information

See the full report here: https://www.tomshardware.com/news/scammers-distribute-fake-microsoft-office-usb-sticks-with-malware

Convolution neural network with batch normalization and inception-residual modules for Android malware classification

A new method, BIR-CNN, is proposed to classify of Android malware. It combines convolution neural network (CNN) with batch normalization and inception-residual (BIR) network modules by using 347-dim network traffic features. CNN combines inception-residual modules with a convolution layer that can enhance the learning ability of the model.

See the full report here: https://www.nature.com/articles/s41598-022-18402-6

Apple security updates fix 2 zero-days used to hack iPhones, Macs

Apple has released emergency security updates today to fix two zero-day vulnerabilities previously exploited by attackers to hack iPhones, iPads, or Macs. One of the bugs (CVE-2022-32894) is an out-of-bounds write vulnerability in the operating system's Kernel. The second (CVE-2022-32893) is an out-of-bounds write vulnerability in WebKit, the web browser engine used by Safari and other apps. The fixes have been provided in macOS Monterey 12.5.1 and iOS 15.6.1/iPadOS 15.6.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-security-updates-fix-2-zero-days-used-to-hack-iphones-macs/

This iconic dangerous USB hacking tool is back with a vengeance

Rubber Ducky, a USB hacking tool has a brand-new iteration in its version 3.0. The biggest change is in the DuckyScript programming language, allowing users to write various functions, store variables, and even use if-then-else controls. An attacker could potentially plug the USB drive into a device for just a few seconds and walk away with stolen credentials.

See the full report here: https://www.techradar.com/news/this-iconic-dangerous-usb-hacking-tool-is-back-with-a-vengeance

Iran-linked hacking group is targeting Israeli shipping, US cybersecurity firm says

A hacking group (tagged as UNC3890) that appears to be linked to Iran has been targeting Israeli shipping in recent years. The hacking group focused on collecting intelligence from Israeli entities and has also targeted Israeli government, energy and health care organizations.

See the full report here: https://www.timesofisrael.com/iran-linked-hacking-group-targeting-israeli-shipping-us-cybersecurity-firm-says/

NY Billing Company Suffers Ransomware Attack, 942K Impacted

New York-based medical management company Practice Resources, LLC (PRL) has started notifying 942,138 people of an April 2022 ransomware attack that affected 26 of its healthcare organization clients. The information involved potentially included names, addresses, health plan numbers, dates of treatment, and medical record numbers.

See the full report here: https://healthitsecurity.com/news/ny-billing-company-suffers-ransomware-attack-942k-impacted

WestJet app data breach reveals other people's personal information

Canadian airline WestJet is reportedly investigating a technical glitch on its app that allowed users to see other people's profiles.

See the full report here: https://calgary.ctvnews.ca/westjet-app-data-breach-reveals-other-people-s-personal-information-1.6031827

Morrie’s Auto Group Confirms Data Breach Affecting Former Employees

Morrie’s Auto Group, an American automotive dealer group, has reported a data breach that occurred in March 2022. The company’s computer network had been infected with malware, and an unauthorized party was able to access files containing sensitive employee information between March 23, 2022, and March 24, 2022.

See the full report here: https://www.jdsupra.com/legalnews/morrie-s-auto-group-confirms-data-7048562/

Logistics Company Shipyaari Exposed Personal Data Of Users

Logistics company Shipyaari, which offers logistics services to D2C brands, reportedly exposed the personal data of its customers because of a vulnerability in its shipment tracking functionality. The leaked data included customer names, addresses, phone numbers, order invoice data and delivery status. Shipyaari fixed the issue in July, removing all the personally identifiable information from its tracking page and putting the tracking page behind a security wall that now requires an OTP for access.

See the full report here: https://inc42.com/buzz/customer-data-leak-detected-b2b-logistics-company-shipyaari/

McKinney-area hospitals experience data breach

Methodist McKinney Hospital, Methodist Allen Surgical Center, and Methodist Craig Ranch Surgical Center in Texas have provided patients notice of unusual activity on their data systems. Methodist McKinney Hospital confirmed that names, addresses, Social Security Numbers, dates of birth, medical history information, medical diagnosis information, treatment information, medical record numbers, and health insurance information were present in the system at the time of the breach.

See the full report here: https://www.dallasnews.com/business/health-care/2022/08/17/mckinney-area-hospitals-experience-data-breach/

BlackByte ransomware gang is back with new extortion tactics

The BlackByte ransomware has launched version 2.0 of its operation, including a new data leak site utilizing new extortion techniques. It is not clear if the ransomware encryptor has changed as well. The new extortion strategy allows victims to pay to extend the publishing of their data by 24 hours ($5,000), download the data ($200,000), or destroy all the data ($300,000).

See the full report here: https://www.bleepingcomputer.com/news/security/blackbyte-ransomware-gang-is-back-with-new-extortion-tactics/

Google fixes fifth Chrome zero-day bug exploited this year

Google is rolling out security patches – for Windows, Mac, and Linux – to fix several security bugs, including a zero-day (CVE-2022-2856). The fixed zero-day is a high-severity security issue due to “insufficient validation of untrusted input in Intents, and can potentially lead to buffer overflow, directory traversal, SQL injection, cross-site scripting, null byte injection, and more after successful exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/google-fixes-fifth-chrome-zero-day-bug-exploited-this-year/

Researchers Link Multi-Year Mass Credential Theft Campaign to Chinese Hackers

A Chinese state-sponsored threat activity group named RedAlpha has been attributed to a multi-year mass credential theft campaign aimed at global humanitarian, think tank, and government organizations – with its activities reportedly in in line with the strategic interests of the Chinese government. The group weaponized as many as 350 domains that spoof legitimate entities like the International Federation for Human Rights (FIDH), Amnesty International, the Mercator Institute for China Studies (MERICS), Radio Free Asia (RFA), and the American Institute in Taiwan (AIT), among others.

See the full report here: https://thehackernews.com/2022/08/researchers-link-multi-year-mass.html

BharatPay data breach: Personal data, transaction details of 37,000 users leaked

BharatPay’s backend database containing customers’ personal information, bank balance, and transaction data from February 2018 to August 2022 was leaked on a cybercrime forum. BharatPay provides various digital financial services by partnering with numerous distribution networks across India – an aim to bring the cashless digital ecosystem to the rural landscape.

See the full report here: https://cio.economictimes.indiatimes.com/news/digital-security/bharatpay-data-breach-personal-data-transaction-details-of-37000-users-leaked-online/93604666