Threat Intelligence Bulletin: 08/19/2022 - 08/25/2022

Q2 2022 Energy Sector: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-08-19a

TLP:CLEAR

ZeroFox Intelligence is excited to announce the release of our Energy Sector Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on July 28, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Threat actors continued to exchange ideas on how to maneuver within the economic and political constraints brought about by the conflict in Ukraine in Q2. Energy sector organizations and their supply chains faced a persistent threat from social engineering campaigns, with particular increases in the use of fraudulent applications, fake Windows 11 upgrades, and employment-related scams to steal credentials and deploy trojans. The threat of vulnerability exploitation grew, averaging almost 70 Common Vulnerabilities and Exposures (CVEs) disclosed per day—up from 56 per day at the end of 2021.

The pace of vulnerability disclosure likely represents a new normal. The threat to the energy sector from Initial Access Brokers (IABs) showed small signs of resurgence, though this increase was not seen across all sectors. The threat from malware remained broadly consistent with previous quarters, underpinned by the high rate of new infostealers and trojans emerging and older versions launching new campaigns. Ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. Russia is the primary nation-state threat to the energy sector, particularly in Europe. Russia-linked groups will very likely continue targeting the European energy sector and wider supply chain infrastructure in an attempt to weaken their resolve to support Ukraine.

Key Findings

• Cybercriminals are increasingly concerned with challenges converting cryptocurrency to fiat currency.
• Social engineering campaigns increasingly used LNK shortcut files, fake Windows upgrades, and employment scams.
• The threat from CVEs and previously-unknown software vulnerabilities likely increased.
• The IAB marketplace showed signs of resurgence.
• ZeroFox Intelligence assesses with low confidence that the threat of malware deployment against the energy sector increased, driven by pro-Russian entities seeking to take advantage of, and exacerbate, strained supply chains.
• The threat from ransomware and digital extortion likely slightly decreased. Eliciting payment from victims may be getting more difficult.

The Underground Economist: Volume 2, Issue 15

Welcome back to The Underground Economist, Volume 2, Issue 15, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of August 19, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full piece here.

Breach Disclosure: BookMeBus

On June 12, 2022, the Telegram channel "We Leak Database" posted a data breach package targeting the BookMeBus, a transportation ticket booking platform operating from Cambodia. From this package, ZeroFox extracted 24,132 email addresses and/or usernames. Of these, 6,855 records were linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

BookMeBus – a transportation ticket booking platform operating from Cambodia – suffered a data breach. The breached data package was leaked on the Telegram channel "We Leak Database" on June 12, 2022; the user who posted the leak mentioned that the data package includes 1 GB of user information with ticket status, user details, email addresses , passwords (hashed), and phone numbers. The data package was also circulated in underground forums like Cracked (on June 12, 2022 by the threat actor "GuntherMagnuson") and BreachForums (on June 25, 2022 by the threat actor "r4idf0rum5"). From the package published on Telegram, ZeroFox extracted 24,132 email addresses and/or usernames. Of these, 6,855 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, address, gender, date of birth, and company.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Luxembuorg_80k

On July 5, 2022, a user Topazzz from the Russian-speaking underground forum XSS posted a data leak package titled "Luxembuorg_80k." From this package, ZeroFox extracted 14,367 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On July 5, 2022, a reputed threat actor "Topazzz" from the Russian-speaking deep web forum XSS posted a data leak package titled "Luxembuorg_80k." From this package, ZeroFox extracted 14,367 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include name, address, and mobile phone number.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-08-19 - 2022-08-25

LockBit claims ransomware attack on security giant Entrust

The LockBit ransomware gang has claimed responsibility for the June cyberattack on digital security giant Entrust. Entrust suffered a ransomware attack on June 18th, 2022. While Entrust confirmed that they suffered a cyberattack and that data was stolen from internal systems, they would not confirm that it was a ransomware attack.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-security-giant-entrust/

Identity paperwork, contacts exposed in Vodacom fibre reseller knowledge breach

Vodacom has warned consumers who subscribe to Vodacom Fiber via marketing company Genuine Promotions that a facts breach has compromised their individual facts. In an e-mail sent to affected shoppers, the firm explained an unauthorized celebration accessed the agency’s servers.

See the full report here: https://www.archynetys.com/identity-paperwork-contacts-exposed-in-vodacom-fibre-reseller-knowledge-breach/

Whitworth University urges patience after data breach, reported ransomware attack: ‘This process does take time’

Whitworth University is taking steps to shore up its cyberdefenses following a reported ransomware attack that has left the university’s network crippled since late July. It’s unclear what sort of information may have been accessed as the investigation is ongoing.

See the full report here: https://www.spokesman.com/stories/2022/aug/18/whitworth-university-urges-patience-after-data-bre/

Luxury goods retailer SFERRA Fine Linens issued breach alert

SFERRA Fine Linens issued an alert about a "data incident", but said there is no evidence of "actual or attempted misuse of information as a result of this incident". The event did not impact any of SFERRA's e-commerce platforms or any information retained in their e-commerce systems, said the company.

See the full report here: https://www.prnewswire.com/news-releases/notice-of-data-breach-301608562.html

Did someone actually hack Boeing aircraft?

A group of security researchers identified a “digital vulnerability” in the devices that pilots often use to calculate their aircraft’s performance in the specific conditions of each flight. Someone with adequate knowledge of this could modify data in the systems, leading pilots to make critical miscalculations.

See the full report here: https://mentourpilot.com/did-someone-actually-hack-boeing-aircraft/

Ukrainian Nuclear Operator Accuses Russians Hackers Of Attacking Its Website

Ukrainian state nuclear operator Enerhoatom said that Russian-based hackers unleashed an hours-long attack on its website but said major problems had been avoided. It blamed the attack on what it said was a Russian group called "narodnaya kiberarmya," or "popular cyberarmy."

See the full report here: https://www.rferl.org/a/ukraine-enerhoatom-hacking-attack-zaporizhzhya/31992142.html

Hackers Using Bumblebee Loader to Compromise Active Directory Services

The malware loader known as Bumblebee is being increasingly co-opted by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities.

See the full report here: https://thehackernews.com/2022/08/hackers-using-bumblebee-loader-to.html

Winnti hackers split Cobalt Strike into 154 pieces to evade detection

​The Chinese Winnti hacking group, also known as 'APT41' or 'Wicked Spider,' targeted at least 80 organizations last year and successfully breached the networks of at least thirteen. This is one of the most "intense" years for the Chinese hackers.

See the full report here: https://www.bleepingcomputer.com/news/security/winnti-hackers-split-cobalt-strike-into-154-pieces-to-evade-detection/

Cybersecurity Initiative warns US election campaigns of hacking scandals

Adam Clayton Powell, the executive director of the University of Southern Califronia Election Cybersecurity Initiative, has warned election officials and campaigns across the US about possible foreign cyber interference.

See the full report here: https://www.cbs17.com/news/cybersecurity-initiative-warning-nc-campaigns-of-hacking-scandals/

Over $2 Billion Stolen This Year In Blockchain Bridge Hacks Expose DeFi’s Achilles Heel

Cross-chain bridges have come under fire in recent weeks for their vulnerability. At their core, bridges allow users to exchange one token for another. They are the key to expanding operability across blockchains.

See the full report here: https://www.forbes.com/sites/mariagraciasantillanalinares/2022/08/18/over-2-billion-stolen-this-year-in-blockchain-bridge-hacks-expose-defis-achilles-heel/?sh=6638d577e50b

Apple security flaw ‘actively exploited’ by hackers to fully control devices

Apple disclosed serious security vulnerabilities for iPhones, iPads and Macs that could potentially allow attackers to take complete control of these devices. The company said it is “aware of a report that this issue may have been actively exploited”.

See the full report here: https://www.theguardian.com/technology/2022/aug/18/apple-security-flaw-hack-iphone-ipad-macs

Estonia under intensive cyber attacks after removing Soviet monuments

The Estonian Information System Authority (RIA) incident handling department CERT-EE reported on Thursday it had identified 24 websites and services infected with malware over the last 24 hours which the attackers tried to utilise for targeting and infecting internet users of the country.

See the full report here: https://tvpworld.com/61906799/estonia-under-intensive-cyber-attacks-after-removing-soviet-monuments

Google blocks largest HTTPS DDoS attack 'reported to date'

A Google Cloud Armor customer was hit with a distributed denial-of-service (DDoS) attack over the HTTPS protocol that reached 46 million requests per second (RPS), making it the largest ever recorded of its kind. In just two minutes, the attack escalated from 100,000 RPS to a record-breaking 46 million RPS.

See the full report here: https://www.bleepingcomputer.com/news/security/google-blocks-largest-https-ddos-attack-reported-to-date/

Spyware Hunters Are Expanding Their Toolset

Expanded spyware detection tools are needed because security firms regularly see real examples of hackers deploying memory-only spyware in their attacks.

See the full report here: https://www.wired.com/story/spyware-hunting-tools-mac-pc-black-hat/

ATMZOW JS Sniffer Campaign Linked to Hancitor Malware

The same threat actors may be behind both the ATMZOW JS sniffer campaign and the Hancitor malware downloader. The connection was made by threat intelligence analyst Victor Okorokov from Group-IB, who said ATMZOW successfully infected at least 483 websites across four continents since the beginning of 2019.

See the full report here: https://www.infosecurity-magazine.com/news/atmzow-js-linked-to-hancitor/

Android malware apps with 2 million installs found on Google Play

A new batch of thirty-five malware Android apps that display unwanted advertisements was found on the Google Play Store, with the apps installed over 2 million times on victims' mobile devices. Security researchers employed a real-time behavior-based analysis method to discover the potentially malicious applications.

See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-apps-with-2-million-installs-found-on-google-play/

WordPress sites hacked with fake Cloudflare DDoS alerts pushing malware

WordPress sites are being hacked to display fake Cloudflare DDoS protection pages to distribute malware that installs the NetSupport RAT and the RaccoonStealer password-stealing Trojan. DDoS (distributed denial of service) protection screens are commonplace on the internet, protecting sites from bots that ping them with bogus requests, aiming to overwhelm them with garbage traffic.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-sites-hacked-with-fake-cloudflare-ddos-alerts-pushing-malware/

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the Trickbot/Conti group, who are not known to have had a previous connection with Ramnit.

See the full report here: https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest/

After infecting banking apps abroad, malware turns to Indian users

SOVA, a malware that creeps into your phone disguised as popular apps like Google Chrome and Amazon, seems to have turned its attention towards India. According to the latest research, India ranks third in the list of countries targeted by SOVA this year.

See the full report here: https://www.hindustantimes.com/cities/mumbai-news/after-infecting-banking-apps-abroad-malware-turns-to-indian-users-101661092275483.html

Grandoreiro banking malware targets manufacturers in Spain, Mexico

The notorious 'Grandoreiro' banking trojan was spotted in recent attacks targeting employees of a chemicals manufacturer in Spain and workers of automotive and machinery makers in Mexico. The malware has been active in the wild since at least 2017 and remains one of the most significant threats of its kind for Spanish-speaking users.

See the full report here: https://www.bleepingcomputer.com/news/security/grandoreiro-banking-malware-targets-manufacturers-in-spain-mexico/

TikTok's in-app browser can monitor your keystrokes, including passwords and credit cards

Any link clicked through TikTok will open within the app using the platform's in-app browser rather than a default browser like Chrome or Safari. The Java Script code embedded by TikTok allows the company to monitor all keystrokes — the equivalent of a keylogger — as well as every tap on the screen, and text inputs including passwords and credit card information.

See the full report here: https://www.abc.net.au/news/2022-08-22/tiktok-in-app-browser-can-monitor-keystrokes-researcher-finds/101356198#:~:text=The%20Java%20Script%20code%20embedded,passwords%20and%20credit%20card%20information.

New ransomware variants arrive

What do LockBit, BlueSky, Deno, RedAlert, Dark Web Hacker, Hive, and Again have in common? All are new or evolving forms of ransomware spotted in the wild.

See the full report here: https://gadget.co.za/new-ransomware-variants-arrive/

Ronin hackers transferred stolen funds from ETH to BTC and used sanctioned mixers

The hackers behind the $625 million Ronin bridge attack in March have since transferred most of their funds from ETH into BTC using renBTC and Bitcoin privacy tools Blender and ChipMixer. The majority of the stolen funds were originally converted into ETH and sent to now sanctioned Ethereum crypto mixer Tornado Cash before being bridged over to the Bitcoin network and converted into BTC via the Ren protocol.

See the full report here: https://cointelegraph.com/news/ronin-hackers-transferred-stolen-funds-from-eth-to-btc-and-used-sanctioned-mixers

Google Chrome threat alert: These users at ‘high risk’ of hacking, India government warns

People using Google Chrome for desktop have been warned about multiple vulnerabilities that can enable hackers to gain control of their devices, as per a recent ‘High Risk’ threat warning from the country’s cyber agency Indian Computer Emergency Response Team (CERT-In).

See the full report here: https://www.dnaindia.com/technology/report-google-chrome-threat-alert-these-users-at-high-risk-of-hacking-government-warns-2978411

DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities

The Donot Team threat actor has updated its Jaca Windows malware toolkit with improved capabilities, including a revamped stealer module designed to capture information from Google Chrome and Mozilla Firefox browsers. Also known as APT-C-35 and Viceroy Tiger, the Donot Team is known for targeting defense, diplomatic, government, and military entities in India, Pakistan, Sri Lanka, and Bangladesh, among others.

See the full report here: https://thehackernews.com/2022/08/donot-team-hackers-updated-its-malware.html

Hackers target hotel and travel companies with fake reservations

A hacker tracked as TA558 is running phishing campaigns that target multiple hotels and firms in the hospitality and travel space. In 2022, TA558 switched from using macro-laced documents in its phishing emails and adopted RAR and ISO file attachments or embedded URLs in the messages. Its phishing emails are written in English, Spanish, and Portuguese, targeting companies in North America, Western Europe, and Latin America.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-hotel-and-travel-companies-with-fake-reservations/

Hackers steal crypto from Bitcoin ATMs by exploiting zero-day bug

Hackers have exploited a zero-day vulnerability in General Bytes Bitcoin ATM servers to steal cryptocurrency from customers. General Bytes is warning customers not to operate their Bitcoin ATMs until they have applied two server patch releases, 20220531.38 and 20220725.22, on their servers. It is unclear how many servers were breached using this vulnerability and how much cryptocurrency was stolen.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-crypto-from-bitcoin-atms-by-exploiting-zero-day-bug/

241 npm and PyPI packages caught dropping Linux cryptominers

Security researchers have disclosed at least 241 malicious npm and PyPI packages that drop cryptominers after infecting Linux machines. These packages are typosquats of popular open source libraries and commands like React, argparse, and AIOHTTP, but instead, download and install cryptomining Bash scripts from the threat actor's server.

See the full report here: https://www.bleepingcomputer.com/news/security/241-npm-and-pypi-packages-caught-dropping-linux-cryptominers/

CISA adds 7 vulnerabilities to list of bugs exploited by hackers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its list of bugs actively exploited by hackers, comprising new flaws disclosed by Apple, Microsoft, SAP, and Google. Relevant agencies have to patch these bugs by September 8, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-adds-7-vulnerabilities-to-list-of-bugs-exploited-by-hackers/

Russian APT29 hackers abuse Azure services to hack Microsoft 365 users

The state-backed Russian cyberespionage group Cozy Bear has been targeting Microsoft 365 accounts in NATO countries and attempting to access foreign policy information. The group reportedly demonstrates exceptional operational security to prevent analysts from discovering and exposing their attack methods.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-apt29-hackers-abuse-azure-services-to-hack-microsoft-365-users/

Over 80,000 exploitable Hikvision cameras exposed online

Over 80,000 Hikvision cameras are vulnerable to a critical command injection flaw (CVE-2021-36260) that is easily exploitable via specially crafted messages sent to the vulnerable web server. Even though Hikvision fixed the bug via a firmware update in September 2021, tens of thousands of systems used by 2,300 organizations across 100 countries have reportedly still not applied the security update.

See the full report here: https://www.bleepingcomputer.com/news/security/over-80-000-exploitable-hikvision-cameras-exposed-online/

FBI warns of residential proxies used in credential stuffing attacks

The FBI has provided details about proxies and configurations used by cybercriminals to mask and automate credential stuffing attacks on US companies. The FBI recommends that organizations enable multi-factor authentication (MFA), educate users on good password hygiene, use fingerprinting to detect unusual activity, implement shadow banning (limiting user access), use strong security protocols in mobile applications, check online for configurations tailored for their websites and for compromised user credentials, and employ cloud protection services.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-residential-proxies-used-in-credential-stuffing-attacks/

Misconfigured Meta Pixel exposed healthcare data of 1.3M patients

U.S. healthcare provider Novant Health has disclosed a data breach impacting 1,362,296 individuals who have had their sensitive information mistakenly collected by the Meta Pixel ad tracking script. The information that may have been exposed includes email address, phone number, emergency contact information, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/misconfigured-meta-pixel-exposed-healthcare-data-of-13m-patients/

Greek natural gas operator suffers ransomware-related data breach

DESFA, Greece's largest natural gas distributor, suffered a data breach and IT system outage following a cyberattack. The company stated that this incident won't impact the gas supply and that all input and output points operate at normal capacity. The Ragnar Locker ransomware group has claimed responsibility for the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/greek-natural-gas-operator-suffers-ransomware-related-data-breach/

LockBit ransomware blames Entrust for DDoS attacks on leak sites

The LockBit ransomware operation's data leak sites were shut down over the past weekend due to a DDoS attack – with a message to remove data stolen from the security firm Entrust. Last week, LockBit claimed responsibility for an attack on Entrust and has since begun leaking the stolen data. In retaliation to the attack, LockBit's data leak sites now show a message warning that the ransomware gang plans to upload all of Entrust's data as a torrent, which will make it almost impossible to take down.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-blames-entrust-for-ddos-attacks-on-leak-sites/

As Nasty as Dirty Pipe — 8 Year Old Linux Kernel Vulnerability Uncovered

Security researchers have disclosed details of an eight-year-old security vulnerability (dubbed DirtyCred) in the Linux kernel. It is a kernel exploitation concept that swaps unprivileged kernel credentials with privileged ones to escalate privilege. Instead of overwriting any critical data fields on kernel heap, DirtyCred abuses the heap memory reuse mechanism to get privileged.

See the full report here: https://thehackernews.com/2022/08/as-nasty-as-dirty-pipe-8-year-old-linux.html

Meet Borat RAT, a New Unique Triple Threat

Security researchers have discovered a new Remote Access Trojan (RAT) that can enable threat actors to deploy ransomware and DDoS attacks. The RAT slows down response services to legitimate users, and can even cause the site to go offline.

See the full report here: https://thehackernews.com/2022/08/meet-borat-rat-new-unique-triple-threat.html

Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts

Cheap Android mobile phones that are counterfeit versions of popular smartphone brands are being used to host trojans targeting WhatsApp and WhatsApp Business messaging apps. People should purchase mobile devices only from official stores and legitimate distributors, to avoid such risks.

See the full report here: https://thehackernews.com/2022/08/researchers-find-counterfeit-phones.html

New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data

A new data exfiltration technique (GAIROSCOPE) uses a covert ultrasonic channel to leak sensitive information from isolated, air-gapped computers to a nearby smartphone, and doesn't require a microphone to pick up the sound waves.

See the full report here: https://thehackernews.com/2022/08/new-air-gap-attack-uses-mems-gyroscope.html

CISA Warns of Active Exploitation of Palo Alto Networks' PAN-OS Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw (CVE-2022-0028 – CVSS score: 8.6) affecting Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities Catalog. Federal Civilian Executive Branch (FCEB) agencies are mandated to update to the latest version by September 12, 2022.

See the full report here: https://thehackernews.com/2022/08/cisa-warns-of-active-exploitation-of.html

Google: Iranian hackers use new tool to steal email from victims

Iranian hacking group Charming Kitten (also known as APT35 and Phosphorus) has been reportedly using a new tool called Hyperscraper to download email messages from targeted Gmail, Yahoo, and Microsoft Outlook accounts.

See the full report here: https://www.bleepingcomputer.com/review/gaming/google-iranian-hackers-use-new-tool-to-steal-email-from-victims/

ETHERLED: Air-gapped systems leak data via network card LEDs

Security researchers have discovered a method (dubbed ETHERLED) to exfiltrate data from air-gapped systems using the LED indicators on network cards. The approach turns the blinking lights into Morse code signals that can be decoded by an attacker. The method can work with other peripherals or hardware that use LEDs as status or operational indicators, such as routers, network-attached storage (NAS) devices, printers, and scanners.

See the full report here: https://www.bleepingcomputer.com/news/security/etherled-air-gapped-systems-leak-data-via-network-card-leds/

Pirated 3DMark benchmark tool delivering info-stealer malware

Malware distributors are using SEO poisoning and malvertising to push malicious shareware sites high in Google Search results, promoting fake software along with cracks and product activation key generators. Software users should keep in mind that even if some sites appear high on search results, they aren’t necessarily legitimate or trustworthy.

See the full report here: https://www.bleepingcomputer.com/news/security/pirated-3dmark-benchmark-tool-delivering-info-stealer-malware/

VMware Carbon Black causing BSOD crashes on Windows

VMware’s Carbon Black Cloud Sensor 3.6.0.1979 - 3.8.0.398 caused devices to crash and show a blue screen of death (BSOD) in Windows servers and workstations at more than 50 organizations. VMWare commented that the issue has been identified and corrected, and VMware Carbon Black is working with impacted customers.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-carbon-black-causing-bsod-crashes-on-windows/

Phishing attacks abusing SaaS platforms see a massive 1,100% growth

Threat actors are increasingly abusing legitimate software-as-a-service (SaaS) platforms like website builders and personal branding spaces to create malicious phishing websites that steal login credentials. This helps in evading alerts from email security systems, enjoying high availability, and reducing the need to learn how to code to create websites that appear legitimate.

See the full report here: bleepingcomputer.com/news/security/phishing-attacks-abusing-saas-platforms-see-a-massive-1-100-percent-growth/

French hospital hit by $10M ransomware attack, sends patients elsewhere

The Center Hospitalier Sud Francilien (located near Paris, France) suffered a cyberattack, because of which the hospital had to refer patients to other establishments and postpone surgery appointments. The ransomware actors have demanded USD 10,000,000 in exchange for a decryption key.

See the full report here: https://www.bleepingcomputer.com/news/security/french-hospital-hit-by-10m-ransomware-attack-sends-patients-elsewhere/

New 'Donut Leaks' extortion gang linked to recent ransomware attacks

A new extortion gang Donut Leaks has been linked to recent cyberattacks, including those on Greek natural gas company DESFA, U.K. architectural firm Sheppard Robson, and multinational construction company Sando. The group’s Tor sites consist of a shaming blog (which lists five victims at the moment) and a data storage site that allows visitors to browse and download all of the stolen, leaked data. It has been speculated that the threat actor running Donut Leaks is a “pentester” or an affiliate for Hive, Ragnar Locker, and possibly other ransomware operations.

See the full report here: https://www.bleepingcomputer.com/news/security/new-donut-leaks-extortion-gang-linked-to-recent-ransomware-attacks/

XCSSET Malware Updates with Python 3 to Target macOS Monterey Users

The operators of the XCSSET macOS malware have made iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3. The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022.

See the full report here: https://thehackernews.com/2022/08/xcsset-malware-updates-with-python-3-to.html

Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies

A former head of security at Twitter has alleged that Twitter has major security problems that pose a threat to its own users' personal information, to company shareholders, to national security, and to democracy.

See the full report here: https://edition.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html

VMware Releases Security Update

VMware has released a security update to address a local privilege escalation vulnerability (CVE-2022-31676; CVSSv3 base score: 7.0) in Tools. A remote attacker could likely exploit the vulnerability to take control of an affected system. Users should apply the available patches to guard against any attacks via this vulnerability.

See the full report here: https://www.vmware.com/security/advisories/VMSA-2022-0024.html

Fake Chrome extension 'Internet Download Manager' has 200,000 installs

Security researchers have observed unwanted behavior exhibited by a Google Chrome extension “Internet Download Manager”—such as opening links to spam sites, changing the default browser search engine, and further showing the user pop-ups asking them to download more "patches" and unwanted programs. The software company Tonec, which publishes a legitimate Windows program called Internet Download Manager asserted that “all IDM extensions that can be found in Google Store are fake and should not be used.” The authentic Chrome extension provided by the company is called “IDM Integration Module.”

See the full report here: https://www.bleepingcomputer.com/news/security/chrome-internet-download-manager-adware-has-200-000-installs/

GitLab ‘strongly recommends’ patching critical RCE vulnerability

GitLab has issued patches to address a critical security flaw (CVE-2022-2884, CVSS score: 9.9) in its software that could lead to arbitrary code execution on affected systems. The security flaw can be exploited via the GitHub import API, but requires authentication to be triggered. There is no reported evidence that the issue is being exploited in attacks, but users should update to the latest version as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/gitlab-strongly-recommends-patching-critical-rce-vulnerability/

Plex warns users to reset passwords after a data breach

The Plex media streaming platform is sending password reset notices to many of its users in response to discovering unauthorized access to one of its databases. The intruder potentially accessed a limited subset of data, including email addresses, usernames, and encrypted passwords. Plex users can add a 2FA (two-factor authentication) step in their login process for additional account security.

See the full report here: https://www.bleepingcomputer.com/news/security/plex-warns-users-to-reset-passwords-after-a-data-breach/

Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams

A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives' Microsoft 365 accounts, even those protected by MFA. Windows admins can monitor for MFA changes on user accounts through the Azure Active Directory Audit Logs.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-aitm-attack-to-monitor-microsoft-365-accounts-for-bec-scams/

Quantum ransomware attack disrupts govt agency in Dominican Republic

The Dominican Republic's Instituto Agrario Dominicano (part of the Ministry of Agriculture) has suffered a Quantum ransomware attack that encrypted multiple services and workstations throughout the government agency. The threat actors claimed to have stolen over 1TB of data and threatened to release it if IAD did not pay a ransom (initially set at USD 650,000 ransom).

See the full report here: https://www.bleepingcomputer.com/news/security/quantum-ransomware-attack-disrupts-govt-agency-in-dominican-republic/

RansomEXX claims ransomware attack on Sea-Doo, Ski-Doo maker

The RansomEXX ransomware gang is claiming responsibility for the cyberattack against Bombardier Recreational Products (BRP), a Canadian maker of Ski-Doo snowmobiles, Sea-Doo jet skis, ATVs, motorcycles, watercrafts, and Rotax engines. The operational halt impacted production, and affected certain transactions with customers and suppliers. RansomEXX listed 29.9 GB of files allegedly stolen from the firm on its leak site.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomexx-claims-ransomware-attack-on-sea-doo-ski-doo-maker/

PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks

The Python Package Index, PyPI, warned people about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages. The social engineering attack involves sending security-themed messages that create a false sense of urgency by informing recipients that Google is implementing a mandatory validation process on all packages and that they need to click on a link to complete the validation or risk getting their PyPI modules removed.

See the full report here: https://thehackernews.com/2022/08/pypi-repository-warns-python-project.html

Crypto Miners Using Tox P2P Messenger as Command and Control Server

Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method. Tox is a serverless protocol for online communications that offers end-to-end encryption (E2EE) protections by making use of the Networking and Cryptography library for encryption and authentication.

See the full report here: https://thehackernews.com/2022/08/crypto-miners-using-tox-p2p-messenger.html