Threat Intelligence Bulletin: 09/23/2022 - 09/29/2022
|by Alpha Team
Breaking News: 2022-09-23 - 2022-09-29
The US used 41 cyber-weapons to steal China’s core technology data, says state media
China has accused the U.S. of hacking into a Chinese space and aviation university, stealing critical technical data.
See the full report here: https://www.globaltimes.cn/page/202209/1275816.shtml
Fraudsters Hack Nigerian Bank, Transfer N523m to 225 Accounts in Deadly 3-Day Cyber-Attack
According to the Nigerian police PR, the hackers stole the huge sum using 18 different customers accounts and dissipated same via Unified Payments Interface (UPI), Cash, ATM/POS, withdrawals and e-transfers.
See the full report here: https://www.legit.ng/business-economy/money/1493555-fraudsters-hack-nigerian-bank-transfer-n523m-225-accounts-deadly-3-day-cyber-attack/
Scams may follow Optus data breach: ACCC
Optus customers should take immediate steps to secure all of their accounts, particularly their bank and financial accounts, said the ACCC. They should also monitor for unusual activity on their accounts and watch out for contact by scammers, it added.
See the full report here: https://www.accc.gov.au/media-release/customers-warned-to-watch-out-for-scams-following-optus-data-breach
Hacked Twitter Account of Oman’s Indian Embassy Promotes XRP Giveaway
The Twitter account of the Embassy of Oman in India was hacked, with scammers replacing the profile picture of the account to a picture of Ripple CEO Brad Garlinghouse.
See the full report here: https://www.cryptotimes.io/hacked-twitter-account-of-omans-indian-embassy-promotes-xrp-giveaway/
A 15-Year-Old Unpatched Python bug potentially impacts over 350,000 projects
More than 350,000 open source projects can be potentially affected by an unpatched Python vulnerability, tracked as CVE-2007-4559 (CVSS score: 6.8), that was discovered 15 years ago. The issue is a Directory traversal vulnerability that resides in the ‘extract’ and ‘extractall’ functions in the tarfile module in Python
See the full report here: https://securityaffairs.co/wordpress/136081/hacking/python-bug-cve-2007-4559.html
Rockstar parent Take-Two Interactive confirms another hack
Take-Two Interactive, parent company to Rockstar Games, makers of the GTA franchise have confirmed that they have been hacked again.
See the full report here: https://www.moneycontrol.com/news/technology/rockstar-parent-take-two-interactive-confirms-another-hack-9215381.html
Portugal's TAP says hackers stole, published passengers' personal data
Portugal's flag carrier TAP told customers that hackers had stolen some of their personal data and published it on the dark web, although the state-owed airline said all payment details appeared to be safe.
See the full report here: https://www.reuters.com/business/aerospace-defense/portugals-tap-says-hackers-stole-published-passengers-personal-data-2022-09-22/
Hackers stealing GitHub accounts using fake CircleCI notifications
GitHub is warning of an ongoing phishing campaign that started on September 16 and is targeting its users with emails that impersonate the CircleCI continuous integration and delivery platform.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-stealing-github-accounts-using-fake-circleci-notifications/
Hackers from Bangladesh target Indian government websites, servers
The attack by the group Mysterious Team Bangladesh (MT) came days after Malaysian hacktivist groups known as DragonForce and Hacktivist of Garuda launched a series of cyber attacks against the Indian government.
See the full report here: https://www.indiatoday.in/india/story/hackers-bangladesh-target-indian-government-websites-servers-2003541-2022-09-22
Malicious npm Package Poses as Tailwind Tool
A malicious package in the npm open source code repository is hitching a social engineering ride on the "Tailwind" legitimate software library tool, which millions of application developers use around the globe.
See the full report here: https://www.darkreading.com/application-security/malicious-npm-package-poses-tailwind-tool
Researchers Uncover Years-Long Mobile Spyware Campaign Targeting Uyghurs
A new wave of a mobile surveillance campaign has been observed targeting the Uyghur community as part of a long-standing spyware operation active since at least 2015, cybersecurity researchers disclosed.
See the full report here: https://thehackernews.com/2022/09/researchers-uncover-years-long-mobile.html
Russian-speaking hacking group Shathak targeting healthcare and manufacturing
Russian-language hacking group Shathak has been actively targeting healthcare, manufacturing, finance and energy sectors in the US, Europe and Japan.
See the full report here: https://techmonitor.ai/technology/cybersecurity/shathak-hacking-group-healthcare-manufacturing
Suspected Chinese Hackers Target Tibet Media, Politicians
Alleged Chinese state-sponsored hackers are behind a barrage of emails that aim to collect intelligence from a range of targets in Tibet, including pro-independence political party and a prominent media organization. The hacking group known as TA413 uses phishing emails and customized malicious software to collect intelligence likely on behalf of the Chinese government.
See the full report here: https://www.bloomberg.com/news/articles/2022-09-22/suspected-chinese-hackers-target-tibet-media-politicians
Check out this Android spyware, says Microsoft, the home of a gazillion Windows flaws
Data-stealing spyware disguised as a banking rewards app is targeting Android users, Microsoft's security team has warned.
See the full report here: https://www.theregister.com/2022/09/22/microsoft_android_spyware_endpoint/
Long Island Agency Asks NYPD for Help After Cyber Attack Cripples 911 Center
Two weeks after a cyber attack hit Suffolk County, NY’s computers, much of the county's police department is still deeply feeling the effects — and is calling on the NYPD for backup.
See the full report here: https://www.policemag.com/645905/long-island-agency-asks-nypd-for-help-after-cyber-attack-cripples-911-center
Microsoft Exchange servers hacked via OAuth apps for phishing
Microsoft says a threat actor gained access to cloud tenants hosting Microsoft Exchange servers in credential stuffing attacks, with the end goal of deploying malicious OAuth applications and sending phishing emails.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-via-oauth-apps-for-phishing/
System flaw makes hacking and stealing Hyundai and Kia cars easier
An insurance industry group says these cars are stolen at nearly twice the rate of the rest of the auto industry because their keys lack computer chips for theft “immobilizer” systems
See the full report here: https://fortune.com/2022/09/22/hyundai-kia-cars-stealing-hack-thieves/
Microsoft SQL servers hacked in TargetCompany ransomware attacks
Vulnerable Microsoft SQL servers are being targeted in a new wave of attacks with FARGO ransomware, security researchers are warning.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-sql-servers-hacked-in-targetcompany-ransomware-attacks/
Metador: A New Hacking Group Hiding in Telecoms and ISPs For Months
Highly sophisticated in its operations, the threat actor targets telecom companies, internet providers, and universities in the Middle East, with the aim of long-term espionage.
See the full report here: https://techdator.net/metador-hacking-group/
Ransomware data theft tool may show a shift in extortion tactics
Data exfiltration malware known as Exmatter and previously linked with the BlackMatter ransomware group is now being upgraded with data corruption functionality that may indicate a new tactic that ransomware affiliates might switch to in the future.
See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-data-theft-tool-may-show-a-shift-in-extortion-tactics/
Samsung, Huawei and Google phone users urged to delete popular apps which may contain malware
Tech-security buffs are warning Android smartphone and tablet users about a swarm of dangerous mobile applications that have been downloaded millions of times from the Google Play Store.
See the full report here: https://www.chroniclelive.co.uk/news/uk-news/android-apps-scam-warning-crime-25102000
Hackers Exploited Zero-Day RCE Vulnerability in Sophos Firewall — Patch Released
Security software company Sophos has released a patch update for its firewall product after it was discovered that attackers were exploiting a new critical zero-day vulnerability to attack its customers' network.
See the full report here: https://thehackernews.com/2022/09/hackers-actively-exploiting-new-sophos.html
British boy, 17, is charged with hacking Uber and Grand Theft Auto developer Rockstar
A 17-year-old boy from Oxfordshire in England has been arrested in relation to recent high-profile hackings of Uber and Grand Theft Auto developer Rockstar.
See the full report here: https://www.dailymail.co.uk/news/article-11246685/British-boy-17-charged-hacking-Uber-Grand-Theft-Auto-developer-Rockstar.html
Optus hacker demands $1.5 million ransom, leaks customer info
A nefarious character is demanding Optus pay US$1 million in cryptocurrency otherwise they will leak sensitive information about millions of Australians that they claim to have obtained in a sophisticated hack.
See the full report here: https://www.news.com.au/finance/business/optus-data-breach-hacker-demands-15-million-ransom-customer-info-leaked-on-dark-web/news-story/d9877fe037a04970225af2eafec6d686
Personal details of stars including Sir David Attenborough leaked after Russian attack on retailer
Clients of Daylesford Organic, the luxury food company, have had their personal details leaked by Russian hackers. Sir David Attenborough, Jeremy Clarkson, Tim Henman, the Duchess of York, the snooker player Ronnie O’Sullivan and Lady Sarah Chatto, the King’s cousin, were victims of the Snatch gang.
See the full report here: https://www.thesun.co.uk/news/19912176/details-stars-david-attenborough-sarah-ferguson-leaked-russian-hack/
Cash Express issues data breach alert
Cash Express notified its customers that their personal information, including: names, dates of birth, Social Security numbers, driver’s license numbers, and financial information may have been stolen and as part of a recent hack.
See the full report here: https://www.benzinga.com/pressreleases/22/09/g29001043/cash-express-llc-data-breach-alert-issued-by-wolf-haldenstein-adler-freeman-herz-llp
Australia to tighten security norms after Optus breach
The Australian government is soon expected to announce several new security measures following the massive Optus data breach that saw hackers steal the personal details of up to 9.8 million Australians. Under the changes to be announced in coming days, banks and other institutions would be informed much faster when a data breach occurs at a company like Optus, so personal data can't be used to access accounts.
See the full report here: https://www.abc.net.au/news/2022-09-25/new-security-measures-to-be-unveiled-following-optus-data-breach/101472364
American Airlines learned it was breached from phishing targets
American Airlines stated that its Cyber Security Response Team found out about a recently disclosed data breach from the targets of a phishing campaign that was using an employee's hacked Microsoft 365 account. The investigation also revealed the attacker accessed multiple employees' accounts and used them to send more phishing emails to targets American has not yet disclosed.
See the full report here: https://www.bleepingcomputer.com/news/security/american-airlines-learned-it-was-breached-from-phishing-targets/
Delta Dental, USA, announces cybersecurity breach
Delta Dental of Washington has announced a cybersecurity breach that affected over 6,000 members following unauthorized network access to a third-party vendor it contracted with earlier this summer. The attackers could have potentially accessed the full name, address, group number, and Delta Dental Identification Number of 6,361 members.
See the full report here: https://www.nbcrightnow.com/news/delta-dental-of-wa-says-thousands-included-in-third-party-security-breach/article_fef7d9ec-3ba4-11ed-ba71-b38a32edf30c.html
Colonial Pipeline ransomware group using new tactics to become more dangerous
The ransomware-as-a-service (RaaS) operation Coreid reportedly uses the name Noberus to describe its ransomware offering, with several features designed to highlight its superiority over other types of ransomware. Its default encryption method uses a process called “intermittent encryption” to encrypt data quickly and securely yet at the same time avoid detection. To extract the stolen files, Noberus uses a tool called Exmatter, designed to steal specific types of files from selected directories and then upload them to the attacker’s server even before the ransomware is deployed.
See the full report here: https://www.techrepublic.com/article/colonial-pipeline-ransomware-group-using-new-tactics-to-become-more-dangerous/
Microsoft shares workarounds for Windows Group Policy issues
Microsoft has acknowledged a known issue where copying files/shortcuts using Group Policy Preferences on Windows client devices might not work as expected after installing Windows cumulative updates released as part of September 2022 Patch Tuesday. The list of affected platforms includes client (from Windows 8.1 up to Windows 11 22H2) and server releases (from Windows Server 2008 SP2 and up to Windows Server 2022). Microsoft confirmed a workaround shared by impacted customers before the issue was acknowledged, together with a couple of additional ways to mitigate the issue.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-workarounds-for-windows-group-policy-issues/
npm packages used by crypto exchanges compromised
Multiple npm packages published by the crypto exchange, dYdX, and used by at least 44 cryptocurrency projects appear to have been compromised. The packages in question were published from the npm account of a dYdX staff member and found to contain illicit code that would run info stealers on a system when installed. dYdX confirmed the incident has not impacted its websites, apps, smart contracts, or funds, and that it plans on publishing an incident post-mortem report.
See the full report here: https://www.bleepingcomputer.com/news/security/npm-packages-used-by-crypto-exchanges-compromised/
Ukraine dismantles hacker gang that stole 30 million accounts
The cyber department of Ukraine's Security Service (SSU) has taken down a group of hackers that stole accounts of about 30 million individuals and sold them on the dark web. The hackers used malware to obtain credentials and other sensitive data available on victim systems in Ukraine and the European Union.
See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-dismantles-hacker-gang-that-stole-30-million-accounts/
Multi-million dollar credit card fraud operation uncovered
A massive operation that has reportedly siphoned millions of USD from credit cards since its launch in 2019 has been exposed and is considered responsible for losses for tens of thousands of victims. The operation uses two kinds of domains that serve as the basis of the operation, namely, dating sites and customer support portals.
See the full report here: https://www.bleepingcomputer.com/news/security/multi-million-dollar-credit-card-fraud-operation-uncovered/
CISA warns of critical ManageEngine RCE bug used in attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical severity Java deserialization vulnerability (CVE-2022-35405) affecting multiple Zoho ManageEngine products to its catalog of bugs exploited in the wild. Proof-of-concept (PoC) exploit code and a Metasploit module (targeting this bug to gain RCE as the SYSTEM user) have been available online since August. All Federal Civilian Executive Branch Agencies (FCEB) agencies now must patch their systems against this bug by October 13.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-manageengine-rce-bug-used-in-attacks/
Void Balaur Hackers-for-Hire Targeting Russian Businesses and Politics Entities
A hack-for-hire group that was first exposed in 2019 has expanded its focus to set its sights on entities with business or political ties to Russia. Dubbed Void Balaur, the cyber mercenary collective has a history of launching cyberattacks against biotechnology and telecom companies since 2015. As many as 3,500 victims have been reported as of November 2021.
See the full report here: https://thehackernews.com/2022/09/void-balaur-hackers-for-hire-group-now.html
Hackers Use NullMixer and SEO to Spread Malware More Efficiently
Security researchers have spotted a new series of campaigns focusing on the malware tool they named NullMixer. The tool spreads malware via malicious websites that can be easily found via popular search engines, including Google.
See the full report here: https://www.infosecurity-magazine.com/news/nullmixer-and-seo-to-spread-malware/
Ukraine Cracks Down on Group Selling Hacked Accounts to Pro-Russia Propagandists
Ukrainian authorities say they have taken down a pro-Russia hacking group that compromised user accounts and then sold them for profit on dark web portals. According to the cyber department of Ukraine's Security Service (SSU), the hackers targeted user accounts of individuals in Ukraine and across Europe.
See the full report here: https://www.securityweek.com/ukraine-cracks-down-group-selling-hacked-accounts-pro-russia-propagandists
New Phishing Attack Technique Spoof Netflix
Cybercriminals have created a form that appeared to be sent from Netflix to an end user. All sender email addresses were spoofed to look like they came from Netflix’s actual domain. In actuality, the phishing emails came from a compromised mail server controlled by a Peruvian university,
See the full report here: https://securityboulevard.com/2022/09/inky-finds-new-phishing-attack-technique-spoofing-netflix/
Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor
A China-aligned advanced persistent threat actor (TA413) weaponized recently disclosed flaws in Sophos Firewall and Microsoft Office (CVE-2022-1040 and CVE-2022-30190, aka "Follina") to deploy a new backdoor called LOWZERO as part of an espionage campaign aimed at Tibetan entities. TA413, also known as LuckyCat, has been linked to relentlessly targeting organizations and individuals associated with the Tibetan community at least since 2020 using malware such as ExileRAT, Sepulcher, and a malicious Mozilla Firefox browser extension dubbed FriarFox.
See the full report here: https://thehackernews.com/2022/09/chinese-espionage-hackers-target.html
Researchers Identify 3 Hacktivist Groups Supporting Russian Interests
Security researchers report that at least three Russian hacktivist groups – XakNet Team, Infoccentr, and CyberArmyofRussia_Reborn – are likely collaborating with state-sponsored cyber threat actors. This is based on evidence that the leakage of data stolen from Ukrainian organizations occurred within 24 hours of malicious wiper incidents undertaken by the Russian nation-state group tracked as APT28 (aka Fancy Bear, Sofacy, or Strontium).
See the full report here: https://thehackernews.com/2022/09/researchers-identify-3-hacktivist.html
Adware on Google Play and Apple Store installed 13 million times
Security researchers have discovered 75 applications on Google Play and another ten on Apple’s App Store – collectively adding to 13 million installations – engaged in an ad fraud campaign dubbed Scylla. Apart from flooding mobile users with advertisements, both visible and hidden, the fraudulent apps also generated revenue by impersonating legitimate apps and impressions. Users should monitor their apps for malicious or unwanted apps by looking for some signs that typically indicate an issue such as rapid battery drainage and increased internet data usage.
See the full report here: https://www.bleepingcomputer.com/news/security/adware-on-google-play-and-apple-store-installed-13-million-times/
New Erbium password-stealing malware spreads as game cracks, cheats
The new Erbium information-stealing malware is being distributed as fake cracks and cheats for popular video games to steal victims' credentials and cryptocurrency wallets. To keep the threat out of theirs systems, users should avoid downloading pirated software, scan all downloaded files on an antivirus tool, and keep their software up to date by installing the latest available security patches.
See the full report here: https://www.bleepingcomputer.com/news/security/new-erbium-password-stealing-malware-spreads-as-game-cracks-cheats/
Hackers use PowerPoint files for 'mouseover' malware delivery
Hackers believed to work for Russia have started using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations to trigger a malicious PowerShell script. No malicious macro is necessary for the malicious code to execute and download the payload, for a more insidious attack.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-powerpoint-files-for-mouseover-malware-delivery/
NVIDIA GeForce Experience beta fixes Windows 11 22H2 gaming issues
NVIDIA has acknowledged performance issues affecting systems with NVIDIA GPUs after installing the Windows 11 22H2 Update. The official fix for this known issue is to update the company's GeForce Experience software suite to the 3.26 Beta version, which addresses the problems.
See the full report here: https://www.bleepingcomputer.com/news/technology/nvidia-geforce-experience-beta-fixes-windows-11-22h2-gaming-issues/
Ukraine warns allies of Russian plans to escalate cyberattacks
The Ukrainian military intelligence service warned today that Russia is planning "massive cyber-attacks" targeting the critical infrastructure of Ukraine and its allies. This incoming wave will likely focus on disrupting and taking down energy industry facilities and institutions.
See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-warns-allies-of-russian-plans-to-escalate-cyberattacks/
Richemont’s Watchfinder Reports Customer Data Breach
Watchfinder, the dealer in pre-owned luxury watches that’s owned by Richemont, said it suffered a data breach that may have disclosed customer information.
See the full report here: https://www.bloomberg.com/news/articles/2022-09-26/richemont-s-watchfinder-reports-customer-data-breach
North Macedonia Ministry Denies Covering up Ransomware Attack
North Macedonia’s Agriculture Ministry has admitted that it was attacked by the ransomware group BlackByte. The admission came after the main opposition VMRO DPMNE party accused the ministry of keeping silent about the attack.
See the full report here: https://balkaninsight.com/2022/09/26/north-macedonia-ministry-denies-covering-up-ransomware-attack/
Diodes Incorporated Confirms Recent Data Breach Affecting SSNs and Health Information
Diodes Incorporated confirmed that the company experienced a data breach after consumer data entrusted to the company was accessible to an unauthorized party. The leaked data include PIIs and health information.
See the full report here: https://www.jdsupra.com/legalnews/diodes-incorporated-confirms-recent-4573117/
SQL Server admins warned about Fargo ransomware
Organizations are being warned about a wave of attacks targeting Microsoft SQL Server with ransomware known as Fargo, which encrypts files and threatens victims that their data may be published online if they do not pay up.
See the full report here: https://www.theregister.com/2022/09/26/sql_server_fargo_ransomware/
Reiter Affiliated Companies, LLC, Confirms Leaked SSNs in the Wake of Recent Data Breach
Reiter Affiliated Companies reported a data breach with the U.S. Department of Health and Human Services Office for Civil Rights after sensitive consumer information entrusted to the company was accessed by an unauthorized party.
See the full report here: https://www.jdsupra.com/legalnews/major-berry-producer-reiter-affiliated-4783686/
Harly, latest malware in market, can drain your bank accounts
Since 2020, more than 190 Harly-infected apps have been discovered on Google Play. Researchers estimate that 4.8 million people have downloaded these apps, however, the actual number may be far higher.
See the full report here: https://www.wionews.com/technology/explained-harly-the-latest-malware-in-market-that-can-drain-your-bank-accounts-520334
Microsoft Sway Pages Weaponized to Perform Phishing and Malware Delivery
While Microsoft only allows uploads of media files in Sway pages (and actively blocks uploads of executable files), there are ways to use Sway to distribute malicious executables by embedding the hosted malware within the platform.
See the full report here: https://www.infosecurity-magazine.com/news/microsoft-sway-phishing-and/
Lazarus hackers drop macOS malware via Crypto.com job offers
The North Korean Lazarus hacking group is now using fake "Crypto[.]com" job offers to hack developers and artists in the crypto space, likely with a long-term goal of stealing digital assets and cryptocurrency.
See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-drop-macos-malware-via-cryptocom-job-offers/
WhatsApp reveals security bug that put users' data at risk
WhatsApp has warned of a critical "security bug" affecting its Android app that could allow attackers to remotely plant malware on users' phones during video calls. The critical vulnerability, CVE-2022-36934, has a severity rating of 9.8 out of 10.
See the full report here: https://www.livemint.com/technology/tech-news/whatsapp-reveals-security-bug-that-put-users-data-at-risk-11664322488682.html
NCC issues countermeasures against website scams on Microsoft Edge Browser
The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has issued an advisory for users to install trusted, up-to-date anti-virus software with an Internet security component and to customize News Feed in Microsoft Edge Browser.
See the full report here: https://www.vanguardngr.com/2022/09/ncc-issues-countermeasures-against-website-scams-on-microsoft-edge-browser/
Chilean Court System Hit With Ransomware Attack
The Chilean judicial system put 150 computers offline to stop the spread of a virus that maliciously encrypts files even as authorities stressed that court proceedings were mostly unaffected. The event is the latest cyber disruption affecting the South American country.
See the full report here: https://www.govinfosecurity.com/chilean-court-system-hit-ransomware-attack-a-20159
Ransomware gangs turn attention to Indian SMBs
Indian Computer Emergency Team (CERT-In) said that ransomware attacks on Indian organizations increased by 51% in the first half of this year. Small businesses (with up to 500 employees) accounted for 54% of ransomware attacks in the country between January 2020 and July 2022.
See the full report here: https://www.techcircle.in/2022/09/27/ransomware-gangs-turn-attention-to-indian-smbs/
Defense Giant Elbit Confirms Data Breach After Ransomware Gang Claims Hack
Elbit Systems of America, a subsidiary of Israeli defense giant Elbit Systems, has confirmed suffering a data breach, a few months after a ransomware gang claimed to have hacked the company’s systems. The attacker may have acquired information belonging to certain employees, including name, address, social security number, date of birth, direct deposit information, and ethnicity.
See the full report here: https://www.securityweek.com/defense-giant-elbit-confirms-data-breach-after-ransomware-gang-claims-hack
Ransomware attack at Linn-Mar School District
The FBI is reportedly investigating a computer breach at the Linn-Mar School District in Iowa (United States of America). A Linn-Mar staff member disclosed a screenshot that showed a warning message stating “all your files have been encrypted by Vice Society.”
See the full report here: https://www.kcrg.com/2022/09/28/ransomware-attack-linn-mar-school-district-what-we-know-now/
Meta dismantles massive Russian network spoofing Western news sites
Meta has reportedly taken down an extensive network of Facebook and Instagram accounts pushing disinformation published on more than 60 websites that spoofed multiple legitimate news sites across Europe. This influence network mainly targeted Germany, France, Italy, Ukraine, and the U.K.
See the full report here: https://www.bleepingcomputer.com/news/security/meta-dismantles-massive-russian-network-spoofing-western-news-sites/
Optus hacker apologizes and allegedly deletes all stolen data
The hacker who claimed to have breached Optus and stolen the data of 11 million customers has withdrawn their extortion demands and apologized to 10,200 people whose personal data was already leaked. Optus, Australia's second-largest mobile operator, disclosed the security breach on September 22, 2022.
See the full report here: https://www.bleepingcomputer.com/news/security/optus-hacker-apologizes-and-allegedly-deletes-all-stolen-data/
Leaked LockBit 3.0 builder used by ‘Bl00dy’ ransomware gang in attacks
The relatively new Bl00Dy Ransomware Gang has started to use a recently leaked LockBit ransomware builder in attacks against companies. Last week, the LockBit 3.0 ransomware builder was leaked on Twitter after the LockBit operator had a falling out with his developer.
See the full report here: https://www.bleepingcomputer.com/news/security/leaked-lockbit-30-builder-used-by-bl00dy-ransomware-gang-in-attacks/
Ethernet VLAN Stacking flaws let hackers launch DoS, MiTM attacks
Four vulnerabilities in the widely adopted 'Stacked VLAN' Ethernet feature allows attackers to perform denial-of-service (DoS) or man-in-the-middle (MitM) attacks against network targets using custom-crafted packets.
See the full report here: https://www.bleepingcomputer.com/news/security/ethernet-vlan-stacking-flaws-let-hackers-launch-dos-mitm-attacks/
IRS warns Americans of massive rise in SMS phishing attacks
The Internal Revenue Service (IRS) warned Americans of an exponential rise in IRS-themed text message phishing attacks trying to steal their financial and personal information in the last few weeks.
See the full report here: https://www.bleepingcomputer.com/news/security/irs-warns-americans-of-massive-rise-in-sms-phishing-attacks/
Hackers now sharing cracked Brute Ratel post-exploitation kit online
The Brute Ratel post-exploitation toolkit has been cracked and is now being shared for free across Russian-speaking and English-speaking hacking communities.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-now-sharing-cracked-brute-ratel-post-exploitation-kit-online/
Hacker shares how they allegedly breached Fast Company’s site
Fast Company took its website offline after it was hacked to display stories and push out Apple News notifications containing obscene and racist comments. The hackers have shared how they allegedly breached the site.
See the full report here: https://www.bleepingcomputer.com/news/security/hacker-shares-how-they-allegedly-breached-fast-company-s-site/
Auth0 warns that some source code repos may have been stolen
Authentication service provider and Okta subsidiary Auth0 has disclosed what it calls a "security event" involving some of its code repositories. Auth0's authentication platform is used to authenticate over 42 million logins each day by more than 2,000 enterprise customers from 30 countries.
See the full report here: https://www.bleepingcomputer.com/news/security/auth0-warns-that-some-source-code-repos-may-have-been-stolen/
Stealthy hackers target military and weapons contractors in recent attack
Security researchers have discovered a new campaign targeting multiple military contractors involved in weapon manufacturing, including an F-35 Lightning II fighter aircraft components supplier.
See the full report here: https://www.bleepingcomputer.com/news/security/stealthy-hackers-target-military-and-weapons-contractors-in-recent-attack/
New Chaos malware infects Windows, Linux devices for DDoS attacks
A quickly expanding botnet called Chaos is targeting and infecting Windows and Linux devices to use them for cryptomining and launching DDoS attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/new-chaos-malware-infects-windows-linux-devices-for-ddos-attacks/
Cyber Criminals Using Quantum Builder Sold on Dark Web to Deliver Agent Tesla Malware
Sold on the dark web for €189 a month, Quantum Builder is a customizable tool for generating malicious shortcut files as well as HTA, ISO, and PowerShell payloads to deliver next-stage malware on the targeted machines, in this case Agent Tesla.
See the full report here: https://thehackernews.com/2022/09/cyber-criminals-using-quantum-builder.html
Massive Spike in Malicious Domain Activity Reported
Rsearchers have identified nearly 79 million malicious domains in the first half of 2022, which collectively represent a little more than 20% of all the newly observed domains (NODs) accessed via its content delivery network (CDN) and other services the company provides.
See the full report here: https://securityboulevard.com/2022/09/akamai-reports-massive-spike-in-malicious-domain-acitivity/
Vendor notifies Geisinger patients of data breach
A billing contractor's data breach has affected 2,857 patients of US-based healthcare service provider Geisinger. A marketing execution and supply chain vendor for VisitPay was subject to a malware attack, whcih resulted in the breach.
See the full report here: https://www.dailyitem.com/news/vendor-notifies-geisinger-patients-of-data-breach/article_7ec67380-3f6b-11ed-ab9c-cbcefacd56fe.html
Vulnerability in Apache Pulsar allowed manipulator-in-the-middle attacks
A newly-discovered vulnerability in Apache Pulsar allows a remote attacker to carry out a manipulator-in-the-middle (MitM) attack due to improper certificate validation. Apache Pulsar is used by thousands of companies for high-performance data pipelines, microservices, instant messaging, data integrations etc.
See the full report here: https://portswigger.net/daily-swig/vulnerability-in-apache-pulsar-allowed-manipulator-in-the-middle-attacks
NCC warns as Lenovo uncovers vulnerability
The Nigerian Communications Commission warned the public as original equipment manufacturer (OEM), Lenovo, said it had discovered vendor vulnerabilities in some of its products, which it said could lead to information disclosure, privilege escalation, and denial of service.
See the full report here: https://thenationonlineng.net/ncc-warns-as-lenovo-uncovers-vulnerability/
Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
Developers of the open source Matrix messenger protocol released an update to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise.
See the full report here: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulnerabilities-that-completely-subvert-e2ee-guarantees/
NCC alerts Zoom users about software that creates vulnerabilities
Zoom users have been advised by the Computer Security Incident Response Team (CSIRT) of the Nigerian Communications Commission (NCC) to install the latest update of the software from the platform’s official website following discovery of vulnerabilities that allow a remote attacker to exploit the app.
See the full report here: https://www.thenicheng.com/ncc-alerts-zoom-users-criminals-can-infiltrate-undetected/
U.S. counterintelligence agency rife with vulnerabilities
U.S. senators have released a report noting the vulnerabilities of the National Counterintelligence and Security Center stemming from prevalent dysfunction, failure to adapt to cybersecurity and "whole-of-society" threats, and inadequate resources.
See the full report here: https://www.scmagazine.com/brief/threat-intelligence/u-s-counterintelligence-agency-rife-with-vulnerabilities
Most Attackers Need Less Than 10 Hours to Find Weaknesses
The average ethical hacker can find a vulnerability that allows the breach of the network perimeter and then exploit the environment in less than 10 hours. Once a vulnerability or weakness is found, about 58% of ethical hackers can break into an environment in less than five hours.
See the full report here: https://www.darkreading.com/attacks-breaches/attackers-less-than-ten-hours-find-weaknesses
Johnson Memorial warns patients of data breach
Johnson Memorial Hospital, USA, has alerted the public to a data breach that took place on a third-party law firm’s computer system in March.
See the full report here: https://www.journalinquirer.com/connecticut_and_region/johnson-memorial-warns-patients-of-data-breach/article_1440fbb4-3f4f-11ed-b621-336929b2572f.html
Arthur J. Gallagher to Face Suit on Breach Affecting 3 Million
Insurance brokers Arthur J. Gallagher & Co. and Gallagher Basset Services must face a proposed class action arising from a 2020 ransomware attack and data breach that allegedly exposed the personal information and protected health information of three million people, a federal court ruled.
See the full report here: https://news.bloomberglaw.com/health-law-and-business/arthur-j-gallagher-to-face-suit-on-breach-affecting-3-million
IceFire ransomware gang ramping up attacks
Security research collective MalwareHunterTeam initially tweeted about the new IceFire ransomware strain on March 14 and confirmed the rapid collection of victims. Similar to other groups, IceFire also requests ransom demands to be paid in Monero.
See the full report here: https://www.techtarget.com/searchsecurity/news/252525508/NCC-Group-IceFire-ransomware-gang-ramping-up-attacks
FMC Services Announces Data Breach Affecting More than 230k People’s Sensitive Information
FMC Services confirmed that the company experienced a data breach after an unauthorized party gained access to sensitive consumer data contained on FMC’s network. The information leaked include names, addresses, Social Security numbers, dates of birth and protected health information of certain patients and former patients.
See the full report here: https://www.jdsupra.com/legalnews/fmc-services-llc-announces-data-breach-6165700/
India's Swachh City platform hacked, data of 16 million people at risk
From the data sample that was disclosed by the threat actor to substantiate his claim on the Dark Web, researchers were able to assess registered email addresses, password hashes, registered phone numbers, transmitted OTP information, login IPs, individual user tokens, and browser fingerprint information of the affected users.
See the full report here: https://thecyberexpress.com/swachh-city-hacked-16-million-indians-personal-information-at-risk/
Tags: all industries, global