Breach Disclosure: Start

On August 30, 2022, the Telegram Channel "ARVIN" posted a data breach package targeting the organization Start, a video services company which combines the production and distribution of Russian-language content operating from Moscow, Russia. From the package published in the Telegram channel, ZeroFox extracted 7,455,592 email addresses and hashed passwords.

Standing Intelligence Requirements**

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 30, 2022, the Telegram Channel "ARVIN" (hxxps[:]//t[.]me/arvin_club) posted a data breach package targeting the organization Start (start[.]ru), a video services company which combines the production and distribution of Russian-language content operating from Moscow, Russia. The threat actor noted that the data dump includes 43.9 million users' information registered from 09/19/2017 till 09/22/2021. The data dump was also circulated in the deep web forums like BreachForums on September 3, 2022 by the threat actor "notdocssell", in Leakbase on August 31, 2022 by the threat actor "cocokeks123" and in a telegram channel "Утечки информации" (translated as "Information leaks"- hxxps[:]//t[.]me/dataleak) on August 28, 2022. From the package published in Telegram channel "ARVIN", ZeroFox extracted 7,455,592 email addresses and hashed passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 2, Issue 18

Welcome back to The Underground Economist, Volume 2, Issue 18, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of September 30, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Q2 2022 Business Insurance: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-10-03a

TLP:CLEAR

ZeroFox Intelligence is excited to announce the release of our Business Insurance Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on September 20, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The insurance industry remains a lucrative target for malicious actors due to the vast amounts of policy holder information insurers possess. Cybercriminals target personally Identifiable Information (PII) held by insurers—including Social Security numbers, health and financial records, phone numbers, and addresses—and leverage such data to commit fraudulent activity or sell it to third parties on deep and dark web (DDW) forums. Specifically, organizations that provide business insurance are very likely to be seen as valuable targets within the broader industry. The compromise of a single business insurer could provide access to multiple downstream targets across various sectors and the opportunity to reach and exploit a wider scope of customer bases, enabling follow-on attacks. As a result, business insurance organizations face a host of potential impacts, including data corruption or data theft, business disruption, and reputational damage.

The attack surface within insurance and financial services more broadly continues to expand, as organizations increasingly adopt digital solutions to modernize infrastructure and improve product offerings. This shift, accelerated by the COVID-19 pandemic, has resulted in insurers driving investment in online services such as web and app-based agency portals, live-data tracking deployed on hybrid cloud platforms, and the adoption of automated underwriting and workflow software. While this provides new business capabilities, it also introduces new attack vectors for threat actors. Additionally, many insurance companies remain reliant on outdated and vulnerable IT systems due to the costs associated with modernizing technology and digitizing client records.

The insurance supply chain is complex, with sensitive customer data and PII often being exchanged by various third parties. Most insurers, for example, utilize independent agents to sell and write policies across various lines of business, presenting opportunities for threat actors to exploit weak security practices at multiple points. As insurers and their supply chains embrace big data and advanced analytics that require handling vast amounts of consumer information beyond current levels yet operate on outdated systems, malicious actors will almost certainly continue to view the industry as a prime target for compromising networks and gaining access to valuable data.

Key Findings

• Threat actors remain motivated to target the business insurers and the broader insurance industry to monetize access to client and network data.
• Criminal actors are most likely to use ransomware and digital extortion to extract the greatest monetary value from the data.
• The threat from saturated loader, infostealer, and trojan marketplaces filled with malware designed to target Windows or Linux-based systems remains prevalent.
• Threat actors are also turning their attention to gaps in third-party vendors’ security practices to exploit stolen data.
• Social engineering remains the most frequently-reported intrusion vector across the insurance sector in 2022 and is expected to remain so for the foreseeable future.
• Cyber espionage poses a threat to the insurance industry from threat actors—typically nation-state or state-sponsored—seeking a competitive advantage or financial return.

U.S. Midterm Elections Series: Impacts Of Political Involvement On Organizations

Product Serial: B-2022-10-03a

TLP:CLEAR

In this brief, ZeroFox Intelligence explores how political involvement and perceived company values may affect organizations.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on September 22, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

In an increasingly divided political climate, an organization’s perceived values can have a major impact on how they are regarded. The past several years have brought many divisive issues to the surface, including the coronavirus pandemic, voting reform, policing, income inequality, and other social justice issues. All of these issues have existed for years, but many have been increasingly moved to the forefront of society, particularly during election cycles. With information regarding campaign contributions from organizations - and leadership social media postings - readily available online, groups and individuals can easily research where organizations give their funding and where they stand on social issues. When those stances or donations do not align with expectations or desires of a segment of society, it can be the basis for physical, cyber, or reputational attacks.

Microsoft Exchange Zero-Day Vulnerabilities

Product Serial: F-2022-09-30a

TLP:CLEAR

In this flash report, ZeroFox Intelligence shares details about two on-premise Microsoft Exchange zero-day vulnerabilities actively being exploited in the wild.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:00 AM (EDT) on September 30, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On September 29, 2022, Microsoft confirmed two zero-day vulnerabilities–tracked as CVE-2022-41040 and CVE-2022-41082–affecting its Exchange Server, versions 2013, 2016, and 2019. Multiple sources disclosed the vulnerabilities, and state that the vulnerabilities are being actively exploited in the wild. While Microsoft has advised that only on-premises Exchange customers are impacted and that customers with Exchange Online do not need to take any action, customers that operate a hybrid server could be impacted.

Key Findings

• Two zero-day vulnerabilities were identified that affect Microsoft Exchange Server versions 2013, 2016, and 2019. On-premises Exchange customers are impacted, and possibly those operating hybrid server environments as well.
• Active exploitation in the wild has been identified.
• Workarounds are available, and Microsoft encourages users to enact URL rewrite instructions and block exposed Remote PowerShell ports.

Breaking News: 2022-09-30 - 2022-10-06

Hacking group hides backdoor malware inside Windows logo image

Security researchers have discovered a malicious campaign by the Witchetty hacking group, which uses steganography to hide a backdoor malware in a Windows logo.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-hides-backdoor-malware-inside-windows-logo-image/

Polyglot files delivering IcedID malware

Threat actors are leveraging polyglot file attacks to evade detection and deliver information-stealing malware. Attackers are using decoy Microsoft Compiled HTML Help files containing multiple file formats to infect systems with information-stealing malware.

See the full report here: https://www.techtarget.com/searchsecurity/news/252525555/Unit-42-finds-polyglot-files-delivering-IcedID-malware

Covert malware targets VMware shops for hypervisor-level espionage

Emerging covert malware can target VMware environments to allow criminals to gain persistent administrative access to hypervisors, transfer files, and execute arbitrary commands on virtual machines.

See the full report here: https://www.theregister.com/2022/09/29/vmware_malware_mandiant/

Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware

The cybercrime group emerged on the scene with ATM-focused malware attacks in the South American nation, providing it the ability to break into ATM machines to perform jackpotting – a type of attack aiming to dispense cash illegitimately – and clone thousands of credit cards to steal funds from the targeted bank's customers.

See the full report here: https://thehackernews.com/2022/09/brazilian-prilex-hackers-resurfaced.html

Cobalt Strike malware campaign targets job seekers

Researchers have spotted a new wave of phishing attacks that target job seekers in the U.S. and New Zealand, infecting them with Cobalt Strike beacons.

See the full report here: https://www.techtarget.com/searchsecurity/news/252525560/Cobalt-Strike-malware-campaign-targets-job-seekers

STOP ransomware variant DJVU gains traction

DJVU began life in 2018 as a new variant of the STOP ransomware that entered center stage towards the end of 2017. STOP ransomware gained notoriety with its multiple campaigns and its unique ransomware extension, STOP.

See the full report here: https://blogs.blackberry.com/en/2022/09/djvu-the-ransomware-that-seems-strangely-familiar

Microsoft: Lazarus hackers are weaponizing open-source software

Microsoft says the North Korean-sponsored Lazarus threat group is trojanizing legitimate open-source software and using it to backdoor organizations in many industry sectors, such as technology, defense, and media entertainment.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-lazarus-hackers-are-weaponizing-open-source-software/

New Royal Ransomware emerges in multi-million dollar attacks

Royal is an operation that launched in January 2022 and consists of a group of vetted and experienced ransomware actors from previous operations. Unlike most active ransomware operations, Royal does not operate as a Ransomware-as-a-Service but is instead a private group without affiliates.

See the full report here: https://www.bleepingcomputer.com/news/security/new-royal-ransomware-emerges-in-multi-million-dollar-attacks/

Disgruntled insider' shared REvil information with researchers, helped law enforcement

A “disgruntled internal source” upset with how other hackers boasted about earnings while they hadn’t been paid went on to help researchers understand the inner workings of the threat actor group REvil

See the full report here: https://www.cyberscoop.com/insider-revil-researchers/

Pentagon bug bounty program turns up nearly 350 vulnerabilities

Security researchers hackers uncovered almost 350 vulnerabilities inside the Defense Department’s networks during a week-long bug bounty program. Nearly 270 researchers participated in the effort, called “Hack U.S.”, which offered financial rewards for discovering critical- and high-level vulnerabilities in systems operated by the Pentagon.

See the full report here: https://therecord.media/pentagon-bug-bounty-program-turns-up-nearly-350-vulnerabilities/

Fired admin cripples former employer's network using old credentials

A former IT system administrator disrupted the operations of his former employer, a financial company in Hawaii, hoping to get his job back after being laid off. Using his former employer's credentials to access the company's configuration settings, the person made numerous changes, including purposefully misdirecting web and email traffic to computers unaffiliated with the company, thereby incapacitating the company's web presence and email.

See the full report here: https://www.bleepingcomputer.com/news/security/fired-admin-cripples-former-employers-network-using-old-credentials/

New Microsoft Exchange zero-day actively exploited in attacks

Threat actors are reportedly exploiting yet-to-be-disclosed Microsoft Exchange zero-day bugs that allow remote code execution. The attackers are using the zero-days to deploy Chinese Chopper web shells on compromised servers for persistence and data theft, as well as to move laterally to other systems on the victims' networks.

See the full report here: https://www.bleepingcomputer.com/news/security/new-microsoft-exchange-zero-day-actively-exploited-in-attacks/

Matrix: Install security update to fix end-to-end encryption flaws

Matrix decentralized communication platform has published a security warning about two critical-severity vulnerabilities that affect the end-to-end encryption in the software development kit (SDK). A threat actor exploiting these flaws could break the confidentiality of Matrix communications and run man-in-the-middle attacks that expose message contents in a readable form.

See the full report here: https://www.bleepingcomputer.com/news/security/matrix-install-security-update-to-fix-end-to-end-encryption-flaws/

Details Disclosed After Schneider Electric Patches Critical Flaw Allowing PLC Hacking

The flaw in question, tracked as CVE-2021-22779, has been described by the industrial giant as an authentication bypass issue that could allow unauthorized access in read and write mode to a Modicon M580 or M340 controller by spoofing Modbus communications between the controller and the engineering software.

See the full report here: https://www.securityweek.com/details-disclosed-after-schneider-electric-patches-critical-flaw-allowing-plc-hacking

Ransomware gang leaks data stolen from LAUSD school system

LAUSD superintendent Alberto M. Carvalho confirmed the release of stolen data in a statement posted to Twitter, along with announcing a new hotline for concerned parents and students to ask questions about the data leak.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-leaks-data-stolen-from-lausd-school-system/

Russians dodging mobilization behind flourishing scam market

Many Russian men eligible for enlistment have resorted to illegal channels that provide them with fabricated exemptions, while those fleeing the country to neighboring regions turn to use identity masking tools.

See the full report here: https://www.bleepingcomputer.com/news/security/russians-dodging-mobilization-behind-flourishing-scam-market/

Mexican president confirms ‘Guacamaya’ hack targeting regional militaries

Mexican president Andrés Manuel López Obrador confirmed a widely reported cyberattack on Friday that leaked sensitive documents and emails from several militaries across Central and South America.

See the full report here: https://therecord.media/mexican-president-confirms-guacamaya-hack-targeting-regional-militaries/

Microsoft to let Office 365 users report Teams phishing messages

Microsoft is working on updating Microsoft Defender for Office 365 to allow Microsoft Teams users to alert their organization's security team of any dodgy messages they receive.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-to-let-office-365-users-report-teams-phishing-messages/

Lazarus hackers abuse Dell driver bug using new FudModule rootkit

The spear-phishing campaign unfolded in the autumn of 2021, and the confirmed targets include an aerospace expert in the Netherlands and a political journalist in Belgium.

See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-abuse-dell-driver-bug-using-new-fudmodule-rootkit/

CISA: Hackers exploit critical Bitbucket Server flaw in attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has added three more security flaws to its list of bugs exploited in attacks, including a Bitbucket Server RCE and two Microsoft Exchange zero-days.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-hackers-exploit-critical-bitbucket-server-flaw-in-attacks/

Fake US govt job offers push Cobalt Strike in phishing attacks

A new phishing campaign targets US and New Zealand job seekers with malicious documents installing Cobalt Strike beacons for remote access to victims' devices.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-us-govt-job-offers-push-cobalt-strike-in-phishing-attacks/

Optus breach victims will get "supercharged" fraud protection

The Australian Federal Police (AFP) has launched Operation Guardian to ensure that more than 10,000 customers who had their info leaked in the Optus data breach will get priority protection against fraud attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/optus-breach-victims-will-get-supercharged-fraud-protection/

Germany arrests hacker for stealing €4 million via phishing attacks

Germany's Bundeskriminalamt (BKA), the country's federal criminal police, carried out raids on the homes of three individuals suspected of orchestrating large-scale phishing campaigns that defrauded internet users of €4,000,000.

See the full report here: https://www.bleepingcomputer.com/news/security/germany-arrests-hacker-for-stealing-4-million-via-phishing-attacks/

BlackCat malware lashes out at US defense IT contractor

The BlackCat ransomware gang, also known as ALPHV, has allegedly broken into IT firm NJVC, a provider of services to civilian US government agencies and the Department of Defense.

See the full report here: https://www.theregister.com/2022/10/02/in-brief-security/

Local governments most vulnerable to ransomware attacks, experts say

Despite years of warnings, local governments in general have been unwilling, incapable or unable to afford to fully defend themselves against threats that demands extraordinary resources and expertise, experts said.

See the full report here: https://www.newsday.com/news/region-state/ransomware-hackers-local-governments-vulnerable-suffolk-county-uis3x0lo

Electricity Company of Ghana hacked

Some sections of the ECG project site situated near the Kwame Nkrumah Circle in Accra has been infiltrated by ransomware, and the hacker or hackers have changed the source code and taken control of parts of the server.

See the full report here: https://www.ghanabusinessnews.com/2022/10/01/ecg-systems-hacked-with-ransomware-sources/

Russian Citizens Wage Cyberwar From Within

For the first time in known history, hackers from within Russia have begun a systemized effort to hack Russian government affiliated websites.

See the full report here: https://www.kyivpost.com/world/russian-citizens-wage-cyberwar-from-within.html

Former NSA employee charged with offering to sell cyber secrets to foreign gov’ts

A 30-year-old former National Security Agency (NSA) employee was charged in federal court on Thursday with attempting to sell sensitive information related to national cyber operations to a foreign government representative.

See the full report here: https://therecord.media/former-nsa-employee-charged-with-offering-to-sell-cyber-secrets-to-foreign-govts/

Cyberattacks on Taiwan started several days before Pelosi arrival: report

The August cyberattacks targeting the government and infrastructure of Taiwan began days before U.S. House Speaker Nancy Pelosi became the first high-ranking U.S. official in 25 years to visit the country, according to researchers.

See the full report here: https://therecord.media/cyberattacks-on-taiwan-started-several-days-before-pelosi-arrival-report/

Fake CISO Profiles on LinkedIn Target Fortune 500s

Someone has created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations.The fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies.

See the full report here: https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/

iPhone users warned of scam notification telling them their device has been hacked

The suspicious message tells users that their iPhone ‘may be hacked’, and instructs them to download ‘cyber security’ software for protection. But it’s thought that clicking anywhere on the screen will enable hackers to access all of your private data, from photos to text messages.

See the full report here: https://www.chroniclelive.co.uk/news/uk-news/iphone-hacked-scam-notification-warning-25167109

Pegasus spyware used against anti-corruption journalists in Mexico, despite government promises

Pegasus spyware was used in Mexico after the president expressly said that the government no longer used the malware. It was used to capture data from the phones of two journalists specialising in reporting on government corruption, as well as a prominent human rights defender

See the full report here: https://9to5mac.com/2022/10/03/pegasus-spyware-used/

Web browser app mode can be abused to make desktop phishing pages

The Application Mode feature is available in all Chromium-based browsers, including Google Chrome, Microsoft Edge and the Brave Browser. It can generate realistic-looking login screens that are hard to differentiate from a legitimate login prompt.

See the full report here: https://www.bleepingcomputer.com/news/security/web-browser-app-mode-can-be-abused-to-make-desktop-phishing-pages/

Cyber Attack Triggers Multiple Sections of Cyber Security Insurance

Getting cyber insurance right is a complex decision. Knowing the ripple effects the attack can have on everything from sensitive customer data to business continuity is important in determining how to make that choice.

See the full report here: https://www.jdsupra.com/legalnews/how-a-cyber-attack-triggers-multiple-8621658/

Lazarus Group Exploits Dell Driver Vulnerability to Bypass Windows Security

The North Korea–backed threat actor known as Lazarus Group has been observed deploying a Windows rootkit by exploiting a Dell firmware driver. The campaign, which shows the hacker group’s ever–evolving techniques, was spotted by ESET security researchers in the autumn of 2021.

See the full report here: https://www.infosecurity-magazine.com/news/lazarus-group-exploit-dell-driver/

New Adware Apps Reach 13 Million Downloads

Security researchers have discovered almost 100 malicious apps on both the Google Play Store and Apple’s App Store. The apps, which have been downloaded 13 million times, contain adware and are known to be involved in the Scylla ad-fraud campaign.

See the full report here: https://news.trendmicro.com/2022/10/03/adware-apps-downloads-android-ios/

Researchers point out links between SEO poisoning and malware infections

The malware chain begins by an attacker generating loads of fake web content that are intended to “borrow” or piggyback on the reputation of a legitimate website. The fakes contain the malware and manage to get search results to appear higher on internet search engines by using pairs of attackers.

See the full report here: https://securityboulevard.com/2022/10/seo-poisoning-beware-of-suspicious-links-to-avoid-malware-infections/

Live support service hacked to spread malware in supply chain attack

The official installer for the Comm100 Live Chat application, a widely deployed SaaS (software-as-a-service) that businesses use for customer communication and website visitors, was trojanized as part of a new supply-chain attack.

See the full report here: https://www.bleepingcomputer.com/news/security/live-support-service-hacked-to-spread-malware-in-supply-chain-attack/

Bumblebee Malware Loader's Payloads Significantly Vary by Victim System

A new analysis of Bumblebee, a particularly pernicious malware loader that first surfaced this March, shows that its payload for systems that are part of an enterprise network is very different from its payload for standalone systems.

See the full report here: https://www.darkreading.com/attacks-breaches/bumblebee-malware-loader-s-payloads-significantly-vary-by-victim-system

Researchers Link Cheerscrypt Linux-Based Ransomware to Chinese Hackers

The recently discovered Linux-Based ransomware strain known as Cheerscrypt has been attributed to a Chinese cyber espionage group known for operating short-lived ransomware schemes.

See the full report here: https://thehackernews.com/2022/10/researchers-link-cheerscrypt-linux.html

Ferrari says internal documents online, but no evidence of cyber attack

Ferrari said some internal documents had been posted online and the luxury sports carmaker was working to identify how this had happened. Ferrari added it had no evidence of a breach of its systems or ransomware, and said there had been no disruption to its business and operations.

See the full report here: https://www.reuters.com/technology/ferrari-says-no-evidence-system-breach-ransomware-2022-10-03/

Australia's Telstra hit by data breach, two weeks after attack on Optus

Australia's largest telecoms firm Telstra Corp said it had suffered what it called a small data breach, a disclosure that comes two weeks after its main rival Optus was left reeling by a massive cyberattack.

See the full report here: https://www.reuters.com/technology/australias-telstra-hit-by-data-breach-two-weeks-after-attack-optus-2022-10-04/

TD Bank Confirms Data Breach After Former Employee Leaks Customer Info

Since TD is one of the largest banks in the United States by deposits, this could be a huge security breach for a lot of customers. The bank has yet to disclose how many customers were affected by this incident.

See the full report here: https://www.itechpost.com/articles/114156/20221003/td-bank-confirms-data-breach-former-employee-leaks-customer-info.htm

Irish Regulator Submits Draft Decision in Facebook Data Breach

Taking the next step in its inquiry into a data breach of Meta’s Facebook platform, the Irish Data Protection Commission (DPC) has submitted a draft decision to other concerned supervisory authorities across the European Union (EU).

See the full report here: https://www.pymnts.com/meta/2022/irish-regulator-submits-draft-decision-in-facebook-data-breach/

Microsoft Exchange server zero-day mitigation can be bypassed

Microsoft has shared mitigations for two Microsoft Exchange zero-day vulnerabilities: CVE-2022-41040 and CVE-2022-41082. Threat actors are using these zero-day bugs in active attacks to breach Microsoft Exchange servers and achieve remote code execution.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-server-zero-day-mitigation-can-be-bypassed/

US Govt: Hackers stole data from US defense org using new malware

The U.S. Government today released an alert about state-backed hackers using a custom CovalentStealer malware and the Impacket framework to steal sensitive data from a U.S. organization in the Defense Industrial Base (DIB) sector.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-hackers-stole-data-from-us-defense-org-using-new-malware/

Netwalker ransomware affiliate sentenced to 20 years in prison

A former Netwalker ransomware affiliate has been sentenced to 20 years in prison and demanded to forfeit USD 21.5 million for his attacks on several entities. Netwalker was a Ransomware-as-a-Service (RaaS) operation launched in 2019, recruiting affiliates to deploy the ransomware in return for a 60-75% share of all ransom payments.

See the full report here: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-affiliate-sentenced-to-20-years-in-prison/

Hackers are breaching scam sites to hijack crypto transactions

A threat actor named Water Labbu is hacking into cryptocurrency scam sites to inject malicious JavaScript that steals funds from the scammer's victims. Water Labbu has compromised at least 45 scam websites, most following the “lossless mining liquidity pledge” theme.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-are-breaching-scam-sites-to-hijack-crypto-transactions/

Optus confirms 2.1 million ID numbers exposed in data breach

Optus has confirmed that 2.1 million customers had government identification numbers compromised during a cyberattack last month. Of this, 1.2 million had at least one number from a current and valid form of identification compromised, and 900,000 had ID numbers exposed but from documents that are now expired.

See the full report here: https://www.bleepingcomputer.com/news/security/optus-confirms-21-million-id-numbers-exposed-in-data-breach/

FBI warns of "Pig Butchering" cryptocurrency investment schemes

Pig Butchering cryptocurrency scams are being used to steal ever-increasing amounts of crypto from unsuspecting investors. Pig Butchering is a relatively new social engineering scam where fraudsters contact people (the "Pigs") on social media and build trust by engaging in long-term communication, establishing the idea of a fabricated friendship or romantic partnership.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-pig-butchering-cryptocurrency-investment-schemes/

Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub

Scammers are impersonating security researchers to sell fake proof-of-concept ProxyNotShell exploits for newly discovered Microsoft Exchange zero-day vulnerabilities. Actual security researchers are keeping the technical details of the vulnerabilities private, and it appears only a small number of threat actors are exploiting them.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-microsoft-exchange-proxynotshell-exploits-for-sale-on-github/

Russian retail chain DNS confirms hack after data leaked online

Russian retail chain DNS (Digital Network System) suffered a data breach that exposed the personal information of customers and employees. DNS's disclosure came hours after a threat actor began leaking the company's data on a hacking forum, allegedly stolen by a hacking group known as NLB Team.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-retail-chain-dns-confirms-hack-after-data-leaked-online/

Researchers Report Supply Chain Vulnerability in Packagist PHP Repository

Researchers have disclosed details about a now-patched high-severity security flaw (CVE-2022-24828; CVSS score: 8.8) in Packagist, a PHP software package repository, that could have been exploited to mount software supply chain attacks. Fixes have been deployed in Composer versions 1.10.26, 2.2.12, and 2.3.5.

See the full report here: https://thehackernews.com/2022/10/researchers-report-supply-chain.html

Russian Hacker Arrested in India for Reportedly Helping Students Cheat in JEE-Main Exam

The incident involved breaking into iLeon software, the platform on which the exam was held, with the goal of granting remote access to a specific set of co-conspirators, who then solved the questions on the students' behalf.

See the full report here: https://thehackernews.com/2022/10/russian-hacker-arrested-in-india-for.html

Popular YouTube Channel Caught Distributing Malicious Tor Browser Installer

A popular Chinese-language YouTube channel has emerged as a means to distribute a trojanized version of a Windows installer for the Tor Browser. The malicious version of the Tor Browser installer is being distributed via a link present in the description of a video that was uploaded to YouTube on January 9, 2022. It has been viewed over 64,500 times to date.

See the full report here: https://thehackernews.com/2022/10/popular-youtube-channel-caught.html

Hundreds of Microsoft SQL servers backdoored with new malware

Security researchers have found a new piece of malware targeting Microsoft SQL servers. Named Maggie, the backdoor has already infected hundreds of machines all over the world.

See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-microsoft-sql-servers-backdoored-with-new-malware/

New "RatMilad" Android Malware Can Steal Data and Spy on Victims

RatMilad is a kind of spyware, which are malware programs used to spy on victims through their devices. RatMilad is capable of recording both video and audio, giving the attackers the ability to listen in on private conversations and conduct remote surveillance.

See the full report here: https://www.makeuseof.com/ratmilad-android-malware-spying-stealing-data/

Novel advanced malware leveraged in reemerging Prilex attacks

Brazilian threat actor Prilex has reemerged in new attacks leveraging an advanced point-of-sale malware instead of ATM-focused malware prior to its year-long hiatus.

See the full report here: https://www.scmagazine.com/brief/threat-intelligence/novel-advanced-malware-leveraged-in-reemerging-prilex-attacks

Parasitic malware tricks crypto scammers into doing the hard work for them

Water Labbu had been targeting problematic cryptocurrency scam websites, piggybacking off the social engineering tactics many crypto scammers use, such as convincing people to hand over passwords, etc, in order to turn the tables on would-be scammers.

See the full report here: https://www.pcgamer.com/trend-micro-crypto-scam-water-labbu/

Grain Valley Schools District investigating recent malware attack

The Grain Valley School District, USA, notified parents it has been the victim of an apparent malware attack. In the notification to parents, the district said an investigation is underway after the district's IT systems reported technical difficulties.

See the full report here: https://www.kshb.com/news/local-news/grain-valley-schools-district-investigating-recent-cyber-attack

Decryptor for some Hades ransomware variants released

Researchers have discovered a vulnerability in the encryption schema of the ransomware, which allows some of the variants to be decrypted without paying the ransom. The Hades ransomware strain affected by the flaw did not exfiltrate any data from the victims.

See the full report here: https://securityaffairs.co/wordpress/136710/malware/hades-ransomware-decryptor.html

NullMixer Dropper Delivers a Multimalware Code Bomb

It is only after a user clicks a malicious link, downloads the malware, and then launches it that NullMixer is deployed. But once the dropper infects a victim's system, it deploys a whole bunch of malware, from spyware to Trojans.

See the full report here: https://www.darkreading.com/remote-workforce/nullmixer-multi-malware-dropper-code-bomb

Microsoft updates mitigation for ProxyNotShell Exchange zero days

Microsoft has updated the mitigations for the latest Exchange zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also referred to as ProxyNotShell.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-updates-mitigation-for-proxynotshell-exchange-zero-days/

City of Tucson discloses data breach affecting over 125,000 people

The City of Tucson, Arizona, has disclosed a data breach affecting the personal information of more than 125,000 individuals. The City began notifying potentially impacted individuals on September 23 that, among the sensitive personal information exposed during the incident, the attacker could have accessed the affected individuals' names and Social Security numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/city-of-tucson-discloses-data-breach-affecting-over-125-000-people/

Chase UK's app-only bank hit with 24-hour ongoing outage

Chase UK's customers with a mobile-based current account have been experiencing an ongoing outage and degraded performance with the bank's app, making it difficult for them to access their accounts and funds.

See the full report here: https://www.bleepingcomputer.com/news/technology/chase-uks-app-only-bank-hit-with-24-hour-ongoing-outage/

FBI: Cyberattacks targeting election systems unlikely to affect results

The FBI and CISA disclosed that cyber activity attempting to compromise election infrastructure is unlikely to cause a massive disruption or prevent voting. Any attempts tracked by FBI and CISA reportedly remained localized and were blocked or successfully mitigated with minimal or no disruption to election processes.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-cyberattacks-targeting-election-systems-unlikely-to-affect-results/

Data of 5000 Australian employees of security firm G4S leaked after ransomware attack

About 5,000 Australian staff of global security firm G4S have been affected by a data leak following a ransomware attack on a work site in July 2022. The data that was stolen reportedly included employee names, addresses, dates of birth, contact details, police and medical checks, tax file numbers, bank account details, superannuation information, Medicare numbers, and licence details.

See the full report here: https://itwire.com/business-it-news/security/data-of-5000-australian-employees-of-security-firm-g4s-leaked-after-ransomware-attack.html

CommonSpirit cyberattack spurs IT outages at CHI Memorial, hospitals across US

A cyberattack deployed against CommonSpirit has led to IT outages at hospitals across the United States. CommonSpirit operates more than 700 care sites and 142 hospitals in 21 states.

See the full report here: https://www.scmagazine.com/analysis/ransomware/commonspirit-cyberattack-spurs-it-outages-at-chi-memorial-hospitals-across-us

Douglas County’s 911 impacted by ransomware cryptovirus

Douglas County Officials reported that their 911 system was impacted by a ransomware attack. Instead of using the computer system, 911 staff had to go old school writing down information on cards and then handing the information to dispatchers.

See the full report here: https://rivercountry.newschannelnebraska.com/story/47422625/douglas-countys-911-impacted-by-ransomware-cryptovirus

Cyberattack takes down Colorado’s homepage

Colorado state government’s homepage was taken down due to a cyberattack by an anonymous agent. A temporary landing page, with links to unaffected government services, was put in its place.

See the full report here: https://www.fortmorgantimes.com/2022/10/05/colorado-wesbite-down-ransomware-cyberattack/

BlackByte ransomware abuses legit driver to disable security products

The BlackByte ransomware gang is using a new technique that researchers are calling "Bring Your Own Driver," which enables bypassing protections by disabling more than 1,000 drivers used by various security solutions.

See the full report here: https://www.bleepingcomputer.com/news/security/blackbyte-ransomware-abuses-legit-driver-to-disable-security-products/