zerofox logo
Advisories

Threat Intelligence Bulletin: 10/07/2022 - 10/13/2022

|by Alpha Team

banner image

U.S. Midterm Election Series: Voting Machine Security

Product Serial: B-2022-10-10a

TLP:CLEAR

In this brief, ZeroFox Intelligence explores voting technologies in the U.S. and recommendations for securing them.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on October 6, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The integrity of votes cast in U.S. elections has come under increased scrutiny in recent years, with partisans of both major political parties calling the outcomes of high-visibility races into question over allegedly-flawed processes. While investigations to date have not yielded evidence of malicious actors decisively altering voter registration records or voting results, vulnerable practices and technology have been identified in a number of voting systems. Most identified vulnerabilities can be addressed, if not prevented, through a combination of physical and digital access controls, timely software patching, and consistent “air-gapping” of systems. The security practices of individual states administering election systems are not always evident, however, indicating some vulnerability in the U.S. electoral process as a whole.

Election systems have numerous sensitive components, including voter registration databases, electronic polling books, voting machines, and ballot scanners. The scope of this report is limited to voting equipment used at polling locations and ballot-counting facilities. The risk under consideration is the likelihood of a malicious actor tampering with the equipment, software, or physical ballots used to cast and record votes so that vote tallies do not correspond with the voters’ selections.

Microsoft Patch Tuesday 10/12/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for October 2022 contained 84 vulnerabilities in total, with:

  • 1 vulnerability rated as Critical
  • 63 vulnerabilities rated as High
  • 2 zero-day vulnerabilities, one of which is actively exploited

This month’s security updates do not contain fixes for two zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082) – widely known as ProxyNotShell – which affect Microsoft's Exchange Servers. Microsoft stated that it will release updates for these two bugs when they are ready.

Most notable vulnerabilities

Microsoft has listed two zero-day vulnerabilities (CVE-2022-41033 – a Windows COM+ Event System Service elevation of privilege vulnerability and CVE-2022-41043 – a Microsoft Office information disclosure vulnerability) among the bugs fixed in the October Patch Tuesday security update. The former is being actively exploited in the wild.

CVE-2022-41033

CVE-2022-41033 (CVSS score: 7.8) is a Windows COM+ Event System Service elevation of privilege vulnerability. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, because of a flaw in the COM+ Event System Service. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

  • Microsoft Windows 7 SP1 x32
  • Microsoft Windows 7 SP1 x64
  • Microsoft Windows Server 2012
  • Microsoft Windows 8.1 x32
  • Microsoft Windows 8.1 x64
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows RT 8.1
  • Microsoft Windows 10 x32
  • Microsoft Windows 10 x64
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows 10 1809 for x64-based Systems
  • Microsoft Windows 10 1809 for 32-bit Systems
  • Microsoft Windows 10 1809 for ARM64-based Systems
  • Microsoft Windows 10 1607 for 32-bit Systems
  • Microsoft Windows 10 1607 for x64-based Systems
  • Microsoft Windows 10 20H2 for 32-bit Systems
  • Microsoft Windows 10 20H2 for ARM64-based Systems
  • Microsoft Windows 10 20H2 for x64-based Systems
  • Microsoft Windows Server (Server Core installation) 2019
  • Microsoft Windows Server (Server Core installation) 2016
  • Microsoft Windows Server (Server Core installation) 2012 R2
  • Microsoft Windows Server (Server Core installation) 2012
  • Microsoft Windows Server for X64-based systems 2008 R2 SP1
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
  • Microsoft Windows Server for 32-bit systems 2008 SP2
  • Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
  • Microsoft Windows 10 21H1 for 32-bit Systems
  • Microsoft Windows 10 21H1 for ARM64-based Systems
  • Microsoft Windows 10 21H1 for x64-based Systems
  • Microsoft Windows Server 2022
  • Microsoft Windows Server (Server Core installation) 2022
  • Microsoft Windows Server for X64-based systems 2008 SP2
  • Microsoft Windows 11 x64
  • Microsoft Windows 11 ARM64
  • Microsoft Windows 10 21H2 for 32-bit Systems
  • Microsoft Windows 10 21H2 for ARM64-based Systems
  • Microsoft Windows 10 21H2 for x64-based Systems
  • Microsoft Windows 11 22H2 for ARM64-based Systems
  • Microsoft Windows 11 22H2 for x64-based Systems

CVE-2022-41043

CVE-2022-41043 (CVSS score: 3.3) is a Microsoft Office information disclosure vulnerability. Microsoft Office could allow a local authenticated attacker to obtain sensitive information. By executing a specially crafted program, an attacker could exploit this vulnerability to obtain sensitive information, and then use this information to launch further attacks against the affected system.

The following products are affected:

  • Microsoft Office 2019 Mac
  • Microsoft Office LTSC for Mac 2021

CVE-2022-37968

CVE-2022-37968 (CVSS score: 10) is an Azure Arc-enabled Kubernetes cluster Connect elevation of privilege vulnerability. Microsoft Azure Arc-enabled Kubernetes cluster Connect could allow a remote attacker to gain elevated privileges on the system, because of this bug. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system and potentially gain control over the Kubernetes cluster. Microsoft has stated that to exploit this vulnerability, an attacker would need to know the randomly generated DNS endpoint for an Azure Arc-enabled Kubernetes cluster.

The following product is affected:

  • Microsoft Azure Arc Connected Clusters

Users should apply the latest security patches specified in Microsoft's October Patch Tuesday update and follow the recommended mitigations and workarounds to protect themselves from these and other vulnerabilities.

Threats From Retail Store-Based Intrusions

Product Serial: B-2022-10-12a

TLP:CLEAR

In this brief, ZeroFox Intelligence discusses various types of threats targeting retail stores, gives real world examples, and offers some recommendations to protect against these threats.

Standing Intelligence Requirements

MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on September 27, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

External cyber intrusion targeting retail organizations poses a real and ongoing threat. However, threat actors entering physical locations of retail stores to conduct cyber intrusions also poses a very real and present danger. Threat actors are able to gain initial access to and attack companies after having a physical presence on site by way of card skimmers, unsecured Point-of-Sale (PoS) systems, unsecured or public Wi-Fi networks, USB drives and other physical hacking equipment, vulnerable Internet of Things (IoT) devices, social engineering, and insider threats. Retailers have had their customer data stolen, their networks degraded, and their infrastructure compromised via these threat vectors.

Breach Disclosure: Gentle Township

On September 4, 2022, a threat actor "donjuji" from BreachForums posted a data breach package targeting Gentle Township, a China-based online dating platform. From this package, ZeroFox extracted 524,472 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On September 4, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting Gentle Township, an online dating and personal services website operating from China. The threat actor noted that the data package includes information relating to 550,000 users. From this package, ZeroFox extracted 524,472 email addresses, usernames, and hashed passwords. Other notable data fields observed in this package include registered IP, registration date, last login IP, and last login time.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: BidenCash

On October 10, 2022, the ZeroFox Dark Ops team acquired a data breach package comprising 1.2 million records from a dark web carding marketplace named “BidenCash.” The package contained information on the card holders as well as credit card details.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On October 10, 2022, the ZeroFox Dark Ops team acquired a data breach package purportedly comprising 1.2 million records from a dark web carding marketplace named "BidenCash." On October 7, 2022, the same dump was distributed on the Russian language deep web forum "XSS." ZeroFox Dark Ops published a similar data package named "BidenCash_7.9m" in June 2022, posted by threat actor BidenCash. By comparing the data with the latest dump, we found 20,866 unique email addresses out of 967,634. In the current dump, there were email addresses with no passwords, credit card details (like number, CVV, and expiry date) and card holder personal details (like name, phone number, and address).

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-10-07 - 2022-10-13

Ransomware gang claims responsibility for attack on defence contractor

The AlphV/BlackCat ransomware gang has revealed that it had staged a malware attack on a Canadian defense contractor, Simex Defence. The company did not say if any documents were copied in the cyberattack but gave assurances that any ransomware affecting their systems is all gone.

See the full report here: https://www.insurancebusinessmag.com/ca/news/cyber/ransomware-gang-claims-responsibility-for-attack-on-defence-contractor-423062.aspx

Backdoored version of popular network admin tool hits 80 organizations around the globe

A false version of a popular tool used by network administrators to manage local area networks provides an attacker with backdoor access and has impacted at least 80 organizations around the world. The malware was hosted on two sites, whose domains are almost identical to the legitimate Advanced IP Scanner website, differing only by one the letter.

See the full report here: https://www.scmagazine.com/analysis/network-security/backdoored-version-of-popular-network-admin-tool-hits-80-organizations-around-the-globe

Ro says it inadvertently exposed employees’ personal information

Healthcare unicorn Ro is notifying employees of a data exposure involving their personal information after a security contractor inadvertently uploaded a spreadsheet of employee data to the internet.

See the full report here: https://techcrunch.com/2022/10/06/ro-healthcare-unicorn-data-exposed/

Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims

An advanced persistent threat (APT) group called Mustang Panda that is leveraging the PlugX malware family to target the Southeast Asian state of Myanmar. Mustang Panda (aka HoneyMyte, Bronze President or Red Delta) is a prolific APT group that has been publicly attributed as being based in China.

See the full report here: https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims

Eternity Group Hackers Offering New LilithBot Malware as a Service to Cybercriminals

The threat actor behind the malware-as-a-service (MaaS) called Eternity has been linked to new piece of malware called LilithBot. It has advanced capabilities to be used as a miner, stealer, and a clipper along with its persistence mechanisms.

See the full report here: https://thehackernews.com/2022/10/eternity-group-hackers-offering-new.html

Australia unveils privacy rule changes after Optus data breach

Australia proposed an overhaul of consumer privacy rules that will help facilitate targeted data sharing between telecommunication firms and banks, following a massive data breach at Optus, the country's second largest mobile operator. The changes will enable telcos to share government-issued identification documents with banks to allow them to implement enhanced monitoring for customers impacted by data breaches.

See the full report here: https://www.thehindu.com/sci-tech/technology/sydney-australia-unveils-privacy-rule-changes-optus-data-breach-cybersecurity-hack-telecommunications-singapore/article65974704.ece

CareOregon issues notice of data breach

CareOregon recently discovered an incident involving disclosure of personal information for a subset of current members. 8,022 current members were impacted by this data breach—including 5,589 CareOregon members, 1,849 Jackson Care Connect members, and 584 Columbia Pacific CCO members.

See the full report here: https://www.globenewswire.com/news-release/2022/10/06/2529869/0/en/CareOregon-notice-of-data-breach.html

BD discloses cybersecurity vulnerability in cervical cytology processing machine

Becton Dickinson has disclosed a cybersecurity vulnerability that could allow an attacker to access and modify information on an instrument used to process cervical cytology samples. The vulnerability affects laboratory automation instrument Totalys MultiProcessor. Because the instrument uses hard-coded credentials, an attacker with physical or network access could see protected and personal information, the company said.

See the full report here: https://www.medtechdive.com/news/bd-cybersecurity-vulnerability-cervical-cytology/633478/

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

See the full report here: https://www.cisa.gov/uscert/ncas/current-activity/2022/10/06/cisco-releases-security-updates-multiple-products

CISA issues fresh orders to polish security vulnerability detection in federal agencies

CISA has issued Binding Operational Directive (BOD) 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, which seeks improve asset visibility and vulnerability enumeration across the federal enterprise.

See the full report here: https://www.itpro.co.uk/security/369252/cisa-issues-orders-to-polish-vulnerability-detection-in-federal-agencies

Lloyd’s of London hit by possible cyberattack

Lloyd’s of London is investigating a potential cyberattack on its network. The insurance market says it has detected “unusual activity” on its systems, and has turned off all external connectivity.

See the full report here: https://techmonitor.ai/technology/lloyds-cyberattack-insurance

US govt shares top flaws exploited by Chinese hackers since 2020

The NSA, CISA, and FBI have disclosed the top security vulnerabilities most exploited by hackers backed by the People's Republic of China (PRC) to target government and critical infrastructure networks. The advisory also bundles recommended mitigations for each of the security flaws, as well as detection methods and vulnerable technologies to help defenders spot and block incoming attack attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-shares-top-flaws-exploited-by-chinese-hackers-since-2020/

Hacker steals $566 million worth of crypto from Binance Bridge

Hackers have reportedly stolen 2 million Binance Coins (BNB), worth $566 million, from the Binance Bridge and have spread some of the funds across a variety of liquidity pools, attempting to transfer the BNB into other assets. While the majority of the stolen funds remain on the BNB Smart Chain, and are now inaccessible to the hacker, Binance estimates that between $70M - $80M were taken off-chain.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-steals-566-million-worth-of-crypto-from-binance-bridge/

FBI warns of disinformation threats before 2022 midterm elections

The Federal Bureau of Investigation (FBI) warned Americans that foreign actors are actively spreading election infrastructure disinformation to manipulate public opinion, discredit the electoral process, sow discord, and encourage a lack of trust in democratic processes and institutions.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-disinformation-threats-before-2022-midterm-elections/

Linux Kernel 5.19.12 bug could damage Intel laptop displays

Linux users have reported seeing weird white flashes and rapid blinking on their Intel laptop displays after upgrading to Linux kernel version 5.19.12, leading to warnings that the bug may damage displays. It has been recommended to revert the Linux Kernel to an older version to avoid causing hardware damage on people's machines and no one using laptops with Intel GPUs should run 5.19.2.

See the full report here: https://www.bleepingcomputer.com/news/linux/linux-kernel-51912-bug-could-damage-intel-laptop-displays/

Meta sues app dev for stealing over 1 million WhatsApp accounts

Meta has sued several Chinese companies (HeyMods, Highlight Mobi, and HeyWhatsApp) for developing and allegedly using unofficial WhatsApp Android apps to steal over one million WhatsApp accounts. The apps used bundled malware to harvest sensitive info, including account authentication, to hijack their WhatsApp accounts to send spam messages.

See the full report here: https://www.bleepingcomputer.com/news/security/meta-sues-app-dev-for-stealing-over-1-million-whatsapp-accounts/

Police arrest teen for using leaked Optus data to extort victims

The Australian Federal Police (AFP) have arrested a 19-year old in Sydney for allegedly using leaked Optus customer data for extortion. The suspect used 10,200 records leaked by the Optus hackers and contacted victims over SMS to threaten that their data would be sold to other hackers unless they paid AUD 2,000 ($1,300) within two days.

See the full report here: https://www.bleepingcomputer.com/news/security/police-arrest-teen-for-using-leaked-optus-data-to-extort-victims/

Details Released for Recently Patched new macOS Archive Utility Vulnerability

Security researchers have shared details about a now-addressed security flaw (CVE-2022-32910) in Apple's macOS operating system that could be potentially exploited to run malicious applications in a manner that can bypass Apple's security measures. Apple described the bug as a logic issue that could allow an archive file to get around Gatekeeper checks, which is designed so as to ensure that only trusted software runs on the operating system.

See the full report here: https://thehackernews.com/2022/10/details-released-for-recently-patched.html

Blizzard’s Overwatch 2 faces cyber attack

The gaming major confirmed that a distributed denial-of-service attack (DDoS) has hit one of the biggest games of the year, which is the follow-up to 2016’s multiplayer shooter. Players who were able to access the servers experienced difficulties, such as being kicked from matches and other types of launch-day instability.

See the full report here: https://infotechlead.com/security/blizzards-overwatch-2-faces-cyber-attack-74862

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials

Meta has identified over 400 malicious apps on Android and iOS that reportedly targeted online users with the goal of stealing their Facebook login information. It is essential to exercise caution before downloading apps and granting access to Facebook to access the promised functionality.

See the full report here: https://thehackernews.com/2022/10/facebook-detects-400-android-and-ios.html

LofyGang hackers built a credential-stealing enterprise on Discord, NPM

The LofyGang threat actors have created a credential-stealing enterprise by distributing 200 malicious packages and fake hacking tools on code hosting platforms. Many of the malicious packages have been reported and removed, while others are still available for download.

See the full report here: https://www.bleepingcomputer.com/news/security/lofygang-hackers-built-a-credential-stealing-enterprise-on-discord-npm/

Hackers exploiting unpatched RCE bug in Zimbra Collaboration Suite

Hackers are actively exploiting an unpatched remote code execution (RCE) vulnerability (CVE-2022-41352, CVSS v3 score: 9.8) in Zimbra Collaboration Suite (ZCS). Zimbra released a security advisory on September 14 to warn system administrators to install Pax, a portable archiving utility, and restart their Zimbra servers to replace cpio, which is the vulnerable component.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploiting-unpatched-rce-bug-in-zimbra-collaboration-suite/

2K Games warns users their stolen data is now up for sale online

Video game publisher 2K warned users that some of their personal info was stolen and put up for sale online following a September 19 security breach. The breached data may include name, email address, helpdesk identification number, gamertag ,and console details. There is no indication that financial information or password(s) held on 2K systems were compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/2k-games-warns-users-their-stolen-data-is-now-up-for-sale-online/

ADATA denies RansomHouse cyberattack, says leaked data from 2021 breach

Taiwanese chip maker ADATA denies claims of a RansomHouse cyberattack after the threat actors began posting stolen files on their data leak site. The RansomHouse gang added ADATA files to their data leak site, claiming they stole 1TB worth of documents in a 2022 cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/adata-denies-ransomhouse-cyberattack-says-leaked-data-from-2021-breach/

Darkweb market BidenCash gives away 1.2 million credit cards for free

Dark web carding market BidenCash has released a massive dump of 1,221,551 credit cards to promote the marketplace, allowing anyone to download them for free to conduct financial fraud. To ensure larger reach, the threat actors distributed the collection via a clearnet domain and on other hacking and carding forums.

See the full report here: https://www.bleepingcomputer.com/news/security/darkweb-market-bidencash-gives-away-12-million-credit-cards-for-free/

Solana Phantom security update NFTs push password-stealing malware

Hackers are airdropping NFTs to Solana cryptocurrency owners pretending to be alerts for a new Phantom security update ¬¬– leading to the installation of password-stealing malware and the theft of cryptocurrency wallets. Victims who installed the fake Phantom security update should immediately scan their computer with an antivirus program and then transfer crypto funds and assets from their existing Phantom wallet to a new one.

See the full report here: https://www.bleepingcomputer.com/news/security/solana-phantom-security-update-nfts-push-password-stealing-malware/

Intel confirms leaked Alder Lake BIOS Source Code is authentic

Intel has confirmed that a source code leak for the UEFI BIOS of Alder Lake CPUs is authentic. Alder Lake is the name of Intel's 12th generation Intel Core processors, released in November 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-confirms-leaked-alder-lake-bios-source-code-is-authentic/

Callback phishing attacks evolve their social engineering tactics

Callback phishing operations are using the old fake subscriptions lure for the first phase of the attack but switching to pretending to help victims deal with an infection or hack. After a while, a different scammer calls the victim to help them with the infection and directs them to a website where they download malware masqueraded as anti-virus software.

See the full report here: https://www.bleepingcomputer.com/news/security/callback-phishing-attacks-evolve-their-social-engineering-tactics/

Fortinet warns admins to patch critical auth bypass bug immediately

Fortinet has warned administrators to update FortiGate firewalls and FortiProxy web proxies to the latest versions, which address a critical severity vulnerability. The security flaw (CVE-2022-40684) is an authentication bypass on the administrative interface that could allow remote threat actors to log into unpatched devices.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-warns-admins-to-patch-critical-auth-bypass-bug-immediately/

Fake adult sites push data wipers disguised as ransomware

Malicious adult websites are deploying fake ransomware which, in reality, acts as a wiper that quietly tries to delete almost all of the data on your device. The websites would automatically prompt users to download an executable named SexyPhotos.JPG.exe that impersonates a JPG image.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-adult-sites-push-data-wipers-disguised-as-ransomware/

Researchers Detail Malicious Tools Used by Cyberespionage Group Earth Aughisky

The advanced persistent threat (APT) group Earth Aughisky, also known as Taidoor, has continued to make adjustments in the tools and malware deployments on specific targets located in Taiwan and, more recently, Japan. The most commonly targeted industry verticals include government, telcom, manufacturing, heavy, technology, transportation, and healthcare.

See the full report here: https://thehackernews.com/2022/10/researchers-detail-malicious-tools-used.html

New Report Uncovers Emotet's Delivery and Evasion Techniques Used in Recent Attacks

Threat actors associated with the notorious Emotet malware are continually shifting their tactics and command-and-control (C2) infrastructure to escape detection. Some of these infection lifecycles related to the attackers were notable for the abuse of a legitimate executable called mshta.exe to launch a malicious HTA file and then drop the Emotet malware.

See the full report here: https://thehackernews.com/2022/10/new-report-uncovers-emotets-delivery.html

U.S. airports' sites taken down in DDoS attacks by pro-Russian hackers

The pro-Russian hacktivist group KillNet has claimed responsibility for distributed denial-of-service (DDoS) attacks against websites of several major airports in the United States, making them inaccessible. These DDoS attacks do not impact flights.

See the full report here: https://www.bleepingcomputer.com/news/security/us-airports-sites-taken-down-in-ddos-attacks-by-pro-russian-hackers/

Caffeine service lets anyone launch Microsoft 365 phishing attacks

A phishing-as-a-service (PhaaS) platform named Caffeine makes it easy for threat actors to launch attacks, featuring an open registration process allowing anyone to jump in and start their own phishing campaigns. The phishing templates target Russian and Chinese platforms, unlike most PhaaS platforms that end to focus on lures for Western services.

See the full report here: https://www.bleepingcomputer.com/news/security/caffeine-service-lets-anyone-launch-microsoft-365-phishing-attacks/

Hackers behind IcedID malware attacks diversify delivery tactics

The threat actors behind IcedID malware phishing campaigns are utilizing a wide variety of distribution methods / infection pathways, likely to determine what works best against different targets. The IcedID malware started in 2017 as a modular banking trojan but has since evolved into a malware dropper that is commonly used to gain initial access to corporate networks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-behind-icedid-malware-attacks-diversify-delivery-tactics/

Toyota discloses data leak after access key exposed on GitHub

Toyota Motor Corporation is warning that customers' personal information may have been exposed after an access key was publicly available on GitHub for almost five years. It was possible for an unauthorized third party to access the details of 296,019 customers between December 2017 and September 15, 2022, when access to the GitHub repository was restricted.

See the full report here: https://www.bleepingcomputer.com/news/security/toyota-discloses-data-leak-after-access-key-exposed-on-github/

Fortinet says critical auth bypass bug is exploited in attacks

Fortinet has confirmed that a critical authentication bypass security vulnerability (CVE-2022-40684) patched last week is being exploited in the wild. Fortinet asked customers to update vulnerable devices to FortiOS 7.0.7 or 7.2.2 and above, FortiProxy 7.0.7 or 7.2.1 and above, and FortiSwitchManager 7.2.1 or above to defend their devices from attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-says-critical-auth-bypass-bug-is-exploited-in-attacks/

Singtel confirms digital burglary at Dialog subsidiary

Singtel has confirmed that an Australian business it owns, consulting unit Dialog, has fallen victim to a cyber burglary, weeks after the data leak at telco Optus was revealed. Singtel stated that intruders may have accessed company data potentially affecting fewer than 20 clients and 1,000 current Dialog employees as well as former employees.

See the full report here: https://www.theregister.com/2022/10/10/singtel_dialog_breach/

Researchers Detail Critical RCE Flaw Reported in Popular vm2 JavaScript Sandbox

A now-patched security flaw (dubbed “Sandbreak”) in the vm2 JavaScript sandbox module could be abused by a remote adversary to break out of security barriers and perform arbitrary operations on the underlying machine. The bug, CVE-2022-36067, carries a maximum severity rating of 10 on the CVSS vulnerability scoring system and has been addressed in version 3.9.11.

See the full report here: https://thehackernews.com/2022/10/researchers-detail-critical-rce-flaw.html

Android leaks some traffic even when "Always-on VPN" is enabled

Security researchers have discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN" or "Always-on VPN" feature is enabled. The traffic that is leaked outside the VPN connection contains metadata that could be used to derive sensitive de-anonymization information, such as WiFi access point locations.

See the full report here: https://www.bleepingcomputer.com/news/google/android-leaks-some-traffic-even-when-always-on-vpn-is-enabled/

VMware vCenter Server bug disclosed last year still not patched

VMware has informed customers that vCenter Server 8.0 is still waiting for a patch to address a high-severity privilege escalation vulnerability (CVE-2021-22048) disclosed in November 2021. Attackers with non-administrative access can exploit the bug to elevate privileges to a higher privileged group on vulnerable servers.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-vcenter-server-bug-disclosed-last-year-still-not-patched/

Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws

Microsoft's October 2022 Patch Tuesday updates provide fixes for a total of 84 flaws. The fixes include two zero-day vulnerabilities, one actively exploited in attacks and one publicly disclosed.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2022-patch-tuesday-fixes-zero-day-used-in-attacks-84-flaws/

Microsoft Exchange servers hacked to deploy LockBit ransomware

Microsoft is investigating reports of a new zero-day bug abused to hack Exchange servers, which were later used to launch Lockbit ransomware attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-lockbit-ransomware/

Russia labels Meta an "extremist" org, sends legal threats to users

Russia's Federal Financial Monitoring Service has added Meta to its list of terrorists and extremists. This means that Russia-based users will not be able to legally use monetization options on Instagram or Facebook, run advertisements on the platform, or perform any transactions on shops hosted on either platform.

See the full report here: https://www.bleepingcomputer.com/news/technology/russia-labels-meta-an-extremist-org-sends-legal-threats-to-users/

Hacking group POLONIUM uses "Creepy" malware against Israel

The POLONIUM hacking group has been observed targeting Israeli organizations with at least seven variants of custom backdoors, including four new undocumented backdoors known as TechnoCreep, FlipCreep, MegaCreep, and PapaCreep. This group is reportedly solely interested in cyberespionage and does not deploy data wipers, ransomware, or other file-damaging tools.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-polonium-uses-creepy-malware-against-israel/

JPMorgan says it is not seeing any impact from alleged hack

PMorgan Chase & Co stated that it was aware of reports that a hacker group had blocked the bank's network infrastructure but the company has not seen any impact on its operations yet. Russian hacker group Killnet said it was "blocking the entire network infrastructure of the largest bank of America JP Morgan."

See the full report here: https://www.reuters.com/business/finance/jpmorgan-says-it-is-not-seeing-any-impact-alleged-hack-2022-10-11/

Solana-Based Decentralized Finance Platform Mango Hit by $100 Million Exploit

Mango, a decentralized finance platform hosted on the Solana blockchain, has been exploited for over USD 100 million. The MGNO governance token was reportedly valued for far more than it should be. With that, the attacker was able to take out large loans against it and then drain Mango's liquidity pools.

See the full report here: https://www.coindesk.com/business/2022/10/11/breaking-news-solana-based-decentralized-finance-platform-mango-hit-by-potential-100-million-exploit/

Unofficial WhatsApp Android app caught stealing users’ accounts

An unofficial WhatsApp Android application named YoWhatsApp has been found stealing access keys for users' accounts. The app includes additional features over the regular WhatsApp, such as the ability to customize the interface or block access to chats, making it enticing for users to install.

See the full report here: https://www.bleepingcomputer.com/news/security/unofficial-whatsapp-android-app-caught-stealing-users-accounts/

Signal will remove support for SMS text messages on Android

Signal announced that it will start to phase out SMS and MMS message support from its Android app to streamline the user experience and prioritize security and privacy.

See the full report here: https://www.bleepingcomputer.com/news/technology/signal-will-remove-support-for-sms-text-messages-on-android/

New npm timing attack could lead to supply chain attacks

Security researchers have discovered an npm timing attack that reveals the names of private packages so that threat actors can release malicious clones publicly to trick developers into using them instead. Organizations can take preventive action by frequently searching npm for suspicious packages that spoof their private packages with duplicate or similar names. GitHub will not fix the bug due to architectural limitations.

See the full report here: https://www.bleepingcomputer.com/news/security/new-npm-timing-attack-could-lead-to-supply-chain-attacks/

Aruba fixes critical RCE and auth bypass flaws in EdgeConnect

Aruba has released security updates for the EdgeConnect Enterprise Orchestrator, addressing multiple critical severity vulnerabilities that enable remote attackers to compromise the host. Aruba has not detected active exploitation of the flaws and has seen no proof of concept exploits that target the vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/aruba-fixes-critical-rce-and-auth-bypass-flaws-in-edgeconnect/

Google simplifies sign-ins with Chrome, Android passkey support

Google has announced that it is introducing passkey support to the Chrome web browser and the Android operating system to simplify sign-ins across apps, websites, and devices.

See the full report here: https://www.bleepingcomputer.com/news/google/google-simplifies-sign-ins-with-chrome-android-passkey-support/

Google Forms abused in new COVID-19 phishing wave in the U.S.

COVID-19-themed phishing messages are impersonating the U.S. Small Business Administration (SBA) and abusing Google Forms to host phishing pages that steal the personal details of business owners. The lures used in the phishing emails are for pandemic financial support programs like the “Paycheck Protection Program”, “Revitalization Fund”, and “COVID Economic Injury Disaster Loan.”

See the full report here: https://www.bleepingcomputer.com/news/security/google-forms-abused-in-new-covid-19-phishing-wave-in-the-us/

Critical Bug in Siemens SIMATIC PLCs Could Let Attackers Steal Cryptographic Keys

A vulnerability (CVE-2022-38465; rated 9.3 on the CVSS scoring system) in Siemens Simatic programmable logic controller (PLC) can be exploited to retrieve the hard-coded, global private cryptographic keys and seize control of the devices. The bug has been addressed by Siemens as part of security updates issued on October 11, 2022.

See the full report here: https://thehackernews.com/2022/10/critical-bug-in-siemens-simatic-plcs.html

Hackers Using Vishing to Trick Victims into Installing Android Banking Malware

Phishing websites are targeting Italian online-banking users via voice phishing (vishing) tactics to deploy the Copybara Android malware.

See the full report here: https://thehackernews.com/2022/10/hackers-using-vishing-tactics-to-trick.html

Mumbai Police’s passport verification system hacked, three passports verified

An unknown person used the log-in credentials of a Mumbai Police Special Branch police officer, logged into the online passport verification system managed by the central government, and completed the verification process of three passports applications.

See the full report here: https://indianexpress.com/article/cities/mumbai/mumbai-polices-passport-verification-system-hacked-three-passports-verified-8203339/

Tags: all industries,  global