Cyber Threat Landscape: Aviation Industry 2022

Product Serial: B-2022-10-14b

TLP:CLEAR

ZeroFox Intelligence is excited to announce the release of our Aviation Industry Cyber Threat Landscape for 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on October 12, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The aviation industry is an attractive target for malicious actors due to its crucial role in international movement of goods and people and the vast amounts of sensitive information aviation companies hold. Cyberattacks in 2022 have highlighted the fragility of aviation supply chain and business operations, as well as the potential impact that successful attacks can have. The aviation supply chain is varied and complex, with multiple global third parties, and relies on interconnected systems with numerous time-sensitive moving parts. Growing interconnectivity and heightened geopolitical tensions in the global supply chain are driving an increased risk to aviation organizations from cyberattacks.

Threats to the industry come from groups ranging from activists to cyber criminals to nation-state actors. Organizations face a host of potential business impacts, including data exfiltration, equipment damage, and operational disruption, as well as a persistent threat from nations conducting cyber espionage to steal proprietary data and intellectual property. Personally Identifiable Information (PII)—including Social Security numbers, passports, financial records, phone numbers, and addresses—is often the main target for cybercriminals targeting aviation, who leverage such data to commit fraudulent activity or sell to third parties on deep and dark web (DDW) forums.

Airlines and airports are attractive targets themselves, but the cyber threat landscape facing the aviation industry as a whole must be considered in the implementation of solutions. Operators are primarily concerned with finding efficient and cost-effective solutions to the movement of goods and people, but good cybersecurity hygiene may not compliment—and could even run contrary to—these practices. To adopt digital solutions safely, a thorough understanding of the threat landscape and of good cybersecurity practices must be obtained and considered as a key pillar in the design and maintenance processes.

Key Findings

• Ransomware and digital extortion remain some of the greatest threats to the aviation sector and its supply chains. Threat actors may resort to more extreme pressure tactics to elicit payment from victims.
• Social engineering campaigns targeting the industry remain highly effective, with attacks in 2022 compromising both customers and employees of aviation companies and adjacent industries.
• The fall in the number of aviation industry-related advertisements from initial access brokers (IAB) on DDW forums throughout 2022 does not necessarily correspond to a reduction in threat. Illicit access to large or high-profile aviation industry entities will likely increasingly be sold via private or direct communication methods.
• Information technology infrastructure faces the greatest threat from malware, with saturated loader, infostealer, and trojan marketplaces filled with malware designed to target Windows or Linux-based systems. Aviation organizations may face an increased threat from wipers leveraged by Russia-backed entities.
• Botnets pose a significant threat to aviation organizations on two key fronts–stealing credentials and remotely controlling infected devices. Distributed Denial of Service (DDoS) attacks against the aviation industry likely have disproportionate impact, given the downstream effects of a short disruption to operations, but rarely last long or cause long-term damage.
• Aviation organizations increasingly rely on third-party vendors to provide network edge, cloud computing, and remote management technologies to enable business operations, greatly expanding the cyber attack surface.

Breach Disclosure: Foro del Guardia Civil Data Breach

On September 4, 2022, a reputed threat actor posted a data breach package on BreachForums targeting Foro del Guardia Civil, a Spain-based discussion forum that covers information related to civil guards. The data package includes over 233,000 users' information with usernames, email addresses, date of birth, IP addresses, and passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On September 4, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting Foro del Guardia Civil, a Spain-based discussion forum that covers information related to civil guards. The threat actor noted that the data package is from September 2022 and includes mote than 233,000 users' information with usernames, email addresses, date of birth, IP addresses, and passwords. From this package, ZeroFox extracted 233,279 email addresses, usernames, and hashed passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Record Store Day Canada

On July 15, 2022, a threat actor posted a data breach package on BreachForums targeting Record Store Day Canada, a Canada-based website that posts information regarding Record Store Day (which celebrates the culture of the independently owned record store). From this package, ZeroFox extracted 10,874 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 15, 2022, a threat actor posted a data breach package on BreachForums targeting Record Store Day Canada, a Canada-based website that posts information regarding Record Store Day (which celebrates the culture of the independently owned record store). The threat actor noted that the data packages includes 17,627 lines of user information. From this package, ZeroFox extracted 10,874 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include city, name, phone number, and province.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: GamingMonk

On August 2, 2022, a threat actor posted a data breach package on BreachForums targeting GamingMonk, an India-based online esports gaming community platform. From this package, ZeroFox extracted 635,804 email addresses and usernames. Of these, 609,330 records were successfully linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 2, 2022, a reputed threat actor "collector" from BreachForums posted a data breach package targeting GamingMonk, an India-based online esports gaming community platform, a subsidiary of MPL . The breach post has been removed from BreachForums. From this package, ZeroFox extracted 635,804 email addresses and usernames. Of these, 609,330 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, date of birth, gender, location, state, and mobile number.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Karen

On June 3, 2022, a threat actor from deep web forum XSS posted a data breach package targeting Karen, a Japan-based cosmetics and beauty salon. From this package, ZeroFox extracted 10,848 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On June 3, 2022, a threat actor "ilyaoslkolvok" from the Russian language deep web forum XSS posted a data breach package targeting Karen, a Japan-based cosmetics and beauty salon. The threat actor noted that the data package includes 20,625 user records with email, password, postal address, name, and phone number. The data package was also shared in the deep web forum BreachForums on June 3, 2022 by the threat actor "thes2001" , in Telegram channels on June 3, 2022 and in the underground forum "ARES CHAT" on August 24, 2022. From the package posted on XSS, ZeroFox extracted 10,848 email addresses. Of these, 10,833 records were successfully linked to plain-text passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Russian Threat Actors Respond To Military Mobilization

Product Serial: B-2022-10-18a

TLP:CLEAR

In this brief, ZeroFox Intelligence shares discussions by Russian-speaking threat actors on deep and dark web forums about Russia's partial military mobilization.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 1:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Deep and dark web actors have begun to broker methods to circumvent Russia’s partial military mobilization announced in late September, including options for dodging the draft. Some of the services are likely attempts at scams or honeypots, and in some cases, it is unlikely the actors are capable of delivering what they have promised. However, the speed with which these methods began to appear in underground channels demonstrates anxiety amongst the Russian-speaking threat actor community, which is openly discussing this topic in forums that usually ban such rhetoric.

The Underground Economist: Volume 2, Issue 19

Welcome back to The Underground Economist, Volume 2, Issue 19, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of October 14, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Killnet Involvement In Darknet Markets

Product Serial: B-2022-10-19a

TLP:CLEAR

In this brief, ZeroFox Intelligence provides detail on activities by pro-Russian hacktivist group Killnet and their involvement with the Solaris Market.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EDT) on October 17, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Killnet has been one of the most vocal threat actor groups since the start of Russia’s invasion of Ukraine. The pro-Russian hacktivist collective, identified as early as January 2022, initially sold Distributed Denial of Service (DDoS) tools as part of a subscription model. After the Ukrainian Anonymous hacking collective expressed public support for Ukraine in February 2022, Killnet declared war on the collective and changed from being a cybercriminal service provider to a hacktivist group. Killnet is dissimilar to well-known, Russia-sponsored Advanced Persistent Threat (APT) groups, as the group is not as efficient; unsophisticated; lies about targets and intentions, as well as about its success in attacking targets; and manipulates its audience regarding the help the group receives from alleged sympathetic actors. Killnet is most successful at spreading pro-Russian propaganda and drumming up attention for its purported activities—which are also being propagated by actors on darknet drug market Solaris Market, among others.

RedKrypt Ransomware

Product Serial: B-2022-10-20b

TLP:AMBER

In this brief, ZeroFox Intelligence shares details on a recently discovered ransomware family calling itself RedKrypt.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 08:00 AM (EDT) on October 18, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence has discovered a previously-unknown ransomware family calling itself RedKrypt. Not much is known about its infection vector, as the sample was discovered on VirusTotal. The ransomware was created in Microsoft's .NET framework and does not appear to use any sort of obfuscation. One key is generated per victim, and that key is then encrypted via RSA1024. Plaintext (.txt) and Markdown (.md) files are fully encrypted, while all other files are only encrypted up to the first 1024 bytes. To ensure it can recover a victim's files, RedKrypt sends the operators a uniquely-generated ID and a RSA1024 private key via Telegram.

Cloud Server Misconfigurations

Product Serial: F-2022-10-20a

TLP:CLEAR

In this report, ZeroFox Intelligence briefly discusses "BlueBleed" and the ramifications of cloud server misconfigurations leading to data leaks.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 20, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Misconfigured cloud servers are not a new occurrence; they happen regularly given that the ease of use of cloud servers often overshadows the need for additional security measures beyond what on-premises solutions require. These misconfigurations have garnered attention when a vulnerability is discovered or threat actors leverage them. The most recently reported event, dubbed "BlueBleed," occurred when security researchers informed Microsoft on September 24, 2022, of a misconfigured storage endpoint allowing unauthenticated access. After being notified, Microsoft properly configured the endpoint so that it could only be accessed after authentication. Microsoft’s official response stated, "Our investigation found no indication customer accounts or systems were compromised. We have directly notified the affected customers," in addition to expressing disappointment around the numbers listed in the report, calling them "exaggerated."

Key Findings

• Recent activity around BlueBleed has highlighted the prominence of cloud server misconfigurations.
• Internet-wide scanning has made it easy for exposed services to be discovered within hours of deployment.
• Many reported misconfigured servers are due to a lack of authentication.

Breaking News: 2022-10-14 - 2022-10-20

New Chinese Malware Attack Framework Targets Windows, macOS, and Linux Systems

A previously undocumented command-and-control (C2) framework dubbed Alchimist is likely being used in the wild to target Windows, macOS, and Linux systems.

See the full report here: https://thehackernews.com/2022/10/new-chinese-malware-attack-framework.html

Fast Company says Executive Board member info was not stolen in attack

American business magazine Fast Company reportedly confirmed that the threat actor behind a September 27 cyberattack – which forced the company to shut down its website – was able to steal contributor credentials and put them up for sale online after hacking its content management system. Personal information of its Executive Board members was not compromised in the cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/fast-company-says-executive-board-member-info-was-not-stolen-in-attack/

Exploit available for critical Fortinet auth bypass bug, patch now

Proof-of-concept exploit code is now available for a critical authentication bypass vulnerability (CVE-2022-40684) affecting Fortinet's FortiOS, FortiProxy, and FortiSwitchManager appliances. Fortinet released security updates to address this flaw last week and urged customers in private alerts to disable remote management user interfaces on affected devices with the utmost urgency.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-fortinet-auth-bypass-bug-patch-now/

Russian DDoS attack project pays contributors for more firepower

A pro-Russian group created a crowdsourced project called DDOSIA that pays volunteers launching distributed denial-of-service (DDOS) attacks against western entities. Currently, DDOSIA has about 400 members and remains a semi-closed invite-only group, regularly targeting a list of 60 military and education organizations in Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-ddos-attack-project-pays-contributors-for-more-firepower/

Magniber ransomware now infects Windows users via JavaScript files

A recent malicious campaign delivering Magniber ransomware has been targeting Windows home users with fake security updates. The ransomware operators reportedly demanded payment of up to $2,500 for home users to receive a decryption tool and recover their files. The strain focuses explicitly on Windows 10 and Windows 11 builds.

See the full report here: https://www.bleepingcomputer.com/news/security/magniber-ransomware-now-infects-windows-users-via-javascript-files/

Cloudflare mitigated record DDoS attack against Minecraft server

Wynncraft, one of the largest Minecraft servers, was recently hit by a 2.5 Tbps distributed denial-of-service (DDoS) attack. Cloudflare was able to mitigate this multi-vector attack that lasted for about two minutes and consisted of UDP and TCP floods packets attempting to overwhelm the server and keep out hundreds of thousands of players.

See the full report here: https://www.bleepingcomputer.com/news/security/cloudflare-mitigated-record-ddos-attack-against-minecraft-server/

The company that owns Shein will pay New York state $1.9 million for data breach

The company behind fashion brands Shein and Romwe will pay New York state $1.9 million over a data breach affecting millions of customers. The penalty comes after an investigation by the Office of the Attorney General into a 2018 hack in which credit card and personal information, like names, emails, and hashed passwords, was stolen.

See the full report here: https://www.theverge.com/2022/10/12/23400768/shein-romwe-data-breach-hack-zoetop-new-york-state-ecommerce

New Chinese Cyberespionage Group Targeting IT Service Providers and Telcos

A previously undocumented Chinese-speaking threat group dubbed WIP19 is targeting telecommunications and IT service providers in the Middle East and Asia. The espionage-related attacks use stolen digital certificate issued by DEEPSoft to sign malicious artifacts deployed during the infection chain to evade detection.

See the full report here: https://thehackernews.com/2022/10/new-chinese-cyberespionage-group.html

Indian Energy Company Tata Power's IT Infrastructure Hit By Cyber Attack

Tata Power Company Limited, India's largest integrated power company, disclosed in a filing with the National Stock Exchange (NSE) of India that it was targeted by a cyber attack. The company stated that it has taken steps to retrieve and restore affected machines and put security guardrails for customer-facing portals to prevent unauthorized access.

See the full report here: https://thehackernews.com/2022/10/indian-energy-company-tata-powers-it.html

Almost 900 servers hacked using Zimbra zero-day flaw

Almost 900 servers have been hacked using a critical Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2022-41352). ZCS admins who haven’t applied the available Zimbra security updates or the workarounds need to do so immediately, as exploitation activity is very high and will likely not stop for some time.

See the full report here: https://www.bleepingcomputer.com/news/security/almost-900-servers-hacked-using-zimbra-zero-day-flaw/

Over 45,000 VMware ESXi servers just reached end-of-life

Over 45,000 VMware ESXi servers just reached end-of-life (EOL), with VMware no longer providing software and security updates unless companies purchase an extended support contract. ESXi has considerable attention from threat actors, so running outdated and vulnerable versions of the software is risky for organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/over-45-000-vmware-esxi-servers-just-reached-end-of-life/

New PHP information-stealing malware targets Facebook accounts

A new Ducktail phishing campaign is spreading a novel Windows information-stealing malware written in PHP used to steal Facebook accounts, browser data, and cryptocurrency wallets. The stealer's code is an obfuscated (Base64) PHP script, which is deciphered directly on memory without touching the disk, minimizing the chances of being detected.

See the full report here: https://www.bleepingcomputer.com/news/security/new-php-information-stealing-malware-targets-facebook-accounts/

Venus Ransomware targets publicly exposed Remote Desktop services

Threat actors behind the Venus Ransomware are hacking into publicly-exposed Remote Desktop services to encrypt Windows devices. As the ransomware appears to be targeting publicly-exposed Remote Desktop services, even those running on non-standard TCP ports, it is vital to put these services behind a firewall.

See the full report here: https://www.bleepingcomputer.com/news/security/venus-ransomware-targets-publicly-exposed-remote-desktop-services/

Fortinet urges admins to patch bug with public exploit immediately

Fortinet urges customers to urgently patch their appliances against a critical authentication bypass FortiOS, FortiProxy, and FortiSwitchManager vulnerability (CVE-2022-40684) exploited in attacks. Admins who can't immediately apply patches or disable vulnerable appliances can also use the mitigation measures shared by Fortinet.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-urges-admins-to-patch-bug-with-public-exploit-immediately/

Police tricks DeadBolt ransomware out of 155 decryption keys

The Dutch National Police, in collaboration with cybersecurity firm Responders.NU, tricked the DeadBolt ransomware gang into handing over 155 decryption keys by faking ransom payments. The police tricked the ransomware gang into releasing the keys by canceling the cryptocurrency transactions before they were included in a block.

See the full report here: https://www.bleepingcomputer.com/news/security/police-tricks-deadbolt-ransomware-out-of-155-decryption-keys/

Microsoft: New Prestige ransomware targets orgs in Ukraine, Poland

Prestige ransomware is being used to target transportation and logistics organizations in Ukraine and Poland in ongoing attacks. Attackers were seen deploying the ransomware payloads across their victims' enterprise networks, a tactic very rarely seen in attacks targeting Ukrainian organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-new-prestige-ransomware-targets-orgs-in-ukraine-poland/

Student jailed for hacking female classmates’ email, Snapchat accounts

A former University of Puerto Rico (UPR) student has been sentenced to 13 months in prison for hacking over a dozen email and Snapchat accounts of female colleagues.

See the full report here: https://www.bleepingcomputer.com/news/security/student-jailed-for-hacking-female-classmates-email-snapchat-accounts/

CISA releases open-source RedEye C2 log visualization tool

The U.S. Cybersecurity and Infrastructure Security (CISA) agency has announced RedEye, an open-source analytic tool for operators to visualize and report command and control (C2) activity. The tool allows users to upload campaign data to view relevant information such as beacons and commands.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-releases-open-source-redeye-c2-log-visualization-tool/

INTERPOL arrests Black Axe cybercrime syndicate members

INTERPOL has arrested over 70 suspected members of the “Black Axe” cybercrime syndicate. Black Axe was founded in 1977 in Nigeria and is considered one of the world's most far-reaching and dangerous crime syndicates.

See the full report here: https://www.bleepingcomputer.com/news/security/interpol-arrests-black-axe-cybercrime-syndicate-members/

Australian police secret agents exposed in Colombian data leak

Identities of secret agents working for the Australian Federal Police (AFP) have been exposed after a hacktivist group called Guacamaya leaked documents stolen from the Colombian government. The leaked data includes more than five terabytes of classified data, including emails, documents, and methods AFP agents were using to stop drug cartels from running their business in Australia.

See the full report here: https://www.bleepingcomputer.com/news/security/australian-police-secret-agents-exposed-in-colombian-data-leak/

Microsoft Office 365 email encryption could expose message content

Security researchers found that it is possible to partially or fully infer the contents of encrypted messages sent through Microsoft Office 365 due to the use of a weak block cipher mode of operation. The main problem with Electronic Code Book (ECB) encryption method used there is that repetitive areas in the plaintext data have the same encrypted result when the same key is used, thus creating a pattern.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-office-365-email-encryption-could-expose-message-content/

Ransomware attack halts circulation of some German newspapers

German newspaper Heilbronn Stimme had to published an issue in e-paper form after a ransomware attack crippled its printing systems. The attack reportedly impacted the entire Stimme Mediengruppe media group, which includes the companies Pressedruck, Echo, and RegioMail. Until the printing systems return to normal operational status, Heilbronn Stimme will continue to print emergency editions via a third party.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-halts-circulation-of-some-german-newspapers/

Windows Mark of the Web bypass zero-day gets unofficial patch

A free unofficial patch has been released through 0patch to address an actively exploited zero-day flaw in the Windows Mark of the Web (MotW) security mechanism. This flaw enables attackers to prevent Windows from applying (MotW) labels on files extracted from ZIP archives downloaded from the Internet. People can install the micropatches on their Windows device until Microsoft releases official updates to address the flaw.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-mark-of-the-web-bypass-zero-day-gets-unofficial-patch/

Microsoft fixes Windows TLS handshake failures in out-of-band updates

Microsoft has issued an out-of-band (OOB) non-security update to address an issue triggering SSL/TLS handshake failures on client and server platforms. The updates can't be deployed via Windows Update, Windows Update for Business, or Windows Server Update Services (WSUS). Users can install them by downloading from the Microsoft Update Catalog and manually importing them into WSUS and Microsoft Endpoint Configuration Manager.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-tls-handshake-failures-in-out-of-band-updates/

Malware dev claims to sell new BlackLotus Windows UEFI bootkit

A threat actor is selling what they claim to be a new UEFI bootkit named BlackLotus on hacking forums. UEFI bootkits are planted in the system firmware and are invisible to security software running within the operating system because the malware loads in the initial stage of the booting sequence. Security researchers noted that BlackLotus' availability marks the propagation of APT-level capabilities in off-the-shelf malware.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-dev-claims-to-sell-new-blacklotus-windows-uefi-bootkit/

MyDeal data breach impacts 2.2M users, stolen data for sale online

Woolworths' MyDeal subsidiary has disclosed a data breach affecting 2.2 million customers, with the hacker trying to sell the stolen data on a hacker forum. MyDeal is an Australian retail marketplace that connects online shoppers with local retailers. As it is common for threat actors to purchase stolen data to use in their own attacks, all MyDeal customers should also be on the lookout for targeted phishing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/mydeal-data-breach-impacts-22m-users-stolen-data-for-sale-online/

Australian insurance firm Medibank confirms ransomware attack

Australian health insurance provider Medibank has confirmed that a ransomware attack disturbed its online services. There has been no evidence of customer data being stolen by the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/australian-insurance-firm-medibank-confirms-ransomware-attack/

Police dismantles criminal ring that hacked keyless cars

Authorities from France, Latvia, and Spain arrested 31 suspects believed to be part of a car theft ring that targeted vehicles from two French car manufacturers. Authorities also seized the domain for the fraudulent software tool used to hack the cars' keyless tech.

See the full report here: https://www.bleepingcomputer.com/news/security/police-dismantles-criminal-ring-that-hacked-keyless-cars/

Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite

Zimbra has released patches to contain an actively exploited security flaw (CVE-2022-41352; CVSS score: 9.8) in its enterprise collaboration suite that could be leveraged to upload arbitrary files to vulnerable instances. The fixes are available in versions Zimbra 9.0.0 Patch 27 and Zimbra 8.8.15 Patch 34.

See the full report here: https://thehackernews.com/2022/10/zimbra-releases-patch-for-actively.html

Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4

The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. It is reportedly the first time this adversary simulation software is being delivered via a Qakbot infection.

See the full report here: https://thehackernews.com/2022/10/black-basta-ransomware-hackers.html

Verizon notifies prepaid customers their accounts were breached

Verizon warned a section of its prepaid customers that attackers gained access to Verizon accounts and used their credit card information in SIM swapping attacks. The attackers could have accessed names, telephone numbers, billing addresses, price plans, and other service-related information on compromised accounts. Customers are advised to set a new Verizon PIN code to secure their Verizon account from future attacks, as well as a new password and secret question to safeguard their My Verizon online accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/verizon-notifies-prepaid-customers-their-accounts-were-breached/

Ransom Cartel linked to notorious REvil ransomware operation

Researchers have linked the relatively new Ransom Cartel ransomware operation with the REvil gang, based on code similarities in both operations' encryptors. Researchers have also observed similarities in the tactics, techniques, and procedures (TTPs) used by REvil and Ransom Cartel, such as double-extortion attacks, large ransom demands, and a data leak site to pressure victims into paying a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/ransom-cartel-linked-to-notorious-revil-ransomware-operation/

FBI: Scammers likely to target US Student Loan Debt Relief applicants

The FBI has warned Americans that scammers may be targeting individuals seeking to enroll in the Federal Student Aid program – to steal their personal information, payment details, and money. Potential targets should be wary of any requests to pay for enrolling in the program or for processing the application.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-scammers-likely-to-target-us-student-loan-debt-relief-applicants/

Microsoft shares fix for Exchange Online mailbox issues in Outlook

Microsoft is working on a fix for a known issue that might prevent customers from configuring Exchange Online mailboxes in Outlook for Windows. Microsoft added that the root cause has been identified as a service issue, and a code fix will be deployed soon.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-fix-for-exchange-online-mailbox-issues-in-outlook/

Hackers target Asian casinos in lengthy cyberespionage campaign

A hacking group named DiceyF has been deploying a malicious attack framework against online casinos in Southeast Asia since at least November 2021. The DiceyF APT group does not appear to be targeting financial gains from the casinos but instead conducting stealthy cyberespionage and intellectual property theft.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-asian-casinos-in-lengthy-cyberespionage-campaign/

Hackers compromised Hong Kong govt agency network for a year

Researchers have uncovered cyberattacks attributed to the China-linked espionage actor APT41 (a.k.a. Winnti) that breached government agencies in Hong Kong and remained undetected for up to a year. Researchers have also observed the deployment of the Mimikatz password extractor in the latest campaigns, allowing the threat actor to burrow deeper into the victim network.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-compromised-hong-kong-govt-agency-network-for-a-year/

Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software

HelpSystems has released an out-of-band security update to address a remote code execution vulnerability (CVE-2022-42948) affecting Cobalt Strike version 4.7.1, which could allow an attacker to take control of targeted systems.

See the full report here: https://thehackernews.com/2022/10/critical-rce-vulnerability-discovered.html

Brazil arrests suspect linked to the Lapsus$ hacking group

The Brazilian Federal Police arrested a suspect believed to be part of the Lapsus$ extortion gang. Although it is unclear how many active members the gang has, it is believed that Lapsus$ has affiliates worldwide who speak multiple languages, including English, Russian, Turkish, German, and Portuguese.

See the full report here: https://www.bleepingcomputer.com/news/security/brazil-arrests-suspect-linked-to-the-lapsus-hacking-group/

Microsoft data breach exposes customers’ contact info, emails

Microsoft disclosed that some of its customers' sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet. The company secured the server after being notified of the leak on September 24, 2022. The leaked data reportedly includes Proof-of-Execution (PoE) and Statement of Work (SoW) documents, user information, product orders/offers, project details, PII (Personally Identifiable Information) data, and documents that may reveal intellectual property.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-data-breach-exposes-customers-contact-info-emails/

Hackers use new stealthy PowerShell backdoor to target 60+ victims

A previously undocumented, undetectable PowerShell backdoor is being actively used by a threat actor who has targeted at least 69 entities. The attack begins with a phishing email with an malicious attachment ("Apply Form.docm") likely themed after a LinkedIn-based job application. To guard against such attacks, admins should apply security updates, limit remote access to endpoints, follow the least privilege principle, and monitor network traffic regularly.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-new-stealthy-powershell-backdoor-to-target-60-plus-victims/

Microsoft Azure SFX bug let hackers hijack Service Fabric clusters

Security researchers have found a Service Fabric Explorer (SFX) spoofing flaw (CVE-2022-35829) dubbed FabriXss that could enable potential attackers to gain full Administrator permissions and take over Service Fabric clusters. Microsoft advises all Service Fabric customers to upgrade to the latest SFX version and not switch to the vulnerable SFXv1 web client version.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-azure-sfx-bug-let-hackers-hijack-service-fabric-clusters/

Apache Commons Text RCE flaw — Keep calm and patch away

A remote code execution flaw (CVE-2022-42889) dubbed Text4Shell in the open-source Apache Commons Text library impacts versions that date as far back as 2018. Users are recommended to upgrade to Apache Commons Text 1.10.0.

See the full report here: https://www.bleepingcomputer.com/news/security/apache-commons-text-rce-flaw-keep-calm-and-patch-away/

CISA Warns of Critical Flaws Affecting Industrial Appliances from Advantech and Hitachi

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released two Industrial Control Systems (ICS) advisories relating to severe flaws in Advantech R-SeeNet and Hitachi Energy APM Edge appliances. Successful exploitation of the flaws could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution.

See the full report here: https://thehackernews.com/2022/10/cisa-warns-of-critical-flaws-affecting.html