Weekly Threat Bulletin - 10/21/2022 - 10/27/2022

October 28, 2022

Alpha Team

Breach Disclosure: Texas Department of Transportation

On August 5, 2022, a threat actor from BreachForums posted a data breach package targeting the Texas Department of Transportation. From this package, ZeroFox extracted 4,373 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 5, 2022, a reputed threat actor "systeM" from BreachForums posted a data breach package targeting the Texas Department of Transportation, a government agency in Texas (United States) responsible for maintaining road and supporting aviation, rail, and public transportation across the state. From this package, ZeroFox extracted 4,373 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include company name, contact details, and address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: ApacheClips

On August 18, 2022, a threat actor from deep web forum XSS posted a data breach package targeting ApacheClips, an uncensored media forum operating from the United States that shares images and videos of military operations and strikes. The data package includes 59,088 lines of user information. From this package, ZeroFox extracted 25,994 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 18, 2022, a threat actor “Amunet” from Russian-language deep web forum XSS posted a data breach package (part 1 of three parts) targeting ApacheClips, an uncensored media forum operating from the United States that shares images and videos of military operations and strikes. The threat actor noted that the data package is from November 15, 2020 and includes 59,088 lines of user information. The data package was also shared in deep web forums like NoHide on August 18, 2022 by the threat actor "Amunet", in BreachForums on May 30, 2022 by the threat actor "Kirti," and on Telegram channel "Data Leak Monitor" on August 18, 2022. From the package posted on XSS, ZeroFox extracted 25,994 email addresses, usernames and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Eviction Lab

On August 6, 2022, a threat actor from BreachForums posted a data breach package targeting Eviction Lab, an U.S.-based research center at Princeton University. The threat actor noted that the data package includes 30,998 lines of user information. From this package, ZeroFox extracted 30,942 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 6, 2022, an elite-level threat actor “icecube100” from BreachForums posted a data breach package targeting Eviction Lab, an U.S.-based research center at Princeton University that conducts research on evictions happening in the United States and publishes datasets on it. The threat actor noted that the data package includes 30,998 lines of user information. The data package was also circulated in a Telegram channel “ARES V.3" on August 6, 2022. From the package shared on BreachForums, ZeroFox extracted 30,942 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include email address, name, postal address, phone number, and IP address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Engrenagem Virtual

On August 16, 2022, a threat actor from BreachForums reposted a data breach package targeting Engrenagem Virtual, a Brazil-based business-consultant firm. From this package, ZeroFox extracted 239,860 email addresses and usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 16, 2022, a threat actor “Addka72424” from BreachForums reposted a data breach package (which was originally posted by the threat actor “sin” on July 5, 2022 in the same forum) targeting Engrenagem Virtual, a Brazil-based company that builds relationship programs to form a channel between companies and people in different segments of businesses. The breach posts created by both threat actors have since been removed from BreachForums. The threat actor Addka72424 noted that the data package is from 2020 and includes 430,939 lines of user information. The data package was also circulated in the Russian language deep web forum XSS on June 4, 2021, by the threat actor “rx26386” and in RaidForums on March 3, 2021. From the package shared by Addka72424 on BreachForums, ZeroFox extracted 239,860 email addresses and usernames. Of these, 17,780 records were successfully linked to hashed passwords. Other notable data fields in this package include tenant ID, full name, date of birth, last activity date, last login date, and gender.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: V Resort

On August 10, 2022, a threat actor from BreachForums posted a data breach package targeting V Resort, a travel solution and resort management company operating from India. From this package, ZeroFox extracted 29,830 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 10, 2022, a threat actor “Sjlandge” from BreachForums posted a data breach package targeting V Resort, a travel solution and resort management company operating from India. From this package, ZeroFox extracted 29,830 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include name, gender, date of birth, address, passport number, AADHAR number, and driving license number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Xtremcam

On August 19, 2022, a threat actor from BreachForums posted a data breach package targeting Xtremcam, an online store for sports cameras and drones operating from France. The threat actor noted that the data package includes 40,031 lines of user information. ZeroFox extracted 40,014 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 19, 2022, a reputed threat actor "buuza" from BreachForums posted a data breach package targeting Xtremcam, an online store for sports cameras and drones operating from France. The threat actor noted that the data package includes 40,031 lines of user information. The data package was also circulated in the deep web forum Leak Zone on February 13, 2022 by the threat actor "envy" and in a Telegram channel "Data Leak Monitor" on January 24, 2022. From the package published on BreachForums, ZeroFox extracted 40,014 email addresses, usernames, and hashed passwords. Other notable data fields observed in this package include name and date of birth.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Qatar 2022 World Cup Event Assessment

Product Serial: A-2022-10-25a

TLP:CLEAR

In this assessment, ZeroFox Intelligence covers a variety of topics surrounding the Qatar 2022 World Cup, including betting & ticketing scams, hacktivism, potential protests, strained local infrastructure, and more.

Standing Intelligence Requirements

GEO PII

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on October 21, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The 2022 Qatar FIFA World Cup runs from November 20 until December 18, 2022. Qatar has been a controversial host since corruption allegations emerged shortly after both Russia and Qatar were awarded hosting rights for the 2018 and 2022 World Cups, respectively, at a ceremony in 2010. Controversies have continued, with the tournament needing to be moved from the traditional Northern Hemisphere off-season summer period to the mid-season winter period to accommodate Qatar's climate. However, the greatest controversies surround the infrastructure projects needed to host the event, which are vast in a small nation not accustomed to hosting international sporting events. Allegedly, 6,500 largely-migrant workers have died building the stadiums, and thousands more continue to be mistreated according to Amnesty International. This prompted calls for a boycott of the event, which have not materialized to date. However, symbolic acts of protests by teams and spectators inside stadiums are likely during the event, which could harm sponsor reputations and lead to a crackdown by security forces that have little tolerance for dissent. Protests against the politics of a participating nation could lead to geopolitical disputes that impact the tournament as well. The Human Rights record of Qatar and Iran, as well as the war in Ukraine, remain the likeliest causes of geopolitical disruptions during the event. A month prior to the tournament, hacktivists from Anonymous collective launched an operation calling for Ukraine to replace Iran at the tournament over Iran's military support to Russia. The group also called for political pressure to be applied.

While Qatar is considered overall to be a safe country—and major acts of terrorim or violence are unlikely—there are still physical security concerns. An estimated 1. million visitors are expected in Qatar; this amounts to a 50 percent increase in the local population and could lead to stresses on transportation infrastructure and the close grouping of eight stadiums. This will also put pressure on Qatar's limited accomodation facilities, where prices have quickly become unaffordable.

During the World Cup, there will likely be threat actors aiming to acquire personal information or monetary value through phishing and scams. Cyber threat actors may target the confluence of logistical issues with accommodation, ticketing, and betting scams. These will range in complexity from basic mass SMS scams to attacks on specific individuals and organizations. Many scams will leverage the wide array of sponsors and impersonate well-known brands operating logistics and accomodations in Doha. Qatar itself requires visitors to download two apps that could expose personally-identifiable information (PII) and other sensitive data; other fraudulent mobile and payment apps will likely be leveraged by threat actors throughout.

Key Findings

Threats will be modified as the tournament goes on, depending on which nations advance.
Accommodations are sparse and extremely expensive, but the limitations could ease as fewer teams advance.
Acts of symbolic protests inside stadiums are likely.
Qatar's housing and transportation infrastructure will be strained during the tournament, particularly at the beginning.
The threat of terrorism during the games is currently considered low.
Betting and ticketing scams are highly likely.
Politically-motivated hacktivism is highly likely. in the lead up to and during the World Cup
Social engineering leveraging tournament-related lures is anticipated as threat actors will aim to capitalize on heightened global interest to harvest credentials, deploy follow-on payloads, and conduct financial fraud.

CVE-2020-7247

Product Serial: P-2022-10-25a

TLP:GREEN

In this profile, ZeroFox Intelligence discusses the risk CVE-2020-7247 poses while covering the technical details and providing a Sigma rule for detection.

Standing Intelligence Requirements

VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 4:30 PM (EDT) on October 7, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

When used in OpenBSD 6.6 and other products, smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6.1 allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Breach Disclosure: CDEK Shopping

On August 29, 2022, a threat actor from BreachForums posted a data breach package targeting CDEK Shopping, a Russia-based online store. The threat actor noted that the data package includes 20,000 users' information. ZeroFox extracted 19,823 email addresses and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 29, 2022, a threat actor "GlobalDefence" from BreachForums posted a data breach package targeting CDEK Shopping, a Russia-based online store selling foreign brands. The threat actor noted that the data package includes 20,000 users' information. The data package was also circulated in the Telegram channel "Утечки информации" on August 29, 2022. From the package published on BreachForums, ZeroFox extracted 19,823 email addresses and hashed passwords. Other notable data fields observed in this package include name, date of birth, and phone numer.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Knoppix

On August 2, 2022, a threat actor from BreachForums posted a data breach package targeting Knoppix, a U.S.-based website that provides downloadable versions of GNU/Linux operating systems. The threat actor noted that the package includes 32,377 rows of user information. From the package published on BreachForums, ZeroFox extracted 32,370 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 2, 2022, an elite level threat actor "Kirti" from BreachForums posted a data breach package targeting Knoppix, a U.S.-based website that provides downloadable versions of GNU/Linux operating systems. The threat actor noted that the data package is from October 1, 2020 and includes 32,377 rows of user information. The data package was also circulated in deep web forums like Leakbase on August 14, 2022 by the threat actor "Chucky" and Raidforums on June 9, 2021. From the package published on BreachForums, ZeroFox extracted 32,370 email addresses, usernames, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: InvestorPlace

On July 25, 2022, a threat actor from BreachForums posted a data breach package targeting InvestorPlace, a financial research firm from Maryland, United States. The threat actor noted that the data package is from the year 2020 and includes 200,000 rows of user information. ZeroFox extracted 100,025 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 25, 2022, an elite level threat actor "Kirti" from BreachForums posted a data breach package targeting InvestorPlace, a financial research firm that publishes articles, stock picks, and stock market news for investors operating from Maryland, United States. The threat actor noted that the data package is from the year 2020 and includes 200,000 rows of user information. InvestorPlace was also targeted in the deep web forum Raidforums on May 10, 2020. From the package published on BreachForums, ZeroFox extracted 100,025 email addresses, usernames, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Egypt Furniture

On August 3, 2022, a threat actor from BreachForums posted a data breach package targeting Egypt Furniture, a furniture manufacturer and retailer from Egypt. The threat actor noted that the data package is from July 2022 and includes information related to around 14,000 users. ZeroFox extracted 14,760 email addresses. Of these, 13,766 records were successfully linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 3, 2022, a threat actor "dior" from BreachForums posted a data breach package targeting Egypt Furniture, a furniture manufacturer and retailer from Egypt that deals with house and hotel furniture. The breach post has now been removed from BreachForums. The threat actor noted that the data package is from July 2022 and includes around 14,000 rows of user information. From this package, ZeroFox extracted 14,760 email addresses. Of these, 13,766 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, mobile number, gender, age, marital status, education, and current job.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Slide Team

On August 25, 2022, a threat actor from BreachForums posted a data breach package targeting Slide Team, a U.S.-based research, consulting, and design agency. The threat actor noted that the data package is from April 2021 and impacted around 1.4 million users. ZeroFox extracted 1,464,198 email addresses. Of these, 1,464,149 records were successfully linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 25, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting Slide Team, a U.S.-based research, consulting, and design agency. The threat actor noted that the data package is from April 2021 and impacted around 1.4 million users. From this package, ZeroFox extracted 1,464,198 email addresses. Of these, 1,464,149 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, date of birth, and gender.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Adopt Me Trading Values

On August 19, 2022, a threat actor from BreachForums posted a data breach package targeting Adopt Me Trading Values, a U.S.-based trading game. The threat actor noted that the data package includes 104,000 user records. From this package, ZeroFox extracted 103,131 email addresses and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 19, 2022, a threat actor "tilly" from BreachForums posted a data breach package targeting Adopt Me Trading Values, a U.S.-based trading mini-game that is made for Roblox players. The breach post has now been removed from BreachForums. The threat actor noted that the data package includes 104,000 user records. From this package, ZeroFox extracted 103,131 email addresses and hashed passwords. Other notable data fields observed in this package include IP and Roblox username.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: OpeningOdds

On August 2, 2022, a threat actor from BreachForums posted a data breach package targeting OpeningOdds, a data tracking system designed to collect football betting odds. The threat actor noted that the data package includes around 8,000 users' information. From the package, ZeroFox extracted 8,793 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 2, 2022, "pompompurin," an admin from BreachForums, posted a data breach package targeting OpeningOdds, a data tracking system designed to collect football betting odds from Singapore Pools, a state-owned lottery operator in Singapore. The threat actor noted that the data package includes around 8,000 users' information. The data package was circulated in the deep web forum Leakbase on August 14, 2022 by the threat actor "Chucky". From the package published on BreachForums, ZeroFox extracted 8,793 email addresses, usernames, and hashed passwords. Other notable data fields observed in this package include age, date of birth, phone number, and country.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Benco

On August 10, 2022, a threat actor from BreachForums posted a data breach package targeting Benco, an eCommerce site operating from Czechia (Czech Republic). The threat actor noted that the data package is from 2021 and includes around 7,000 user records. ZeroFox extracted 7,512 email addresses. Of these, 7,503 records were successfully linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 10, 2022, a reputed threat actor "emo" from BreachForums posted a data breach package targeting Benco, an eCommerce site operating from Czechia (Czech Republic). The threat actor noted that the data package is from 2021 and includes around 7,000 user records. The data package was also circulated in deep web forums like Leakbase on August 12, 2022 by the threat actor "Chucky", in the Russia language forum XSS on August 20, 2021 by the threat actor "MrMarch", in RaidForums on July 7, 2021 by the threat actor "Nowhereblack", and in Telegram channels like "BaseLeak" on August 21, 2021 and "Breached Data | Group" on July 7, 2021. From the package published on BreachForums, ZeroFox extracted 7,512 email addresses. Of these, 7,503 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, address, birth date, job position, location, and mobile number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-10-21 - 2022-10-27

Internet connectivity worldwide impacted by severed fiber cables in France

A major internet cable in the South of France was severed, affecting subsea cable connectivity to Europe, Asia, and the United States and causing data packet losses and increased website response latency. Security company Zscaler reported that it made routing adjustments to mitigate the impact. However, users face problems due to app and content providers routing traffic through the impacted paths. Investigations into the incident is underway.

See the full report here: https://www.bleepingcomputer.com/news/technology/internet-connectivity-worldwide-impacted-by-severed-fiber-cables-in-france/

Health system data breach due to Meta Pixel hits 3 million patients

Advocate Aurora Health (AAH) is notifying its patients of a data breach that exposed the personal data of 3,000,000 patients. Information may have been exposed via the leak include IP address; dates, times, and locations of scheduled appointments; medical provider information; insurance information; and more.

See the full report here: https://www.bleepingcomputer.com/news/security/health-system-data-breach-due-to-meta-pixel-hits-3-million-patients/

Ursnif malware switches from bank account theft to initial access

A new version of the Ursnif malware (or Gozi) functions as a generic backdoor, rather than specifically as a banking trojan. This indicates that the operators of the new version might be focusing on distributing ransomware. The new Ursnif variant (named LDR4) is delivered via fake job offer emails.

See the full report here: https://www.bleepingcomputer.com/news/security/ursnif-malware-switches-from-bank-account-theft-to-initial-access/

Google sued over biometric data collection without consent

Google has been sued for allegedly collecting and using biometric data belonging to millions of Texans – from products and services such as services like Google Photos, Google Assistant, and Nest Hub Max – without proper consent.

See the full report here: https://www.bleepingcomputer.com/news/security/google-sued-over-biometric-data-collection-without-consent/

OldGremlin hackers use Linux ransomware to attack Russian orgs

OldGremlin, or TinyScouts, a ransomware group that targets Russian corporate networks, has incorporated file-encrypting malware for Linux machines into its arsenal.

See the full report here: https://www.bleepingcomputer.com/news/security/oldgremlin-hackers-use-linux-ransomware-to-attack-russian-orgs/

Cybercriminals jailed for cryptocurrency theft, death threats

Two people were sentenced to more than two years in prison for stealing cryptocurrency in SIM swapping attacks and hijacking victims' social media accounts. They reportedly targeted individuals who likely own significant amounts of crypto assets in Coinbase or Block.io wallets or controlled high-value "Original Gangster" (OG) Instagram and Tumblr accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/cybercriminals-jailed-for-cryptocurrency-theft-death-threats/

Hacking group updates Furball Android spyware to evade detection

The Domestic Kitten hacking group (also known as APT-C-50) is targeting Iranian citizens in mobile surveillance campaigns with new version of the FurBall Android spyware. The spyware is distributed via fake websites, to which victims are directed via direct messages, social media posts, emails, SMS, black SEO, and SEO poisoning.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-updates-furball-android-spyware-to-evade-detection/

Android adware apps in Google Play downloaded over 20 million times

Security researchers have discovered 16 malicious clicker apps on Google Play. Clicker apps load ads in invisible frames or in the background and click them to generate revenue for their operators. The apps have now been removed from Google Play but have been installed over 20 million times.

See the full report here: https://www.bleepingcomputer.com/news/security/android-adware-apps-in-google-play-downloaded-over-20-million-times/

Thousands of GitHub repositories deliver fake PoC exploits with malware

Researchers have found found thousands of GitHub repositories that offer fake proof-of-concept (PoC) exploits for various vulnerabilities, with some of them including malware. Software testers should carefully scrutinize the PoCs they download and run thorough checks before executing them.

See the full report here: https://www.bleepingcomputer.com/news/security/thousands-of-github-repositories-deliver-fake-poc-exploits-with-malware/

TommyLeaks and SchoolBoys: Two sides of the same ransomware gang

Two new extortion gangs TommyLeaks and SchoolBoys (that are actually part of the same operation) are targeting companies worldwide. While it is unclear why the group is using two different names, it may be trying a similar approach to that taken by Conti and Karakurt (where Karakurt acts as the data extortion arm of the ransomware outfit).

See the full report here: https://www.bleepingcomputer.com/news/security/tommyleaks-and-schoolboys-two-sides-of-the-same-ransomware-gang/

U.S. government warns of Daixin Team targeting health orgs with ransomware

The U.S. CISA, FBI, and the Department of Health and Human Services (HHS) have warned Americans of cybercrime group Daixin Team actively targeting the U.S. Healthcare and Public Health (HPH) sector in ransomware attacks. The federal agencies also shared indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) in a joint advisory to help security professionals detect and block attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-of-daixin-team-targeting-health-orgs-with-ransomware/

Wholesale giant METRO hit by IT outage after cyberattack

International wholesale giant METRO is experiencing infrastructure outages and store payment issues (in stores in Austria, Germany, and France) following a recent cyberattack. Even though its stores are still operating, METRO stated that it was forced to set up offline payment systems and that online orders are delayed.

See the full report here: https://www.bleepingcomputer.com/news/security/wholesale-giant-metro-hit-by-it-outage-after-cyberattack/

Hackers exploit critical VMware flaw to drop ransomware, miners

Malicious campaigns are using a critical vulnerability (CVE-2022-22954) in VMware Workspace One Access to deliver various malware. The threat actors deployed the Mira botnet for distributed denial-of-service (DDoS) attacks, the GuardMiner cryptocurrency miner, and the RAR1Ransom tool in attacks. Although VMware released a fix for the bug several months ago, many systems still remain vulnerable.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-vmware-flaw-to-drop-ransomware-miners/

Clearview AI gets third €20 million fine for illegal data collection

France’s data protection authority (CNIL) has fined Clearview AI with €20 million for illegal collection and processing of biometric data belonging to French citizens. Clearview AI received the same fine from Italian and Greek data protection authorities for the same violations in March and July this year. Clearview AI scraps publicly available images and videos of people from websites and social media platforms and associates them with identities.

See the full report here: https://www.bleepingcomputer.com/news/security/clearview-ai-gets-third-20-million-fine-for-illegal-data-collection/

BlackByte ransomware uses new data theft tool for double-extortion

A BlackByte ransomware affiliate is using a new custom data stealing tool called ExByte to steal data from compromised Windows devices quickly. BlackByte has been primarily targeting organizations in Africa recently, likely to avoid provoking Western law enforcement.

See the full report here: https://www.bleepingcomputer.com/news/security/blackbyte-ransomware-uses-new-data-theft-tool-for-double-extortion/

Critical Flaw Reported in Move Virtual Machine Powering the Aptos Blockchain Network

Researchers have disclosed details of a now-patched critical flaw in the Move virtual machine that powers the Aptos blockchain network. Aptos is a new entrant to the blockchain space and launched its mainnet on October 17, 2022.

See the full report here: https://thehackernews.com/2022/10/critical-flaw-reported-in-move-virtual.html

Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware

The Emotet botnet has been linked to a new wave of malspam campaigns that take advantage of password-protected archive files to drop CoinMiner and Quasar RAT on compromised systems. While such attacks require persuading the target into opening the attachment, this campaign sidesteps this via a batch file to automatically supply the password to unlock the payload.

See the full report here: https://thehackernews.com/2022/10/emotet-botnet-distributing-self.html

Hackers Started Exploiting Critical "Text4Shell" Apache Commons Text Vulnerability

Security researchers have spotted hackers’ exploitation attempts targeting a newly disclosed flaw in Apache Commons Text (CVE-2022-42889, a.k.a. Text4Shell – severity ranking of 9.8/10.0) on October 18, 2022. The Apache Software Foundation (ASF) released an updated version of the software (1.10.0) on September 24, 2022.

See the full report here: https://thehackernews.com/2022/10/hackers-started-exploiting-critical.html

Typosquat campaign mimics 27 brands to push Windows, Android malware

A massive campaign is using over 200 typosquatting domains that impersonate twenty-seven brands to trick visitors into downloading various Windows and Android malware. Some of the malicious sites mimic Google Play, APKCombo, APKPure, PayPal, VidMate, Snapchat, and TikTok, and deliver the ERMAC and Agent Tesla malware.

See the full report here: https://www.bleepingcomputer.com/news/security/typosquat-campaign-mimics-27-brands-to-push-windows-android-malware/

Apple fixes new zero-day used in attacks against iPhones, iPads

Apple has fixed a zero-day vulnerability (CVE-2022-42827) – an out-of-bounds write issue caused by software writing data outside the boundaries of the current memory buffer. If successfully exploited in attacks, this zero-day could have been used by potential attackers to execute arbitrary code with kernel privileges. Apple addressed the zero-day vulnerability in iOS 16.1 and iPadOS 16.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-new-zero-day-used-in-attacks-against-iphones-ipads/

Iran’s atomic energy agency confirms hack after stolen data leaked online

The Iranian Atomic Energy Organization (AEOI) has confirmed that one of its subsidiaries' email servers was hacked after the Black Reward hacking group published stolen data online. The agency says it immediately took the necessary measures to mitigate the results of this incident and informed all concerned parties to be prepared for potential exploitation attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/iran-s-atomic-energy-agency-confirms-hack-after-stolen-data-leaked-online/

Cuba ransomware affiliate targets Ukrainian govt agencies

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert about potential Cuba Ransomware attacks against critical networks in the country. A new wave of phishing emails impersonating the Press Service of the General Staff of the Armed Forces of Ukraine is deploying Cuba Ransomware's signature malware: ROMCOM RAT.

See the full report here: https://www.bleepingcomputer.com/news/security/cuba-ransomware-affiliate-targets-ukrainian-govt-agencies/

Microsoft fixes printing issue blocking Windows 11 22H2 upgrades

Microsoft has fixed a known issue blocking the Windows 11 2022 Update from being offered on systems with printers using Universal Print Class or Microsoft IPP Class drivers because of compatibility issues.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-printing-issue-blocking-windows-11-22h2-upgrades/

Pendragon car dealer refuses $60 million LockBit ransomware demand

U.K.-based Pendragon Group has decided not to pay a ransom after the company was breached in a cyberattack by the LockBit ransomware gang. The Pendragon Group has more than 200 car dealerships in the United Kingdom and owns CarStore, Evans Halshaw, and Stratstone luxury car retailer.

See the full report here: https://www.bleepingcomputer.com/news/security/pendragon-car-dealer-refuses-60-million-lockbit-ransomware-demand/

SideWinder APT Using New WarHawk Backdoor to Target Entities in Pakistan

The SideWinder group (also called APT-C-17, Rattlesnake, and Razor Tiger) has reportedly compromised the official website of Pakistan’s National Electric Power Regulatory Authority (NEPRA) to deliver a tailored malware called WarHawk.

See the full report here: https://thehackernews.com/2022/10/sidewinder-apt-using-new-warhawk.html

Australia flags increased penalties for data breaches following major cyberattacks

Australia will introduce laws to parliament to increase penalties for companies subject to major data breaches, after high-profile cyberattacks hit millions of Australians in recent weeks. Two prominent attacks were the data breach at the country’s second-largest telco, Singtel-owned Optus (with the theft of personal data from up to 10 million accounts), and at health insurer Medibank Private (theft of 200 GB of data, including medical diagnoses and procedures).

See the full report here: https://www.reuters.com/technology/australia-flags-increased-penalties-data-breaches-following-major-cyberattacks-2022-10-22/

Outsourcer Interserve fined £4.4m for failing to stop cyber-attack

The U.K. government has fined construction group Interserve 4.4 million pounds after a 2020 cyberattack led hackers to steal the personal and financial information of up to 113,000 employees. Bank account details, national insurance numbers, ethnic origin, sexual orientation and religion were among the personal information compromised.

See the full report here: https://www.theguardian.com/business/2022/oct/24/outsourcer-interserve-fined-4-point-4m-cyber-attack-failings-data-breach-personal-information

Online liquor delivery company Drizly settles with U.S. FTC over data breach

Online liquor market Drizly has settled with the U.S. Federal Trade Commission (FTC) over a data breach that exposed information about 2.5 million people. Drizly is required to destroy unnecessary data, restrict what it collects, and follow certain data security practices.

See the full report here: https://www.reuters.com/legal/online-liquor-deliver-company-drizly-settles-with-us-ftc-over-data-breach-2022-10-24/

Medibank reveals customer data breach much wider than originally thought

Medibank has revealed that the cyberattack on its customers' data is much wider than originally thought. Medibank confirmed that data from its main brand is now believed to have been compromised. All Medibank and ahm customers have been urged to contact the company's cyber response hotlines by phone or through an information page on the firm's website.

See the full report here: https://www.abc.net.au/news/2022-10-25/medibank-breach-wider-than-estimated/101572904

Data of alleged 2.6 million Carousell accounts being sold on Dark Web, hacking forums

A database of user accounts believed to have been stolen from online marketplace Carousell is being sold on the dark web and hacking forums. Carousell stated that 1.95 million user accounts were affected, but no credit card and payment-related information was compromised. The leak contains victims’ names, usernames, e-mail addresses, phone numbers, country of origin, date of account creation, and number of followers.

See the full report here: https://www.straitstimes.com/singapore/data-of-alleged-26m-carousell-accounts-being-sold-on-dark-web-hacking-forums

Chrome extensions with 1 million installs hijack targets’ browsers

Security researchers have discovered a new malvertizing campaign (dubbed Dormant Colors) pushing Google Chrome extensions that hijack searches and insert affiliate links into webpages. The extensions and the websites listed in the IoCs section (of the report published by the researchers) have been removed/taken offline, but the researchers warn that the operation is constantly renewed with new add-on names and domains.

See the full report here: https://www.bleepingcomputer.com/news/security/chrome-extensions-with-1-million-installs-hijack-targets-browsers/

Cisco warns admins to patch AnyConnect flaw exploited in attacks

Cisco has warned customers that two security vulnerabilities (CVE-2020-3433 and CVE-2020-3153) in the Cisco AnyConnect Secure Mobility Client for Windows are being exploited in the wild. Cisco advised admins to update the vulnerable software and block ongoing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-warns-admins-to-patch-anyconnect-flaw-exploited-in-attacks/

See Tickets discloses 2.5 years-long credit card theft breach

Ticketing service provider See Tickets informed customers that cybercriminals might have accessed their payment card details via a skimmer on its website. Via the infection (which happened on June 25, 2019), the criminals might have stolen names, physical addresses, payment card number, CVV code, and expiry date of the card. Customers should remain vigilant against phishing emails or other unsolicited communication and monitor credit card statements for suspicious charges.

See the full report here: https://www.bleepingcomputer.com/news/security/see-tickets-discloses-25-years-long-credit-card-theft-breach/

Ukrainian charged for operating Raccoon Stealer malware service

A Ukrainian national has been charged for involvement in the Raccoon Stealer cybercrime operation. Raccoon Stealer is an information-stealing trojan distributed under the MaaS (malware-as-a-service) model. The suspect was arrested in March 2022 and is currently jailed in the Netherlands while waiting to be extradited to the United States.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-charged-for-operating-raccoon-stealer-malware-service/

Microsoft: Vice Society targets schools with multiple ransomware families

The Vice Society group has been switching ransomware payloads in attacks targeting the education sector worldwide. The variants include BlackCat, QuantumLocker, Zeppelin, a Vice Society-branded variant of Zeppelin ransomware, HelloKitty/Five Hands, and RedAlert. Sometimes, the group does not deploy ransomware and instead performs extortion using stolen data.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-vice-society-targets-schools-with-multiple-ransomware-families/

Dutch police arrest hacker who breached healthcare software vendor

The Dutch police have arrested a person for breaching the systems of a healthcare software vendor and stealing tens of thousands of documents. The documents potentially contain sensitive personal and medical data of patients.

See the full report here: https://www.bleepingcomputer.com/news/security/dutch-police-arrest-hacker-who-breached-healthcare-software-vendor/

VMware fixes critical Cloud Foundation remote code execution bug

VMware has released security updates (CVE-2021-39144; CVSSv3 base score of 9.8/10) to fix a critical vulnerability in VMware Cloud Foundation, a hybrid cloud platform for running enterprise apps in private or public environments. The bug can be exploited remotely by unauthenticated threat actors in low-complexity attacks that don't require user interaction. The updates are available in version 1.4.19 of XStream.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-cloud-foundation-remote-code-execution-bug/

Massive cryptomining campaign abuses free-tier cloud dev resources

An automated and large-scale “freejacking” campaign, run by a threat actor Purpleurchin, abuses free GitHub, Heroku, and Buddy services to mine cryptocurrency. 300 GitHub accounts, 2,000 Heroku accounts, and 900 Buddy.works accounts are used in this operation, rotated and channeled through 130 Docker Hub images with mining containers. The loss for GitHub is around $15 per month per account, while for Heroku and Buddy, the loss is between $7 and $10 per month per account.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-cryptomining-campaign-abuses-free-tier-cloud-dev-resources/

Zscaler outage causing heavy packet loss, connectivity issues

A Zscaler service outage led to loss of connectivity, packet loss, and latency for customers. Zscaler has confirmed that the disruption was caused by an issue in zscalertwo.net Cloud and that it has now been mitigated.

See the full report here: https://www.bleepingcomputer.com/news/technology/zscaler-outage-causing-heavy-packet-loss-connectivity-issues/

Hive claims ransomware attack on Tata Power, begins leaking data

Hive ransomware group has claimed responsibility for a cyberattack on Tata Power, India's largest integrated power company. The group began leaking data allegedly stolen from Tata Power on their leak site, with the leaks comprising employees' personally identifiable information (PII), National ID (Aadhar) card numbers, PAN (tax account) numbers, salary information, engineering drawings, financial and banking records, as well as client information.

See the full report here: https://www.bleepingcomputer.com/news/security/hive-claims-ransomware-attack-on-tata-power-begins-leaking-data/

22-Year-Old Vulnerability Reported in Widely Used SQLite Database Library

A high-severity vulnerability (CVE-2022-35737; CVSS score: 7.5) has been disclosed in the SQLite database library, affecting SQLite versions 1.0.12 through 3.39.1. The bug was introduced as part of a code change dating back to October 2000 and could enable attackers to crash or control programs. The flaw has been addressed in version 3.39.2 released on July 21, 2022.

See the full report here: https://thehackernews.com/2022/10/22-year-old-vulnerability-reported-in.html

Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog

Researchers have disclosed details of two vulnerabilities in Microsoft Windows – dubbed LogCrusher and OverLog – which affect the EventLog Remoting Protocol (MS-EVEN). OverLog was assigned the CVE identifier CVE-2022-37981 (CVSS score: 4.3) and addressed by Microsoft as part of the October 2022 Patch Tuesday updates, but LogCrusher remains unresolved.

See the full report here: https://thehackernews.com/2022/10/researchers-detail-windows-event-log.html

Cybercriminals Used Two PoS Malware to Steal Details of Over 167,000 Credit Cards

A threat actor used two point-of-sale (PoS) malware variants to steal information related to more than 167,000 credit cards from payment terminals. The identity of the criminals behind the scheme is unknown, and it is currently not clear if the stolen data has been sold for monetary gains.

See the full report here: https://thehackernews.com/2022/10/cybercriminals-used-two-pos-malware-to.html

Microsoft fixes Windows vulnerable driver blocklist sync issue

Microsoft has announced that it addressed an issue preventing the Windows kernel vulnerable driver blocklist from being synced to systems running older Windows versions. Microsoft also stated that starting with the Windows 11 2022 update (version 22H2), the blocklist is enabled by default on all devices.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/

Notorious "BestBuy" hacker arraigned for running dark web market

A notorious British hacker (known as Bestbuy, Spdrman, Popopret, and UserL0ser) was arraigned by the U.S. Department of Justice for allegedly running the now defunct 'The Real Deal" dark web marketplace. Threat actors used this platform to sell stolen credentials for U.S. government agencies' systems, hacking tools, drugs, weapons, government data, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/notorious-bestbuy-hacker-arraigned-for-running-dark-web-market/

LinkedIn's new security features combat fake profiles, threat actors

LinkedIn has introduced new features to fight fake profiles and malicious use of the platform. LinkedIn announced that it has begun to display more information about accounts to verify their authenticity, actively hunt for fakes using AI, and warn users when they receive suspicious messages.

See the full report here: https://www.bleepingcomputer.com/news/security/linkedins-new-security-features-combat-fake-profiles-threat-actors/

Microsoft fixes TLS handshake failures in Windows 11 22H2

Microsoft has addressed a known issue (caused by October 2022 Patch Tuesday updates) that triggers SSL/TLS handshake failures on client and server platforms with the release of the KB5018496 preview cumulative update. Users can install the updates by going into Settings > Windows Update, clicking “Check for Updates,” and then selecting the optional preview to download and install.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-tls-handshake-failures-in-windows-11-22h2/

Medibank now says hackers accessed all its customers’ personal data

Australian insurance firm Medibank has confirmed that hackers accessed all of its customers' personal data and a large amount of health claims data during a recent ransomware attack.

See the full report here: https://www.bleepingcomputer.com/news/security/medibank-now-says-hackers-accessed-all-its-customers-personal-data/

Microsoft: Server Manager disk resets can lead to data loss

Australian insurance firm Medibank has confirmed that hackers accessed all of its customers' personal data and a large amount of health-claims data during a recent ransomware attack. The threat actors managed to exfiltrate some of the accessed data, so customers should assume that all of this data was stolen.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-server-manager-disk-resets-can-lead-to-data-loss/

Kimsuky Hackers Spotted Using 3 New Android Malware to Target South Koreans

Microsoft has warned users that a newly acknowledged issue can lead to data loss when resetting virtual disks using the Server Manager management console. This issue affects Windows Server 2019, Windows Server 2022, and Windows 11 22H2. Microsoft has provided a workaround for this issue, allowing admins to reset virtual disks without data loss risks.

See the full report here: https://thehackernews.com/2022/10/kimsuky-hackers-spotted-using-3-new.html

Tags:

all industries

global