Weekly Threat Bulletin - 10/28/2022

Q3 2022 Financial Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-10-31a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Financial Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to financial sector organizations remained broadly consistent in Q3 2022, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. There were increases in particular aspects of the social engineering threat to financial organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2. (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosures, particularly in software commonly-used by financial organizations, will very likely strain out-of-cycle patch management processes and increase the likelihood of vulnerabilities not being patched in a timely manner. Financial organizations should note an ongoing shift in the Initial Access Broker (IAB) market, with a fall in advertisements pertaining to financial organizations likely reflecting an ongoing move towards brokers making sales in private channels rather than advertising in open forums. Botnet and malware deployment remained high, including infostealers and banking trojans. Digital extortion attempts against financial victims remain below 2021 levels, likely caused in part by difficulty eliciting victims’ payments. While there have been fewer attacks against “big game” financial sector organizations, incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers.

Key Findings

Financial organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
Vulnerabilities in software commonly-used by financial organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Illicit access to large financial entities was increasingly being sold via private or direct communication channels.
While there were fewer ransomware and digital extortion attempts against “big game” financial sector targets, incidents highlighted the high threat of attacks against third-party providers.

Q3 2022 Retail Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-10-31b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Retail Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

Executive Summary

The threat to retail sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. Retail organizations faced an increased threat from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online Version 2. (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosure, including in widely-used e-commerce platforms, will very likely strain out-of-cycle patch management processes and increases the risk of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. Digital extortion attempts against retail targets remain below 2021 levels, likely caused in part by difficulty eliciting payments from victims. Incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers.

Key Findings

Retail organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
Vulnerabilities in widely-used ecommerce platforms were leveraged in attacks against the retail sector, long after patches were released.
Illicit access to retail entities was increasingly being sold via private or direct communication channels.
E-skimmers and other malware continued to be deployed at a high frequency against payment systems.
Ransomware and digital extortion attempts against the retail sector this quarter highlighted the threat of attacks against third-party providers.

Breach Disclosure: MarketsMojo

On August 30, 2022, a threat actor from BreachForums posted a data breach package targeting MarketsMojo, an India-based financial advisory platform to provide share market research. The threat actor noted that the data package has impacted around 496,000 members. From this package, ZeroFox extracted 469,964 email addresses and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 30, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting MarketsMojo, a India-based financial advisory platform to provide share market research, advice, and tips to investors. The threat actor noted that the data package is from around March 2021 and has impacted around 496,000 members. From this package, ZeroFox extracted 469,964 email addresses and/or usernames. Of these, 288,366 records were successfully linked to hashed passwords. Other notable data fields observed in this package include display name, phone number, address, and Facebook ID.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: LeagueSpy

On August 30, 2022, a threat actor from BreachForums posted a data breach package targeting LeagueSpy, a Germany-based sports website. The threat actor noted that the data package has impacted around 159,000 members. From this package, ZeroFox extracted 159,153 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 30, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting LeagueSpy, a Germany-based sports website. The threat actor noted that the data package is from December 2020 and impacted around 159,000 members. From this package, ZeroFox extracted 159,153 email addresses, usernames, and hashed passwords. Other notable data fields observed in this package include user ID, IP, registration date, and birthday.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Chartered Insurance Institute

On August 27, 2022, a threat actor from BreachForums posted a data breach package targeting Chartered Insurance Institute, a U.K.-based insurance and financial planning company. The threat actor noted that the data package includes around 57,000 rows of user information. From this package, ZeroFox extracted 57,542 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 27, 2022, a threat actor "prove" from BreachForums posted a data breach package targeting Chartered Insurance Institute, an insurance and financial planning company operating from London, United Kingdom. The threat actor noted that the data package includes around 57,000 rows of user information. From this package, ZeroFox extracted 57,542 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include country, date of birth, name, address, and telephone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: CrimeCraft GangWars

On July 26, 2022, a threat actor from BreachForums posted a data breach package targeting CrimeCraft GangWars, an online gaming website. The threat actor noted that the data package includes 1.5 million records. From this package, ZeroFox extracted 1,570,807 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 26, 2022, a threat actor "donjuji" from BreachForums posted a data breach package targeting CrimeCraft GangWars, an online gaming website. The breach post has been removed from BreachForums. The threat actor noted that the data package includes 1.5 million records. The data package was also circulated in BreachForums on March 18, 2022 by the threat actor "God" and in RaidForums on October 26, 2021. From the package published on BreachForums, ZeroFox extracted 1,570,807 email addresses, usernames, and hashed passwords. Other notable data fields observed in this package include birth date, secret question, secret answer, registration IP, and country code.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: FreeGame2017

On August 30, 2022, a threat actor from BreachForums posted a data breach package targeting FreeGame2017, a gaming website operating from Bulgaria. The threat actor noted that the data breach has impacted 1.8 million users. From the package published on BreachForums, ZeroFox extracted 1,814,804 email addresses and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 30, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting FreeGame2017, a gaming website operating from Bulgaria. The threat actor noted that the data package is from December 2019 and impacted 1.8 million users. The data package was also circulated in deep web forums like Leakbase on September 10, 2022 by the threat actor "Chucky" and in RaidForums on March 27, 2020. From the package published on BreachForums, ZeroFox extracted 1,814,804 email addresses and/or usernames. Of these, 1,814,801 records were successfully linked to hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: 360icons

On July 27, 2022, a threat actor from BreachForums posted a data breach package targeting 360icons, an online gaming website operating from Iceland. From this package, ZeroFox extracted 101,861 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 27, 2022, "pompompurin," an adminstrator of BreachForums, posted a data breach package targeting 360icons, a website hosting online gaming tournaments and discussion forums operating from Iceland. From this package, ZeroFox extracted 101,861 email addresses, usernames, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Realcoding

On August 30, 2022, a threat actor from BreachForums posted a data breach package targeting Realcoding, a coding website operating from Russia. The threat actor noted that the data package includes 113,000 rows of user information. From this package, ZeroFox extracted 112,893 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 30, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting Realcoding, a coding website operating from Russia. The threat actor noted that the data package is from May 2021 and includes 113,000 users' information. From this package, ZeroFox extracted 112,893 email addresses, usernames, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Peep My Porn

On July 24, 2022, a threat actor from BreachForums posted a data breach package targeting Peep My Porn, an adult-entertainment website operating from the United States. The threat actor noted that the data package includes 261,000 users' information. From this package, ZeroFox extracted 260,933 email addresses, usernames, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 24, 2022, a VIP level threat actor "impierator" from BreachForums posted a data breach package targeting Peep My Porn, an adult-entertainment website operating from the United States. The threat actor noted that the data package includes 261,000 users' information. From this package, ZeroFox extracted 260,933 email addresses, usernames, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 2, Issue 20

Welcome back to The Underground Economist, Volume 2, Issue 20, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of October 28, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Breaking News: 2022-10-28 - 2022-11-03

Twilio discloses another hack from June, blames voice phishing

Cloud communications company Twilio has disclosed a new data breach from a June 2022 attack where the same attackers behind the August hack accessed some customers' information. Because of the two breaches, Twilio reset the credentials of the compromised employee user accounts and is distributing FIDO2 tokens to all employees.

See the full report here: https://www.bleepingcomputer.com/news/security/twilio-discloses-another-hack-from-june-blames-voice-phishing/

Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets

A new version of the Fodcha DDoS botnet (version 4) features ransom demands (in Monero) injected into packets and new features to evade detection. The botnet now uses encryption to establish communication with the C2 server, making it harder for security researchers to analyze the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1tbps-in-power-injects-ransoms-in-packets/

Apple fixes recently disclosed zero-day on older iPhones, iPads

Apple has released security updates to backport patches released on October 24,2022, to older iPhones and iPads, addressing an actively exploited zero-day bug (CVE-2022-42827). CISA has added this bug to its catalog of known exploited vulnerabilities, requiring Federal Civilian Executive Branch (FCEB) agencies to patch it by November 15, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-fixes-recently-disclosed-zero-day-on-older-iphones-ipads/

Microsoft links Raspberry Robin worm to Clop ransomware attacks

A threat group (DEV-0950) used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm. Nearly 3,000 devices in almost 1,000 organizations have seen at least one Raspberry Robin payload-related alert in the past month.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-links-raspberry-robin-worm-to-clop-ransomware-attacks/

Australian Clinical Labs says patient data stolen in ransomware attack

Australian Clinical Labs (ACL) has disclosed a February 2022 data breach affecting its Medlab Pathology business, exposing the medical records and other sensitive information of 223,000 people. The Quantum ransomware gang took responsibility for the attack and uploaded all stolen files – including patient and employee details, financial reports, invoices, contracts, forms, subpoenas, and more – on its Tor site on June 14, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/australian-clinical-labs-says-patient-data-stolen-in-ransomware-attack/

Drinik Android malware now targets users of 18 Indian banks

A new version of the Drinik Android trojan is targeting 18 Indian banks, masquerading as India’ official tax management app (in the form of an APK named iAssist) to steal victims' personal information and banking credentials. People should avoid APK downloads from outside the Play Store and enable multifactor authentication for logging in to e-banking portals.

See the full report here: https://www.bleepingcomputer.com/news/security/drinik-android-malware-now-targets-users-of-18-indian-banks/

New York Post hacked with offensive headlines targeting politicians

New York Post confirmed that it was hacked after its website and Twitter account were used by attackers to publish offensive headlines and tweets targeting U.S. politicians.

See the full report here: https://www.bleepingcomputer.com/news/security/new-york-post-hacked-with-offensive-headlines-targeting-politicians/

Researchers Expose Over 80 ShadowPad Malware C2 Servers

Researchers have discovered 85 command-and-control (C2) servers supported by the ShadowPad malware since September 2021. ShadowPad is a modular malware platform privately shared among multiple Chinese state-sponsored actors since 2015.

See the full report here: https://thehackernews.com/2022/10/researchers-expose-over-80-shadowpad.html

Apple iOS and macOS Flaw Could've Let Apps Eavesdrop on Your Conversations with Siri

A now-patched security flaw dubbed SiriSpy (CVE-2022-32946) in Apple's iOS and macOS operating systems could have enabled apps with Bluetooth access to eavesdrop on conversations with Siri. The Core Bluetooth issue has been patched in iOS 16.1.

See the full report here: https://thehackernews.com/2022/10/apple-ios-and-macos-flaw-couldve-let.html

New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances

A new cryptojacking campaign (Kiss-a-dog) targets vulnerable Docker and Kubernetes infrastructure as part of opportunistic attacks to illicitly mine cryptocurrency. While such campaigns lost prominence with dropping cryptocurrency prices, multiple campaigns were launched in October to take advantage of a low competitive environment.

See the full report here: https://thehackernews.com/2022/10/new-cryptojacking-campaign-targeting.html

Bed Bath & Beyond reviewing possible data breach

Bed Bath & Beyond Inc disclosed that a third party improperly accessed its data through a phishing scam by accessing the hard drive and certain shared drives of one of its employees. The company is reviewing the data that was accessed to determine whether the drives contained any sensitive or personally identifiable information.

See the full report here: https://www.reuters.com/business/retail-consumer/bed-bath-beyond-reviewing-possible-data-breach-2022-10-28/?utm

U.S. Bank reveals data breach involving some credit card accounts

U.S. Bank is reportedly notifying some of its customers about their personal information being accidentally shared by a third-party vendor. The data breach – which affected about 1,000 customers – revealed names, Social Security numbers, closed account numbers, and outstanding balances.

See the full report here: https://www.nbcnews.com/business/consumer/us-bank-data-breach-impacts-some-credit-card-accounts-rcna54594

High-Severity Flaws in Juniper Junos OS Affect Enterprise Networking Devices

Several high-severity security flaws affecting Juniper Networks devices have been disclosed. Users of Juniper Networks firewalls, routers, and switches are recommended to apply the latest software patch available for Junos OS to mitigate these threats.

See the full report here: https://thehackernews.com/2022/10/high-severity-flaws-in-juniper-junos-os.html

Researchers Uncover Stealthy Techniques Used by Cranefly Espionage Hackers

A hacking group tracked as UNC3524 (or Cranefly) is using a new backdoor called Danfuan (delivered via a dropper called Geppei) to target employees dealing with corporate transactions. Geppei reads commands from Microsoft Internet Information Services (IIS) logs that masquerade as harmless web access requests sent to a compromised server.

See the full report here: https://thehackernews.com/2022/10/researchers-uncover-stealthy-techniques.html

Microsoft releases out-of-band updates to fix OneDrive crashes

Microsoft has released out-of-band updates to address a known issue causing OneDrive and OneDrive for Business to crash after installing recent Windows 10 updates. The updates are available for Windows 10 20H2, Windows 10 21H1, Windows 10 21H2, and Windows 10 22H2. Users can install them manually after downloading from the Microsoft Update Catalog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-out-of-band-updates-to-fix-onedrive-crashes/

New open-source tool scans public AWS S3 buckets for secrets

A new open-source "S3crets Scanner" scanner allows people to search for “secrets” (authentication keys, access tokens, and API keys) mistakenly stored in publicly exposed or a company's Amazon AWS S3 storage buckets. When used periodically to scan an organization's assets, the scanner can help firms minimize the chances of data leaks or network breaches resulting from the exposure of secrets.

See the full report here: https://www.bleepingcomputer.com/news/security/new-open-source-tool-scans-public-aws-s3-buckets-for-secrets/

Exploit released for critical VMware RCE vulnerability, patch now

Proof-of-concept exploit code is now available for a pre-authentication remote code execution (RCE) vulnerability (CVE-2021-39144; CVSSv3 base score of 9.8/10) that allows attackers to execute arbitrary code remotely with root privileges on unpatched Cloud Foundation and NSX Manager appliances. VMware has released security updates to address the bug and also patches for some end-of-life products.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-vmware-rce-vulnerability-patch-now/

New Azov data wiper tries to frame researchers and BleepingComputer

A new and destructive Azov Ransomware data wiper is being distributed through pirated software, key generators, and adware bundles. The threat actors behind the operation falsely claim that the operation is run by several well-known security researchers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-azov-data-wiper-tries-to-frame-researchers-and-bleepingcomputer/

ConnectWise fixes RCE bug exposing thousands of servers to attacks

ConnectWise has released security updates to address a critical vulnerability in the ConnectWise Recover and R1Soft Server Backup Manager (SBM) secure backup solutions. The affected software versions include ConnectWise Recover or earlier and R1Soft SBM v6.16.3 or earlier. Affected ConnectWise Recover SBMs have been automatically updated to the latest version of Recover (v2.9.9), while R1Soft users have been advised to upgrade the server backup manager to SBM v6.16.4.

See the full report here: https://www.bleepingcomputer.com/news/security/connectwise-fixes-rce-bug-exposing-thousands-of-servers-to-attacks/

Largest EU copper producer Aurubis suffers cyberattack, IT outage

German copper producer Aurubis has announced that it suffered a cyberattack that forced it to shut down IT systems to prevent the attack's spread. The company stated that the attack has not impacted production. The company is still assessing the impact of the cyberattack, and is working closely with the authorities to speed up the process.

See the full report here: https://www.bleepingcomputer.com/news/security/largest-eu-copper-producer-aurubis-suffers-cyberattack-it-outage/

Student arrested for running one of Germany’s largest dark web markets

Germany's Federal Criminal Police Office (BKA) has arrested a 22-year-old student suspected of being the administrator of “Deutschland im Deep Web” (DiDW), one of the largest darknet markets in the country. The platform had already gone offline in March 2022, with 16,000 registered users, 28,000 posts, and 72 high-volume sellers of prohibited goods, including weapons and drugs.

See the full report here: https://www.bleepingcomputer.com/news/security/student-arrested-for-running-one-of-germany-s-largest-dark-web-markets/

Google fixes seventh Chrome zero-day exploited in attacks this year

Google has released an emergency security update for the Chrome desktop web browser to address a vulnerability (CVE-2022-3723) known to be exploited in attacks. Chrome users are strongly advised to update their web browsers as soon as possible to block exploitation attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/google-fixes-seventh-chrome-zero-day-exploited-in-attacks-this-year/

Instagram confirms outage following stream of user suspensions

Instagram disclosed that it is investigating reports of users being unable to log in to the platform, while some others got account-suspension notices or saw a reduced follower count.

See the full report here: https://www.bleepingcomputer.com/news/technology/instagram-confirms-outage-following-stream-of-user-suspensions/

Microsoft: Windows domain joins may fail after October updates

Microsoft stated that Windows domain join processes may fail with "0xaac (2732)" errors after applying October 2022 Patch Tuesday security updates. The bug is due to hardening changes introduced when addressing CVE-2022-38042 (an elevation of privilege vulnerability in the Active Directory Domain Services). The company shared some workarounds to deal with this problem.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-domain-joins-may-fail-after-october-updates/

Mozilla Firefox fixes freezes caused by new Windows 11 feature

Mozilla has fixed a known issue causing the Firefox web browser (on Windows 11, version 22H2 systems) to freeze when copying text on devices where the Suggested Actions clipboard feature is enabled. Mozilla has fixed the bug in Firefox 106.0.3 and shared a workaround as well.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-fixes-freezes-caused-by-new-windows-11-feature/

Hackers selling access to 576 corporate networks for $4 million

Hackers are reportedly selling access to 576 corporate networks worldwide for a total cumulative price of USD 4,000,000. As initial access brokers have become an integral part of the ransomware attack chain, it is crucial to secure networks from intrusion by methods including placing remote access servers behind VPNs, restricting access to publicly exposed devices, and enabling MFA.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-selling-access-to-576-corporate-networks-for-4-million/

Chegg sued by FTC after suffering four data breaches within 3 years

The U.S. Federal Trade Commission (FTC) has sued education technology company Chegg after it exposed the sensitive information of millions of customers and employees in four data breaches since 2017.

See the full report here: https://www.bleepingcomputer.com/news/security/chegg-sued-by-ftc-after-suffering-four-data-breaches-within-3-years/

NSA shares supply chain security tips for software suppliers

NSA, CISA, and the Office of the Director of National Intelligence (ODNI) have shared a set of suggested practices for software suppliers to secure the supply chain. The Enduring Security Framework (ESF) will release another advisory focused on the customer (acquiring organizations) part of the software supply chain lifecycle (after issuing the first chapter in September with guidance for software developers).

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-shares-supply-chain-security-tips-for-software-suppliers/

Hacking group abuses antivirus software to launch LODEINFO malware

The Chinese Cicada hacking group (or APT10) was observed abusing security software to install a new version of the LODEINFO malware against Japanese organizations. The malware authors released six new versions of LODEINFO in 2022, the latest being v0.6.7, released in September 2022. APT10's Japan-targeting operations are characterized by constant evolution, expansion of targeted platforms, better evasion, and stealthy infection chains.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-abuses-antivirus-software-to-launch-lodeinfo-malware/

GitHub Repojacking Bug Could've Allowed Attackers to Takeover Other Users' Repositories

GitHub has addressed a high-severity security flaw that could have been exploited to create malicious repositories and supply chain attacks. The RepoJacking technique involves a bypass of a protection mechanism called popular repository namespace retirement, which aims to prevent developers from pulling unsafe repositories with the same name.

See the full report here: https://thehackernews.com/2022/10/github-repojacking-bug-couldve-allowed.html

Cyber officials from 37 countries, 13 companies to meet on ransomware in Washington

The White House will host officials from 37 countries and 13 companies in Washington to address the growing threat of cybercrime. A key topic will be how to disrupt such attacks, counter the illicit movement of cryptocurrencies, and build resilience against such attacks. The White House hopes that the meeting will allow participating countries to institute a set of cyber norms that are recognized across the globe to counter criminal ransomware threats and hold malicious actors accountable.

See the full report here: https://www.reuters.com/technology/cyber-officials-37-countries-13-companies-meet-ransomware-washington-2022-10-31/

Ransomware hackers hit Australian defence communications platform

ForceNet, a communications platform used by Australian military personnel and defense staff, has been reportedly hit with a ransomware attack. There is no evidence yet of breach of the data that the company holds on behalf of defense authorities, but some private information such as dates of birth and enlistment details of military personnel may have been stolen.

See the full report here: https://www.reuters.com/technology/ransomware-hackers-hit-australian-defence-communications-platform-2022-10-31/

Entire voter registry exposed again, this time in Shas party security breach

A security breach in a Shas party database left all details of the 6.5 million citizens on Israel’s voter registry exposed to hackers, with personal information such as phone numbers and family connections available online. Israeli election law gives political parties access to the registry, but forbids handing it to a third party.

See the full report here: https://www.timesofisrael.com/entire-voter-registry-exposed-again-this-time-in-shas-party-security-breach/

Google ad for GIMP.org served info-stealing malware via lookalike site

Google search results displayed an ad for the image-editing software GIMP, which appeared legitimate but would lead users to a lookalike site which contained an infected installer. It still is not clear how the ad displayed the official URL and if it was a slip-up or bug in Google Ad Manager.

See the full report here: https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/

Dropbox discloses breach after hacker stole 130 GitHub repositories

Dropbox has disclosed details of a security breach that involved names and email addresses of employees, past and current customers, sales, and vendors. The phishing attack took place through the use of a fake e-mail impersonating the CircleCi continuous delivery platform and then prompted users for their Github username and password.

See the full report here: https://www.bleepingcomputer.com/news/security/dropbox-discloses-breach-after-hacker-stole-130-github-repositories/

New SandStrike spyware infects Android devices via malicious VPN app

Threat actors are using a recently discovered spyware program known as SandStrike to target adherents of the Baháʼí faith. The malicious VPN is presented as a means for circumventing blocks of religious material and resources. The operation scours the victim's device for sensitive data including call logs and contacts and will also monitor the victims' activity.

See the full report here: https://www.bleepingcomputer.com/news/security/new-sandstrike-spyware-infects-android-devices-via-malicious-vpn-app/

Microsoft fixes critical RCE flaw affecting Azure Cosmos DB

Security analysts have discovered a critical vulnerability in Azure Cosmos DB and provided a proof of concept exploit code. Microsoft confirmed the flaw but noted that the issue only affected a small percentage of users (Azure Cosmos DB customers who use Jupyter Notebooks). The bug has been patched now.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-fixes-critical-rce-flaw-affecting-azure-cosmos-db/

U.S. FCC commissioner to visit Taiwan to discuss cybersecurity, telecoms

The U.S. Federal Communications Commissioner will be the latest senior U.S. official to visit Taiwan. The U.S. de-facto embassy reported that the visit will occur this week and be held to discuss cybersecurity and telecommunications, Taiwan's foreign ministry has declined to comment.

See the full report here: https://theprint.in/world/u-s-fcc-commissioner-to-visit-taiwan-to-discuss-cybersecurity-telecoms/1192452/

Royal Mail data breach as customers' information leaked to other users

The Royal Mail Service experienced a breach where customers could see the information of other users. The service was temporarily suspended as a protective measure.

See the full report here: https://news.sky.com/story/royal-mail-data-breach-as-customers-information-leaked-to-other-users-12735690

OpenSSL fixes two high severity-vulnerabilities

The OpenSSL Project has patched two high-severity security flaws (CVE-2022-3602 and CVE-2022-3786) in its open-source cryptographic library used to encrypt communication channels and HTTPS connections. The bugs affect OpenSSL version 3.0.0 and later and have been addressed in OpenSSL 3.0.7.

See the full report here: https://www.bleepingcomputer.com/news/security/openssl-fixes-two-high-severity-vulnerabilities-what-you-need-to-know/

Multiple Vulnerabilities Reported in Checkmk IT Infrastructure Monitoring Software

Several security vulnerabilities (two critical and two medium) were discovered in Checkmk IT Infrastructure monitoring software. These vulnerabilities on their own have a limited scope; however, an adversary can chain the issues together to exploit them further to bypass authentication and read the config files, and finally use them for remote code execution. The bugs have been patched in Checkmk version 2.1.0p12.

See the full report here: https://thehackernews.com/2022/11/multiple-vulnerabilities-reported-in.html

Dozens of PyPI packages caught dropping "W4SP" info-stealing malware

Researchers have discovered over two dozen Python packages on the PyPi registry that are pushing info-stealing malware, which can steal Chrome passwords, browser cookies, Discord tokens and upload them all to a Discord web-hook.

See the full report here: https://www.bleepingcomputer.com/news/security/dozens-of-pypi-packages-caught-dropping-w4sp-info-stealing-malware/

Vodafone Italy discloses data breach after reseller hacked

Vodafone Italy is sending its customers a notice of a data breach, which resulted in the compromise of sensitive subscriber data, identity documents, and contact details. The notice clarifies that no account passwords or network traffic has been released as part of the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/vodafone-italy-discloses-data-breach-after-reseller-hacked/

Hundreds of U.S. news sites push malware in supply-chain attack

Threat actors are using the compromised infrastructure of an undisclosed media company to deploy the SocGholish JavaScript malware framework (also known as FakeUpdates) on the websites of hundreds of newspapers. The malware has been installed on sites belonging to more than 250 U.S. news outlets – some of them being major news organizations – in cities including New York, Boston, Chicago, Miami, and Washington, D.C.

See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-us-news-sites-push-malware-in-supply-chain-attack/

Emotet botnet starts blasting malware again after 5 month break

The Emotet malware operation is again spamming malicious emails after almost a five-month hiatus. Emotet is a malware infection distributed through phishing campaigns containing malicious Excel or Word documents. Considered the most distributed malware in the past, it suddenly stopped spamming on June 13, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-again-after-5-month-break/

U.S. govt employees exposed to mobile attacks from outdated Android, iOS

Almost half of the Android-based mobile phones used by U.S. state and local government employees are exposed to hundreds of vulnerabilities as they are running outdated versions of the operating system. Thee U.S. Cybersecurity & Infrastructure Agency (CISA) has created a “Known Exploited Vulnerabilities Catalog” and sets a deadline by which federal agencies must patch the bugs. However, state, local, and tribal governments are not mandated to adhere to the CISA guidelines.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-employees-exposed-to-mobile-attacks-from-outdated-android-ios/

Bed Bath & Beyond's technology chief resigns after possible data breach

The customer and technology chief of Bed Bath & Beyond Inc will step down, days after the company reported a possible data breach. The company is still reviewing if the breached drives had any sensitive or personally identifiable information.

See the full report here: https://www.reuters.com/business/retail-consumer/bed-bath-beyonds-technology-chief-resigns-after-possible-data-breach-2022-11-02/#:~:text=Nov%202%20(Reuters)%20%2D%20Bed,reported%20a%20possible%20data%20breach.

Harcourts Melbourne City real estate agency advises customers of data breach

Australian real estate company Harcourts suffered a data breach, potentially exposing customers' names, addresses, and bank details to hackers. The company has reportedly revoked access and added new layers of protection after the data breach. It is unclear how many people have been impacted by the breach.

See the full report here: https://www.abc.net.au/news/2022-11-02/harcourts-melbourne-real-estate-agent-stafflink-data-breach/101608270