Threat Intelligence Bulletin: 11/04/2022 - 11/10/2022

Microsoft Patch Tuesday 11/09/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for November 2022 contained 68 vulnerabilities in total, with:

• 11 vulnerabilities rated as Critical
• 6 zero-day vulnerabilities, all of which are actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

This month’s security updates contain patches for a previously disclosed and reported bug (CVE-2022-41091) – a Security Feature Bypass of “Windows Mark of the Web,” which flags files from untrusted sources. This batch of security updates also includes fixes for the set of vulnerabilities dubbed ProxyNotShell (CVE-2022-41040 and CVE-2022-41082).

Most notable vulnerabilities

Microsoft has listed six zero-day vulnerabilities (CVE-2022-41128, CVE-2022-41073, CVE-2022-41125, CVE-2022-41091, CVE-2022-41040, and CVE-2022-41082) among the bugs fixed in the November Patch Tuesday security update. All of these zero-day vulnerabilities are being actively exploited in the wild.

CVE-2022-41128

CVE-2022-41128 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, because of a flaw in the Network Scripting Languages component. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Windows Server 2012 R2
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41073

CVE-2022-41073 (CVSS score: 7.8) is a Privilege Escalation bug. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, because of a flaw in the Print Spooler component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41125

CVE-2022-41125 (CVSS score: 7.8) is an elevation of privilege vulnerability. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the CNG Key Isolation Service component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41091

CVE-2022-41091 (CVSS score: 5.4) is a Security Bypass vulnerability. Microsoft Windows could allow a remote attacker to bypass security restrictions, caused by a flaw in the Mark of the Web Security feature. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to bypass security features.

The following products are affected:

• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41040

CVE-2022-41040 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Exchange Server can be vulnerable to server-side request forgery (SSRF), because of improper validation of user-supplied input within the Exchange OWA interface. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to conduct an SSRF attack.

The following products are affected:

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-41082

CVE-2022-41082 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw when PowerShell is accessible. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Exchange Server 2013 Cumulative Update 23

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Q3 2022 Manufacturing Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-11-09a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Manufacturing Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The manufacturing sector remained a prime target for malicious actors in Q3 2022 due to its key role in critical infrastructure and the global economy. ZeroFox Intelligence assesses that the threat to the sector will increase in the coming months amidst geopolitical and economic strain, underpinned by politically-inspired targeting. In Q3 2022, manufacturers faced an increased threat from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online Version 2. (FIDO2) and certificate-based authentication. Exploit disclosure in Information Technology and Operational Technology infrastructure continued at a high pace, with threat actors leveraging vulnerabilities in past end-of-life products. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. Digital extortion attempts against manufacturing targets continued to fall, likely caused in part by difficulty eliciting victims’ payments, although ZeroFox Intelligence has observed an increase in attacks against “big game” manufacturing targets. In coming months, the industry is likely to see an increase in politically-motivated extortion targeting.

Key Findings

• Manufacturing organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Manufacturing organizations continued to face a high risk of threat actors leveraging exploits in products past end-of-life use.
• Advertisements for illicit access into manufacturing organizations plateaued, bucking a downward trend seen in other sectors.
• Despite a likely reduction in threat from ransomware and digital extortion, ZeroFox Intelligence observed an increase in attacks against “big game” manufacturing organizations.
• ZeroFox Intelligence assesses the threats facing the manufacturing sector will more likely than not develop significantly over the next two quarters.

Q3 2022 Energy Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-11-09b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Energy Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assesses that the energy sector saw one of the biggest increases in threat of any sector in Q3 2022, with the ongoing war in Ukraine and subsequent economic crisis continuing to shape the cyber threat landscape. ZeroFox Intelligence assesses that the threat to the sector will continue to increase in the coming months, underpinned by politically-inspired targeting. In Q3 2022, there were likely increases in particular aspects of the social engineering threat to energy organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2. (FIDO2) and certificate-based authentication. Exploit disclosure in Information Technology and Operational Technology infrastructure continued at a high pace, with threat actors leveraging vulnerabilities in past end-of-life products. The Initial Access Broker (IAB) market, which is underpinning the ransomware and digital extortion threat to energy firms, is shifting towards sales being made in private channels rather than advertising in open forums. This will likely make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. ZeroFox Intelligence has identified an increase in threat from ransomware and digital extortion, bucking a trend seen in other sectors, with a rise in attacks against “big game” energy targets. In coming months, the industry is likely to see an increase in politically-motivated extortion targeting.

Key Findings

• Energy organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Energy organizations continued to face a high risk of threat actors leveraging exploits in products past end-of-life use.
• IABs likely increasingly sold access to energy firms in the United States and Europe to ransomware operators via private channels, underpinning the increased threat the sector has faced from digital extortion.
• The ransomware and digital extortion threat to the energy sector likely increased, bucking an overall downward trend seen in other sectors.
• ZeroFox Intelligence assesses the threats facing the energy sector will more likely than not develop significantly over the next two quarters.

Breaking News: 2022-11-04 - 2022-11-10

International summit agrees crackdown on crypto to combat ransomware

At the White House's second Counter Ransomware Initiative Summit, the 36-nation group announced a crackdown on the use of cryptocurrency for ransomware operations. Sharing information on the wallets used for money laundering, blockchain tracing and analytics, and developing an active information sharing between public and private entities were listed as critical necessities in the summit.

See the full report here: https://www.theregister.com/2022/11/03/ransomware_summit_cryptocurrency/

Hackers Using Rogue Versions of KeePass and SolarWinds Software to Distribute RomCom RAT

The operators of RomCom RAT Malware are distributing infected versions of SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro via fake websites. Victims targeted by the operation primarily included people in Ukraine and English-speaking countries like the United Kingdom.

See the full report here: https://thehackernews.com/2022/11/hackers-using-rogue-versions-of-keepass.html

OPERA1ER APT Hackers Targeted Dozens of Financial Organizations in Africa

A French-speaking threat actor OPERA1ER (or DESKTOP-GROUP, Common Raven, and NXSMS) has been linked to more than 30 successful cyber attacks on banks, financial services, and telecom companies across Africa, Asia, and Latin America between 2018 and 2022. There are reportedly no zero-day threats in OPERA1ER's arsenal, and the attacks often use exploits for vulnerabilities discovered years ago.

See the full report here: https://thehackernews.com/2022/11/researchers-detail-opera1er-apt-attacks.html

New TikTok Privacy Policy Confirms Chinese Staff Can Access European Users' Data

TikTok is updating its privacy policy to make it explicitly clear that the user data can be accessed by employees from across the globe, including China. While Bytedance has repeatedly denied allegations of being controlled by the Chinese government, it has continued to give rise to new controversies over privacy practices and data handling.

See the full report here: https://thehackernews.com/2022/11/new-tiktok-privacy-policy-confirms.html

LockBit ransomware claims attack on Continental automotive giant

The Lockbit ransomware group has claimed responsibility for an attack on the German automobile giant, Continental. Lockbit reportedly stole some data from the company's systems and threatened to publish it on its data leak site if the company did not accept the demands within 22 hours.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-attack-on-continental-automotive-giant/

ALMA Observatory shuts down operations due to a cyberattack

The Atacama Large Milimeter Array (ALMA) Observatory in Chile has suspended operations and taken its website offline following a cybersecurity attack. E-mail services at the observatory are currently limited and specialists have begun work towards the restoration of systems. The staff clarified that the attack did not compromise the ALMA antennas or any scientific data, indicating that there were no signs of unauthorized data access.

See the full report here: https://www.bleepingcomputer.com/news/security/alma-observatory-shuts-down-operations-due-to-a-cyberattack/

New clipboard hijacker replaces crypto wallet addresses with lookalikes

A new clipboard hijacker named "Laplas Clipper" is using wallet addresses that look similar to the target recipient's address. The tool offers users sophisticated and granular access and control over hijacking operations along with a web-based monitoring panel. It is unclear how the attackers generate the similar wallet addresses at near real-time to dupe users.

See the full report here: https://www.bleepingcomputer.com/news/security/new-clipboard-hijacker-replaces-crypto-wallet-addresses-with-lookalikes/

Researchers Find Links b/w Black Basta Ransomware and FIN7 Hackers

Security researchers have discovered links between the Black Basta ransomware operation and the FIN7 (aka Carbanak) group. This link suggests that either Black Basta and FIN7 maintain a special relationship or that one or more individuals belong to both groups.

See the full report here: https://thehackernews.com/2022/11/researchers-find-links-bw-black-basta.html

New Crimson Kingsnake gang impersonates law firms in BEC attacks

A business-email compromise (BEC) group called "Kingsnake" is impersonating well-known international firms. The threat actors pretend to be lawyers sending invoices for overdue payment of services that were supposedly provided to the recipient firm over a year ago. The group operates about 100 different domains, all which are similar to the names of genuine firms.

See the full report here: https://www.bleepingcomputer.com/news/security/new-crimson-kingsnake-gang-impersonates-law-firms-in-bec-attacks/

Microsoft Warns of Uptick in Hackers Leveraging Publicly-Disclosed 0-Day Vulnerabilities

Microsoft warned users that nation-state and criminal actors are increasing their use of publicly-disclosed zero-day bugs in attacks. Microsoft noted that it takes only 14 days on average for an exploit to be available in the wild after its public disclosure.

See the full report here: https://thehackernews.com/2022/11/microsoft-warns-of-uptick-in-hackers.html

Researchers Detail New Malware Campaign Targeting Indian Government Employees

The Transparent Tribe threat actor (also known as APT36, Operation C-Major, and Mythic Leopard) has been linked to a new campaign aimed at Indian government organizations with trojanized versions of a two-factor authentication called "Kavach." The group abuses Google ads to distribute malware, and performs credential harvesting attacks using malicious websites masquerading as official Indian government portals.

See the full report here: https://thehackernews.com/2022/11/researchers-detail-new-malware-campaign.html

CISA Warns of Critical Vulnerabilities in 3 Industrial Control System Software

The US Cybersecurity & Infrastructure Agency (CISA) has published three Industrial Control Advisories about vulnerabilities in software from Nokia, ETIC Telecom, and Delta Industrial Automation. Most notable among them is a set of three flaws affecting ETIC Telecom's Remote Access Server (RAS), which could allow an attacker to obtain sensitive information and compromise the vulnerable device and other connected machines.

See the full report here: https://thehackernews.com/2022/11/cisa-warns-of-critical-vulnerabilities.html

Z-Library eBook site domains seized by U.S. Dept of Justice

Domains of the popular online e-book repository Z-Library have been seized by the U.S. Department of Justice. Zlibrary was ranked among the top 10,000 websites visited frequently and offered over 11 million books for free via its website. Even though the clearnet sites are unavailable, Z-Library is still accessible via its Tor Onion address.

See the full report here: https://www.bleepingcomputer.com/news/technology/z-library-ebook-site-domains-seized-by-us-dept-of-justice/

British government is scanning all Internet devices hosted in UK

The United Kingdom's National Cyber Security Centre (NCSC) is scanning all internet-exposed devices hosted in the United Kingdom for vulnerabilities – with the goal to understand the nation's security position. Requests are designed to harvest the minimum amount of data to check if the scanned device is affected by a vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/british-govt-is-scanning-all-internet-devices-hosted-in-uk/

As Twitter brings on $8 fee, phishing emails target verified accounts

Several phishing emails have been observed targeting verified Twitter users, soon after the company announced plans to charge users USD 8 a month for Twitter Blue and account verification. These emails – originating from servers of hacked websites and blogs – convey a false sense of urgency, urging the user to sign-in to their Twitter account or risk suspension.

See the full report here: https://www.bleepingcomputer.com/news/security/as-twitter-brings-on-8-fee-phishing-emails-target-verified-accounts/

Microsoft sued for open-source piracy through GitHub Copilot

A lawsuit has been filed against Microsoft, GitHub, and OpenAI, alleging that GitHub's copilot tool violates the term of open-source licenses and infringes upon the rights of programmers. The tool was trained using machine learning using millions of lines of code from public open-source repositories, often without the explicit notification of the author of the code involved.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-sued-for-open-source-piracy-through-github-copilot/

FBI: Hacktivist DDoS attacks had minor impact on critical orgs

The FBI disclosed that DDoS attacks launched by hacktivist groups have minimal impact on the services that they target. The reduced impact is because of the targeting public-facing infrastructure (such as websites) rather than the actual services.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-hacktivist-ddos-attacks-had-minor-impact-on-critical-orgs/

ACE seizes 42 soccer and live TV piracy web domains with millions of visitors

The Alliance for Creativity and Entertainment (ACE) shut down 42 websites for the pirated streaming of televised soccer games and live TV, seizing their domains and taking down the illegal streaming services. The websites were drew a majority of their traffic from Argentina.

See the full report here: https://www.bleepingcomputer.com/news/technology/ace-seizes-42-soccer-and-live-tv-piracy-web-domains-with-millions-of-visitors/

Robin Banks phishing service returns to steal banking accounts

The Robin Banks phising-as-a-service (PhaaS) platform has resumed operations – after a four-month gap – with infrastructure hosted by a Russian internet company that provides protection against DDoS attacks. Among the new features are bypassing multi-factor authentication (MFA) and a redirector to avoid detection.

See the full report here: https://www.bleepingcomputer.com/news/security/robin-banks-phishing-service-returns-to-steal-banking-accounts/

Medibank refuses to pay ransom for hacked data as affected customer number doubles to 9.7 million

Medibank announced that no ransom payment would be made to the criminals responsible for the recent data hack. The company stated that its position is consistent with the position of the Australian government, specifying that there is only a limited chance that paying a ransom would ensure the return of the customer data and prevent it from being published. The company believes that the criminals accessed the name, date of birth, address, phone number, and e-mail address of 9.7 million customers.

See the full report here: https://www.abc.net.au/news/2022-11-07/medibank-refuses-to-pay-ransom-data-hack-cyber-attack/101622914

Experts Find URLScan Security Scanner Inadvertently Leaks Sensitive URLs and Data

Security researchers have warned of a "trove of sensitive information" leaking through urlscan.io, a website scanner for malicious URLs. The leaks included sensitive personal pages, password reset links, shared documents, and payment invoices, all of which were publicly searchable and could be accessed by anyone.

See the full report here: https://thehackernews.com/2022/11/experts-find-urlscan-security-scanner.html

Azov Ransomware is a wiper, destroying data 666 bytes at a time

The Azov ransomware continues to be heavily distributed worldwide, and is now proven to be a data wiper which destroys the target's data and infects other software. The malware was distributed through pirated content and software, and then the malware pretended to encrypt the data of users.

See the full report here: https://www.bleepingcomputer.com/news/security/azov-ransomware-is-a-wiper-destroying-data-666-bytes-at-a-time/

U.S. unmasks hacker who stole 50,000 bitcoins from Silk Road

The U.S. Department of Justice announced the conviction of James Zhong, a hacker who had stolen 50,000 bitcoins from the “Silk Road” darknet marketplace. Zhong pleaded to money laundering schemes for exploiting an "withdrawal processing flaw" that allowed him to withdraw many times more bitcoin than he had deposited on the marketplace.

See the full report here: https://www.bleepingcomputer.com/news/security/us-unmasks-hacker-who-stole-50-000-bitcoins-from-silk-road/

Maple Leaf Foods suffers outage following weekend cyberattack

Maple Leaf Foods disclosed that it experienced a cyberattack that caused a system outage and disruption of operations. The food packaging giant reported that its IT team took immediate action to deal with the problem and is now working with cybersecurity experts to resolve it. The company announced that it would work with customers and partners to reduce any impact or delay in operations.

See the full report here: https://www.bleepingcomputer.com/news/security/maple-leaf-foods-suffers-outage-following-weekend-cyberattack/

Ransomware gang threatens to release stolen Medibank data

A ransomware gang tracked as BlogXX (and believed by some security researchers to be a relaunch of REvil) claimed responsibility for the October 2022 attack on Australian health insurance provider Medibank. The ransomware group stated that it would release the stolen data within 24 hours. It is not yet known how much data was stolen, nor has any proof been provided so far for the claims.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-release-stolen-medibank-data/

F1 teams and personnel face cybersecurity threat by global hacking network

F1 Teams and personnel were victims of an attack conducted by a global hacking group based out of India. The group known as "WhiteInt" operate from the Indian city Gurugram and reportedly launched the attack on behalf of private investigator groups used by major law firms operating from London.

See the full report here: https://thesportsrush.com/f1-news-f1-teams-and-personnel-face-cybersecurity-threat-by-global-hacking-network/

LockBit affiliate uses Amadey Bot malware to deploy ransomware

A Lockbit 3.0 affiliate is using phishing emails that install the Amadey Bot to take control of and encrypt devices. The threat actor targets companies using phishing emails with lures pretending to be job application offers or copyright infringement notices.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-affiliate-uses-amadey-bot-malware-to-deploy-ransomware/

Malicious extension lets attackers control Google Chrome remotely

A new Chrome browser botnet named "Cloudy" was observed using malicious code to steal online accounts, log keystrokes, inject ads and js code and enlists the victim's browser in DDos Attacks. The Remote Access Tool (RAT) was developed for Chromium-based browsers such as Google Chrome and Microsoft Edge.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-extension-lets-attackers-control-google-chrome-remotely/

VMware fixes three critical auth bypass bugs in remote access tool

VMWare has released security updates to address three critical security vulnerabilities (CVE-2022-31685, CVE-2022-31686, and CVE-2022-31687; CVSS v3 base score: 9.8/10) that enable remote attackers to bypass authentication and elevate privileges to admin level. Non-authenticated threat actors could exploit them in low-complexity attacks that do not require user interaction for privilege escalation. The bugs were patched in Workspace ONE Assist 22.10 (89993) for Windows customers.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-three-critical-auth-bypass-bugs-in-remote-access-tool/

Microsoft fixes ProxyNotShell Exchange zero-days exploited in attacks

Microsoft has released security updates to address two-high level security vulnerabilities (CVE-2022-41082 and CVE-2022-41040) collectively known as ProxyNotShell, which are exploited in the wild. Attackers chained them together to deploy Chinese Chopper web shells on compromised servers for persistence and data theft.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-proxynotshell-exchange-zero-days-exploited-in-attacks/

Citrix urges admins to patch critical ADC, Gateway auth bypass

Citrix has urged its customers to install security updates for a critical authentication bypass vulnerability in Citrix ADC and Citrix Gateway. Through abuse of certain configurations, the three vulnerabilities enable attackers to gain unauthorized access to a device, perform remote desktop takeover, or bypass the login brute force protection.

See the full report here: https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-critical-adc-gateway-auth-bypass/

Influencer "Hushpuppi" gets 11 years in prison for cyber fraud

An Instagram influencer known as "Hushpuppi" has been sentenced to 11 years in prison for conspiring to launder tens of millions of USD from business email compromise (BEC) scams and various cyber schemes.

See the full report here: https://www.bleepingcomputer.com/news/security/influencer-hushpuppi-gets-11-years-in-prison-for-cyber-fraud/

Suspected Medibank hacker post stolen data on dark web forum

A ransomware group has begun posting customer data stolen from Australia’s largest health insurer, Medibank Private. Cybersecurity experts who have viewed the leaked data have confirmed that it includes customers’ names, postal codes, and data on health treatment for issues such as cocaine addiction and other issues. Medibank dismissed reports that the data release included HIV treatment information.

See the full report here: https://www.smh.com.au/business/companies/suspected-medibank-hackers-post-stolen-data-20221109-p5bwo1.html

Microsoft November 2022 Patch Tuesday fixes 6 exploited zero-days, 68 flaws

Microsoft's November 2022 Patch Tuesday updates come with fixes for six actively exploited Windows vulnerabilities and a total of 68 security flaws. Eleven of the 68 vulnerabilities fixed in today's update are classified as "Critical" as they allow privilege elevation, spoofing, and remote code execution.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2022-patch-tuesday-fixes-6-exploited-zero-days-68-flaws/

Lenovo fixes flaws that can be used to disable UEFI Secure Boot

Lenovo has fixed two high-severity vulnerabilities (CVE-2022-3430 and CVE-2022-3431) – affecting various ThinkBook, IdeaPad, and Yoga laptop models – that could allow an attacker to deactivate UEFI Secure Boot. The consequences of running unsigned, malicious code before OS boot are significant, as threat actors can bypass all security protections to plant malware that persists between OS reinstallations.

See the full report here: https://www.bleepingcomputer.com/news/security/lenovo-fixes-flaws-that-can-be-used-to-disable-uefi-secure-boot/

Couple sentenced to prison for trying to sell nuclear warship secrets

A U.S. Navy nuclear engineer and his wife were sentenced to over 19 years and more than 21 years in prison for attempting to sell nuclear warship design secrets to whom they believed was a foreign power agent but was actually an undercover FBI agent. The two defendants tried selling restricted information such as printouts, technical details, and operations manuals.

See the full report here: https://www.bleepingcomputer.com/news/security/couple-sentenced-to-prison-for-trying-to-sell-nuclear-warship-secrets/

New hacking group uses custom "Symatic" Cobalt Strike loaders

A previously unknown Chinese hacking group dubbed "Earth Longzhi" targets organizations in East Asia, Southeast Asia, and Ukraine using custom versions of Cobalt Strike loaders to plant persistent backdoors on victims' systems. APT groups increasingly rely on commodity malware and attack frameworks like Cobalt Strike to obscure their trace and make attribution difficult. By following these tactics, they managed to stay undetected for at least 2.5 years.

See the full report here: https://www.bleepingcomputer.com/news/security/new-hacking-group-uses-custom-symatic-cobalt-strike-loaders/

15,000 sites hacked for massive Google SEO poisoning campaign

Hackers are conducting a massive black hat search engine optimization (SEO) campaign by compromising almost 15,000 websites to redirect visitors to fake Q&A discussion forums. The researchers believe the threat actors' goal is to generate enough indexed pages to increase the fake Q&A sites' authority and thus rank better in search engines.

See the full report here: https://www.bleepingcomputer.com/news/security/15-000-sites-hacked-for-massive-google-seo-poisoning-campaign/

New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world. IceXLoader is a commodity malware sold for USD 118 on underground forums for a lifetime license. It is primarily used to download and execute additional malware on breached hosts.

See the full report here: https://thehackernews.com/2022/11/new-icexloader-malware-loader-variant.html

North Korea attempted to hack, siphon funds from an Israeli company

North Korea-based hackers tried to hack into the systems of an Israeli company that deals in the field of cryptocurrency. The goal was reportedly to use that money to support the North Korean nuclear program. The intrusion attempt was detected and foiled by cybersecurity personnel.

See the full report here: https://www.jpost.com/breaking-news/article-721742

Google Chrome: Apply new security update now to fix these six "high severity" bugs

Google has released a security update to fix ten security vulnerabilities in Google Chrome. A few of these bugs could allow remote attackers to crash vulnerable systems. Six of the updates have been classified as "high severity," meaning updates should be applied as soon as possible.

See the full report here: https://www.zdnet.com/article/google-chrome-security-update-fixes-six-high-severity-vulnerabilities-which-attackers-could-use-to-crash-your-computer/

New StrelaStealer malware steals your Outlook, Thunderbird accounts

A new information-stealing malware named. "StrelaStealer" is actively stealing email account credentials from Outlook and Thunderbird, two widely used email clients. This behavior deviates from most info-stealers, which attempt to steal data from various data sources, including browsers, cryptocurrency wallet apps, cloud gaming apps, the clipboard, etc

See the full report here: https://www.bleepingcomputer.com/news/security/new-strelastealer-malware-steals-your-outlook-thunderbird-accounts/

A hacking group stole USD 11 million from 12 African countries

12 African countries have reportedly lost millions of dollars to a hacking group named OPERA1ER, which relies solely on known off-the-shelf tools. The group, based in a French-speaking African country, managed to launch over 30 successful attacks against banks, financial services providers, and telecommunication companies between 2018 and 2022.

See the full report here: https://finance.yahoo.com/news/hacking-group-stole-11-million-143000916.html

Justice Blade Hackers are Targeting Saudi Arabia

A hacker group called "Justice Blade" has published leaked data from Smart Link BPO Solutions, an outsourcing IT vendor working with major enterprises and government agencies in Saudi Arabia. The actors claim to have stolen CRM records, personal information, email communications, contracts, account credentials, and more.

See the full report here: https://cyware.com/news/justice-blade-group-targets-saudi-arabian-giants-f2661986/?web_view=true

APT29 Exploited a Windows Feature to Compromise European Diplomatic Entity Network

Russia-linked actor APT29 (or Cozy Bear / Iron Hemlock / The Dukes) is leveraging a "lesser-known" Windows feature called Credential Roaming as part of its attack against an unnamed European diplomatic entity. The espionage group is known for its intrusions aimed at collecting intelligence that align with Russia's strategic objectives.

See the full report here: https://thehackernews.com/2022/11/apt29-exploited-windows-feature-to.html

Several Cyber Attacks Observed Leveraging IPFS Decentralized Network

A number of phishing campaigns are leveraging the decentralized Interplanetary Filesystem (IPFS) network to host malware, phishing kit infrastructure, and facilitate other attacks. IPFS has been used to serve rogue landing pages to steal credentials and distribute a wide range of malware comprising Agent Tesla, reverse shells, data wiper, and an information stealer called Hannabi Grabber.

See the full report here: https://thehackernews.com/2022/11/several-cyber-attacks-observed.html

Experts Warn of Browser Extensions Spying On Users via Cloud9 Chrome Botnet Network

The "Keksec" threat actor has been linked to a previously undocumented malware strain (Cloud9), which has been observed in the wild masquerading as an extension for Chromium-based web browsers. The extension comes with a wide range of features that enable it to steal cookies, log keystrokes, inject arbitrary JavaScript code, mine crypto, and even use the host for DDoS attacks.

See the full report here: https://thehackernews.com/2022/11/experts-warn-of-browser-extensions.html