Threat Intelligence Bulletin: 11/11/2022 - 11/17/2022

Threat Landscape: Black Friday & Cyber Monday 2022

Product Serial: B-2022-11-11a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Threat Landscape for Black Friday & Cyber Monday 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on November 9, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Black Friday and Cyber Monday (BFCM) are two of the busiest shopping days on the retail calendar and a prime period for malicious actors to target consumers. Black Friday is the name given to the Friday after Thanksgiving in the United States and has traditionally marked the start of the holiday shopping season. It is one of the busiest days of the year for retailers and consumers, with extensively promoted sales and discounted prices both online and in-store. In 2022, Black Friday falls on November 25, though promotions and discounts begin up to a month in advance. Cyber Monday refers to the Monday following Black Friday and falls on November 28 this year. Sales forecasts indicate that BFCM 2022 is anticipated to be larger in sales than previous years despite strained economic and geopolitical circumstances.

Threat actors using BFCM to target retailers and consumers in recent years have had a variety of motivations, including financial gain, political persuasion, and activism. Attacks occur in both the physical and cyber domains. BFCM represents an opportunity for cyber threat actors to hide amongst the excitement about and rapid increase in retail activity, leveraging the urgency and enthusiasm generated by the holiday sales to defraud victims. Both retailers and consumers are attractive targets. Malicious cyber activity during recent BFCMs highlighted the efficacy of leveraging human error to scam customers. Retailers face a host of potential business threats, including impersonations, distributed denial of service attacks (DDoS), and e-commerce skimming malware.

Key Findings

• Sales forecasts indicate that Black Friday and Cyber Monday 2022 are anticipated to be larger in sales than in previous years.
• ZeroFox Intelligence assesses that social engineering will almost certainly remain one of the most prolific ways financially-motivated threat actors target shoppers.
• We expect an increase in SMS-based phishing scams and callback phishing throughout the Black Friday and Cyber Monday 2022 timeframe.
• We anticipate malicious actors will leverage fraudulent domains during BFCM 2022 to: dupe unsuspecting victims into purchasing fake items, harvest financial information, or deploy malware.
• Threat actors will most likely advertise fake or misleading discounts or prizes in social media posts that contain links to malicious websites.
• Consumers should be particularly wary of being contacted about BFCM 2022 sales via unsolicited direct messages.
• ZeroFox Intelligence has not identified threat actors or groups planning to target retail locations on Black Friday.
• Recent acts of vandalism against retail locations - carried out by activists - highlight a tactic to consider for proactive prevention of would-be Black Friday demonstrations.

G20 Summit Event Assessment

Product Serial: A-2022-11-11a

TLP: CLEAR

ZeroFox Intelligence is proud to announce the release of our assessment for the 7th Annual Group of 20 (G20) summit.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:30 AM (EST) on November 11, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Popular Indonesian tourist destination Bali will be hosting the 17th Annual Group of 20 (G20) summit from November 15–16, 2022. Residents and visitors will begin to experience physical security preparations as early as November 11, when drivers will be restricted by their license plates on certain roadways until November 18. The conference is especially notable because it will be the first gathering of global leaders since Russia’s war in Ukraine. However, Russian President Vladimir Putin will not be attending given the criticism over the war’s humanitarian and cost-of-living impacts, which are expected to feature prominently. Leaders from the other 18 largest economies will be in attendance, plus a seat for the European Union (EU). This includes a planned meeting between U.S. President Joe Biden and Chinese President Xi Jinping, who recently secured a third term in leadership that will likely see him remain leader of China for the rest of his life. The relationship between the two countries is tense over Taiwan and recent U.S. export rules that prohibit Chinese access to advanced technology.

Efforts to solve the global cost-of-living and energy crises will also continue during the summit; many of the leaders will have recently attended the COP27 environmental summit in Egypt as well as the ASEAN summit in Phnom Penh, where both Biden and Xi were expected. Lastly, the G20 precedes the Asian-Pacific Economic Conference in Bangkok, which will be headlined by U.S. Vice President Kamala Harris. The presence of three major international summits in the same geographic region occurring in the same week with important political leaders at all three increases the risk of nation-state and hacktivist activity. The G20 also has added physical security and cyber risks, as it is taking place at a popular tourist destination. Bali and Indonesia experienced a series of damaging al-Qaeda attacks in the early 2000s. However, coordinated counter-terrorism efforts over the last 10 years have significantly weakened jihadist groups in the region, making a terror attack unlikely. Similarly, protest groups are not predicated to gather en masse the way they have for previous summits.

Indonesia has a relatively poor recent cybersecurity record with several notable cyber breaches related to government-held data. This includes a late 2021 data breach on its COVID-19 tracking app, which delegates are still required to download. Threat actors may attempt to obtain sensitive personal information from delegates or visitors by impersonating apps and websites, such as those of hotels, G20-related events, and tourism services on the island. Given that G20 is occurring between two other major international summits, cyber threat actors have a larger window than normal to threaten world leaders. Heightened geopolitical rhetoric on account of Russia’s war in Ukraine and tensions between the United States and China, coupled with financial motivations, could give cyber threat actors added incentive to target any of the three major summits.

Key Findings

• Indonesia is requiring delegates to download a COVID-19 tracing app that was compromised in 2021.
• Indonesia has a weak record protecting government-held data; it has experienced a series of cyberattacks and data breaches since 2020.
• Security will be tight around the series of venue locations and the over 20 sponsoring hotels providing accommodations.
• Travel through the local airport and along major roadways will be restricted by license plates.
• Russian President Vladimir Putin will not attend but Ukrainian President Volodymyr Zelinsky will.
• U.S. President Joe Biden is planning to meet with Chinese President Xi Jinping.
• Important global summit ASEAN will be held before G20 and APEC falls afterward, where more consequential trade and political agreements could be reached.

Breach Disclosure: Sosedi

On August 20, 2022, a threat actor from BreachForums posted a data breach package targeting Sosedi, a retail chain operating across Belarus. The threat actor noted that the data package includes 641,000 lines of user records. From this package, ZeroFox extracted 629,141 email addresses, hashed passwords, and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 20, 2022, a reputed threat actor "MOSSAD" from BreachForums posted a data breach package targeting Sosedi, a chain of stores throughout Belarus that sells food and groceries. The threat actor noted that the data package includes 641,000 lines of user records. The data package was also circulated in Telegram channels like "KelvinSecurity - Dark Market & Leaks" on July 12, 2022 and in "Worldwide Logs And Databases" on July 8, 2022. From the package published on BreachForums, ZeroFox extracted 629,141 email addresses, hashed passwords, and/or usernames. Other notable data fields observed in this package include name, gender, date of birth, phone number, postal address, and company.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 2, Issue 21

Welcome back to The Underground Economist, Volume 2, Issue 21, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of November 11, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Breaking News: 2022-11-11 - 2022-11-17

Warning: New Massive Malicious Campaigns Targeting Top Indian Banks' Customers

Cybersecurity researchers are warning Americans of massive phishing campaigns that distribute five different malware targeting banking customers in India. The bank customers targeted include account subscribers of seven banks including some of the most well-known banks located in the country and potentially affecting millions of customers. Some of the targeted banks include Axis Bank, ICICI Bank, and the State Bank of India (SBI), among others.

See the full report here: https://thehackernews.com/2022/11/warning-this-widespread-malicious.html

Hacker Rewarded USD 70,000 for Finding Way to Bypass Google Pixel Phones' Lock Screens

Google has released patches for a high-severity security issue affecting all Pixel smartphones that could be exploited to bypass lockscreens. The vulnerability, tracked as CVE-2022-20465 and reported back in June 2022, was resolved in November 2022. The issue allowed an attacker with physical access to bypass the lock screen protections (fingerprint, PIN, etc.) and gain complete access to the user's device.

See the full report here: https://thehackernews.com/2022/11/hacker-rewarded-70000-for-finding-way.html

U.S. Health Dept warns of Venus ransomware targeting healthcare orgs

The U.S. Department of Health and Human Services (HHS) has warned Americans that Venus ransomware attacks are targeting the country's healthcare organizations. The operators of Venus ransomware are not believed to operate as a ransomware-as-a-service (RaaS) model and no associated data leak site (DLS) exists at this time.

See the full report here: https://www.bleepingcomputer.com/news/security/us-health-dept-warns-of-venus-ransomware-targeting-healthcare-orgs/

Russian military hackers linked to ransomware attacks in Ukraine

A series of Prestige ransomware attacks targeting transportation and logistics organizations in Ukraine and Poland have been linked to an elite Russian military cyberespionage group called Sandworm (a.k.a., BlackEnergy, Voodoo Bear, and TeleBots). This tactic has rarely been seen in attacks targeting Ukrainian organizations, and it matches previous Russian state-aligned activity – such as the use of the HermeticWiper destructive malware before the start of the invasion of Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-military-hackers-linked-to-ransomware-attacks-in-ukraine/

Worok hackers hide new malware in PNGs using steganography

A threat group tracked as "Worok" hides malware within PNG images to infect victims' machines with information-stealing malware without raising alarms. Worok has targeted high-profile victims, including government entities in the Middle East, Southeast Asia, and South Africa.

See the full report here: https://www.bleepingcomputer.com/news/security/worok-hackers-hide-new-malware-in-pngs-using-steganography/

High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

Cybersecurity researchers have disclosed details of a vulnerability (CVE-2022-0902; CVSS score: 8.1) in a system used across oil and gas organizations that could be exploited by an attacker to inject and execute arbitrary code. Attackers can exploit this flaw to gain root access on an ABB flow computer, read and write files, and remotely execute code. ABB has released firmware updates that patch this bug on July 14, 2022.

See the full report here: https://thehackernews.com/2022/11/high-severity-flaw-reported-in-critical.html

An eight dollar mess — Twitter Blue "verified" accounts push crypto scams

The New Twitter Blue program (available for an USD 8 monthly fee) is being used by attackers and fraudsters to impersonate famous people. Whereas only accounts of notable personalities and organizations earned the blue tick previously, it is now open to anyone willing to pay the monthly fee.

See the full report here: https://www.bleepingcomputer.com/news/security/an-8-mess-twitter-blue-verified-accounts-push-crypto-scams/

FBI warns scammers now impersonate refund payment portals

The FBI warned Americans that tech support scammers are now impersonating financial institutions' refund payment portals to harvest victims' sensitive information. The fraudsters reportedly trick victims (generally someone from within the elderly population) via email or phone calls into giving them access to their computers. People who have fallen victim to such scams should report it as soon as possible by filing a complaint with the Internet Crime Complaint Center (IC3).

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-scammers-now-impersonate-refund-payment-portals/

Ukraine arrests fraud ring members who made EUR 200 million per year

Ukraine's cyber police and Europol have arrested five key members of an international investment fraud ring estimated to have caused losses of over EUR 200 million per year. The operation of the investment scheme was spread across multiple European countries, including Ukraine, Germany, Spain, Latvia, Finland, and Albania. The criminals created an extensive network of fake websites posing as cryptocurrency, stocks, bonds, futures, and options investment portals to promote the operation.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-arrests-fraud-ring-members-who-made-200-million-per-year/

Canadian food retail giant Sobeys hit by Black Basta ransomware

Sobeys, a major Canadian food retailer, has been experiencing IT system problems at its pharmacy and grocery stores. It has revealed that while its grocery stores were still open, some services were impacted by this company-wide issue. The company also added that it is working on resolving the issues affecting its IT systems to reduce store disruption.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-food-retail-giant-sobeys-hit-by-black-basta-ransomware/

Ukraine says Russian hacktivists use new Somnia ransomware

Russian hacktivists have infected several organizations in Ukraine with a new ransomware strain called "Somnia," encrypting their systems and causing operational problems. The group previously disclosed creating the Somnia ransomware on Telegram and even posted evidence of attacks against tank producers in Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-says-russian-hacktivists-use-new-somnia-ransomware/

New extortion scam threatens to damage sites’ reputation, leak data

An extortion scam is targeting website owners and admins worldwide, claiming to have hacked their servers and demanding USD 2,500 not to leak data. The emails appear to be non-targeted, with ransom demand recipients from all verticals, including personal bloggers, government agencies, and large corporations.

See the full report here: https://www.bleepingcomputer.com/news/security/new-extortion-scam-threatens-to-damage-sites-reputation-leak-data/

Experts Uncover Two Long-Running Android Spyware Campaigns Targeting Uyghurs

Two long-running surveillance campaigns have been found targeting the Uyghur community in China and elsewhere with Android spyware tools designed to harvest sensitive information and track their whereabouts.This encompasses a previously undocumented malware strain called BadBazaar and updated variants of an espionage artifact dubbed MOONSHINE.

See the full report here: https://thehackernews.com/2022/11/experts-uncover-two-long-running.html

Malicious Google Play Store App Spotted Distributing Xenomorph Banking Trojan

Google has removed two new malicious dropper apps that have been detected on the Play Store for Android, one of which posed as a lifestyle app and was caught distributing the Xenomorph banking malware.

See the full report here: https://thehackernews.com/2022/11/these-two-google-play-store-apps.html

Multiple High-Severity Flaws Affect Widely Used OpenLiteSpeed Web Server Software

Security researchers found three high-severity flaws (CVE-2022-0072, CVSS score: 5.8; (CVE-2022-0073, CVSS score: 8.8; and CVE-2022-0074, CVSS score: 8.8) in the open source OpenLiteSpeed Web Server as well as its enterprise variant. The bugs could be exploited for privilege escalation, command injection, and finally privileged code execution. The bugs affect OpenLiteSpeed (from 1.5.11 up to 1.7.16) and LiteSpeed (from 5.4.6 up to 6.0.11) and have been patched in versions 1.7.16.1 and 6.0.12.

See the full report here: https://thehackernews.com/2022/11/multiple-high-severity-flaw-affect.html

Russian-Canadian National Charged Over Involvement in LockBit Ransomware Attacks

The U.S. Department of Justice (DoJ) has announced charges against a dual Russian and Canadian national for his alleged participation in LockBit ransomware attacks across the world. The suspect has been taken into custody and is awaiting extradition to the United States.

See the full report here: https://thehackernews.com/2022/11/russian-canadian-national-charged-over.html

Thales confirms hackers have released its data on the dark web

French defence and technology group Thales (TCFP.PA) disclosed that data relating to the group has been released on the "publication platform" of the hacker group LockBit 3.0 on November 10. Thales confirmed that there were no intrusions in its IT systems.

See the full report here: https://www.reuters.com/technology/hackers-release-thales-data-dark-web-franceinfo-says-2022-11-11/

Windows Kerberos authentication breaks after November updates

Microsoft is investigating a new known issue causing enterprise domain controllers to experience Kerberos sign-in failures and other authentication problems after installing cumulative updates released in the November 2022 Patch Tuesday. Kerberos has replaced the NTLM protocol as the default authentication protocol for domain-connected devices on all Windows versions above Windows 2000. Microsoft is working on a fix for this issue and estimates that a solution will be available in the coming weeks.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-kerberos-authentication-breaks-after-november-updates/

Google will pay USD 391M to settle Android location tracking lawsuit

Google has agreed to pay USD 391.5 million to settle a privacy lawsuit filed relating to the company misleading Android users and tracking their locations since at least 2014 – even when they thought location tracking was disabled. The settlement also requires Google to introduce more user-friendly account controls and limits the company's use and storage of some types of location data.

See the full report here: https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/

42,000 sites used to trap users in brand impersonation scheme

A malicious for-profit Chinese group named "Fangxiao" has created a massive network of over 42,000 web domains that impersonate well-known brands to redirect users to sites promoting adware apps, dating sites, or giveaways. Most of these sites use the ".top" TLD, followed by ".cn," ".cyou," ".xyz," ".work," and ".tech."

See the full report here: https://www.bleepingcomputer.com/news/security/42-000-sites-used-to-trap-users-in-brand-impersonation-scheme/

Whoosh confirms data breach after hackers sell 7.2M user records

The Russian scooter-sharing service "Whoosh" has confirmed a data breach after hackers started to sell a database containing the details of 7.2 million customers. Whoosh is Russia's leading urban mobility service platform, operating in 40 cities with over 75,000 scooters.

See the full report here: https://www.bleepingcomputer.com/news/security/whoosh-confirms-data-breach-after-hackers-sell-72m-user-records/

Instagram, Facebook, Twitter, YouTube suspended in Turkey after blast

Following a deadly blast in Istanbul, Turkish authorities began restricting access to social media platforms including Instagram, Facebook, Twitter, YouTube and Telegram as a nationwide broadcast ban went into effect.

See the full report here: https://www.bleepingcomputer.com/news/security/instagram-facebook-twitter-youtube-suspended-in-turkey-after-blast/

New KmsdBot Malware Hijacking Systems for Mining Crypto and Launch DDoS Attacks

A new malware type ("KmsdBot") uses the Secure Shell (SSH) cryptographic protocol to gain entry into targeted systems with the goal of mining cryptocurrency and carrying out distributed denial-of-service (DDoS) attacks. The Golang-based malware has targeted a variety of companies ranging from gaming to luxury car brands to security firms.

See the full report here: https://thehackernews.com/2022/11/new-kmsdbot-malware-hijacking-systems.html

Over 15,000 WordPress Sites Compromised in Malicious SEO Campaign

A new malicious campaign has compromised over 15,000 WordPress websites in an attempt to redirect visitors to bogus Q&A portals. The search engine poisoning technique is designed to promote fake low-quality Q&A sites operated by the same threat actor. This is suspected to be a case of brute-forcing the WordPress administrator accounts, so users should enable two-factor authentication and ensure that all software is up-to-date.

See the full report here: https://thehackernews.com/2022/11/over-15000-wordpress-sites-compromised.html

Russian software disguised as American finds its way into U.S. Army, CDC apps

Thousands of smartphone applications in Apple’s and Google's online stores contain computer code developed by a technology company, Pushwoosh, that presents itself as based in the United States, but is actually Russian. The CDC was reportedly deceived into believing Pushwoosh was based in the U.S. capital and has since removed Pushwoosh software from seven public-facing apps. The U.S. Army also removed an app containing Pushwoosh code in March because of the same concerns.

See the full report here: https://www.reuters.com/technology/exclusive-russian-software-disguised-american-finds-its-way-into-us-army-cdc-2022-11-14/

Chinese hackers target government agencies and defense orgs

A threat actor tracked as "Billbug" (a.k.a. Thrip, Lotus Blossom, Spring Dragon) has been running a campaign targeting a certificate authority, various different government agencies, and defense organizations in Asia. The most recent attacks were observed since at least March but the actor has been operating stealthily for more than a decade and it is believed to be a state-sponsored group working for China.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-target-government-agencies-and-defense-orgs/

Researchers release exploit details for Backstage pre-auth RCE bug

Older versions of the Spotify Backstage development portal builder are vulnerable to a critical (CVSS score: 9.8) unauthenticated remote code execution flaw allowing attackers to execute commands. The problem lies in a vm2 sandbox escape issue that researchers disclosed in a report last month. All system administrators are advised to upgrade to the latest release, Backstage version 1.7.2.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-release-exploit-details-for-backstage-pre-auth-rce-bug/

North Korean hackers target European orgs with updated malware

North Korean hackers are using a new version of the DTrack backdoor to attack organizations in Europe and Latin America. DTrack is a modular backdoor featuring a keylogger, a screenshot snapper, a browser history retriever, a running processes snooper, an IP address and network connection information snatcher, and more. Apart from spying, it can run commands to perform file operations, fetch additional payloads, steal files and data, and execute processes on the compromised device.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-target-european-orgs-with-updated-malware/

FTX Hack or Inside Job? Blockchain Experts Examine Clues and a "Stupid Mistake"

Investigations relating to the recent USD 400 million hack in the crypto exchange FTX indicate the possibility of a high-level insider committing an amateur misstep that might have inadvertently revealed their identity. The attacker reportedly used their verified personal account on crypto exchange Kraken to send 500 TRX to the compromised wallet address to cover a transaction fee.

See the full report here: https://finance.yahoo.com/news/ftx-hack-inside-job-blockchain-203036234.html

Researchers Reported Critical SQLi and Access Flaws in Zendesk Analytics Service

Researchers have disclosed details of now-patched flaws in Zendesk Explore that could have been exploited by an attacker to gain unauthorized access to information from certain customer accounts. There has reportedly been no evidence of exploitation of these bugs in the wild, and no action is required from customers. The company fixed the bugs on September 8, 2022.

See the full report here: https://thehackernews.com/2022/11/researchers-reported-critical-sqli-and.html

PCspooF: New Vulnerability Affects Networking Tech Used by Spacecraft and Aircraft

Security researchers have disclosed a novel attack method (“PCspooF”) against time-triggered ethernet (TTE) – potentially causing the failure of systems powering spacecraft and aircraft. The study recommends using optocouplers or surge protectors to block electromagnetic interference, checking the source MAC addresses to ensure authenticity, hiding key PCF fields, using a link-layer authentication protocol like IEEE 802.1AE, increasing the number of sync masters, and disabling dangerous state transitions.

See the full report here: https://thehackernews.com/2022/11/pcspoof-new-vulnerability-affects.html

Medibank defends decision to not pay hackers ransom for stolen data as it contacts 480,000 customers

Medibank has begun communicating with nearly half a million customers whose health data is believed to have been stolen, weeks after it first became aware hackers had breached its customer database. The company defended its decision not to pay the ransom, citing the limited chance of secure recovery of the data even after payment as well as the possibility of inadvertently encouraging the criminals for further extortion.

See the full report here: https://www.abc.net.au/news/2022-11-16/medibank-defends-decision-not-to-pay-hackers-ransom-at-agm/101659206

Iranian hackers compromise US government network in cryptocurrency generating scheme, officials say

Iranian government-sponsored hackers compromised the network of an unnamed US federal government agency starting in February, stealing passwords on the network and installing software to generate cryptocurrency. The hackers exploited a widely known vulnerability (Log4Shell – CVE-2021-44228) that CISA sounded the alarm about in December 2021 and ordered relevant agencies to address.

See the full report here: https://edition.cnn.com/2022/11/16/politics/iran-hackers-us-government-network/index.html

Police dismantle pirated TV streaming network with 500,000 users

The Spanish police have dismantled a network of pirated streaming sites that illegally distributed content from 2,600 TV channels and 23,000 movies and series to roughly 500,000 users. The law enforcement action took place in a joint operation involving the Spanish police and EUROPOL, resulting in the arrest of four operators.

See the full report here: https://www.bleepingcomputer.com/news/technology/police-dismantle-pirated-tv-streaming-network-with-500-000-users/

Okta shares workaround for ongoing Microsoft 365 SSO outage

Okta, a leading provider of authentication services, has shared a workaround for ongoing issues preventing customers from logging into their accounts using Microsoft Office 365 Single Sign-On. The outage affects users across the United States, EMEA (Europe, the Middle East, and Africa), and Japan. Okta's support team is still adding updates after isolating and unsuccessfully attempting to resolve the issue.

See the full report here: https://www.bleepingcomputer.com/news/technology/okta-shares-workaround-for-ongoing-microsoft-365-sso-outage/

Magento stores targeted in massive surge of TrojanOrders attacks

At least seven hacking groups are behind a massive surge in "TrojanOrders" attacks targeting Magento 2 websites, exploiting a vulnerability (CVE-2022-24086) that allows the threat actors to compromise vulnerable servers. These attacks are being used to inject malicious JavaScript code into an online store's website.

See the full report here: https://www.bleepingcomputer.com/news/security/magento-stores-targeted-in-massive-surge-of-trojanorders-attacks/

Suspected Zeus cybercrime ring leader "Tank" arrested by Swiss police

Tank, one of the leaders of the notorious JabberZeus cybercrime gang, was arrested in Geneva last month. He reportedly managed the stolen banking credentials and the money mules who wired money from the victims' accounts into those controlled by the cybercriminals.

See the full report here: https://www.bleepingcomputer.com/news/security/suspected-zeus-cybercrime-ring-leader-tank-arrested-by-swiss-police/

Researchers Discover Hundreds of Amazon RDS Instances Leaking Users' Personal Data

Hundreds of databases on Amazon Relational Database Service (Amazon RDS) are exposing personal identifiable information (PII). This includes names, email addresses, phone numbers, dates of birth, marital status, car rental information, and even company logins.

See the full report here: https://thehackernews.com/2022/11/researchers-discover-hundreds-of-amazon.html

Updated RapperBot malware targets game servers in DDoS attacks

The Mirai-based botnet "RapperBot" has re-emerged via a new campaign that infects IoT devices for DDoS (Distributed Denial of Service) attacks against game servers.The malware was discovered last August when it used SSH brute-forcing to spread on Linux servers. By tracing its activities, the researchers found that RapperBot has been operational since May 2021, but its exact goals were hard to decipher.

See the full report here: https://www.bleepingcomputer.com/news/security/updated-rapperbot-malware-targets-game-servers-in-ddos-attacks/