Threat Intelligence Bulletin: 11/18/2022

Breach Disclosure: TNAFlix

On June 25, 2022, a threat actor from BreachForums posted a data breach package targeting TNAFlix, an adult entertainment website operating from Cyprus. From the package published on BreachForums, ZeroFox extracted 1,374,450 email addresses and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On June 25, 2022, a threat actor "XHJACK" from BreachForums posted a data breach package targeting TNAFlix, an adult entertainment website operating from Cyprus. The threat actor noted that the data package is approximately from June 2022 which impacted 1.3 million users. The data package was also circulated in a deep web forum Leakbase on July 11, 2022 by the threat actor "Chucky". From the package published on BreachForums, ZeroFox extracted 1,374,450 email addresses and/or usernames. Of these, 1,374,439 records were successfully linked to plain-text passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: GGCORP

On August 11, 2022, a threat actor from BreachForums posted a data breach package targeting GGCORP, a gaming website operating from Montenegro. The threat actor noted that the data package impacted 2.5 million users. From the package published on BreachForums, ZeroFox extracted 2,370,434 email addresses, usernames and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 11, 2022, a reputed threat actor "donjuji" from BreachForums posted a data breach package targeting GGCORP, a gaming website operating from Montenegro. The threat actor noted that the data package is approximately from August 2022 which impacted 2.5 million users. The same victim was also targeted in a Telegram channel RedPacket Security on November 8, 2022. From the package published on BreachForums, ZeroFox extracted 2,370,434 email addresses, usernames and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: RuneMart

On August 19, 2022, a threat actor from the Russian deep web forum XSS posted a data breach package targeting RuneMart, an online discussion forum operating from the United States. From the package published on XSS, ZeroFox extracted 14,389 email addresses, usernames and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 19, 2022, a user level threat actor "caunt" from the Russian deep web forum XSS posted a data breach package targeting RuneMart, an online discussion forum operating from the United States. The data package was also circulated in the deep web forum ULeaks on the month of August 2022. From the package published on XSS, ZeroFox extracted 14,389 email addresses, usernames and hashed passwords. Other notable data fields observed in this package include user ID, last activity, birthday, and IP address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Vungle

On August 10, 2022, a threat actor from BreachForums posted a data breach package targeting Vungle, an in-app video advertising platform for performance marketers operating from the United States. The threat actor noted the data package is from February 20, 2022 which includes more than 11,000 lines of user information. From this package, ZeroFox extracted 11,609 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 10, 2022, a threat actor "emo" from BreachForums reposted a data breach package which was originally posted by the threat actor "hiGIVWwtgu" on May 2, 2022 in the same forum targeting Vungle, an in-app video advertising platform for performance marketers operating from the United States. The breach post created by both the threat actors "emo" and "hiGIVWwtgu" have been taken down. The threat actor noted the data package is from February 20, 2022 which includes more than 11,000 lines of user information. From this package, ZeroFox extracted 11,609 email addresses. No passwords were found in this breach.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Currently

On July 27, 2022, a threat actor from BreachForums posted a data breach package targeting "Currently" a news portal from AT&T. From the package published on BreachForums, ZeroFox extracted 702,735 email addresses and/or usernames. Of these, 702,348 records were successfully linked to plain-text and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 27, 2022, a reputed threat actor "mahony" from BreachForums posted a data breach package targeting "Currently" a news portal from AT&T. On August 5, 2022, the threat actor name "mahony" has changed to "dirtbike" in the Breachforums. The data package was also circulated in a deep web forum Cracked on November 16, 2022 by the threat actor "hoaidz126". From the package published on BreachForums, ZeroFox extracted 702,735 email addresses and/or usernames. Of these, 702,348 records were successfully linked to plain-text and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: KinoKong

On August 18, 2022, a threat actor from BreachForums reposted a data breach package targeting KinoKong, a Czech Republic based streaming and online TV website. The threat actor noted that the data package has impacted 824,684 users. From the package published on BreachForums, ZeroFox extracted 822,272 email addresses and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 18, 2022, a reputed threat actor "buuza" from BreachForums reposted a data breach package targeting KinoKong, a Czech Republic based streaming and online TV website. The threat actor noted that the data package is approximately from March 2021 which impacted 824,684 users. The data package was also published in BreachForums itself on August 30, 2022 by the threat actor "donjuji". From the package published on BreachForums by the threat actor "buuza", ZeroFox extracted 822,272 email addresses and hashed passwords. Other notable data fields observed in this package include user ID, registration date, full name, and IP address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-11-18 - 2022-11-22

F5 fixes two remote code execution flaws in BIG-IP, BIG-IQ

F5 has released hotfixes to address two high-severity flaws (CVE-2022-41622; CVSS v3: 8.8 CVE-2022-41800; CVSS v3: 8.7) which allowed attackers to perform remote code execution. Impacted customers are recommended to request the engineering hotfix for their product version from F5 and install it manually. To resolve CVE-2022-41622, admins should also disable Basic Authentication for iControl SOAP after installing the hotfix.

See the full report here: https://www.bleepingcomputer.com/news/security/f5-fixes-two-remote-code-execution-flaws-in-big-ip-big-iq/

Phishing kit impersonates well-known brands to target US shoppers

A sophisticated phishing kit has been targeting North Americans since mid-September, using lures focused on holidays like Labor Day and Halloween. The kit uses multiple evasion detection techniques and incorporates several mechanisms to keep non-victims away from its phishing pages. Some impersonated brands include sporting goods firm Dick's, high-end luggage maker Tumi, Delta Airlines, and the wholesale clubs, Sam's Club and Costco.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-kit-impersonates-well-known-brands-to-target-us-shoppers/

Microsoft fixes Windows Kerberos auth issues in emergency updates

Microsoft has released optional out-of-band (OOB) updates (KB5021656), (KB5021655), (KB5021654), (KB5021653), (KB5021652), and (KB5021657) to fix a known issue triggering Kerberos sign-in failures and other authentication problems on enterprise Windows domain controllers after installing cumulative updates released in the November 2022 Patch Tuesday.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-kerberos-auth-issues-in-emergency-updates/

Previously unidentified ARCrypter ransomware expands worldwide

A previously unknown "ARCrypter" ransomware that compromised key organizations in Latin America is now expanding its attacks worldwide. Threat actors behind the new ransomware family attacked a government agency in Chile last August, targeting both Linux and Windows systems and appending the “.crypt” extension on encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/previously-unidentified-arcrypter-ransomware-expands-worldwide/

FBI: Hive ransomware extorted USD 100 million from over 1,300 victims

The Federal Bureau of Investigation (FBI) disclosed that the Hive ransomware gang has successfully extorted roughly USD 100 million from over a thousand companies since June 2021. The Hive gang is known to deploy additional ransomware payloads on the networks of victims who refuse to pay the ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-hive-ransomware-extorted-100m-from-over-1-300-victims/

QBot phishing abuses Windows Control Panel EXE to infect devices

Phishing emails distributing the QBot (Qakbot) malware – a full-featured malware dropper – are using a DLL hijacking flaw to infect computers, likely as an attempt to evade detection by security software. DLL hijacking is a common attack method that takes advantage of how Dynamic Link Libraries (DLLs) are loaded in Windows. Ransomware gangs, including Black Basta, Egregor, and Prolock, also use the malware to gain initial access to corporate networks.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-phishing-abuses-windows-control-panel-exe-to-infect-devices/

U.S. charges Russian suspects with operating Z-Library e-Book site

Two Russian nationals were charged with intellectual property crimes linked to Z-Library, a pirate online eBook repository. The defendants were arrested on November 3, 2022, in Argentina by the country's authorities at the request of U.S. law enforcement. A day later, Z-Library's clearnet domains were seized by the Department of Justice and the FBI.

See the full report here: https://www.bleepingcomputer.com/news/security/us-charges-russian-suspects-with-operating-z-library-e-book-site/

New ransomware encrypts files, then steals your Discord account

The new "AXLocker" ransomware family is not only encrypting victims' files and demanding a ransom payment but also stealing the Discord accounts of infected users. If a user finds that AxLocker encrypted their computer, they should immediately change Discord password, as it will invalidate the token stolen by the ransomware. While this may not help recover the files, it will prevent further compromise of accounts, data, and the communities the user is involved in.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomware-encrypts-files-then-steals-your-discord-account/

New attacks use Windows security bypass zero-day to drop malware

New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings. When files are downloaded from an untrusted remote location, such as the Internet or an email attachment, Windows add a special attribute to the file called the Mark of the Web.

See the full report here: https://www.bleepingcomputer.com/news/security/new-attacks-use-windows-security-bypass-zero-day-to-drop-malware/

Researchers secretly helped decrypt Zeppelin ransomware for 2 years

Security researchers found vulnerabilities in the encryption mechanism of the Zeppelin ransomware and exploited them to create a working decryptor they used since 2020 to help victim companies recover files without paying the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-secretly-helped-decrypt-zeppelin-ransomware-for-2-years/

US charges BEC suspects with targeting federal health care programs

The U.S. Department of Justice (DOJ) has charged ten defendants for their alleged involvement in business email compromise (BEC) schemes targeting numerous victims across the country, including U.S. federal funding programs like Medicare and Medicaid. In total, the losses resulting from their attacks amount to more than USD 11.1 million, stolen by tricking the victims into redirecting bank transfers into the fraudsters' accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/us-charges-bec-suspects-with-targeting-federal-health-care-programs/

Chinese hackers use Google Drive to drop malware on govt networks

State-backed Chinese hackers launched a spearphishing campaign to deliver custom malware stored in Google Drive to government, research, and academic organizations worldwide. The attacks have been observed between March and October 2022 and researchers attributed it to the cyber espionage group Mustang Panda (Bronze President, TA416). According to researchers, the threat group targeted mostly organizations in Australia, Japan, Taiwan, Myanmar, and the Philippines.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-google-drive-to-drop-malware-on-govt-networks/

Google Search results poisoned with torrent sites via Data Studio

Threat actors are abusing Google's Looker Studio (formerly Google Data Studio) to boost search engine rankings for their illicit websites that promote spam, torrents, and pirated content. The SEO poisoning attack uses Google's datastudio.google.com subdomain to lend credibility to malicious domains. These links, rather than representing a legitimate Google Data Studio project, are minisites that host links to pirated content.

See the full report here: https://www.bleepingcomputer.com/news/security/google-search-results-poisoned-with-torrent-sites-via-data-studio/

Atlassian fixes critical command injection bug in Bitbucket Server

Atlassian has released updates to address critical-severity bugs (CVE-2022-43781 and CVE-2022-43782) in its centralized identity management platform, Crowd Server and Data Center, and in Bitbucket Server and Data Center, the company's solution for Git repository management. Both security vulnerabilities received a severity rating of 9 out of 10 (calculated by Atlassian) and affect multiple versions of the products.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-command-injection-bug-in-bitbucket-server/

Indian Government Publishes Draft of Digital Personal Data Protection Bill 2022

The Indian government has released a draft version of the data protection regulation, The Digital Personal Data Protection Bill, 2022. The bill aims to secure personal data, while also seeking users' consent in "clear and plain language" describing the exact kinds of information that will be collected and for what purpose. The draft is open for public consultation until December 17, 2022.

See the full report here: https://thehackernews.com/2022/11/indian-government-publishes-draft-of.html

Meta Reportedly Fires Dozens of Employees for Hijacking Users' Facebook and Instagram Accounts

Meta Platforms reportedly fired or disciplined over two dozen employees and contractors over the past year for allegedly compromising and taking over user accounts. Reportedly those fired included contractors who worked as security guards at the social media firm's facilities and were given access to an internal tool that allowed employees to help "users they know" gain access to accounts after forgetting their passwords, or had their accounts locked out.

See the full report here: https://thehackernews.com/2022/11/meta-reportedly-fires-dozens-of.html

LodaRAT Malware Resurfaces with New Variants Employing Updated Functionalities

The LodaRAT malware has resurfaced with new variants that are being deployed in conjunction with other sophisticated malware, such as RedLine Stealer and Neshta. Aside from being dropped alongside other malware families, LodaRAT has also been observed being delivered through a previously unknown variant of another commodity trojan called Venom RAT. An AutoIT-based malware, LodaRAT (aka Nymeria) is attributed to a group called Kasablanca and is capable of harvesting sensitive information from compromised machines.

See the full report here: https://thehackernews.com/2022/11/lodarat-malware-resurfaces-with-new.html

India’s securities depository CDSL says malware compromised its network

India’s leading central securities depository, Central Depository Services Limited (CDSL), stated that a few of its internal systems have been compromised by malware. CSDL said that it continues to investigate, and that it has so far no reason to believe that any confidential information or investor data has been compromised due to the incident.

See the full report here: https://techcrunch.com/2022/11/18/cdsl-malware-internal-systems/

Exploit released for actively abused ProxyNotShell Exchange bug

Proof-of-concept exploit code has been released for two actively exploited and high-severity vulnerabilities in Microsoft Exchange, collectively known as ProxyNotShell. Tracked as CVE-2022-41082 and CVE-2022-41040, the two bugs affect Microsoft Exchange Server 2013, 2016, and 2019 and allow attackers to escalate privileges to run remote code execution on compromised servers. Microsoft released security updates to address the two security flaws as part of the November 2022 Patch Tuesday updates.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-actively-abused-proxynotshell-exchange-bug/

Google Chrome extension used to steal cryptocurrency, passwords

An information-stealing Google Chrome browser extension named "VenomSoftX" is being deployed by Windows malware to steal cryptocurrency and clipboard contents as users browse the web. This Chrome extension is being installed by the ViperSoftX Windows malware, which acts as a JavaScript-based RAT (remote access trojan) and cryptocurrency hijacker.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-extension-used-to-steal-cryptocurrency-passwords/

Apps with over 3 million installs leak "Admin" search API keys

Researchers discovered 1,550 mobile apps leaking Algolia API keys, risking the exposure of sensitive internal services and stored user information. Of those apps, 32 expose admin secrets, including 57 unique admin keys, giving attackers a way to access sensitive user information or modify app index records and settings.

See the full report here: https://www.bleepingcomputer.com/news/security/apps-with-over-3-million-installs-leak-admin-search-api-keys/

Two Estonians arrested for running USD 575 million crypto Ponzi scheme

Two Estonian nationals were arrested in Estonia, after being indicted in the United States for running a massive cryptocurrency Ponzi scheme that led to more than USD 575 million in losses. The defendants were accused of defrauding hundreds of thousands of victims together with four other co-conspirators residing in Estonia, Belarus, and Switzerland between December 2013 and August 2019. They allegedly funneled victims' funds through a complex network of shell companies, bank accounts, virtual asset services, and cryptocurrency wallets.

See the full report here: https://www.bleepingcomputer.com/news/security/two-estonians-arrested-for-running-575m-crypto-ponzi-scheme/

Aurora infostealer malware increasingly adopted by cybergangs

Cybercriminals are increasingly using a new Go-based information stealer named “Aurora” to steal data from browsers and cryptocurrency apps, exfiltrate data directly from disks, and load additional payloads. The reason for this sudden rise in Aurora’s popularity is its low detection rates and general unknown status, making its infections less likely to be detected.

See the full report here: https://www.bleepingcomputer.com/news/security/aurora-infostealer-malware-increasingly-adopted-by-cybergangs/

Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chat

A crypto-stealing phishing campaign is underway to bypass multi-factor authentication and gain access to accounts on Coinbase, MetaMask, Crypto.com, and KuCoin and steal cryptocurrency. The threat actors abuse the Microsoft Azure Web Apps service to host a network of phishing sites and lure victims to them via phishing messages impersonating bogus transaction confirmation requests or suspicious activity detection.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-bypass-coinbase-and-metamask-2fa-via-teamviewer-fake-support-chat/

Hackers steal USD 300,000 in DraftKings credential stuffing attack

Sports betting company DraftKings said that it would make whole customers affected by a credential stuffing attack that led to losses of up to USD 300,000. A common factor in all accounts that got hijacked seems to be an initial USD 5 deposit followed by the attackers changing the password, enabling two-factor authentication (2FA) on a different phone number, and then withdrawing as much as possible from the victims' linked bank accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-300-000-in-draftkings-credential-stuffing-attack/

Google Cloud Threat Intelligence team releases 165 YARA rules to detect Cobalt Strike attacks

The Google Cloud Threat Intelligence team has open-sourced YARA Rules and a VirusTotal Collection of indicators of compromise (IOCs) to help defenders detect Cobalt Strike components in their networks. Security teams will also be able to identify Cobalt Strike versions deployed in their environment using these detection signatures.

See the full report here: https://www.bleepingcomputer.com/news/security/google-releases-165-yara-rules-to-detect-cobalt-strike-attacks/

Daixin Ransomware Gang Steals 5 Million AirAsia Passengers' and Employees' Data

The cybercrime group called Daixin Team has leaked sample data belonging to AirAsia, a Malaysian low-cost airline, on its data leak portal. The development comes a little over a week after the company fell victim to a ransomware attack on November 11 and 12. The threat actors claim to have obtained the personal data associated with five million unique passengers and all of its employees.

See the full report here: https://thehackernews.com/2022/11/daixin-ransomware-gang-steals-5-million.html

Notorious Emotet Malware Returns With High-Volume Malspam Campaign

The notorious Emotet malware has returned with renewed vigor as part of a high-volume malspam campaign designed to drop payloads like IcedID and Bumblebee. Among the primary countries targeted are the U.S., the U.K., Japan, Germany, Italy, France, Spain, Mexico, and Brazil. The malware, which is attributed to a threat actor known as Mummy Spider (aka Gold Crestwood or TA542), staged a revival late last year after its infrastructure was dismantled during a coordinated law enforcement operation in January 2021.

See the full report here: https://thehackernews.com/2022/11/notorious-emotet-malware-returns-with.html

Google Wins Lawsuit Against Russians Linked to Blockchain-based Glupteba Botnet

Google has won a lawsuit filed against two Russian nationals in connection with the operation of a botnet called Glupteba. The U.S. District Court for the Southern District of New York imposed monetary sanctions against the defendants and their U.S.-based legal counsel. The defendants have also been asked to pay Google's attorney fees. The defendants' move to press sanctions against Google was denied.

See the full report here: https://thehackernews.com/2022/11/google-wins-lawsuit-against-russians.html