Threat Intelligence Bulletin: 11/23/2022

Breach Disclosure: İleti Yönetim Sistemi

On July 20, 2022, a threat actor from BreachForums posted a data breach package targeting İleti Yönetim Sistemi, a Turkey-based national commercial electronic message management platform. From this package, ZeroFox extracted 271,533 email addresses and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 20, 2022, a threat actor "see_u_rf" from BreachForums posted a data breach package targeting İleti Yönetim Sistemi, a Turkey-based national commercial electronic message management platform which allows the service providers to store and manage different types of message permissions. The threat actor noted that the data package is approximately from June 2022 and the database leaked due to an exposed ElasticSearch server. From this package, ZeroFox extracted 271,533 email addresses and/or usernames. No passwords were found in this breach. Other notable data fields observed in this package include name, address, and phone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Famm

On July 21, 2022, a threat actor from BreachForums posted a data breach package targeting Famm, a Japan based photography website. The threat actor noted that the data package has impacted 1.3M users. From the package published on BreachForums, ZeroFox extracted 1,393,746 email addresses, hashed passwords, and/or usernames.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 21, 2022, a threat actor "nvl" from BreachForums posted a data breach package targeting Famm, a Japan based photography website. The threat actor noted that the data package was from the year late 2020 which impacted 1.3M users. The data package was also circulated in the deep web forums like in the Russian language forum XSS on November 17, 2020 by the threat actor "Izmailovskiy" and in Raid Forums on November 19, 2020. From the package published on BreachForums, ZeroFox extracted 1,393,746 email addresses, hashed passwords, and/or usernames. Other notable data fields observed in this package include name, sex, and birthday.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Strela Stealer

Product Serial: B-2022-11-29a

TLP: CLEAR

Standing Intelligence Requirements

MAL

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on November 25, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

In November 2022, ZeroFox Intelligence analyzed a new information stealer known as Strela Stealer. While most current information stealers target a wide variety of applications and cryptocurrencies, Strela Stealer instead focuses on credentials obtained from Microsoft Outlook and Mozilla Thunderbird. Publicly available samples are known to spread via ISO files containing Windows Shortcut (.lnk) files. An ISO file is a type of container file—similar to ZIP files without compression—that is most commonly used in connection with optical media such as a CD-ROM or DVD. Clicking on the included shortcut file in this instance uses Windows’ built-in rundll32.exe to open x.html, a polyglot file that is a valid HTML file and Windows dynamic link library (DLL).

Breach Disclosure: Clement Industries

On August 19, 2022, a threat actor from BreachForums posted a data breach package targeting Clement Industries, a U.S.-based waste management company. From this package, ZeroFox extracted 11,198 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 19, 2022, a reputed threat actor "romwe" from BreachForums posted a data breach package targeting Clement Industries, a U.S.-based waste management company that provides solutions for recycling programs for industrial plants. The threat actor noted that the data breach package includes 22 databases. From this package, ZeroFox extracted 11,198 email addresses with no passwords included. Other notable data fields observed in this package include name and phone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Twitter_5.4m

On November 28, 2022, the ZeroFox Dark Ops team acquired a data breach package titled "Twitter_5.4m" targeting microblogging and social-networking platform Twitter. From this package, ZeroFox extracted 5,297,608 email addresses and usernames. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-11-23 - 2022-12-01

This Malware Installs Malicious Browser Extensions to Steal Users' Passwords and Cryptos

A malicious extension for Chromium-based web browsers has been observed to be distributed via a long-standing Windows information stealer called ViperSoftX. The add-on had features that enable it to access website visits, steal credentials and clipboard data, and even swap cryptocurrency addresses via an adversary-in-the-middle (AiTM) attack.

See the full report here: https://thehackernews.com/2022/11/this-malware-installs-malicious-browser.html

Luna Moth Gang Invests in Call Centers to Target Businesses with Callback Phishing Campaigns

The Luna Moth campaign has extorted hundreds of thousands of dollars from several victims in the legal and retail sectors. The attacks are notable for employing a technique called callback phishing or telephone-oriented attack delivery (TOAD), wherein the victims are social engineered into making a phone call through phishing emails containing invoices and subscription-themed lures. Cybersecurity researchers said the attacks are the "product of a single highly organized campaign."

See the full report here: https://thehackernews.com/2022/11/luna-moth-gang-invests-in-call-centers.html

U.S. Authorities Seize Domains Used in 'Pig butchering' Cryptocurrency Scams

The U.S. Justice Department (DoJ) on Monday announced the takedown of seven domain names in connection to a "pig butchering" cryptocurrency scam. The fraudulent scheme, which operated from May to August 2022, netted the actors over USD 10 million from five victims. Pig butchering is a type of scam in which swindlers lure unsuspecting investors into sending their crypto assets. The criminals encounter potential victims on dating apps, social media sites, and through SMS messages.

See the full report here: https://thehackernews.com/2022/11/us-authorities-seize-domains-used-in.html

Azure extends DDoS attack protection down to small business users, for a fee

An new Azure service aimed at protecting smaller businesses from the growing threat of distributed denial-of-service (DDoS) attacks is now in public preview, according to Microsoft. DDoS IP Protection is a new SKU for the Azure DDoS Protection service that is designed to deliver enterprise-level protection even down to the single public IP level at a monthly fee, delivering essentially the same services that larger organizations use.

See the full report here: https://www.theregister.com/2022/11/22/microsoft_azure_smb_ddos/

Donut extortion group also targets victims with ransomware

The Donut (D0nut) extortion group has been confirmed to deploy ransomware in double-extortion attacks on the enterprise. The group's attacks were first noticed during August 2022, they were linked to attacks on Greek natural gas company DESFA, UK architectural firm Sheppard Robson, and multinational construction company Sando.

See the full report here: https://www.bleepingcomputer.com/news/security/donut-extortion-group-also-targets-victims-with-ransomware/

Hackers breach energy orgs via bugs in discontinued web server

State-backed Chinese hacking groups targeted multiple Indian electrical grid operators, compromising an Indian national emergency response system and the subsidiary of a multinational logistics company. The attackers gained access to the internal networks of the hacked entities via Internet-exposed cameras on their networks as command-and-control servers.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-breach-energy-orgs-via-bugs-in-discontinued-web-server/

Android file manager apps infect thousands with Sharkbot malware

A new collection of malicious Android apps disguised as harmless file managers had infiltrated the official Google Play app store. Since, the trojan apps are file managers, it’s less likely to raise suspicions when requesting dangerous permissions. If these apps are installed, Android users should remove them immediately and change the passwords for any online bank accounts they use. The best way to protect yourself is to keep the Play Protect service enabled so that malicious apps are removed as they are detected.

See the full report here: https://www.bleepingcomputer.com/news/security/android-file-manager-apps-infect-thousands-with-sharkbot-malware/

World Cup phishing emails spike in Middle Eastern countries

Phishing attempts targeting victims in the Middle East increased 100 percent last month in the lead up to the World Cup in Qatar. Cybersecurity researchers documented a spike in these email-based attacks between September and October, when the volume of malicious emails doubled. Miscreants used FIFA and other football-related lures as the initial attack vector, and the researchers detailed several email samples they found in the wild.

See the full report here: https://www.theregister.com/2022/11/21/world_cup_phishing_emails/

Ransomware attack cripples AIIMS Hospital services

The National Informatics Centre (NIC) at AIIMS Delhi said that a ransomware attack affected the hospital server due to which day to day activities remained halted at the premier institute. Doctors and patients complained of the facility being down post which it was found that there was a ransomware attack. According to doctors working at the institute, they were not able to generate barcodes to send samples, they were not able to see imaging and reports of patients as well.

See the full report here: https://indianexpress.com/article/cities/delhi/aiims-ransomware-attack-services-hit-8285901/

Nighthawk Likely to Become Hackers' New Post-Exploitation Tool After Cobalt Strike

A nascent and legitimate penetration testing framework known as Nighthawk is likely to gain threat actors' attention for its Cobalt Strike-like capabilities. With rogue actors already leveraging cracked versions of Cobalt Strike and others to further their post-exploitation activities, Nighthawk could likewise witness similar adoption by groups looking to "diversify their methods and add a relatively unknown framework to their arsenal."

See the full report here: https://thehackernews.com/2022/11/nighthawk-likely-to-become-hackers-new.html

Meta Takes Down Fake Facebook and Instagram Accounts Linked to Pro-U.S. Influence Operation

Meta Platforms said it took down a network of accounts and pages across Facebook and Instagram that were operated by people associated with the U.S. military to spread narratives that depicted the country in a favorable light in the Middle East and Central Asia. The network, which originated from the U.S., primarily singled out Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan, Russia, Somalia, Syria, Tajikistan, Uzbekistan, and Yemen.

See the full report here: https://thehackernews.com/2022/11/meta-takes-down-fake-facebook-and.html

Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries

Microsoft disclosed the intrusion activity aimed at Indian power grid entities earlier this year likely involved the exploitation of security flaws in a now-discontinued web server called Boa. The tech behemoth's cybersecurity division said the vulnerable component poses a "supply chain risk that may affect millions of organizations and devices." The findings build on a prior report published in April 2022, which delved into a sustained campaign orchestrated by suspected China-linked adversaries to strike critical infrastructure organizations in India.

See the full report here: https://thehackernews.com/2022/11/hackers-exploiting-abandoned-boa-web.html

Ducktail Malware Operation Evolves with New Malicious Capabilities

The operators of the Ducktail information stealer have demonstrated a "relentless willingness to persist" and continued to update their malware as part of an ongoing financially driven campaign. The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account, the threat actor uses their gained access to run ads for monetary gain.

See the full report here: https://thehackernews.com/2022/11/ducktail-malware-operation-evolves-with.html

Fake MSI Afterburner targets Windows gamers with miners, info-stealers

Windows gamers and power users are being targeted by fake MSI Afterburner download portals to infect users with cryptocurrency miners and the RedLine information-stealing malware. The MSI Afterburner is a GPU utility that allows you to configure overclocking, create fan profiles, perform video capturing, and monitor your installed graphics cards' temperature and CPU utilization.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-msi-afterburner-targets-windows-gamers-with-miners-info-stealers/

Backdoored Chrome extension installed by 200,000 Roblox players

Chrome browser extension "SearchBlox" installed by more than 200,000 users has been discovered to contain a backdoor that can steal your Roblox credentials as well as your assets on Rolimons, a Roblox trading platform. There are two search results for "SearchBlox" on Chrome. These extensions claim to let you "search Roblox servers for a desired player... blazingly fast" but both contained the backdoor.

See the full report here: https://www.bleepingcomputer.com/news/security/backdoored-chrome-extension-installed-by-200-000-roblox-players/

Pro-Russian hacktivists take down EU Parliament site in DDoS attack

The website of the European Parliament has been taken down following a DDoS (Distributed Denial of Service) attack claimed by Anonymous Russia, part of the pro-Russian hacktivist group Killnet. European Parliament President confirmed the incident saying that the Parliament's "IT experts are pushing back against it & protecting our systems."

See the full report here: https://www.bleepingcomputer.com/news/security/pro-russian-hacktivists-take-down-eu-parliament-site-in-ddos-attack/

Mali GPU "patch gap" leaves Android users vulnerable to attacks

A set of five exploitable vulnerabilities in Arm's Mali GPU driver remain unfixed months after the chip maker patched them, leaving potentially millions of Android devices exposed to attacks. Devices from Google, Samsung, Xiaomi, Oppo, as well as other phone makers are currently impacted and waiting for a fix to reach users. The vulnerabilities were discovered in June 2022. They are tracked as CVE-2022-33917 and CVE-2022-36449 (collective identifier for multiple security issues).

See the full report here: https://www.bleepingcomputer.com/news/security/mali-gpu-patch-gap-leaves-android-users-vulnerable-to-attacks/

Russian cybergangs stole over 50 million passwords this year

At least 34 distinct Russian-speaking cybercrime groups using info-stealing malware like Raccoon and Redline have collectively stolen 50,350,000 account passwords from over 896,000 individual infections from January to July 2022. The stolen credentials were for cryptocurrency wallets, Steam, Roblox, Amazon, and PayPal accounts, as well as payment card records. According to a report, most victims are based in the United States, Germany, India, Brazil, and Indonesia, but the malicious operations targeted 111 countries.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-cybergangs-stole-over-50-million-passwords-this-year/

German company wins USD 154K for US Navy's breach of software licensing

The Court of Federal Claims has now awarded Bitmanagement Software, USD 154,400 for the Navy's copyright infringement. Bitmanagement claims the Navy proceeded to distribute and reinstall it's software on at least 558,466 machines, despite only having paid for the initial 38 licenses.

See the full report here: https://www.theregister.com/2022/11/22/navy_copyright_bitmanagement/

New RansomExx Ransomware Variant Rewritten in the Rust Programming Language

The operators of the RansomExx ransomware have become the latest to develop a new variant that is fully rewritten in the Rust programming language. The version dubbed "RansomExx2" is designed to run on the Linux operating system. It has been linked to a number of attacks on government agencies, manufacturers, and other high-profile entities.

See the full report here: https://thehackernews.com/2022/11/new-ransomexx-ransomware-variant.html

Interpol seized USD 130 million from cybercriminals worldwide

INTERPOL has announced the seizure of USD 130,000,000 million worth of money and virtual assets linked to various cybercrimes and money laundering operations. In total, the operation resulted in the arrest of 975 individuals and allowed investigators to resolve more than 1,600 cases.

See the full report here: https://www.bleepingcomputer.com/news/security/interpol-seized-130-million-from-cybercriminals-worldwide/

Docker Hub repositories hide over 1,650 malicious containers

Over 1,600 publicly available Docker Hub images are hiding malicious behavior, including cryptocurrency miners, embedded secrets that can be used as backdoors, DNS hijackers, and website redirectors. Many of the malicious images are using names that disguise them as popular and trustworthy projects.

See the full report here: https://www.bleepingcomputer.com/news/security/docker-hub-repositories-hide-over-1-650-malicious-containers/

Black Basta Ransomware Gang Actively Infiltrating U.S. Companies with Qakbot Malware

Several U.S. companies have been at the receiving end of an aggressive malware campaign that leads to ransomware infections. Black Basta, which emerged in April 2022, follows an approach of double extortion to steal sensitive data from targeted companies and utilises it to extort cryptocurrency payments.

See the full report here: https://thehackernews.com/2022/11/black-basta-ransomware-gang-actively.html

Bahamut Cyber Espionage Hackers Targeting Android Users with Fake VPN Apps

The cyber espionage group known as Bahamut has been attributed as behind a highly targeted campaign that infects users of Android devices with malicious apps designed to extract sensitive information. The activity, which has been active since January 2022, entails distributing rogue VPN apps through a fake website.

See the full report here: https://thehackernews.com/2022/11/bahamut-cyber-espionage-hackers.html

US military goes zero-trust on software and government gets busy

Federal agencies are continuing to put in place their cybersecurity strategies after the government issued its executive order to strengthen defences. The Pentagon outlined its zero-trust strategy roadmap while the Cybersecurity and Infrastructure Security Agency (CISA) updated its infrastructure resilience framework for guiding entities as they plan their cybersecurity efforts.

See the full report here: https://www.theregister.com/2022/11/23/dod_cisa_omb_cybersecurity/

Hackers steal USD 42M from Fenbushi Capital founder’s wallet

The Founding Manager of Fenbushi Capital, tweeted on November 23 that thieves stole USD 42 million on November 10 from his personal wallet. The company claims that a compromised private key was to blame for the hack.

See the full report here: https://www.financialexpress.com/blockchain/hackers-steal-42m-from-fenbushi-capital-founders-wallet/2889951/

iSpoof service dismantled, main operator and 145 users arrested

The "iSpoof" online spoofing service has been dismantled following an international law enforcement investigation that also led to the arrest of 146 people, including the suspected mastermind of the operation. The owner of iSpoof was arrested on Sunday, November 6, 2022, in East London.

See the full report here: https://www.bleepingcomputer.com/news/security/ispoof-service-dismantled-main-operator-and-145-users-arrested/

Russia-based RansomBoggs Ransomware Targeted Several Ukrainian Organizations

The attacks against several Ukrainian entities were first noticed on November 21, 2022. Sandworm, an elite adversarial hacking group within Russia's GRU military intelligence agency, has a notorious track record of striking critical infrastructure over the years. The threat actor has been linked to the NotPetya cyberattacks against hospitals and medical facilities in 2017 and the destructive assaults against the Ukrainian electrical power grid in 2015 and 2016.

See the full report here: https://thehackernews.com/2022/11/russia-based-ransomboggs-ransomware.html

Dell, HP, and Lenovo Devices Found Using Outdated OpenSSL Versions

An examination of firmware images across devices from Dell, HP, and Lenovo has revealed the presence of outdated versions of the OpenSSL cryptographic library, underscoring a supply chain risk. The firmware image associated with Lenovo Thinkpad enterprise devices was found to use three different versions of OpenSSL: 0.9.8zb, 1.0.0a, and 1.0.2j, the last of which was released in 2018.

See the full report here: https://thehackernews.com/2022/11/dell-hp-and-lenovo-devices-found-using.html

5.4 million Twitter users' stolen data leaked online — more shared privately

Over 5.4 million Twitter user records containing non-public information stolen using an API vulnerability fixed in January have been leaked on a hacker forum. The data includes scraped public information as well as private phone numbers and email addresses that are not meant to be public. If you receive an email claiming your account was suspended, there are log in issues, or you are about to lose your verified status, and it prompts you to login on to a non-Twitter domain, ignore the emails and delete them as they are likely phishing attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/54-million-twitter-users-stolen-data-leaked-online-more-shared-privately/

Ransomware gang targets Belgian municipality, hits police instead

The Ragnar Locker ransomware gang has published stolen data from what they thought was the municipality of Zwijndrecht, but turned out to be stolen from Zwijndrecht police, a local police unit in Antwerp, Belgium. A Belgian lawyer and privacy activist has recommended that exposed individuals should change everything they can, including license plates, identity cards, passports, etc. The leaked data reportedly exposed thousands of car number plates, fines, crime report files, personnel details, investigation reports, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-targets-belgian-municipality-hits-police-instead/

Vice Society ransomware claims attack on Cincinnati State college

The Vice Society ransomware operation claimed responsibility for a cyberattack on Cincinnati State Technical and Community College, with the threat actors now leaking data obtained during the attack. The hackers posted a long list of documents on their Tor data leak site they claim was stolen from the college, claiming that a ransom was never paid.

See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-ransomware-claims-attack-on-cincinnati-state-college/

New Windows Server updates cause domain controller freezes, restarts

Microsoft is investigating LSASS memory leaks (caused by Windows Server updates released during the November Patch Tuesday) that might lead to freezes and restarts on some domain controllers. If this service crashes, logged-in users immediately lose access to Windows accounts on the machine, and they're shown a system restart error followed by a system reboot. Microsoft is working on a resolution and says it will provide an update with an upcoming release, however a temporary workaround is available.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-domain-controller-freezes-restarts/

Google pushes emergency Chrome update to fix 8th zero-day in 2022

Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year. The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google's Threat Analysis Group on November 22, 2022. Chrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.

See the full report here: https://www.bleepingcomputer.com/news/security/google-pushes-emergency-chrome-update-to-fix-8th-zero-day-in-2022/

US bans Chinese telecoms imports – won't even consider authorizing them

The United States' Federal Communications Commission (FCC) has effectively barred the authorizing of the import or sale of Chinese telecoms and video surveillance products from Huawei, ZTE, Hytera Communications, Hikvision, and Dahua, on national security grounds. It is known to be another part of The Secure Equipment Act – a Biden administration law that requires the FCC to update its equipment authorization procedures.

See the full report here: https://www.theregister.com/2022/11/27/fcc_china_equipment_authorization_ban/

Doctors call for greater scrutiny of bidders for platform that pools UK's health info

A doctors' conference has called on the UK's medics union to help scrutinize bidders for the NHS Federated Data Platform (FDP) contract to ensure they have a positive track record on security, privacy and ethics.

See the full report here: https://www.theregister.com/2022/11/25/family_doctors_conference_calls_for/

TikTok ‘"Invisible Body" challenge exploited to push malware

A new and trending TikTok challenge requires you to film yourself naked while using TikTok's "Invisible Body" filter, which removes the body from the video and replaces it with a blurry background. To capitalize on this, threat actors are creating TikTok videos that claim to offer a special "unfiltering" filter to remove TikTok's body masking effect and expose the TikTokers' nude bodies.

See the full report here: https://www.bleepingcomputer.com/news/security/tiktok-invisible-body-challenge-exploited-to-push-malware/

Acer fixes UEFI bugs that can be used to disable Secure Boot

Acer has fixed a high-severity vulnerability affecting multiple laptop models that could enable local attackers to deactivate UEFI Secure Boot on targeted systems. The Secure Boot security feature blocks untrusted operating systems bootloaders on computers with a Trusted Platform Module (TPM) chip and Unified Extensible Firmware Interface (UEFI) firmware to prevent malicious code like rootkits and bootkits from loading during the startup process. The security flaw (CVE-2022-4020) was discovered in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices.

See the full report here: https://www.bleepingcomputer.com/news/security/acer-fixes-uefi-bugs-that-can-be-used-to-disable-secure-boot/

Malicious Android app found powering account creation service

A fake Android SMS application, with 100,000 downloads on the Google Play store, has been discovered to secretly act as an SMS relay for an account creation service for sites like Microsoft, Google, Instagram, Telegram, and Facebook. A researcher says the infected devices are then rented out as "virtual numbers" for relaying a one-time passcode used to verify a user while creating new accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-android-app-found-powering-account-creation-service/

Meta fined EUR 265M for not protecting Facebook users' data from scrapers

Meta has been fined EUR 265 million by the Irish data protection commission (DPC) for a massive 2021 Facebook data leak exposing the information of hundreds of million users worldwide. This concludes the DPC's investigation of potential GDPR violations by Meta, launched on April 14, 2021, following the publishing of data belonging to 533 million Facebook users on a hacker forum. The exposed data included personal information, such as mobile numbers, Facebook IDs, names, genders, locations, relationship statuses, occupations, dates of birth, and email addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/meta-fined-265m-for-not-protecting-facebook-users-data-from-scrapers/

Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services

Amazon Web Services (AWS) has resolved a cross-tenant vulnerability in its platform that could be weaponized by an attacker to gain unauthorized access to resources. The issue relates to a confused deputy problem, a type of privilege escalation where a program that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. The shortcoming was reported to AWS on September 1, 2022, following which a patch was shipped on September 6.

See the full report here: https://thehackernews.com/2022/11/researchers-detail-appsync-cross-tenant.html

Canada to boost defence, cyber security in Indo-Pacific policy, focus on 'disruptive' China

Canada launched its long-awaited Indo-Pacific strategy on Sunday, outlining spending of CAD 2.3 billion (CAD 1.7 billion) to boost military and cyber security in the region and vowed to deal with a "disruptive" China while working with it on climate change and trade. The plan, detailed in a 26-page document, said Canada would tighten foreign investment rules to protect intellectual property and prevent Chinese state-owned enterprises from snapping up critical mineral supplies.

See the full report here: https://www.reuters.com/world/americas/canada-launches-new-indo-pacific-strategy-focus-disruptive-china-2022-11-27/

Hackers Demand INR 200 Crore From AIIMS, Server Down For 6 Days: Report

Hackers have allegedly demanded an estimated INR 200 crore in cryptocurrency from the All India Institute of Medical Sciences (AIIMS), Delhi as its server remained out of order for the sixth consecutive day, official sources said on Monday. It is feared that data of around 3-4 crore patients could have been compromised due to the breach detected Wednesday morning.

See the full report here: https://www.ndtv.com/india-news/hackers-demand-rs-200-crore-from-aiims-server-down-for-6-days-report-3560180

Cons access LinkedIn data, employ spear-phishing to swindle users

Police and independent cybersecurity experts stated that data shared by organisations and employees on the professional networking website enables a wide range of cybercrimes -- from financial frauds to Business Email Compromise (BEC) to corporate espionage. Cybersecurity researchers have observed cybercriminals routinely scanning professional networking sites such as LinkedIn to gather information on potential targets.

See the full report here: https://www.hindustantimes.com/cities/mumbai-news/cons-access-linkedin-data-employ-spear-phishing-to-swindle-users-101669662835186.html

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 and impacts Oracle Access Manager (OAM) versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0.

See the full report here: https://thehackernews.com/2022/11/cisa-warns-of-actively-exploited.html

Trigona ransomware spotted in increasing attacks worldwide

A previously unnamed ransomware has rebranded under the name "Trigona," launching a new Tor negotiation site where they accept Monero as ransom payments. Trigona has been active for a while, with samples seen at the beginning of the 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/trigona-ransomware-spotted-in-increasing-attacks-worldwide/

Let’s Encrypt issued over 3 billion certificates, securing 309M sites for free

Internet Security Research Group (ISRG), the nonprofit behind Let's Encrypt, says the open certificate authority (CA) has issued its three billionth certificate this year. Let's Encrypt has been providing websites with the X.509 digital certificates needed to enable HTTPS (SSL/TLS) and encrypted communications for free since September 2015, when it issued the first certificate for the helloworld.letsencrypt.org domain.

See the full report here: https://www.bleepingcomputer.com/news/security/let-s-encrypt-issued-over-3-billion-certificates-securing-309m-sites-for-free/

Spanish police dismantle operation that made EUR 12M via investment scams

Spanish National Police have dismantled a cybercrime organization that used fake investment sites to defraud over EUR 12.3 million from 300 victims across Europe. The malicious campaigns involved creating fake cryptocurrency investment sites with a similar appearance to well-known, legitimate platforms.

See the full report here: https://www.bleepingcomputer.com/news/security/spanish-police-dismantle-operation-that-made-12m-via-investment-scams/

Microsoft Defender boosts default protection for all enterprise users

Microsoft announced that built-in protection is generally available for all devices onboarded to Defender for Endpoint, the company's endpoint security platform. Once applied, this default set of settings provides better protection for enterprise endpoints against advanced and emerging threats, including ransomware attacks.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-boosts-default-protection-for-all-enterprise-users/

Twitter search spam campaign hides China riots, researchers say

Certain Twitter tags and searches were flooded with spam and suggestive ads in what appears to be an attempt to help the Chinese government censor news about rioters protesting coronavirus restrictions in China.

See the full report here: https://www.theregister.com/2022/11/29/twitter_search_spam_campaign_hides/?td=rt-3a

Blockchain couldn't stop TXT spam in India, regulator now trying AI

India's Telecom Regulatory Authority (TRAI) has announced a fresh crackdown on TXT spam – this time using artificial intelligence. The TRAI's approach to managing spam, saw the regulator create a mandatory register of telemarketers and telecoms service providers, and require them to secure opt-ins from message recipients.

See the full report here: https://www.theregister.com/2022/11/29/india_txt_spam_crackdown/

US Army app with Russian code reaped no user data, service says

An application approved by the U.S. Army that contained code from a Russian company harvested no information from the more than 1,000 people that downloaded it, according to the service, which has since discontinued its use. An army spokesperson claimed that there were “no indications” of a data breach tied to the National Training Center app, which was developed in 2016 by former training center personnel to provide installation news and information, such as phone numbers.

See the full report here: https://news.yahoo.com/us-army-app-russian-code-134421235.html

North Korea Hackers Using New "Dolphin" Backdoor to Spy on South Korean Targets

The North-Korean threat actor ScarCruft has been linked to a previously undocumented backdoor called Dolphin that the threat actor has used against targets in South Korea. Dolphin is said to be selectively deployed, with the malware using cloud services like Google Drive for data exfiltration as well as command-and-control. Cybersecurity researchers said they found the implant deployed as a final-stage payload as part of a watering hole attack in early 2021 directed against a South Korean digital newspaper.

See the full report here: https://thehackernews.com/2022/12/north-korea-hackers-using-new-dolphin.html

Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection

New findings show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "unexpected behavior" in the npm command line interface (CLI) tool. The npm CLI's install and audit commands have built-in capabilities to check a package and all of its dependencies for known vulnerabilities, effectively acting as a warning mechanism for developers by highlighting the flaws.

See the full report here: https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html

This Malicious App Abused Hacked Devices to Create Fake Accounts on Multiple Platforms

A malicious Android SMS app from the Google Play Store has been found to harvest text messages with the goal of creating accounts on a wide range of platforms like Facebook, Google, and WhatsApp. The app, named “Symoo” (com.vanjan.sms), had over 100,000 downloads and functioned as a relay for transmitting messages to a server, which advertises an account creation service.

See the full report here: https://thehackernews.com/2022/11/this-malicious-app-abused-hacked.html

French Electricity Provider Fined for Storing Users' Passwords with Weak MD5 Algorithm

The French data protection watchdog fined electricity provider Électricité de France EUR 600,000 for violating the European Union General Data Protection Regulation (GDPR) requirements. The Commission nationale de l'informatique et des libertés (CNIL) said the electric utility breached European regulation by storing the passwords for over 25,800 accounts by hashing them using the MD5 algorithm as recently as July 2022.

See the full report here: https://thehackernews.com/2022/11/french-electricity-provider-fined-for.html

Australia Passes Bill to Fine Companies up to AUD 50 Million for Data Breaches

The Australian government passed a bill that increases the penalty for companies suffering from serious or repeated data breaches. The maximum fines have been bumped up from the current AUD 2.22 million to AUD 50 million, 30% of an entity's adjusted turnover in the relevant period, or three times the value of any benefit obtained through the misuse of information, whichever is greater. The legislation, called the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, also bestows more powers to the Australian Information Commissioner to address security breaches.

See the full report here: https://thehackernews.com/2022/11/australia-passes-bill-to-fine-companies.html

Chinese Cyber Espionage Hackers Using USB Devices to Target Entities in Philippines

A threat actor (tracked as UNC4191) with a suspected China nexus has been linked to a set of espionage attacks in the Philippines that primarily relies on USB devices as an initial infection vector. An analysis of the artifacts used in the intrusions indicates that the campaign dates as far back as September 2021.

See the full report here: https://thehackernews.com/2022/11/chinese-cyber-espionage-hackers-using.html

Three New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS

Researchers have disclosed details of three new security vulnerabilities affecting operational technology (OT) products from CODESYS and Festo that could lead to source code tampering and denial-of-service (DoS). The vulnerabilities reported are the latest in a long list of flaws collectively tracked under the name OT:ICEFALL.

See the full report here: https://thehackernews.com/2022/11/3-new-vulnerabilities-affect-ot.html

NVIDIA releases GPU driver update to fix 29 security flaws

NVIDIA has released a security update for its GPU display driver for Windows, containing a fix for a high-severity flaw that threat actors can exploit to perform, among other things, code execution and privilege escalation. The latest security update addresses 25 vulnerabilities on the Windows and Linux GPU drivers, of which seven flaws are categorized as high-severity.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-releases-gpu-driver-update-to-fix-29-security-flaws/

Google discovers Windows exploit framework used to deploy spyware

Google's Threat Analysis Group (TAG) has linked an exploit framework that targets now-patched vulnerabilities in the Chrome and Firefox web browsers and the Microsoft Defender security app to a Spanish software company. The two most critical vulnerabilities are: CVE-2022-34669 (CVSS v3.1: 8.8) and CVE-2022-34671 (CVSS v3.1: 8.5). It is recommended to update both the Chrome and Firefox browsers immediately,

See the full report here: https://www.bleepingcomputer.com/news/security/google-discovers-windows-exploit-framework-used-to-deploy-spyware/

GoTo says hackers breached its dev environment, cloud storage

Remote access and collaboration company GoTo disclosed that it suffered a security breach where threat actors gained access to its development environment and third-party cloud storage service. GoTo (formerly LogMeIn) began emailing customers, informing that it has started investigating the cyberattack with the help of experts and alerted law enforcement.

See the full report here: https://www.bleepingcomputer.com/news/security/goto-says-hackers-breached-its-dev-environment-cloud-storage/

Keralty ransomware attack impacts Colombia's health care system

The Keralty multinational healthcare organization suffered a RansomHouse ransomware attack, disrupting the websites and operations of the company and its subsidiaries. Keralty is a Colombian healthcare provider that operates an international network of 12 hospitals and 371 medical centers in Latin America, Spain, the United States, and Asia.

See the full report here: https://www.bleepingcomputer.com/news/security/keralty-ransomware-attack-impacts-colombias-health-care-system/

Critical RCE bugs in Android remote keyboard apps with 2M installs

Three Android applications that allow users to use devices as remote keyboards for their computers have critical vulnerabilities that could expose key presses and enable remote code execution.The apps are PC Keyboard, Lazy Mouse, and Telepad, and their vulnerable versions (free and paid) and in Google Play they have a combined installation count of more than two million.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-rce-bugs-in-android-remote-keyboard-apps-with-2m-installs/

Lastpass says hackers accessed customer data in new breach

LastPass says unknown attackers breached its cloud storage using information stolen during a previous security incident from August 2022. The company added that the threat actors managed to access customer data stored in the compromised storage service. It also noted that customers' passwords have not been compromised and remain safely encrypted due to LastPass's Zero Knowledge architecture.

See the full report here: https://www.bleepingcomputer.com/news/security/lastpass-says-hackers-accessed-customer-data-in-new-breach/

Cybersecurity researchers take down DDoS botnet by accident

While analyzing a botnet network, cybersecurity researchers accidentally took down a cryptomining botnet that was also used for distributed denial-of-service (DDoS) attacks. The KmsdBot malware behind this botnet was discovered by members of the cybersecurity team after it infected one of their honeypots. KmsdBot targets Windows and Linux devices with a wide range of architectures, and it infects new systems via SSH connections that use weak or default login credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/cybersecurity-researchers-take-down-ddos-botnet-by-accident/

Crafty threat actor uses "aged" domains to evade security platforms

A sophisticated threat actor named "CashRewindo" has been using aged domains in global malvertising campaigns that lead to investment scam sites. Malvertising involves the injection of malicious JavaScript code in digital ads promoted by legitimate advertising networks, taking website visitors to pages that host phishing forms, drop malware, or operate scams. The CashRewindo malvertising campaigns are spread across Europe, North and South America, Asia, and Africa, using customized language and currency to appear legitimate to the local audience.

See the full report here: https://www.bleepingcomputer.com/news/security/crafty-threat-actor-uses-aged-domains-to-evade-security-platforms/