Threat Intelligence Bulletin: 12/02/2022

Breach Disclosure: 1.5kk_corp

On November 24, 2022, the ZeroFox Dark Ops team acquired a data package titled "1.5kk_corp". From this package, ZeroFox extracted 1,544,949 email addresses. Of these, 1,540,966 records were successfully linked to plain-text passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

CVE-2022-22947

Product Serial: P-2022-12-06a

TLP: CLEAR

In this report, ZeroFox Intelligence discusses the risk that CVE-2022-22947 poses while covering the technical details and providing a Sigma rule for detection.

Standing Intelligence Requirements

VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EST) on December 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

CVE-2022-22947 is an RCE vulnerability that allows threat actors to gain an initial foothold within a corporate network. When successfully exploited, this vulnerability provides the running malware with the same permissions as the user running the Spring Cloud Gateway application. This vulnerability allows a threat actor the ability to easily run arbitrary shell commands on a front-facing application. Accordingly, ZeroFox rates its impact as high because a successful exploitation attempt can lead to severe economic and reputational damage for an organization.

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could craft a malicious request that could allow arbitrary remote execution on the remote host.

Breach Disclosure: Eye4Fraud

On October 27, 2022, a threat actor from BreachForums posted a data breach package targeting Eye4Fraud, a U.S.-based company that provides fraud protection service for eCommerce merchants. From this package, ZeroFox extracted 466,802 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On October 27, 2022, a recently registered threat actor "eye4fraud" from BreachForums posted a data breach package targeting Eye4Fraud, a U.S.-based company that provides fraud protection service for eCommerce merchants. From this package, ZeroFox extracted 466,802 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include full names, phone numbers, physical addresses and payment methods.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Q3 2022 Public Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-12-07a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Public Sector Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to public sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. ZeroFox Intelligence assesses that the threat to the sector will likely increase in the coming months, underpinned by politically-inspired targeting. There were increases in particular aspects of the social engineering threat, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2.0 (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosures, particularly in software commonly used by public sector entities, will very likely strain out-of-cycle patch management processes and increase the likelihood of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, with Eastern European public sector bodies in particular likely facing an increased threat from distributed denial-of-service (DDoS) attacks by pro-Russian threat actors. Digital extortion attempts remained below 2021 levels, likely caused in part by difficulty eliciting victims’ payments. However, incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers; in coming months, the sector is likely to see an increase in politically-motivated extortion targeting.

Key Findings

Public sector organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
Vulnerabilities in software commonly used by public sector organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
The threat to public sector organizations from IABs increased in Q3 2022
Most public sector bodies around the world saw a negligible change in the threat from botnets, though Eastern European entities likely faced an increased threat.
While there were fewer ransomware and digital extortion attempts, threat actors continued to demonstrate a high degree of capability in attacks against critical infrastructure and government functions.

Q3 2022 Healthcare Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-12-07b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Healthcare Sector Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

DDW GEO MAL PII VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to healthcare sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. In Q3 2022, there were likely increases in particular aspects of the social engineering threat to healthcare organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2.0 (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosure, including in internet-connected medical devices and software commonly used by healthcare organizations, will very likely strain out-of-cycle patch management processes and increases the risk of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers, trojans, and spyware. Digital extortion attempts against healthcare targets remain below 2021 levels, likely caused in part by difficulty eliciting payments from victims. Incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream users.

Key Findings

Healthcare organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
Vulnerabilities in software commonly used by healthcare organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
The threat to healthcare organizations from IABs likely increased in Q3 2022.
The threat from cyber espionage remained high, with multiple campaigns by threat actors—including state-linked actors—identified in Q3 2022.
Ransomware and digital extortion attempts against the healthcare sector this quarter highlighted the threat of attacks against third-party providers.

Breach Disclosure: Openraid

On October 14, 2022, a reputed threat actor "emo" from BreachForums reposted a data breach package targeting Openraid (openraid[.]org), a gaming website operating from the United States. From this package, ZeroFox extracted 344,289 email addresses, usernames and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Я в Польше

On October 31, 2022, a reputed threat actor "copy" from BreachForums posted a data breach package targeting Я в Польше (yavp[.]pl), a website that details the life of Ukrainian and Russian citizens in Poland. From the package published in BreachForums, ZeroFox extracted 62,164 email addresses, usernames and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On October 31, 2022, a reputed threat actor "copy" from the BreachForums posted a data breach package targeting Я в Польше (yavp[.]pl), a website that provides information about the life of Ukrainian and Russian language-speakers in Poland. The threat actor noted that the data dump includes 62k lines of user information. The data dump was also circulated in a deep web forum "Leaked Databases" by the threat actor "baz00ka" on November 1, 2022. From the package published in BreachForums, ZeroFox extracted 62,164 email addresses, usernames and hashed passwords. Other notable data fields observed in this package include: id, name, usertype, lastvisitDate, activation, facebook_id, and ip.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-12-02 - 2022-12-08

Hackers Leak Another Set of Medibank Customer Data on the Dark Web

Medibank confirmed that the threat actors behind the recent cyber attack posted another package of data stolen from its systems on the dark web after its refusal to pay a ransom.

See the full report here: https://thehackernews.com/2022/12/hackers-leak-another-set-of-medibank.html

Researchers Disclose Critical RCE Vulnerability Affecting Quarkus Java Framework

A critical security vulnerability (CVE-2022-4116; CVSS score: 9.8) in the Quarkus Java framework could be exploited to achieve remote code execution. A malicious actor could exploit this vulnerability (found in the Dev UI Config Editor) without any privileges. Users should upgrade to version 2.14.2.Final and 2.13.5.Final to safeguard against the flaw.

See the full report here: https://thehackernews.com/2022/12/researchers-disclose-critical-rce.html

Schoolyard Bully Trojan Apps Stole Facebook Credentials from Over 300,000 Android Users

More than 300,000 users across 71 countries have been affected by a new Android threat campaign called the Schoolyard Bully Trojan. Mainly intended to steal Facebook credentials, the malware is disguised under legitimate education-themed applications to lure unsuspecting users into downloading them. The apps, which were available for download from the official Google Play Store, have now been taken down.

See the full report here: https://thehackernews.com/2022/12/schoolyard-bully-trojan-apps-stole.html

Almost 300 predatory loan apps found in Google and Apple stores

Almost 300 apps, downloaded by around 15 million users, have been pulled from the Google Play and Apple App stores over claims it promised quick loans at reasonable rates but then used extortion and other predatory schemes against borrowers. The loans came with hidden fees and high interest rates that drove up the payments and the apps asked for sensitive information on their mobile devices. This included SMS messages, photos, phone history and contact lists that was then used against victims.

See the full report here: https://www.theregister.com/2022/12/01/apple_google_predatory_loans/?td=rt-3a

Facebook approved 75% of ads threatening U.S. election workers

An investigation revealed Facebook’s inadequate ability to detect and remove death threats against election workers in the run up to the US midterm elections. The platform approved nine of the ten English-language death threats for publication and six of the ten Spanish-language death threats, the researchers reported.

See the full report here: https://www.theregister.com/2022/12/02/facebook_ads_screening/

FBI: Cuba ransomware raked in USD 60 million from over 100 victims

The FBI and CISA revealed in a new joint security advisory that the Cuba ransomware gang gained over USD 60 million from ransom payments as of August 2022 after breaching more than 100 victims worldwide. This is a follow-up to another advisory which warned that the cybercrime group compromised dozens of organizations from U.S. critical infrastructure sectors, making over USD 40 million since it started targeting U.S. companies.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-cuba-ransomware-raked-in-60-million-from-over-100-victims/

Compromised OEM Android platform certificates used to sign malware

Several platform certificates used by Android OEM device vendors to digitally sign core system applications were used by threat actors to sign apps containing malware. OEM Android device manufacturers use platform certificates, or platform keys, to sign devices' core ROM images containing the Android operating system and associated apps.

See the full report here: https://www.bleepingcomputer.com/news/security/compromised-oem-android-platform-certificates-used-to-sign-malware/

Hyundai app bugs allowed hackers to remotely unlock, start cars

Vulnerabilities in mobile apps reportedly exposed Hyundai and Genesis car models produced after 2012 to remote attacks that allowed unlocking and starting the vehicles. Security researchers found the issues and explored similar attack surfaces in the SiriusXM "smart vehicle" platform used in cars from other makers (Toyota, Honda, FCA, Nissan, Acura, and Infinity) that allowed them to "remotely unlock, start, locate, flash, and honk" them.

See the full report here: https://www.bleepingcomputer.com/news/security/hyundai-app-bugs-allowed-hackers-to-remotely-unlock-start-cars/

Android malware apps with 2 million installs spotted on Google Play

A new set of Android malware, phishing, and adware apps have infiltrated the Google Play store, tricking over two million people into installing them. The apps pretend to be useful utilities and system optimizers but, in reality, are the sources of performance issues, ads, and user-experience degradation.

See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-apps-with-2-million-installs-spotted-on-google-play/

Domain aging gang CashRewindo picks vintage sites to push malvertising

The threat group behind a global malvertising scheme is using so-called aged domains to evade cybersecurity mechanisms and catch victims in investment scams. They inject malicious code into digital advertisements on legitimate ad networks, using the infected ads to steer website visitors to pages that may install malware or run scams.

See the full report here: https://www.theregister.com/2022/12/02/cashrewindo_scam_domain_aging/

Hackers Exploiting Redis Vulnerability to Deploy New Redigo Malware on Servers

A previously undocumented Go-based malware is targeting Redis servers with the goal of taking control of the infected systems and likely building a botnet network. The attacks involve taking advantage of a critical security vulnerability (CVE-2022-0543; CVSS score: 10.0) in the open source, in-memory, key-value store that was disclosed earlier this year to deploy Redigo.

See the full report here: https://thehackernews.com/2022/12/hackers-exploiting-redis-vulnerability.html

Researchers Disclose Supply-Chain Flaw Affecting IBM Cloud Databases for PostgreSQL

IBM has fixed a high-severity security vulnerability affecting its Cloud Databases (ICD) for PostgreSQL product that could be exploited to tamper with internal repositories and run unauthorized code. The privilege escalation flaw (CVSS score: 8.8), dubbed "Hell's Keychain," has been described by researchers as a first-of-its-kind supply-chain attack vector impacting a cloud provider's infrastructure.

See the full report here: https://thehackernews.com/2022/12/researchers-disclose-supply-chain-flaw.html

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an Industrial Control Systems (ICS) advisory warning of multiple vulnerabilities in Mitsubishi Electric GX Works3 engineering software. Successful exploitation of these vulnerabilities could allow unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server module or to view and execute programs

See the full report here: https://thehackernews.com/2022/12/cisa-warns-of-multiple-critical.html

Hackers Sign Android Malware Apps with Compromised Platform Certificates

Platform certificates used by Android smartphone vendors like Samsung, LG, and MediaTek were reportedly abused to sign malicious apps. Rogue application signed with the same certificate can gain access to the highest level of privileges as the Android operating system, permitting it to harvest all kinds of sensitive information from a compromised device. Google stated that it informed all impacted vendors to rotate the certificates and that there's no evidence these apps were delivered through the Play Store.

See the full report here: https://thehackernews.com/2022/12/hackers-sign-android-malware-apps-with.html

Police arrest 55 members of "Black Panthers" SIM Swap gang

The Spanish National Police have arrested 55 "Black Panthers" group members, including one of the organization's leaders based in Barcelona. The gang was operating four specialized activity cells dedicated to social engineering, vishing (voice phishing), phishing, and carding.

See the full report here: https://www.bleepingcomputer.com/news/security/police-arrest-55-members-of-black-panthers-sim-swap-gang/

BlackProxies proxy service increasingly popular among hackers

A new residential proxy market is becoming popular among hackers, cybercriminals, phishers, scalpers, and scammers, selling access to a million claimed proxy IP addresses worldwide. The new platform ("BlackProxies") is one of the fastest growing newcomers in the space.

See the full report here: https://www.bleepingcomputer.com/news/security/blackproxies-proxy-service-increasingly-popular-among-hackers/

DHS Cyber Safety Board to review Lapsus$ gang’s hacking tactics

The Department of Homeland Security (DHS) Cyber Safety Review Board will review attacks linked to Lapsus$, which breached multiple high-profile companies in recent incidents. Lapsus$ breached Microsoft, Nvidia, T-Mobile, Samsung, Uber, Vodafone, Ubisoft, Okta, and e-commerce giant Mercado Libre earlier this year.

See the full report here: https://www.bleepingcomputer.com/news/security/dhs-cyber-safety-board-to-review-lapsus-gang-s-hacking-tactics/

Hackers use new, fake crypto app to breach networks, steal cryptocurrency

The North Korean "Lazarus" hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets. According to a joint FBI and CISA report from February 2021, AppleJeus has been in circulation since at least 2018, used by Lazarus in cryptocurrency hijacking and digital asset theft operations. A new report has identified new, fake crypto programs and AppleJeus activity, with signs of evolution in the malware's infection chain and abilities.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-new-fake-crypto-app-to-breach-networks-steal-cryptocurrency/

SIM swapper gets 18-months for involvement in USD 22 million crypto heist

A person was sentenced to 18 months in prison for his involvement in a fraud scheme that led to the theft of millions from a cryptocurrency investor. The funds were stolen following a January 2018 SIM swap attack to hijack the investor's phone number and fraudulently transfer roughly USD 23.8 million in cryptocurrency from his crypto wallet to an online account.

See the full report here: https://www.bleepingcomputer.com/news/security/sim-swapper-gets-18-months-for-involvement-in-22-million-crypto-heist/

Rackspace: Ongoing Exchange outage caused by security incident

Some of Rackspace’s hosted Microsoft Exchange services have been taken down by what the company has described as a security incident. The cloud computing services provider claimed that it became aware of an issue impacting the Microsoft Exchange environment and after further analysis, determined that it was a security incident. Rackspace is not certain when it will be able to restore its service to those impacted by the incident.

See the full report here: https://www.bleepingcomputer.com/news/technology/rackspace-ongoing-exchange-outage-caused-by-security-incident/

New CryWiper data wiper targets Russian courts, mayor’s offices

The CryWiper data malware was reportedly used in attacks against Russian mayor's offices and courts. The CryWiper is not ransomware, but it can cause severe data destruction and business interruption.

See the full report here: https://www.bleepingcomputer.com/news/security/new-crywiper-data-wiper-targets-russian-courts-mayor-s-offices/

Google Chrome emergency update fixes 9th zero-day of the year

Google has released Chrome 108.0.5359.94/.95 for Windows, Mac, and Linux users to address a single high-severity security flaw (CVE-2022-4262). The zero-day vulnerability is due to a high-severity type confusion weakness in the Chrome V8 JavaScript engine. Although Google said it detected attacks exploiting this zero-day, the company is yet to share technical details or information regarding these incidents.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-9th-zero-day-of-the-year/

Severe AMI MegaRAC flaws impact servers from AMD, ARM, HPE, Dell, others

Three vulnerabilities in the American Megatrends MegaRAC Baseboard Management Controller (BMC) software impact server equipment used in many cloud service and data center providers. The flaws could enable attackers, under certain conditions, to execute code, bypass authentication, and perform user enumeration. System admins are recommended to disable remote administration options and add remote authentication steps where possible.

See the full report here: https://www.bleepingcomputer.com/news/security/severe-ami-megarac-flaws-impact-servers-from-amd-arm-hpe-dell-others/

Hackers hijack Linux devices using PRoot isolated filesystems

Hackers are abusing the open-source Linux PRoot utility in BYOF (Bring Your Own Filesystem) attacks to provide a consistent repository of malicious tools that work on many Linux distributions. A Bring Your Own Filesystem attack is when threat actors create a malicious filesystem on their own devices that contain a standard set of tools used to conduct attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hijack-linux-devices-using-proot-isolated-filesystems/

Sneaky hackers reverse defense mitigations when detected

A financially motivated threat actor is hacking telecommunication service providers and business process outsourcing firms, actively reversing defensive mitigations applied when the breach is detected. The campaign was spotted in June 2022 and are still ongoing, with security researchers able to identify five distinct intrusions. The attacks have been attributed with low confidence to hackers tracked as Scattered Spider.

See the full report here: https://www.bleepingcomputer.com/news/security/sneaky-hackers-reverse-defense-mitigations-when-detected/

Ransomware attack forces French hospital to transfer patients

The André-Mignot teaching hospital in the suburbs of Paris had to shut down its phone and computer systems because of a recent ransomware attack. The Ile-de-France Regional Health Agency (ARS) advised patients with already scheduled consultations or planned interventions (e.g., surgery, chemotherapy, radiotherapy) to reach out to their doctor or the department they were assigned, who will redirect them to an available treatment unit.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-forces-french-hospital-to-transfer-patients/

CISA orders agencies to patch exploited Google Chrome bug by Dec 26

The Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability to its list of bugs known to be exploited in attacks. The actively exploited zero-day bug (CVE-2022-4262) was patched on December 2, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-exploited-google-chrome-bug-by-dec-26th/

Microsoft warns of Russian cyberattacks throughout the winter

Microsoft has warned of Russian-sponsored cyberattacks continuing to target Ukrainian infrastructure and NATO allies in Europe throughout the winter. The attacks have been accompanied by a propaganda campaign to undermine Western support (from the U.S., EU, and NATO) for Ukraine. Russian propaganda has also sought to undermine European support for Ukraine and sow discord, with the end goal of disrupting the supply of aid and weaponry to Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-russian-cyberattacks-throughout-the-winter/

Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems

The maintainers of the FreeBSD operating system have released updates to fix a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution. The issue (CVE-2022-23093) impacts all supported versions of FreeBSD and concerns a stack-based buffer overflow vulnerability in the ping service.

See the full report here: https://thehackernews.com/2022/12/critical-ping-vulnerability-allows.html

Hackers now selling 150,000 patients' data of TN hospital on Dark Web

The data records of at least 150,000 patients from a hospital (Sree Saran Medical Center) located in the Indian state Tamil Nadu are being sold on the dark web for hundreds of dollars.

See the full report here: https://www.business-standard.com/article/current-affairs/hackers-now-selling-150k-patients-data-of-tn-hospital-on-dark-web-report-122120200647_1.html

Samsung Galaxy S22 hacked twice on first day of Pwn2Own Toronto

Contestants have hacked the Samsung Galaxy S22 smartphone twice during the first day of the Pwn2Own Toronto 2022 hacking competition. According to the contest's rules, in both cases, the Galaxy S22 devices ran the latest version of the Android operating system with all available updates installed.

See the full report here: https://www.bleepingcomputer.com/news/security/samsung-galaxy-s22-hacked-twice-on-first-day-of-pwn2own-toronto/

Amnesty International Canada breached by suspected Chinese hackers

Amnesty International's Canadian branch has disclosed a security breach detected in early October 2022 and linked it to a Chinese-backed threat group. The international human rights non-governmental organization (NGO) says it first detected the breach on October 5 2022, when it spotted suspicious activity on its IT infrastructure.

See the full report here: https://www.bleepingcomputer.com/news/security/amnesty-international-canada-breached-by-suspected-chinese-hackers/

Antwerp's city services down after hackers attack digital partner

The city of Antwerp, Belgium, is working to restore its digital services that were disrupted by a cyberattack on its digital provider. The disruption affected services used by citizens, schools, daycare centers, and the police. Among the services affected by the attack are those from the Antwerp Healthcare Company (Zorgbedrijf Antwerpen), which provides residential care services to seniors in the province.

See the full report here: https://www.bleepingcomputer.com/news/security/antwerps-city-services-down-after-hackers-attack-digital-partner/

Suspects arrested for hacking US networks to steal employee data

Four men suspected of hacking into U.S. networks to steal employee data for identity theft and the filing of fraudulent U.S. tax returns have been arrested in Europe at the request of the U.S. law enforcement authorities. To gain access to these servers, the Department of Justice says the suspects purchased stolen credentials from cybercrime marketplaces, such as the now-shut-down xDedic marketplace.

See the full report here: https://www.bleepingcomputer.com/news/security/suspects-arrested-for-hacking-us-networks-to-steal-employee-data/

Microsoft: Hackers target cryptocurrency firms over Telegram

Microsoft says that cryptocurrency investment companies have been targeted by a threat group it tracks as DEV-0139 via Telegram groups used to communicate with the firms' VIP customers.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-hackers-target-cryptocurrency-firms-over-telegram/

South Pacific vacations may be wrecked by ransomware

New Zealand's Privacy Commission has signalled it may open an investigation into local managed services provider Mercury IT, which serves many government agencies and businesses and has been hit by ransomware. Mercury's website is, at the time of this report, a single page that states "Mercury IT provides a wide range of IT services to customers throughout New Zealand."

See the full report here: https://www.theregister.com/2022/12/07/nz_vanuatu_cyberattacks/

Open Source Ransomware Toolkit Cryptonite Turns Into Accidental Wiper Malware

A version of an open source ransomware toolkit called Cryptonite has been observed in the wild with (inadvertent) wiper capabilities due to its "weak architecture and programming." Cryptonite, unlike many other ransomware strains, is not available for sale on the cybercriminal underground, and was instead offered for free by an actor named CYBERDEVILZ until recently through a GitHub repository. The source code and its forks have since been taken down.

See the full report here: https://thehackernews.com/2022/12/open-source-ransomware-toolkit.html

Android December 2022 security updates fix 81 vulnerabilities

Google has released the December 2022 security update for Android, fixing four critical-severity vulnerabilities, including a remote code execution flaw exploitable via Bluetooth. The update addresses 45 vulnerabilities in core Android components with patch level 2022-12-01, and another 36 vulnerabilities impacting third-party components addressed in patch level 2022-12-05.

See the full report here: https://www.bleepingcomputer.com/news/security/android-december-2022-security-updates-fix-81-vulnerabilities/

Rackspace confirms outage was caused by ransomware attack

Texas-based cloud computing provider Rackspace has confirmed that a ransomware attack is behind an ongoing Hosted Exchange outage described as an "isolated disruption." The attack took place on December 2, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/rackspace-confirms-outage-was-caused-by-ransomware-attack/

Massive DDoS attack takes Russia’s second-largest bank VTB offline

Russia's second-largest financial institution VTB Bank says it is facing the worst cyberattack in its history after its website and mobile apps were taken offline due to an ongoing DDoS (distributed denial of service) attack.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-ddos-attack-takes-russia-s-second-largest-bank-vtb-offline/

New Go-based Zerobot Botnet Exploiting Dozen of IoT Vulnerabilities to Expand its Network

A novel Go-based botnet called Zerobot has been observed in the wild proliferating by taking advantage of nearly two dozen security vulnerabilities in the internet of things (IoT) devices and other software. The botnet contains several modules, including self-replication, attacks for different protocols, and self-propagation.

See the full report here: https://thehackernews.com/2022/12/new-go-based-zerobot-botnet-exploiting.html

Chinese Hackers Target Middle East Telecoms in Latest Cyber Attacks

A malicious campaign targeting the Middle East is likely linked to BackdoorDiplomacy, an advanced persistent threat (APT) group with ties to China. The espionage activity, directed against a telecom company in the region, is said to have commenced on August 19, 2021 through the successful exploitation of ProxyShell flaws in the Microsoft Exchange Server.

See the full report here: https://thehackernews.com/2022/12/chinese-hackers-target-middle-east.html

Iranian State Hackers Targeting Key Figures in Activism, Journalism, and Politics

Hackers with ties to the Iranian government have been linked to an ongoing social engineering and credential phishing campaign directed against human rights activists, journalists, researchers, academics, diplomats, and politicians working in the Middle East. At least 20 individuals are believed to have been targeted, Human Rights Watch (HRW) said in a report, attributing the malicious activity to an adversarial collective tracked as APT42.

See the full report here: https://thehackernews.com/2022/12/iranian-state-hackers-targeting-key.html

Darknet's Largest Mobile Malware Marketplace Threatens Users Worldwide

Cybersecurity researchers have revealed details about a darknet marketplace called InTheBox that is designed to specifically cater to mobile malware operators. The actor behind the criminal storefront, believed to be available since at least January 2020, has been offering over 400 custom web injects grouped by geography that can be purchased by other adversaries looking to mount attacks of their own.

See the full report here: https://thehackernews.com/2022/12/darknets-largest-mobile-malware.html

Vice Society Ransomware Attackers Targeted Dozens of Schools in 2022

The Vice Society cybercrime group has disproportionately targeted educational institutions, accounting for 33 victims in 2022 and surpassing other ransomware families like LockBit, BlackCat, BianLian, and Hive. Other prominent industry verticals targeted include healthcare, governments, manufacturing, retail, and legal services.

See the full report here: https://thehackernews.com/2022/12/vice-society-ransomware-attackers.html

Chinese Hackers Using Russo-Ukrainian War Decoys to Target APAC and European Entities

The China-linked nation-state hacking group Mustang Panda is using lures related to the ongoing Russo-Ukrainian war to attack entities in Europe and the Asia-Pacific. Some of the targeted countries include Vietnam, India, Pakistan, Kenya, Turkey, Italy, and Brazil.

See the full report here: https://thehackernews.com/2022/12/chinese-hackers-using-russo-ukrainian.html

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based military weapons and hardware supplier. The new infrastructure was attributed to a threat activity group tracked under the name TAG-53, and is known by the cybersecurity community as Blue Callisto, Callisto, COLDRIVER, SEABORGIUM, and TA446.

See the full report here: https://thehackernews.com/2022/12/russian-hackers-spotted-targeting-us.html

Microsoft Alerts Cryptocurrency Industry of Targeted Cyberattacks

Cryptocurrency investment companies are the target of a developing threat cluster that uses Telegram groups to seek out potential victims. Microsoft's Security Threat Intelligence Center (MSTIC) is tracking the activity under the name DEV-0139, and builds upon a recent report that attributed the same set of attacks to North Korea's Lazarus Group.

See the full report here: https://thehackernews.com/2022/12/microsoft-alerts-cryptocurrency.html

CryptosLabs "pig butchering" ring stole up to USD 505 million since 2018

A previously unknown investment scam group named "CryptosLabs" has stolen up to EUR 480 million (USD 505 million) from victims in France, Belgium, and Luxembourg, since the launch of its operation in 2018. "CryptosLabs" is one of the most well-organized crime groups of its kind, featuring kingpins, sales agents, developers, and call-center operators.

See the full report here: https://www.bleepingcomputer.com/news/security/cryptoslabs-pig-butchering-ring-stole-up-to-505-million-since-2018/

CloudSEK claims it was hacked by another cybersecurity firm

Indian cybersecurity firm CloudSEK says a threat actor gained access to its Confluence server using stolen credentials for one of its employees' Jira accounts. While some internal information, including screenshots of product dashboards and some customers' names and purchase orders, was exfiltrated from its Confluence wiki, CloudSEK says the attackers didn't compromise its databases.

See the full report here: https://www.bleepingcomputer.com/news/security/cloudsek-claims-it-was-hacked-by-another-cybersecurity-firm/

Hackers use new Fantasy data wiper in coordinated supply chain attack

The Iranian Agrius APT hacking group is using a new "Fantasy" data wiper in supply-chain attacks impacting organizations in Israel, Hong Kong, and South Africa. The campaign started in February 2022 and unfolded at full scale in March 2022, breaching an IT support services firm, a diamond wholesaler, a jeweler, and an HR consulting company.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-new-fantasy-data-wiper-in-coordinated-supply-chain-attack/

Google: State hackers still exploiting Internet Explorer zero-days

Google's Threat Analysis Group (TAG) revealed that a group of North Korean hackers tracked as APT37 exploited a previously unknown Internet Explorer vulnerability to infect South Korean targets with malware.

See the full report here: https://www.bleepingcomputer.com/news/security/google-state-hackers-still-exploiting-internet-explorer-zero-days/

Elon Musk's Twitter followers targeted in fake crypto giveaway scam

Elon Musk followers are being added to a "Deal of the Year" list on Twitter that lures them into depositing small crypto amounts into the attackers' wallet with the false promise of receiving up to 5,000 BTC in return.

See the full report here: https://www.bleepingcomputer.com/news/security/elon-musks-twitter-followers-targeted-in-fake-crypto-giveaway-scam/

Chinese hackers stole millions worth of U.S. COVID relief money, Secret Service says

Chinese hackers have stolen tens of millions of dollars worth of U.S. COVID relief benefits since 2020. The Secret Service declined to provide any additional details but confirmed claims that the Chinese hacking team that is reportedly responsible is known within the security research community as APT41 or Winnti.

See the full report here: https://www.reuters.com/technology/chinese-hackers-stole-millions-worth-us-covid-relief-money-secret-service-says-2022-12-05/