Threat Intelligence Bulletin: 12/23/2022 - 12/29/2022

December 30, 2022

Alpha Team

Breach Disclosure: Yappy

An alleged July 2022 data breach at Yappy – a video-sharing application based in Russia – exposed 66 email addresses and/or usernames, which were subsequently shared on several deep web sources. 63 records were successfully linked to hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In July 2022, Yappy – a video-sharing application based in Russia – allegedly suffered a security incident, in which 66 email addresses and/or usernames were exposed and subsequently shared on several deep web sources. Of these, 63 records were successfully linked to hashed passwords. Other notable data fields observed in this package include name, birthday, and gender. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: NterOne

An alleged July 2022 data breach at NterOne, an online training and consulting company, exposed 203,063 email addresses and hashed passwords, which were subsequently shared on a deep web source.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In July 2022, NterOne, a U.S.-based online training and consulting company, allegedly suffered a security incident, in which 203,063 email addresses and hashed passwords were exposed and subsequently shared on a deep web forum. Other notable information leaked in this package includes full names, IP addresses, phone numbers, physical addresses, and user activity. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Liftow

An alleged October 2022 data breach at Liftow, a Toyota forklift and material handling solutions company, exposed 98,487 email addresses, which were subsequently shared on a deep web source.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In October 2022, Liftow, a Canada-based Toyota forklift and material handling solutions company, allegedly suffered a security incident, in which 98,487 email addresses were exposed and subsequently shared on a deep web forum. Other notable information leaked in this package includes names, physical addresses, phone numbers, and client information. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Gaforu

An alleged October 2022 data breach at Gaforu, a gaming website, exposed 826,615 email addresses, hashed passwords, and/or usernames, which were subsequently shared on a deep web source.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In October 2022, Gaforu, a gaming website, allegedly suffered a security incident, in which 826,615 email addresses, hashed passwords, and/or usernames were exposed and subsequently shared on a deep web forum. Other notable information leaked in this package includes IP address, birthday, and social media profiles. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Viva Air

An alleged data breach at Viva Air, an airlines based in Colombia, exposed 165,198 email addresses and card numbers, which were subsequently shared on a deep web source.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Viva Air, an airlines based in Colombia, allegedly suffered a security incident, in which 165,198 email addresses and card numbers were exposed and subsequently shared on a deep web forum. Other notable information leaked in this package includes names, IP addresses, phone numbers, physical addresses, IIN (issuer identification number), and user activity. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Muscle Nutrition

An alleged September 2022 data breach at Muscle Nutrition, an online food supplements store, exposed 138,279 email addresses and hashed passwords, which were subsequently shared on several deep web sources.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In September 2022, Muscle Nutrition, a Slovenia-based online food supplements store, allegedly suffered a security incident, in which 138,279 email addresses and hashed passwords were exposed and subsequently shared on several deep web forums. Other notable information leaked in this package includes name, physical address, company, fax number, and phone number. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: InfraGard

An alleged December 2022 data breach at InfraGard, an American intelligence-sharing platform for critical infrastructure protection, exposed 48,139 email addresses and usernames, which were subsequently shared on several deep web sources.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In December 2022, InfraGard, a U.S.-based intelligence-sharing platform for critical infrastructure protection, allegedly suffered a security incident, in which 48,139 email addresses and usernames were exposed and subsequently shared on several deep web platforms. Other notable information leaked in this package includes names, phone numbers, and company names. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: CEAnswer

An alleged data breach at CEAnswer, a platform that provides online educational content, exposed 36,717 email addresses, hashed passwords, and usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

CEAnswer, a platform that provides online educational content, allegedly suffered a security incident, in which 36,717 email addresses, hashed passwords, and usernames were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package includes users’ names, activation codes, last login, and phone numbers. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-12-23 - 2022-12-29

Leading sports betting firm BetMGM discloses data breach

Leading sports betting company BetMGM disclosed that a threat actor stole personal information belonging to an undisclosed number of customers. The data that was stolen in the attack varies for each customer; the attackers obtained a wide range of data including names, contact info, and transaction details.

See the full report here: https://www.bleepingcomputer.com/news/security/leading-sports-betting-firm-betmgm-discloses-data-breach/

Lastpass: Hackers stole customer vault data in cloud storage breach

LastPass revealed that attackers stole customer vault data after breaching its cloud storage using information stolen during an August 2022 incident.

See the full report here: https://www.bleepingcomputer.com/news/security/lastpass-hackers-stole-customer-vault-data-in-cloud-storage-breach/

Comcast Xfinity accounts hacked in widespread 2FA bypass attacks

Comcast Xfinity customers reported that their accounts were hacked in widespread attacks that bypass two-factor authentication. These compromised accounts were then used to reset passwords for other services, such as the Coinbase and Gemini crypto exchanges.

See the full report here: https://www.bleepingcomputer.com/news/security/comcast-xfinity-accounts-hacked-in-widespread-2fa-bypass-attacks/

Vice Society ransomware gang switches to new custom encryptor

The Vice Society ransomware operation has switched to using a custom ransomware encrypt that implements a strong, hybrid encryption scheme based on NTRUEncrypt and ChaCha20-Poly1305.

See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-ransomware-gang-switches-to-new-custom-encryptor/

FIN7 hackers create auto-attack platform to breach Exchange servers

The notorious FIN7 hacking group uses an automated attack system that exploits Microsoft Exchange and SQL injection vulnerabilities to breach corporate networks, steal data, and select targets for ransomware attacks based on financial size.

See the full report here: https://www.bleepingcomputer.com/news/security/fin7-hackers-create-auto-attack-platform-to-breach-exchange-servers/

Two New Security Flaws Reported in Ghost CMS Blogging Software

Cybersecurity researchers have detailed two security flaws (CVE-2022-41654) in the JavaScript-based blogging platform known as Ghost, one of which could be abused to elevate privileges via specially crafted HTTP requests.

See the full report here: https://thehackernews.com/2022/12/two-new-security-flaws-reported-in.html

Critical Security Flaw Reported in Passwordstate Enterprise Password Manager

Multiple high-severity vulnerabilities have been disclosed in Passwordstate password management solution that could be exploited by an unauthenticated remote adversary to obtain a user's plaintext passwords. The list of vulnerabilities identified include: CVE-2022-3875 (CVSS score: 9.1), CVE-2022-3876 (CVSS score: 6.5), CVE-2022-3877 (CVSS score: 5.7). Users are recommended to update to Passwordstate 9.6 - Build 9653 or later versions to mitigate the potential threats.

See the full report here: https://thehackernews.com/2022/12/critical-security-flaw-reported-in.html

Massive Twitter data leak investigated by EU privacy watchdog

An inquiry was launched following news reports of a massive Twitter data leak. This leak affected over 5.4 million Twitter users and included both public information scraped from the site as well as private phone numbers and email addresses. The data was obtained through the exploitation of an API vulnerability that Twitter had fixed in January 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-twitter-data-leak-investigated-by-eu-privacy-watchdog/

Hackers exploit bug in WordPress gift card plugin with 50K installs

Hackers are actively targeting a critical flaw in YITH WooCommerce Gift Cards Premium, a WordPress plugin used on over 50,000 websites. Exploiting the vulnerability, tracked as CVE-2022-45359 (CVSS v3: 9.8), allows unauthenticated attackers to upload files to vulnerable sites, including web shells that provide full access to the site.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-bug-in-wordpress-gift-card-plugin-with-50k-installs/

New info-stealer malware infects software pirates via fake cracks sites

A new information-stealing malware named "RisePro" is being distributed through fake cracks sites operated by the PrivateLoader pay-per-install (PPI) malware distribution service. RisePro is designed to help attackers steal victims’ credit cards, passwords, and crypto wallets from infected devices.

See the full report here: https://www.bleepingcomputer.com/news/security/new-info-stealer-malware-infects-software-pirates-via-fake-cracks-sites/

W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names

Threat actors have published yet another round of malicious packages to Python Package Index (PyPI) with the goal of delivering information-stealing malware on compromised developer machines. These two versions, which were live on PyPI for about an hour before they were pulled, have been reportedly downloaded 400 times.

See the full report here: https://thehackernews.com/2022/12/w4sp-stealer-discovered-in-multiple.html

Researchers Warn of Kavach 2FA Phishing Attacks Targeting Indian Govt. Officials

A new targeted phishing campaign is focusing on a two-factor authentication solution called Kavach used by Indian government officials. The campaign has been attributed to SideCopy, a hacking crew believed to be of Pakistani origin and active since at least 2019.

See the full report here: https://thehackernews.com/2022/12/researchers-warn-of-kavach-2fa-phishing.html

France Fines Microsoft EUR 60 Million for Using Advertising Cookies Without User Consent

France's privacy watchdog has imposed a EUR 60 million (USD 63.88 million) fine against Microsoft's Ireland subsidiary for dropping advertising cookies in users' computers without their explicit consent in violation of data protection laws in the European Union.

See the full report here: https://thehackernews.com/2022/12/france-fines-microsoft-60-million-for.html

Hacker claims to be selling Twitter data of 400 million users

A Breach Forums user claims to be selling public and private data of 400 million Twitter users scraped in 2021 using a now-fixed API vulnerability for USD 200,000. The forum post includes sample data for several celebrities, politicians, and journalists, including Alexandria Ocasio-Cortez, Donald Trump JR, and Piers Morgan.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-claims-to-be-selling-twitter-data-of-400-million-users/

GuLoader Malware Utilizing New Techniques to Evade Security Software

Cybersecurity researchers have exposed a variety of techniques adopted by an advanced malware downloader called GuLoader (also called CloudEyE) to evade security software. The techniques include several anti-analysis and anti-debugging tricks at every step of execution, throwing an error message if it detects any known analysis of debugging mechanisms.

See the full report here: https://thehackernews.com/2022/12/guloader-malware-utilizing-new.html

BTC.com lost $3 million worth of cryptocurrency in cyberattack

BTC.com, one of the world's largest cryptocurrency mining pools, announced it was the victim of a cyberattack that resulted in the theft of approximately USD 3 million worth of crypto assets belonging to both customers and the company.

See the full report here: https://www.bleepingcomputer.com/news/security/btccom-lost-3-million-worth-of-cryptocurrency-in-cyberattack/

Hackers steal $8 million from users running trojanized BitKeep apps

Several BitKeep crypto wallet users reported that their wallets were drained during Christmas after hackers triggered transactions that didn't require verification. The incident appears to have impacted users who downloaded an unofficial version of the BitKeep app.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-8-million-from-users-running-trojanized-bitkeep-apps/

EarSpy attack eavesdrops on Android phones via motion sensors

Researchers has developed an eavesdropping attack (EarSpy) for Android devices that can recognize the caller's gender and identity, and even private speech. EarSpy is an academic effort of researchers from five American universities (Texas A&M University, New Jersey Institute of Technology, Temple University, University of Dayton, and Rutgers University).

See the full report here: https://www.bleepingcomputer.com/news/security/earspy-attack-eavesdrops-on-android-phones-via-motion-sensors/

Indian Railways data breach: 30 million user records up for sale

Indian Railways allegedly suffered a data breach in which the data of over 30 million users was compromised and is being sold on a hacker forum. The seller claims that the data includes name, email, phone number, gender, and other personal information.

See the full report here: https://www.moneycontrol.com/news/india/indian-railways-data-breach-30-million-user-records-up-for-sale-9772761.html

US Probes How USD 372 Million Vanished in Hack After FTX Bankruptcy

The U.S. Department of Justice has reportedly launched a criminal probe into the alleged hack that stole nearly USD 400 million from FTX-controlled wallets the night the exchange filed for bankruptcy. The criminal investigation is separate from the fraud case against former CEO Sam Bankman-Fried.

See the full report here: https://www.bloomberg.com/news/articles/2022-12-27/us-probes-how-372-million-vanished-in-hack-after-ftx-bankruptcy?leadSource=uverify%20wall

British Cabinet minister’s Twitter account hacked to promote cryptocurrencies

The Twitter account of the British education secretary Gillian Keegan appeared to have been hacked, with the account posting several tweets promoting a cryptocurrency event. Last month, the Commons speaker wrote to MPs advising them to ramp up security on their mobile phones with multi-factor verification, as well as update software and delete old messages.

See the full report here: https://www.theguardian.com/technology/2022/dec/26/hack-of-twitter-uk-education-secretary-gillian-keegan-changes-profile-picture-elon-musk

BlueNoroff APT Hackers Using New Ways to Bypass Windows MotW Protection

BlueNoroff, a subcluster of the notorious Lazarus Group, has been observed adopting new techniques into its playbook that enable it to bypass Windows Mark of the Web (MotW) protections. This includes the use of optical disk image (.ISO extension) and virtual hard disk (.VHD extension) file formats as part of a novel infection chain.

See the full report here: https://thehackernews.com/2022/12/bluenoroff-apt-hackers-using-new-ways.html

Ransomware attack at Louisiana hospital impacts 270,000 patients

The Lake Charles Memorial Health System (LCMHS) in Louisiana (United States) is sending out notices of a data breach affecting roughly 270,000 of its patients. The affected files include personal and medical information. People who received care in LCMHS in the past should be alert for incoming communications asking personal information and payment data and monitor their bank statements.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-at-louisiana-hospital-impacts-270-000-patients/

Thousands of Citrix servers vulnerable to patched critical flaws

Thousands of Citrix ADC and Gateway deployments remain vulnerable to two critical-severity security issues (CVE-2022-27510 and CVE-2022-27518) that were fixed earlier in 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/thousands-of-citrix-servers-vulnerable-to-patched-critical-flaws/

APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector

Microsoft's decision to block Visual Basic for Applications (VBA) macros by default for Office files downloaded from the internet has led many threat actors to improvise their attack chains.

See the full report here: https://thehackernews.com/2022/12/apt-hackers-turn-to-malicious-excel-add.html

Royal ransomware claims attack on Intrado telecom provider

The Royal Ransomware gang claimed responsibility for a cyber attack against telecommunications company Intrado. While Intrado is yet to share any information regarding this incident, it indicated that the attack started on December 1, 2022 and the initial ransom demand was USD 60 million.

See the full report here: https://www.bleepingcomputer.com/news/security/royal-ransomware-claims-attack-on-intrado-telecom-provider/

North Korean hackers stealing NFTs using nearly 500 phishing domains

Hackers linked to North Korea’s Lazarus Group are reportedly behind a massive phishing campaign targeting nonfungible token (NFT) investors — utilizing nearly 500 phishing domains to dupe victims.

See the full report here: https://www.investing.com/news/cryptocurrency-news/north-korean-hackers-stealing-nfts-using-nearly-500-phishing-domains-2970307

Hacker group claims U.S. military devices with biometric data auctioned online

Members of a hacking group have claimed that they were able to order U.S. military equipment used in Afghanistan that contained sensitive data and the biometric information of over 2,000 people.

See the full report here: https://www.thehindu.com/sci-tech/technology/ccc-hacker-group-claims-us-military-devices-biometric-data-auctioned-online-afghanistan-taliban/article66313159.ece

Hackers abuse Google Ads to spread malware in legit software

Malware operators have been increasingly abusing the Google Ads platform to spread malware to unsuspecting users searching for popular software products. Among the products impersonated in these campaigns include Grammarly, MSI Afterburner, Slack, Dashlane, and Malwarebytes.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-to-spread-malware-in-legit-software/

BitKeep Confirms Cyber Attack Losses of Over USD 9 Million in Digital Currencies

Decentralized multi-chain crypto wallet BitKeep confirmed a cyberattack that allowed threat actors to distribute fraudulent versions of its Android app with the goal of stealing users' digital currencies.

See the full report here: https://thehackernews.com/2022/12/bitkeep-confirms-cyber-attack-loses.html

Tags:

all industries

global