Threat Intelligence Bulletin: 01/06/2023 - 01/12/2023
|by Alpha Team
CVE-2022-26134
Product Serial: P-2023-01-06a
TLP:CLEAR
In this profile, ZeroFox Intelligence discusses the risk CVE-2022-26134 poses while covering the technical details and providing a Sigma rule for detection.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Link to Download
View the full report here.
Current Description
CVE-2022-26134 is an Open Graph Navigation Language (OGNL) injection vulnerability that allows an unauthenticated attacker to execute arbitrary code on affected versions of an Atlassian Confluence server or data center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Breach Disclosure: ClickASnap
An alleged September 2022 data breach at ClickASnap, an image sharing website based in United Kingdom, exposed 3,344,366 email addresses, username and hashed passwords, which were subsequently shared on a deep web platform.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
In September 2022, ClickASnap, an image sharing website based in United Kingdom, allegedly suffered a security incident, in which 3,344,366 email addresses, username and hashed passwords were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package includes full name and postal address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Breach Disclosure: Aidan Gray
An alleged data breach at Aidan Gray, a U.S.-based furniture manufacturer and seller, exposed 8,115 email addresses, which were subsequently shared on a deep web platform.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
Aidan Gray, a U.S.-based furniture manufacturer and seller, allegedly suffered a security incident, in which 8,115 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package includes full name, physical addresses, phone number, date of birth, fax number, and gender. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Breach Disclosure: Michael Miller Fabrics
An alleged data breach at Michael Miller Fabrics, a U.S.-based textile products manufacturer, exposed 30,792 email addresses, which were subsequently shared on a deep web platform.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
Michael Miller Fabrics, a U.S.-based textile products manufacturer, allegedly suffered a security incident, in which 30,792 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package includes name, telephone number, and postal address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Breach Disclosure: Twitter - DB/Scraper Leak 200 million
An alleged data breach at Twitter – via an API abuse that enabled email addresses to be resolved to Twitter profiles – exposed 205,295,063 email addresses and usernames, which were subsequently shared on several deep web platforms.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
Twitter allegedly suffered a security incident sometime in 2021 via an API abuse that enabled email addresses to be resolved to Twitter profiles, in which 205,295,063 email addresses and usernames were leaked, which were subsequently shared on several deep web platforms. No passwords were found in this breach. Other notable information leaked in this package include name, follower count, and account creation time. The threat actor did not disclose the ultimate source of the data breach.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
LastPass Breach Update
Product Serial: F-2023-01-09a
TLP:CLEAR
In this flash report, ZeroFox Intelligence shares details on the LastPass data breach.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Link to Download
View the full report here.
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations.All sources used in this particular Intelligence product were identified prior to 1:00 PM (EST) on January 9, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Key Findings
- Concern over an August 2022 security incident at LastPass has grown considerably from initial assessments.
- The number of LastPass users impacted by the breach remains unknown.
- In December 2022, LastPass determined that the threat actor gained access to customers’ company names, end-user names, billing addresses, email addresses, telephone numbers, and IP addresses.
- A class action lawsuit has been filed against LastPass seeking damages and restitution for any LastPass users who had data stolen in the breach..
The Underground Economist: Volume 2, Issue 25
Welcome back to The Underground Economist, Volume 2, Issue 25, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of January 6, 2023.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Link to Download
View the full piece here.
Microsoft Patch Tuesday 1/11/2023 Notes
This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Recommendations
Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.
Details
Highlights:
Microsoft's Patch Tuesday update for January 2023 involved 98 vulnerabilities in total, with:
- 11 vulnerabilities classified as Critical
- 1 zero-day vulnerability, which is being actively exploited
(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)
Most notable vulnerabilities
This month’s security updates include patches for a zero-day bug: CVE-2023-21674 – a Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege vulnerability, which is being actively exploited in the wild. Another significant bug patched in this batch is CVE-2023-21549 (a Windows SMB Witness Service Elevation of Privilege vulnerability).
A critical security bypass flaw, CVE-2023-21743, affects organizations running Microsoft SharePoint Server. To patch this vulnerability, it’s not enough to deploy the Microsoft updates. System administrators will also need to initiate a SharePoint upgrade action included in this update. Microsoft also issued patches for two Microsoft Exchange bugs: CVE-2023-21762 and CVE-2023-21745.
CVE-2023-21674
CVE-2023-21674 (CVSS score: 8.8) is a Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. This zero-day bug is being actively exploited in attacks.
The following products are affected:
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows RT 8.1
- Windows 8.1 for x64-based systems
- Windows 8.1 for 32-bit systems
- Windows Server 2016 (Server Core installation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
CVE-2023-21549
CVE-2023-21549 (CVSS score: 8.8) is a Windows SMB Witness Service Elevation of Privilege Vulnerability. An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to privileged accounts only.
The following products are affected:
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows RT 8.1
- Windows 8.1 for x64-based systems
- Windows 7 for 32-bit Systems Service Pack 1
- Windows Server 2016 (Server Core installation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
CVE-2023-21743
CVE-2023-21743 (CVSS score: 5.3) is a Microsoft SharePoint Server Security Feature Bypass Vulnerability. This bug can allow an attacker to circumvent security mechanisms to get system or network access. In a network-based attack, an unauthenticated attacker could bypass authentication and make an anonymous connection. To patch this vulnerability, in addition to applying the updates, customers must also trigger a SharePoint upgrade action included in this update to protect their SharePoint farm. The upgrade action can be triggered by running the SharePoint Products Configuration Wizard, the Upgrade-SPFarm PowerShell cmdlet, or the "psconfig.exe -cmd upgrade -inplace b2b" command on each SharePoint server after installing the update.
The following products are affected:
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
CVE-2023-21762
CVE-2023-21762 (CVSS score: 8.0) is a Microsoft Exchange Server Spoofing Vulnerability. Exploiting this vulnerability could allow the disclosure of NTLM hashes. This vulnerability's attack is limited at the protocol level to a logically adjacent topology; it cannot simply be done across the internet, but instead needs something specific tied to the target. A successful attack could lead to a NTLM relay allowing for controls that would be able to block availability of a resource.
The following products are affected:
- Microsoft Exchange Server 2013 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 11
- Microsoft Exchange Server 2019 Cumulative Update 12
- Microsoft Exchange Server 2016 Cumulative Update 23
CVE-2023-21745
CVE-2023-21745 (CVSS score: 8.0) is a Microsoft Exchange Server Spoofing Vulnerability. As a result of this bug, Microsoft Exchange Server could allow a remote authenticated attacker to conduct spoofing attacks. An authenticated attacker could achieve exploitation given a Powershell remoting session to the server. An authenticated attacker could exploit this vulnerability LAN-side or potentially from the internet.
The following products are affected:
- Microsoft Exchange Server 2019 Cumulative Update 11
- Microsoft Exchange Server 2019 Cumulative Update 12
- Microsoft Exchange Server 2016 Cumulative Update 23
Users are advised to apply the latest security patches specified in Microsoft's January 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.
Breach Disclosure: University of Minnesota
An alleged data breach at University of Minnesota, a U.S.-based education institution, exposed 3,408 email addresses and hashed passwords, which were subsequently shared on a deep web platform.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
University of Minnesota, a U.S.-based education institution, allegedly suffered a security incident, in which 3,408 email addresses and hashed passwords were leaked, which were subsequently shared on a deep web platform. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Breach Disclosure: Pixmagik
An alleged data breach at Pixmagik, a Spain-based online personalized gifts store, exposed 14,272 email addresses, which were subsequently shared on several deep web platforms.
Standing Intelligence Requirements
For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Details
Pixmagik, a Spain-based online personalized gifts store, allegedly suffered a security incident, in which 14,272 email addresses, which were subsequently shared on several deep web platforms. No passwords were found in this breach. Other notable information leaked in this package includes full names, payment method, and postal address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
- Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Profile: RisePro Stealer
Product Serial: P-2023-01-11a
TLP: CLEAR
In this report, ZeroFox Intelligence provides an overview of RisePro Stealer's capabilities.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/intelligence/advisories/14956
Link to Download
View the full report here.
Scope Note
ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:00 AM (EST) on December 23, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Executive Summary
RisePro Stealer is a malware typically used to steal sensitive information from infected computers. It has been spreading via PrivateLoader infections since late December 2022.1 (PrivateLoader malware is designed to deliver secondary payloads such as RisePro Stealer through fake software cracks.) RisePro Stealer is capable of targeting several web browsers for saved credentials, credit cards, cookies, history, and many extensions that deal with cryptocurrency. In addition to browsers, RisePro targets cryptocurrency wallets through desktop applications and files matching attacker-configured patterns; it is also capable of acting as a loader for secondary payloads. Good cyber hygiene practices and avoiding the use of pirated software may combat the risks posed to individuals and organizations.
Breaking News: 2023-01-06 - 2023-01-12
Blind Eagle Hackers Return with Refined Tools and Sophisticated Infection Chain
A financially motivated threat actor tracked as Blind Eagle has resurfaced with a refined toolset and an elaborate infection chain as part of its attacks targeting organizations in Colombia and Ecuador.
See the full report here: https://thehackernews.com/2023/01/blind-eagle-hackers-return-with-refined.html
Fortinet patches product flaws, notifies on new vulnerability
Fortinet has warned of a high-severity flaw (CVE-2022-39947) affecting multiple versions of FortiADC application delivery controller that could lead to the execution of arbitrary code. The company said it would patch the flaw when it launches FortiADC 6.2.4 and 7.0.2.
See the full report here: https://www.scmagazine.com/brief/vulnerability-management/fortinet-patches-product-flaws-notifies-on-new-vulnerability
The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
The notorious information-stealer known as Vidar is continuing to leverage popular social media services such as TikTok, Telegram, Steam, and Mastodon as an intermediate command-and-control (C2) server.
See the full report here: https://thehackernews.com/2023/01/the-evolving-tactics-of-vidar-stealer.html
SpyNote Strikes Again: Android Spyware Targeting Financial Institutions
Financial institutions are being targeted (at least since October 2022) by a new version of Android malware called SpyNote that combines both spyware and banking trojan characteristics.This has helped other actors in developing and distributing the spyware, often also targeting banking institutions. Some of the notable institutions that are impersonated by the malware include Deutsche Bank, HSBC U.K., Kotak Mahindra Bank, and Nubank.
See the full report here: https://thehackernews.com/2023/01/spynote-strikes-again-android-spyware.html
Bluebottle Cybercrime Group Preys on Financial Sector in French-Speaking African Nations
A cybercrime group dubbed Bluebottle has been linked to a set of targeted attacks against the financial sector in Francophone countries located in Africa from at least July 2022 to September 2022. The activity shares overlaps with a threat cluster tracked as OPERA1ER, which has carried out dozens of attacks aimed at banks, financial services, and telecom companies in Africa, Asia, and South America between 2018 and 2022.
See the full report here: https://thehackernews.com/2023/01/bluebottle-cybercrime-group-preys-on.html
Slack's private GitHub code repositories stolen over holidays
Slack suffered a security incident over the holidays affecting some of its private GitHub code repositories. Due to the most recent security update which has been rolled out, no action needs to be taken by customers.
See the full report here: https://www.bleepingcomputer.com/news/security/slacks-private-github-code-repositories-stolen-over-holidays/
Rackspace: Customer email data accessed in ransomware attack
Rackspace revealed that attackers accessed some of its customers' Personal Storage Table (PST) files which can contain a wide range of information, including emails, calendar data, contacts, and tasks. This update comes after Rackspace confirmed that the Play ransomware operation was behind the cyberattack that took down its hosted Microsoft Exchange environment in December 2022.
See the full report here: https://www.bleepingcomputer.com/news/security/rackspace-customer-email-data-accessed-in-ransomware-attack/
Bitdefender releases free MegaCortex ransomware decryptor
A decryptor has been released for the MegaCortex ransomware family, making it possible for victims of the once notorious gang to restore their data for free. Using the decryptor is pretty straightforward, as it's a standalone executable that doesn't require installation and offers to locate encrypted files on the system automatically.
See the full report here: https://www.bleepingcomputer.com/news/security/bitdefender-releases-free-megacortex-ransomware-decryptor/
France fines Apple for targeted App Store ads without consent
France's data protection authority (CNIL) has fined Apple EUR 8,000,000 for collecting user data for targeted advertising on the App Store without requesting or securing the user's consent.
See the full report here: https://www.bleepingcomputer.com/news/apple/france-fines-apple-for-targeted-app-store-ads-without-consent/
Hackers use CAPTCHA bypass to make 20K GitHub accounts in a month
South African threat actors known as "Automated Libra" have been improving their techniques to make a profit by using cloud platform resources for cryptocurrency mining. The threat actors use a new CAPTCHA solving system, follow a more aggressive use of CPU resources for mining, and mix "freejacking" with the "Play and Run" technique to abuse free cloud resources.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-captcha-bypass-to-make-20k-github-accounts-in-a-month/
Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors
The Russian cyberespionage group Turla is piggybacking on attack infrastructure used by a decade-old malware type (a variant of a commodity malware called ANDROMEDA, a.k.a. Gamarue) to deliver its own reconnaissance and backdoor tools to targets in Ukraine.
See the full report here: https://thehackernews.com/2023/01/russian-turla-hackers-hijack-decade-old.html
Chick-fil-A investigates reports of hacked customer accounts
American fast-food restaurant chain Chick-fil-A is investigating "suspicious activity" linked to some of its customers' accounts. If any customer observes any unusual activity on their account, they should immediately change their passwords to new ones that unique, complex, and not used on other online platforms or accounts.
See the full report here: https://www.bleepingcomputer.com/news/security/chick-fil-a-investigates-reports-of-hacked-customer-accounts/
VSCode Marketplace can be abused to host malicious extensions
Researchers have found its easy to upload malicious extensions to Microsoft's Visual Studio Code Marketplace and have found a few suspicious existing extensions. Code developers using VSCode extensions should remain vigilant and scrutinize their add-ons extensively before installing them on production machines.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/vscode-marketplace-can-be-abused-to-host-malicious-extensions/
Microsoft ends Windows 7 extended security updates on Tuesday
Windows 7 Professional and Enterprise editions will no longer receive extended security updates for critical and important vulnerabilities starting January 10, 2023.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-ends-windows-7-extended-security-updates-on-tuesday/
Hackers push fake Pokemon NFT game to take over Windows devices
Threat actors are using a well-crafted Pokemon NFT card game website to distribute the NetSupport remote access tool and take control over victims' devices. In a successful attack, threat actors can remotely connect to a user's device to steal data, install other malware, or even attempt to spread further on the network.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-push-fake-pokemon-nft-game-to-take-over-windows-devices/
Malicious PyPi packages create CloudFlare Tunnels to bypass firewalls
Six malicious packages on PyPI, the Python Package Index, were found installing information-stealing and RAT (remote access trojan) malware while using Cloudflare Tunnel to bypass firewall restrictions for remote access. The packages have now been removed from PyPI, but those who downloaded them will have to manually uninstall the remnants of the infection.
See the full report here: https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-create-cloudflare-tunnels-to-bypass-firewalls/
Air France and KLM notify customers of account hacks
Air France and KLM have informed Flying Blue customers that some of their personal information was exposed after their accounts were breached. Flying Blue is a loyalty program allowing clients of several airlines to exchange loyalty points for rewards. The attack was reportedly blocked in time and no miles were charged.
See the full report here: https://www.bleepingcomputer.com/news/security/air-france-and-klm-notify-customers-of-account-hacks/
FCC wants telecom carriers to report data breaches faster
The U.S. Federal Communications Commission wants to strengthen federal law enforcement and modernize breach notification requirements for telecommunications companies so that they notify customers of security breaches faster. The Commission also wants telecommunications carriers to report all significant breaches to several federal agencies, including the FBI, Secret Service, and the FCC.
See the full report here: https://www.bleepingcomputer.com/news/security/fcc-wants-telecom-carriers-to-report-data-breaches-faster/
Russian hackers targeted U.S. nuclear scientists
A Russian hacking team known as Cold River reportedly targeted three nuclear research laboratories – Brookhaven (BNL), Argonne (ANL) and Lawrence Livermore National Laboratories (LLNL) – in the United States in mid 2021. The hackers created fake login pages for each institution and emailed nuclear scientists in an attempt to make them reveal their passwords.
See the full report here: https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/
Auth0 fixes RCE flaw in JsonWebToken library used by 22,000 projects
Auth0 fixed a remote code execution vulnerability in the JsonWebToken open-source library used by over 22,000 projects and downloaded over 36 million times per month on NPM. The library is used in open source projects created by Microsoft, Twilio, Salesforce, Intuit, Box, IBM, Docusign, Slack, SAP, and many more. The vulnerability is tracked as CVE-2022-23529 and impacts JsonWebToken versions below 9.0.0 (released on December 23, 2022).
See the full report here: https://www.bleepingcomputer.com/news/security/auth0-fixes-rce-flaw-in-jsonwebtoken-library-used-by-22-000-projects/
Fake OnlyFans dating sites abuse UK Environment Agency open redirect
Threat actors abused redirects on the official website of the United Kingdom's Department for Environment, Food & Rural Affairs (DEFRA) to direct visitors to fake OnlyFans adult dating sites. The abused DEFRA domain at "riverconditions.environment-agency.gov.uk" was taken offline and its DNS records were removed after security researchers reported the problem.
See the full report here: https://www.bleepingcomputer.com/news/security/fake-onlyfans-dating-sites-abuse-uk-environment-agency-open-redirect/
Microsoft: Kubernetes clusters hacked in malware campaign via PostgreSQL
The Kinsing malware is actively breaching Kubernetes clusters by leveraging known weaknesses in container images and misconfigured, exposed PostgreSQL containers. Kinsing is a Linux malware with a history of targeting containers for crypto mining.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-kubernetes-clusters-hacked-in-malware-campaign-via-postgresql/
Darknet drug markets move to custom Android apps for increased privacy
Online markets selling drugs and other illegal substances on the dark web have started to use custom Android apps for increased privacy and to evade law enforcement. These apps allow shop clients to communicate with drug vendors and provide specific courier instructions for delivery.
See the full report here: https://www.bleepingcomputer.com/news/security/darknet-drug-markets-move-to-custom-android-apps-for-increased-privacy/
New Study Uncovers Text-to-SQL Model Vulnerabilities Allowing Data Theft and DoS Attacks
A group of academics have demonstrated novel attacks that leverage Text-to-SQL models to produce malicious code that could enable adversaries to glean sensitive information and stage denial-of-service (DoS) attacks.
See the full report here: https://thehackernews.com/2023/01/new-study-uncovers-text-to-sql-model.html
German finance regulator warns of "Godfather" malware attacks
German finance regulator BaFin warned consumers that the malware known as "Godfather," which records user input, has been attacking 400 banking and cryptocurrency apps, including some in Germany.
See the full report here: https://www.reuters.com/technology/german-finance-regulator-warns-godfather-malware-attacks-2023-01-09/
Hacker Sent to Prison for Robbing Vietnamese Crypto Exchange
A resident of Ho Chi Minh City in Vietnam has been given 10 years in prison for stealing 300 million Vietnamese dong from a crypto entrepreneur whose coin trading site he targeted in cyberattacks.
See the full report here: https://news.bitcoin.com/hacker-sent-to-prison-for-robbing-vietnamese-crypto-exchange/
Over 1,300 fake AnyDesk sites push Vidar info-stealing malware
A massive campaign is abusing over 1,300 domains to impersonate the official AnyDesk site and redirecting to a Dropbox folder seen pushing the Vidar information-stealing malware. AnyDesk is a popular remote desktop application for Windows, Linux, and macOS.
See the full report here: https://www.bleepingcomputer.com/news/security/over-1-300-fake-anydesk-sites-push-vidar-info-stealing-malware/
Trojan Puzzle attack trains AI assistants into suggesting malicious code
Security researchers have devised a new poisoning attack (“Trojan Puzzle”) that could trick AI-based coding assistants into suggesting dangerous code. The attack bypasses static detection and signature-based dataset cleansing models.
See the full report here: https://www.bleepingcomputer.com/news/security/trojan-puzzle-attack-trains-ai-assistants-into-suggesting-malicious-code/
CISA orders agencies to patch Exchange bug abused by ransomware gang
The Cybersecurity and Infrastructure Security Agency (CISA) has added two security vulnerabilities (CVE-2022-41080 and CVE-2023-21674) to its catalog of exploited bugs. All Federal Civilian Executive Branch (FCEB) agencies need to patch the bug by January 31, 2023.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-exchange-bug-abused-by-ransomware-gang/
Lorenz ransomware gang plants backdoors to use months later
Security researchers have determined that hackers deploying Lorenz ransomware breached a victim network five months before starting to move laterally, steal data, and encrypt systems. Researchers are warning users that patching critical vulnerabilities allowing access to a network is insufficient to defend against ransomware attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/lorenz-ransomware-gang-plants-backdoors-to-use-months-later/
Iowa’s largest school district cancels classes after cyberattack
Des Moines Public Schools, the largest school district in Iowa (United States), canceled all classes on January 10 (Tuesday) after taking all networked systems offline in response to unusual activity detected on its network. While the nature of the incident is yet to be revealed, other Iowa school districts were targeted in ransomware attacks in 2022.
See the full report here: https://www.bleepingcomputer.com/news/security/iowa-s-largest-school-district-cancels-classes-after-cyberattack/
Microsoft January 2023 Patch Tuesday fixes 98 flaws, 1 zero-day
Microsoft's January 2023 Patch Tuesday features fixes for an actively exploited zero-day vulnerability (CVE-2023-21674) and a total of 98 flaws.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2023-patch-tuesday-fixes-98-flaws-1-zero-day/
StrongPity hackers target Android users via trojanized Telegram app
The StrongPity APT hacking group (also known as Promethium or APT-C-41) is distributing a fake Shagle chat app that is a trojanized version of the Telegram for Android app with an added backdoor. Shagle is a legitimate random-video-chat platform allowing strangers to talk via an encrypted communications channel. Once installed, this app enables the hackers to conduct espionage on the targeted victims, including monitoring phone calls, collecting SMS texts, and grabbing contact lists.
See the full report here: https://www.bleepingcomputer.com/news/security/strongpity-hackers-target-android-users-via-trojanized-telegram-app/
Scattered Spider hackers use old Intel driver to bypass security
A financially motivated threat actor tracked as Scattered Spider was observed attempting to deploy Intel Ethernet diagnostics drivers in a BYOVD (Bring Your Own Vulnerable Driver) attack to evade detection from EDR (Endpoint Detection and Response) security products. Windows users should enable the driver blocklist to protect against these BYOVD attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-use-old-intel-driver-to-bypass-security/
Twitter claims leaked data of 200 million users not stolen from its systems
Twitter finally addressed reports that a dataset of email addresses linked to hundreds of millions of Twitter users was leaked and put up for sale online, saying that it found no evidence the data was obtained by exploiting a vulnerability in its systems.
See the full report here: https://www.bleepingcomputer.com/news/security/twitter-claims-leaked-data-of-200m-users-not-stolen-from-its-systems/
Threema claims encryption flaws never had a real-world impact
A team of researchers have published a paper describing multiple security flaws in Threema, a secure end-to-end encrypted communications app. Threema released a statement on the disclosure of the issues, stating that the finding's current applicability and historic importance overall do not have considerable real-world impact.
See the full report here: https://www.bleepingcomputer.com/news/security/threema-claims-encryption-flaws-never-had-a-real-world-impact/
Cisco warns of auth bypass bug with public exploit in EoL routers
Cisco warned customers of a critical authentication bypass vulnerability with public exploit code affecting multiple end-of-life (EoL) VPN routers. The security flaw (CVE-2023-20025) was found in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 routers. Cisco noted that it has not and will not release software updates that address this vulnerability.
See the full report here: https://www.bleepingcomputer.com/news/security/cisco-warns-of-auth-bypass-bug-with-public-exploit-in-eol-routers/
Gootkit malware abuses VLC to infect healthcare orgs with Cobalt Strike
The Gootkit loader malware operators are running a new SEO poisoning campaign that abuses VLC Media Player to infect Australian healthcare entities with Cobalt Strike beacons. The campaign's goal is to deploy the Cobalt Strike post-exploitation toolkit on infected devices for initial access to corporate networks.
See the full report here: https://www.bleepingcomputer.com/news/security/gootkit-malware-abuses-vlc-to-infect-healthcare-orgs-with-cobalt-strike/
Royal Mail halts international services after cyberattack
The U.K. Royal Mail has stopped its international shipping services due to severe service disruption caused by what it described as a cyber incident. While delivery and collection services across the U.K. have been unaffected by the incident, the company advised customers to hold export items while the issues are resolved, as they cannot be dispatched to overseas destinations.
See the full report here: https://www.bleepingcomputer.com/news/security/royal-mail-halts-international-services-after-cyberattack/
New Dark Pink APT group targets govt and military with custom malware
Attacks targeting government agencies and military bodies in multiple countries in the APAC region have been attributed to what appears to be a new advanced threat actor that leverages custom malware to steal confidential information.
See the full report here: https://www.bleepingcomputer.com/news/security/new-dark-pink-apt-group-targets-govt-and-military-with-custom-malware/
New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors
A new analysis of Raspberry Robin's attack infrastructure has revealed that it is possible for other threat actors to repurpose the infections for their own malicious activities, making it an even more potent threat. Raspberry Robin (aka QNAP worm), attributed to a threat actor dubbed DEV-0856, is malware that has increasingly come under the radar for being used in attacks aimed at finance, government, insurance, and telecom entities.
See the full report here: https://thehackernews.com/2023/01/new-analysis-reveals-raspberry-robin.html
Despite Ban, Bangladesh Bought Spyware Worth at Least USD 12 Million From Israeli Firms
Despite a ban on accepting bids from Israel, Bangladesh purchased at least four separate advanced surveillance equipment by Israeli firms, including from a company owned by a former Israeli intelligence officer, a new investigation has found.
See the full report here: https://thewire.in/south-asia/bangladesh-spyware-israel-ban
F.A.A. Outage Highlights Fragility of the Aviation System
Flights across the United States were halted on January 11, 2023 because the Federal Aviation Administration’s system to alert pilots to safety issues went down. The F.A.A. stated that it had traced the outage to a damaged database file and that there was no evidence that it was caused by a cyberattack.
See the full report here: https://www.nytimes.com/2023/01/11/business/faa-flight-delays-outage.html
Tags: all industries, global