Threat Intelligence Bulletin: 01/13/2023 - 01/19/2023

Breach Disclosure: Barça Innovation Hub

An alleged data breach at Barça Innovation Hub, a Spain-based sports innovation center, exposed 26,243 email addresses, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Barça Innovation Hub, a Spain-based sports innovation center, allegedly suffered a security incident, in which 26,243 email addresses were leaked, which were subsequently shared on several deep web platforms. Other notable information leaked in this package include name, phone number, physical addresses, and date of birth. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Reyco

An alleged data breach at Reyco, a Mexico-based company that deals with advising hospitality related industries to supply with right kitchenwares, exposed 40,700 email addresses, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Reyco, a Mexico-based company that deals with advising hospitality related industries to supply with right kitchenwares, allegedly suffered a security incident, in which 40,700 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package include name, phone number, and physical addresses. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: T-Mobile Netherlands

An alleged June 2022 data breach at T-Mobile Netherlands exposed 5,259 email addresses, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In June 2022, T-Mobile Netherlands allegedly suffered a security incident, in which 5,259 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package include name, phone number, physical addresses, username, and employee ID. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Layoffs Fuel Uptick in Employment Scams

Product Serial: F-2023-01-18a

TLP:CLEAR

In this flash report, ZeroFox Intelligence shares details on the uptick in employment scams as a result of layoffs across industries.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EST) on January 17, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• A recent uptick in layoffs across industries has seen increased efforts by threat actors to target job seekers with employment scams.
• The tech industry has been particularly hard-hit with layoffs since 2022.
• Threat actors utilize employment-related scams in order to obtain sensitive personal and financial information on their victims.
• Fake job postings in 2022 cost victims nearly double what they did in 2020.
• Even though organizations are not responsible for the creation of fraudulent job postings, their brands can be negatively impacted by these scams.

Breach Disclosure: Accessily

An alleged data breach at Accessily, a U.S.-based digital marketing company, exposed 18,642 email addresses and usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Accessily, a U.S.-based digital marketing company, allegedly suffered a security incident, in which 18,642 email addresses and usernames were leaked, which were subsequently shared on a deep web platform. Of these, 17,513 records were successfully linked to hashed passwords. Other notable information leaked in this package include name, IP address, and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Indolj

An alleged data breach at Indolj, a Pakistan-based digital and software solutions company, exposed 48,731 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Indolj, a Pakistan-based digital and software solutions company, allegedly suffered a security incident, in which 48,731 email addresses and hashed passwords were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package include name, phone number, IP address and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2023-01-13 - 2023-01-19

European police takes down call centers behind cryptocurrency scams

Several call centers across Europe controlled by a criminal organization involved in online investment fraud were taken down following a cross-border investigation started in June 2022. Law enforcement from Bulgaria, Cyprus, Germany, and Serbia found that suspects operating out of these call centers tricked victims into investing large amounts of money in fake cryptocurrency schemes, also known as "Pig Butchering" cryptocurrency scams.

See the full report here: https://www.bleepingcomputer.com/news/security/european-police-takes-down-call-centers-behind-cryptocurrency-scams/

MetaMask warns of new "Address Poisoning" cryptocurrency scam

Cryptocurrency wallet provider MetaMask is warning users of a new scam called "Address Poisoning" used to trick users into sending funds to a scammer rather than an intended recipient. Since there's no way to stop these malicious transactions from occurring on the blockchain, MetaMask is warning users to be diligent when copying addresses from transactions.

See the full report here: https://www.bleepingcomputer.com/news/security/metamask-warns-of-new-address-poisoning-cryptocurrency-scam/

Microsoft: Cuba ransomware hacking Exchange servers via OWASSRF flaw

Cuba ransomware threat actors are hacking Microsoft Exchange servers unpatched against a critical server-side request forgery (SSRF) vulnerability also exploited in Play ransomware attacks. Cloud computing provider Rackspace recently confirmed that Play ransomware used a zero-day exploit dubbed OWASSRF targeting this bug (CVE-2022-41080) to compromise unpatched Microsoft Exchange servers on its network after bypassing ProxyNotShell URL rewrite mitigations.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-cuba-ransomware-hacking-exchange-servers-via-owassrf-flaw/

Android TV box on Amazon came pre-installed with malware

A Canadian system administrator discovered that an Android TV box (T95 Android TV box with an AllWinner T616 processor) purchased from Amazon was pre-loaded with persistent, sophisticated malware baked into its firmware. The system administrator created a script and instructions to help users nullify the payload and stop its communication with the C2 (command and control) server. It is unclear if this single device was affected or if all devices from this model or brand include the malicious component.

See the full report here: https://www.bleepingcomputer.com/news/security/android-tv-box-on-amazon-came-pre-installed-with-malware/

RAT malware campaign tries to evade detection using polyglot files

Operators of the StrRAT and Ratty remote access trojans (RAT) are running a new campaign using polyglot MSI/JAR and CAB/JAR files to evade detection from security tools. The threat actors achieve moderate success in evading detection by anti-virus engines. This is notable considering how old and well-documented the two particular RATs are.

See the full report here: https://www.bleepingcomputer.com/news/security/rat-malware-campaign-tries-to-evade-detection-using-polyglot-files/

Royal Mail cyberattack linked to LockBit ransomware operation

A cyberattack on Royal Mail, U.K.'s largest mail delivery service, has been linked to the LockBit ransomware operation. The Royal Mail disclosed that it suffered a cyber incident that forced it to halt international shipping services.

See the full report here: https://www.bleepingcomputer.com/news/security/royal-mail-cyberattack-linked-to-lockbit-ransomware-operation/

Hackers exploit Control Web Panel flaw to open reverse shells

Hackers are actively exploiting a critical vulnerability patched recently in Control Web Panel (CWP), a tool for managing servers formerly known as CentOS Web Panel. The security issue is identified as CVE-2022-44877 and received a critical severity score of 9.8 out of 10 as it allows an attacker to execute code remotely without authentication.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-control-web-panel-flaw-to-open-reverse-shells/

IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours

A recent IcedID malware attack enabled the threat actor to compromise the Active Directory domain of an unnamed target less than 24 hours after gaining initial access, while also borrowing techniques from other groups like Conti to meet its goals.

See the full report here: https://thehackernews.com/2023/01/icedid-malware-strikes-again-active.html

Over 100 Siemens PLC Models Found Vulnerable to Firmware Takeover

Security researchers have disclosed multiple architectural vulnerabilities in Siemens SIMATIC and SIPLUS S7-1500 programmable logic controllers (PLCs) that could be exploited by a malicious actor to stealthily install firmware on affected devices and take control of them.

See the full report here: https://thehackernews.com/2023/01/over-100-siemens-plc-models-found.html

Experts Detail Chromium Browser Security Flaw Putting Confidential Data at Risk

Details have emerged about a now-patched vulnerability (CVE-2022-3656) in Google Chrome and Chromium-based browsers that, if successfully exploited, could have made it possible to siphon files containing confidential data.

See the full report here: https://thehackernews.com/2023/01/experts-detail-chromium-browser.html

Canada's largest alcohol retailer's site hacked to steal credit cards

The Liquor Control Board of Ontario (LCBO), a Canadian government enterprise alcohol retailer, revealed that unknown attackers had breached its website to inject malicious code designed to steal customer and credit card information at check-out.

See the full report here: https://www.bleepingcomputer.com/news/security/canadas-largest-alcohol-retailers-site-hacked-to-steal-credit-cards/

Google Chrome to let you disable or enable extensions per site

Google is working on a new feature that allows you to disable or enable Chrome extensions based on site-by-site basis. The Chrome Web Store has many extensions, but there's a catch - some extensions can cause website problems, and some sites do not allow extensions like ad blockers.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-to-let-you-disable-or-enable-extensions-per-site/

TikTok slapped with USD 5.4 million fine over cookie opt-out feature

France's data protection authority (CNIL) has fined TikTok UK and TikTok Ireland EUR 5,000,000 for making it difficult for users of the platform to refuse cookies and for not sufficiently informing them about their purpose. This design behavior was deemed a violation of Article 82 of France's data protection laws (DPA), a national regulation that conforms with the GDPR framework enforced throughout Europe.

See the full report here: https://www.bleepingcomputer.com/news/security/tiktok-slapped-with-54-million-fine-over-cookie-opt-out-feature/

Cisco Issues Warning for Unpatched Vulnerabilities in EoL Business Routers

Cisco has warned of two security vulnerabilities affecting end-of-life (EoL) Small Business RV016, RV042, RV042G, and RV082 routers that it said will not be fixed, even as it acknowledged the public availability of proof-of-concept (PoC) exploit. The issues are rooted in the router's web-based management interface, enabling a remote adversary to sidestep authentication or execute malicious commands on the underlying operating system.

See the full report here: https://thehackernews.com/2023/01/cisco-issues-warning-for-unpatched.html

Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability

A majority of internet-exposed Cacti servers have not been patched against a recently patched critical security vulnerability that has come under active exploitation in the wild. According to research, only 26 out of a total of 6,427 servers to be running a patched version of Cacti (1.2.23 and 1.3.0).

See the full report here: https://thehackernews.com/2023/01/cacti-servers-under-attack-as-majority.html

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data. The CI/CD service CircleCI said the "sophisticated attack" took place on December 16, 2022, and that the malware went undetected by its antivirus software.

See the full report here: https://thehackernews.com/2023/01/malware-attack-on-circleci-engineers.html

ODIN Intelligence website is defaced as hackers claim breach

The website for ODIN Intelligence, a company that provides technology and tools for law enforcement and police departments, was defaced. ODIN provides apps, like SweepWizard and other technologies, to law enforcement departments.

See the full report here: https://techcrunch.com/2023/01/15/odin-intelligence-website-defaced-sweepwizard/#:~:text=The%20defacement%20note%20made%20note,a%20signature%20for%20each%20file.

Researchers to release PoC exploit for critical Zoho RCE bug, patch now

Proof-of-concept exploit code will be released for a critical vulnerability allowing remote code execution (RCE) without authentication in several VMware products. Tracked as CVE-2022-47966, this pre-auth RCE security flaw is due to using an outdated and vulnerable third-party dependency, Apache Santuario. Users are advised to enable multi-factor authentication and update Mendix SAML to versions 2.3.4 (Mendix 8), 3.3.8 (Mendix 9, Upgrade Track), or 3.3.9 (Mendix 9, New Track) to mitigate potential risks.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-to-release-poc-exploit-for-critical-zoho-rce-bug-patch-now/

MSI accidentally breaks Secure Boot for hundreds of motherboards

Over 290 MSI motherboards have reportedly been affected by an insecure default UEFI Secure Boot setting settings that allows any operating system image to run regardless of whether it has a wrong or missing signature. The discovery comes from a Polish security researcher who claims that he did not receive a response despite his efforts to contact MSI and inform them about the issue. The issue impacts many Intel and AMD-based MSI motherboards that use a recent firmware version, affecting even brand-new MSI motherboard models.

See the full report here: https://www.bleepingcomputer.com/news/security/msi-accidentally-breaks-secure-boot-for-hundreds-of-motherboards/

Vice Society ransomware leaks University of Duisburg-Essen’s data

The Vice Society ransomware gang has claimed responsibility for a November 2022 cyberattack on the University of Duisburg-Essen (UDE) that forced the university to reconstruct its IT infrastructure, a process that's still ongoing. The threat actors have also leaked files they claim to have stolen from the university during the network breach, exposing potentially sensitive details about the university's operations, students, and personnel.

See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-ransomware-leaks-university-of-duisburg-essen-s-data/

Datadog rotates RPM signing key exposed in CircleCI hack

Cloud security firm Datadog says that one of its RPM GPG signing keys and its passphrase have been exposed during a recent CircleCI security breach. However, the company added that it has yet to find evidence that this key was leaked or misused.

See the full report here: https://www.bleepingcomputer.com/news/security/datadog-rotates-rpm-signing-key-exposed-in-circleci-hack/

Malicious "Lolip0p" PyPi packages install info-stealing malware

A threat actor has uploaded to the PyPI (Python Package Index) repository three malicious packages that carry code to drop info-stealing malware on developers' systems. The malicious packages were all uploaded by the same author named Lolip0p between January 7 and 12, 2023. Their names are colorslib, httpslib, and libhttps. All three have been reported and removed from the PyPI.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-lolip0p-pypi-packages-install-info-stealing-malware/

Avast releases free BianLian ransomware decryptor

Security software company Avast has released a free decryptor for the BianLian ransomware strain to help victims of the malware recover locked files without paying the hackers.The availability of a decryptor comes only about half a year after increased activity from BianLian ransomware over the summer of 2022, when the threat group breached multiple high-profile organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/avast-releases-free-bianlian-ransomware-decryptor/

Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software

A collection of about 250 domains are being used to distribute information-stealing malware such as Raccoon and Vidar since early 2020. The infection chain uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub. Users are advised to refrain from downloading pirated software and enforce multi-factor authentication wherever possible to harden accounts.

See the full report here: https://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html

CISA Warns for Flaws Affecting Industrial Control Systems from Major Manufacturers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released several Industrial Control Systems (ICS) advisories warning of critical security flaws affecting products from Sewio, InHand Networks, Sauter Controls, and Siemens. This includes CVE-2022-45444 (CVSS score: 10.0), two command injection flaws (CVE-2022-47911 and CVE-2022-43483, CVSS scores: 9.1), and an out-of-bounds write vulnerability (CVE-2022-41989, CVSS score: 9.1).

See the full report here: https://thehackernews.com/2023/01/cisa-warns-for-flaws-affecting.html

Versailles police warn of scammers posing as deputies

Police in Versailles are warning people to never give out personal information over the phone. The Versailles Police Department said that it has recently received several complaints about scammers posing as officers and calling individuals to request missed court or summons fines. Authorities emphasized they will never ask for payment over the phone.

See the full report here: https://fox56news.com/news/local/versailles-police-warn-of-scammers-posing-as-deputies/

Bitcoin scammers made over GBP 22 million after exploiting a loophole on a crypto trading site

Scammers from Blackpool, began orchestrating a crypto scam in 2017 after discovering a glitch which allowed them to steal money from an Australian cryptocurrency trading website. The move allowed the scammers to syphon off more than GBP 20 million worth of credits over a three-month period.

See the full report here: https://metro.co.uk/2023/01/17/blackpool-bitcoin-scammers-stole-over-22m-in-cryptocurrency-18115224/

Europe Beefs-Up Cybersecurity Law, Trumping The UK

The EU has introduced two new significant pieces of legislation that are intended to increase cybersecurity resilience in the European economy and the overall resilience of critical infrastructure providers to incidents that have the potential to significantly disrupt their services.

See the full report here: https://www.forbes.com/sites/stewartroom/2023/01/16/europe-beefs-up-cybersecurity-law-trumping-the-uk/?sh=64793d6f6081

Git patches two critical remote code execution security flaws

Git has patched two critical severity security vulnerabilities (CVE-2022-41903 and CVE-2022-23521) that could allow attackers to execute arbitrary code after successfully exploiting heap-based buffer overflow weaknesses. A third Windows-specific flaw (CVE-2022-41953) impacting the Git GUI tool caused by an untrusted search path weakness enables unauthenticated threat actors to run untrusted code low-complexity attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/git-patches-two-critical-remote-code-execution-security-flaws/

Hackers turn to Google search ads to push info-stealing malware

Hackers are setting up fake websites for popular free and open-source software to promote malicious downloads through advertisements in Google search results. At least one prominent user on the cryptocurrency scene has fallen victim to the campaign, claiming it allowed hacker to steal all their digital crypto assets along with control over their professional and personal accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-turn-to-google-search-ads-to-push-info-stealing-malware/

Hackers can use GitHub Codespaces to host and deliver malware

Researchers have demonstrated how threat actors can abuse the GitHub Codespaces' port forwarding feature to host and distribute malware and malicious scripts. GitHub Codespaces allows developers to deploy cloud-hosted IDE platforms in virtualized containers to write, edit, and test/run code directly within a web browser.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/

Over 4,000 Sophos Firewall devices vulnerable to RCE attacks

Over 4,000 Sophos Firewall devices exposed to Internet access are vulnerable to attacks targeting a critical remote code execution (RCE) vulnerability. Sophos disclosed this code injection flaw (CVE-2022-3236) found in the User Portal and Webadmin of Sophos Firewall in September and also released hotfixes for multiple Sophos Firewall versions (official fixes were issued three months later, in December 2022).

See the full report here: https://www.bleepingcomputer.com/news/security/over-4-000-sophos-firewall-devices-vulnerable-to-rce-attacks/

Nissan North America data breach caused by vendor-exposed database

Nissan North America has begun sending data breach notifications informing customers of a breach at a third-party service provider that exposed customer information. The security incident was reported to the Office of the Maine Attorney General on January 16, 2023, where Nissan disclosed that 17,998 customers were affected by the breach

See the full report here: https://www.bleepingcomputer.com/news/security/nissan-north-america-data-breach-caused-by-vendor-exposed-database/

Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered between October 8, 2022 and December 2, 2022 in Azure API Management, Azure Functions, Azure Machine Learning, and Azure Digital Twins, have since been addressed by Microsoft.

See the full report here: https://thehackernews.com/2023/01/microsoft-azure-services-flaws-couldve.html

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa. Phishing emails, typically tailored to the victim's interests, are loaded with malicious attachments to activate the infection routine.

See the full report here: https://thehackernews.com/2023/01/earth-bogle-campaign-unleashes-njrat.html

Iranian Government Entities Under Attack by New Wave of BackdoorDiplomacy Attacks

The threat actor known as BackdoorDiplomacy has been linked to a new wave of attacks targeting Iranian government entities between July and late December 2022. Also known by the names APT15, KeChang, NICKEL, and Vixen Panda, the Chinese APT group has a history of cyber espionage campaigns aimed at government and diplomatic entities across North America, South America, Africa, and the Middle East at least since 2010.

See the full report here: https://thehackernews.com/2023/01/iranian-government-entities-under.html

Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers

Security vulnerabilities have been disclosed in Netcomm and TP-Link routers, some of which could be weaponized to achieve remote code execution. The flaws, tracked as CVE-2022-4873 and CVE-2022-4874, concern a case of stack-based buffer overflow and authentication bypass and impact Netcomm router models NF20MESH, NF20, and NL1902 running firmware versions earlier than R6B035.

See the full report here: https://thehackernews.com/2023/01/critical-security-vulnerabilities.html

Git Users Urged to Update Software to Prevent Remote Code Execution Attacks

The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that could be exploited by a malicious actor to achieve remote code execution. The flaws, tracked as CVE-2022-23521 and CVE-2022-41903, impact the following versions of Git: v2.30.6, v2.31.5, v2.32.4, v2.33.5, v2.34.5, v2.35.5, v2.36.3, v2.37.4, v2.38.2, and v2.39.0. Patched versions include v2.30.7, v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, v2.38.3, and v2.39.1.

See the full report here: https://thehackernews.com/2023/01/git-users-urged-to-update-software-to.html

MailChimp discloses new breach after employees got hacked

Email marketing firm MailChimp suffered another breach after hackers accessed an internal customer support and account administration tool, allowing the threat actors to access the data of 133 customers. MailChimp says the attackers gained access to employee credentials after conducting a social engineering attack on Mailchimp employees and contractors.

See the full report here: https://www.bleepingcomputer.com/news/security/mailchimp-discloses-new-breach-after-employees-got-hacked/

Bank of America starts restoring missing Zelle transactions

Bank of America has started to restore missing Zelle transactions that suddenly disappeared from customers' bank accounts this morning, causing some to dip into negative balances.

See the full report here: https://www.bleepingcomputer.com/news/technology/bank-of-america-starts-restoring-missing-zelle-transactions/

Ukraine links data-wiping attack on news agency to Russian hackers

The Computer Emergency Response Team of Ukraine (CERT-UA) has linked a destructive malware attack targeting the country's national news agency (Ukrinform) to Sandworm Russian military hackers. CERT-U says the cyberattack was likely carried out by the Sandworm group based on the threat actors' tactics, which was previously linked to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-links-data-wiping-attack-on-news-agency-to-russian-hackers/

Illegal Solaris darknet market hijacked by competitor Kraken

Solaris, a large darknet marketplace focused on drugs and illegal substances, has been taken over by a smaller competitor named "Kraken," who claims to have hacked it on January 13, 2022. The Tor site of Solaris currently redirects to Kraken, while blockchain monitoring experts at Elliptic report no movements in the cryptocurrency addresses associated with the site after January 13, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/illegal-solaris-darknet-market-hijacked-by-competitor-kraken/

Bitzlato crypto exchange seized for ransomware, drugs money laundering

The U.S. Department of Justice arrested and charged a Russian national, the founder of the Hong Kong-registered cryptocurrency exchange Bitzlato, with helping cybercriminals allegedly launder illegally obtained money. The individual was arrested in Miami and will be arraigned in the U.S. District Court for the Southern District of Florida.

See the full report here: https://www.bleepingcomputer.com/news/security/bitzlato-crypto-exchange-seized-for-ransomware-drugs-money-laundering/

New York man defrauded thousands using credit cards sold on dark web

A New York resident has pleaded guilty to charges of conspiracy to commit bank fraud using stolen credit cards purchased on dark web cybercrime marketplaces. The person admitted to playing a key role in the operation of a credit card conspiracy group that caused over USD 1,500,000 in damages to 4,000 account holders.

See the full report here: https://www.bleepingcomputer.com/news/security/new-york-man-defrauded-thousands-using-credit-cards-sold-on-dark-web/