Threat Intelligence Bulletin: 01/27/2023

ZeroFox Intelligence Geopolitical Brief for February 2023

Product Serial: B-2023-1-27a

TLP:CLEAR

In this briefing, ZeroFox Intelligence provides an analysis on geopolitical events that took place in January 2023, and a forward look at events for February 2023.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Breach Disclosure: Bit Hotel

An alleged data breach at Bit Hotel, a Netherland-based metaverse gaming website, exposed 15,501 email addresses and/or usernames, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Bit Hotel, a Netherland-based metaverse gaming website, allegedly suffered a security incident, in which 15,501 email addresses and/or usernames were leaked, which were subsequently shared on several deep web platforms. Of these, 8,868 records were successfully linked to hashed passwords. Other notable information leaked in this package include location. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Latestpilotjobs

An alleged data breach at Latestpilotjobs, a Sweden-based job portal that posts vacancies related to aviation industries, exposed 119,463 email addresses, usernames and hashed passwords, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Latestpilotjobs, a Sweden-based job portal that posts vacancies related to aviation industries, allegedly suffered a security incident, in which 119,463 email addresses, usernames and hashed passwords were leaked, which were subsequently shared on several deep web platforms. Other notable information leaked in this package include name and user activity. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: WOBI Data

An alleged data breach at WOBI Data, a U.S.-based business content hub that produce and distribute the management media content, exposed 220,001 email addresses, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

WOBI Data, a a U.S.-based business content hub that produce and distribute the management media content, allegedly suffered a security incident, in which 220,001 email addresses were leaked, which were subsequently shared on several deep web platforms. No passwords were found in this breach. Other notable information leaked in this package include full name, gender, age, phone number, company, and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Webmium

An alleged data breach at Webmium, a Czech Republic-based digital advertising services company, exposed 35,104 email addresses and hashed passwords, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Webmium, a Czech Republic-based digital advertising services company, allegedly suffered a security incident, in which 35,104 email addresses and hashed passwords were leaked, which were subsequently shared on several deep web platforms. Other notable information leaked in this package include name and user activity. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Cricingif

An alleged data breach at Cricingif, a U.S.-based cricket news website, exposed 855,447 email addresses, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Cricingif, a U.S.-based cricket news website, allegedly suffered a security incident, in which 855,447 email addresses were leaked, which were subsequently shared on several deep web platforms. Of these, 826,741 records were successfully linked to plain-text passwords. Other notable information leaked in this package include name, physical addresse, phone number, and social media ID. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Phishing Ads Target Password Managers

Product Serial: F-2023-01-31a

TLP:CLEAR

In this flash report, ZeroFox Intelligence provides updates on additional threat actor activities targeting password managers, this time with phishing ads.

Standing Intelligence Requirements

Phishing & Fraud PII

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 3:00 PM (EST) on January 31, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

Phishing ads aimed at stealing password vault credentials are the latest tactic used to target password managers.
Recent targeting of password managers has involved security breaches and credential stuffing attacks.
Threat actors’ level of sophistication with creating phishing pages continues to evolve.
The identified phishing pages targeting the password managers have since been removed; however, this does not abate the threat of this type of activity.

Breach Disclosure: B&H Petroleum

An alleged data breach at B&H Petroleum, a U.S.-based company that sells and provides services for petroleum equipment, exposed 54 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

B&H Petroleum, a U.S.-based company that sells and provides services for petroleum equipment, allegedly suffered a security incident, in which 54 email addresses and plain-text passwords were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package include name, phone number, and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2023-01-27 - 2023-02-02

Bitwarden password vaults targeted in Google ads phishing attack

Bitwarden and other password managers are being targeted in Google ads phishing campaigns to steal users' password vault credentials. As the enterprise and consumers move to use unique passwords at every site, it has become essential to use password managers to keep track of all the passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/bitwarden-password-vaults-targeted-in-google-ads-phishing-attack/

Hive ransomware disrupted after FBI hacks gang's systems

The Hive ransomware operation's Tor payment and data leak sites were seized as part of an international law enforcement operation after the FBI infiltrated the gang's infrastructure. The US Department of Justice and Europol announced that an international law enforcement operation secretly infiltrated the Hive ransomware gang's infrastructure in July 2022. This operation allowed them to learn about attacks before they occurred and warn targets, and to obtain and distribute decryption keys to victims, preventing approximately USD 130 million in ransom payments.

See the full report here: https://www.bleepingcomputer.com/news/security/hive-ransomware-disrupted-after-fbi-hacks-gangs-systems/

Microsoft urges admins to patch on-premises Exchange servers

Microsoft urged customers to keep their on-premises Exchange servers patched by applying the latest supported Cumulative Update (CU) to have them always ready to deploy an emergency security update. Some threat actors' goals when targeting Exchange servers include gaining access to sensitive information within users' mailboxes, the company's address book, which would help make social engineering attacks more effective, and the organizations' Active Directory and connected cloud environments.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-urges-admins-to-patch-on-premises-exchange-servers/

US offers USD 10M bounty for Hive ransomware links to foreign governments

The U.S. Department of State has offered up to USD 10 million for information that could help link the Hive ransomware group (or other threat actors) with foreign governments. In November, the FBI revealed that this ransomware operation had extorted around USD 100 million from over 1,500 companies since June 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/us-offers-10m-bounty-for-hive-ransomware-links-to-foreign-governments/

New Mimic ransomware abuses "Everything" Windows search tool

Security researchers discovered a new ransomware strain Mimic that leverages the APIs of the "Everything" file search tool for Windows to look for files targeted for encryption. Discovered in June 2022, the malware appears to target mainly English and Russian-speaking users.

See the full report here: https://www.bleepingcomputer.com/news/security/new-mimic-ransomware-abuses-everything-windows-search-tool/

Lexmark warns of RCE bug affecting 100 printer models, PoC released

Lexmark has released a security firmware update to fix a severe vulnerability that could enable remote code execution (RCE) on more than 100 printer models. The security issue is tracked as CVE-2023-23560 and has a severity rating of 9.0. It is a server-side request forgery (SSRF) in the Web Services feature of Lexmark devices.

See the full report here: https://www.bleepingcomputer.com/news/security/lexmark-warns-of-rce-bug-affecting-100-printer-models-poc-released/

Google nukes 50,000 accounts pushing Chinese disinformation

Google’s Threat Analysis Group terminated tens of thousands of accounts linked to a group known as "Dragonbridge" or "Spamouflage Dragon" that is disseminating pro-Chinese disinformation across multiple online platforms. The company took down more than 50,000 accounts used by Dragonbridge across its platforms, including YouTube, Blogger, and AdSense.

See the full report here: https://www.bleepingcomputer.com/news/security/google-nukes-50-000-accounts-pushing-chinese-disinformation/

UK warns of increased attacks from Russian, Iranian hackers

The U.K. National Cyber Security Centre (NCSC) has issued a warning of Russian and Iranian state-sponsored hackers increasingly targeting organizations and individuals. More specifically, the country’s cybersecurity agency has identified a spike in spear-phishing attacks attributed to threat actors tracked as SEABORGIUM and TA453. The goal of the campaigns is to gather information from the victims.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-warns-of-increased-attacks-from-russian-iranian-hackers/

Yandex denies hack, blames source code leak on former employee

A Yandex source code repository allegedly stolen by a former employee of the Russian technology company has been leaked as a Torrent on a popular hacking forum. The leaker posted a magnet link that they claim are "Yandex git sources" consisting of 44.7 GB of files stolen from the company in July 2022. These code repositories allegedly contain all of the company's source code besides anti-spam rules. In a statement Yandex said its systems were not hacked, and claimed a former employee leaked the source code repository.

See the full report here: https://www.bleepingcomputer.com/news/security/yandex-denies-hack-blames-source-code-leak-on-former-employee/

Dutch hacker obtained virtually all Austrians' personal data, police say

A Dutch hacker who was arrested in November 2022 obtained and offered for sale the full name, address, and date of birth of virtually everyone in Austria as confirmed the nation's police. A user believed to be the hacker offered the data for sale in an online forum in May 2020, presenting it as "the full name, gender, complete address and date of birth of presumably every citizen" in Austria.

See the full report here: https://www.reuters.com/world/europe/dutch-hacker-obtained-virtually-all-austrians-personal-data-police-say-2023-01-25/

Shady reward apps on Google Play amass 20 million downloads

A new category of activity tracking applications has been having massive success recently on Google Play, Android's official app store, having been downloaded on over 20 million devices. The applications promote themselves as health, pedometer, and good habit-building apps, promising to give users random rewards for staying active in their daily lives, reaching distance goals, etc. If you have any of the above phishing apps installed on your Android device, you should uninstall them immediately and then run an AV scan to locate and remove any remnants.

See the full report here: https://www.bleepingcomputer.com/news/security/shady-reward-apps-on-google-play-amass-20-million-downloads/

Researchers to release VMware vRealize Log RCE exploit, patch now

Security researchers will release an exploit targeting a vulnerability chain for gaining remote code execution on unpatched VMware vRealize Log Insight appliances. VMware patched four security vulnerabilities in this log analysis tool, two of which are critical and allow attackers to execute code remotely without authentication.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-to-release-vmware-vrealize-log-rce-exploit-patch-now/

Hackers use new SwiftSlicer wiper to destroy Windows domains

Security researchers have identified a new data-wiping malware they named SwiftSlicer that aims to overwrite crucial files used by the Windows operating system. The new malware was discovered in a recent cyberattack against a target in Ukraine and has been attributed to Sandworm, a hacking group working for Russia’s General Staff Main Intelligence Directorate (GRU) as part of the Main Center for Special Technologies (GTsST) military unit 74455.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-new-swiftslicer-wiper-to-destroy-windows-domains/

Ukraine: Sandworm hackers hit news agency with 5 data wipers

The Ukrainian Computer Emergency Response Team (CERT-UA) found a mix of five different data-wiping malware strains deployed on the network of the country's national news agency (Ukrinform) on January 17, 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-sandworm-hackers-hit-news-agency-with-5-data-wipers/

PlugX malware hides on USB devices to infect new Windows hosts

Security researchers have analyzed a variant of the PlugX malware that can hide malicious files on removable USB devices and then infect the Windows hosts they connect to. The malware uses a novel technique that allows it to remain undetected for longer periods and could potentially spread to air-gapped systems. A sample of this PlugX variant was found by cybersecurity researchers during a response to a Black Basta ransomware attack that relied on GootLoader and the Brute Ratel post-exploitation toolkit for red-team engagements.

See the full report here: https://www.bleepingcomputer.com/news/security/plugx-malware-hides-on-usb-devices-to-infect-new-windows-hosts/

Gootkit Malware Continues to Evolve with New Components and Obfuscations

The threat actors associated with the Gootkit malware have made notable changes to their toolset, adding new components and obfuscations to their infection chains. Gootkit, also called Gootloader, is spread through compromised websites that victims are tricked into visiting when searching for business-related documents like agreements and contracts via a technique called search engine optimization (SEO) poisoning.

See the full report here: https://thehackernews.com/2023/01/gootkit-malware-continues-to-evolve.html

Experts Uncover the Identity of Mastermind Behind Golden Chickens Malware Service

Cybersecurity researchers have discovered the real-world identity of the threat actor behind Golden Chickens malware-as-a-service, who goes by the online persona "badbullzvenom." The threat actor's cyber arsenal has been put to use by other prominent cybercriminal groups like Cobalt Group (aka Cobalt Gang), Evilnum, and FIN6, all of which are estimated to have collectively caused losses totaling USD 1.5 billion.

See the full report here: https://thehackernews.com/2023/01/experts-uncover-identity-of-mastermind.html

N. Korean hackers launder USD 27.18 million ETH stolen in Harmony Bridge attack

The Harmony Bridge attackers, who stole USD 100 million worth of Ethereum (ETH) in June 2022, are continuing to launder their loot. The hackers laundered USD 27.18 million of the stolen ETH so far, according to cybersecurity researchers. Six exchanges received the laundered funds.

See the full report here: https://cryptoslate.com/n-korean-hackers-launder-27-18m-eth-stolen-in-harmony-bridge-attack/

U.S. No Fly list shared on a hacking forum, government investigating

A U.S. No Fly list with over 1.5 million records of banned flyers and upwards of 250,000 selectees has been shared publicly on a hacking forum. The server belonged to Ohio-based airline CommuteAir.

See the full report here: https://www.bleepingcomputer.com/news/security/us-no-fly-list-shared-on-a-hacking-forum-government-investigating/

JD Sports says hackers stole data of 10 million customers

UK sports apparel chain JD Sports is warning customers of a data breach after a server was hacked that contained online order information for 10 million customers. In data breach notices shared by affected customers, the company warns that the attack exposed customer information for orders placed between November 2018 and October 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/jd-sports-says-hackers-stole-data-of-10-million-customers/

QNAP fixes critical bug letting hackers inject malicious code

QNAP has advised customers to install QTS and QuTS firmware updates that fix a critical security vulnerability allowing remote attackers to inject malicious code on QNAP NAS devices. The vulnerability is tracked as CVE-2022-27596 and rated "Critical" (CVSS v3 score: 9.8), impacting QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-fixes-critical-bug-letting-hackers-inject-malicious-code/

GitHub revokes code signing certificates stolen in repo hack

GitHub says unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories. So far, GitHub has found no evidence that the password-protected certificates (one Apple Developer ID certificate and two Digicert code signing certificates used for Windows apps) were used for malicious purposes.

See the full report here: https://www.bleepingcomputer.com/news/security/github-revokes-code-signing-certificates-stolen-in-repo-hack/

Cybercrime job ads on the dark web pay up to USD 20,000 per month

Cybercrime groups are increasingly running their operations as a business, promoting jobs on the dark web that offer developers and hackers competitive monthly salaries, paid time off, and paid sick leaves. In a new report by cybersecurity researchers, which analyzed 200,000 job ads posted on 155 dark websites between March 2020 and June 2022, hacking groups and APT groups seek to hire mainly software developers (61% of all ads), offering very competitive packages to entice them.

See the full report here: https://www.bleepingcomputer.com/news/security/cybercrime-job-ads-on-the-dark-web-pay-up-to-20k-per-month/

KeePass disputes vulnerability allowing stealthy password theft

The development team behind the open-source password management software KeePass is disputing what is described as a newly found vulnerability that allows attackers to stealthily export the entire database in plain text. KeePass is a popular open-source password manager that allows you to manage your passwords using a locally stored database, rather than a cloud-hosted one, such as LastPass or Bitwarden.

See the full report here: https://www.bleepingcomputer.com/news/security/keepass-disputes-vulnerability-allowing-stealthy-password-theft/

Porsche halts NFT launch, phishing sites fill the void

Porsche cut its minting of a new NFT collection short after a low turnout and backlash from the crypto community, allowing threat actors to fill the void by creating phishing sites that steal digital assets from cryptocurrency wallets.

See the full report here: https://www.bleepingcomputer.com/news/security/porsche-halts-nft-launch-phishing-sites-fill-the-void/

Titan Stealer: A New Golang-Based Information Stealer Malware Emerges

A new Golang-based information stealer malware dubbed Titan Stealer is being advertised by threat actors through their Telegram channel. The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files.

See the full report here: https://thehackernews.com/2023/01/titan-stealer-new-golang-based.html

Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software

Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software, after three security vulnerabilities were brought to light in the same product. The impact of exploiting these vulnerabilities include remote control of compromised servers, remote deployment of malware, ransomware and firmware implants, and physical damage of servers (bricking).

See the full report here: https://thehackernews.com/2023/02/additional-supply-chain-vulnerabilities.html

New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector

The Russia-affiliated Sandworm used yet another wiper malware strain dubbed NikoWiper as part of an attack that took place in October 2022 targeting an energy sector company in Ukraine.

See the full report here: https://thehackernews.com/2023/01/new-report-reveals-nikowiper-malware.html

Researchers Uncover Packer Used by Several Malware to Evade Detection for 6 Years

A shellcode-based packer dubbed TrickGate has been successfully operating without attracting notice for over six years, while enabling threat actors to deploy a wide range of malware such as TrickBot, Emotet, AZORult, Agent Tesla, FormBook, Cerber, Maze, and REvil over the years.

See the full report here: https://thehackernews.com/2023/01/researchers-uncover-packer-that-helped.html

Microsoft: Over 100 threat actors deploy ransomware in attacks

Microsoft revealed that its security teams are tracking over 100 threat actors deploying ransomware during attacks. In all, the company says it monitors over 50 unique ransomware families that were actively used until the end of 2022. Some of the most prominent ransomware payloads in recent campaigns include Lockbit Black, BlackCat (aka ALPHV), Play, Vice Society, Black Basta, and Royal.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-over-100-threat-actors-deploy-ransomware-in-attacks/

Microsoft disables verified partner accounts used for OAuth phishing

Microsoft has disabled multiple fraudulent, verified Microsoft Partner Network accounts for creating malicious OAuth applications that breached organizations' cloud environments to steal email. Microsoft said that the threat actors posed as legitimate companies to enroll and successfully be verified as that company in the MCPP (Microsoft Cloud Partner Program). The threat actors used these accounts to register verified OAuth apps in Azure AD for consent phishing attacks targeting corporate users in the UK and Ireland.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-disables-verified-partner-accounts-used-for-oauth-phishing/

New Sh1mmer ChromeBook exploit unenrolls managed devices

A new exploit called "Sh1mmer" allows users to unenroll an enterprise-managed Chromebook, enabling them to install any apps they wish and bypass device restrictions. When Chromebooks are enrolled with a school or an enterprise, they are managed by policies established by the organization's administrators. This allows admins to force-install browser extensions, apps, and to restrict how a device can be used.

See the full report here: https://www.bleepingcomputer.com/news/security/new-sh1mmer-chromebook-exploit-unenrolls-managed-devices/

PoS malware can block contactless payments to steal credit cards

New versions of the Prilex point-of-sale malware can block secure, NFC-enabled contactless credit card transactions, forcing consumers to insert credit cards that are then stolen by the malware. On a payment terminal, contactless transactions use NFC (Near Field Communication) chips embedded in credit cards and mobile devices to conduct close-proximity payments via credit cards, smartphones, or even smartwatches.

See the full report here: https://www.bleepingcomputer.com/news/security/pos-malware-can-block-contactless-payments-to-steal-credit-cards/

Exploit released for critical VMware vRealize RCE vulnerabilit

Security researchers have released proof-of-concept (PoC) code for a VMware vRealize Log Insight vulnerability chain that allows attackers to gain remote code execution on unpatched appliances. VMware patched four security vulnerabilities in its vRealize log analysis tool, two being critical and allowing remote attackers to execute code on compromised devices. Both are tagged as critical severity with CVSS base scores of 9.8/10 and can be exploited as part of low-complexity attacks that don't require user interaction.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-vmware-vrealize-rce-vulnerability/

Google Fi says hackers accessed customers’ information

Google’s cell network provider Google Fi has confirmed a data breach, likely related to the recent security incident at T-Mobile, which allowed hackers to steal millions of customers’ information. In an email sent to customers, Google said that the primary network provider for Google Fi recently informed the company that there had been suspicious activity relating to a third-party support system containing a limited amount of Google Fi customer data.

See the full report here: https://techcrunch.com/2023/01/31/google-fi-customer-data-breach/

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

Cybersecurity researchers have disclosed details of two security flaws in the open source ImageMagick software that could potentially lead to a denial-of-service (DoS) and information disclosure. The two issues, which were identified in version 7.1.0-49, were addressed in ImageMagick version 7.1.0-52, released in November 2022.

See the full report here: https://thehackernews.com/2023/02/researchers-uncover-new-bugs-in-popular.html

Experts Warn of "Ice Breaker" Cyberattacks Targeting Gaming and Gambling Industry

A new attack campaign has targeted the gaming and gambling sectors since at least September 2022, prior to the ICE London 2023 gaming industry trade fair event. Cybersecurity researchers are tracking the activity cluster under the name Ice Breaker, stating the intrusions employ clever social engineering tactics to deploy a JavaScript backdoor.

See the full report here: https://thehackernews.com/2023/02/experts-warn-of-ice-breaker.html

Hackers Abused Microsoft's "Verified Publisher" OAuth Apps to Breach Corporate Email Accounts

Microsoft said it took steps to disable fake Microsoft Partner Network (MPN) accounts that were used for creating malicious OAuth applications as part of a phishing campaign designed to breach organizations' cloud environments and steal emails.

See the full report here: https://thehackernews.com/2023/02/hackers-abused-microsofts-verified.html

New Nevada Ransomware targets Windows and VMware ESXi systems

A relatively new ransomware operation known as Nevada seems to grow its capabilities quickly as security researchers noticed improved functionality for the locker targeting Windows and VMware ESXi systems. Nevada ransomware started to be promoted on the RAMP darknet forums on December 10, 2022, inviting Russian and Chinese-speaking cybercriminals to join it for an 85% cut from paid ransoms.

See the full report here: https://www.bleepingcomputer.com/news/security/new-nevada-ransomware-targets-windows-and-vmware-esxi-systems/

New HeadCrab malware infects 1,200 Redis servers to mine Monero

A new stealthy malware designed to hunt down vulnerable Redis servers online has infected over a thousand of them since September 2021 to build a botnet that mines for Monero cryptocurrency. The malware has so far ensnared at least 1,200 such servers, which are also used to scan for more targets online.

See the full report here: https://www.bleepingcomputer.com/news/security/new-headcrab-malware-infects-1-200-redis-servers-to-mine-monero/

LockBit ransomware goes "Green," uses new Conti-based encryptor

The LockBit ransomware gang has again started using encryptors based on other operations, this time switching to one based on the leaked source code for the Conti ransomware. Since its launch, the LockBit operation has gone through numerous iterations of its encryptor, starting with a custom one and moving to LockBit 3.0 (aka LockBit Black), which is derived from the BlackMatter gang's source code.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-goes-green-uses-new-conti-based-encryptor/

Over 1,800 Android phishing forms for sale on cybercrime market

A threat actor named InTheBox is promoting on Russian cybercrime forums an inventory of 1,894 web injects (overlays of phishing windows) for stealing credentials and sensitive data from banking, cryptocurrency exchange, and e-commerce apps. The overlays are compatible with various Android banking malware and mimic apps operated by major organizations used in dozens of countries on almost all continents.

See the full report here: https://www.bleepingcomputer.com/news/security/over-1-800-android-phishing-forms-for-sale-on-cybercrime-market/

Arnold Clark customer data stolen in attack claimed by Play ransomware

Arnold Clark, an independent car retailer, is notifying some customers that their personal information was stolen in a December 23, 2023 cyberattack claimed by the Play ransomware group. The company said in emails sent to affected clients that the stolen data includes ID information and banking details.

See the full report here: https://www.bleepingcomputer.com/news/security/arnold-clark-customer-data-stolen-in-attack-claimed-by-play-ransomware/

New DDoS-as-a-Service platform used in recent attacks on hospitals

A new DDoS-as-a-Service (DDoSaaS) platform named "Passion" was seen used in recent attacks by pro-Russian hacktivists against medical institutions in the United States and Europe. DDoSaaS platforms rent their available firepower to those looking to launch disruptive attacks on their targets, absolving them from the need to build their own large botnets or coordinate volunteer action.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ddos-as-a-service-platform-used-in-recent-attacks-on-hospitals/

Solar Industries India Website Hacked

A company based in Nagpur (India) which makes weapons for the Indian military has faced a cyberattack, and now the company’s sensitive data is online for sale. While there is no official word from the firm, Solar Industries India Limited, the breach was confirmed by a cybersecurity researcher.

See the full report here: https://theprint.in/india/nagpur-unit-making-military-weapons-hit-by-hackers-says-cybersecurity-firm-data-up-for-sale/1344338/