Threat Intelligence Bulletin: 02/03/2023

Super Bowl 2023 Assessment

Product Serial: A-2023-02-03a

TLP:CLEAR

In this assessment, ZeroFox Intelligence covers various topics surrounding the 2023 Super Bowl, including physical security, cyber security, and fraud and scams.

Standing Intelligence Requirements

Geopolitical & Physical GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on February 2, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

No credible physical or cyber attack plans have been identified that target Super Bowl LVII.
Physical security preparedness has also included cybersecurity preparations, as a cyberattack would likely have physical security implications as well.
Ahead of the Super Bowl, 5G infrastructure has been shored up in order to not only maximize the attendee experience but also to maintain the ability of security and emergency personnel to function.
Accommodations are sparse and extremely expensive, and scams are present to take advantage of attendees searching for last-minute or cheap accommodations.
The threat of terrorism during the Super Bowl is currently considered low.
Betting and ticketing scams are highly likely, as Super Bowl LVII is anticipated to be the largest betting event ever.

The Underground Economist: Volume 3, Issue 3

Welcome back to The Underground Economist, Volume 3, Issue 3, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of February 3, 2023.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

ZeroFox Daily Intelligence Brief - February 7, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Microsoft Outlook Experiences Global Outage

Microsoft is dealing with an ongoing outage affecting its Outlook webmail service. Customers are experiencing issues with sending, receiving, or searching email or even logging in and having their accounts wiped. Microsoft is restarting portions of the infrastructure impacted by a recent change, and the problem has spread to regions beyond North America. The current Outlook outage also affects additional services like the Microsoft Teams communication platform. This follows a recent five-hour incident that impacted Azure and Microsoft 365 globally and took down multiple services, including Microsoft Teams, Exchange Online, and Outlook. This is a developing story.

Recommendation:

If you are a Microsoft Outlook user, it is best to monitor updates from Microsoft or from the Office Service Health Status page for further information and resolution of the issue.

New Hacking Campaign Exploits Sunlogin Vulnerabilities to Deploy Sliver Toolkit and Disable Security Software

A recent hacking attack has been identified that targets remote-control software Sunlogin. The attackers use two weaknesses in the software to install a tool called Sliver, which is used to disable security software on a device. The attack begins with exploiting the CNVD-2022-10270 / CNVD-2022-03672 RCE vulnerabilities in Sunlogin v11.0.0.33 and earlier, using readily-available proof of concept exploits. The attackers use PowerShell to bypass security products and gain control over the device. They then use Powercat to connect to a remote server, giving them access to the device. In some cases, the attackers also install Gh0st RAT to carry out further actions.

Recommendation:

To protect against this type of attack, Windows admins can use certain security measures provided by Microsoft, including enabling the vulnerable driver blocklist, blocking the hash of the AV killer, and monitoring event logs for newly-installed services named "mhyprot2."

List of Proxy IPs to Help Block KillNet's DDoS Bots

A free tool has been developed to help organizations defend against DDoS attacks from Russian cybercrime group KillNet. The tool, which is an open proxy IP blocklist, lists tens of thousands of proxy IP addresses used by the Russian group in its network-traffic flooding events. The U.S. Department of Health and Human Services issued a second warning about the threat KillNet poses to the healthcare sector after the group claimed responsibility for a series of attacks that took 14 U.S. hospitals' websites offline. KillNet's attacks and threats often have a political slant, but the FBI and private security researchers have called the group's DDoS events publicity stunts with limited success. Although KillNet's attacks usually do not cause major damage, they can cause service outages and hinder access to healthcare information; the group may also use DDoS as a distraction while attempting more serious attacks.

Recommendations:

Take precautions and ensure the security measures of your organization, especially in the wake of increased DDoS attacks by the Russian cybercrime group KillNet.
Be aware of the group's tendency to exaggerate its actions, and take its claims with a grain of salt.

New Linux Variant of Clop Ransomware Discovered with Flawed Encryption

A Linux variant of the Clop ransomware has been discovered in the wild, but it has a faulty encryption algorithm that can be reversed. The Linux version is believed to be an early stage of the ransomware and is missing some functions that are present in the Windows version. The malware targets specific folders and file types for encryption but contains a hard-coded master key that can be used to recover the original files without paying the ransom. The development shows that threat actors are increasingly targeting platforms beyond Windows, and it is likely that we will see more Linux-targeted ransomware campaigns in the future.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.
Require strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication.

The GuLoader Malware Campaign: A Growing Threat to E-commerce Industries

E-commerce industries in South Korea and the United States, as well as Germany, Saudi Arabia, Taiwan, and Japan, are being targeted by a malware campaign called GuLoader. In the past, the malware was spread through Microsoft Word documents with macros, but now it is being spread through NSIS executable files. NSIS is an open-source tool used for creating installers for Windows operating systems. The NSIS files are embedded in ZIP or ISO images to help the malware evade detection. The GuLoader malware has become more sophisticated over time, adding obfuscation and encryption layers to hide its activities. The shift towards using NSIS files is a response to Microsoft blocking macros in Office files downloaded from the internet. Threat actors are being creative and persistent in evading detection and analysis.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.

Sanctioned Iran Group Tied to Charlie Hebdo Hack

Microsoft revealed that an Iranian nation-state group sanctioned by the U.S. government is responsible for the hack of French satirical magazine Charlie Hebdo, likely in response to the magazine sponsoring a cartoon contest "ridiculing" Iranian Supreme Leader Ali Khamenei. The group, Emennet Pasargad, which is tracked by Microsoft under the name NEPTUNIUM, was also linked by the FBI to a sophisticated influence campaign aimed at interfering with the 2020 U.S. presidential elections. In early January 2023, a "hacktivist" group calling itself Holy Souls claimed to have the personal information of more than 200,000 Charlie Hebdo customers and threatened to release it for 20 Bitcoins, a common tactic used by Iran-sponsored hacktivist groups that routinely target perceived regime rivals.

Recommendations:

Protect your online identity and reputation with solid password practices and two-step verification.
Stay ahead of potential breaches by continuously monitoring for compromised credentials.
Uncover threats and potential security issues with the powerful intelligence search feature on the ZeroFox platform.

ZeroFox Daily Intelligence Brief - February 8, 2023

Urgent Update Needed: Go Anywhere MFT Software Vulnerability Discovered

A zero-day vulnerability has been discovered in GoAnywhere MFT, a managed file transfer (MFT) software that enables companies to share data with other users. The flaw allows an attacker to access the software's servers and execute code on exposed admin consoles, either via a VPN, whitelisted IPs, or private company networks. The vendors have released a patch in version 7.1.2 of the software and urge users to update immediately. Many exposed admin consoles with non-HTTPS Port 8000 were found using a Shodan search. Customers are advised to review admin user accounts for unauthorized access and apply recommended configurations.

Recommendation:

Update GoAnywhere MFT software to version 7.1.2 as soon as possible to address the zero-day vulnerability.

CISA Releases Recovery Script for ESXiArgs Ransomware Victims

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a script on GitHub to help users recover their VMware ESXi servers encrypted by the recent ESXiArgs ransomware attacks. The attacks encrypted 2,800 servers, but the threat actors failed to encrypt flat files, which helped a tech team devise a method to rebuild virtual machines from the unencrypted files. The script automates the recovery process by cleaning up encrypted files and attempting to rebuild the .vmdk file using the unencrypted flat file.

Recommendation:

CISA urges administrators to review the script before using it and to create backups. The script is delivered without warranty, and CISA does not assume liability for damage caused by it.

Regulator Halts AI Chatbot Over GDPR Concerns

The Italian Data Protection Authority (GPDP) has ordered the AI chatbot Replika to stop processing data on its domestic citizens, as it violates GDPR rules. The app reportedly does not comply with the GDPR’s transparency requirements, and it processes the personal data of children unlawfully with no age verification mechanism. Some app store reviews have also reported that the bot has generated sexually-inappropriate content. Luka, the San Francisco-based developer of Replika, has been told to stop processing Italians' data within 20 days or face a fine of up to €20 million or 4 percent of its turnover. There are also concerns about the app's links to Russia and its broadcasting of Russian propaganda. The GPDP ruling may lead to similar scrutiny of other popular AI bots like ChatGPT.

Recommendation:

AI chatbot users should be aware that the Italian privacy regulator has ordered Replika to stop processing data on Italian citizens for violating GDPR rules, including lack of age verification and unsuitable content for younger users.

LockBit Ransomware Gang Claims Royal Mail Cyberattack

Royal Mail, the UK's leading mail delivery service, has had to halt its international shipping services following a cyberattack. The LockBit group is suspected of the ransomware attack but initially denied involvement and blamed other cybercriminals using the LockBit 3.0 ransomware builder. However, a representative of the group later confirmed LockBit was behind the attack and said a ransom must be paid in exchange for a decryptor and the deletion of stolen data. The attack is being investigated by the National Crime Agency and UK National Cyber Security Centre (NCSC). Royal Mail has described the incident as a "cyber incident" and has restored some of the services affected.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.
Require strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication.

CERT-UA Issues Alert on Phishing Attacks Employing Remcos Software

The Computer Emergency Response Team of Ukraine (CERT-UA) is alerting state authorities of a new phishing campaign that leverages a legitimate remote monitoring and surveillance software, Remcos. The phishing emails appear to be from Ukrainian telecom company Ukrtelecom and include an attachment over 600MB in size that, when executed, installs the Remcos software on the victim's machine. The Remcos software was developed by BreakingSecurity; however, in this case, it is being used for espionage purposes. The CERT-UA has provided Indicators of Compromise (IoCs) commonly used in the attack. The CERT-UA attributes the campaign to the nation-state actor UAC-0050, which has been known to target state authorities in Ukraine for the purpose of espionage.

Recommendations:

ZeroFox recommends using caution when receiving emails from unknown sources, especially those that contain large attachments
Be aware of the presence of nation-state actors conducting cyber-espionage campaigns and take the necessary steps to protect systems and information, such as keeping software and security systems up to date and monitor for the presence of IoCs provided by the CERT-UA.

ZeroFox Daily Intelligence Brief - February 9, 2023

Key Findings

New Version of ESXiArgs Ransomware
Hong Kong Police Crack International Phishing Syndicate Using Rogue Mobile Apps to Steal Information
Weee! Food Delivery Data Breach Impacts 1.1 Million Customers
Threat Actors Increasing Use of Microsoft OneNote for Info-Stealing RATs
Money Lover App Security Flaw Exposes Shared Wallet Data

New Version of ESXiArgs Ransomware Encrypts More Data, Making Recovery Difficult

The ESXiArgs ransomware has evolved and is now encrypting larger amounts of data, making recovery of encrypted VMware ESXi virtual machines more challenging. In the first wave of attacks, over 3,000 internet-exposed VMware ESXi servers were encrypted, possibly through exploiting old VMware SLP vulnerabilities. The initial encryption process involved a script that encrypted virtual machine files in increments, leaving larger chunks of unencrypted data. However, a second wave of attacks is now underway with a modified encryption routine that encrypts much more data in large files, rendering recovery highly unlikely. The second wave also removed the Bitcoin addresses from the ransom note. According to an admin who reported the attack, the Service Location Protocol (SLP) was disabled, but the server was still compromised.

Recommendation:

ZeroFox still recommends attempting to recover encrypted ESXi servers using CISA's recovery script.

Hong Kong Police Crack International Phishing Syndicate Using Rogue Mobile Apps to Steal Information

An 11-month operation by Hong Kong police and Interpol has resulted in a crackdown on an international phishing syndicate that used 563 fake mobile applications to steal information from phones globally. The operation, named "Magicflame," tracked down 258 servers around the world linked to malicious mobile apps impersonating banks and financial institutions. The victims were infected after clicking on a link from a smishing message, allowing the hackers to steal personal information that included bank account and credit card details, phone contacts, and photographs. The servers stored data stolen from 519 phones, mostly from Japan and South Korea. No arrests were made by Hong Kong police, but information about the suspects was passed on to overseas enforcement agencies.

Recommendations:

ZeroFox recommends staying alert; avoid connecting to any suspicious websites or mobile apps via hyperlinks in emails or text messages.
Be vigilant when downloading and installing applications, especially if they are from unknown or untrusted sources. Check the developer information and reviews before downloading.

Weee! Food Delivery Data Breach Impacts 1.1 Million Customers

Weee! food delivery service suffered a data breach affecting at least 1.1 million customers. A newer and very well-reputed threat actor named “IntelBroker” leaked the information, which contains first and last names, email addresses, phone numbers, device type, order notes, and other data used by the delivery platform. Weee! has confirmed the breach but states that no payment information was exposed, as the company does not retain payment information in its databases. Information of customers who placed orders between July 12, 2021, and July 12, 2022, may have been impacted. Weee! has informed all customers of the issue and is reviewing its security measures.

Recommendations:

Change the password for your email account and any other accounts where you use the same or similar login credentials. Use strong and unique passwords for each online account.
Configure ongoing monitoring for Compromised Account Credentials in the event any of your credentials circulate in the underground.
If available, turn on two-factor authentication for your email and other accounts to add an extra layer of security.

Threat Actors Increasing Use of Microsoft OneNote for Info-Stealing RATs

Security researchers discovered a new type of cyberattack using Microsoft OneNote attachments to deliver remote access Trojans (RATs) in phishing campaigns. The OneNote attachments contain Visual Basic Script (VBS) files, which retrieve two files from a command and control (C2) server. The first file is a decoy OneNote file, and the second is a malicious batch file that deploys one of four info-stealing RAT variants: AsyncRAT, XWorm, QuasarRAT, and Formbook. The RATs can steal sensitive information such as passwords, keystrokes, session cookies, and cryptocurrency wallets. Historically, attackers used Microsoft Word and Excel macros to spread malware, but Microsoft banned the use of macros in 2022—forcing attackers to find new methods.

Recommendations:

Provide cybersecurity awareness training to employees with a focus on phishing.
Inform employees to be cautious when dealing with Microsoft Office files, especially OneNote files.
If OneNote is not used within the organization, consider blocking .one files at the email firewall to prevent them from reaching employees.

Money Lover App Security Flaw Exposes Shared Wallet Data

A vulnerability in financial app Money Lover, which allows users to manage their expenses and budget, exposed transaction data and email addresses of users who had created shared wallets. The data was exposed to any authenticated user of the app and could be viewed using the browser's developer tools. The vulnerability impacted only users who had used the shared wallet feature and exposed email addresses, wallet names, and limited transaction data. The publisher of Money Lover, Finsify, released an update to fix the issue on January 27, 2023.

Recommendation:

Money Lover users are advised to update their app to the latest version to avoid potential targeted phishing attacks that could further compromise sensitive information.

OpenSSL Releases Fixes for High-Severity Security Flaws in Encryption Toolkit

The OpenSSL Project has released fixes to address several security vulnerabilities, including a high-severity bug in the open source encryption toolkit tracked as CVE-2023-0286. This issue relates to type confusion in the handling of X.509 certificates, which may allow an adversary to read memory contents or cause a denial-of-service attack. The vulnerability is likely to impact only those applications that have a custom implementation for retrieving a certificate revocation list over a network. The bug has been patched in OpenSSL versions 3.0.8, 1.1.1t, and 1.0.2zg. These fixes arrive nearly two months after OpenSSL plugged a low-severity flaw in the processing of X.509 certificates, which resulted in a denial-of-service condition.

Recommendation:

ZeroFox recommends updating applications to the latest versions of OpenSSL, which are 3.0.8, 1.1.1t, and 1.0.2zg. Updating to the latest versions of OpenSSL is important to ensure the security of sensitive information and prevent potential security incidents.

Breach Disclosures: 2023-02-03 - 2023-02-09

Breach Disclosure: VDC Data Breach

An alleged data breach at VDC – an India-based e-commerce company – exposed 14,346 email addresses and the data was subsequently shared on a deep web forum. No passwords were found in this breach. Other notable data fields observed in this package include: Name, Physical addresses, Phone numbers, Fax, gender and Date of Birth.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19572

Breach Disclosure: Blinds4UK

Blinds4UK – a U.K.-based online furniture store – allegedly suffered a security incident, in which 140,775 email addresses and plain-text passwords were exposed and subsequently shared on several deep web sources.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19571

Breach Disclosure: DecksDirect

An alleged data breach at DecksDirect – a U.S.-based company that provides sales and services related to decks construction – exposed 85,802 email addresses, which were subsequently shared on a deep web platform.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19575

Breach Disclosure: Comet Forums

An alleged data breach at Comet Forums – a U.S.-based discussion forum – exposed 192,420 email addresses, usernames and hashed passwords were exposed and subsequently shared on a deep web forum.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19573

Breach Disclosure: Hepros Data Breach

Hepros – a Germany-based foldable scooter designer and manufacturer – allegedly suffered a security incident, in which 30,195 email addresses were exposed and subsequently shared on a deep web forum.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19574

Breach Disclosure: PaleoHacks

An alleged data breach at PaleoHacks – a U.S.-based online diet food recipes seller – exposed 59,893 email addresses, usernames and hashed passwords, which were subsequently shared on several deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19576

Breach Disclosure: Life of Pix

An alleged data breach at Life of Pix – a Canada-based website that offers high-resolution photographs – exposed 174,394 email addresses, usernames, and hashed passwords, which were subsequently shared on a deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19577

Breach Disclosure: E-Pal

An alleged data breach at E-Pal – a U.S.-based social platform for gamers – exposed 99,316 email addresses, which were subsequently shared on a deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19579

Breach Disclosure: TrustUp

An alleged data breach at TrustUp – a Belgium-based company that provides professional contractors for constructions and home repair services – exposed 32,640 email addresses, which were subsequently shared on a deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19578

Breach Disclosure: AutoHotkey

An alleged data breach at AutoHotkey – a U.S.-based software company – exposed 17,781 email addresses and/or usernames, which were subsequently shared on a deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19580

Breach Disclosure: AICPA

An alleged data breach at AICPA – U.S.-based accountancy certification company – exposed 140,000 email addresses and plain-text passwords, which were subsequently shared on a deep web platforms.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19581

Breach Disclosure: PokeMasters

An alleged data breach at PokeMasters, a U.S.-based website that hosts games and discussions relating to Pokémon, exposed 13,577 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19582

Breach Disclosure: BEAMSTART

An alleged data breach at BEAMSTART, a Singapore-based news and information website – allegedly suffered a security incident, in which 70,518 email addresses and hashed passwords were exposed, which were subsequently shared on a deep web platform.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19583

Breach Disclosure: SMIDA

An alleged data breach at SMIDA, a Ukrainian stock market development agency, exposed 327,364 email addresses and hashed passwords, which were subsequently shared on a deep web forum.

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19584

Breach Disclosure: JCF online

An alleged data breach at JCF online, a U.S.-based online guitarist community forum– allegedly suffered a security incident, in which 80,757 email addresses were exposed and subsequently shared on a deep web forum

See the full report here: https://cloud.zerofox.com/intelligence/advisories/19585

Breaking News: 2023-02-03 - 2023-02-09

New Russian-Backed Gamaredon's Spyware Variants Targeting Ukrainian Authorities

The State Cyber Protection Centre (SCPC) of Ukraine has called out the Russian state-sponsored threat actor known as Gamaredon for its targeted cyber attacks on public authorities and critical information infrastructure in the country. The advanced persistent threat, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and UAC-0010, has a track record of striking Ukrainian entities dating as far back as 2013.

See the full report here: https://thehackernews.com/2023/02/new-russian-backed-gamaredons-spyware.html

Cisco fixes bug allowing backdoor persistence between reboots

Cisco has released security updates to address a high-severity vulnerability in the Cisco IOx application hosting environment that can be exploited in command injection attacks. The security flaw (CVE-2023-20076) is due to the incomplete sanitization of parameters passed during the app activation process.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-bug-allowing-backdoor-persistence-between-reboots/

North Korean hackers stole research data in two-month-long breach

A new cyber espionage campaign dubbed "No Pineapple!" has been attributed to the North Korean Lazarus hacking group. The campaign led the threat actors to stealthily steal 100GB of data from the victim without causing any destruction. The campaign lasted between August and November 2022, targeting organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-stole-research-data-in-two-month-long-breach/

Former Ubiquiti dev pleads guilty to trying to extort his employer

A former Ubiquiti employee who managed the networking device maker's cloud team, pled guilty to stealing gigabytes worth of files from Ubiquiti's network and trying to extort his employer while posing as an anonymous hacker and a whistleblower.

See the full report here: https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-pleads-guilty-to-trying-to-extort-his-employer/

Hackers weaponize Microsoft Visual Studio add-ins to push malware

Security researchers warn that hackers may start using Microsoft Visual Studio Tools for Office (VSTO) more often as method to achieve persistence and execute code on a target machine via malicious Office add-ins.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-weaponize-microsoft-visual-studio-add-ins-to-push-malware/

Google ads push "virtualized" malware made for antivirus evasion

An ongoing Google ads malvertising campaign is spreading malware installers that leverage KoiVM virtualization technology to evade detection when installing the Formbook data stealer.

See the full report here: https://www.bleepingcomputer.com/news/security/google-ads-push-virtualized-malware-made-for-antivirus-evasion/

0ktapus hackers are back and targeting tech and gaming companies, says leaked report

The hackers who reportedly hit more than 130 organizations in 2022 and stole the credentials of almost 10,000 employees are still targeting several tech and video game companies.

See the full report here: https://techcrunch.com/2023/02/02/0ktapus-hackers-are-back-and-targeting-tech-and-gaming-companies-says-leaked-report/

Financial software firm Ion Group battles LockBit ransomware attack

Ion Group, a Dublin-based software company that helps financial institutions automate their critical business processes, has been hit by a ransomware attack that forced several European and U.S. banks to revert to manual processes. LockBit claimed responsibility for the attack and is threatening to leak data stolen from the company on February 4, 2023, unless a ransom demand is paid according to the ransomware gang’s dark web site. It’s not yet known how much and what types of data were stolen.

See the full report here: https://techcrunch.com/2023/02/02/ion-group-lockbit-derivatives-ransomware/

New Dingo crypto token found charging a 99 percent transaction fee

Cybersecurity researchers have flagged Dingo Token as a potential scam after finding a function that allows the project's owner to manipulate trading fees up to 99% of the transaction value.

See the full report here: https://www.bleepingcomputer.com/news/security/new-dingo-crypto-token-found-charging-a-99-percent-transaction-fee/

Linux version of Royal Ransomware targets VMware ESXi servers

Royal Ransomware is the latest ransomware operation to add support for encrypting Linux devices to its most recent malware variants, specifically targeting VMware ESXi virtual machines.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-version-of-royal-ransomware-targets-vmware-esxi-servers/

NY attorney general forces spyware vendor to alert victims

The New York attorney general's office has announced a USD 410,000 fine for a stalkerware developer who used 16 companies to promote surveillance tools illegally. Stalkerware platforms allow their customers to monitor other people's phones without the users' knowledge.

See the full report here: https://www.bleepingcomputer.com/news/security/ny-attorney-general-forces-spyware-vendor-to-alert-victims/

TruthFinder, Instant Checkmate confirm data breach affecting 20 million customers

PeopleConnect, the owner of the TruthFinder and Instant Checkmate background check services, confirmed it suffered a data breach after hackers leaked a 2019 backup database containing the info of millions of customers. TruthFinder and Instant Checkmate are subscription-based services allowing customers to perform background checks on other people.

See the full report here: https://www.bleepingcomputer.com/news/security/truthfinder-instant-checkmate-confirm-data-breach-affecting-20m-customers/

Massive ESXiArgs ransomware attack targets VMware ESXi servers worldwide

Admins, hosting providers, and the French Computer Emergency Response Team (CERT-FR) warn that attackers actively target VMware ESXi servers unpatched against a two-year-old remote code execution vulnerability to deploy a new ESXiArgs ransomware. Tracked as CVE-2021-21974, the security flaw is caused by a heap overflow issue in the OpenSLP service that can be exploited by unauthenticated threat actors in low-complexity attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/

Florida hospital takes IT systems offline after cyberattack

Tallahassee Memorial HealthCare (TMH) has taken its IT systems offline and suspended non-emergency procedures following a cyberattack. While all its network systems were taken online, TMH says this attack only impacted some of them.

See the full report here: https://www.bleepingcomputer.com/news/security/florida-hospital-takes-it-systems-offline-after-cyberattack/

GoAnywhere MFT zero-day vulnerability lets hackers breach servers

The developers of the GoAnywhere MFT file transfer solution are warning customers of zero-day remote code execution vulnerability on exposed administrator consoles. GoAnywhere is a secure web file transfer solution that allows companies to securely transfer encrypted files with their partners while keeping detailed audit logs of who accessed the files.

See the full report here: https://www.bleepingcomputer.com/news/security/goanywhere-mft-zero-day-vulnerability-lets-hackers-breach-servers/

Atlassian warns of critical Jira Service Management auth flaw

A critical vulnerability (CVE-2023-22501) in Atlassian's Jira Service Management Server and Data Center could allow an unauthenticated attacker to impersonate other users and gain remote access to the systems. Atlassian explains that the security issue affects versions 5.3.0 through 5.5.0 and that hackers could gain access to a Jira Service Management instance under certain circumstances.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-jira-service-management-auth-flaw/

New High-Severity Vulnerabilities Discovered in Cisco IOx and F5 BIG-IP Products

F5 has warned of a high-severity flaw impacting BIG-IP appliances that could lead to denial-of-service (DoS) or arbitrary code execution.

See the full report here: https://thehackernews.com/2023/02/new-high-severity-vulnerabilities.html

PixPirate: New Android Banking Trojan Targeting Brazilian Financial Institutions

A new Android banking trojan has set its eyes on Brazilian financial institutions to commit fraud by leveraging the PIX payments platform. Cybersecurity researchers discovered the malware between the end of 2022 and the beginning of 2023 and is tracking it under the name PixPirate.

See the full report here: https://thehackernews.com/2023/02/pixpirate-new-android-banking-trojan.html

Hackers who breached ION say ransom paid; company declines comment

The hackers who claimed responsibility for a disruptive breach at financial data firm ION say a ransom has been paid, although they declined to say how much it was or offer any evidence that the money had been handed over.

See the full report here: https://www.reuters.com/technology/hackers-say-ransom-paid-case-derivatives-data-firm-ion-company-declines-comment-2023-02-03/

Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations

The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data.

See the full report here: https://thehackernews.com/2023/02/iranian-oilrig-hackers-using-new.html

VMware warns admins to patch ESXi servers, disable OpenSLP service

VMware advised customers to install the latest security updates and disable the OpenSLP service targeted in a large-scale campaign of ransomware attacks against Internet-exposed and vulnerable ESXi servers. The company added that the attackers aren't exploiting a zero-day vulnerability and that this service is disabled by default in ESXi software releases issued since 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-warns-admins-to-patch-esxi-servers-disable-openslp-service/

Hackers backdoor Windows devices in Sliver and BYOVD attacks

A new hacking campaign exploits Sunlogin flaws to deploy the Sliver post-exploitation toolkit and launch Windows Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software. Sliver is a post-exploitation toolkit created by Bishop Fox that threat actors began using as a Cobalt Strike alternative last summer, employing it for network surveillance, command execution, reflective DLL loading, session spawning, process manipulation, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-backdoor-windows-devices-in-sliver-and-byovd-attacks/

Police hacked Exclu message platform to snoop on criminals

The Dutch police announced that it dismantled the Exclu encrypted communications platform after hacking into the service to monitor the activities of criminal organizations. The operation consisted of two separate investigations starting in September 2020 and April 2022, when the police also carried out 79 targeted searches in the Netherlands, Germany, and Belgium and arrested 42 people.

See the full report here: https://www.bleepingcomputer.com/news/security/police-hacked-exclu-secure-message-platform-to-snoop-on-criminals/

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware. The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for terminating processes.

See the full report here: https://thehackernews.com/2023/02/formbook-malware-spreads-via.html

OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability

The maintainers of OpenSSH have released OpenSSH 9.2 to address a number of security bugs, including a memory safety vulnerability in the OpenSSH server (sshd). Tracked as CVE-2023-25136, the shortcoming has been classified as a pre-authentication double free vulnerability that was introduced in version 9.1.

See the full report here: https://thehackernews.com/2023/02/openssh-releases-patch-for-new-pre-auth.html

Microsoft: Iranian Nation-State Group Sanctioned by U.S. Behind Charlie Hebdo Hack

An Iranian nation-state group sanctioned by the U.S. government has been attributed to the hack of the French satirical magazine Charlie Hebdo in early January 2023. A hacktivist group named Holy Souls (now identified as NEPTUNIUM) had claimed to be in possession of the personal information of more than 200,000 Charlie Hebdo customers, after the publication conducted a cartoon contest that cast Iranian Supreme Leader Ali Khamenei in an unsavory light.

See the full report here: https://thehackernews.com/2023/02/microsoft-iranian-nation-state-group.html

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign. The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware. Other countries targeted as part of the campaign include Germany, Saudi Arabia, Taiwan and Japan.

See the full report here: https://thehackernews.com/2023/02/guloader-malware-using-malicious-nsis.html

CISA releases recovery script for ESXiArgs ransomware victims

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a script to recover VMware ESXi servers encrypted by the recent widespread ESXiArgs ransomware attacks. CISA urges admins to review the script before using it to understand how it works and avoid possible complications. Admins should create backups before attempting recovery.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-releases-recovery-script-for-esxiargs-ransomware-victims/

New QakNote attacks push QBot malware via Microsoft OneNote files

A new QBot malware campaign dubbed "QakNote" has been observed in the wild, using malicious Microsoft OneNote attachments to infect systems with the banking trojan. Qbot (aka QakBot) is a former banking trojan that evolved into malware that specializes in gaining initial access to devices. As a defense against this new attack vector, email administrators can consider blocking all .one file extensions, as they are not commonly sent as attachments.

See the full report here: https://www.bleepingcomputer.com/news/security/new-qaknote-attacks-push-qbot-malware-via-microsoft-onenote-files/

Russian man pleads guilty to laundering Ryuk ransomware money

A Russian citizen has pleaded guilty to laundering money for the notorious Ryuk ransomware group for over three years. From August 2018 to August 2021, the arrested man and 13 accomplices participated in money laundering activities involving proceeds from Ryuk ransomware attacks targeting individuals and organizations in the United States and worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-man-pleads-guilty-to-laundering-ryuk-ransomware-money/

Over 12% of analyzed online stores expose private data, backups

Many online stores are exposing private backups in public folders, including internal account passwords, which can be leveraged to take over the e-commerce sites and extort owners. A study examined over 2,000 stores of various sizes and found that 250 (12.3%) exposed archives on public web folders, particularly backups containing database passwords, secret administrator URLs, internal API keys, and customer PII (personally identifiable information).

See the full report here: https://www.bleepingcomputer.com/news/security/over-12-percent-of-analyzed-online-stores-expose-private-data-backups/

Medusa botnet returns as a Mirai-based variant with ransomware sting

A new version of the Medusa DDoS (distributed denial of service) botnet, based on Mirai code, has appeared in the wild, featuring a ransomware module and a Telnet brute-forcer. Medusa is an old malware strain (not to be confused with the same-name Android trojan) being advertised in darknet markets since 2015, which later added HTTP-based DDoS capabilities in 2017.

See the full report here: https://www.bleepingcomputer.com/news/security/medusa-botnet-returns-as-a-mirai-based-variant-with-ransomware-sting/

Researcher breaches Toyota supplier portal with info on 14,000 partners

Toyota's Global Supplier Preparation Information Management System (GSPIMS) was breached by a security researcher who responsibly reported the issue to the company. The security researcher discovered a backdoor in Toyota's system that allowed anyone to access an existing user account as long as they knew their email address. Toyota confirmed that the issues were fixed by November 23, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/researcher-breaches-toyota-supplier-portal-with-info-on-14-000-partners/

Clop ransomware flaw allowed Linux victims to recover files for months

The Clop ransomware gang is now using a malware variant that explicitly targets Linux servers, but a flaw in the encryption scheme has allowed victims to quietly recover their files for free for months. This new Linux version of Clop was spotted in December 2022 by a cybersecurity researcher after the threat group used it together with the Windows variant in an attack against a university in Colombia.

See the full report here: https://www.bleepingcomputer.com/news/security/clop-ransomware-flaw-allowed-linux-victims-to-recover-files-for-months/

LockBit ransomware gang claims Royal Mail cyberattack

The LockBit ransomware operation has claimed the cyberattack on UK's leading mail delivery service Royal Mail that forced the company to halt its international shipping services due to severe service disruption. The entry for the Royal Mail attack on LockBit's data leak site says that the stolen data will be published online on Thursday, February 9, at 03:42 AM UTC.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-royal-mail-cyberattack/

Chip equipment maker MKS Instruments says it is investigating ransomware attack

MKS Instruments Inc said it was investigating a ransomware attack that affected the semiconductor equipment maker's production-related systems. The company said it was in the early stages of investigating the attack that it identified, adding that costs related to the incident have not been determined. MKS said it would temporarily suspend operations at some of its facilities, as part of its containment efforts.

See the full report here: https://telecom.economictimes.indiatimes.com/news/chip-equipment-maker-mks-instruments-says-it-is-investigating-ransomware-attack/97660336

New ESXiArgs ransomware version prevents VMware ESXi recovery

New ESXiArgs ransomware attacks are now encrypting more extensive amounts of data, making it much harder, if not impossible, to recover encrypted VMware ESXi virtual machines.

See the full report here: https://www.bleepingcomputer.com/news/security/new-esxiargs-ransomware-version-prevents-vmware-esxi-recovery/

SonicWall warns web content filtering is broken on Windows 11 22H2

Security hardware manufacturer SonicWall warned customers today of what it describes as a limitation of the web content filtering (WCF) feature on Windows 11, version 22H2 systems. The company says it's currently working on a fix for this issue which will be made available with the release of Capture Client 3.7.7 for Windows on February 17.

See the full report here: https://www.bleepingcomputer.com/news/security/sonicwall-warns-web-content-filtering-is-broken-on-windows-11-22h2/

Weee! grocery service confirms data breach, 1.1 million affected

The leaked database contains Weee! customers' first and last names, email addresses, phone numbers, device type (iOS/PC/Android), order notes, and other data the delivery platform uses. The company confirmed that customer information was stolen in the data breach.

See the full report here: https://www.bleepingcomputer.com/news/security/weee-grocery-service-confirms-data-breach-11-million-affected/

Tor and I2P networks hit by wave of ongoing DDoS attacks

The Tor network has been experiencing connectivity and performance issues. Tor Project's Executive Director revealed that a wave of distributed denial-of-service (DDoS) attacks has been targeting the network since at least July 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/tor-and-i2p-networks-hit-by-wave-of-ongoing-ddos-attacks/

US NIST unveils winning encryption algorithm for IoT data protection

The National Institute of Standards and Technology (NIST) announced that ASCON is the winning bid for the "lightweight cryptography" program to find the best algorithm to protect small IoT (Internet of Things) devices with limited hardware resources.

See the full report here: https://www.bleepingcomputer.com/news/security/us-nist-unveils-winning-encryption-algorithm-for-iot-data-protection/

Malicious Dota 2 game mods infected players with malware

Security researchers have discovered four malicious Dota 2 game mods that were used by a threat actor to backdoor the players' systems. The unknown attacker created four game mods for the highly popular Dota 2 multiplayer online battle arena video game and published them on the Steam store to target the game's fans.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-dota-2-game-mods-infected-players-with-malware/

Money Lover for Android & iOS leaked email addresses, transactions

A flaw in the Money Lover financial app for Android, iOS, and Windows allowed any logged-in member to see the email addresses and live transaction metadata for other users' shared wallets. Money Lover is a finance app allowing users to manage their expenses and budgets that has been downloaded five million times on the Play Store, with the app also available for iOS and Windows.

See the full report here: https://www.bleepingcomputer.com/news/security/money-lover-for-android-and-ios-leaked-email-addresses-transactions/

Drug distributor AmerisourceBergen confirms security breach

Pharmaceutical distributor AmerisourceBergen confirmed that hackers compromised the IT system of one of its subsidiaries after threat actors began leaking allegedly stolen data. AmerisourceBergen is a pharmaceutical product distributor, medical business consultant, and patient services provider.

See the full report here: https://www.bleepingcomputer.com/news/security/drug-distributor-amerisourcebergen-confirms-security-breach/

Russian hackers using new Graphiron information stealer in Ukraine

The Russian hacking group known as "Nodaria" (UAC-0056) is using a new information-stealing malware called "Graphiron" to steal data from Ukrainian organizations. The Go-based malware can harvest a wide range of information, including account credentials, system, and app data. The malware will also capture screenshots and exfiltrate files from compromised machines.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-using-new-graphiron-information-stealer-in-ukraine/

All classes canceled at Irish university as it announces "significant IT breach"

Munster Technological University (MTU) is working with law enforcement to establish if a major IT breach that led to the closure of its four Cork campuses is linked to an international ransomware attack on hundreds of organisations. MTU’s four Cork campuses will remain closed until and an update is expected later on whether students can return to campus as planned.

See the full report here: https://www.breakingnews.ie/ireland/munster-technological-university-working-with-gardai-after-cyberattack-1429808.html

Hong Kong police and Interpol uncover servers and apps used by global phishing syndicate

Hong Kong police have cracked the local operation of an international phishing syndicate that used 563 bogus mobile applications to spy on phones globally and steal information.

See the full report here: https://www.scmp.com/news/hong-kong/law-and-crime/article/3209140/hong-kong-police-and-interpol-uncover-servers-and-apps-used-global-phishing-syndicate?web_view=true