Threat Intelligence Bulletin: 02/10/2023 - 02/16/2023
|by Alpha Team
ZeroFox Intelligence Flash Report – Deepfake Attacks Pose a Growing Threat to MFA
Product Serial: F-2023-02-14a
TLP:CLEAR
In this flash report, ZeroFox Intelligence examines the growing threat synthetic media poses to multi-factor authentication (MFA), as AI-based deepfake technology can deceive MFA systems that rely on voice, face, or behavior recognition, enabling attackers to access sensitive information, accounts, and systems.
Standing Intelligence Requirements
Deep Dark Web & Criminal Underground
Link to Download View the full report here.
Key Findings
- The use of synthetic media to bypass multi-factor authentication (MFA) systems is a growing threat to organizational security.
- Attackers use social engineering techniques to collect data from users for generating realistic audio and video content.
- The AI-based deepfake technology can deceive MFA systems that rely on voice, face, or behavior recognition, enabling attackers to access sensitive information, accounts, and systems.
- The use of social engineering tactics to collect data further emphasizes the need for continuous user education and awareness training.
Microsoft Patch Tuesday 2/15/2023 Notes
This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.
Standing Intelligence Requirements
Recommendations
Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.
Details
Highlights:
Microsoft's Patch Tuesday update for February 2023 contained 77 vulnerabilities, with:
- 9 vulnerabilities rated as Critical
- 55 vulnerabilities rated as High
- 3 actively exploited zero-day vulnerabilities
(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)
Most notable vulnerabilities
This month’s Patch Tuesday cumulative Windows update includes fixes for three zero-day Privilege Escalation vulnerabilities: CVE-2023-21823, CVE-2023-21715, and CVE-2023-23376, which are being actively exploited in the wild.
The other significant bugs patched in this batch of updates include Windows Network File System Remote Code Execution (RCE) vulnerability: CVE-2023-21689, CVE-2023-21690, and CVE-2023-21692; Visual Studio Remote Code Execution vulnerabilities: CVE-2023-23381 and CVE-2023-21815. Microsoft also fixed Office vulnerabilities: CVE-2023-21716, which is a Microsoft Word bug that can lead to remote code execution and CVE-2023-21803, a vulnerability targeting how the Microsoft iSCSI Discovery Service handles certain requests.
CVE-2023-21823
CVE-2023-21823 (CVSS score: 7.8) is a Privilege Escalation Vulnerability which Microsoft indicated could potentially allow attackers to execute commands with SYSTEM privileges. This security update will be pushed out to users via the Microsoft Store rather than Windows Update. For those customers who disable automatic updates in the Microsoft Store, Microsoft will not be pushing out the update automatically.
The following products are affected:
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2016 (Server Core installation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
- Microsoft Office for iOS
- Microsoft Office for Universal
- Microsoft Office for Android
CVE-2023-21715
CVE-2023-21715 (CVSS score: 7.3) is a Security Bypass Vulnerability that can potentially allow an attacker to circumvent security mechanisms to get system or network access. impacts Microsoft Publisher. It has a local attack vector, requires some permissions, and requires user interaction. It involves the attacker using social engineering to get a user to go to a specially crafted website that leads to a local attack on that computer.
The following products are affected:
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft 365 Apps for Enterprise for 64-bit Systems
CVE-2023-23376
CVE-2023-23376 (CVSS score: 7.8) is a Windows Common Log File System Driver Elevation of Privilege Vulnerability which allows an attacker who has successfully exploited the vulnerability to gain SYSTEM privileges.
The following products are affected:
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2016 (Server Core installation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
CVE-2023-21689
CVE-2023-21689 (CVSS score: 7.8) is a Security Bypass Vulnerability that can potentially allow an attacker to circumvent security mechanisms to get system or network access.
The following products are affected:
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2016 (Server Core installation)
- Windows Server 2016
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 10 Version 20H2 for ARM64-based Systems
- Windows 10 Version 20H2 for 32-bit Systems
- Windows 10 Version 20H2 for x64-based Systems
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
CVE-2023-21529
CVE-2023-21529 (CVSS score: 8.8) is a Microsoft Exchange Server Remote Code Execution Vulnerability. It requires the attacker to be authenticated and if they receive authentication, the attacker could target the server accounts in an arbitrary or remote code execution. The following products are affected:
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2013 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 11
- Microsoft Exchange Server 2019 Cumulative Update 12
CVE-2023-21716
CVE-2023-21716 (CVSS score: 9.8) is a Security Bypass Vulnerability Affecting Microsoft Office, primarily Microsoft Word. As a result of this bug, if a malicious file is loaded in the preview pane, an attacker could run code in the logged-on user’s context. This means the user would not even need to open the file to be infected. This has a network attack rating and requires no privileges or user interaction.
The following products are affected:
- Microsoft Word 2013 Service Pack 1 (64-bit editions)
- Microsoft Word 2013 RT Service Pack 1
- Microsoft Word 2013 Service Pack 1 (32-bit editions)
- Microsoft SharePoint Foundation 2013 Service Pack 1
- Microsoft Office Web Apps Server 2013 Service Pack 1
- Microsoft Word 2016 (32-bit edition)
- Microsoft Word 2016 (64-bit edition)
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2013 Service Pack 1
- Microsoft SharePoint Enterprise Server 2016
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft Office 2019 for Mac
- Microsoft Office Online Server
- SharePoint Server Subscription Edition Language Pack
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft SharePoint Server Subscription Edition
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC for Mac 2021
Users are advised to apply the latest security patches specified in Microsoft's February 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.
ZeroFox Daily Intelligence Brief: 2023-02-10 - 2023-02-16
ZeroFox Daily Intelligence Brief - February 10, 2023
Key Findings
- Reddit Hit by a Phishing Attack
- Joint Advisory Issued on DPRK State-Sponsored Ransomware Attacks Targeting Healthcare and Critical Infrastructure
- Russian Threat Actors Target Eastern Europeans in Cryptocurrency Industry with Modified Stealerium Malware “Enigma”
- Financially-Motivated Threat Group Using Custom Tools for Information Theft
- United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang
- Study Reveals Pre-Installed Spyware on Top-of-the-Line Android Devices in China
View the full Brief here: https://cloud.zerofox.com/intelligence/advisories/19617
ZeroFox Daily Intelligence Brief - February 13, 2023
Key Findings
- Namecheap Email Account Breach Leads to MetaMask and DHL Phishing Campaigns
- Play Ransomware Group Claims Attack on A10 Networks
- ChatGPT and the Growing Threat of AI-Driven Cyberattacks
- All India Institute of Medical Sciences Suffers Cyberattack Causing Network Shutdown
- Royal Mail Faces Ransom Deadline as LockBit 2.0 Hackers Claim Network Access
- CISA Adds Three New Vulnerabilities to Its List of Known Exploited Vulnerabilities
- Korenix JetWave Industrial Control Systems Vulnerable to Attack
View the full Brief here: https://cloud.zerofox.com/intelligence/advisories/19629
ZeroFox Daily Intelligence Brief - February 14, 2023
Key Findings
- Cloudflare Blocked Record-Breaking 71 Million RPS DDoS Attack
- Apple Releases Critical Security Updates
- New Financially Motivated Campaign Deploys MortalKombat Ransomware and Laplas Cryptocurrency Hijacker
- Eurostar Faces Backlash Against Recent Password Reset Issue
- Increasing Use of Phishing Attacks to Bypass MFA in Microsoft 365
View the full Brief here: https://cloud.zerofox.com/intelligence/advisories/19644
ZeroFox Daily Intelligence Brief - February 15, 2023
Key Findings
- Airline SAS Network Hit by Hackers, Says App Was Compromised
- Healthcare Giant CHS Reports First Data Breach in GoAnywhere Hacks
- Microsoft February 2023 Patch Tuesday Fixes Three Exploited Zero-Days, 77 flaws
- European Systemic Risk Board (ESRB) Urges for Stronger Defense Against Attack on Financial Institutions
- Chinese Hackers Targeting South American Diplomatic Entities with ShadowPad
View the full Brief here: https://cloud.zerofox.com/intelligence/advisories/19659
ZeroFox Daily Intelligence Brief - February 16, 2023
Key Findings
- Hyundai, Kia Patch Bug Allowing Car Thefts with a USB Cable
- Hackers Start Using Havoc Post-Exploitation Framework in Attacks
- Citrix Fixes Severe Flaws in Workspace, Virtual Apps, and Desktops
- North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware
View the full Brief here: https://cloud.zerofox.com/intelligence/advisories/19668
Breach Disclosures: 2023-02-10 - 2023-02-16
Breach Disclosure: Tomopop
An alleged data breach at Tomopop – a U.S.-based community site for collectible toy culture blogs – exposed 10,149 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19683
Breach Disclosure: Bithoven
An alleged data breach at Bithoven – a Saint Vincent and the Grenadines-based cryptocurrency exchange company – exposed 19,041 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19684
Breach Disclosure: PureCars
An alleged data breach at PureCars – a U.S.-based automotive software and managed services company – exposed 412,665 email addresses, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19685
Breach Disclosure: TxBands
An alleged data breach at TxBands – a U.S.-based webpage that provides news related to Texas High School band – exposed 28,396 email addresses, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19686
Breach Disclosure: LaunchBox Community Forums
An alleged data breach at LaunchBox Community Forums – a U.S.-based software discussion forum – exposed 108,061 email addresses, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19687
Breach Disclosure: Muzhiwan
An alleged data breach at Muzhiwan – a China-based gaming app store – exposed 1,048,051 email addresses, passwords and/or usernames, which were subsequently shared on several deep web platforms.
Report: https://cloud.zerofox.com/intelligence/advisories/19688
Breach Disclosure: GameForce
An alleged data breach at GameForce – a Netherland-based shop and playroom for gamers – exposed 8,564 email addresses and hashed passwords, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19689
Breach Disclosure: Europétrole
An alleged data breach at Europétrole – a France-based consulting company in the oil, gas and petrochemical industries – exposed 9,721 email addresses, usernames and plain-text passwords, which were subsequently shared on a deep web platform.
Report: https://cloud.zerofox.com/intelligence/advisories/19690
Breach Disclosure: Bodynet
An alleged data breach at Bodynet – a Netherland-based online discussion site – exposed 51,999 email addresses, which were subsequently shared on a deep web platforms.
Report: https://cloud.zerofox.com/intelligence/advisories/19691
Breach Disclosure: Nonstop
An alleged data breach at Nonstop – a U.S.-based health care and insurance company – exposed 31,530 email addresses, which were subsequently shared on several deep web platforms.
Report: https://cloud.zerofox.com/intelligence/advisories/19692
Breaking News: 2023-02-10 - 2023-02-16
Reddit Suffers Security Breach Exposing Internal Documents and Source Code
Reddit has disclosed that it was the victim of a security incident that enabled unidentified threat actors to gain unauthorized access to internal documents, code, and some unspecified business systems. The company blamed it on a "sophisticated and highly-targeted phishing attack" that took place on February 5, 2023, targeting its employees.
Report: https://thehackernews.com/2023/02/reddit-suffers-security-breach-exposing.html
Hackers use fake crypto job offers to push info-stealing malware
A campaign operated by Russian threat actors uses fake job offers to target Eastern Europeans working in the cryptocurrency industry, aiming to infect them with a modified version of the Stealerium malware named "Enigma."
Largest Canadian bookstore Indigo shuts down site after cyberattack
Indigo Books & Music, the largest bookstore chain in Canada, has been struck by a cyberattack, causing the company to make the website unavailable to customers and to only accept cash payments. The exact nature of the incident remains unclear but Indigo is not ruling out that hackers may have stolen customer data.
Malicious Google ads sneak AWS phishing sites into search results
A new phishing campaign targeting Amazon Web Services (AWS) logins is abusing Google ads to sneak phishing sites into Google Search to steal your login credentials.
Hacker develops new "Screenshotter" malware to find high-value targets
A new threat actor tracked as TA886 targets organizations in the United States and Germany with new custom malware to perform surveillance and data theft on infected systems. The threat actor appears to have financial motivations, performing a preliminary evaluation of breached systems to determine if the target is valuable enough for further intrusion.
U.S. and U.K. sanction TrickBot and Conti ransomware operation members
The United States and the United Kingdom have sanctioned seven Russian individuals for their involvement in the TrickBot cybercrime group, whose malware was used to support attacks by the Conti and Ryuk ransomware operation. TrickBot is a cybercrime gang responsible for developing numerous malware families, such as the eponymous TrickBot malware, BazarBackdoor, Anchor, and BumbleBee.
PayPal and Twitter abused in Turkey relief donation scams
Scammers are exploiting the ongoing humanitarian crisis in Turkey and Syria by abusing legitimate platforms like PayPal and Twitter. The U.K. government has urged the public to "give safely" when supporting global aid efforts in response to humanitarian crises. Donors should check the government's charity register, verify bank account numbers, use legitimate routes for crypto donation, and report any scams to authorities.
Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices
A set of 38 security vulnerabilities has been uncovered in wireless industrial internet of things (IIoT) devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology (OT) environments. As countermeasures, it's recommended to disable insecure encryption schemes, hide Wi-Fi network names, disable unused cloud management services, and take steps to prevent devices from being publicly accessible.
Report: https://thehackernews.com/2023/02/critical-infrastructure-at-risk-from.html
NewsPenguin Threat Actor Emerges with Malicious Campaign Targeting Pakistani Entities
A previously unknown threat actor dubbed NewsPenguin has been linked to a phishing campaign targeting Pakistani entities by leveraging the upcoming international maritime expo as a lure. The attacks are designed to target marine-related entities and the event's visitors by tricking the message recipients into opening the seemingly harmless Microsoft Word document.
Report: https://thehackernews.com/2023/02/newspenguin-threat-actor-emerges-with.html
Gootkit Malware Adopts New Tactics to Attack Healthcare and Finance Firms
The Gootkit malware is prominently going after healthcare and finance organizations in the U.S., U.K., and Australia, according to new findings made by cybersecurity researchers. Gootkit, also called Gootloader, is exclusively attributed to a threat actor tracked by Mandiant as UNC2565.
Report: https://thehackernews.com/2023/02/gootkit-malware-adopts-new-tactics-to.html
OpenSSL Fixes Multiple New Security Flaws with Latest Update
The OpenSSL Project has released fixes to address several security flaws, including a high-severity bug in the open source encryption toolkit that could potentially expose users to malicious attacks. Tracked as CVE-2023-0286, the issue relates to a case of type confusion that may permit an adversary to read memory contents or enact a denial-of-service, the maintainers said in an advisory.
Report: https://thehackernews.com/2023/02/openssl-fixes-multiple-new-security.html
Unpatched Security Flaws Disclosed in Multiple Document Management Systems
Multiple unpatched security flaws have been disclosed in open source and freemium Document Management System (DMS) offerings from four vendors LogicalDOC, Mayan, ONLYOFFICE, and OpenKM. The eight vulnerabilities offer a mechanism through which an attacker can convince a human operator to save a malicious document on the platform and, once the document is indexed and triggered by the user, giving the attacker multiple paths to control the organization.
Report: https://thehackernews.com/2023/02/unpatched-security-flaws-disclosed-in.html
NameCheap's email hacked to send Metamask, DHL phishing emails
Domain registrar Namecheap had its email account breached, leading to threat actors sending MetaMask and DHL phishing emails that attempted to steal recipients' personal information and cryptocurrency wallets. The phishing campaigns originated from SendGrid, an email platform used historically by Namecheap to send renewal notices and marketing emails.
Devs targeted by W4SP Stealer malware in malicious PyPi packages
Five malicious packages were found on the Python Package Index (PyPI), stealing passwords, Discord authentication cookies, and cryptocurrency wallets from unsuspecting developers. PyPI is a software repository for packages created in the Python programming language. As the index hosts 200,000 packages, it allows developers to find existing packages that satisfy various project requirements, saving time and effort.
City of Oakland systems offline after ransomware attack
The City of Oakland was hit by a ransomware attack that forced it to take all systems offline until the network is secured and affected services are brought back online. The attack has not affected core services, with the City saying that 911 dispatch and fire and emergency resources are all working as expected. The City's Information Technology Department (ITD) is coordinating with law enforcement to investigate the attack and working on securing and restoring impacted services.
A10 Networks confirms data breach after Play ransomware attack
The California-based networking hardware manufacturer A10 Networks has confirmed that the Play ransomware gang briefly gained access to its IT infrastructure and compromised data. The company's investigation determined that the threat actors managed to gain access to shared drives, deployed malware, and compromised data related to human resources, finance, and legal functions.
Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day
The Clop ransomware gang claims to be behind recent attacks that exploited a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool, saying it stole data from over 130 organizations. The security flaw, now tracked as CVE-2023-0669, enables attackers to gain remote code execution on unpatched GoAnywhere MFT instances with their administrative console exposed to Internet access. Clop disclosed that they had allegedly stolen the data over the course of ten days after breaching servers vulnerable to exploits targeting this bug.
California medical group data breach impacts 3.3 million patients
Multiple medical groups in the Heritage Provider Network in California have suffered a ransomware attack, exposing sensitive patient information to cybercriminals. The medical groups impacted by the cyberattack are Regal Medical Group, Lakeside Medical Organization, ADOC Medical Group, and Greater Covina Medical. The entities collectively issued a notice of data breach at the start of the month and shared a sample letter with the California Attorney General's office earlier this week.
North Korean ransomware attacks on healthcare fund govt operations
A new cybersecurity advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) describes recently observed tactics, techniques, and procedures (TTPs) observed with North Korean ransomware operations against public health and other critical infrastructure sectors. The document is a joint report from the NSA, FBI, CISA, U.S. HHS, and the Republic of Korea National Intelligence Service and Defense Security Agency, and notes that the funds extorted this way went to support North Korean government's national-level priorities and objectives.
CISA Warns of Active Attacks Exploiting Fortra MFT, TerraMaster NAS, and Intel Driver Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active abuse in the wild. Included among the three is CVE-2022-24990, a bug affecting TerraMaster network-attached storage (TNAS) devices that could lead to unauthenticated remote code execution with the highest privileges. Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by March 3, 2023, to secure the networks against active threats.
Report: https://thehackernews.com/2023/02/cisa-warns-of-active-attacks-exploiting.html
Pak Foreign Ministry data allegedly hacked by Indian hackers, claims report
Indian hackers have reportedly managed to extract data from Pakistan's Ministry of Foreign Affairs (MoFA) office. The hackers gained unauthorised access to the ministry's systems and were able to extract a significant amount of data.
5 servers hacked, 1.3 TB data encrypted: MoS Chandrasekhar on AIIMS cyber attack
As per the analysis of the national cyber security watchdog, five servers of the All Indian Institute of Medical Sciences (AIIMS) were affected by a recent cyber attack which led to encryption of approximately 1.3 terabytes of data. The AIIMS, Delhi allegedly faced a cyber attack on November 23, 2022 paralysing its servers. A case of extortion and cyber terrorism was registered by the Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police on November 25, 2022.
Russian hackers disrupt Turkey-Syria earthquake relief
Russian hackers have disrupted contact between NATO and military aircraft providing aid to victims of the Turkish-Syrian earthquake which has claimed at least 28,000 lives. A Nato official confirmed that the alliance had fallen victim to a cyber attack, which is believed to have been carried out by the Killnet group of hackers. The Killnet group of hackers claimed responsibility for the distributed denial of service (DDoS) attacks but did not provide any more details.
Cloudflare blocks record-breaking 71 million RPS DDoS attack
Cloudflare blocked what it describes as the largest volumetric distributed denial-of-service (DDoS) attack to date. The company said it detected and mitigated not just one but a wave of dozens of hyper-volumetric DDoS attacks targeting its customers.
451 PyPI packages install Chrome extensions to steal crypto
Over 450 malicious PyPI python packages were found installing malicious browser extensions to hijack cryptocurrency transactions made through browser-based crypto wallets and websites. These packages are being promoted through a typosquatting campaign that impersonates popular packages but with slight variations, such as an altered or swapped character. The goal is to deceive software developers into downloading these malicious packages instead of the legitimate ones.
Apple fixes new WebKit zero-day exploited to hack iPhones, Macs
Apple has released emergency security updates to address a new zero-day vulnerability used in attacks to hack iPhones, iPads, and Macs. The zero-day patch is tracked as CVE-2023-23529 and is a WebKit confusion issue that could be exploited to trigger OS crashes and gain code execution on compromised devices.
Spain, U.S. dismantle phishing gang that stole $5 million in a year
Spain's National Police and the U.S. Secret Service have dismantled a Madrid-based international cybercrime ring comprised of nine members who stole over EUR 5,000,000 from individuals and North American companies. The cybercrime gang specializes in online scams, employing social engineering, phishing, and smishing to collect sensitive victim details and then use that information to commit financial fraud.
Lazarus hackers use new mixer to hide USD 100 million in stolen crypto
North Korean hackers have found a way around U.S.-imposed sanctions to launder the cryptocurrency proceeds from their heists, according to evidence discovered by blockchain analysts. The Lazarus Group has laundered about USD 100 million in stolen Bitcoin since October 2022 through a single crypto-mixing service called Sinbad.
FTC: USD 1.3 billion lost by 70,000 Americans to romance scams last year
The U.S. Federal Trade Commission (FTC) says Americans once again reported record losses of USD 1.3 billion to romance scams in 2022, with median losses of USD 4,400. Americans have also reported losing USD 493 million in 2019, USD 730 million in 2020, and USD 1.3 billion throughout 2021.
Pepsi Bottling Ventures suffers data breach after malware attack
Pepsi Bottling Ventures LLC suffered a data breach caused by a network intrusion that resulted in the installation of information-stealing malware and the extraction of data from its IT systems. Pepsi Bottling Ventures is the largest bottler of Pepsi-Cola beverages in the United States, responsible for manufacturing, selling, and distributing popular consumer brands. It operates 18 bottling facilities across North and South Carolina, Virginia, Maryland, and Delaware.
Ransomware hits Technion university to protest tech layoffs and Israel
A new ransomware group going by the name "DarkBit" has hit Technion - Israel Institute of Technology, one of Israel's leading research universities. The ransom note posted by DarkBit is littered with messaging protesting tech layoffs and promoting anti-Israel rhetoric, as well as the group demanding a USD 1.7 million payment.
Chinese Tonto Team Hackers' Second Attempt to Target Cybersecurity Firm Group-IB Fails
The advanced persistent threat (APT) actor known as Tonto Team carried out an unsuccessful attack on cybersecurity company Group-IB in June 2022. The Singapore-headquartered firm said that it detected and blocked malicious phishing emails originating from the group targeting its employees. It's also the second attack aimed at Group-IB, the first of which took place in March 2021.
Report: https://thehackernews.com/2023/02/chinese-tonto-team-hackers-second.html
Hackers Targeting U.S. and German Firms Monitor Victims' Desktops with Screenshotter
A previously unknown threat actor has been targeting companies in the U.S. and Germany with bespoke malware designed to steal confidential information. Cybersecurity researchers tracking the activity cluster under the name Screentime said the group, dubbed TA866, is likely financially motivated.
Report: https://thehackernews.com/2023/02/hackers-targeting-us-and-german-firms.html
Indian social media app Slick exposed childrens’ user data
Emerging Indian social media app Slick left an internal database containing users’ personal information, including data of school-going children, publicly exposed to the internet for months. Since at least December 11, 2022 a database containing full names, mobile numbers, dates of birth, and profile pictures of Slick users was left online without a password.
Report: https://techcrunch.com/2023/02/10/slick-social-media-app-data-exposed/
Taiwan fines car renting giant iRent for customer data spill
Taiwanese authorities have fined car rental and ridesharing giant iRent after a report revealed that the company was spilling customers’ data and identity documents onto the open web for months. According to media reports, iRent, which is owned by Taiwanese auto conglomerate Hotai Motor, received two separate fines for failing to adequately protect the data of more than 400,000 customers.
Report: https://techcrunch.com/2023/02/10/taiwan-irent-exposed-data/
Massive AdSense Fraud Campaign Uncovered - 10,000+ WordPress Sites Infected
The threat actors behind the black hat redirect malware campaign have scaled up their campaign to use more than 70 bogus domains mimicking URL shorteners and infect over 10,800 websites. The main objective is still ad fraud by artificially increasing traffic to pages which contain the AdSense ID which contain Google ads for revenue generation.
Report: https://thehackernews.com/2023/02/massive-adsense-fraud-campaign.html
Update Now: Microsoft Releases Patches for 3 Actively Exploited Windows Vulnerabilities
Microsoft released security updates to address 75 flaws spanning its product portfolio, three of which have come under active exploitation in the wild. The updates are in addition to 22 flaws the Windows maker patched in its Chromium-based Edge browser over the past month. Of the 75 vulnerabilities, nine are rated Critical and 66 are rated Important in severity. 37 out of 75 bugs are classified as remote code execution (RCE) flaws.
Report: https://thehackernews.com/2023/02/update-now-microsoft-releases-patches.html
Eurostar forces "password resets" — then fails and locks users out
International high-speed rail operator, Eurostar, is emailing its users and forcing them to reset their account passwords in a bid to upgrade security.But users who visit the password reset link are met with technical problems, thereby making it impossible for them to reset their password or log in to their accounts. Eurostar is well known for connecting the United Kingdom to France, Belgium, and Netherlands with most of its trains crossing the Channel Tunnel.
New "MortalKombat" ransomware targets systems in the U.S.
Hackers conducting a new financially motivated campaign are using a variant of the Xortist commodity ransomware named "MortalKombat," together with the Laplas clipper in cyberattacks. Both malware infections are used to conduct financial fraud, with the ransomware used to extort victims to receive a decryptor and Laplas to steal cryptocurrency by hijacking crypto transactions.
New stealthy "Beep" malware focuses heavily on evading detection
A new stealthy malware named "Beep" was discovered, featuring many features to evade analysis and detection by security software. The malware was discovered by cybersecurity analysts after various samples were uploaded to VirusTotal, an online platform for file scanning and malicious content detection. Although Beep is still in development and missing several key features, it currently allows threat actors to download and execute further payloads on compromised devices remotely.
Healthcare giant CHS reports first data breach in GoAnywhere hacks
Community Health Systems (CHS) says it was impacted by a recent wave of attacks targeting a zero-day vulnerability in Fortra’s GoAnywhere MFT secure file transfer platform. The healthcare provider giant said that Fortra issued an alert saying that it had experienced a security incident leading to some CHS data being compromised. A subsequent investigation revealed that the resulting data breach affected the personal and health information of up to 1 million patients.
NPM packages posing as speed testers install crypto miners instead
A new set of 16 malicious NPM packages are pretending to be internet speed testers but are, in reality, coinminers that hijack the compromised computer's resources to mine cryptocurrency for the threat actors. The packages were uploaded onto NPM, an online repository containing over 2.2 million open-source JavaScript packages shared among software developers to speed up the coding process.
RedEyes hackers use new malware to steal data from Windows, phones
The APT37 threat group uses a new evasive "M2RAT" malware and steganography to target individuals for intelligence collection. APT37, also known as "RedEyes" or "ScarCruft," is a North Korean cyber espionage hacking group believed to be state-supported.
Airline SAS network hit by hackers, says app was compromised
Scandinavian airline SAS said it was hit by a cyber attack and urged customers to refrain from using its app but later said it had fixed the problem. News reports said the hack paralysed the carrier's website and leaked customer information from its app.
Hackers target Bahrain airport, news sites to mark Arab Spring uprising
Hackers said they had taken down the websites of Bahrain’s international airport, state news agency and chamber of commerce to mark the 12-year anniversary of an Arab Spring uprising in the small Gulf country. A statement posted online by a group calling itself Al-Toufan, or “The Flood” in Arabic, claimed to have hacked the airport website, which was unavailable for at least a half hour in the middle of the day.
EU countries told to step up defence against state hackers
The European Systemic Risk Board (ESRB) has published a report about advancing tools for cyber resilience with the aim of reducing impact to its financial sector. This report builds on previous work by the ESRB to prevent and mitigate risks to financial stability in the event of a cyber incident.
Report: https://www.esrb.europa.eu/news/pr/date/2023/html/esrb.pr230214~788425a034.en.html
Chinese Hackers Targeting South American Diplomatic Entities with ShadowPad
Microsoft attributed a China-based cyber espionage actor to a set of attacks targeting diplomatic entities in South America. The tech giant's Security Intelligence team is tracking the cluster under the emerging moniker DEV-0147, describing the activity as an expansion of the group's data exfiltration operations that traditionally targeted government agencies and think tanks in Asia and Europe.
Report: https://thehackernews.com/2023/02/chinese-hackers-targeting-south.html
North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware
APT37, a sophisticated threat actor that is linked to the North Korean government, has begun operating a new malware, M2RAT, which is a clear indication that the group is continuing to evolve its features and tactics. The group is known for using a variety of different tools and techniques to carry out its attacks.
Report: https://thehackernews.com/2023/02/north-koreas-apt37-targeting-southern.html
Hyundai, Kia patch bug allowing car thefts with a USB cable
Hyundai and KIA are rolling out an emergency software update on several of their car models in a response to a serious security vulnerability that allows hackers to steal them. The United States Department of Transportation published a post yesterday explaining that the security flaw impacts approximately 3.8 million Hyundai vehicles and 4.5 million KIA cars. It is vital that car owners take action to install the update as soon as possible in order to minimize the risk of their vehicles being stolen or otherwise compromised.
Hackers start using Havoc post-exploitation framework in attacks
The emergence of the new open-source command and control framework, Havoc, is being observed by cybersecurity experts. One of the most interesting capabilities of Havoc is its ability to bypass Microsoft Defender on up-to-date Windows 11 devices using a combination of techniques, including sleep obfuscation, return address stack spoofing, and indirect syscalls.
City of Oakland declares state of emergency after ransomware attack
The city of Oakland (California, United States) has declared a local state of emergency due to a ransomware attack on February 8, 2023. The incident did not impact core services, the 911 dispatch, and fire and emergency resources.
Russian hacker convicted of USD 90 million hack-to-trade charges
A Russian national has been found guilty of participating in a global scheme that involved hacking into U.S. computer networks to steal confidential earnings reports, which helped the criminals to make USD 90,000,000 in illegal profits. In December 2021, the individual was extradited to the United States to face charges of hacking into the systems of two U.S.-based filing agents used by American companies to file earnings reports through the Securities and Exchange Commissions (SEC) system.
Citrix fixes severe flaws in Workspace, Virtual Apps and Desktops
Citrix Systems has released security updates for vulnerabilities in its Virtual Apps and Desktops, as well as its Workspace Apps products. The security issues addressed have been categorized as high- severity, and if exploited, could allow attackers with local access to the target to elevate their privileges and take control of the affected system. At present, there are no mitigation advice or workarounds available for the identified security issues, making it essential to update the impacted products as the only recommended approach to address the risks.
Emsisoft says hackers are spoofing its certs to breach networks
Hackers are using fake code-signing certificates which impersonate cybersecurity firm Emsisoft to target customers who use its security products in an attempt to bypass their defenses. Threat actors attempt to take advantage of this by creating fake certificates whose names appear to be associated with a trustworthy entity but are in reality not valid certificates. The company suggests that system administrators set a password on their Emsisoft product to prevent it from being tampered with or disabled in the event of a breach.
Dark Caracal APT emerges with a New Version of Bandook Spyware
The little-known Dark Caracal APT group, which first emerged in 2018, has returned with a new campaign that aims to infect computers in Central and Latin America. Currently, the group is infecting over 700 computers in Central and South America, with a primary focus on the Dominican Republic and Venezuela.
Report: https://www.eff.org/deeplinks/2023/02/uncle-sow-dark-caracal-latin-america
Tags: tlp:clear, all industries, global