Threat Intelligence Bulletin: 02/24/2023

ZeroFox Intelligence Profile – Updates on Black Basta Ransomware

Product Serial: P-2023-02-27a

TLP:CLEAR

In this profile report, ZeroFox Intelligence provides updates on Black Basta ransomware, including additional IOCs and activity since the previous profile report was disseminated in August 2022, and the group's significant feature updates in November 2022.

Standing Intelligence Requirements

Deep Dark Web & Criminal Underground DDW

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 3:00 PM (EST) on February 24, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

Black Basta follows the ransomware-as-a-service (RaaS) model used by threat actors to infect and extort victims.
Black Basta ransomware introduced some significant feature updates in November 2022, namely file encryption algorithms, the number of file extensions per victim, and stack-based string obfuscation, all of which likely providing them better evasion capabilities against antivirus and Endpoint Detection and Response (EDR).
ZeroFox Intelligence notes that Black Basta has so far shown a continued propensity to target organizations within the manufacturing, retail, and construction industries.

ZeroFox Intelligence Geopolitical Brief for March 2023

Product Serial: B-2023-03-02a

TLP:CLEAR

In this briefing, ZeroFox Intelligence provides an analysis of geopolitical events that took place in February 2023 and a forward look at events for March 2023. Developments in Russia's war in Ukraine, including renewed support from China are discussed. The implications for changes made to the Northern Ireland Protocol and major protests in the United Kingdom and France are also covered. A critical policy meeting in China is outlined to provide insight into domestic and international policy. The outcome of Nigeria's election as well as upcoming elections in Turkey, Bulgaria, Thailand, and Japan, are also discussed.

Standing Intelligence Requirements

Geopolitical & Physical GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on February 28, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Daily Intelligence Brief: 2023-02-24 - 2023-03-02

ZeroFox Daily Intelligence Brief - February 24, 2023

Key Findings

European Commission Bans TikTok on Its Corporate Devices
CISA Urges Increased Vigilance One Year After Russia's Invasion of Ukraine
New FTC Data Show Consumers Reported Losing Nearly USD 8.8 Billion to Scams in 2022
TELUS Investigating Leak of Stolen Source Code, Employee Data
Multiple Lawsuits Filed Against Regal Medical Group Over Ransomware Attack

Report: https://cloud.zerofox.com/intelligence/advisories/19762

ZeroFox Daily Intelligence Brief - February 27, 2023

Key Findings

Dish Network Goes Offline After Likely Cyberattack, Employees Cut Off
News Corp Says State Hackers Were on Its Network for Two Years
ChromeLoader Campaign Uses VHD Files Disguised as Cracked Games and Pirated Software

Report: https://cloud.zerofox.com/intelligence/advisories/19775

ZeroFox Daily Intelligence Brief - February 28, 2023

Key Findings

U.S. Marshals Service Suffers Security Breach That Compromises Sensitive Information
LastPass Says Employee’s Home Computer was Hacked and Corporate Vault Taken
Thousands of Texan Drivers of Asian Origin Targeted in License Breach
MedusaLocker Ransomware Leveraged In Healthcare Cyberattacks

Report: https://cloud.zerofox.com/intelligence/advisories/19788

ZeroFox Daily Intelligence Brief - March 1, 2023

Key Findings

CISA Adds ZK Java Framework RCE Bug to Known Exploited Vulnerabilities Catalog
SCARLETEEL Hackers Use Advanced Cloud Skills to Steal Source Code, Data
Confidential Bank Documents Found Dumped in Garbage Bin in Perth
CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks
London Honeypots Attacked 2,000 Times Per Minute
Cyberattack on Boston Union Results in USD 6.4 Million Loss

Report: https://cloud.zerofox.com/intelligence/advisories/19806

ZeroFox Daily Intelligence Brief - March 2, 2023

Key Findings

YouTube Facing UK Watchdog Over Children’s Data Complaint
Irish Authorities Levy GDPR Fine in Centric Health Breach
Russia Bans Foreign Messaging Apps in Government Organizations
Trezor Warns of Massive Crypto Wallet Phishing Campaign
Social Engineering Scams Targeting Fashion and Brand Influencers Increasing in Prevalence and Sophistication

Report: https://cloud.zerofox.com/intelligence/advisories/19822

Breach Disclosures: 2023-02-24 - 2023-03-02

### Breach Disclosure: RushMyPassport

An alleged data breach at RushMyPassport – a U.S.-based passport courier service provider – exposed 342,219 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19770

### Breach Disclosure: OrdiROI

An alleged data breach at OrdiROI – a France-based refurbished mobile phones and laptop retail online store– exposed 9,962 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19777

Breach Disclosure: CXOreach

An alleged data breach at CXOreach – an India-based online free B2B database and business intelligence website – exposed 383,838 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19784

Breach Disclosure: TelROI

An alleged data breach at TelROI – a France-based online and offline store for refurbished phones, laptops and tablets – exposed 20,467 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19785

Breach Disclosure: GameAnyone

An alleged data breach at GameAnyone – an Iceland-based website that allows users to share the gameplay videos – exposed 7,500 email addresses and/or physical address, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19786

Breach Disclosure: Hackvita

An alleged data breach at Hackvita – a Russia-based online platform that provides different types of premium accounts – exposed 27,326 usernames, email addresses, and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19787

Breach Disclosure: City Online (都市在线)

An alleged data breach at City Online (都市在线) – a China-based media platform – exposed 616,514 email addresses, hashed password and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19797

Breach Disclosure: Arkansas District Court Clerks Association

An alleged data breach at Arkansas District Court Clerks Association – a U.S.-based non-profit organization that works related to court administration – exposed 242 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19798

Breach Disclosure: China EKO

An alleged data breach at China EKO – a China-based online store for home utilities – exposed 382,261 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19799

Breach Disclosure: EM International

An alleged data breach at EM International – an India-based environmental science and biotechnology research group – exposed 7,500 email addresses and/or physical address, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19800

Breach Disclosure: Rodalink

An alleged data breach at Rodalink – an Indonesia-based bicycle manufacturer and retailer – exposed 31,732 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19801

Breach Disclosure: Kewal Kiran Clothing

An alleged data breach at Kewal Kiran Clothing – an India-based online clothing brand – exposed 1,368,392 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19802

Breach Disclosure: Oyela

An alleged data breach at Oyela – an India-based online store for fashion products – exposed 102,103 usernames and email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19803

Breach Disclosure: HQ International

A combolist breach package titled “30,000,000 (30 Million) HQ International Combos" exposed 29,984,227 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19804

Breach Disclosure: Caorle

An alleged data breach at Teen Services Caorle – an Italy-based travel and hospitality services company – exposed 20,067 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19814

Breach Disclosure: Epi Gaming

An alleged data breach at Epi Gaming – a U.S.-based online gaming website – exposed 29,295 email addresses, usernames and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19815

Breach Disclosure: Canadian Ski Instructors’ Alliance Store

An alleged data breach at Canadian Ski Instructors’ Alliance Store – a Canada-based online ski apparel store and ski teaching body – exposed 9,086 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19816

Breach Disclosure: Dorben Group

An alleged data breach at Dorben Group – a Panama-based online luxury goods retailer – exposed 24,260 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19817

Breach Disclosure: MZ Online Market

An alleged data breach at MZ Online Market – a Myanmar-based E-Commerce website – exposed 8,332 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19818

Breach Disclosure: A2ZClothing

An alleged data breach at A2ZClothing – a U.S.-based fashion and apparel store – exposed 3,885 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19819

Breach Disclosure: Kansas House of Representatives

An alleged data breach at Kansas House of Representatives – a U.S.-based non-profit organization that provides career developments support to teenagers – exposed 14,807 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19820

Breach Disclosure: UScellular

An alleged data breach at UScellular – a U.S.-based mobile network operator – exposed 28,565 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19821

Breaking News: 2023-02-24 - 2023-03-02

Fruit giant Dole suffers ransomware attack impacting operations

Operations of Dole Food Company, one of the world’s largest producers and distributors of fresh fruit and vegetables, has been affected by a ransomware attack.

See the full report here: https://www.bleepingcomputer.com/news/security/fruit-giant-dole-suffers-ransomware-attack-impacting-operations/

TELUS investigating leak of stolen source code, employee data

Canada's second-largest telecom, TELUS, is investigating a potential data breach after a threat actor claimed to be selling the company’s internal data on an online forum. The threat actor claims to be in possession of the company’s private source code repositories, payroll records, employee names, and employee email addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/telus-investigating-leak-of-stolen-source-code-employee-data/

Microsoft urges Exchange admins to remove some antivirus exclusions

Microsoft advises admins to remove some previously recommended antivirus exclusions for Exchange servers to boost the servers' security. Microsoft stated that exclusions targeting the Temporary ASP.NET Files and Inetsrv folders and the PowerShell and w3wp processes are not required.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-urges-exchange-admins-to-remove-some-antivirus-exclusions/

FTC: Americans lost $8.8 billion to fraud in 2022 after 30% surge

The U.S. Federal Trade Commission (FTC) revealed that Americans lost almost USD 8.8 billion to scams in 2022, over 30% more compared with the previous year. The top fraud categories include imposter scams, online shopping scams, prizes, sweepstakes, lotteries, investments, and business and job opportunities.

See the full report here: https://www.bleepingcomputer.com/news/security/ftc-americans-lost-88-billion-to-fraud-in-2022-after-30-percent-surge/

Forsage DeFi platform founders indicted for USD 340 million scam

Four Russian nationals who founded the Forsage decentralized finance (DeFi) cryptocurrency investment platform have been indicted for allegedly running a global Ponzi and pyramid scheme that raised $340 million. The platform's founders used malicious code to direct large portions of the investor funds outside Forsage and into cryptocurrency wallets they controlled.

See the full report here: https://www.bleepingcomputer.com/news/security/forsage-defi-platform-founders-indicted-for-340-million-scam/

Ukraine says Russian hackers backdoored govt websites in 2021

The Computer Emergency Response Team of Ukraine (CERT-UA) announced that Russian state hackers have breached several government websites this week using backdoors planted in December 2021. The incident did not cause essential system failures or disruptions that would affect the operation of Ukrainian public authorities.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-says-russian-hackers-backdoored-govt-websites-in-2021/

Pirated Final Cut Pro infects your Mac with cryptomining malware

Security researchers have discovered a cryptomining operation targeting macOS with a malicious version of Final Cut Pro that remains largely undetected by antivirus engines. The operator(s) behind this campaign have been uploading other macOS apps like Adobe Photoshop and Logic Pro X since 2019, all of them containing a payload for cryptocurrency mining.

See the full report here: https://www.bleepingcomputer.com/news/security/pirated-final-cut-pro-infects-your-mac-with-cryptomining-malware/

Russian malware dev behind NLBrute hacking tool extradited to US

A Russian malware developer accused of creating and selling the NLBrute password-cracking tool has been extradited to the United States after his arrest in the Republic of Georgia. The threat actor reportedly used NLBrute to obtain the login credentials of tens of thousands of computers located all over the world.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-malware-dev-behind-nlbrute-hacking-tool-extradited-to-us/

Clasiopa hackers use new Atharvan malware in targeted attacks

Security researchers have observed a hacking group targeting companies in the materials research sector with a unique toolset that includes a custom remote access trojan (RAT) called Atharvan. The researchers found hints suggesting that the group, Clasiopa, uses brute force to gain access to public facing servers. Atharvan is a custom backdoor not seen in any other attacks in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/clasiopa-hackers-use-new-atharvan-malware-in-targeted-attacks/

Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products

Multiple threat actors have been observed weaponizing a now-patched critical security vulnerability (CVE-2022-47966; CVSS score: 9.8) impacting several Zoho ManageEngine products. 24 different products, including Access Manager Plus, ADManager Plus, ADSelfService Plus, Password Manager Pro, Remote Access Plus, and Remote Monitoring and Management (RMM), are affected by the issue.

See the full report here: https://thehackernews.com/2023/02/experts-sound-alarm-over-growing.html

Lazarus Group Likely Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data

Researchers suspect the North Korea-aligned Lazarus Group to be behind a new backdoor associated with a malware downloader named Wslink. The payload, dubbed WinorDLL64, can exfiltrate, overwrite, and delete files; execute PowerShell commands; obtain comprehensive information about the underlying machine; list active sessions; create and terminate processes; enumerate drives; and compress directories.

See the full report here: https://thehackernews.com/2023/02/lazarus-group-using-new-winordll64.html

Stanford University discloses data breach affecting PhD applicants

Stanford University experienced a data breach where files containing Economics Ph.D. program admission information were downloaded from its website between December 2022 and January 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/stanford-university-discloses-data-breach-affecting-phd-applicants/

PureCrypter malware hits govt orgs with ransomware, info-stealers

A threat actor has been targeting government entities with PureCrypter malware downloader that has been seen delivering multiple information stealers and ransomware strains. The campaign reportedly targeted multiple government organizations in the Asia-Pacific and North-American regions.

See the full report here: https://www.bleepingcomputer.com/news/security/purecrypter-malware-hits-govt-orgs-with-ransomware-info-stealers/

ChromeLoader campaign lures with malicious VHDs for popular games

Security researchers have noticed that the operators of the ChromeLoader browser hijacking and adware campaign are now using VHD (Virtual Hard Disk) files named after popular games. Previously, such campaigns relied on ISO-based distribution.

See the full report here: https://www.bleepingcomputer.com/news/security/chromeloader-campaign-lures-with-malicious-vhds-for-popular-games/

News Corp says state hackers were on its network for two years

Mass media and publishing giant News Corporation (News Corp) says that attackers behind a breach disclosed in 2022 first gained access to its systems two years before, in February 2020. This was revealed in data breach notification letters sent to employees affected by the data breach, who had some of their personal and health information accessed.

See the full report here: https://www.bleepingcomputer.com/news/security/news-corp-says-state-hackers-were-on-its-network-for-two-years/

Dish Network goes offline after likely cyberattack, employees cut off

Dish Network, American TV giant and satellite broadcast provider, has experienced a widespread outage over the past 24 hours, with its websites and apps as well as several networks owned by the corporation ceasing to function.

See the full report here: https://www.bleepingcomputer.com/news/security/dish-network-goes-offline-after-likely-cyberattack-employees-cut-off/

Australia retailer's customer data compromised in third-party breach

Australian retailer The Good Guys had customer data compromised in a security breach involving its former third-party supplier, My Rewards.

See the full report here: https://www.zdnet.com/article/australia-retailers-customer-data-compromised-in-third-party-breach/?web_view=true

Dutch Police arrest three ransomware actors extorting EUR 2.5 million

Amsterdam cybercrime police arrested three men for ransomware activity that generated EUR 2.5 million from extorting small and large organizations in multiple countries, including online shops, software firms, social media companies, and institutions connected to critical infrastructure and services. The suspects are charged with stealing sensitive data from victim networks and demanding a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/dutch-police-arrest-three-ransomware-actors-extorting-25-million/

LastPass: DevOps engineer hacked to steal password vault data in 2022 breach

LastPass has disclosed further information regarding a coordinated second attack in which a threat actor gained unauthorized access to Amazon AWS cloud storage servers and stole data over a period of two months. The company has now disclosed how the threat actors performed this attack, stating that they used information stolen in an August breach, information from another data breach, and a remote code execution vulnerability to install a keylogger on a senior DevOps engineer's computer.

See the full report here: https://www.bleepingcomputer.com/news/security/lastpass-devops-engineer-hacked-to-steal-password-vault-data-in-2022-breach/

U.S. Marshals Service investigating ransomware attack, data theft

The U.S. Marshals Service (USMS) is investigating the theft of sensitive law enforcement information, which occurred after a ransomware attack that impacted what the agency refers to as a stand-alone USMS system. The USMS is a bureau within the Department of Justice that provides support to all aspects of the federal justice system.

See the full report here: https://www.bleepingcomputer.com/news/security/us-marshals-service-investigating-ransomware-attack-data-theft/

New Exfiltrator-22 post-exploitation kit linked to LockBit ransomware

Threat actors are promoting a new post-exploitation framework called "Exfiltrator-22," which is specifically designed to spread ransomware in corporate networks without being detected. The new framework was developed by former Lockbit 3.0 affiliates who specialize in anti-analysis and defense evasion.

See the full report here: https://www.bleepingcomputer.com/news/security/new-exfiltrator-22-post-exploitation-kit-linked-to-lockbit-ransomware/

Critical flaws in WordPress Houzez theme exploited to hijack websites

Hackers are actively exploiting two critical-severity vulnerabilities in the Houzez theme and plugin for WordPress, which are two premium add-ons primarily used for real estate websites. The Houzez theme is a USD 69 premium plugin that offers easy listing management and a smooth customer experience. ThemeForest. One of the flaws was fixed in version 2.6.4 in August 2022, while the other was addressed in version 2.7.2 in November 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-flaws-in-wordpress-houzez-theme-exploited-to-hijack-websites/

Hacker leaks alleged Activision employee data on cybercrime forum

A threat actor has posted data that the alleged data stolen from American game publisher Activision in December 2022 on a hacking forum, highlighting the data's value for phishing operations. In a forum post on the Breached hacking forum, the hackers claims to have stolen the data from Activision Azure database.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-leaks-alleged-activision-employee-data-on-cybercrime-forum/

RIG Exploit Kit still infects enterprise users via Internet Explorer

The RIG Exploit Kit is utilized for roughly 2,000 intrusions daily and is successful in about 30% of cases, the highest ratio in the service's operational history. By exploiting Internet Explorer vulnerabilities, RIG EK has been seen distributing various malware families, including Dridex, SmokeLoader, and RaccoonStealer.

See the full report here: https://www.bleepingcomputer.com/news/security/rig-exploit-kit-still-infects-enterprise-users-via-internet-explorer/

Dish Network confirms ransomware attack behind multi-day outage

Satellite broadcast provider and TV giant Dish Network has confirmed that a ransomware attack was the cause of a multi-day network and service outage.

See the full report here: https://www.bleepingcomputer.com/news/security/dish-network-confirms-ransomware-attack-behind-multi-day-outage/

CISA warns of hackers exploiting ZK Java Framework RCE flaw

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added CVE-2022-36537 to its "Known Exploited Vulnerabilities Catalog" after threat actors began actively exploiting the remote code execution (RCE) flaw in attacks. CVE-2022-36537 is a high-severity (CVSS v3.1: 7.5) flaw impacting the ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1, enabling attackers to access sensitive information by sending a specially crafted POST request to the AuUploader component.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

New MortalKombat ransomware decryptor recovers your files for free

Cybersecurity researchers have released a free MortalKombat ransomware decryptor that victims can use to restore their files without paying a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/new-mortalkombat-ransomware-decryptor-recovers-your-files-for-free/

SCARLETEEL hackers use advanced cloud skills to steal source code, data

An advanced hacking operation dubbed "SCARLETEEL" targets public-facing web apps running in containers to infiltrate cloud services and steal sensitive data.

See the full report here: https://www.bleepingcomputer.com/news/security/scarleteel-hackers-use-advanced-cloud-skills-to-steal-source-code-data/

New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises

A new post-exploitation framework called EXFILTRATOR-22 (aka EX-22) has emerged in the wild with the goal of deploying ransomware within enterprise networks while flying under the radar. Some of the notable features include establishing a reverse shell with elevated privileges, uploading and downloading files, logging keystrokes, launching ransomware to encrypt files, and starting a live VNC (Virtual Network Computing) session for real-time access.

See the full report here: https://thehackernews.com/2023/02/new-ex-22-tool-empowers-hackers-with.html

APT-C-36 Strikes Again: Blind Eagle Hackers Target Key Industries in Colombia

The threat actor known as Blind Eagle has been linked to a new campaign targeting various key industries in Colombia. The activity, which was detected by cybersecurity researchers on February 20, 2023, is also said to encompass Ecuador, Chile, and Spain, suggesting a slow expansion of the hacking group's victimology footprint.

See the full report here: https://thehackernews.com/2023/02/apt-c-36-strikes-again-blind-eagle.html

Thousands of Asian Texans targeted in driver’s license breach

State authorities shipped thousands of Texas driver’s licenses to an international organized crime group in a security lapse that is still under investigation. The agency is working with federal agencies, and the investigation spans at least four states, as other states have also been similarly targeted. It’s not clear when the investigation will be completed.

See the full report here: https://www.dallasnews.com/news/politics/2023/02/27/thousands-of-asian-texans-targeted-in-drivers-license-breach/

Trezor warns of massive crypto wallet phishing campaign

An ongoing phishing campaign disguises itself as data breach notifications from the hardware cryptocurrency service Trezor in an attempt to steal the target's cryptocurrency wallet. When setting up a new Trezor wallet, users are given a 12 or 24-word recovery seed that can be used to recover a wallet. However, anyone who gains access to this seed can also restore the wallet on their own devices, making them valuable targets for threat actors. It is recommended to be aware of this campagain as well as to never share your recovery seed with anyone.

See the full report here: https://www.bleepingcomputer.com/news/security/trezor-warns-of-massive-crypto-wallet-phishing-campaign/

Aruba Networks fixes six critical vulnerabilities in ArubaOS

Aruba Networks published a security advisory to inform customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system. The flaws impact Aruba Mobility Conductor, Aruba Mobility Controllers, and Aruba-managed WLAN Gateways and SD-WAN Gateways.

See the full report here: https://www.bleepingcomputer.com/news/security/aruba-networks-fixes-six-critical-vulnerabilities-in-arubaos/

Iron Tiger hackers create Linux version of their custom malware

The APT27 hacking group, aka "Iron Tiger," has prepared a new Linux version of its SysUpdate custom remote access malware, allowing the Chinese cyberespionage group to target more services used in the enterprise.

See the full report here: https://www.bleepingcomputer.com/news/security/iron-tiger-hackers-create-linux-version-of-their-custom-malware/

Cisco patches critical Web UI RCE flaw in multiple IP phones

Cisco has addressed a critical security vulnerability found in the Web UI of multiple IP Phone models that unauthenticated and remote attackers can exploit in remote code execution (RCE) attacks. The RCE flaw (CVE-2023-20078) allows attackers to inject arbitrary commands that will be executed with root privileges following successful exploitation. While a security update for CVE-2022-20968 is not yet available, admins are advised to disable CDP on affected IP Phone devices supporting Link Layer Discovery Protocol (LLDP) to remove the attack vector.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-patches-critical-web-ui-rce-flaw-in-multiple-ip-phones/

GitHub’s secret scanning alerts now available for all public repos

GitHub has announced that its secret scanning alerts service is now available to all public repositories and can be enabled to detect leaked secrets. Secrets are sensitive data accidentally added to GitHub repositories, including API keys, account passwords, authentication tokens, and other confidential data that can enable attackers to perform security breaches or gain access to non-public data.

See the full report here: https://www.bleepingcomputer.com/news/security/github-s-secret-scanning-alerts-now-available-for-all-public-repos/

Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques

Cryptocurrency companies are being targeted as part of a new campaign that delivers a remote access trojan called Parallax RAT. Parallax RAT grants attackers remote access to victim machines. It comes with features to upload and download files as well as record keystrokes and screen captures.

See the full report here: https://thehackernews.com/2023/03/parallax-rat-targeting-cryptocurrency.html

BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11

A stealthy Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape.

See the full report here: https://thehackernews.com/2023/03/blacklotus-becomes-first-uefi-bootkit.html