Threat Intelligence Bulletin: 04/14/2023 - 04/20/2023
|by Alpha Team
ZeroFox Weekly Threat Bulletin: 04/14/2023 - 04/20/2023
ZeroFox Daily Intelligence Briefs:
ZeroFox Daily Intelligence Brief - April 20, 2023
Key Findings
- Investigation Reveals Findings on GoAnywhere Zero-Day Attacks That Hit over 130 Organizations
- Cybersecurity Agencies of the “Five Eyes” Recommend Best Practices for Smart Cities
- Security Scaled Up After U.S. Intelligence Data Leak
Report: https://zerofox.com/advisories/20282
ZeroFox Daily Intelligence Brief - April 19, 2023
Key Findings
- UK and U.S. Cybersecurity Authorities Warn of State-Backed Hackers Targeting Cisco Routers
- YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader
- Security Scaled Up After U.S. Intelligence Data Leak
Report: https://zerofox.com/advisories/20268
ZeroFox Daily Intelligence Brief - April 18, 2023
Key Findings
- Business Emails Targeted Through Banking Trojan, Spread Via Malware
- CommScope Data Published After Ransom Negotiation Fails
- Ex-Conti Members and FIN7 Threat Actors Develop New Domino Malware
Report: https://zerofox.com/advisories/20256
ZeroFox Daily Intelligence Brief - April 17, 2023
Key Findings
- CISA Orders Federal Agencies to Patch Android Zero-Day Abused by Chinese App Pinduoduo
- LockBit Ransomware Encryptors Designed to Target Mac Devices
- Hospitality Services Affected by ALPHV Ransomware Attack
Report: https://zerofox.com/advisories/20241
ZeroFox Daily Intelligence Brief - April 14, 2023
Key Findings
- Legion: A New Python-Based Hacking Tool Promoted on Telegram
- Russian Hackers Linked to Widespread Attacks Targeting NATO and EU
- Civil Liberty Groups Express Data-Privacy Concerns in European Union Child Protection Bill
Report: https://zerofox.com/advisories/20225
Breach Disclosures:
Breach Disclosure: Lead Kahuna
Summary An alleged data breach at Lead Kahuna – a U.S.-based company that provides software solution for marketing systems – exposed 223,036 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20293
Breach Disclosure: Almazan Kitchen
Summary An alleged data breach at Almazan Kitchen – a Serbia-based website that sells kitchen products and share recipes – exposed 14,417 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20292
Breach Disclosure: Urban Roosters
Summary An alleged data breach at Urban Roosters – a Spain-based entertainment platform designed for conducting hip-hop online competitions – exposed 382,670 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20267
Breach Disclosure: MSPA_forums
Summary An alleged data breach at MSPA_forums – a U.S.-based webcomic site – exposed 180,824 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20266
Breach Disclosure: RealDudesInc
Summary An alleged data breach at RealDudesInc – an Iceland-based online video accessory store – exposed 101,863 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20258
Breach Disclosure: California Lottery
Summary A data leak package titled “California Lottery" – exposed 10,021 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20257
Breach Disclosure: Spidermetrix
Summary An alleged data breach at Spidermetrix – an Australia-based company that pays people to participate in online surveys – exposed 679,006 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20255
Breach Disclosure: Indian Government Employee Database
Summary An alleged data breach of an Indian Government Employee Database – exposed 68,895 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20254
Breach Disclosure: TAP Air Portugal
Summary An alleged data breach at TAP Air Portugal – a Portugal-based airline service – exposed 103,044 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20253
Breach Disclosure: Cig Reviews
Summary An alleged data breach at Cig Reviews – a U.S.-based online site that reviews and lists discounts for cigarettes – exposed 282,109 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20252
Breach Disclosure: DFB
Summary An alleged data breach at DFB – an German-based football association – exposed 2,996,829 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20251
Breach Disclosure: Haijiao
Summary An alleged data breach at Haijiao – a China-based online adult entertainment site – exposed 15,545,908 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20240
Breach Disclosure: Remedia Homeopathy
Summary An alleged data breach at Remedia Homeopathy – an Austria-based company that operates in the pharmaceuticals industry – exposed 134,315 email addresses and/or usernames, which were subsequently shared on a deep web platform.
Report: https://zerofox.com/advisories/20239
Breaking News:
Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases
A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers. The vulnerabilities potentially allowed unauthorized access to Alibaba Cloud customers' PostgreSQL databases and the ability to perform a supply chain attack on both Alibaba database services. The issues, dubbed BrokenSesame, were reported to Alibaba Cloud in December 2022, following mitigations were deployed by the company on April 12, 2023. There is no evidence to suggest that the weaknesses were exploited in the wild.
See the full report here: https://thehackernews.com/2023/04/two-critical-flaws-found-in-alibaba.html
GhostToken Opens Google Accounts to Permanent Infection
A security vulnerability in Google's Cloud Platform (GCP) could have allowed cyberattackers to hide an unremovable, malicious application inside a victim's Google account, dooming the account to a state of permanent, undetectable infection. The bug, dubbed "GhostToken," was discovered on April 20 2023, the malicious app could have paved the way for a startling array of unauthorized activity, including reading the victim's Gmail account, accessing files in Google Drive and Google Photos, viewing the Google calendar, and tracking locations via Google Maps.
See the full report here: https://www.darkreading.com/remote-workforce/-ghosttoken-opens-google-accounts-to-permanent-infection
Europe’s Air-Traffic Agency Under Attack From Pro-Russian Hackers
Europe’s air-traffic control agency stated that it was under attack from pro-Russian hackers amid fears that Moscow could interfere with the region’s critical infrastructure as its confrontation with the West escalates. The cyberattack on the agency’s website started on April 19, a spokeswoman for the European Organisation for the Safety of Air Navigation, also known as Eurocontrol, said, adding that it wasn’t affecting the agency’s air-traffic control activities.
See the full report here: https://www.wsj.com/amp/articles/europes-air-traffic-agency-under-attack-from-pro-russian-hackers-54b4514d
Hackers Using Old Nokia 3310 Phone to Start Car Without Key
Recent car thefts have involved technology concealed inside outdated Nokia phones and Bluetooth speakers. This brand-new type of car theft is becoming more prevalent in the US. Criminals use tiny gadgets to interface with the car’s control system, sometimes hidden within innocent-looking Bluetooth speakers or cell phones. This makes it possible for thieves with little technological expertise to steal cars without a key, sometimes in as little as 15 seconds.
See the full report here: https://cybersecuritynews.com/hackers-using-old-nokia-3310-phone-to-steal-cars/
NSO Group Used 3 Zero-Click iPhone Exploits Against Human Rights Defenders
Israeli spyware maker NSO Group deployed at least three novel "zero-click" exploits against iPhones in 2022 to infiltrate defenses erected by Apple and deploy Pegasus. NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world.
See the full report here: https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html
Daggerfly Cyberattack Campaign Hits African Telecom Services Providers
Telecommunication services providers in Africa are the target of a new campaign orchestrated by a China-linked threat actor at least since November 2022. The intrusions have been pinned on a hacking crew tracked as Daggerfly, and which is also monitored by the broader cybersecurity community as Bronze Highland and Evasive Panda. The campaign makes use of previously unseen plugins from the MgBot malware framework. The attackers were also seen using a PlugX loader and abusing the legitimate AnyDesk remote desktop software.
See the full report here: https://thehackernews.com/2023/04/daggerfly-cyberattack-campaign-hits.html
Capita confirms hackers stole data in recent cyberattack
London-based professional outsourcing giant Capita has published an update on the cyber-incident that impacted it at the start of the month, now admitting that hackers exfiltrated data from its systems. More specifically, the firm has found, with the help of security specialists, that hackers accessed roughly 4% of its server infrastructure and stole files hosted on the breached systems.The incident was significantly restricted, potentially affecting around 4% of Capita's server estate.
See the full report here: https://www.bleepingcomputer.com/news/security/capita-confirms-hackers-stole-data-in-recent-cyberattack/
Lazarus hackers now push Linux malware via fake job offers
A new Lazarus campaign considered part of "Operation DreamJob" has been discovered targeting Linux users with malware for the first time. This new targeting was discovered by cybersecurity researchers, who state with high confidence that Lazarus conducted the recent supply-chain attack on VoIP provider 3CX. The attack was discovered in March 2023, compromising multiple companies that used the trojanized version of the 3CX client with information-stealing trojans.
See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-now-push-linux-malware-via-fake-job-offers/
Attackers use abandoned WordPress plugin to backdoor websites
Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors. Eval PHP is an old WordPress plugin that allows site admins to embed PHP code on pages and posts of WordPress sites and then execute the code when the page is opened in the browser. The plugin has not been updated in the past decade and is generally considered abandonware, yet it is still available through the WordPress plugins repository.
See the full report here: https://www.bleepingcomputer.com/news/security/attackers-use-abandoned-wordpress-plugin-to-backdoor-websites/
Popular Fitness Apps Leak Location Data Even When Users Set Privacy Zones
Fitness apps such as Strava leak sensitive location information of users, even when they've used in-app features to specifically set up privacy zones to hide their activity within specified areas, researchers have found. Two PhD students from KU Leuven in Belgium have discovered that if a person is starting his or her activity from home, an attacker with limited skills can use high-precision API metadata revealed in the app to pinpoint their home location, even if they've set up what's called an endpoint privacy zone (EPZ) for that area.
See the full report here: https://www.darkreading.com/application-security/popular-fitness-apps-leak-location-data-even-when-users-set-privacy-zones
Killnet Boss Exposes Rival Leader in Kremlin Hacktivist Beef
Killmilk, the founder and de facto leader of the Killnet group announced on April 15 that he had to make a difficult decision and reveal the real-life identity of “Raty”, the head of Anonymous Russia, a group that initially conducted distributed denial of service (DDoS) attacks in Ukraine, and later joined several Killnet campaigns, becoming an associated group more tightly integrated with Killnet’s command structure. Killmilk shared what looks like a photo of a passport with some details blurred out. Killmilk then announced that he would appoint a new head for Anonymous Russia, a threat actor with the alias “Radis.”
See the full report here: https://www.darkreading.com/threat-intelligence/killnet-boss-rival-leader-kremlin-hacktivist-beef
Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution
A fresh round of patches has been made available for the vm2 JavaScript library to address two critical flaws that could be exploited to break out of sandbox protections and achieve code execution. Both the flaws – CVE-2023-29199 and CVE-2023-30547 – are rated 9.8 out of 10 on the CVSS scoring system and have been addressed in versions 3.9.16 and 3.9.17, respectively. Successful exploitation of the bugs, which allow an attacker to raise an unsanitized host exception, could be weaponized to escape the sandbox and run arbitrary code in the host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox, the maintainers of the vm2 library said in an alert.
See the full report here: https://thehackernews.com/2023/04/critical-flaws-in-vm2-javascript.html
Pakistani Hackers Use Linux Malware Poseidon to Target Indian Government Agencies
The Pakistan-based advanced persistent threat (APT) actor known as Transparent Tribe used a two-factor authentication (2FA) tool used by Indian government agencies as a ruse to deliver a new Linux backdoor called Poseidon. Poseidon is a second-stage payload malware associated with Transparent Tribe. It is a general-purpose backdoor that provides attackers with a wide range of capabilities to hijack an infected host. Its functionalities include logging keystrokes, taking screen captures, uploading and downloading files, and remotely administering the system in various ways."
See the full report here: https://thehackernews.com/2023/04/pakistani-hackers-use-linux-malware.html
Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered
The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems. The group is known for using a variety of sophisticated attack techniques, including custom malware, social engineering tactics, and spear-phishing attacks. Blind Eagle, also referred to as APT-C-36, is a suspected Spanish-speaking group that chiefly strikes private and public sector entities in Colombia. Attacks orchestrated by the group have also targeted Ecuador, Chile, and Spain.
See the full report here: https://thehackernews.com/2023/04/blind-eagle-cyber-espionage-group.html
Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine
Elite hackers associated with Russia's military intelligence service have been linked to large-volume phishing campaigns aimed at hundreds of users in Ukraine to extract intelligence and influence public discourse related to the war. The state-sponsored cyber actor, also tracked as APT28, Fancy Bear, Forest Blizzard, Iron Twilight, Sednit, and Sofacy, is both highly active and proficient. It has been active since at least 2009, targeting media, governments, and military entities for espionage.
See the full report here: https://thehackernews.com/2023/04/google-tag-warns-of-russian-hackers.html
Play ransomware gang uses custom Shadow Volume Copy data-theft tool
The Play ransomware group has developed two custom tools in .NET, namely Grixba and VSS Copying Tool, which it uses to improve the effectiveness of its cyberattacks. The two tools enable attackers to enumerate users and computers in compromised networks, gather information about security, backup, and remote administration software, and easily copy files from Volume Shadow Copy Service (VSS) to bypass locked files.
See the full report here: https://www.bleepingcomputer.com/news/security/play-ransomware-gang-uses-custom-shadow-volume-copy-data-theft-tool/
Google patches another actively exploited Chrome zero-day
Google has released a security update for the Chrome web browser to fix the second zero-day vulnerability found to be exploited in attacks this year. Google is aware that an exploit for CVE-2023-2136 exists in the wild. The new version is 112.0.5615.137 and fixes a total of eight vulnerabilities. The stable release is available only for Windows and Mac users, with the Linux version to roll out soon.
See the full report here: https://www.bleepingcomputer.com/news/security/google-patches-another-actively-exploited-chrome-zero-day/
Hackers actively exploit critical RCE bug in PaperCut servers
Print management software developer PaperCut is warning customers to update their software immediately, as hackers are actively exploiting flaws to gain access to vulnerable servers. PaperCut makes printing management software compatible with all major brands and platforms. It is used by large companies, state organizations, and education institutes, while the official website claims it serves hundreds of millions of people from over 100 countries.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
UK cyber-argency warns of a new ‘class’ of Russian hackers
The United Kingdom's NCSC (National Cyber Security Centre) is warning of a heightened risk from attacks by state-aligned Russian hacktivists, urging all organizations in the country to apply recommended security measures. Typically, those hacktivist groups focus their malicious cyber-activity on performing DDoS (distributed denial of service) attacks that cause service disruption on critical entities such as airports, parliament, and government sites. Hence, the British agency advises all organizations to implement some recommended actions to increase security and pay particular attention to secure system administration.
See the full report here: https://www.bleepingcomputer.com/news/security/uk-cyber-argency-warns-of-a-new-class-of-russian-hackers/
Ransomware gangs abuse Process Explorer driver to kill security software
Threat actors use a new hacking tool dubbed AuKill to disable Endpoint Detection & Response (EDR) Software on targets' systems before deploying backdoors and ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks. In such attacks, malicious actors drop legitimate drivers signed with a valid certificate and capable of running with kernel privileges on the victims' devices to disable security solutions and take over the system. This technique is popular among various threat actors, from state-backed hacking groups to financially-motivated ransomware gangs.
See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gangs-abuse-process-explorer-driver-to-kill-security-software/
Fortra shares findings on GoAnywhere MFT zero-day attacks
Fortra has completed its investigation into the exploitation of CVE-2023-0669, a zero-day flaw in the GoAnywhere MFT solution that the Clop ransomware gang exploited to steal data from over a hundred companies. The critical GoAnywhere remote code execution flaw became publicly known after Fortra notified customers on February 3rd, 2023. A working exploit was soon released on February 6th, 2023, increasing the likelihood other threat actors would exploit it. Fortra released the security update for the zero-day vulnerability a day later, urging all customers to install it.
See the full report here: https://www.bleepingcomputer.com/news/security/fortra-shares-findings-on-goanywhere-mft-zero-day-attacks/
Microsoft SQL servers hacked to deploy Trigona ransomware
Attackers are hacking into poorly secured and Interned-exposed Microsoft SQL (MS-SQL) servers to deploy Trigona ransomware payloads and encrypt all files. The MS-SQL servers are being breached via brute-force or dictionary attacks that take advantage of easy-to-guess account credentials. After connecting to a server, the threat actors deploy malware dubbed CLR Shell by security researchers from South Korea who spotted the attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-sql-servers-hacked-to-deploy-trigona-ransomware/
EU unveils USD 1.2 billion cyber plan to curb cross-border hacking attacks
The European Union unveiled a EUR 1.1-billion (USD 1.2 billion) plan to help stave off cross-border hacking attacks as the threat from Russia grows. Europe is looking to shore up its online defences as Moscow's war on Ukraine has raised fears that Russian hackers could target critical infrastructure.
See the full report here: https://www.hindustantimes.com/technology/eu-unveils-1-2-billion-cyber-plan-to-curb-cross-border-hacking-attacks-101681833885480.html
ChatGPT Account Take Over Vulnerability Let Hackers Gain User’s Online Account
A security analyst and bug hunter recently uncovered a critical security vulnerability in ChatGPT. With just a single click, a threat actor could easily exploit the vulnerability and gain complete control of any ChatGPT user’s account. As a result, opening the doors to sensitive data let attackers execute unauthorized actions; the whole is termed “Account Take Over.”
See the full report here: https://cybersecuritynews.com/chatgpt-account-take-over-vulnerability/
Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access
The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis has revealed the adversary's use of the SimpleHelp remote support software in June 2022.
See the full report here: https://thehackernews.com/2023/04/iranian-hackers-using-simplehelp-remote.html
YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader
Cybersecurity researchers have detailed the inner workings of a highly evasive loader named "in2al5d p3in4er" (read: invalid printer) that's used to deliver the Aurora information stealer malware. The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique.
See the full report here: https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html
New sandbox escape PoC exploit available for VM2 library, patch now
A security researcher has released yet another sandbox escape proof of concept (PoC) exploit that makes it possible to execute unsafe code on a host running the VM2 sandbox. VM2 is a specialized JavaScript sandbox used by a broad range of software tools for running and testing untrusted code in an isolated environment, preventing the code from accessing the host's system resources or external data.The library is commonly found in integrated development environments (IDEs), code editors, security tools, and various pen-testing frameworks. It counts several million downloads per month in the NPM package repository.
See the full report here: https://www.bleepingcomputer.com/news/security/new-sandbox-escape-poc-exploit-available-for-vm2-library-patch-now/
Microsoft: Iranian hackers behind retaliatory cyberattacks on US orgs
Microsoft has discovered that an Iranian hacking group known as "Mint Sandstorm" is conducting cyberattacks on US critical infrastructure in what is believed to be retaliation for recent attacks on Iran's infrastructure. Mint Sandstorm is the new name for the Phosphorous hacking group, believed to work for the Iranian government and linked to the Islamic Revolutionary Guard Corps (IRGC). A subgroup of Mint Sandstorm switched from performing surveillance in 2022 to performing direct attacks on US critical infrastructure.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-iranian-hackers-behind-retaliatory-cyberattacks-on-us-orgs/
US, UK warn of govt hackers using custom malware on Cisco routers
The US, UK, and Cisco are warning of Russian state-sponsored APT28 hackers deploying a custom malware named "Jaguar Tooth" on Cisco IOS routers, allowing unauthenticated access to the device. APT28, also known as Fancy Bear, STRONTIUM, Sednit, and Sofacy, is a state-sponsored hacking group linked to Russia's General Staff Main Intelligence Directorate (GRU). This hacking group has been attributed to a wide range of attacks on European and US interests and is known to abuse zero-day exploits to conduct cyber espionage.
See the full report here: https://www.bleepingcomputer.com/news/security/us-uk-warn-of-govt-hackers-using-custom-malware-on-cisco-routers/
Hackers publish sensitive employee data stolen during CommScope ransomware attack
Hackers published a trove of data stolen from U.S. network infrastructure giant CommScope, including thousands of employees’ Social Security numbers and bank account details. The North Carolina–based company, which designs and manufactures network infrastructure products for a range of customers, including hospitals, schools and U.S. federal agencies, was listed on the dark web leak site of the Vice Society ransomware gang.
See the full report here: https://techcrunch.com/2023/04/17/hackers-publish-sensitive-employee-data-stolen-during-commscope-ransomware-attack/
New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers
A novel credential-stealing malware called Zaraza bot is being offered for sale on Telegram while also using the popular messaging service as a command-and-control (C2). Zaraza bot targets a large number of web browsers and is being actively distributed on a Russian Telegram hacker channel popular with threat actors. Once the malware infects a victim's computer, it retrieves sensitive data and sends it to a Telegram server where the attackers can access it immediately.
See the full report here: https://thehackernews.com/2023/04/new-zaraza-bot-credential-stealer-sold.html
Vice Society Ransomware Using Stealthy PowerShell Tool for Data Exfiltration
Threat actors associated with the Vice Society ransomware gang have been observed using a bespoke PowerShell-based tool to fly under the radar and automate the process of exfiltrating data from compromised networks. Threat actors (TAs) using built-in data exfiltration methods like [living off the land binaries and scripts] negate the need to bring in external tools that might be flagged by security software and/or human-based security detection mechanisms. These methods can also hide within the general operating environment, providing subversion to the threat actor.
See the full report here: https://thehackernews.com/2023/04/vice-society-ransomware-using-stealthy.html
New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware
A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware. The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco. QBot (aka Qakbot or Pinkslipbot) is a banking trojan that's known to be active since at least 2007. Besides stealing passwords and cookies from web browsers, it doubles up as a backdoor to inject next-stage payloads such as Cobalt Strike or ransomware.
See the full report here: https://thehackernews.com/2023/04/new-qbot-banking-trojan-campaign.html
Israeli Spyware Vendor QuaDream to Shut Down Following Citizen Lab and Microsoft Expose
Israeli spyware vendor QuaDream is allegedly shutting down its operations in the coming days, less than a week after its hacking toolset was exposed by cybersecurity researchers. The company's board of directors are looking to sell off its intellectual property, the report further added.
See the full report here: https://thehackernews.com/2023/04/israeli-spyware-vendor-quadream-to-shut.html
New Chameleon Android malware mimics bank, govt, and crypto apps
A new Android trojan called "Chameleon" has been targeting users in Australia and Poland since the start of the year, mimicking the CoinSpot cryptocurrency exchange, an Australian government agency, and the IKO bank. The mobile malware was seen distributed through compromised websites, Discord attachments, and Bitbucket hosting services. Chameleon includes a wide range of malicious functionality, including stealing user credentials through overlay injections and keylogging, cookies, and SMS texts from the infected device.
See the full report here: https://www.bleepingcomputer.com/news/security/new-chameleon-android-malware-mimics-bank-govt-and-crypto-apps/
New QBot email attacks use PDF and WSF combo to install malware
QBot malware is now distributed in phishing campaigns utilizing PDFs and Windows Script Files (WSF) to infect Windows devices. Qbot (aka QakBot) is a former banking trojan that evolved into malware that provides initial access to corporate networks for other threat actors. This initial access is done by dropping additional payloads, such as Cobalt Strike, Brute Ratel, and other malware that allows other threat actors to access the compromised device.
See the full report here: https://www.bleepingcomputer.com/news/security/new-qbot-email-attacks-use-pdf-and-wsf-combo-to-install-malware/
Hackers abuse Google Command and Control red team tool in attacks
The Chinese state-sponsored hacking group APT41 was found abusing the GC2 (Google Command and Control) red teaming tool in data theft attacks against a Taiwanese media and an Italian job search company. APT 41, also known as HOODOO, is a Chinese state-sponsored hacking group known to target a wide range of industries in the USA, Asia, and Europe. Cybersecurity researchers have been tracking the hacking group since 2014, saying its activities overlap with other known Chinese hacking groups, such as BARIUM and Winnti.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/
Ex-Conti members and FIN7 devs team up to push new Domino malware
Ex-Conti ransomware members have teamed up with the FIN7 threat actors to distribute a new malware family named "Domino" in attacks on corporate networks. Domino is a relatively new malware family consisting of two components, a backdoor named "Domino Backdoor," which in turn drops a "Domino Loader" that injects an info-stealing malware DLL into the memory of another process. Cybersecurity researchers have been tracking ex-Conti and TrickBot members utilizing the new malware in attacks since February 2023.
See the full report here: https://www.bleepingcomputer.com/news/security/ex-conti-members-and-fin7-devs-team-up-to-push-new-domino-malware/
Human rights groups raise alarm over UN Cybercrime Treaty
United Nations negotiators convened this week in Vienna, Austria, to formulate a draft cybercrime treaty, and civil society groups are worried. The UN Cybercrime Treaty, to the extent it gets adopted, is expected to define global norms for lawful surveillance and legal processes available to investigate and prosecute cybercriminals.
See the full report here: https://www.theregister.com/2023/04/14/un_cybercrime_treaty/
Cybercrims hop geofences, clamor for stolen ChatGPT accounts
The market for stolen ChatGPT accounts, and especially Plus subscriptions, is on the rise as miscreants in countries blocked by OpenAI try to hop the chatbot's geofences. This uptick began in March 2023, who say they've noticed an increase in the chatter in underground forums related to leaking or selling compromised ChatGPT premium accounts. By premium accounts, they mean ChatGPT Plus: the subscription service that costs USD 20 per month and gives users access to new features and faster response times.
See the full report here: https://www.theregister.com/2023/04/15/cybercrims_hop_chatgpt_geofences/
Severe Android and Novi Survey Vulnerabilities Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The two flaws are: CVE-2023-20963 (CVSS score: 7.8) - Android Framework Privilege Escalation Vulnerability, CVE-2023-29492 (CVSS score: TBD) - Google, in its monthly Android Security Bulletin for March 2023, acknowledged there are indications that CVE-2023-20963 may be under limited, targeted exploitation.
See the full report here: https://thehackernews.com/2023/04/severe-android-and-novi-survey.html
Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability
Google has released an emergency Chrome security update to address the first zero-day vulnerability exploited in attacks since the start of 2023. The new version is rolling out to users in the Stable Desktop channel, and it will reach the entire user base over the coming days or weeks. Chrome users should upgrade to version 112.0.5615.121 as soon as possible, as it addresses the CVE-2023-2033 vulnerability on Windows, Mac, and Linux systems.
See the full report here: https://thehackernews.com/2023/04/google-releases-urgent-chrome-update-to.html
Russia accuses NATO of launching 5,000 cyberattacks since 2022
The Federal Security Service of the Russian Federation (FSB) has accused the United States and other NATO countries of launching over 5,000 cyberattacks against critical infrastructure in the country since the beginning of 2022. The agency says it has taken timely measures to prevent these attacks from causing any negative consequences to Russia. Furthermore, the FSB claims that these attacks originate from Ukrainian territories, which are used for masking the true origin and identity of the perpetrators. At the same time, the attacks also involve the deployment of "new types of cyber-weapons."
See the full report here: https://www.bleepingcomputer.com/news/security/russia-accuses-nato-of-launching-5-000-cyberattacks-since-2022/
Darktrace: Investigation found no evidence of LockBit breach
Cybersecurity firm Darktrace says it found no evidence that the LockBit ransomware gang breached its network after the group added an entry to their dark web leak platform, implying that they stole data from the company's systems. Hours after the gang claimed DarkTrace as a victim on their data leak site, the company conducted an investigation and found no evidence of a breach of their systems. Our security teams have run a full review of our internal systems and can see no evidence of compromise.
See the full report here: https://www.bleepingcomputer.com/news/security/darktrace-investigation-found-no-evidence-of-lockbit-breach/
Vice Society ransomware uses new PowerShell data theft tool in attacks
The Vice Society ransomware gang is deploying a new, rather sophisticated PowerShell script to automate data theft from compromised networks. Stealing corporate and customer data is a standard tactic in ransomware attacks for use as further leverage when extorting victims or reselling the data to other cybercriminals for maximum profit. Vice Society's new data exfiltrator is fully automated and uses "living off the land" binaries and scripts that are unlikely to trigger alarms from security software, keeping their activities stealthy before the final step of the ransomware attack, the encrypting of data.
See the full report here: https://www.bleepingcomputer.com/news/security/vice-society-ransomware-uses-new-powershell-data-theft-tool-in-attacks/
Android malware infiltrates 60 Google Play apps with 100M installs
A new Android malware named "Goldoson" has infiltrated Google Play through 60 legitimate apps that collectively have 100 million downloads. The malicious malware component is part of a third-party library used by all sixty apps that the developers unknowingly added to their apps.
See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-infiltrates-60-google-play-apps-with-100m-installs/
Hackers start abusing Action1 RMM in ransomware attacks
Security researchers are warning that cybercriminals are increasingly using the Action1 remote access software for persistence on compromised networks and to execute commands, scripts, and binaries. Action1 is a remote monitoring and management (RMM) product that is commonly used by managed service providers (MSPs) and the enterprise to remotely manage endpoints on a network. The software allows admins to automate patch management and the deploying of security updates, install software remotely, catalog hosts, troubleshoot problems on endpoints, and get real-time reports.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-start-abusing-action1-rmm-in-ransomware-attacks/
NCR suffers Aloha POS outage after BlackCat ransomware attack
NCR is suffering an outage on its Aloha point of sale platform after being hit by an ransomware attack claimed by the BlackCat/ALPHV gang. NCR is an American software and technology consulting company that provides digital banking, POS system, and payment processing solutions for restaurants, businesses, and retailers. One of their products, the Aloha POS platform used in hospitality services, has suffered an outage since, with customers unable to utilize the system. NCR has disclosed that the outage was caused by a ransomware attack on data centers used to power their Aloha POS platform.
See the full report here: https://www.bleepingcomputer.com/news/security/ncr-suffers-aloha-pos-outage-after-blackcat-ransomware-attack/
CISA warns of Android bug exploited by Chinese app to spy on users
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of a high-severity Android vulnerability believed to have been exploited by a Chinese e-commerce app Pinduoduo as a zero-day to spy on its users. This Android Framework security flaw (tracked as CVE-2023-20963) allows attackers to escalate privileges on unpatched Android devices without requiring user interaction.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-android-bug-exploited-by-chinese-app-to-spy-on-users/
LockBit ransomware encryptors found targeting Mac devices
The LockBit ransomware gang has created encryptors targeting Macs for the first time, likely becoming the first major ransomware operation to ever specifically target macOS. The new ransomware encryptors were discovered by a cybersecurity researcher who found a ZIP archive on VirusTotal that contained what appears to be most of the available LockBit encryptors.
See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-encryptors-found-targeting-mac-devices/
German Superyacht Maker Lürssen Hit by Ransomware Cyber Attack
German shipbuilder Lürssen, which makes military vessels as well as luxury yachts, has become the target of a ransomware cyberattack. The Bremen-based company was attacked over the Easter holiday period. The attack brought large parts of Lürssen’s shipyard operations to a standstill.
See the full report here: https://www.insurancejournal.com/news/international/2023/04/12/716262.htm
Legion: New hacktool steals credentials from misconfigured sites
A new Python-based credential harvester and SMTP hijacking tool named "Legion" is being sold on Telegram that targets online email services for phishing and spam attacks. Legion is sold by cybercriminals who use the “Forza Tools” moniker and operate a YouTube channel with tutorials and a Telegram channel with over a thousand members.
See the full report here: https://www.bleepingcomputer.com/news/security/legion-new-hacktool-steals-credentials-from-misconfigured-sites/
Russian hackers linked to widespread attacks targeting NATO and EU
Poland's Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29 state-sponsored hackers, part of the Russian government's Foreign Intelligence Service (SVR), to widespread attacks targeting NATO and European Union countries. As part of this campaign, the cyberespionage group (also tracked as Cozy Bear and Nobelium) aimed to harvest information from diplomatic entities and foreign ministries.
See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-linked-to-widespread-attacks-targeting-nato-and-eu/
Five arrested after 33,000 victims lose USD 98 million to online investment fraud
Europol and Eurojust announced the arrest of five individuals believed to be part of a massive online investment fraud ring with at least 33,000 victims who lost an estimated EUR 89 million (roughly USD 98 million). The coordinated action took place across two action days in March and involved the search of 15 locations (including five illegal call centers) across Bulgaria, Romania, and Israel.
See the full report here: https://www.bleepingcomputer.com/news/security/five-arrested-after-33-000-victims-lose-98m-to-online-investment-fraud/
Dutch Police mails RaidForums members to warn they’re being watched
The Dutch Police is sending emails to former RaidForums members, asking them to delete stolen data and stop illegal cyber activities and warning that they are not anonymous. RaidForums was a very popular and notorious hacking and data leak forum known for hosting, leaking, and selling stolen data obtained from breached organizations. Threat actors who frequented the forum would hack into websites or access exposed database servers to steal customer information.
See the full report here: https://www.bleepingcomputer.com/news/security/dutch-police-mails-raidforums-members-to-warn-theyre-being-watched/
Phishing attack targets accountants as Tax Day approaches
Microsoft is warning of a phishing campaign targeting accounting firms and tax preparers with remote access malware allowing initial access to corporate networks. With the USA reaching the end of its annual tax season, accountants are scrambling to gather clients' tax documents to complete and file their tax returns. Due to this, it makes it an ideal time for threat actors to target tax preparers, hoping that they mistakenly open malicious files that they would generally be more careful with when less busy.
See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-phishing-attack-targets-accountants-as-tax-day-approaches/
Alleged Pentagon classified documents leaker arrested
The FBI has detained a 21-year-old Air National Guardsman suspected of leaking a trove of classified Pentagon documents on Discord. The suspect was being held in connection with an investigation into alleged unauthorized removal, retention, and transmission of classified national defense information. The individual controlled a private Discord server, and allegedly posted photographs of the classified Pentagon documents to impress the private group's 25 members, which included netizens in Europe, Asia, and South America.
See the full report here: https://www.theregister.com/2023/04/13/alleged_pentagon_leaker_arrested/
RTM Locker: Emerging Cybercrime Group Targeting Businesses with Ransomware
Cybersecurity researchers have detailed the tactics of a rising cybercriminal gang called "Read The Manual" (RTM) Locker that functions as a private ransomware-as-a-service (RaaS) provider and carries out opportunistic attacks to generate illicit profit. The "Read The Manual" Locker gang uses affiliates to ransom victims, all of whom are forced to abide by the gang's strict rules.
See the full report here: https://thehackernews.com/2023/04/rtm-locker-emerging-cybercrime-group.html
New Python-Based "Legion" Hacking Tool Emerges on Telegram
An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation. Legion includes modules to enumerate vulnerable SMTP servers, conduct remote code execution (RCE) attacks, exploit unpatched versions of Apache, and brute-force cPanel and WebHost Manager (WHM) accounts. The malware is said to bear similarities to another malware family called AndroxGh0st that was first documented in December 2022.
See the full report here: https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html
Pakistan-based Transparent Tribe Hackers Targeting Indian Educational Institutions
The Transparent Tribe threat actor has been linked to a set of weaponized Microsoft Office documents in intrusions directed against the Indian education sector to deploy a continuously maintained piece of malware called Crimson RAT. While the suspected Pakistan-based threat group is known to target military and government entities in the country, the activities have since expanded to include the education sector.
See the full report here: https://thehackernews.com/2023/04/pakistan-based-transparent-tribe.html
Tags: tlp:clear, all industries, global