ZeroFox Weekly Threat Bulletin: 04/21/2023 - 04/27/2023

ZeroFox Daily Intelligence Briefs:

ZeroFox Daily Intelligence Brief - April 27, 2023

Key Findings

• U.S. Federal Agencies Express Concern Over the Method of Developing AI Systems
• Threat Actors Are Hacking into AT&T Emails to Steal Cryptocurrency
• Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks

Report: https://zerofox.com/advisories/20385

ZeroFox Daily Intelligence Brief - April 26, 2023

Key Findings

• Chinese Hackers Could Breach U.S. Government Networks Within Five Years
• Industrial Organization Exposed to Remote Attacks Through a Vulnerability Found in RTU
• New SLP Bug May Lead to Massive DDoS Amplification Attacks

Report: https://zerofox.com/advisories/20372

ZeroFox Daily Intelligence Brief - April 25, 2023

Key Findings

• Schneider Electric Warns of Critical Flaws in its APC UPS Software
• Black Basta Gang Leaks Personal Information from YellowPages Data
• Intel CPUs Vulnerable to New Transient Execution Side-channel Attack

Report: https://zerofox.com/advisories/20334

ZeroFox Daily Intelligence Brief - April 24, 2023

Key Findings

• American Bar Association Data Breached, Over 1.4 Million Members Alerted
• Conti Team is Distributing Bumblebee Malware Through Google Ads
• Decoy Dog Malware Toolkit Found After Analyzing 70 Billion DNS Queries

Report: https://zerofox.com/advisories/20305

ZeroFox Daily Intelligence Brief - April 21, 2023

Key Findings

• Daggerfly Cyberattack Campaign Targets African Telecom Services Providers
• “GhostToken,” a Security Vulnerability in Google’s Cloud Platform, Patched Before Being Exploited
• Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

Report: https://zerofox.com/advisories/20295

Breach Disclosures:

Breach Disclosure: Tanpool

Summary

An alleged data breach at Tanpool – a U.S.-based marketplace that connects drivers with empty seats to co-travellers looking for a ride or want to send Parcel – exposed 9,803 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20397

Breach Disclosure: 505K of random emails:passwords

Summary

A combolist breach package titled “505K of random emails:passwords" exposed 503,006 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20361

Breach Disclosure: 100,000 Fresh Email_Pass Combos

Summary

A combolist breach package titled “100,000 Fresh Email_Pass Combos" exposed 99,999 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20360

Breach Disclosure: 5748_Executives_Leak

Summary

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 5,012 email addresses and plain-text, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20359

Breach Disclosure: 247Hire

Summary

An alleged data breach at 247Hire – a U.S.-based recruiting solutions company – exposed 49,867 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20358

Breach Disclosure: Grass Pomegranate Community

Summary

An alleged data breach at Grass Pomegranate Community – a China-based adult discussion forum – exposed 3,282,690 email addresses, usernames and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20357

Breach Disclosure: Repuestos Fuentes

Summary

An alleged data breach at Repuestos Fuentes – a Spain-based spare parts seller for mobile phones, tablets, PC and consoles – exposed 262,842 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20356

Breach Disclosure: Oasis Games

Summary

An alleged data breach at Oasis Games – a China-based global multi-platform game publisher – exposed 469,486 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20355

Breach Disclosure: Ministry of Corporate Affairs

Summary

An alleged data breach at Ministry of Corporate Affairs – an India-based official government website – exposed 727,198 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20354

Breach Disclosure: Renting Authority

Summary

An alleged data breach at Renting Authority – a U.S.-based employment, rental verification, online rent payments service provider company – exposed 290,569 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20353

Breach Disclosure: Express Insurance

Summary

An alleged data breach at Express Insurance – an Ukraine-based insurance company – exposed 8,883 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20352

Breach Disclosure: Team Xecuter

Summary

An alleged data breach at Team Xecuter – an Israel-based hacking board (now defunct, seized by FBI) – exposed 284,877 email addresses, hashed password and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20351

Breach Disclosure: Forum Travesti

Summary

An alleged data breach at Forum Travesti – a Portugal-based recruiting solutions company – exposed 191,372 email addresses, hashed password and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20350

Breach Disclosure: Marktel

Summary

An alleged data breach at Marktel – a Spain-based consulting and business development service company – exposed 566,648 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20349

Breach Disclosure: Abandonia

Summary

An alleged data breach at Abandonia – a Sweden-based gaming site – exposed 918,712 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20348

Breach Disclosure: Advatix

Summary

An alleged data breach at Advatix – a U.S.-based supply chain company – exposed 15,541 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20347

Breach Disclosure: Tecwallet

Summary

An alleged data breach at Tecwallet – an online learning platform for IT Courses operating from United States – exposed 3,937 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20346

Breach Disclosure: Kari

Summary

An alleged data breach at Kari – a Russia-based shoes and fashion accessories brand – exposed 217,263 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20345

Breach Disclosure: SynchroBit

Summary

An alleged data breach at SynchroBit – an UK-based trading platform that particularly focus on blockchain ecosystems and technology. – exposed 33,017 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20344

Breach Disclosure: Interchim

Summary

An alleged data breach at Interchim – a France-based manufacturer and distributor of consumables and instruments for research industry – exposed 27,926 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20343

Breach Disclosure: Unigame

Summary

An alleged data breach at Unigame – developer and publisher of role playing games operating from United States – exposed 850,886 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20342

Breach Disclosure: Planet Calypso

Summary

An alleged data breach at Planet Calypso – a Sweden-based gaming website – exposed 62,283 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20341

Breach Disclosure: Cheerleading

Summary

An alleged data breach at Cheerleading – a U.S.-based cheerleading apparel and accessories retail store – exposed 52,294 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20340

Breach Disclosure: UFC Fight Club

Summary

An alleged data breach at UFC Fight Club – a U.S.-based mixed martial arts (MMA) event organization and promotion company – exposed 239,269 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20339

Breach Disclosure: BizOpp_optins

Summary

US BizOpp Optins-2019 – A combolist package – exposed 52,140,918 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20338

Breach Disclosure: Ministry of Corporate Affairs Data Breach

Summary

An alleged data breach at Ministry of Corporate Affairs Data Breach – an India-based official government website – exposed 727,198 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20337

Breach Disclosure: Parkbench

Summary

Parkbench, a Canada-based sales & marketing platform, in which 233,150 email addresses were leaked, which were subsequently shared on several deep web sources.

Report: https://zerofox.com/advisories/20336

Breach Disclosure: Club Penguin Online

Summary

An alleged data breach at Club Penguin Online – a U.S.-based online gaming website – exposed 1,688,491 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20335

Breach Disclosure: UniverseGamers Gunz

Summary

An alleged data breach at UniverseGamers Gunz – a Brazil-based gaming platform – exposed 955,350 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20326

Breach Disclosure: 430K_USA Combolist

Summary

A combolist breach package titled “430K_USA Combolist" exposed 433,640 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20325

Breach Disclosure: 1.5 Milion Gmail Combolist

Summary

A combolist breach package titled “1.5 Milion Gmail Combolist" exposed 1,598,627 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20324

Breach Disclosure: Combo_2G Combolist

Summary

A combolist breach package titled “Combo_2G Combolist" exposed 143,363,248 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20323

Breach Disclosure: Netherlands combo

Summary

A combolist breach package titled “Netherlands combo" exposed 13,607 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20322

Breach Disclosure: 400K_USA_Stock_Leads

Summary

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 140,644 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20321

Breach Disclosure: France_b2b

Summary

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 147,489 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20320

Breach Disclosure: 745k Florida

Summary

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 625,259 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20319

Breach Disclosure: Shaye

Summary

An alleged data breach at Shaye – an India-based online clothing store – exposed 35,635 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20318

Breach Disclosure: Lucas Forums

Summary

An alleged data breach at Lucas Forums – a U.S.-based Star Wars discussion forum (now defunct) – exposed 154,465 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20317

Breach Disclosure: Eskimi

Summary

An alleged data breach at Eskimi – a Lithuania-based advertising company – exposed 1,197,600 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20316

Breach Disclosure: Farmadelivery

Summary

An alleged data breach at Farmadelivery – a Brazil-based online pharmacy delivery website – exposed 1,152,192 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20315

Breach Disclosure: Cryptobox

Summary

An alleged data breach at Cryptobox – an onion site that allows selling and buying information – exposed 2,249 email addresses, hashed passwords, and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20314

Breach Disclosure: Joygames

Summary

An alleged data breach at Joygames – a U.S.-based gaming and discussion platform – exposed 4,493,117 email addresses, hashed password and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20313

Breach Disclosure: Woman & Home

Summary

An alleged data breach at Woman & Home – a United Kingdom-based lifestyle magazine – exposed 46,096 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20312

Breach Disclosure: Mandarin

Summary

An alleged data breach at Mandarin – a Russia-based payment platform – exposed 16,302 email addresses, usernames and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20311

Breach Disclosure: Stalker Online

Summary

An alleged data breach at Stalker Online – a U.S.-based gaming site – exposed 1,420,192 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20310

Breach Disclosure: Star Sonata

Summary

An alleged data breach at Star Sonata – a U.S.-based space-themed massive multiplayer online role-playing game – exposed 25,599 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20309

Breach Disclosure: New Celebrity Nudes

Summary

An alleged data breach at New Celebrity Nudes – a U.S.-based adult entertainment site – exposed 10,233 email addresses, usernames and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20308

Breach Disclosure: Lead Kahuna

Summary

An alleged data breach at Lead Kahuna – a U.S.-based company that provides software solution for marketing systems – exposed 223,036 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20293

Breach Disclosure: Almazan Kitchen

Summary

An alleged data breach at Almazan Kitchen – a Serbia-based website that sells kitchen products and share recipes – exposed 14,417 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20292

Breaking News:

Israel: hackers leak thousands of personal details as Netanyahu’s Facebook account targeted

The Facebook account of Israeli Prime Minister was hacked into, and the identities and names of tens of thousands of Israelis were leaked, following another cyber-attack targeting the country's Atid group. The cyber-attack came as Israel celebrates its Independence Day. The hackers known as Sharpboys published information claiming it was stolen from the servers of the Israeli Atid group. The group published a file containing 200,000 records, including names, identity cards, addresses and other personal documents.

See the full report here: https://www.middleeastmonitor.com/20230427-israel-hackers-leak-thousands-of-personal-details-as-netanyahus-facebook-account-targeted/

Hackers steal emails, private messages from hookup websites

Hackers have stolen email addresses, direct messages, and other personal data from users of two dating websites, according to a data breach expert. The stolen data was found to contain usernames, email addresses, passwords, profile pictures, sexual orientation, users’ date of birth, their city and state, their IP addresses, and biographies. The stolen passwords are scrambled with a weak algorithm that could potentially be broken and allow hackers to see the actual passwords.

See the full report here: https://techcrunch.com/2023/04/27/hackers-steal-emails-private-messages-from-hookup-websites/

Hackers Take Control of Government-Owned Satellite in Alarming Experiment

A team of researchers proved they could hack into a European Space Agency-owned satellite, allowing them to take full control of its communication, imaging—and even its maneuverability systems. The intrusion was a controlled hack as part of ESA’s ongoing CYSAT conference. A cybersecurity team took up ESA’s Hack CYSAT challenge and found a way to seize control of an OPS-SAT nanosatellite originally sent up into low Earth orbit back in 2019. The intrusion allowed the hackers access to the satellite’s global positioning system, attitude control system, and even its onboard camera.

See the full report here: https://gizmodo.com/hackers-control-government-owned-satellite-test-esa-1850383452

Microsoft: Clop and LockBit ransomware behind PaperCut server hacks

Clop and LockBit ransomware attacked PaperCut servers through the abuse of CVE-2023-27350 and high CVE-2023-27351 vulnerabilities, impacting all PaperCut MF or NG versions 8.0+ and 15.0+, respectively, on all OS platforms. Papercut urged admins to upgrade servers immediately as exploits are actively exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-clop-and-lockbit-ransomware-behind-papercut-server-hacks/

Paperbug Attack: New Politically-Motivated Surveillance Campaign in Tajikistan

A little-known Russian-speaking cyber-espionage group has been linked to a new politically-motivated surveillance campaign targeting high-ranking government officials, telecom services, and public service infrastructures in Tajikistan. The intrusion set, dubbed Paperbug by Swiss cybersecurity researchers, has been attributed to a threat actor known as Nomadic Octopus (aka DustSquad). The ultimate motive behind the attacks is unclear at this stage, but researchers have raised the possibility that it could be the work of opposition forces within the country or, alternatively, an intelligence-gathering mission carried out by Russia or China.

See the full report here: https://thehackernews.com/2023/04/paperbug-attack-new-politically.html

Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers

Google said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth. CryptBot is estimated to have infected over 670,000 computers in 2022 with the goal of stealing sensitive data such as authentication credentials, social media account logins, and cryptocurrency wallets from users of Google Chrome. The harvested data is then exfiltrated to the threat actors, who then sell the data to other attackers for use in data breach campaigns.

See the full report here: https://thehackernews.com/2023/04/google-gets-court-order-to-take-down.html

New Atomic macOS info-stealing malware targets 50 crypto wallets

A new macOS information-stealing malware named "Atomic" (aka AMOS) is being sold to cybercriminals via private Telegram channels for a subscription of USD 1,000 per month. For this hefty price, buyers get a DMG file containing a 64-bit Go-based malware designed to target macOS systems and steel keychain passwords, files from the local filesystem, passwords, cookies, and credit cards stored in browsers. The malware also attempts to steal data from over 50 cryptocurrency extensions, which have become a popular target for information-stealing malware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-atomic-macos-info-stealing-malware-targets-50-crypto-wallets/

Linux version of RTM Locker ransomware targets VMware ESXi servers

RTM Locker is the latest enterprise-targeting ransomware operation found to be deploying a Linux encryptor that targets virtual machines on VMware ESXi servers. The RTM (Read The Manual) cybercrime gang has been active in financial fraud since at least 2015, known for distributing a custom banking trojan used to steal money from victims. Cybersecurity researchers reported that RTM Locker had launched a new Ransomware-as-a-Service (Raas) operation and had begun to recruit affiliates, including those from the former Conti cybercrime syndicate.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-version-of-rtm-locker-ransomware-targets-vmware-esxi-servers/

Google banned 173,000 developer accounts to block malware, fraud rings

Google says it banned 173,000 developer accounts in 2022 to block malware operations and fraud rings from infecting Android users' devices with malicious apps. The company revealed in its "bad apps" yearly report that it also prevented almost 1.5 million apps linked to various policy violations from reaching the Google Play Store.

See the full report here: https://www.bleepingcomputer.com/news/google/google-banned-173k-developer-accounts-to-block-malware-fraud-rings/

Android Minecraft clones with 35 million downloads infect users with adware

A set of 38 Minecraft copycat games on Google Play infected devices with the Android adware "HiddenAds" to stealthily load ads in the background to generate revenue for its operators. The Minecraft-like games hiding adware were downloaded by roughly 35 million Android users worldwide, mainly from the United States, Canada, South Korea, and Brazil.

See the full report here: https://www.bleepingcomputer.com/news/security/android-minecraft-clones-with-35m-downloads-infect-users-with-adware/

Advanced Cars May Face Greater Risk Of Hacking, Cybersecurity Experts Warn

Experts at recent auto technology conferences as well as several industry reports paint disturbing pictures of how a severe shortage of skilled software engineers, inadequate planning and testing by automakers before vehicles go into production, unintended entry points such as Bluetooth links and a lack of software standards all contribute towards exploits in automobiles.

See the full report here: https://www.forbes.com/sites/edgarsten/2023/04/26/cybersecurity-vulnerability-in-vehicles-is-escalating-as-software-engineer-shortage-grows/?sh=787247528ab2

Hackers are breaking into AT&T email accounts to steal cryptocurrency

Unknown hackers are breaking into the accounts of people who have AT&T email addresses, and using that access to then hack into the victim’s cryptocurrency exchange’s accounts and steal their crypto. Cybercriminals reportedly found a way to hack into the email addresses of anyone who has an att.net, sbcglobal.net, bellsouth.net and other AT&T email addresses. The hackers are supposedly able to do that because they have access to a part of AT&T’s internal network, which allows them to create mail keys for any user.

See the full report here: https://techcrunch.com/2023/04/26/hackers-are-breaking-into-att-email-accounts-to-steal-cryptocurrency/

Students’ psychological reports, abuse allegations leaked by ransomware hackers

Hackers who broke into the Minneapolis Public Schools earlier have circulated an enormous cache of files that appear to include highly sensitive documents on schoolchildren and teachers, including allegations of teacher abuse and students’ psychological reports. The files appeared online in March 2023 after the school district announced that it had been the victim of a ransomware cyberattack. Some were printed on school letterheads. Many were listed in folder sets named after Minneapolis schools.

See the full report here: https://www.nbcnews.com/tech/security/students-psychological-reports-abuse-allegations-leaked-ransomware-hac-rcna79414

Cyberattack on US railroad company compromises critical infrastructure

Cybercriminals have attacked Alaska Railroad Corporation (ARRC), stealing sensitive information about its vendors and employees. The notice to affected clients on April 17 2023 stated that “a third party gained unauthorized access” to the ARRC’s internal network systems. ARRC is owned by the State of Alaska and is a Class II railroad operating freight and passenger trains in the state. Transportation systems are considered critical infrastructure in the US, meaning that protecting them is a national security priority.

See the full report here: https://cybernews.com/news/cyberattack-us-railroad-critical-infrastructure/

Ukrainian arrested for selling data of 300 million people to Russians

The Ukrainian cyber police have arrested a 36-year-old man from the city of Netishyn for selling the personal data and sensitive information of over 300 million people, citizens of Ukraine, and various European countries. The seller was using Telegram to promote the stolen data to interested buyers, asking between USD 500 and USD 2,000 depending on the amount of data and its value. In particular, the attacker had information on passport data, taxpayer numbers, birth certificates, driver's licenses, and bank account data.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-arrested-for-selling-data-of-300m-people-to-russians/

PrestaShop fixes bug that lets any backend user delete databases

The open-source e-commerce platform PrestaShop has released a new version that addresses a critical-severity vulnerability allowing any back-office user to write, update, or delete SQL databases regardless of their permissions.

See the full report here: https://www.bleepingcomputer.com/news/security/prestashop-fixes-bug-that-lets-any-backend-user-delete-databases/

Cisco discloses XSS zero-day flaw in server management tool

Cisco disclosed today a zero-day vulnerability in the company's Prime Collaboration Deployment (PCD) software that can be exploited for cross-site scripting attacks. This server management utility enables admins to perform migration or upgrade tasks on servers in their organization's inventory. Tracked as CVE-2023-20060, the bug was found in the web-based management interface of Cisco PCD 14 and earlier by researchers at the NATO Cyber Security Centre (NCSC).

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-discloses-xss-zero-day-flaw-in-server-management-tool/

Chinese hackers use new Linux malware variants for espionage

Hackers are deploying new Linux malware variants in cyberespionage attacks, such as a new PingPull variant and a previously undocumented backdoor tracked as "Sword2033." PingPull is a RAT (remote access trojan) observed in espionage attacks conducted by the Chinese state-sponsored group Gallium, also known as Alloy Taurus. The attacks targeted government and financial organizations in Australia, Russia, Belgium, Malaysia, Vietnam, and the Philippines. Researchers continued to monitor these espionage campaigns reports that the Chinese threat actor uses new malware variants against targets in South Africa and Nepal.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-new-linux-malware-variants-for-espionage/

Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks

The prolific Iranian nation-state group known as Charming Kitten is actively targeting multiple victims in the U.S., Europe, the Middle East, and India with a novel malware dubbed BellaCiao, adding to its ever-expanding list of custom tools. BellaCiao is a "personalized dropper" that's capable of delivering other malware payloads onto a victim machine based on commands received from an actor-controlled server.

See the full report here: https://thehackernews.com/2023/04/charming-kittens-new-bellaciao-malware.html

Chinese Hackers Using MgBot Malware to Target International NGOs in Mainland China

The advanced persistent threat (APT) group referred to as Evasive Panda has been observed targeting an international non-governmental organization (NGO) in Mainland China with malware delivered via update channels of legitimate applications like Tencent QQ. The attack chains are designed to distribute a Windows installer for MgBot malware. The activity commenced in November 2020 and continued throughout 2021.

See the full report here: https://thehackernews.com/2023/04/chinese-hackers-using-mgbot-malware-to.html

US National Cyber Director: Fending off cyber threats in space is "urgent"

Defending space systems against cyberthreats remains "urgent and requires high-level attention," according to the acting US National Cyber Director, who also announced that the White House would host its first space industry cybersecurity workshop in southern California. The Director referenced Russia's attempt to jam SpaceX's Starlink, which was using its satellite constellation to deliver internet connectivity to Ukraine.

See the full report here: https://www.theregister.com/2023/04/26/kemba_walden_cybersecurity_space/

Chinese hackers will "probably" breach protected government networks within 5 years, leaked document says

China’s government is testing capabilities to get around a cybersecurity model that the federal government has embraced and that testing, combined with “advanced infiltration techniques,” will “probably” allow Chinese access to some government networks protected by the model within the next five years, according to a leaked classified document that hasn’t previously been reported. Both the Defense Department and the White House have made the “zero trust” model a cybersecurity priority.

See the full report here: https://www.washingtonpost.com/politics/2023/04/24/chinese-hackers-will-probably-breach-protected-government-networks-within-5-years-leaked-document-says/

A developer exploited an API flaw to provide free access to GPT-4

A developer is attempting to reverse-engineer APIs to grant anyone free access to popular AI models like OpenAI’s GPT-4. The developer’s project, GPT4Free, blew up on GitHub after links to it from Reddit went viral. At present, GPT4Free provides — or at least appears to provide — free and nearly unlimited access to GPT-4, as well as GPT-3.5, GPT-4’s predecessor.

See the full report here: https://techcrunch.com/2023/04/25/a-developer-exploited-an-api-flaw-to-provide-free-access-to-gpt-4/

Industrial orgs at risk from critical Inea RTU vulnerability

Industrial organizations could be subjected to remote attacks exploiting a critical OS command injection vulnerability in Inea remote terminal units, which has since been patched as part of a firmware update. Threat actors could leverage the flaw, tracked as CVE-2023-2131, impacting Inea ME RTUs with firmware versions prior to 3.36 to facilitate remote code execution, according to an advisory from the Cybersecurity and Infrastructure Security Agency.

See the full report here: https://www.scmagazine.com/brief/critical-infrastructure/industrial-orgs-at-risk-from-critical-inea-rtu-vulnerability

US to focus on stifling online attacks rather than snagging criminal convictions

US prosecutors are going to focus more on disrupting online attacks, even if it means losing out on a criminal conviction, according to the US Deputy Attorney General. At a keynote at the RSA Conference, the Deputy Attorney General instructed prosecutors and investigators to disrupt any active attack first to minimize further harm, and worry about trying to get a criminal prosecution later.

See the full report here: https://www.theregister.com/2023/04/25/us_rsa_government_hacking/

Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware

A financially-motivated North Korean threat actor is suspected to be behind a new Apple macOS malware strain called RustBucket. RustBucket communicates with command and control (C2) servers to download and execute various payloads. The Apple device management company attributed it to a threat actor known as BlueNoroff, a subgroup within the infamous Lazarus cluster that's also tracked under the monikers APT28, Nickel Gladstone, Sapphire Sleet, Stardust Chollima, and TA444.

See the full report here: https://thehackernews.com/2023/04/lazarus-subgroup-targeting-apple.html

Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor

An Iranian nation-state threat actor has been linked to a new wave of phishing attacks targeting Israel that's designed to deploy an updated version of a backdoor called PowerLess. Cybersecurity researchers are tracking the activity cluster under its mythical creature handle Educated Manticore, which exhibits "strong overlaps" with a hacking crew known as APT35, Charming Kitten, Cobalt Illusion, ITG18, Mint Sandstorm (formerly Phosphorus), TA453, and Yellow Garuda

See the full report here: https://thehackernews.com/2023/04/iranian-hackers-launch-sophisticated.html

TP-Link Archer WiFi router flaw exploited by Mirai malware

The Mirai malware botnet is actively exploiting a TP-Link Archer A21 (AX1800) WiFi router vulnerability tracked as CVE-2023-1389 to incorporate devices into DDoS (distributed denial of service) swarms.Researchers first abused the flaw during the Pwn2Own Toronto hacking event in December 2022, where two separate hacking teams breached the device using different pathways (LAN and WAN interface access). The flaw was disclosed to TP-Link in January 2023, with TP-Link releasing a fix last month in a new firmware update.

See the full report here: https://www.bleepingcomputer.com/news/security/tp-link-archer-wifi-router-flaw-exploited-by-mirai-malware/

New SLP bug can lead to massive 2,200x DDoS amplification attacks

A new reflective Denial-of-Service (DoS) amplification vulnerability in the Service Location Protocol (SLP) allows threat actors to launch massive denial-of-service attacks with 2,200X amplification. This flaw, tracked as CVE-2023-29552, was discovered by researchers, who say that over 2,000 organizations are using devices that expose roughly 54,000 exploitable SLP instances for use in DDoS amplification attacks. Vulnerable services include VMWare ESXi Hypervisors, Konica Minolta printers, IBM Integrated Management Modules, and Planex Routers deployed by unsuspecting organizations worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/new-slp-bug-can-lead-to-massive-2-200x-ddos-amplification-attacks/

VMware fixes critical zero-day exploit chain used at Pwn2Own

VMware has released security updates to address zero-day vulnerabilities that could be chained to gain code execution systems running unpatched versions of the company's Workstation and Fusion software hypervisors. The two flaws were part of an exploit chain demonstrated by security researchers, during the second day of the Pwn2Own Vancouver 2023 hacking contest. Vendors have 90 days to patch the zero-day bugs exploited and disclosed during Pwn2Own before Trend Micro's Zero Day Initiative releases technical details.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-zero-day-exploit-chain-used-at-pwn2own/

Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering

The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings reveal. Tomiris's endgame consistently appears to be the regular theft of internal documents. The threat actor targets government and diplomatic entities in the CIS. The Russian cybersecurity researcher assessment is based on three new attack campaigns mounted by the hacking crew between 2021 and 2023.

See the full report here: https://thehackernews.com/2023/04/russian-hackers-tomiris-targeting.html

Shields Health Breach Exposes 2.3M Users' Data

An unauthorized actor gained access to the systems of Shields Health Care Group (SHCG) in March, exposing driver's license numbers as well as other identification information for more than 2.3 million patients, according to the company.

See the full report here: https://www.darkreading.com/attacks-breaches/shields-health-breach-exposes-2-3m-users-data

Yellow Pages Canada confirms cyber attack as Black Basta leaks data

Yellow Pages Group, a Canadian directory publisher has confirmed that it has been hit by a cyber attack. Black Basta ransomware and extortion gang claims responsibility for the attack and has posted sensitive documents and data on the internet.

See the full report here: https://www.bleepingcomputer.com/news/security/yellow-pages-canada-confirms-cyber-attack-as-black-basta-leaks-data/

APC warns of critical unauthenticated RCE flaws in UPS software

APC's Easy UPS Online Monitoring Software is vulnerable to unauthenticated arbitrary remote code execution, allowing hackers to take over devices and, in a worst-case scenario, disabling its functionality altogether.

See the full report here: https://www.bleepingcomputer.com/news/security/apc-warns-of-critical-unauthenticated-rce-flaws-in-ups-software/

KuCoin's Twitter account hacked to promote crypto scam

KuCoin's Twitter account was hacked, allowing attackers to promote a fake giveaway scam that led to the theft of over USD 22.6K in cryptocurrency. The cryptocurrency exchange and trading platform has promised to fully reimburse victims for all verified losses caused by the hack of its official Twitter handle. Furthermore, it assures that all users' assets on the platform remain entirely secure.

See the full report here: https://www.bleepingcomputer.com/news/security/kucoins-twitter-account-hacked-to-promote-crypto-scam/

Ransomware Hackers Using AuKill Tool to Disable EDR Software Using BYOVD Attack

Threat actors are employing a previously undocumented "defense evasion tool" dubbed AuKill that's designed to disable endpoint detection and response (EDR) software by means of a Bring Your Own Vulnerable Driver (BYOVD) attack. The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.

See the full report here: https://thehackernews.com/2023/04/ransomware-hackers-using-aukill-tool-to.html

Intel CPUs vulnerable to new transient execution side-channel attack

A new side-channel attack impacting multiple generations of Intel CPUs has been discovered, allowing data to be leaked through the EFLAGS register. The new attack was discovered by researchers at Tsinghua University, the University of Maryland, and a computer lab (BUPT) run by the Chinese Ministry of Education and is different than most other side-channel attacks. Instead of relying on the cache system like many other side-channel attacks, this new attack leverages a flaw in transient execution that makes it possible to extract secret data from user memory space through timing analysis.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-cpus-vulnerable-to-new-transient-execution-side-channel-attack/

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. These include CVE-2023-28432, a MinIO information disclosure vulnerability, CVE-2023-27350, an improper access control vulnerability affecting PaperCut MF/NG, and CVE-2023-2136, a Skia integer overflow vulnerability in Google Chrome. Federal Civilian Executive Branch (FCEB) agencies in the U.S. are recommended to remediate identified vulnerabilities by May 12, 2023, to secure their networks against active threats.

See the full report here: https://thehackernews.com/2023/04/cisa-adds-3-actively-exploited-flaws-to.html

N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX

The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. The Matryoshka doll-style cascading attack against 3CX first came to light on March 29, 2023, when it emerged that Windows and macOS versions of its communication software were trojanized to deliver a C/C++-based data miner named ICONIC Stealer.

See the full report here: https://thehackernews.com/2023/04/nk-hackers-employ-matryoshka-doll-style.html

Decoy Dog malware toolkit found after analyzing 70 billion DNS queries

A new enterprise-targeting malware toolkit called "Decoy Dog" has been discovered after inspecting anomalous DNS traffic that is distinctive from regular internet activity. Decoy Dog helps threat actors evade standard detection methods through strategic domain aging and DNS query dribbling, aiming to establish a good reputation with security vendors before switching to facilitating cybercrime operations. Researchers discovered the toolkit in early April 2023 as part of its analysis of over 70 billion DNS records daily to look for signs of abnormal or suspicious activity.

See the full report here: https://www.bleepingcomputer.com/news/security/decoy-dog-malware-toolkit-found-after-analyzing-70-billion-dns-queries/

Google ads push BumbleBee malware used by ransomware gangs

The enterprise-targeting Bumblebee malware is distributed through Google Ads and SEO poisoning that promote popular software like Zoom, Cisco AnyConnect, ChatGPT, and Citrix Workspace. Bumblebee is a malware loader discovered in April 2022, thought to have been developed by the Conti team as a replacement for the BazarLoader backdoor, used for gaining initial access to networks and conducting ransomware attacks. In September 2022, a new version of the malware loader was observed in the wild, featuring a stealthier attack chain that used the PowerSploit framework for reflective DLL injection into memory.

See the full report here: https://www.bleepingcomputer.com/news/security/google-ads-push-bumblebee-malware-used-by-ransomware-gangs/

Hackers can breach networks using data on resold corporate routers

Enterprise-level network equipment on the secondary market hide sensitive data that hackers could use to breach corporate environments or to obtain customer information. Looking at several used corporate-grade routers, researchers found that most of them had been improperly wiped during the decommissioning process and then sold online.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-breach-networks-using-data-on-resold-corporate-routers/

EvilExtractor malware activity spikes in Europe and the U.S.

Researchers are seeing a rise in attacks spreading the EvilExtractor data theft tool, used to steal users' sensitive data in Europe and the U.S. EvilExtractor is sold by a company named Kodex for USD 59/month, featuring seven attack modules, including ransomware, credential extraction, and Windows Defender bypassing.

See the full report here: https://www.bleepingcomputer.com/news/security/evilextractor-malware-activity-spikes-in-europe-and-the-us/

Kubernetes RBAC abused to create persistent cluster backdoors

Hackers use a novel method involving RBAC (Role-Based Access Control) to create persistent backdoor accounts on Kubernetes clusters and hijack their resources for Monero crypto-mining. RBAC is a Kubernetes API access control system allowing admins to define which users or service accounts can access API resources and operations. By abusing RBAC to enforce malicious access control policies, threat actors can persist on compromised clusters even if the misconfiguration that provided initial access is fixed in the future.

See the full report here: https://www.bleepingcomputer.com/news/security/kubernetes-rbac-abused-to-create-persistent-cluster-backdoors/

American Bar Association data breach hits 1.4 million members

The American Bar Association (ABA) has suffered a data breach after hackers compromised its network and gained access to older credentials for 1,466,000 members. The ABA is the largest association of lawyers and legal professionals globally, with 166,000 members as of 2022. The ABA began notifying members that a hacker was detected on its network on March 17th, 2023, and may have gained access to members' login credentials for a legacy member system decommissioned in 2018.

See the full report here: https://www.bleepingcomputer.com/news/security/american-bar-association-data-breach-hits-14-million-members/

University websites using MediaWiki, TWiki hacked to serve Fortnite spam

Websites of multiple U.S. universities are serving Fortnite and gift card spam. Researchers observed Wiki and documentation pages being hosted by universities including Stanford, MIT, Berkeley, UMass Amherst, Northeastern, Caltech, among others, were compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/university-websites-using-mediawiki-twiki-hacked-to-serve-fortnite-spam/

Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers. The vulnerabilities potentially allowed unauthorized access to Alibaba Cloud customers' PostgreSQL databases and the ability to perform a supply chain attack on both Alibaba database services. The issues, dubbed BrokenSesame, were reported to Alibaba Cloud in December 2022, following mitigations were deployed by the company on April 12, 2023. There is no evidence to suggest that the weaknesses were exploited in the wild.

See the full report here: https://thehackernews.com/2023/04/two-critical-flaws-found-in-alibaba.html

GhostToken Opens Google Accounts to Permanent Infection

A security vulnerability in Google's Cloud Platform (GCP) could have allowed cyberattackers to hide an unremovable, malicious application inside a victim's Google account, dooming the account to a state of permanent, undetectable infection. The bug, dubbed "GhostToken," was discovered on April 20 2023, the malicious app could have paved the way for a startling array of unauthorized activity, including reading the victim's Gmail account, accessing files in Google Drive and Google Photos, viewing the Google calendar, and tracking locations via Google Maps.

See the full report here: https://www.darkreading.com/remote-workforce/-ghosttoken-opens-google-accounts-to-permanent-infection

Europe’s Air-Traffic Agency Under Attack From Pro-Russian Hackers

Europe’s air-traffic control agency stated that it was under attack from pro-Russian hackers amid fears that Moscow could interfere with the region’s critical infrastructure as its confrontation with the West escalates. The cyberattack on the agency’s website started on April 19, a spokeswoman for the European Organisation for the Safety of Air Navigation, also known as Eurocontrol, said, adding that it wasn’t affecting the agency’s air-traffic control activities.

See the full report here: https://www.wsj.com/amp/articles/europes-air-traffic-agency-under-attack-from-pro-russian-hackers-54b4514d

Hackers Using Old Nokia 3310 Phone to Start Car Without Key

Recent car thefts have involved technology concealed inside outdated Nokia phones and Bluetooth speakers. This brand-new type of car theft is becoming more prevalent in the US. Criminals use tiny gadgets to interface with the car’s control system, sometimes hidden within innocent-looking Bluetooth speakers or cell phones. This makes it possible for thieves with little technological expertise to steal cars without a key, sometimes in as little as 15 seconds.

See the full report here: https://cybersecuritynews.com/hackers-using-old-nokia-3310-phone-to-steal-cars/

NSO Group Used 3 Zero-Click iPhone Exploits Against Human Rights Defenders

Israeli spyware maker NSO Group deployed at least three novel "zero-click" exploits against iPhones in 2022 to infiltrate defenses erected by Apple and deploy Pegasus. NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world.

See the full report here: https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html

Daggerfly Cyberattack Campaign Hits African Telecom Services Providers

Telecommunication services providers in Africa are the target of a new campaign orchestrated by a China-linked threat actor at least since November 2022. The intrusions have been pinned on a hacking crew tracked as Daggerfly, and which is also monitored by the broader cybersecurity community as Bronze Highland and Evasive Panda. The campaign makes use of previously unseen plugins from the MgBot malware framework. The attackers were also seen using a PlugX loader and abusing the legitimate AnyDesk remote desktop software.

See the full report here: https://thehackernews.com/2023/04/daggerfly-cyberattack-campaign-hits.html

Capita confirms hackers stole data in recent cyberattack

London-based professional outsourcing giant Capita has published an update on the cyber-incident that impacted it at the start of the month, now admitting that hackers exfiltrated data from its systems. More specifically, the firm has found, with the help of security specialists, that hackers accessed roughly 4% of its server infrastructure and stole files hosted on the breached systems.The incident was significantly restricted, potentially affecting around 4% of Capita's server estate.

See the full report here: https://www.bleepingcomputer.com/news/security/capita-confirms-hackers-stole-data-in-recent-cyberattack/

Lazarus hackers now push Linux malware via fake job offers

A new Lazarus campaign considered part of "Operation DreamJob" has been discovered targeting Linux users with malware for the first time. This new targeting was discovered by cybersecurity researchers, who state with high confidence that Lazarus conducted the recent supply-chain attack on VoIP provider 3CX. The attack was discovered in March 2023, compromising multiple companies that used the trojanized version of the 3CX client with information-stealing trojans.

See the full report here: https://www.bleepingcomputer.com/news/security/lazarus-hackers-now-push-linux-malware-via-fake-job-offers/

Attackers use abandoned WordPress plugin to backdoor websites

Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors. Eval PHP is an old WordPress plugin that allows site admins to embed PHP code on pages and posts of WordPress sites and then execute the code when the page is opened in the browser. The plugin has not been updated in the past decade and is generally considered abandonware, yet it is still available through the WordPress plugins repository.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-use-abandoned-wordpress-plugin-to-backdoor-websites/