zerofox logo
Advisories

Threat Intelligence Bulletin: 04/28/2023 - 05/04/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 04/28/2023 - 05/04/2023

ZeroFox Daily Intelligence Briefs:

ZeroFox Daily Intelligence Brief - May 4, 2023

Brief Highlights

  • City of Dallas Suspends IT Systems to Prevent the Spread of Ransomware Attack
  • Drone Goggles Maker Claims Firmware Sabotaged to “Brick” Devices
  • Hotels at Risk from Bug in Oracle Property Management Software
  • CVE-2023-22921
  • CVE-2023-1804
  • CVE-2023-22651
  • CVE-2020-16134
  • CVE-2023-20959
  • Telegram: @cloudlogss (90-99) Botnet Breach (2,421,461 Email address and password
  • Credit Card Data Breach: 2023-5-3
  • Telegram: @cloudlogss (80-89) Botnet Breach (2,248,938 Records) Email address and password

Report: https://zerofox.com/advisories/20448

ZeroFox Daily Intelligence Brief - May 3, 2023

Brief Highlights

  • Operation SpecTor Nabs 288 Dark Web Drug Vendors and Buyers
  • ALPHV Targets Australian Commercial Law Firm, Hacks 4TB Data
  • Anonymous Sudan Claims to Have Disrupted Iron Dome Intercepts
  • CVE-2023-23920
  • CVE-2023-29839
  • CVE-2022-4129
  • CVE-2017-2921
  • CVE-2015-7611

Report: https://zerofox.com/advisories/20438

ZeroFox Daily Intelligence Brief - May 2, 2023

Brief Highlights

  • ZeroFox Advisory May 2023 Geopolitical Brief
  • FDA Warns of Potential Risks from Vulnerability in Illumina DNA Sequencing Instruments
  • Ransomware Attack on Health Insurance Care Affecting Patients
  • LOBSHOT, a New Windows Remote-Access Malware, Exploits Google Ads for Its Distribution
  • CVE-2022-28005 Vulnerability
  • CVE-2023-2004 Vulnerability
  • CVE-2023-2033 Vulnerability
  • CVE-2016-9565 Exploit
  • CVE-2019-9153 Exploit
  • Telegram: YouTube (9) Botnet Breach
  • Telegram: YouTube (4) Botnet Breach
  • Telegram: YouTube (3) Botnet Breach

Report: https://zerofox.com/advisories/20424

ZeroFox Daily Intelligence Brief - May 1, 2023

Key Findings

  • Numerous Vulnerabilities Spotted in Intel TDX
  • New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks
  • ChatGPT is Back in Italy After Addressing Data Privacy Concerns

Report: https://zerofox.com/advisories/20414

ZeroFox Daily Intelligence Brief - April 28, 2023

Key Findings

  • Linux Version of RTM Locker Ransomware Targets VMware ESXi Servers
  • Israel Facing Wave of Cyberattacks in Lead-Up to 75th Independence Day Celebrations
  • PaperCut Says Hackers Are Exploiting Critical Security Flaws in Unpatched Servers

Report: https://zerofox.com/advisories/20398

Breach Disclosures:

Breach Disclosure: Tanpool

Summary

An alleged data breach at Tanpool – a U.S.-based marketplace that connects drivers with empty seats to co-travellers looking for a ride or want to send Parcel – exposed 9,803 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20397

Breaking News:

Payment software giant AvidXchange suffers its second ransomware attack of 2023

Hackers have published a trove of sensitive data stolen from payment software company AvidXchange after the company fell victim to ransomware for the second time in 2023. AvidXchange provides cloud-based software that helps organizations automate invoice processing and payment management processes. The North Carolina-based company says it processed 70 million transactions for 8,000 customers in 2022. A ransomware group called RansomHouse claimed responsibility for the recent cyberattack on AvidXchange.

See the full report here: https://techcrunch.com/2023/05/03/avidxchange-second-ransomware-attack-2023/

China accuses US-controlled "empire of hackers" of attacking it and several other countries

A report, jointly released by China’s National Computer Virus Emergency Response Centre (CVERC) and cybersecurity company 360, accused the US Central Intelligence Agency of secretly orchestrating “peaceful evolution” and “colour revolutions” around the world with the use of superior technology. According to the report, which was focused on numerous cyberattacks within China, investigators captured and extracted a large number of Trojan programs, functional plug-ins, and attack platform samples that they said were closely associated with the CIA, revealing an “empire of hackers” under US control.

See the full report here: https://www.scmp.com/news/china/science/article/3219414/us-controlled-empire-hackers-attacking-china-other-countries-report

New KEKW malware infects open-source Python Wheel files via a PyPI distribution

Malicious open-source Python .whl (Wheel) files were found distributing a new malware named KEKW that can steal sensitive information from infected systems by incorporating clipper activities with infostealers to hijack cryptocurrency transactions. In a blog post on May 3 2023, researchers explained that the Python packages under scrutiny were not present in the actual PyPI (Python Package Index) repository, indicating that the Python security team removed the malicious packages.

See the full report here: https://www.scmagazine.com/news/devops/kekw-malware-infects-open-source-python-wheel-files

Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts

Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensions being increasingly used to steal users' Facebook account credentials with an aim to run unauthorized ads from hijacked business accounts.

See the full report here: https://thehackernews.com/2023/05/meta-takes-down-malware-campaign-that.html

Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks. Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet. This investment in social engineering meant that these threat actors did not have to invest as much on the malware side. The fake accounts, in addition to using traditional lures like women looking for a romantic connection, masqueraded as recruiters, journalists, or military personnel.

See the full report here: https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections. Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. While the flaw was patched by the Australian company on March 8, 2023, the first signs of active exploitation emerged on April 13, 2023.

See the full report here: https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html

Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services. This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal. By abusing the SSRF vulnerabilities, attackers could send requests from the service's CORS Proxy and the hosting proxy itself, access internal Azure assets, deny service and bypass web application firewalls.

See the full report here: https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html

Cisco phone adapters vulnerable to RCE attacks, no fix available

Cisco has disclosed a vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters, allowing an unauthenticated, remote attacker to execute arbitrary code on the devices. Tracked as CVE-2023-20126 and having a "critical" CVSS score of 9.8, this vulnerability is caused by a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-phone-adapters-vulnerable-to-rce-attacks-no-fix-available/

Kimsuky hackers use new recon tool to find security gaps

The North Korean Kimsuky hacking group has been observed employing a new version of its reconnaissance malware, now called "ReconShark," in a cyberespionage campaign with a global reach. The threat actor has expanded its targeting scope, now targeting government organizations, research centers, universities, and think tanks in the United States, Europe, and Asia.

See the full report here: https://www.bleepingcomputer.com/news/security/kimsuky-hackers-use-new-recon-tool-to-find-security-gaps/

New Fleckpe Android malware installed 600K times on Google Play

A new Android subscription malware named "Fleckpe" has been spotted on Google Play, the official Android app store, disguised as legitimate apps downloaded over 620,000 times. Fleckpe is the newest addition to the realm of malware that generates unauthorized charges by subscribing users to premium services, joining the ranks of other malicious Android malware, such as Jocker and Harly. Threat actors make money from unauthorized subscriptions by receiving a share of the monthly or one-time subscription fees generated through the premium services. When the threat actors operate the services, they keep the entire revenue.

See the full report here: https://www.bleepingcomputer.com/news/security/new-fleckpe-android-malware-installed-600k-times-on-google-play/

Ransomware gang hijacks university alert system to issue threats

The Avos ransomware gang hijacked Bluefield University's emergency broadcast system, "RamAlert," to send students and staff SMS texts and email alerts that their data was stolen and would soon be released. On April 30 2023, the University disclosed to students and staff that they had suffered a cyberattack that impacted the IT systems, causing all examinations to be postponed. At the time, the University claimed that its investigation had found no evidence of any cases of financial fraud or identity theft linked to this incident.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-hijacks-university-alert-system-to-issue-threats/

Hotels at Risk From Bug in Oracle Property Management Software

Thousands of hotels and other entities in the hospitality industry worldwide using Oracle's Opera property management system might be vulnerable to an exploit that Oracle disclosed in its April 2023 security update. Oracle has described the vulnerability (CVE-2023-21932) as a complex bug in the Oracle Hospitality Opera 5 Property Services product that only an authenticated attacker with highly privileged access could exploit. The vendor assigned it a moderate severity rating of 7.2 on the CVSS scale based among other things on the apparent fact that an attacker could not exploit it remotely.

See the full report here: https://www.darkreading.com/application-security/hotels-at-risk-from-bug-in-oracle-property-management-software

Brightline data breach impacts 783K pediatric mental health patients

Pediatric mental health provider Brightline is warning patients that it suffered a data breach impacting 783,606 people after a ransomware gang stole data using a zero-day vulnerability in its Fortra GoAnywhere MFT secure file-sharing platform. In a new "data security notice" displayed on the company's website, Brightline confirmed that data was stolen from its GoAnywhere MFT service that contained protected health information. These attacks were conducted by the Clop ransomware gang, who utilized a zero-day vulnerability tracked as CVE-2023-0669 to allegedly steal data from 130 companies.

See the full report here: https://www.bleepingcomputer.com/news/security/brightline-data-breach-impacts-783k-pediatric-mental-health-patients/

Researcher hijacks popular Packagist PHP packages to get a job

A researcher hijacked over a dozen Packagist packages—with some having been installed hundreds of millions of times over the course of their lifetime. The researcher stated that by hijacking these packages he hopes to get a job. And, he seems pretty confident that this would work. The researcher, operating under the pseudonym "neskafe3v1" claimed to have taken over fourteen Packagist packages, with one of them having over 500 million installs.

See the full report here: https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job/

Police dismantles Try2Check credit card verifier used by dark web markets

The U.S. Department of Justice announced the indictment of Russian citizen, suspected of running a stolen credit card checking operation that generated tens of millions in revenue. Kulkov is believed to have created the Try2Check underground service in 2005, a platform that soon became highly popular among cybercriminals in the illegal credit card trade and helped the suspect make at least USD 18 million in bitcoin.

See the full report here: https://www.bleepingcomputer.com/news/security/police-dismantles-try2check-credit-card-verifier-used-by-dark-web-markets/

Facebook disrupts new NodeStealer information-stealing malware

Facebook discovered a new information-stealing malware distributed on Meta called "NodeStealer,' allowing threat actors to steal browser cookies to hijack accounts on the platform, as well as Gmail and Outlook accounts. Capturing cookies that contain valid user session tokens is a tactic that is growing in popularity among cybercriminals, as it allows them to hijack accounts without having to steal credentials or interact with the target while also bypassing two-factor authentication protections. The company has since disrupted the operation and helped impacted users recover their accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-disrupts-new-nodestealer-information-stealing-malware/

Drone goggles maker claims firmware sabotaged to brick devices

Orqa, a maker of First Person View (FPV) drone racing goggles, claims that a contractor introduced code into its devices' firmware that acted as a time bomb designed to brick them. Orqa started receiving reports from customers surprised to see their FPV One V1 goggles enter bootloader mode and become unusable. The company revealed hours after devices began getting bricked when powered up, the issue resulted from a firmware bug caused by the date/time feature.

See the full report here: https://www.bleepingcomputer.com/news/technology/drone-goggles-maker-claims-firmware-sabotaged-to-brick-devices/

Russian hackers use WinRAR to wipe Ukraine state agency’s data

The Russian "Sandworm" hacking group has been linked to an attack on Ukrainian state networks where WinRar was used to destroy data on government devices. In a new advisory, the Ukrainian Government Computer Emergency Response Team (CERT-UA) says the Russian hackers used compromised VPN accounts that weren't protected with multi-factor authentication to access critical systems in Ukrainian state networks.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-use-winrar-to-wipe-ukraine-state-agencys-data/

Hackers start using double DLL sideloading to evade detection

An APT hacking group known as "Dragon Breath," "Golden Eye Dog," or "APT-Q-27" is demonstrating a new trend of using several complex variations of the classic DLL sideloading technique to evade detection. These attack variations begin with an initial vector that leverages a clean application, most often Telegram, that sideloads a second-stage payload, sometimes also clean, which in turn, sideloads a malicious malware loader DLL. The lure for victims is trojanized Telegram, LetsVPN, or WhatsApp apps for Android, iOS, or Windows that have been supposedly localized for people in China.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-start-using-double-dll-sideloading-to-evade-detection/

City of Dallas hit by Royal ransomware attack impacting IT services

The City of Dallas,Texas, has suffered a Royal ransomware attack, causing it to shut down some of its IT systems to prevent the attack's spread. Local media reported that the City's police communications and IT systems were shut down due to a suspected ransomware attack. This has led to 911 dispatchers having to write down received reports for officers rather than submit them via the computer-assisted dispatch system. The Dallas County Police Department's website was also offline due to the incident but has since been restored

See the full report here: https://www.bleepingcomputer.com/news/security/city-of-dallas-hit-by-royal-ransomware-attack-impacting-it-services/

Hackers claim major breach of law firm HWL Ebsworth

A hacker group claims to have stolen employee and client data from the Australia's largest legal partnership, HWL Ebsworth. Russia-linked ALPHV, also known as BlackCat, said it has 4 terabytes of data from HWL Ebsworth’s servers spanning internal company files and personal employee data, including CVs, IDs, financial reports, accounting data, loans data, and insurance agreements.

See the full report here: https://www.afr.com/companies/professional-services/hacking-group-claims-major-breach-of-law-firm-hwl-ebsworth-20230501-p5d4jx

APT41 Subgroup Plows Through Asia-Pacific, Utilizing Layered Stealth Tactics

After nearly a year, Earth Longzhi is back, utilizing newer and better stealth tactics in espionage campaigns against many of the same kinds of targets. Rather than tried-and-true phishing emails, Earth Longzhi has tended to target public-facing Internet Information Services (IIS) and Microsoft Exchange servers as inroads to install the popular Behinder Web shell. Using Behinder, it can gather information and download further malware onto host systems. Earth Longzhi primarily delivers two types of malware: Croxloader, a loader for Cobalt Strike, and a new anti-detection tool called SPHijacker

See the full report here: https://www.darkreading.com/vulnerabilities-threats/apt41-subgroup-plows-through-asia-pacific-utilizing-layered-stealth-tactics

Leaked Files Show Extent of Ransomware Group's Access to Western Digital Systems

A ransomware group has leaked files showing the extent of their access to Western Digital systems and it appears that the hackers were closely monitoring the company’s initial response to the breach from within its network. The digital storage giant announced a service outage on April 2, 2023 and the next day it confirmed that the cause was a cyberattack. The company at the time admitted that the hackers had gained access to some data, but it did not share any details. The company has not provided any updates on the incident since its initial statement.

See the full report here: https://www.securityweek.com/leaked-files-show-extent-of-ransomware-groups-access-to-western-digital-systems/

Police operation "SpecTor" arrests 288 dark web drug vendors and buyers

An international law enforcement operation codenamed "SpecTor" has arrested 288 dark web vendors and customers worldwide, with police seizing EUR 50.8 million (USD 55.9M) in cash and cryptocurrency. The vendors were active on a marketplace known as "Monopoly Market" that sold drugs to customers worldwide in exchange for Bitcoin and Monero cryptocurrency. Monopoly Market was launched in 2019 but was later seized by law enforcement in December 2021. While some believed that law enforcement seized the site at the time, others speculated that it was an exit scam, where the owners were stealing cryptocurrency deposited on the site.

See the full report here: https://www.bleepingcomputer.com/news/security/police-operation-spector-arrests-288-dark-web-drug-vendors-and-buyers/

Hackers exploit 5-year-old unpatched flaw in TBK DVR devices

Hackers are actively exploiting an unpatched 2018 authentication bypass vulnerability in exposed TBK DVR (digital video recording) devices. DVRs are an integral part of security surveillance systems as they record and store video recorded by cameras. TBK Vision's website claims its products are deployed in banks, government organizations, the retail industry, and more. As these DVR servers are used to store sensitive security footage, they are usually located on internal networks to prevent unauthorized access to the recorded video. Unfortunately, this makes them attractive to threat actors who can exploit them for initial access to corporate networks and to steal data.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-5-year-old-unpatched-flaw-in-tbk-dvr-devices/

Apple and Google team up to fight Bluetooth tracker stalking

Apple and Google have joined forces to push for adopting new industry standards designed to stop stalking via Bluetooth-enabled location-tracking devices. The new draft specification unveiled today by the two tech giants proposes that vendors making devices that could enable unwanted tracking should make it easier to alert the targeted individuals when this happens.

See the full report here: https://www.bleepingcomputer.com/news/technology/apple-and-google-team-up-to-fight-bluetooth-tracker-stalking/

FBI seizes 9 crypto exchanges used to launder ransomware payments

The FBI and Ukrainian police have seized nine cryptocurrency exchange websites that facilitated money laundering for scammers and cybercriminals, including ransomware actors. In its announcement, the FBI says the operation was carried out with the help of the Virtual Currency Response Team, the National Police of Urkaine, and legal prosecutors in the country.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-seizes-9-crypto-exchanges-used-to-launder-ransomware-payments/

1Password explains scary Secret Key and password change alerts

1Password says a recent incident that caused customers to receive notifications about changed passwords was the result of service disruption and not a security breach. The company first revealed in an incident report five days ago that the notifications were erroneous and linked to routine database maintenance scheduled on Thursday, April 27.

See the full report here: https://www.bleepingcomputer.com/news/security/1password-explains-scary-secret-key-and-password-change-alerts/

North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

The North Korean threat actor known as ScarCruft started experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default. RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate multi-stage infection chains. This is another representation of a major trend in the threat landscape, where APTs and cybercriminals alike attempt to overcome the blocking of macros from untrusted sources.

See the full report here: https://thehackernews.com/2023/05/north-koreas-scarcruft-deploys-rokrat.html

BouldSpy Android Spyware: Iranian Government's Alleged Tool for Spying on Minority Groups

A new Android surveillanceware possibly used by the Iranian government has been used to spy on over 300 individuals belonging to minority groups. The malware, dubbed BouldSpy, has been attributed with moderate confidence to the Law Enforcement Command of the Islamic Republic of Iran (FARAJA). Targeted victims include Iranian Kurds, Baluchis, Azeris, and Armenian Christian groups.

See the full report here: https://thehackernews.com/2023/05/bouldspy-android-spyware-iranian.html

Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software

Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers. The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It's currently used by several vendors like NVIDIA Cumulus, DENT, and SONiC, posing supply chain risks.

See the full report here: https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html

Level Finance crypto exchange hacked after two security audits

Hackers exploited a Level Finance smart contract vulnerability to drain 214,000 LVL tokens from the decentralized exchange and swapped them for 3,345 BNB, worth approximately USD 1,100,000. While Level Finance said the attack did not affect its liquidity pool and the DAO treasury, and the exploit was isolated from all other contracts, the LVL token lost roughly 50% of its value immediately after the attack was made known.

See the full report here: https://www.bleepingcomputer.com/news/security/level-finance-crypto-exchange-hacked-after-two-security-audits/

Anonymous Sudan says it hacked Israeli rocket alerts, Iron Dome warning

The hacker group Anonymous Sudan claimed to have hacked Israeli rocket warning systems, including for the Iron Dome, amid a barrage of rockets fired from the Gaza Strip, and warned it would do so again should more rockets be launched. The hacker group said on its Telegram channel that it had succeeded in taking down the websites of the rocket warning services Cumta, Red Alert, Halamish and Evigilo, as well as targeting some of their smartphone apps. All four sites are still down at the time of writing, according to media reports, though smartphone apps seem to be functional.

See the full report here: https://www.jpost.com/israel-news/article-741869

US Wellness Provides Notification of Data Security Incident

US Wellness has learned of a data security incident that may have involved personal and/or protected health information of its patients. US Wellness has sent notification letters to potentially involved individuals to notify them about this incident and provide resources to assist them. On January 31, 2023, US Wellness' vendor experienced a security incident that disrupted access to certain systems. In response, US Wellness took immediate steps to secure its systems and promptly launched an investigation. On February 9, 2023, US Wellness learned that certain personal and/or protected health information may have been impacted in connection with the incident. There is no evidence of the misuse of any information potentially involved in this incident.

See the full report here: https://www.darkreading.com/attacks-breaches/us-wellness-provides-notification-of-data-security-incident

How Darknet Hackers are Trading Crypto Accounts for USD 85

A new study reveals that criminals are selling hacked crypto accounts for as low as USD 85 on the darknet. Not just crypto accounts, hackers are selling credit card details with account balances of up to USD 5,000 for USD 110 on the darknet. Online bank account credentials with USD 2,000 balance are sold for just USD 60. Facebook and Instagram login credentials cost around USD 25, while Gmail is worth USD 60.

See the full report here: https://beincrypto.com/darknet-hackers-selling-crypto-accounts-85/

Bitmarck shuts down systems, services after cyberattack

German IT services provider Bitmarck has shut down all of its customer and internal systems, including entire datacenters in some cases, following a cyberattack. The company, one of the largest service providers for German health insurers, said no customer, patient, or insured individuals' data had been accessed in the security breach — at least not according to "the current state of knowledge," according to an April 30 2023 update posted on its temporary website. Patient data "was and is never endangered by the attack," the alert read, noting that this sensitive information is subject to "special protection" under Germany's Gematik healthcare data regulations.

See the full report here: https://www.theregister.com/2023/05/01/bitmarck_data_breach/

Vietnamese Threat Actor Infects 500,000 Devices Using "Malverposting" Tactics

A Vietnamese threat actor has been attributed as behind a "malverposting" campaign on social media platforms to infect over 500,000 devices worldwide over the past three months to deliver variants of information stealers such as S1deload Stealer and SYS01stealer. Malverposting refers to the use of promoted social media posts on services like Facebook and Twitter to mass propagate malicious software and other security threats. The idea is to reach a broader audience by paying for ads to "amplify" their posts.

See the full report here: https://thehackernews.com/2023/05/vietnamese-threat-actor-infects-500000.html

Hackers leak images to taunt Western Digital's cyberattack response

The ALPHV ransomware operation, aka BlackCat, has published screenshots of internal emails and video conferences stolen from Western Digital, indicating they likely had continued access to the company's systems even as the company responded to the breach. The leak comes after the threat actor warned Western Digital on April 17 that they would hurt them until they "cannot stand anymore" if a ransom was not paid.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-images-to-taunt-western-digitals-cyberattack-response/

T-Mobile discloses second data breach since the start of 2023

T-Mobile disclosed the second data breach of 2023 after discovering that attackers had access to the personal information of hundreds of customers for more than a month, starting late February 2023. Compared to previous data breaches reported by T-Mobile, the latest of which impacted 37 million people, this incident affected only 836 customers. Still, the amount of exposed information is highly extensive and exposes affected individuals to identity theft and phishing attacks. T-Mobile said the threat actors didn't gain access to call records or affected individuals' personal financial account info, but contains more than enough data for identity theft.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-discloses-second-data-breach-since-the-start-of-2023/

New LOBSHOT malware gives hackers hidden VNC access to Windows devices

A new malware known as "LOBSHOT" distributed using Google ads allows threat actors to stealthily take over infected Windows devices using hVNC. Earlier in 2023, numerous cybersecurity researchers reported a dramatic increase in threat actors utilizing Google ads to distribute malware in search results. These advertising campaigns impersonated websites for 7-ZIP, VLC, OBS, Notepad++, CCleaner, TradingView, Rufus, and many more applications. However, these sites pushed malware instead of distributing legitimate applications, including Gozi, RedLine, Vidar, Cobalt Strike, SectoRAT, and the Royal Ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-lobshot-malware-gives-hackers-hidden-vnc-access-to-windows-devices/

Apple’s first Rapid Security Response patch fails to install on iPhones

Apple has launched the first Rapid Security Response (RSR) patches for iOS 16.4.1 and macOS 13.3.1 devices, with some users having issues installing them on their iPhones. As the company describes in a recently published support document, RSR patches are small-sized updates that target the iPhone, iPad, and Mac platforms and patch security issues between major software updates. Some of these out-of-band security updates may also be used to address vulnerabilities actively exploited in attacks.

See the full report here: https://www.bleepingcomputer.com/news/apple/apples-first-rapid-security-response-patch-fails-to-install-on-iphones/

Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks

Networking equipment maker Zyxel has released patches for a critical security flaw in its firewall devices that could be exploited to achieve remote code execution on affected systems. The issue, tracked as CVE-2023-28771, is rated 9.8 on the CVSS scoring system.

See the full report here: https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html

‘Robin Hood’ hacker steals rich Russian crypto funds, gives to poor Ukraine

A hacker transferred bitcoinsstolen from the Russian government to the addresses of Ukrainian volunteers. Using their skills, the hacker gained access to hundreds of crypto wallets, which likely belonged to Russian law enforcement agencies. Analysts believe that the hacker used a feature of documenting transactions in the bitcoin blockchain to identify 986 wallets controlled by the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), the Foreign Intelligence Service (SVR), and the Federal Security Service (FSB).

See the full report here: https://news.yahoo.com/robin-hood-hacker-steals-rich-145300274.html

China has 50 hackers for every FBI cyber agent, says Bureau boss

China has 50 hackers for every one of the FBI's cyber-centric agents, the Bureau's director told a congressional committee. Speaking at the House Appropriations Committee's subcommittee on Commerce, Justice, Science, and Related Agencies, the director tried to justify the Bureau's budget request by outlining the threats it is trying to counter.

See the full report here: https://www.theregister.com/2023/05/01/fbi_director_wray_china_testimony/

Major UK banks including Lloyds, Halifax, TSB hit by outages

Websites and mobile apps of Lloyds Bank, Halifax, TSB Bank, and Bank of Scotland have experienced web and mobile app outages leaving customers unable to access their account balances and information. While the cause of the widespread outage is unknown, multiple customers reported having troubles when logging into their online banking accounts.

See the full report here: https://www.bleepingcomputer.com/news/technology/major-uk-banks-including-lloyds-halifax-tsb-hit-by-outages/

Cold storage giant Americold outage caused by network breach

Americold, a leading cold storage and logistics company, has been facing IT issues since its network was breached. The company said it contained the attack and is now investigating the incident that also affected operations per customer and employee reports.

See the full report here: https://www.bleepingcomputer.com/news/security/cold-storage-giant-americold-outage-caused-by-network-breach/

Hackers target vulnerable Veeam backup servers exposed online

Veeam backup servers are being targeted by at least one group of threat actors known to work with multiple high-profile ransomware gangs. Malicious activity and tools echoing FIN7 attacks have been observed in intrusions since March 28 2023, less than a week after an exploit became available for a high-severity vulnerability in Veeam Backup and Replication (VBR) software. Tracked as CVE-2023-27532, the security issue exposes encrypted credentials stored in the VBR configuration to unauthenticated users in the backup infrastructure.The software vendor fixed the issue on March 7 and provided workaround instructions.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-vulnerable-veeam-backup-servers-exposed-online/

Hackers use fake Windows Update guides to target Ukrainian gov

The Computer Emergency Response Team of Ukraine (CERT-UA) says Russian hackers are targeting various government bodies in the country with malicious emails supposedly containing instructions on how to update Windows as a defense against cyber attacks. CERT-UA believes that the Russian state-sponsored hacking group APT28 (aka Fancy Bear) sent these emails and impersonated system administrators of the targeted government entities to make it easier to trick their targets.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-fake-windows-update-guides-to-target-ukrainian-govt/

Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions

South Korean education, construction, diplomatic, and political institutions are at the receiving end of new attacks perpetrated by a China-aligned threat actor known as the Tonto Team. Recent cases have revealed that the group is using a file related to anti-malware products to ultimately execute their malicious attacks. Tonto Team, active since at least 2009, has a track record of targeting various sectors across Asia and Eastern Europe.

See the full report here: https://thehackernews.com/2023/04/tonto-team-uses-anti-malware-file-to.html

ViperSoftX InfoStealer Adopts Sophisticated Techniques to Avoid Detection

A significant number of victims in the consumer and enterprise sectors located across Australia, Japan, the U.S., and India have been affected by an evasive information-stealing malware called ViperSoftX. ViperSoftX was first documented in 2020, with cybersecurity analysts detailing a campaign in November 2022 that leveraged the malware to distribute a malicious Google Chrome extension capable of siphoning cryptocurrencies from wallet applications.

See the full report here: https://thehackernews.com/2023/04/vipersoftx-infostealer-adopts.html

New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets

Threat actors are advertising a new information stealer for the Apple macOS operating system called Atomic macOS Stealer (or AMOS) on Telegram for USD 1,000 per month, joining the likes of MacStealer. The Atomic macOS Stealer can steal various types of information from the victim's machine, including Keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password

See the full report here: https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html

CISA Warns of Critical Flaws in Illumina's DNA Sequencing Instruments

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) medical advisory warning of a critical flaw impacting Illumina medical devices. The issues impact the Universal Copy Service (UCS) software in the Illumina MiSeqDx, NextSeq 550Dx, iScan, iSeq 100, MiniSeq, MiSeq, NextSeq 500, NextSeq 550, NextSeq 1000/2000, and NovaSeq 6000 DNA sequencing instruments.

See the full report here: https://thehackernews.com/2023/04/cisa-warns-of-critical-flaws-in.html

Israel: hackers leak thousands of personal details as Netanyahu’s Facebook account targeted

The Facebook account of Israeli Prime Minister was hacked into, and the identities and names of tens of thousands of Israelis were leaked, following another cyber-attack targeting the country's Atid group. The cyber-attack came as Israel celebrates its Independence Day. The hackers known as Sharpboys published information claiming it was stolen from the servers of the Israeli Atid group. The group published a file containing 200,000 records, including names, identity cards, addresses and other personal documents.

See the full report here: https://www.middleeastmonitor.com/20230427-israel-hackers-leak-thousands-of-personal-details-as-netanyahus-facebook-account-targeted/

Hackers steal emails, private messages from hookup websites

Hackers have stolen email addresses, direct messages, and other personal data from users of two dating websites, according to a data breach expert. The stolen data was found to contain usernames, email addresses, passwords, profile pictures, sexual orientation, users’ date of birth, their city and state, their IP addresses, and biographies. The stolen passwords are scrambled with a weak algorithm that could potentially be broken and allow hackers to see the actual passwords.

See the full report here: https://techcrunch.com/2023/04/27/hackers-steal-emails-private-messages-from-hookup-websites/

Hackers Take Control of Government-Owned Satellite in Alarming Experiment

A team of researchers proved they could hack into a European Space Agency-owned satellite, allowing them to take full control of its communication, imaging—and even its maneuverability systems. The intrusion was a controlled hack as part of ESA’s ongoing CYSAT conference. A cybersecurity team took up ESA’s Hack CYSAT challenge and found a way to seize control of an OPS-SAT nanosatellite originally sent up into low Earth orbit back in 2019. The intrusion allowed the hackers access to the satellite’s global positioning system, attitude control system, and even its onboard camera.

See the full report here: https://gizmodo.com/hackers-control-government-owned-satellite-test-esa-1850383452

Microsoft: Clop and LockBit ransomware behind PaperCut server hacks

Clop and LockBit ransomware attacked PaperCut servers through the abuse of CVE-2023-27350 and high CVE-2023-27351 vulnerabilities, impacting all PaperCut MF or NG versions 8.0+ and 15.0+, respectively, on all OS platforms. Papercut urged admins to upgrade servers immediately as exploits are actively exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-clop-and-lockbit-ransomware-behind-papercut-server-hacks/

Paperbug Attack: New Politically-Motivated Surveillance Campaign in Tajikistan

A little-known Russian-speaking cyber-espionage group has been linked to a new politically-motivated surveillance campaign targeting high-ranking government officials, telecom services, and public service infrastructures in Tajikistan. The intrusion set, dubbed Paperbug by Swiss cybersecurity researchers, has been attributed to a threat actor known as Nomadic Octopus (aka DustSquad). The ultimate motive behind the attacks is unclear at this stage, but researchers have raised the possibility that it could be the work of opposition forces within the country or, alternatively, an intelligence-gathering mission carried out by Russia or China.

See the full report here: https://thehackernews.com/2023/04/paperbug-attack-new-politically.html

Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers

Google said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth. CryptBot is estimated to have infected over 670,000 computers in 2022 with the goal of stealing sensitive data such as authentication credentials, social media account logins, and cryptocurrency wallets from users of Google Chrome. The harvested data is then exfiltrated to the threat actors, who then sell the data to other attackers for use in data breach campaigns.

See the full report here: https://thehackernews.com/2023/04/google-gets-court-order-to-take-down.html

New Atomic macOS info-stealing malware targets 50 crypto wallets

A new macOS information-stealing malware named "Atomic" (aka AMOS) is being sold to cybercriminals via private Telegram channels for a subscription of USD 1,000 per month. For this hefty price, buyers get a DMG file containing a 64-bit Go-based malware designed to target macOS systems and steel keychain passwords, files from the local filesystem, passwords, cookies, and credit cards stored in browsers. The malware also attempts to steal data from over 50 cryptocurrency extensions, which have become a popular target for information-stealing malware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-atomic-macos-info-stealing-malware-targets-50-crypto-wallets/

Linux version of RTM Locker ransomware targets VMware ESXi servers

RTM Locker is the latest enterprise-targeting ransomware operation found to be deploying a Linux encryptor that targets virtual machines on VMware ESXi servers. The RTM (Read The Manual) cybercrime gang has been active in financial fraud since at least 2015, known for distributing a custom banking trojan used to steal money from victims. Cybersecurity researchers reported that RTM Locker had launched a new Ransomware-as-a-Service (Raas) operation and had begun to recruit affiliates, including those from the former Conti cybercrime syndicate.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-version-of-rtm-locker-ransomware-targets-vmware-esxi-servers/

Google banned 173,000 developer accounts to block malware, fraud rings

Google says it banned 173,000 developer accounts in 2022 to block malware operations and fraud rings from infecting Android users' devices with malicious apps. The company revealed in its "bad apps" yearly report that it also prevented almost 1.5 million apps linked to various policy violations from reaching the Google Play Store.

See the full report here: https://www.bleepingcomputer.com/news/google/google-banned-173k-developer-accounts-to-block-malware-fraud-rings/

Android Minecraft clones with 35 million downloads infect users with adware

A set of 38 Minecraft copycat games on Google Play infected devices with the Android adware "HiddenAds" to stealthily load ads in the background to generate revenue for its operators. The Minecraft-like games hiding adware were downloaded by roughly 35 million Android users worldwide, mainly from the United States, Canada, South Korea, and Brazil.

See the full report here: https://www.bleepingcomputer.com/news/security/android-minecraft-clones-with-35m-downloads-infect-users-with-adware/

ZeroFox Intelligence Reports:

ZeroFox Intelligence Geopolitical Brief for May 2023

Summary In this ZeroFox Intelligence Geopolitical Brief for May 2023, predictions on important elections in Thailand, Greece, and Turkey are discussed. Local elections in the United Kingdom and India are also covered. The most important G-7 meeting in years, where renewed supply chain disruptors are being proposed, is also covered. Sudan's crisis and how it can impact global operations are also included. In Europe, physical security updates are the primary concern, including ongoing French protests and a key local election followed by the coronation of King Charles.

Report: https://zerofox.com/advisories/20402

Tags: tlp:clear,  all industries,  global