zerofox logo
Advisories

Threat Intelligence Bulletin: 05/05/2023 - 05/11/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 05/05/2023 - 05/11/2023

ZeroFox Daily Intelligence Briefs:

ZeroFox Daily Intelligence Brief - May 11, 2023

Brief Highlights

  • ZeroFox Intelligence: CryptNet: Ransomware-as-a-Service Being Promoted on Russian Underground Forum RAMP
  • Industrial Cybersecurity Company Discloses Data Breach Attempt
  • RapperBot DDoS Malware Adds Cryptojacking as New Revenue Stream
  • Experts Detail New Zero-Click Windows Vulnerability That Enables NTLM Credential Theft
  • CVE-2023-30944
  • CVE-2023-30943
  • CVE-2023-31223
  • CVE-2018-8120
  • CVE-2013-2143
  • CVE-2007-2772
  • тут миллиард Botnet Breach (29,522 Records) Email addresses and passwords
  • сновымгодом Botnet Breach (100,936 Records) Email addresses and passwords
  • свежак Botnet Breach (986 Records) Email addresses and passwords

Report: https://zerofox.com/advisories/20527

ZeroFox Daily Intelligence Brief - May 10, 2023

Brief Highlights

  • International Operation Takes Down FSB’s “Snake” Malware Network
  • Researchers Create Proof-of-Concept Exploit for New Linux Kernel NetFilter Flaw
  • Sysco Data Breach Exposes Employee and Customer Data

Report: https://zerofox.com/advisories/20514

ZeroFox Daily Intelligence Brief - May 9, 2023

Brief Highlights

  • QR Codes Present a New Way to Swindle
  • Over One Million Patients’ Personal Data Compromised in NextGen Data Breach
  • MSI Warns Users of Firmware Integrity Risk After Ransomware Attack
  • CVE-2020-26298
  • CVE-2022-28888
  • CVE-2023-27568
  • CVE-2018-10088
  • CVE-2014-4943
  • BreachForums: 4.4M_USA Combolist

Report: https://zerofox.com/advisories/20501

ZeroFox Daily Intelligence Brief - May 8, 2023

Brief Highlights

  • ZeroFox Intelligence Advisory: Common Vulnerabilities and Exposure (CVE) Exploits Likely Increased Against Manufacturing Sector in Q1 2023
  • Android Fixes Critical Bugs Exploited in Spyware Attacks
  • Western Digital Temporarily Suspends Its Online Store After Hackers Stole Customers’ Data
  • DragonBreath APT Strikes Across Asia, Targeting Gambling Industry
  • CVE-2023-30018
  • CVE-2023-2554
  • CVE-2023-2553
  • CVE-2007-5082
  • CVE-2018-1999002
  • CVE-2014-5460
  • FREE LOGS LEAK Botnet Breach (120,750 Records) Email address and password
  • 444 Botnet Breach (172,257 Records) Email address and password

Report: https://zerofox.com/advisories/20487

ZeroFox Daily Intelligence Brief - May 5, 2023

Brief Highlights

  • ZeroFox Intelligence Advisory: Vulnerabilities Exploitation and Ransomware Threats Likely Increased Against the Financial Sector in Q1
  • Russian Hackers Linked to Sandstorm Group Wipe Ukrainian State Agency’s Data
  • CISA’s New Draft Attestation Form Sparks Several Concerns from Experts
  • Cisco Warns Users Against Critical Vulnerability, Advises to Eliminate SPA 112 2-Port Phone Adapter from Work Environments
  • CVE-2023-2468
  • CVE-2023-2467
  • CVE-2023-2464
  • CVE-2010-0359
  • CVE-2016-4264
  • Telegram: @cloudlogss (170-179) Botnet Breach (441,422 Records) Email address and password
  • Credit Card Data Breach: 2023-5-4
  • Telegram: Архив WinRAR (0-10) Botnet Breach (107,452 Records)) Email address and password

Report: https://zerofox.com/advisories/20463

Breach Disclosures:

Breach Disclosure: Jamie Kent

Summary

An alleged data breach at Jamie Kent – a U.S.-based music community – exposed 93,205 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20490

Breach Disclosure: 326K_COMBOLIST_MIX_UHQ

Summary

A combolist breach package titled “326K PRIVATE COMBOS MIXED & UHQ" exposed 326,472 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20489

Breach Disclosure: usa_1m Data Leak

Summary

A combolist breach package titled “1M US marketing email 2022 sole" exposed 985,317 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20488

Breach Disclosure: 410_Azure

Summary

A combolist breach package titled “410_Azure" exposed 120,753 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20486

Breach Disclosure: 460K_USA_Mail Combolist

Summary

A combolist breach package titled “460K_USA_Mail Combolist" exposed 460,236 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20485

Breach Disclosure: GMail_Combo Combolist

Summary

A combolist breach package titled “GMail_Combo Combolist" exposed 771,126 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20484

Breach Disclosure: 150k_ssn

Summary

A combolist breach package titled “150k_ssn" exposed 153,201 email addresses and plain-text passwords, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20483

Breach Disclosure: Indiabulls

Summary

An alleged data breach at Indiabulls – an India-based financial services group – exposed 219,490 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20482

Breach Disclosure: eToro

Summary

An alleged data breach at eToro – an Israel-based company that operates in cryptocurrency trading and stock trading – exposed 200,283 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20470

Breach Disclosure: UTIP Technologies

Summary

An alleged data breach at UTIP Technologies – a Russia-based forex platform to trade on the foreign exchange market – exposed 6,667,594 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20469

Breach Disclosure: ANS Commerce

Summary

An alleged data breach at ANS Commerce – an India-based extended e-commerce – exposed 921,991 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20468

Breach Disclosure: 800K_USA_COMBOLIST

Summary

An alleged package containing the details of about 800K US Individuals were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20467

Breach Disclosure: Autotrader

Summary

An alleged data breach at Autotrader – a U.S.-based online marketplace for car buyers and sellers – exposed 13,453 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20466

Breach Disclosure: Webzen

Summary

An alleged data breach at Webzen - a Korea-based gaming site – exposed 208,900 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20465

Breaking News:

U.S. Probing Cybersecurity Risks of Rockwell Automation's China Operations

Several departments of the US government are involved in an investigation focusing on the potential cybersecurity risks posed by the Chinese operations of American industrial giant Rockwell Automation. Information obtained by the publication from documents and officials showed that the focus of the investigation is Rockwell’s facility in Dalian, China, where employees might have access to information that could be used to compromise the systems of the company’s customers. China could see Rockwell Automation as a valuable hacking target considering that the company’s products are widely used in critical infrastructure, government, military, and energy sectors in the United States.

See the full report here: https://www.securityweek.com/us-probing-cybersecurity-risks-of-rockwell-automations-china-operations-report/

Former Ubiquiti dev who extorted the firm gets six years in prison

A former senior developer of Ubiquiti, was sentenced to six years in prison for stealing company data, attempting to extort his employer, and aiding the publication of misleading news articles that severely impacted the firm's market capitalization. In January 2021, network device manufacturer Ubiquiti announced that it suffered a data breach at a third-party cloud provider on December 2020, informing all its customers that they needed to reset their passwords and enable 2FA on their accounts. While allegedly working as part of the incident response, the Department of Justice says Sharp posed as the anonymous hacker, demanding that Ubiquity pay 50 Bitcoin (USD 1.9 million at the time) to learn of the exploited vulnerability and for the stolen data to be deleted.

See the full report here: https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-who-extorted-the-firm-gets-six-years-in-prison/

WordPress Elementor plugin bug let attackers hijack accounts on 1M sites

One of WordPress's most popular Elementor plugins, "Essential Addons for Elementor," was found to be vulnerable to an unauthenticated privilege escalation that could allow remote attacks to gain administrator rights on the site. Essential Addons for Elementor is a library of 90 extensions for the 'Elementor' page builder, used by over one million WordPress sites. The flaw, which PatchStack discovered on May 8, 2023, is tracked as CVE-2023-32243 and is an unauthenticated privilege escalation vulnerability on the plugin's password reset functionality, impacting versions 5.4.0 to 5.7.1.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-elementor-plugin-bug-let-attackers-hijack-accounts-on-1m-sites/

Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers

An increasing number of ransomware operations are adopting the leaked Babuk ransomware source code to create Linux encryptors targeting VMware ESXi servers. Researchers observed this rising trend after spotting a rapid succession of nine Babuk-based ransomware variants that surfaced between the second half of 2022 and the first half of 2023. There is a noticeable trend that actors increasingly use the Babuk builder to develop ESXi and Linux ransomware. This is particularly evident when used by actors with fewer resources, as these actors are less likely to significantly modify the Babuk source code.

See the full report here: https://www.bleepingcomputer.com/news/security/babuk-code-used-by-9-ransomware-gangs-to-encrypt-vmware-esxi-servers/

Brightly warns of SchoolDude data breach exposing credentials

U.S. tech company and Siemens subsidiary Brightly Software is notifying customers that their personal information and credentials were stolen by attackers who gained access to the database of its SchoolDude online platform. SchoolDude is a cloud-based platform for managing work orders used by over 7,000 colleges, universities, and K-12 schools from school districts of up to 600,000 students. The companies' other SaaS solutions are being used by more than 12,000 organizations worldwide, most from the United States, Canada, the United Kingdom, and Australia.

See the full report here: https://www.bleepingcomputer.com/news/security/brightly-warns-of-schooldude-data-breach-exposing-credentials/

Multinational tech firm ABB hit by Black Basta ransomware attack

Swiss multinational company ABB, a leading electrification and automation technology provider, has suffered a Black Basta ransomware attack, reportedly impacting business operations. Headquartered in Zurich, Switzerland, ABB employs approximately 105,000 employees and has USD 29.4 billion in revenue for 2022. As part of its services, the company develops industrial control systems (ICS) and SCADA systems for manufacturing and energy suppliers.

See the full report here: https://www.bleepingcomputer.com/news/security/multinational-tech-firm-abb-hit-by-black-basta-ransomware-attack/

Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack

A nascent botnet called Andoryu has been found to exploit a now-patched critical security flaw in the Ruckus Wireless Admin panel to break into vulnerable devices. The flaw, tracked as CVE-2023-25717 (CVSS score: 9.8), stems from improper handling of HTTP requests, leading to unauthenticated remote code execution and a complete compromise of wireless Access Point (AP) equipment. Andoryu was first documented by Chinese cybersecurity researcers earlier in February 2023, detailing its ability to communicate with command-and-control (C2) servers using the SOCKS5 protocol. While the malware is known to weaponize remote code execution flaws in GitLab (CVE-2021-22205) and Lilin DVR for propagation, the addition of CVE-2023-25717 shows that Andoryu is actively expanding its exploit arsenal to ensnare more devices into the botnet.

See the full report here: https://thehackernews.com/2023/05/andoryu-botnet-exploits-critical-ruckus.html

New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe

A previously undetected advanced persistent threat (APT) actor dubbed Red Stinger has been linked to attacks targeting Eastern Europe since 2020. Military, transportation, and critical infrastructure were some of the entities being targeted, as well as some involved in the September East Ukraine referendums. Depending on the campaign, attackers managed to exfiltrate snapshots, USB drives, keyboard strokes, and microphone recordings. Red Stinger overlaps with a threat cluster revealed under the name Bad Magic in April 2023 as having targeted government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea.

See the full report here: https://thehackernews.com/2023/05/new-apt-group-red-stinger-targets.html

Global enterprises targeted by novel Akira ransomware gang

Sixteen companies in finance, manufacturing, education, real estate, and consulting worldwide have already been claimed to be compromised by the new Akira ransomware operation since its inception in March 2023. Akira's encryptor targets files of different file extensions but skips those ending in .exe, .dll, .msi, .lnk, and .sys, as well as those located in the Windows, System Volume Information, Recycle Bin, and Program Data folders. Data stolen from four of the entities compromised by Akira have already been posted on its leak site, with the ransomware operation seeking ransoms between USD 200,000 and millions of dollars

See the full report here: https://www.scmagazine.com/brief/threat-intelligence/global-enterprises-targeted-by-novel-akira-ransomware-gang

Mastermind Behind Twitter 2020 Hack Pleads Guilty and Faces up to 70 Years in Prison

A U.K. national has pleaded guilty in the U.S. in connection with the July 2020 Twitter attack affecting numerous high-profile accounts and defrauding other users of the platform. The perpetrator who went by the online alias PlugwalkJoe, admitted to "his role in cyberstalking and multiple schemes that involve computer hacking", including the July 2020 hack of Twitter. The 23-year-old individual was extradited from Spain on April 26 after the Spanish National Court, in February, approved the DoJ request to hand over O'Connor to face 14 criminal charges in the U.S.

See the full report here: https://thehackernews.com/2023/05/mastermind-behind-twitter-2020-hack.html

Sophisticated DownEx Malware Campaign Targeting Central Asian Governments

Government organizations in Central Asia are the target of a sophisticated espionage campaign that leverages a previously undocumented strain of malware dubbed DownEx. Researchers stated that the campaign remains active, with evidence likely pointing to the involvement of Russia-based threat actors. The malware was first detected in a highly targeted attack aimed at foreign government institutions in Kazakhstan in late 2022. Subsequently, another attack was observed in Afghanistan.

See the full report here: https://thehackernews.com/2023/05/sophisticated-downex-malware-campaign.html

Cybersecurity firm Dragos discloses cybersecurity incident, extortion attempt

Industrial cybersecurity company Dragos disclosed what it describes as a "cybersecurity event" after a known cybercrime gang attempted to breach its defenses and infiltrate the internal network to encrypt devices. While Dragos states that the threat actors did not breach its network or cybersecurity platform, they got access to the company's SharePoint cloud service and contract management system. No Dragos systems were breached, including anything related to the Dragos Platform.

See the full report here: https://www.bleepingcomputer.com/news/security/cybersecurity-firm-dragos-discloses-cybersecurity-incident-extortion-attempt/

New ransomware decryptor recovers data from partially encrypted files

A new "White Phoenix" ransomware decryptor allows victims to partially recover files encrypted by ransomware strains that use intermittent encryption. In September 2022, the researchers reported that intermittent encryption is gaining traction in the ransomware space, with all big RaaS offering it at least as an option to affiliates and BlackCat/ALPHV having seemingly the most sophisticated implementation.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransomware-decryptor-recovers-data-from-partially-encrypted-files/

Fake in-browser Windows updates push Aurora info-stealer malware

A recently spotted malvertising campaign tricked users with an in-browser Windows update simulation to deliver the Aurora information stealing malware. Written in Golang, Aurora has been available on various hacker forums for more than a year, advertised as an info stealer with extensive capabilities and low antivirus detection.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-in-browser-windows-updates-push-aurora-info-stealer-malware/

Experts Detail New Zero-Click Windows Vulnerability for NTLM Credential Theft

Cybersecurity researchers have shared details about a now-patched security flaw in Windows MSHTML platform that could be abused to bypass integrity protections on targeted machines. The vulnerability, tracked as CVE-2023-29324 (CVSS score: 6.5), has been described as a security feature bypass. It was addressed by Microsoft as part of its Patch Tuesday updates for May 2023. The security researcher who discovered and reported the bug, noted that all Windows versions are affected, but pointed out Microsoft, Exchange servers with the March update omit the vulnerable feature.

See the full report here: https://thehackernews.com/2023/05/experts-detail-new-zero-click-windows.html

North Korean hackers breached major hospital in Seoul to steal data

The Korean National Police Agency (KNPA) warned that North Korean hackers had breached the network of one of the country's largest hospitals, Seoul National University Hospital (SNUH), to steal sensitive medical information and personal details. Local media in South Korea linked the attack to the Kimsuky hacking group, but the police's report does not explicitly mention the particular threat group. The attackers used seven servers in South Korea and other countries to launch the attack on the hospital's internal network.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-breached-major-hospital-in-seoul-to-steal-data/

RapperBot DDoS malware adds cryptojacking as new revenue stream

New samples of the RapperBot botnet malware have added cryptojacking capabilites to mine for cryptocurrency on compromised Intel x64 machines. The change occurred gradually, with developers first adding the cryptomining component separately from the botnet malware. Towards the end of January 2023, the botnet and cryptomining functionalities were combined into a single unit.

See the full report here: https://www.bleepingcomputer.com/news/security/rapperbot-ddos-malware-adds-cryptojacking-as-new-revenue-stream/

New "Greatness" service simplifies Microsoft 365 phishing attacks

The Phishing-as-a-Service (PhaaS) platform named "Greatness" has seen a spike in activity as it targets organizations using Microsoft 365 in the United States, Canada, the U.K., Australia, and South Africa. In a new report, researchers explained the launch of Greatness phishing platform in mid-2022, with a spike in activity in December 2022 and then again in March 2023. Most victims are located in the United States, with many working in manufacturing, healthcare, technology, education, real estate, construction, finance, and business services.

See the full report here: https://www.bleepingcomputer.com/news/security/new-greatness-service-simplifies-microsoft-365-phishing-attacks/

Power grids at risk from critical Siemens RTU vulnerability

A critical vulnerability affecting some of Siemens’ industrial control systems (ICS) designed for the energy sector could allow malicious hackers to destabilize a power grid, according to the researchers who found the security hole. The vulnerability, tracked as CVE-2023-28489, impacts the CPCI85 firmware of Sicam A8000 CP-8031 and CP-8050 products, and it can be exploited by an unauthenticated attacker for remote code execution. Patches are available in firmware versions CPCI85 V05 or later.

See the full report here: https://www.securityweek.com/critical-siemens-rtu-vulnerability-could-allow-hackers-to-destabilize-power-grid/

Researchers Uncover SideWinder's Latest Server-Based Polymorphism Technique

The advanced persistent threat (APT) actor known as SideWinder has been accused of deploying a backdoor in attacks directed against Pakistan government organizations as part of a campaign that commenced in late November 2022. In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload. Another campaign discovered in early March 2023 shows that Turkey has also landed in the crosshairs of the threat actor's collection priorities.

See the full report here: https://thehackernews.com/2023/05/researchers-uncover-sidewinders-latest.html

Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps

A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021. Slovak cybersecurity researchers are tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin. These attacks use a specific tactic: targeting the victim companies' support agents via chat applications – in particular, the Comm100 and LiveHelp100 apps,

See the full report here: https://thehackernews.com/2023/05/operation-chattygoblin-hackers.html

Spanish police dismantle phishing operation linked to crime ring

The National Police of Spain have arrested two hackers, 15 members of a criminal organization, and another 23 people involved in illegal financial operations in Madrid and Seville for alleged bank scams. The cybercrime operation is an email and SMS-based phishing campaign that allegedly scammed over 300,000 people and resulted in confirmed losses of at least EUR 700,000 (USD 770k). The poilce announcement stated that 40 people have been arrested, accused of the crimes of belonging to a criminal organization, bank scam, documentary falsification, identity theft, and money laundering

See the full report here: https://www.bleepingcomputer.com/news/security/spanish-police-dismantle-phishing-operation-linked-to-crime-ring/

Critical Ruckus RCE flaw exploited by new DDoS botnet malware

A new malware botnet named "AndoryuBot" is targeting a critical-severity flaw in the Ruckus Wireless Admin panel to infect unpatched Wi-Fi access points for use in DDoS attacks. Tracked as CVE-2023-25717, the flaw impacts all Ruckus Wireless Admin panels version 10.4 and older, allowing remote attackers to perform code execution by sending unauthenticated HTTP GET requests to vulnerable devices. The flaw was discovered and fixed on February 8, 2023. Still, many have not applied the available security updates, while end-of-life models impacted by the security problem will not get a patch.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-ruckus-rce-flaw-exploited-by-new-ddos-botnet-malware/

GitHub now auto-blocks token and API key leaks for all repos

GitHub is now automatically blocking the leak of sensitive information like API keys and access tokens for all public code repositories. The announcement comes after the company introduced push protection in beta more than one year ago, in April 2022. This feature proactively prevents leaks by scanning for secrets before 'git push' operations are accepted, and it works with 69 token types (API keys, private keys, secret keys, authentication tokens, access tokens, management certificates, credentials, and more) detectable with a low "false positive" detection rate.

See the full report here: https://www.bleepingcomputer.com/news/security/github-now-auto-blocks-token-and-api-key-leaks-for-all-repos/

New Linux kernel NetFilter flaw gives attackers root privileges

A new Linux NetFilter kernel flaw has been discovered, allowing unprivileged local users to escalate their privileges to root level, allowing complete control over a system. The CVE-2023-32233 identifier has been reserved for the vulnerability, but a severity level is yet to be determined. The security problem stems from Netfilter nf_tables accepting invalid updates to its configuration, allowing specific scenarios where invalid batch requests lead to the corruption of the subsystem's internal state.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-kernel-netfilter-flaw-gives-attackers-root-privileges/

FBI nukes Russian Snake data theft malware with self-destruct command

Cybersecurity and intelligence agencies from all Five Eyes member nations took down the infrastructure used by the Snake cyber-espionage malware operated by Russia's Federal Security Service (FSB). The development of the Snake malware started under the name "Uroburos" in late 2003, while the first versions of the implant were seemingly finalized by early 2004, with Russian state hackers deploying the malware in attacks immediately after. The malware is linked to a unit within Center 16 of the FSB, the notorious Russian Turla hacking group, and was disrupted following a coordinated effort named Operation MEDUSA.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-nukes-russian-snake-data-theft-malware-with-self-destruct-command/

Food distribution giant Sysco warns of data breach after cyberattack

Sysco, a leading global food distribution company, has confirmed that its network was breached in the early part of 2023 by attackers who stole sensitive information, including business, customer, and employee data. In an internal memo sent to employees on May 3 2023, the company revealed that customer and supplier data in the U.S. and Canada, as well as personal information belonging to U.S. employees, may have been impacted in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/food-distribution-giant-sysco-warns-of-data-breach-after-cyberattack/

Security researcher finds trove of Capita data exposed online

London-based outsourcing giant Capita left a trove of data exposed online for seven years, just weeks after the company admitted to a data breach potentially impacting customer data. The AWS bucket, which the researcher said had been exposed to the internet since 2016, contained approximately 3,000 files totaling 655GB in size.

See the full report here: https://techcrunch.com/2023/05/05/security-researcher-finds-trove-of-capita-data-exposed-online/

NextGen Healthcare says hackers accessed personal data of more than 1 million patients

NextGen Healthcare, a U.S.-based provider of electronic health record software, admitted that hackers breached its systems and stole the personal data of more than 1 million patients. In a data breach notification filed with the Maine attorney general’s office, NextGen Healthcare confirmed that hackers accessed the personal data of 1.05 million patients, including approximately 4,000 Maine residents. In a letter sent to those affected, NextGen Healthcare said that hackers stole patients’ names, dates of birth, addresses and Social Security numbers.

See the full report here: https://techcrunch.com/2023/05/08/nextgen-healthcare-data-breach/

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine

An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine (CERT-UA). The emails, per the agency, are sent using compromised accounts and come with a ZIP archive that, in reality, is a polyglot file containing a decoy document and a JavaScript file. The JavaScript code is then used to launch an executable that paves for the execution of the SmokeLoader malware.

See the full report here: https://thehackernews.com/2023/05/cert-ua-warns-of-smokeloader-and.html

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign. This involves using a ZIP archive lure pertaining to India's Defence Research and Development Organization (DRDO) to deliver a malicious payload capable of harvesting sensitive information. The cyber espionage group, with activity dating back to at least 2019, targets entities that align with Pakistan government interests.

See the full report here: https://thehackernews.com/2023/05/sidecopy-using-action-rat-and-allakore.html

FBI seizes 13 more domains linked to DDoS-for-hire services

The U.S. Justice Department announced the seizure of 13 more domains linked to DDoS-for-hire platforms, also known as "booter" or "stressor" services. The seizures are part of a coordinated international law enforcement effort (known as Operation PowerOFF) to disrupt online platforms allowing anyone to launch massive distributed denial-of-service (DDoS) attacks against any target for the right amount of money.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-seizes-13-more-domains-linked-to-ddos-for-hire-services/

Intel investigating leak of Intel Boot Guard private keys after MSI breach

Intel is investigating the leak of alleged private keys used by the Intel Boot Guard security feature, potentially impacting its ability to block the installation of malicious UEFI firmware on MSI devices. In March 2023, the Money Message extortion gang attacked computer hardware make MSI, claiming to have stolen 1.5TB of data during the attack, including firmware, source code, and databases.The ransomware gang demanded a USD 4,000,000 ransom and, after not being paid and began leaking the data for MSI on their data leak site.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-investigating-leak-of-intel-boot-guard-private-keys-after-msi-breach/

QR codes used in fake parking tickets, surveys to steal your money

As QR codes continue to be heavily used by legitimate organizations—from Super Bowl advertisements to enforcing parking fees and fines, scammers have started abusing these technologies. A woman in Singapore reportedly lost USD 20,000 after using a QR code to fill out a "survey" at a bubble tea shop, whereas cases of fake car parking citations with QR codes targeting drivers have been observed in the U.S. and the U.K.

See the full report here: https://www.bleepingcomputer.com/news/security/qr-codes-used-in-fake-parking-tickets-surveys-to-steal-your-money/

Microsoft: Iranian hacking groups join Papercut attack spree

Iranian state-backed hackers have joined the ongoing assault targeting vulnerable PaperCut MF/NG print management servers. These groups are tracked as Mango Sandstorm (aka Mercury or Muddywater and linked to Iran's Ministry of Intelligence and Security) and Mint Sandstorm (also known as Phosphorus or APT35 and tied to Iran's Islamic Revolutionary Guard Corps). The PaperCut exploitation activity by Mint Sandstorm appears opportunistic, affecting organizations across sectors and geographies.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-iranian-hacking-groups-join-papercut-attack-spree/

Hackers Leak Private Keys for MSI Products, Making It Easier to Attack Them

Cybercriminals could have an easier time attacking MSI laptops after a ransomware gang leaked private code signing keys for the company’s products. The leak sources back to a group known as Money Message, which announced last month that it had infiltrated MSI and stolen sensitive company files, including alleged source code. Money Message claims MSI refused to pay up to keep the information secret, it posted the stolen data on its website on the dark web.

See the full report here: https://www.pcmag.com/news/hackers-leak-private-keys-for-msi-products-making-it-easier-to-attack-them

Over a Dozen PHP Packages with 500 Million Installs Compromised

PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date. The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes, package URLs were then changed to point to the forked repositories. The four user accounts are said to have had access to a total of 14 packages, including multiple Doctrine packages. The incident took place on May 1, 2023.

See the full report here: https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html

Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN

Italian corporate banking clients are the target of an ongoing financial fraud campaign that has been leveraging a new web-inject toolkit called drIBAN since at least 2019. The compromised bank accounts are either controlled by the threat actors themselves or their affiliates, who are then tasked with laundering the stolen funds.

See the full report here: https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

An advanced persistent threat (APT) actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism. The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time. Operation Dragon Breath, also tracked under the names APT-Q-27 and Golden Eye, was first documented in 2020, detailing a watering hole campaign designed to trick users into downloading a trojanized Windows installer for Telegram.

See the full report here: https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html

Ransomware gang hijacks university alert system to issue threats

The Avos ransomware gang hijacked Bluefield University's emergency broadcast system, "RamAlert," to send students and staff SMS texts and email alerts that their data was stolen and would soon be released. Bluefield University is a small private university in Bluefield, Virginia, with roughly 900 students. On April 30th, the University disclosed to students and staff that they had suffered a cyberattack that impacted the IT systems, causing all examinations to be postponed. At the time, the University claimed that its investigation had found no evidence of any cases of financial fraud or identity theft linked to this incident.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-hijacks-university-alert-system-to-issue-threats/

New Cactus ransomware encrypts itself to evade antivirus

A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of “large commercial entities.” The Cactus ransomware operation has been active since at least March 2023 and is looking for big payouts from its victims. While the new threat actor adopted the usual tactics seen in ransomware attacks - file encryption and data theft - it added its own touch to avoid detection.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cactus-ransomware-encrypts-itself-to-evade-antivirus/

Meet Akira — A new ransomware operation targeting the enterprise

The new Akira ransomware operation has slowly been building a list of victims as they breach corporate networks worldwide, encrypt files, and then demand million-dollar ransoms. Launched in March 2023, Akira claims to have already conducted attacks on sixteen companies. These companies are in various industries, including education, finance, real estate, manufacturing, and consulting. While another ransomware named Akira was released in 2017, it is not believed that these operations are related.

See the full report here: https://www.bleepingcomputer.com/news/security/meet-akira-a-new-ransomware-operation-targeting-the-enterprise/

New Android FluHorse malware steals your passwords, 2FA codes

A new Android malware called "FluHorse" has been discovered, targeting users in Eastern Asia with malicious apps that imitate legitimate versions. The malware was discovered by researchers after reports that it has been targeting various sectors of Eastern Asia since May 2022. The FluHorse malware is distributed via email, while its goal is to steal its target's account credentials and credit card data and, if needed, snatch two-factor authentication (2FA) codes.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-fluhorse-malware-steals-your-passwords-2fa-codes/

New Android updates fix kernel bug exploited in spyware attacks

Android security updates released in May 2023 patch a high-severity vulnerability exploited as a zero-day to install commercial spyware on compromised devices. The security flaw (tracked as CVE-2023-0266) is a use-after-free weakness in the Linux Kernel sound subsystem that may result in privilege escalation without requiring user interaction. It was exploited as part of a complex chain of multiple 0-days and n-days in a spyware campaign targeting Samsung Android phones.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-updates-fix-kernel-bug-exploited-in-spyware-attacks/

ALPHV gang claims ransomware attack on Constellation Software

Canadian diversified software company Constellation Software confirme that some of its systems were breached by threat actors who also stole personal information and business data. The Incident was limited to a small number of systems related to internal financial reporting and related data storage. Constellation added that it had contained the attack and has now restored all of the IT infrastructure systems impacted in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/alphv-gang-claims-ransomware-attack-on-constellation-software/

WordPress custom field plugin bug exposes over 1 million sites to XSS attacks

Security researchers warn that the "Advanced Custom Fields" and "Advanced Custom Fields Pro" WordPress plugins, with millions of installs, are vulnerable to attacks. The two plugins are among WordPress's most popular custom field builders, with 2,000,000 active installs on sites worldwide. A researcher discovered the high-severity reflected XSS vulnerability on May 2, 2023, which was assigned the identifier CVE-2023-30777. They have indicated that flaw could allow an unauthenticated attacker to steal sensitive information and escalate their privileges on an impacted WordPress site.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-custom-field-plugin-bug-exposes-over-1m-sites-to-xss-attacks/

Payment software giant AvidXchange suffers its second ransomware attack of 2023

Hackers have published a trove of sensitive data stolen from payment software company AvidXchange after the company fell victim to ransomware for the second time in 2023. AvidXchange provides cloud-based software that helps organizations automate invoice processing and payment management processes. The North Carolina-based company says it processed 70 million transactions for 8,000 customers in 2022. A ransomware group called RansomHouse claimed responsibility for the recent cyberattack on AvidXchange.

See the full report here: https://techcrunch.com/2023/05/03/avidxchange-second-ransomware-attack-2023/

China accuses US-controlled "empire of hackers" of attacking it and several other countries

A report, jointly released by China’s National Computer Virus Emergency Response Centre (CVERC) and cybersecurity company 360, accused the US Central Intelligence Agency of secretly orchestrating “peaceful evolution” and “colour revolutions” around the world with the use of superior technology. According to the report, which was focused on numerous cyberattacks within China, investigators captured and extracted a large number of Trojan programs, functional plug-ins, and attack platform samples that they said were closely associated with the CIA, revealing an “empire of hackers” under US control.

See the full report here: https://www.scmp.com/news/china/science/article/3219414/us-controlled-empire-hackers-attacking-china-other-countries-report

New KEKW malware infects open-source Python Wheel files via a PyPI distribution

Malicious open-source Python .whl (Wheel) files were found distributing a new malware named KEKW that can steal sensitive information from infected systems by incorporating clipper activities with infostealers to hijack cryptocurrency transactions. In a blog post on May 3 2023, researchers explained that the Python packages under scrutiny were not present in the actual PyPI (Python Package Index) repository, indicating that the Python security team removed the malicious packages.

See the full report here: https://www.scmagazine.com/news/devops/kekw-malware-infects-open-source-python-wheel-files

Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts

Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensions being increasingly used to steal users' Facebook account credentials with an aim to run unauthorized ads from hijacked business accounts.

See the full report here: https://thehackernews.com/2023/05/meta-takes-down-malware-campaign-that.html

Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks. Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet. This investment in social engineering meant that these threat actors did not have to invest as much on the malware side. The fake accounts, in addition to using traditional lures like women looking for a romantic connection, masqueraded as recruiters, journalists, or military personnel.

See the full report here: https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections. Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. While the flaw was patched by the Australian company on March 8, 2023, the first signs of active exploitation emerged on April 13, 2023.

See the full report here: https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html

Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services. This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal. By abusing the SSRF vulnerabilities, attackers could send requests from the service's CORS Proxy and the hosting proxy itself, access internal Azure assets, deny service and bypass web application firewalls.

See the full report here: https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html

Cisco phone adapters vulnerable to RCE attacks, no fix available

Cisco has disclosed a vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters, allowing an unauthenticated, remote attacker to execute arbitrary code on the devices. Tracked as CVE-2023-20126 and having a "critical" CVSS score of 9.8, this vulnerability is caused by a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-phone-adapters-vulnerable-to-rce-attacks-no-fix-available/

Kimsuky hackers use new recon tool to find security gaps

The North Korean Kimsuky hacking group has been observed employing a new version of its reconnaissance malware, now called "ReconShark," in a cyberespionage campaign with a global reach. The threat actor has expanded its targeting scope, now targeting government organizations, research centers, universities, and think tanks in the United States, Europe, and Asia.

See the full report here: https://www.bleepingcomputer.com/news/security/kimsuky-hackers-use-new-recon-tool-to-find-security-gaps/

New Fleckpe Android malware installed 600K times on Google Play

A new Android subscription malware named "Fleckpe" has been spotted on Google Play, the official Android app store, disguised as legitimate apps downloaded over 620,000 times. Fleckpe is the newest addition to the realm of malware that generates unauthorized charges by subscribing users to premium services, joining the ranks of other malicious Android malware, such as Jocker and Harly. Threat actors make money from unauthorized subscriptions by receiving a share of the monthly or one-time subscription fees generated through the premium services. When the threat actors operate the services, they keep the entire revenue.

See the full report here: https://www.bleepingcomputer.com/news/security/new-fleckpe-android-malware-installed-600k-times-on-google-play/

Ransomware gang hijacks university alert system to issue threats

The Avos ransomware gang hijacked Bluefield University's emergency broadcast system, "RamAlert," to send students and staff SMS texts and email alerts that their data was stolen and would soon be released. On April 30 2023, the University disclosed to students and staff that they had suffered a cyberattack that impacted the IT systems, causing all examinations to be postponed. At the time, the University claimed that its investigation had found no evidence of any cases of financial fraud or identity theft linked to this incident.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-hijacks-university-alert-system-to-issue-threats/

ZeroFox Intelligence Reports:

ZeroFox Intelligence Flash Report - Implications of Upcoming Turkish Presidential and Parliamentary Elections

Summary In this flash report, ZeroFox Intelligence provides an analysis of Turkey’s upcoming national elections for its presidency and the entire 600-seat parliament on May 14, 2023. Long-time leader Recep Tayyip Erdogan, who previously served as prime minister for 11 years, is seeking his third five-year term as president. However, his primary opponent is Kemal Kilicdaroglu, the leader of Turkey’s main opposition Republican People’s Party (CHP), who is backed by a rare coalition of five other opposition parties known as the Nation Alliance or Table of Six.

Report: https://zerofox.com/advisories/20516

ZeroFox Intelligence Cyber Threat Advisory – CryptNet Ransomware

Summary In this advisory, ZeroFox Intelligence discusses observations its researchers have made of a new Ransomware-as-a-Service, dubbed “CryptNet.” CryptNet is marketed as fast and fully undetectable with various capabilities and features, such as the ability to delete shadow copies and disable backup services, offline encryption, and a chat panel for negotiations.

Report: https://zerofox.com/advisories/20515

ZeroFox Intelligence Flash Report - Increase in Threat Actor Activity Around Misconfigured MongoDB Instances

Summary In this flash report, ZeroFox Intelligence provides analysis around an uptick in threat actor chatter this week regarding misconfigured MongoDB instances on port 27017, which suggests a risk of imminent data exfiltration and subsequent brokering of large, sensitive data sets. Port 27017 is the default connection point for MongoDB, a commonly used database system for cloud-based data storage and management.

Report: https://zerofox.com/advisories/20503

Tags: tlp:clear,  all industries,  global