Threat Intelligence Bulletin: 10/25/2019 - 10/31/2019

Alpha Team Research: Opportunistic Hackers Case Study

The recent hack on the city of Johannesburg is a great example of an opportunistic attacker and how popular these types of attacks have become. This breach did not appear targeted, or motivated by any factors, but just at the right place at the right time. These types of attacks are relatively common, with hacker groups claiming they compromised a site that wouldn’t typically be a target for attacks, due to the size or scope of the site. However, the attackers were able to find some way to compromise them and attempted to make the hack seem much more impactful than it actually was. While the Johannesburg attack was actually relatively major, it still was an example of how attackers try to capitalize on any possibility to make a name for themselves, regardless of how much notoriety is actually deserved.

Recommendations

• Continue monitoring the Alpha Team Tab for reports related to dark web and threat actor activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

The Shadow Kill Hackers first posted about the Johannesburg attack last week and claimed they had access to the Domain Controllers for the city. They posted screenshots of the data and explained the victims had until the 28th of October to pay 4 bitcoins to release control back to the owners. Since this happened, the group has been featured in several news articles detailing the attack and who might be behind it. This group took the opportunity to try and market themselves as being something bigger than opportunistic hackers, and have most recently tried to appear "professional" with their recent Twitter bio - "Our main goal is to find security holes on companies and make them pay for us in order to receive a full detailed scenario attack report.". Their new bio sounds like they would provide companies who were attacked, with information as to how the attack was conducted, and what could be done to prevent future attacks.

Figure 1. Windows Login of compromised machine

In reality, this group, like many others who try this technique, most likely found an exposed system through the use of common internet scanning tools, like Shodan, and found a way in. Given that most governments are not properly equipped to handle cyber attacks and do not have the proper resources to manage and respond to these types of attacks, as with the recent example of Baltimore, this was a perfect target. By targeting victims in certain industries that don't afford them the benefits of being properly secured, attackers can try and capitalize on these attacks and remain in the news, certainly giving them the fame they desire.

Groups like Shadow Kill Hackers have hit before, and as long as the news and media continue to publicize their information and name, groups will continue to target sites like this in order to gain notoriety. While this group hasn't been incredibly active on Twitter besides talking about their few, disparate attacks on websites, an even smaller, more unknown group "BSB Hackers" commented on the Shadow Kill Hackers Twitter page with comments like "BSB hackers Loading in" and "Look out for BSB Hackers" and even more comically "We will attack your main server". This borders on troll-level tweets and wouldn't be worth commenting on except for the fact that Shadow Kill Hackers replied to them and later deleted the tweets. Shadow Kill Hackers replied back "Waiting for you lol Little kids", which was later deleted, but this reads somewhat like Shadow Kill Hackers may have gotten scared with the publicity and possibly tried to attribute this to another group, by quickly making this random group online that appeared the same week as Shadow Kill Hackers.

Figure 2. BSBHackers engaging with Shadow Kill Hackers on Twitter

It is highly unlikely that two random groups would target or be interested in the city of Johannesburg the same week, with both completely unknown groups talking about this city and attack. Because the Shadow Kill Hackers have deleted their comments, it either seems like they are just going to own up to the attacks now, or they want to distance themselves from this cheap tactic to try and misdirect others from themselves. It is also equally possible that the BSB Hackers are trying to piggyback off the new-found attention for this attack and make a name for themselves indirectly, and not having anything to do with the group, to begin with.

Conclusion

Less sophisticated or motivated attackers will often target companies that can't defend themselves properly, and then try to reap the benefits of this media exposure. However, they rarely succeed in becoming staple groups in the security community due to not being legitimate hackers. Related to the quest for notoriety, most APT’s or sophisticated threat groups rarely publicly claim responsibility for attacks and remain unknown until the victim organization releases news about the attack. With the popularity of internet scanners, it's easier now more than ever to quickly identify potential targets of new vulnerabilities, such as the recent vBulletin vulnerability, allowing attackers to target victims of opportunity, rather than a specific mission. This allows attackers to pick juicier targets which may give them the biggest reward. For instance, attackers leveraged vBulletin exploits against forums that had the most sensitive data, used for blackmailing victims. In the case of this attack, it's possible they figured the city wouldn't be interested in not paying due to the recent cases of this attack and how costly it becomes.

Deep Voice: Removing Trust From a Multi Factor Safeguard

Artificial Intelligence has advanced to such a point where it can now be used to generate fake, but extremely believable recordings of a person's voice. These deepfaked voice recordings, sometimes referred to as "deepvoice" could potentially be used by threat actors to bypass the voice verification processes used by many financial institutions. This could greatly increase an organization's risk of falling victim to financial fraud.

Recommendations

• Consider instituting a callback policy for any conversation regarding the transfer of funds or other sensitive information. This means that upon receiving a phone call requesting this kind of information, the call recipient would hang up, and call back on a line that has been pre-approved for this particular type of conversation with a particular party. Multiple lines may be needed for multiple parties, and specific numbers should be enforced. If a call is received from someone who does not know the correct callback number, sensitive information should not be shared
• Consider enacting a policy requiring a passphrase for any action involving the transfer of funds. Require that any party requetsing fund transfer use this passphrase prior to the sharing of sensitive information or authorization of fund transfer
• Enabling one or both of these policies will help to mitigate the success rate of a deepfaked audio attack

Details

Threat actors are starting to leverage advances in artificial intelligence (AI) to undermine traditional secondary authorization safeguards around wire transfers. Standard best practice to reduce the efficacy of business email compromise (BEC) is to require voice verification of authorized wire transfers. Voice verification is frequently chosen in the financial realm both because it is perceived to be more secure and reduces the risk of human error with wire transfers. This additional confirmation does significantly increase the difficulty for a hacker. By using a voice confirmation, traditionally this means a hacker cannot simply compromise a single email account or even a mail exchange for a successful operation.

However, advances in AI are enabling a revolution in wire fraud. Rather than solely relying on BEC, some hackers are creating deep voice recordings of CEOs and other highly positioned members of companies and using that technology to request wire transfers. This technique is particularly effective for two reasons:

1. Because of the advances in technology, it is practically impossible to distinguish the voice of the real person from these deep fakes; and
2. The phone call requesting the wire transfer bypasses the traditional routes of BEC and plays on the inherent trust people place on voice communication.

Additionally, the perception of voice verification as the premier method for security reduces the likelihood that users of this method will recognize possible security risks

Current technology requires roughly three hours of voice recordings to make a convincing deep voice fake. This audio can be ripped from sources such as:

• Earning calls;
• Interviews;
• Speaking engagements;
• Personal videos; or
• Any other public recording

In order to reduce your organization's risk of falling prey to this kind of attack, ZeroFOX recommends implementing the policies detailed above.

TA505 Disguises Malware for Halloween

TA505 is a financially-focused cybercrime group that has been in existence since 2014. The group recently launched a seasonal spear-phishing campaign which leverages impersonating domains of the file-sharing service Sync in order to host malicious Microsoft Excel files, which act as droppers for additional malware which can then be potentially used to expand TA505-controlled botnets. ZeroFOX Alpha Team has been coordinating with customers and threat-sharing groups who are affected by TA505. Through this coordination, the team has recently observed a change in the group’s spear-phishing techniques as well as their malware obfuscation and packing techniques. TA505 is clearly knowledgeable of Western pop culture - demonstrated most recently by a new campaign focused on Halloween. Specifically, the campaign leverages Halloween as a call to action to get victims to download and run their malware.

Infection Vector

On October 28, 2019, ZeroFOX Alpha Team obtained a malicious XLS file, believed to be a TA505-associated dropper. The dropper was hosted on a website that encouraged users to download the file with a call-to-action referencing today’s holiday, Halloween. Given that this campaign went live on October 27, 2019, when the command and control domain was registered, this appears to have been done deliberately to capitalize on the upcoming holiday. This is similar to previous TA505 campaigns, which have hosted droppers on Dropbox-themed websites. In this case, however, a Dropbox competitor, Sync, is being spoofed. This demonstrates frequent adaptation of delivery methods and utilization of similar products in order to increase chances of a download. The spoofed domain used for this campaign, d1.syncdownloading[.]com, features a landing page very similar in appearance to the legitimate Sync download page, increasing the likelihood that a user will download the file. While refreshing this page, multiple filenames were observed - Haloween_invitation.XLS and IVO292980002.XLS. Both files were obtained, and the functionality was determined to be the same. The Haloween_invitation.XLS file name indicates a level of familiarity with Western pop-culture, capitalized upon to create a level of trust and urgency with their victims.

Figure 1. Sync download link of Halloween-themed malicious XLS file.

XLS Dropper and Obfuscation Method

When downloaded and opened in Excel, the file appears benign and displays a loading image. This image is static and the loading bar does not change no matter the length of time the document is opened.

Figure 2. XLS file as opened in Microsoft Excel.

When a user who has macros enabled opens the dropper file, a series of macros are run to install the dropper, unpack a module to access the C2 server, and make the corresponding C2 call. During our analysis of this file, ZeroFOX Alpha Team did not observe any kind of notification to the user that macros were being run, making it more difficult for a victim to realize they have been infected. Although the command and control server was live at the time Alpha Team began this analysis, no payload was obtained from the C2, preventing further analysis.

The XLS file contains an OLE stream. Embedded within this stream is a Windows INF file. INF files are associated with driver and device installation. This appears to be a legitimate Epson printer driver INF for Windows 7 installation. However, in this case, this INF is used to obfuscate two binaries that have been sandwiched into the driver file. Both of these binaries are Windows DLLs.

Figure 3. Legitimate Windows printer driver config, used to disguise embedded DLLs.

Dropper Functionality and DLL Loading

The macros within the XLS file are used to extract and load these DLLs from the OLE stream within the XLS file. There are two DLLs, as one is intended to be loaded on Windows x32 systems, and the other on Windows x64 systems. Both DLL varieties are encrypted. The DLL extraction function is called DonHuan, potentially a reference to the legendary Spanish libertine who seduced his way through Seville. This function is used to move to a specific offset within the XLS file, which varies by Windows version and therefore DLL version to be extracted, and to verify that the first bytes at this offset are consistent with the Windows executable file header before extracting the DLL.

Figure 4. DonHuan function used to extract DLLs from dropper.

The DonHuan extraction function is called within a second function, called StartRecovery, shown below.

Figure 5. StartRecovery function, calling DonHuan for DLL extraction, DLL loading and ZooDcom exposed function call.

Within this function, the DonHuan function is called to locate and extract the appropriate DLL from the dropper. The file path used to save the DLL to memory is built and saved to a variable called “nm.” This is consistent with other macros seen used by TA505, although the obfuscation methods in this case do differ from previously seen methods. The name of the extracted DLLs is also visible here - “MPCMD1.dll” or “MPCMD2.dll” depending on the version. The path where the extracted DLL will be saved, along with the name of the OLE stream, and the CNPK variable containing the offset of the DLL to be extracted, are passed to the DonHuan function. Finally, a function called ZooDcom is called. This is an exposed function within the DLL, likely used to download additional payloads.

Command and Control Traffic

The dropper analyzed in this research makes an HTTPS request to the domain office-en-service[.]com. A quick whois search on this domain yields an interesting pivot point: the domain registrant has not removed their email address from the whois record. An additional reverse whois for the registered email address returns 20 total domains registered to this email, including googledrive-download[.]com, which was also seen used as a command and control server by related samples. Several of the other domains registered by this email address were also hosting live content, however, a cursory analysis did not indicate malicious activity. The spoofed hosting site of this dropper, syncdownloading[.]com, was not registered to this email, however, and no registrant information was included for this domain. At the time of this posting, none of the related domains are live.

Potential Links to TA505

There are some similarities between the dropper functionality utilized by this sample, and past droppers seen used by TA505. TA505 has been previously observed using droppers containing embedded DLLs, and calling exposed functions from the dropper macros in order to download additional payloads. This pattern is congruent with what ZeroFOX has observed in this campaign. Historically, TA505 also tends to leverage cloud hosting services for dropper distribution. As is the case in this campaign, the group often attempts to spoof legitimate services like Microsoft Office and Google Drive with the command and control domains. TA505 very often modifies both the malware they use, as well as phishing and dropper strategies, however, the similarities between this campaign and past campaigns lead us to believe that this activity can be attributed to TA505.

Conclusion

Attackers change their obfuscation methods often to avoid detection. The obfuscation method seen utilized in this campaign is novel and utilizes an uncommon file format in an attempt to disguise embedded malicious binaries. This campaign also demonstrates a level of awareness of Western pop culture and capitalizes upon a major holiday in an attempt to increase the success rate of the campaign. Although the obfuscation method here is new, similarities between previous TA505 techniques and the technique used in this campaign lead us to believe this activity can be attributed to TA505.

References

[1] https://attack.mitre.org/groups/G0092/

Indicators of Compromise

Malicious Office Documents
fa08f42cc45b6b82dc2f750bcd73ed952e45e8b8e45110d42d2e7a6bb7320332
376bf023723de86e1060596c762cd95c0bf35bc73f448ef5f353b76bf0eca06a
3cf9e4073d1c67a57f1e00f00f416af7cd2f2cbca6e5f3ef6035d41a794905ca
77ab30e099df582576068f38fb4addab31cbde45cf0cc0e781be13e869ffc3c5
ad3d4cc8836b6938a3885cda99728ec9d0211b1bc6bc1074fc8d6cf3ac6d7335
0901d2dc4ef3960827ffd24ba30f2bc388fe20d4ea995524455a251d419094cb
13a75cec7f70250f8f17975b6da7b90f0f03353099a77c27ec093e01acf7d207
45f20f70e00a908a4c6a13e41169973772e37576662a27d71a3b6ff460edbc8d
168f9da2fc50dc58f2975ef12195eea25b465cd8aa84ca4adce4811a14a2372e
26d04d6b98f7556b80a22242f5f867fbf2fbd5c7f31e5b2d4c56d5c6db0b8a59
513d77240a5026385eddc7a0e4c3a896dad45e1da1829f63252090cf50ba5d17
11458b1f464c0d946eca898fb3bf012ee48e37c9be1e40d2155e9e307e762238
fe7c72930907df9ce720c70807615c6f94ecde456d8ebe9e09bbd6fb80013ecc
dc500a4ce70aa31fb4b14a8e9ab76c20a4c7c41ad84c0bb00db0a036599207bf
3be49e4db9e8b82bccbc13448d35456d7afd9370bcf706f80e4317323484b69a
ac25caf7b80e5c7569ab3a736b5bc18658ea1dfb5f5f923a53ce573512632e57
5dfc61698958c0dda9dd0a24b4972614aec731a6df4961ad8e756392415d7205
5d3a1b37eb89789d4296e279b0293ba08f90f491202a5f4db30ce52a35023316
8fea8ee91bdae921e501fce1abd4380292c8a66047e4a8f745c78a84efe02970
9bbfcdca5e7c78e0a2ebc5434ad3ceb43a53adff8a22389a59f5c72b47568b41
6ffc2fbce89e01c594bc9b7bc67172907266d5d4d7434462f1f647994c738d9d

C2 domains
office-en-service[.]com
googledrive-download[.]com
syncdownloading[.]com

IP Addresses
45.142.214[.]119
195.123.245[.]71

File Names
Haloween_invitation.xls
IVO292980002.XLS
MPCMD1.dll
MPCMD2.dll

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/109/list_indicators/

Breaking News: 2019-10-25 - 2019-10-31

Microsoft Phishing Attacks Target United Nations and Charities - BleepingComputer

United Nations and other humanitarian aid organizations have been the target of phishing campaigns since March 2019 according to researchers. The attackers are targeting users through fake Office 365 and Google Docs, with mobile users being targeted as well due to the way phone browsers display truncated URLs. On the phishing sites, there is a keylogger installed so that even if users don't submit forms, the information they type in the page still gets sent back to the attacker controlled domains. These sites also used with valid SSL certificates, adding to the legitimacy of the phishing pages.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-phishing-attacks-target-united-nations-and-charities/

City of Johannesburg hit by ransomware, again

For the second time in 4 months, the largest city in South Africa, Johannesburg has been hit by ransomware and is holding the city for ransom. The Shadow Kill Hackers are demanding 4 bitcoins be paid by Monday or else they claim they'll release the data online. Due to this compromise, authorities shut down all IT infrastructure, including websites, payment portals and other government services.

See the full report here: https://www.zdnet.com/article/city-of-johannesburg-hit-by-ransomware-again/

iBye, bad guy: Apple yanks 18 iOS store apps that sheltered advert-mashing malware

Apple has recently removed 18 applications after they were identified in performing various fraudulent activities, such as click-fraud, opening ads, or changing settings to subscribe to expensive subscription services. All the apps were developed by the India-based company, AppAspect, however, it is not known if the creator knew of the malicious code used in the apps. Previous apps created by AppAspect were found to have malicious code in them as well, however, once notified they were republished and no longer had the code included.

See the full report here: https://www.theregister.co.uk/2019/10/24/apple_clickfraud_takedown/

PHP RCE flaw actively exploited to pop NGINX servers

NGINX servers with PHP-FPM enabled are vulnerable to a new exploit targeting PHP version 7 and later. This new vulnerability was identified in September, and shortly after Proof-of-Concept (POC) code was uploaded to Github. It's confirmed that this exploit targets PHP version 7, however, it seems possible to adapt this to work on versions 5 and later. If certain conditions are met, this exploit code can achieve Remote-Code Execution (RCE) on the target server. Users are advised to upgrade to the latest non-vulnerable version, as well as looking at disabling PHP-FPM if not needed.

See the full report here: https://www.helpnetsecurity.com/2019/10/28/cve-2019-11043/

UniCredit reveals data breach exposing 3 million customer records

The Italian bank, UniCredit, has identified a breach impacting three million customers, which included names, telephone numbers, email addresses, and cities where they were registered. This data breach did not include any financial data or credentials related to access financial data related to client accounts. The client data was apparently obtained by accessing a single file generated in 2015, containing the three million records, however, it is unclear how the file was accessed at this time.

See the full report here: https://www.zdnet.com/article/unicredit-reveals-data-breach-exposing-3-million-customer-records/

TrialWorks Ransomware Attack Disrupts Court Cases and Deadlines - BleepingComputer

One of the top-rated providers of legal case management software, TrialWorks, has become victim of a ransomware attack earlier this month. This attack prevented any lawyers from accessing documents hosted on the platform. Interesting of note that TrialWorks did not publicly state they experienced a breach, but rather emailed all customers informing them of this attack. It appears that TrialWorks ended up paying the ransom and obtained the decryption key, since two days after the attack, TrialWorks announced they were actively decrypting the files. There were a few instances where lawyers needed to ask for extensions for their cases due to not being able to access the site. At this time, no group has been identified as the culprit for this attack.

See the full report here: https://www.bleepingcomputer.com/news/security/trialworks-ransomware-attack-disrupts-court-cases-and-deadlines/

Adobe left 7.5 million Creative Cloud user records exposed online

An exposed Elasticsearch database without a password ended up exposing the customer details of nearly 7.5 million Adobe Creative Cloud users. This database contained information about customer accounts, however, no passwords or financial data was included in the database. Adobe credits a misconfiguration of a prototype environment as the reason for the exposure. While the data itself wasn't of extreme value, the possibility of using this data for further phishing related attacks would be valuable to attackers, if targeting sensitive or high-value Creative Cloud accounts.

See the full report here: https://www.zdnet.com/article/adobe-left-7-5-million-creative-cloud-user-records-exposed-online/

Cybercriminals Impersonate Russian APT Fancy Bear to Launch DDoS Attacks

A cybergrime group apparently owning their own DDoS botnet has been masquerading as the Russian APT group, Fancy Bear, to launch DDoS attacks and get payment from their victims. This group has been asking victims for a payment of 2 bitcoins to stop the attacks, and has been seen targeting back-end servers, due to these servers typically not having DDoS mitigation systems in place, which proves a higher chance of success of taking down sites. While trying to use the popularity of Fancy Bear in their attacks, this does not fit in with their typical victim set or attack type, and seems to just be used for intimidating victims that this attack may be larger scale than it is.

See the full report here: https://threatpost.com/cybercriminals-impersonate-russian-apt-fancy-bear-to-launch-ddos-attacks/149578/

New FuxSocy Ransomware Impersonates the Notorious Cerber - BleepingComputer

A new ransomware has been identified that shares some commonalities with the notorious Cerber ransomware. Discovered by MalwareHunterTeam, this ransomware used names from the popular TV show, Mr.Robot to dub their ransomware, FuxSocy Encryptor. There are numerous similarities between this ransomware and Cerber, most notably, using the same exception list for encrypting files, obfuscating filenames in a similar manner, changing the desktop background to an almost identical background used by Cerber. However, with these similarities, they also differ from Cerber by trying to evade virtual machines running this, as well as only encrypting files at a certain point, making most documents unreadable, however, some files can still display some information, for instance, pictures still showing some of the image.

See the full report here: https://www.bleepingcomputer.com/news/security/new-fuxsocy-ransomware-impersonates-the-notorious-cerber/

Country of Georgia Suffers Widespread Cyberattack

The country of Georgia suffered a widespread cyber attack yesterday. This attack affected over 2,000 websites, where a large percentage of them were defaced with an image of the former Georgian president. The compromised server belonged to a single VPS provider, Pro-Service, and allowed the attackers to deface multiple websites at once.

See the full report here: https://threatpost.com/country-of-georgia-suffers-widespread-cyberattack/149625/

Details for 1.3 million Indian payment cards put up for sale on Joker's Stash

A dump of 1.3 million Indian credit cards were put up for sale on Joker's stash. The cards that were put up for sale were dubbed as "fresh skimmeD" (sic), indicating that these were stolen via a credit card skimming operation. Some of the cards are going for as high as $100, indicating these are high-tier cards and could be used for riskier and larger transactions.

See the full report here: https://www.zdnet.com/article/details-for-1-3-million-indian-payment-cards-put-up-for-sale-on-jokers-stash/

Untitled Goose Game Insecure Deserialization/Code Execution

Honk honk. The chaotic "Untitled Goose Game", which has gained a large cult following it's release, is susceptible to malicious code execution due to how it loads saved game files. The BinaryFormatter deserialization within Mono was used insecurely by the game creators, causing the bug. Surprisingly the company patched the bug and released a fix this month.

See the full report here: https://www.reddit.com/r/netsec/comments/dooxtm/untitled_goose_game_insecure_deserializationcode/

City of Johannesburg, on Second Hit, Refuses to Pay Ransom

The Johannesburg ransomware story continues, now with a public statement that they will not pay the 4 BTC ($30,00 USD) ransom to the cybercriminals that issued the attack. Although the option to pay the ransom is part of the attack, most security professionals recommend not to pay it, as there is no honor among thieves, so the guarantee of a decryption key is slim. This is similar to Baltimore's situation, where the city also refused to pay, leading to outages of services for weeks.

See the full report here: https://threatpost.com/johannesburg-refuses-ransom-pay/149676/

Takeaways from the $566M BriansClub breach

A follow up to the BriansClub breach was posted by Krebs this morning. In this post, he highlights some high level stats about the carding forum. One seller had over 6,000,000 credit card records for sale, adding up to $106 million dollars in product. After disclosing to financial firms, Krebs notes that the larger firms such as Visa and Mastercard had many of the cards flagged, while smaller institutions were surprised that they were breached at all.

See the full report here: https://krebsonsecurity.com/?p=49342

WhatsApp sues NSO Group for Pegasus spyware attack

In a bold move by the tech giant Facebook, their WhatsApp team of privacy lawyers sue NSO Group, a developer of spyware for phones, on their development and deployment of the Pegasus spyware attack. NSO Group is known for working with government agencies and law enforcement to install tracking and spyware software on potential targets. The evidence for attribution to NSO Group was a report generated by Citizen Lab on the Pegasus spyware earlier this year.

See the full report here: https://www.itpro.co.uk/security/34715/whatsapp-sues-nso-group-for-pegasus-spyware-attack

Valve Source Engine, Fortnite Servers Crippled By Gafgyt Variant

Servers hosting software for running video games, such as Fortnite and Valve's Source Eengine, are being targeted by the Gafgyt botnet. The goal of the botnet seems to be renting it out for DDoS attacks. The botnet scans the internet for vulnerable IoT devices and then attempts to exploit them with 3 separate exploits. The botnet was being advertised on Instagram for sale, which includes access to it as well as the source code.

See the full report here: https://threatpost.com/valve-source-engine-fortnite-servers-crippled-by-gafgyt-variant/149719/

New Office 365 Phishing Scams Using Audio Voicemail Recordings - BleepingComputer

A recent phishing campaign published my Mcafee shows prevalent use of audio voicemail recordings as a call to action for victims to enter their credentials into the phishing website. The researchers reported that 3 separate phishing kits were used in the campaign, all affecting Office365.

See the full report here: https://www.bleepingcomputer.com/news/security/new-office-365-phishing-scams-using-audio-voicemail-recordings/

Leading Web Domain Name Registrars Disclose Data Breach

A data breach was disclosed by large domain name registrations Web.com, Network Solutions, and Register.com. These registrars have been in existence for decades, and offer additional services such as web hosting and web design. The breach data did not contain PII, such as passwords or personal payment information, according to the breach disclosures. This was the second breach for Web.com, who experienced a security incident in 2015 that released more sensitive payment card information.

See the full report here: https://thehackernews.com/2019/10/domain-name-registrars-hacked.html