Threat Intelligence Bulletin: 11/29/2019 - 12/05/2019

Imposter Amazon Site Targets Shoppers in India

Alpha Team has identified an imposter Amazon site targeting shoppers in India. This site offers electronics at a steep 98% discount, in order to lure potential victims into entering personal and payment card information which could then be used by this scammer to drain a victim’s bank account, or could be sold on a carding forums for profit.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify that the domain you are visiting matches what you would expect, particularly when clicking through links in web searches
• Always verify the sender of unexpected or suspicious emails, and never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Alpha Team has identified an imposter Amazon website, which phishes for PII and payment card information, targeting Indian customers. The site spoofs the legitimate Amazon.in site, and has gone as far as ripping off the legitimate Amazon.in logo as well as many other design elements of the site. The homepage uses a graphic referencing Diwali, a festival which took place October 27, 2019. The site was registered October 11, 2019, and given that Diwali is long since over, it appears not to have been updated since first created.

Figure 1. Homepage of impersonating Amazon.in site

In order to lure victims into entering their information, the site offers a selection of “Mobile Phones Upto 98% Off.” These prices equate to about $30 USD, which perhaps should be an indication that this is a scam. Clicking on one of these discount phones takes users to a page with an option to “Add Delivery Address.” It is not possible to add multiple items to the cart, and the discount phone links are actually the only elements of the homepage that are clickable.

Figure 2. Page view after adding item to cart

The first phishing page in the checkout process requests various shipping-related information from the victim, like address and phone number. After this information is submitted, the victim is redirected to a payment page.

Figure 3. Payment card information phishing page

This payment page also includes a purchase protection badge, likely intended to assure users who are attempting to make purchases from this site. Finally, after submitting payment information, the user is redirected to a success page, where they are urged to continue shopping.

Figure 4. Purchase success page

Conclusion

Amazon scams are common - but typically, they simply phish for login credentials. This phishing site is interesting in that it imitates an online shopping experience to obtain payment card information from users. Despite being a relatively good impersonation, there are several giveaways that indicate this is a scam site. There are small grammatical errors on the home page, many links aren’t actually clickable, and the shopping cart functionality differs from that of the legitimate Amazon site. Additionally, that electronics are being offered for 98% off, is highly suspicious. To mitigate risk, ZeroFOX recommends following the recommendations detailed above.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/114/list_indicators/

Gift Card Stash Scam Targets Holiday Shoppers

Alpha Team has identified a series of new scam sites that lure victims into divulging personal information in exchange for gift card codes. The sites, which go by the name “Gift Card Stash” or “GC Stash,” claim that they use random number generators along with a validity checker of some undisclosed kind, in order to verify that the card code is genuine. Ultimately, victims never receive cards - they are instead subjected to scam survey purgatory, where they are prompted to enter personal information and answer bogus surveys until they exit the page.

Recommendations

• Use caution when interacting with promotional sites, especially when asked to provide sensitive personal information. If a promotion sounds too good to be true, it probably is. Consider using a separate email for promotional entries
• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify that the domain you are visiting matches what you would expect, particularly when clicking through links in web searches
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

A new gift card scam has popped onto the scene, just in time for the holidays. This time, Twitter bot accounts are being used to push scam websites that claim to generate free, legal ecodes for gaming stores like Nintento eShop, xBox, and Steam. The sites also advertise the same service for Amazon, Sephora, Lowes, PayPal, and many others.

Figure 1. Social media post advertising scam site

Figure 2. Home page of GC Stash/Gift Card Stash sites

Navigating to the link in the post takes users to a site where they are prompted to select the site for which they would like to generate a gift card code, and the amount of their choosing - either $25, $50, or $100.

Figure 3. Users are prompted to choose an amount for the site in question

The gift card amounts remain the same for all options given to the user. Clicking one of these options brings users to a popup that claims to be in the process of generating a code. Ultimately, the user is asked to verify their humanity, and is given a choice of options to do this. Each of these options directs users to a scam survey site, where they are directed to input a variety of personal information and answer dozens of questions. Ultimately, the verification process is never finalized. Users are prompted to answer survey after survey until they get frustrated and exit the page.

Conclusion

Gift card scams spike every year around the holidays, when attackers take advantage of the gift giving season to lure holiday shoppers into falling for these scams. It is always important to keep in mind that promises of something for nothing are likely false promises. Never give personal information out to sites that you have not fully vetted.

IOCs

getprize[.]site
promocodeall[.]com
nucode[.]site
giftcodes[.]pw
gamer-evolution-tools[.]live
itunes[.]codigosmania[.]com
codigosdesteamgratis[.]direzi[.]com
gelatocards[.]com
steamgiftcards[.]mobi
playcode[.]site
paypal[.]freehax[.]cc
amazon[.]playhacks[.]net
spotify[.]playhacks[.]net
codegift[.]club
onlinepromotionsusa[.]com
giftcardstash.xyz
giftcardfree[.]website
gcstash[.]club

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/116/list_indicators/

Breach Disclosure: AgusiQ-Torrents

Polish torrent site AgusiQ-Torrents[.]pl has been breached, exposing the login details of over 90,000 users. Passwords for the site were hashed using the MD-5 algorithm, which has flaws that could be exploited to reveal plain-text passwords. The breach database was offered for sale on RaidForums in October 2019.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Information related to over 90,000 user accounts has been exposed, after Polish torrent site AgusiQ-Torrents[.]pl was breached. Breach data was offered for sale on RaidForums in October 2019.

Figure 1. Sale add, with sample of data, on Raidforums

Exposed data includes email and IP address, username, and MD5-hashed passwords. This is unfortunate for users involved, as there are many security issues in the MD-5 hashing algorithm which allow it to easily be broken, so that plain text passwords could potentially be recovered.

Breaking News: 2019-11-29 - 2019-12-05

Ryuk Ransomware Forces Prosegur Security Firm to Shut Down Network - BleepingComputer

Prosegur, a Spanish multinational security company fell prey to a cybersecurity incident disrupting its telecommunication platform, knocking it offline. The malware strain used in the attack is Ryuk, delivered via Emotet, affecting all Prosegur locations in Europe. The company says that it took maximum security measures to avoid malware propagation internally and to the networks of its clients. As a precaution, the company continues to restrict communications and is fully focused on rebuilding systems and restoring operations.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-forces-prosegur-security-firm-to-shut-down-network/

Upbit cryptocurrency exchange loses $48.5 million to hackers

Upbit, a South Korean cryptocurrency exchange suffered a cyberattack losing $48.5 million in cryptocurrency. 342,000 in Ethereum (ETH), approximately $48.5 million had been stolen from the Upbeat Ethereum hot wallet. Following the attack, deposit and withdrawal services from Upbit were suspended and remaining cryptocurrency in the exchange's hot wallet has been transferred to a hardware-based cold wallet storage system that is not connected to the Internet. The company executives have promised that Upbit assets will cover the stolen funds and customers will not be impacted beyond an estimated two-week timeframe for deposit and withdrawal services to resume.

See the full report here: https://www.zdnet.com/article/upbit-cryptocurrency-exchange-loses-48-5-million-to-hackers/

Adobe discloses security breach impacting Magento Marketplace users

Adobe owned Magento, an E-Commerce platform has disclosed a security breach wherein unauthorized third party has gained access to registered customer’s sensitive information. The attackers have exploited a bug in Magento portal in order to gain access to account holders’ data. The exposed data includes name, email, MageID, billing & shipping address and phone number and other commercial pieces of information. The incident was detected on November 21st, 2019 by the firm and the portal was take down immediately to address the issue. Adobe confirmed that there were no financial data and passwords were compromised. The firm claimed that all the impacted account holders were notified by them.

See the full report here: https://www.zdnet.com/article/adobe-discloses-security-breach-impacting-magento-marketplace-users/

Palo Alto Networks hit by major data breach - TechRadar

Palo Alto Networks, a multinational cybersecurity company suffered a data breach which resulted in the personal data of both past and current employees being leaked online. Around seven current and former employees of the company were impacted. The exposed information includes names, dates of birth and social security numbers of the victims. Affected employees were notified of the breach and the company assures that they have taken steps to the occurrence of similar incidents from in the future.

See the full report here: https://www.techradar.com/news/palo-alto-networks-hit-by-major-data-breach

Beware of Thanksgiving eCard Emails Distributing Malware - BleepingComputer

A new phishing campaign has been discovered wherein Thanksgiving Day greeting cards and office closing notices with last-minute invoices are being sent via emails. If a user opens the malicious Word document attached, they will be presented with a screen asking them to "Enable Content" or "Enable Editing" to properly view it. These Word documents contain obfuscated macros that will either download malware from a remote host or extract it from an embedded payload. Upon clicking the "Enable Content" button, macros will execute and install the malware on the victim's computer. People are advised to never open an unusual attachment and not to enable editing options for a word document unless the request comes from a known address.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-of-thanksgiving-ecard-emails-distributing-malware/

Mixcloud Investigating Alleged Data Breach Impacting 21 Million Users - Motherboard

Mixcloud, a U.K.-based audio streaming platform, is investigating an alleged data breach which provided unauthorized access to over 21 million users' data. The company said that the majority of Mixcloud users signed up via Facebook authentication, where, by default, no password is stored and added that Mixcloud does not store data such as full credit card numbers or mailing addresses. The exposed information includes usernames, email addresses, and hashed passwords. The seller, who goes by the handle "A_W_S," is currently asking for around 0.5 bitcoins, or approximately $4,000, for the data. Mixcloud claims that the user passwords have not been exposed but encourages users to change their passwords across multiple services.

See the full report here: https://www.vice.com/en_us/article/7x5g4q/mixcloud-investigating-data-breach-allegedly-impacting-21-million-users

Hackers have reportedly figured out how to reactivate people's canceled Netflix accounts and start charging them again for monthly subscriptions (NFLX)

Hackers have exploited Netflix's data retention policy to reactivate canceled customer subscriptions and steal their accounts. Netflix stores customer data, including billing information, for ten months after cancellation, to enable a speedy account recovery should a user wish to rejoin. The hackers could log in to dormant accounts and reactivate them without knowing users' bank details. Stolen Netflix accounts have reportedly been found on sites like eBay.

See the full report here: https://www.businessinsider.com/netflix-hackers-reactivating-canceled-accounts-2019-11

Active TrickBot Campaign Observed Abusing SendGrid and Google Docs

PhishLabs researchers have discovered an active Trickbot campaign that leverages SendGrid infrastructure to target multiple industries. Users are lured using fear and curiosity prompt interaction with themes involving termination, meetings with lawyers, customer complaints, and payouts. SendGrid, a popular email delivery platform, is abused to send malicious links to targeted users. The links are redirected to Google Docs which prompts the user to download a secure document. Subsequently, a .exe file is downloaded which installs the Tirckbot malware. It uses various techniques to perform web injections and steal sensitive information. Users are advised to stay vigilant to suspicious emails and immediately report them.

See the full report here: https://info.phishlabs.com/blog/active-trickbot-campaign-sendgrid-google-docs

Fake Steam Skin Giveaway Site Steals your Login Credentials - BleepingComputer

Hackers are promoting fake skin giveaway sites, using Steam, to steal users' login credentials. Steam is a popular video game digital distribution service. These phishing sites are created to give away new skins of popular video games. On visiting the promotional site, the user is tricked to log in to the site using Steam account credentials. Once the attackers gain access to the account, they can perform malicious activities to promote the scam. Users must visit the legitimate domain and report any such fake domains.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-steam-skin-giveaway-site-steals-your-login-credentials/

Data of 21 million Mixcloud users put up for sale on the dark web

Online music streaming service Mixcloud has confirmed a data breach, which is on sale on the dark web. The leaked data included usernames, email addresses, hashed password strings, users' country of origin, registration dates, last login dates, and IP addresses. The breach is suspected to take place on or before 13th November, based on the date of the last user profile. The company has assured the users that the passwords are salted with strong hashing and cannot be decrypted.

See the full report here: https://www.zdnet.com/article/data-of-21-million-mixcloud-users-put-up-for-sale-on-the-dark-web/

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is an open standard for access delegation, used to grant websites or applications access to user information on other websites without giving them the passwords. If this vulnerability is exploited, the victim can experience the theft of sensitive data, compromised production servers, lost data, manipulation of data, encryption of all the organization’s data with ransomware and more. Though the vulnerability has been reported and patched, researchers warn against the misuse or misconfiguration of OAuth 2.0 may have a tremendous impact, allowing for over-privileged third-party applications or the eventual account takeover by malicious attackers.

See the full report here: https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/

Researcher Discovered A Critical Security Flaw In The Truecaller App - Mashable India

Recently, a security researcher has disclosed a flaw in Truecaller mobile application, which could allow attackers to inject malicious links for the profile picture and exploit anyone who visits the profile. attackers can also leverage this vulnerability to steal IP addresses, users' data, scan for open ports to perform attacks including the brute force and distributed denial of service (DDOS). All the versions of the application, including Android, iOS, and web, are affected. Truecaller has addressed this flaw and fixed it immediately.

See the full report here: https://in.mashable.com/tech/8839/researcher-discovered-a-critical-security-flaw-in-the-truecaller-app

Facebook Ads Manager Targeted by New Info-Stealing Trojan - BleepingComputer

A new fake PDF editing software, 'PDFreader,' has been found to be an infostealer in disguise. Upon install, the trojan attempts to steal Facebook sessions cookies from Chrome and Firefox by accessing the Cookies SQLite database. It also connects to various Facebook URLs for extracting sensitive information. The stolen data includes session cookies, access tokens, account ids, advertising email addresses, associated pages, credit card info, PayPal email, ad balances, and spending limits. The trojan also attempts to steal Amazon session cookies.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-ads-manager-targeted-by-new-info-stealing-trojan/

Insecure Database Exposes Millions of Private SMS Messages

Millions of SMS text mmessages have been exposed due to an unprotected database belonging to the American communications company TrueDialog. The database contained details such as full names of message recipients, TrueDialog account details, message content, email addresses, phone numbers of both recipients and account holders, dates and times that messages were sent, message status indicators. Researchers found the exposed database on 26th November, and reported it to TrueDialong. It has since been secured.

See the full report here: https://threatpost.com/insecure-database-exposes-millions-of-private-sms-messages/150706/

StrandHogg Vulnerability Affects All Versions of Android

An Android vulnerability has been discovered, that lets malicious apps hijack legitimate apps, and perform malicious operations on their behalf. If exploited, the bug dubbed as StrandHogg, could grant attackers access to private SMS conversations, photos, and login credentials. Attackers could track a victim's movements, make and/or record phone calls, and spy through the smartphone's camera and microphone, the experts report. The malicious applications exploiting StrandHogg don't directly come from Google Play. Victims have to first download the legitimate application, which serves as a dropper to download future malware. The Google Playstore has suspended the potentially harmful apps.

See the full report here: https://www.darkreading.com/threat-intelligence/strandhogg-vulnerability-affects-all-versions-of-android/d/d-id/1336498

TrickBot Widens Infection Campaigns in Japan Ahead of Holiday Season

Trickbot has expanded from targeting strictly Western countries, to targeting Japanese banks. This campaign has been leveraging Emotet in order to drop the Trickbot banking trojan on victims, and injects malicious code into banking websites to exfiltrate information input to the infected site. This particular campaign is targeting hundreds of Japanese banking URLs, as well as those of a major hotel chai.

See the full report here: https://securityintelligence.com/posts/trickbot-widens-infection-campaigns-in-japan-ahead-of-holiday-season/

Data breach exposed personal info of nearly 6,000 Montgomery County student accounts - WTOP

The personal information of nearly 6,000 students in Montgomery County, Maryland, has been exposed due to a data breach in Naviance software. Breached information includes name, date of birth, gender, address, phone numbers, nickname, GPA and weighted GPA, email address, school counselor, grade level, student ID, SAT and PSAT scores, ACT score and IB score. The suspect, in this case, is a student who gained access to the platform in September. It is believed that the suspect did not share this information with others.

See the full report here: https://wtop.com/montgomery-county/2019/12/data-breach-exposed-personal-info-of-nearly-6000-montgomery-county-student-accounts/

Two malicious Python libraries caught stealing SSH and GPG keys

The Python security team has removed two trojanized Python libraries, namely, "python3-dateutil" which imitated the popular "dateutil" library and "jeIlyfish" (where the first L is an I), which mimicked the "jellyfish" library from PyPI (Python Package Index) that were caught stealing SSH and GPG keys from the projects of infected developers. Both libraries were created by the same developer with username "olgired2017", using a technique called typosquatting to register similarly-looking names. Users of these libraries are advised to change all SSH and GPG keys they've used over the past year.

See the full report here: https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/

Chrome Password Stealer CStealer Uses MongoDB to Store Collected Data - Security Intelligence

CStealer, a new Google Chrome password stealer uses a remote MongoDB database to store its collected data. This technique differs from similar malware, as it leverages hardcoded MongoDB credentials and the MongoDB C Driver to remotely connect and exfiltrate stolen data to a database, rather than the traditional method of sending this data to a command-and-control (C&C) server. To defend against threats like CStealer, researchers recommend using identity and access management (IAM) programs and artificial intelligence (AI)-driven solutions and automated monitoring tools.

See the full report here: https://securityintelligence.com/news/chrome-password-stealer-cstealer-uses-mongodb-to-store-collected-data/

Critical Android Flaw Leads to ‘Permanent DoS’

Google has released an update to address three critical-severity vulnerabilities. The most severe of these issues is a vulnerability in the Framework component that could enable a remote attacker using a specially crafted message to cause a permanent denial of service. The DoS flaw, CVE-2019-2232, has been addressed for devices running on versions 8.0, 8.1, 9 and 10 of the Android operating system. The other two critical flaws tracked as CVE-2019-2222 and CVE-2019-2223, exist in Android’s Media framework on operating systems versions 8.0, 8.1,9 and 10. This framework includes support for playing a variety of common media types so that users can easily utilize audio, video, and images. Successful exploitation could enable a remote attacker using a crafted file to execute code within the context of a privileged process. Patches are available for all three CVEs and users are urged to update as soon as possible.

See the full report here: https://threatpost.com/google-critical-android-permanent-dos-flaw/150764/

HackerOne Breach Leads to $20,000 Bounty Reward

HackerOne has paid out $20,000 bug bounty for discovery of an issue in its own platform, to a vulnerability researcher who discovered a session cookie issue. After "human error" exposed a session cookie, this cookie could have been used by external attackers to access HackerOne platform features, including sensitive vulnerability reports in other products. The issue has since been resolved.

See the full report here: https://threatpost.com/hackerone-breach-20000-bounty-reward/150846/

Ransomware attack hits major US data center provider

CyrusOne, a major data center provider in the US, has been hit by REvil/Sodinokibi ransomware. This is the latest REvil attack in a string of attacks that have targeted hundreds of government and healthcare agencies in the last six months. No public statement has yet been released by CyrusOne.

See the full report here: https://www.zdnet.com/article/ransomware-attack-hits-major-us-data-center-provider/

China resurrects Great Cannon for DDoS attacks on Hong Kong forum

The Chinese government has deployed Great Cannon in massive DDoS attacks against a forum used by Hong Kong protestors to organize. Great Cannon is a tool used to redirect massive amounts of web traffic to targeted websites, resulting in the site crashing if it cannot handle the huge number of requests. The tool has previously been used to target Github, for hosting tools that enabled Chinese users to bypass Chinese government censorship, as well as other sites highlighting Internet censorship. The tool has been attributed to China based on large amounts of shared code between Great Cannon and China's Great Firewall. Additionally, both tools were located on the same servers.

See the full report here: https://www.zdnet.com/article/china-resurrects-great-cannon-for-ddos-attacks-on-hong-kong-forum/

British American Tobacco Suffers Data Breach and Ransomware Attack - Security Magazine

An unsecured Elasticsearch server has exposed over 352 GB of personally identifiable information of people who have entered promotions run by the Romanian branch of British American Tobacco. Information exposed includes name, email and phone number birthdate, gender, and even cigarette and tobacco product preferences. When security researchers discovered this insecure server, they also discovered that it had already been discovered by hackers, who had dropped ransomware that encrypted the data and demanded a bitcoin payment for its release. The company has not released a statement at this time.

See the full report here: https://www.securitymagazine.com/articles/91356-british-american-tobacco-suffers-data-breach-and-ransomware-attack

Iran Targets Mideast Oil with ZeroCleare Wiper Malware

A new wiper malware called “ZeroCleare” has been discovered targeting the energy and industrial sector in the Middle East. Researchers believe ZeroCleare is the work of two Iran-based threat actors, APT34 and Hive0081. The malware has two variants to target both 64 and 32 -bit Windows systems, however, the 32-bit variant is not actually functional. In order to bypass Windows safeguards, ZeroCleare uses the legitimate EldoS RawDisk driver to overwrite the master boot record (MBR) and disk partitions. The attackers also gain access to multiple network accounts by brute-forcing the passwords and dropping both China Chopper and Tuna web shells by exploiting unnamed SharePoint vulnerability. They also use Team Viewer, and a Mimikatz variant to exfiltrate credentials from an infected system.

See the full report here: https://threatpost.com/iran-mideast-oil-zerocleare-wiper-malware/150814/