Threat Intelligence Bulletin: 01/24/2020 - 01/30/2020

Tout Breach Advisory

On Saturday, January 25th information about a 2014 breach of a now-defunct social media site called Tout began circulating. The breach activity contains information that could give a bad actor the ability to pivot to other accounts because of password reuse.

Recommendations

• Enable 2-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance

Details

In 2014 Tout suffered a data breach of 650k accounts. The method of the breach is not known. On January 25th, 2020 the breach data started circulating on forums that specialize in breach data.

The breach contains:

• Username
• Password hash in bcrypt
• Login IP of user
• Location of user
• Bio of user

DailyObjects Breach Advisory

During January of 2018, more than 464,000 customer records were leaked online from the Indian retailer DailyObjects. This data included names, physical addresses, email addresses, phone numbers, and PIN codes stored in plain text.

Recommendations

• Enable 2-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance

Details

Sometime during January of 2018, the online retailer DailyObjects suffered a data breach and more than 464,000 customer records were posted online. It is not known at this time how this breach occurred, as DailyObjects has not commented on this matter.

The breach included various customer information in plain text, which included names, physical addresses, email addresses, phone numbers, and PIN codes.

Oski Stealer Malware Research Report

ZeroFOX Alpha Team has analyzed recent reporting on the Oski Stealer malware and released this advisory which serves as an overview of this malware and the potential threats it may pose. There was a recent tweet from a security researcher who linked to this admin panel being used by the Oski Stealer malware, which prompted our investigation. Oski Stealer malware appears to have been around since at least August of 2019, with screenshots of the first version being included in various news outlets. Around 2 months ago however, a new administration panel has been identified being circulated.

Details

This malware is designed to steal a variety of sensitive information, with some pre-defined data types, such as credentials, credit card numbers, crypto currency wallets. In addition, attackers who deploy this malware and use the Oski Stealer admin panel can configure the malware to steal any number of file types or site information using customizable rules in the admin panel. It uses a variety of methods to extract this data, most commonly through the Windows registry, from the SQLite databases that the browsers use, extracting session cookies or through browser hooks using DLL injection.

The new Oski Stealer admin panel we are seeing, features an enhanced dashboard which gives controllers a "single pane of glass" view of their victims, including total number of logs, number of passwords captured, top infected countries, top sites that users viewed, and top browsers used by victims. Controllers can then use the log viewer to view individual victim captures, including any crypto wallets captured or passwords for various sites being used or specify what sites to capture using "Marker Rules". This malware will also include the contents of the user's desktop or other file folders that the controller would specify in the "Grab Rules" section of the admin panel.

Figure #1 Login Panel for Oski Stealer

Due to the hardcoded domain included in the malware, we identified a related VirusTotal sample, which can be used for further context on this threat. Most notably, you can see the various files opened/written, files dropped, modified registry keys, and process/service actions happening on the infected Windows machine.

This malware has been relatively successful due to not needing admin rights to be installed, and being able to be ran on x86 and x64 versions of Windows 7, 8, 8.1, and 10. In the panel our team had access to, we identified numerous countries being targeted, with victims being heavily from the United States, and with credentials ranging from social networks to banking and gaming sites. There was only 1 victim out of the ~300+ victims we saw that had crypto related information being stolen, however, almost all of the victims we saw had username and passwords stolen.

Figure #2 Admin Panel for Oski Stealer

Conclusion

Due to the broad number of victim architectures targeted, the ease of use of the admin panel by attackers, and the type of data collected from victims, this malware could pose a relevant threat to customers of ZeroFOX. Attackers can quickly and easily identify stolen social media or email credentials which could allow for further pivoting into your company or to be used in other attacks.

Breaking News: 2020-01-24 - 2020-01-30

Shlayer, No. 1 Threat for Mac, Targets YouTube, Wikipedia

Shlayer, a malvertising-focused trojan is targeting YouTube and Wikipedia to spread malicious code. Shlayer's main purpose is to fetch and install various adware variants. According to Kaspersky's research, the malware operators promise website owners to monetize their sites in exchange for pushing malicious links pointing to Shlayer downloads. Overall, Shlayer is being hosted for download on 700 different domains.

See the full report here: https://threatpost.com/shlayer-mac-youtube-wikipedia/152146/

Buchbinder Car Renter Exposes Info of Over 3 Million Customers - BleepingComputer

Security Researcher, Matthias Nehls discovered an unsecured MSSQL database containing the personal details of over 3.1 million customers of a German car rental company, Buchbinder. The database contained more than 5 million files that exposed customer names, emails, phone numbers, addresses, dates of birth, license numbers, and financial information. Some of the exposed records also included employee and online portal user passwords. Following the incident, the company immediately secured the database.

See the full report here: https://www.bleepingcomputer.com/news/security/buchbinder-car-renter-exposes-info-of-over-3-million-customers/

U.S. Gov Agency Targeted With Malware-Laced Emails

A phishing campaign called Fractured Statue targeted a U.S. government agency with emails harboring several malware strains, including a new malware downloader called Carrotball. The spear-phishing emails contained six unique malicious attachments from four different Russian email addresses to 10 unique targets. The subject matter of the lures featured articles written in Russian about ongoing geopolitical issues surrounding North Korea. Once downloaded, the malicious attachments attempted to infect victims with several malware families. One of the malicious documents also included Carrotball, whose sole purpose was to facilitate the download and installation of the SysCon backdoor.

See the full report here: https://threatpost.com/u-s-gov-agency-malware-laced-emails/152141/

Critical, Unpatched ‘MDhex’ Bugs Threaten Hospital Devices

Researchers at CyberMDX have discovered a set of six critical cybersecurity vulnerabilities dubbed as MDhex in a range of GE Healthcare devices for hospitals. These flaws could allow attackers to disable the devices, harvest personal health information (PHI), change alarm settings and alter device functionality. If exploited, these vulnerabilities could directly impact the confidentiality, integrity, and availability of devices. While no patches exist so far, users are urged to segregate the network, change the default passwords and follow other best practices to mitigate the risks.

See the full report here: https://threatpost.com/critical-mdhex-bugs-ge-medical-devices/152163/

DOS Exploit PoC Released for Critical Windows RDP Gateway Bugs - BleepingComputer

A Danish security researcher has released a Proof-of-Concept(PoC) denial of service(DoS) exploit for the CVE-2020-0609 and CVE-2020-0610 flaws collectively called as BlueGate affecting the Remote Desktop Gateway (RD Gateway) component on Windows Server. The DoS PoC comes with a built-in scanner for checking if the device is vulnerable to BlueGate exploitation attempts. These two vulnerabilities were patched by Microsoft as part of the January Patch Tuesday. Although there are no signs of attackers actively scanning for vulnerable RDP gateway servers, users are urged to install the security updates issued by Microsoft to defend against potential future attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/dos-exploit-poc-released-for-critical-windows-rdp-gateway-bugs/

Cisco Webex Flaw Lets Unauthenticated Users Join Private Online Meetings

A vulnerability has been reported in the Cisco Webex video conferencing platform which could allow an unauthenticated remote attacker to enter a password-protected meeting. The flaw is tracked as CVE-2020-3142 and has the CVSS score 7.5. Cisco fixed this vulnerability in versions 39.11.5 and later for Cisco Webex Meetings Suite sites and 40.1.3 for Cisco Webex Meetings Online sites.

See the full report here: https://threatpost.com/cisco-webex-flaw-lets-unauthenticated-users-join-private-online-meetings/152191/

New Ryuk Info Stealer Targets Government and Military Secrets - BleepingComputer

MalwareHunterTeam has discovered a new variant of the Ryuk ransomware with an upgrade to steal confidential files related to the military, government, financial statements, banking, and other sensitive data with new features such as content scanning and keyword matching. The previous Ryuk stealer scanned computer's files for .docx and .xlsx files, but this new version of the stealer looks for .cpp, .h, .xls, .xlsx, .doc, .docx, .pdf, wallet.dat, and .jpg files and if a file matches one of the above extensions, the stealer will check the file names and content to match with its keywords. Upon finding a matching document, the malware will upload it to an FTP site that is under the attacker's control.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ryuk-info-stealer-targets-government-and-military-secrets/

Trend Micro antivirus zero-day used in Mitsubishi Electric hack

Japanese multinational electronics and electrical equipment manufacturing company, Mitsubishi Electric, was hacked and confidential files were stoled by a Chinese hackers group known as Tick. The company detected an intrusion on its network on June 28, 2019. According to the sources, the hackers exploited CVE-2019-18187, a directory traversal, and arbitrary file upload vulnerability in the Trend Micro OfficeScan antivirus. Trend Micro issued the patch for the vulnerability, back in October 2019, and warned customers that the vulnerability was being actively exploited by hackers in the wild.

See the full report here: https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/

City of Potsdam Servers Offline Following Cyberattack - BleepingComputer

The City of Potsdam, Brandenburg, fell victim to a cyberattack earlier this week and was forced to take its administration systems offline after noticing unauthorized access to the Potsdam administration's servers. All online-based applications of the city administration, including the service facilities relevant to citizens are currently unusable. It is speculated that the unpatched Citrix servers could have been an entry point for the attackers to install the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/city-of-potsdam-servers-offline-following-cyberattack/

Magecart gang arrested in Indonesia

Interpol and Indonesian police have arrested three suspicious men, involved in Magecart cyber attacks. Magecart attacks are known for web skimming, where hackers planted malicious JavaScript to steal payment card information. The suspects were only identified by their initials: ANF (27 years), K (35 years), and N (23 years), from regions of Jakarta and Yogyakarta. Accroding to the investigation, the group has been active since 2017 and have infected approximately 571 websites.

See the full report here: https://www.zdnet.com/article/magecart-gang-arrested-in-indonesia/

Google, Mozilla Ban Hundreds of Browser Extensions in Chrome, Firefox

Both Google and Mozilla are tracking down web browser extensions that steal user data and carry out other malicious actions. Browser extensions are add-ons, installed on the browser, to enhance web surfing experience. Google has detected an exponential increase in Chrome extensions involved in fraudulent transactions. As a temporary measure, the extensions with monetary components are disabled. Subsequently, Mozilla has also disabled 197 Firefox add-ons that are involved in remote-code execution and data harvesting.

See the full report here: https://threatpost.com/google-mozilla-ban-browser-extensions-chrome-firefox/152257/

Microsoft's IE Zero-day Fix is Breaking Windows Printing - BleepingComputer

Microsoft's temporary fix for a zero-day remote code execution vulnerability in Internet Explorer is causing numerous problems in Windows. The fix involves changing the owner of the %windir%\system32\jscript.dll and denying access to the file for the Everyone group. Along with causing printing to fail on HP printers and other USB printers, 0patch discovered that Microsoft's mitigation also caused issues such as Windows Media Player is reported to break on playing MP4 files, the sfc (Resource Checker) chokes on jscript.dll with altered permissions, printing to "Microsoft Print to PDF" is reported to break, proxy automatic configuration scripts (PAC scripts) may not work.

See the full report here: https://www.bleepingcomputer.com/news/security/microsofts-ie-zero-day-fix-is-breaking-windows-printing/

Hackers hijack social media accounts for the NFL and 15 teams

The social media accounts of the NFL and 15 of its teams were hacked and defaced by a Saudi hacker group, OurMine. OurMine crew is known for hijacking the social media accounts of high-profile celebrities and tech CEOs. Currently, details of how the defacements took place are unclear. However, a large portion of the tweets posted by the OurMine crew on the hijacked accounts are coming from Khoros, a web service used by digital marketing and public relations departments to manage social media accounts and gauge social media engagements.

See the full report here: https://www.zdnet.com/article/hackers-hijack-twitter-accounts-for-chicago-bears-and-green-bay-packers/

Tampa Bay Times hit with Ryuk ransomware attack

Florida newspaper, Tampa Bay Times suffered a Ryuk ransomware attack. Sensitive customer information such as subscriber addresses and credit card details, was not disclosed in the breach. The newspaper has successfully restored its primary systems and is working on further preventative measures.

See the full report here: https://blog.malwarebytes.com/ransomware/2020/01/tampa-bay-times-hit-with-ryuk-ransomware-attack/

Zoom Bug Could Have Let Uninvited People Join Private Meetings

According to Check Point Research, the video conferencing platform, Zoom, was vulnerable to a security flaw that could allow unauthorized and uninvited people to remotely eavesdrop on unprotected active meetings, potentially exposing private audio, video, and documents shared throughout the session. Zoom has patched the security loophole and has added security features and functionalities such as default passwords, account and group level password enforcement, meeting ID validation, and device blocker to prevent future risks.

See the full report here: https://thehackernews.com/2020/01/zoom-meeting-password.html

Wawa card breach may rank as one of the biggest of all times

Card details of more than 30 million Wawa customers' are put up for sale on the internet's largest carding fraud forum, Joker's Stash. According to Gemini Advisory, the Wawa card dump seems to include 30 million US records across more than 40 states and over one million non-US records from more than 100 different countries. Currently, Joker's Stash team is selling the details of US-issued cards with $17/card, on average, while data for international cards are priced at a higher $210/card.

See the full report here: https://www.zdnet.com/article/wawa-card-breach-may-rank-as-one-of-the-biggest-of-all-times/

Emotet Uses Coronavirus Scare to Infect Japanese Targets - BleepingComputer

In a new malspam campaign, Emotet payload emails are delivered to victims from Japan, including Gifu, Osaka, and Tottori. These emails are camouflaged as official notifications from disability welfare service providers and public health centers to provide preventative measures against coronavirus infections, within the attachments. The email attachment is a malicious Word document which prompts the victims to click on “Enable Content”, upon which a malicious macro launches a PowerShell command that installs Emotet. The infected computer will further be used to deliver malicious spam messages to other targets and to drop other malware strains such as the Trickbot Trojan.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-uses-coronavirus-scare-to-infect-japanese-targets/

Critical Flaws in Magento e-Commerce Platform Allow Code-Execution

Three recently-patched critical vulnerabilities: CVE-2020-3716, CVE-2020-3718, and CVE-2020-3719 in Adobe’s Magento e-commerce platform could lead to arbitrary code execution. These updates are likely of interest to Magecart groups, who could look to exploit the flaws ahead of administrators applying the patches. Administrators are urged to update their websites to prevent future risks.

See the full report here: https://threatpost.com/critical-flaws-magento-ecommerce-code-execution/152343/

Ring Doorbell App for Android Caught Sharing User Data with Facebook, Data-Miners

According to the Electronic Frontier Foundation (EFF), Amazon’s Ring Doorbell app for Android was caught sending customer information to data analytics and marketing companies without meaningfully notifying the customers. Information such as real-time data on user interactions with the app, personally identifiable information (PII), device and carrier data, unique identifiers that allow companies to track users across apps, and information about a user’s home network was sent to data analytics and marketing companies such as Branch, MixPanel, AppsFlyer, and Facebook.

See the full report here: https://threatpost.com/ring-sharing-user-data-facebook-data-miners/152300/

Ragnarok Ransomware Targets Citrix ADC, Disables Windows Defender - BleepingComputer

A new ransomware dubbed Ragnarok is targeting unpatched Citrix ADC servers vulnerable to the CVE-2019-19781 exploit. Ragnarok attempts to disable the Windows Defender by adding Windows group policies, clear Shadow Volume Copies, disable Windows automatic startup repair and turn off the Windows Firewall. The encrypted files are appended with the .ragnarok extension. A ransom note called "!!ReadMe_To_Decrypt_My_Files.txt." is left in every traversed folder.

See the full report here: https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-targets-citrix-adc-disables-windows-defender/