Threat Intelligence Bulletin: 01/31/2020 - 02/06/2020

WaWa Exposes Over 30 Million Payment Cards

In late December 2019, WaWa, the US-based convenience store and gas station chain, reported its payment systems had been compromised for a period of 9 months. This compromise resulted in the exposure of over 30 million payment cards. On January 27, 2020, a large bundle of full payment card details was offered for sale on the carding and fraud forum Joker’s Stash. It is highly likely these payment details were exfiltrated from compromised WaWa payment systems.

Recommendations

• If you have made a purchase at a WaWa location between March 2019 and December 2019, consider cancelling and replacing payment cards
• Continue monitoring the Alpha Team Tab for additional updates on this data breach. If you have specific questions regarding this breach, or on the criminal forums we monitor, reach out to [email protected] for assistance

Details

Joker’s Stash is a criminal fraud forum, where payment card details from various data breaches are offered for sale. The cards are offered for sale individually, with pricing ranging from $50 - $100 on average. When Joker’s Stash replenishes their card offerings, they often publish an announcement on their forum, intended to generate buzz on the site over new card offerings.

Figure 1. Announcement of most recent payment card dump on Joker’s Stash

Most often, payment card data breaches are a result of point of sale, or POS breaches. POS systems are highly attractive targets to attackers because of the payment information that flows through these systems. Despite this, POS systems are particularly vulnerable to malware as they are generally difficult to update, and tend to run old versions of operating systems. For this reason, POS malware can utilize legacy exploits in order to drop additional modules to steal this payment card information.

The payment card drop that likely contains details from the WaWa breach includes full card numbers, cardholder name, and expiration dates. Card PIN numbers and CVV codes were not included in the compromise. For this reason, these cards may be more difficult for would-be fraudsters to use. It is also important to note that the Joker’s Stash dump only includes a portion of the 30 million breached cards. The remainder of card details may be released in waves, or they may never be released at all.

Exploiting World-Wide Crises for Phishing Attacks

With news of the recent coronavirus impacting China and spreading to other countries, more and more people are worried about the threat that this poses to them and their families. Threat actors have capitalized on this widespread fear to lure potential victims into clicking on malicious emails or visiting malicious websites.

Recommendations

• Remain vigilant for suspicious emails that may be targeting worldwide issues like the coronavirus
• Ensure you have standard defenses configured in your organization (i.e. 2FA, Anti-Virus/Malware, not reusing passwords, etc.)

Details

Threat actors always try to develop enticing lures for victims to engage with their emails or websites, and with something as widespread and potentially devastating as the coronavirus, they are bound to have some success with this over general lures used. This tactic does not have to be focused on a particular geographic area, however, we would assume that most of this would be directed to the main areas that are impacted. It is possible however for the actors to target places that have not been hit with this virus yet, which could potentially cause more panic since this could signify that the virus has spread.

Along with any convincing lure by threat actors, the more convincing or relevant news or “call to action” that these actors can use, the more successful they could be. Using something that is potentially deadly to individuals like the coronavirus is a great tactic by attackers since there are potential consequences associated with this threat, as opposed to phishing emails saying that someone’s social media account has been compromised.

Figure 1. Breakdown of the types of domains seen registered using names associated with the coronavirus

Some samples have been identified in VirusTotal that are being used by the Patchwork APT group that targets victims located in China with coronavirus lores. The initial vector of delivery is not known, however, there are a few variations of filenames which get dropped on the victim machine, including:

Application Form.xlsm (申请表格.xlsm) Wuhan Travel Information Collection Application Form.xlsm (武汉旅行信息收集申请表.xlsm) Application form for collecting health readiness information.xlsm (收集健康准备信息的申请表.xlsm) Diagnosis and prevention of pneumonia caused by a new coronavirus infection.xlsm (新型冠状病毒感染引起的肺炎的诊断和预防措施.xlsm) Ministry of Health Directive.docx (卫生部指令.docx)

These files above are related to the IP address 45.153.184[.]67, with the files listed above communicating with this IP address, which is a VPS provider located in Cyprus. Additionally, samples related to this malware were seen being hosted on 185.193.38[.]24 as well, which is another hosting company, located in Germany.

Figure 2. VirusTotal graph of IP hosting malicious samples related to coronavirus

Conclusion

The impact of attackers capitalizing on this virus is similar to other phishing emails or malicious sites, in that they are trying to get victims to interact with their email or website in order to compromise them. The only difference here is that this could be more successful than other campaigns using traditional lures to entice victims.

Attackers will always try to think of new methods and ways to get victims to interact with their content. When major world events occur, it's best to trust but verify news you are seeing, and being aware that attackers will most likely try to use the news as a method for getting victims to view their content.

Breaking News: 2020-01-31 - 2020-02-05

DOD contractor suffers ransomware infection

Electronic Warfare Associates (EWA), an eminent US government contractor, suffered a ransomware infection. The ransomware, suspected to be Ryuk, encrypted the company's systems including its web servers. According to security researchers, EWA Government Systems Inc., EWA Technologies Inc., Simplicikey, Homeland Protection Institute are among the impacted sites. Currently, it is not known how much of the company's internal network was encrypted during the incident.

See the full report here: https://www.zdnet.com/article/dod-contractor-suffers-ransomware-infection/

NEC Defense Contracts Info Potentially Compromised in Breach - BleepingComputer

The Japanese NEC electronics giant suffered a cyberattack, resulting in unauthorized access to its internal network. Supposedly, 28,000 files were found by the company on one of the compromised servers and some of them contained defense equipment info such as submarine sensors. However, the Japanese Ministry of Defense said that the exposed files contained information on contracts with NEC, not defense secrets, and there is no impact on Japan's defense system.

See the full report here: https://www.bleepingcomputer.com/news/security/nec-defense-contracts-info-potentially-compromised-in-breach/

U.N. Hack Stemmed From Microsoft SharePoint Flaw

The United Nations network reportedly suffered a data breach back in July 2019, giving the hackers access to nearly 400 GB of sensitive data. According to reports, the hackers exploited a Microsoft SharePoint remote code-execution vulnerability (CVE-2019-0604) which was patched by the vendor but the U.N. reportedly had not updated its systems. However, the U.N. claims that no sensitive data was accessed in the data breach and immediate actions were taken to shut down the affected development servers.

See the full report here: https://threatpost.com/un-hack-microsoft-sharepoint-flaw/152378/

Avast Shuts Down Jumpshot After Getting Caught Selling User's Data - BleepingComputer

Jumpshot, a subsidiary of Avast, has been collecting user data and selling it to other companies. The user data possibly included Google searches, watched videos, visited sites, and downloaded files. Avast announced that they are shutting down Jumpshot and also stated that the subsidiary was 100% GDPR compliant and operated independently with its own management and board of directors who built their services from the data feed shared by Avast.

See the full report here: https://www.bleepingcomputer.com/news/security/avast-shuts-down-jumpshot-after-getting-caught-selling-users-data/

Firefox now shows what telemetry data it's collecting about you

A recent enhancement to Firefox is a special page that allows users to see telemetry data collected from their browser. Technical information such as browser settings, installed add-ons, OS/hardware information, browser session details, and running processes can be viewed from the page. This new feature is accessible by typing "about:telemetry" in the browser's URL address bar and can be disabled by navigating to "about:preferences#privacy" in the "Firefox Data Collection and Use" section.

See the full report here: https://www.zdnet.com/article/firefox-now-shows-what-telemetry-data-its-collecting-about-you/

Evil Corp Returns With New Malware Infection Tactic

The operators of the Evil Corp, also known as TA505 or Dudear, are back in action after a short break. Evil Corp is presently using new HTML redirection techniques to distribute malware. Microsoft observed emails from the cybercriminal gang utilizing HTML redirectors. It is unclear whether these HTML redirectors are URLs in the body of the email itself or if they are embedded into an attachment to the email. Regardless, once they are clicked on, they automatically download a malicious Excel file. Next, if the victim “enables editing” in the Excel file, the final payload, GraceWire trojan, an infostealer is dropped.

See the full report here: https://threatpost.com/evil-corp-returns-with-new-malware-infection-tactic/152430/

Ransomware hits TV & radio news monitoring service TVEyes

TVEyes, a popular platform for monitoring TV and radio news, suffered a ransomware attack on January 30, 2020. Core server & engineering workstations inside TVEyes' network were affected through the attack, as a result of which, newsrooms, political campaigns, and PR agencies lost access to the platform. Presently, the ransomware strain that infected the company's network has not been identified. The company's CEO, David Ives, said that they do not intend to pay the ransom demand and are currently restoring from backups and rebuilding impacted infrastructure.

See the full report here: https://www.zdnet.com/article/ransomware-hits-tv-radio-news-monitoring-service-tveyes/

Microsoft Offers Free Windows 10 VMs for Edge Legacy Testing - BleepingComputer

For those who no longer have Microsoft Edge Legacy and Internet Explorer 11 or want to test from another operating system, Microsoft has released a free Windows 10 virtual machine that has these browsers installed. Once imported, you can start the virtual machine and have a fully functional Windows 10 machine with Internet Explorer 11 and Microsoft Edge Legacy preloaded. Users will have 90 days to use the virtual machine, once activated. Microsoft has released the Chromium-based Microsoft Edge and will eventually install it via Windows Update. As part of this installation process, Microsoft Edge Legacy will also be removed unless the user blocks the Windows Update from doing so.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-offers-free-windows-10-vms-for-edge-legacy-testing/

New Intel Microcodes for Windows 10 Released to Fix CPU Bugs - BleepingComputer

As previous Microcode updates have caused performance issues on older CPUs or system hangs in the past, Microsoft has released a new Intel Microcode update for Windows 10 1909, 1903, and older versions that contains software fixes for hardware bugs in Intel CPUs. Intel Microcode updates are not installed via Windows Update and must be installed manually. This allows Intel to fix, or at least mitigate, security flaws such as speculative execution vulnerabilities or bugs that are discovered after a CPU has been manufactured. When installing the update, Microsoft will require the user to restart the computer.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-intel-microcodes-for-windows-10-released-to-fix-cpu-bugs/

Hackers are hijacking smart building access systems to launch DDoS attacks

Hackers are actively searching the internet and hijacking smart door/building access control systems, which they are using to launch DDoS attacks. The attackers are scanning for exposed NSC Linear eMerge E3 devices and using one of the ten vulnerabilities. Linear eMerge E3, a product of Nortek Security & Control (NSC), are access control systems that are installed in organizations to control what doors and rooms employees and visitors can access based on their credentials (access codes) or smart cards. In May 2019, ten vulnerabilities were disclosed impacting NSC Linear eMerge E3 devices. NSC is yet to provide patches for vulnerable devices. Attackers are exploiting the vulnerability "CVE-2019-7256" to inject commands and take control of the system. System administrators managing networks where NSC Linear eMerge E3 devices are installed are advised to take these systems off the internet, or at least limit access to these devices using a firewall or VPN.

See the full report here: https://www.zdnet.com/article/hackers-are-hijacking-smart-building-access-systems-to-launch-ddos-attacks/

Coronavirus Phishing Attacks Are Actively Targeting the US - BleepingComputer

An ongoing phishing campaign is leveraging the recent coronavirus outbreak to conduct phishing attacks in the US. In one of the phishing emails spotted by KnowBe4 researchers reveal that attackers promise to provide a list of active infections in the surrounding area to trick their potential victims into clicking a link embedded in the message and leading to a credential phishing page. On clicking, users are redirected to an attacker-controlled and Outlook-themed phishing landing page used for collecting and stealing user credentials. Another phishing campaign spotted by Mimecast lures the recipients to "go through the attached document on safety measures regarding the spreading of coronavirus." Users are urged to download a malicious PDF designed to infect their computers with a malware payload. Users are advised to stay vigilant to email communications in relation to staying safe and protected from the coronavirus and adopt cyber hygiene practices.

See the full report here: https://www.bleepingcomputer.com/news/security/coronavirus-phishing-attacks-are-actively-targeting-the-us/

Devious Spamhaus Phishing Scam Warns Your on an Email Block list - BleepingComputer

In a new phishing campaign discovered by ProofPoint researchers, hackers are distributing malware by sending emails that pretend to be from the Spamhaus project. Spamhaus Project is an organization that creates spam block lists that mail servers can utilize to block known spammers from sending emails to recipients in their organization. The phishing email warns the recipient that their email address has been added to the Spamhaus Block List (SBL) and will be blacklisted on mail servers unless they follow the instructions found at a listed URL. The URL contains a Google drive link and a password. On clicking the link, a password-protected file embedded with an obfuscated Visual Basic Script (VBS) is downloaded. The VBS script is launched to install Ursnif malware executables. The malware steals all the data, gathers login credentials, and further compromises a victim's accounts or even their network. Users must be vigilant to the incoming mails and scan the attachments before opening it.

See the full report here: https://www.bleepingcomputer.com/news/security/devious-spamhaus-phishing-scam-warns-your-on-an-email-block-list/

Twitter Fixed Issue Exploited to Match Phone Numbers to Accounts - BleepingComputer

Twitter has tracked down a large network of fake accounts that exploited the Twitter API by matching usernames to phone numbers, mostly coming from IP addresses within Iran, Israel, and Malaysia. A feature in the Twitter API allows new accounts to find their friends through phone numbers. Attackers have leveraged this feature to query users that have their phone numbers associated with their accounts and also have enabled the 'Let people who have your phone number find you on Twitter' option in their Settings. Twitter suspended involved accounts and fixed the security flaw affecting the API endpoint.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-fixed-issue-exploited-to-match-phone-numbers-to-accounts/

Magecart group jumps from Olympic ticket website to new wave of e-commerce shops

The Magecart group is targeting a new set of websites referencing a single set of malicious domain hosting the OpendoorCDN skimmer code. This code has been used in the past to target several e-commerce websites to steal consumer payment card details. An analysis of the code revealed new files, out of which one is a replica of the original skimmer with altered variable names and a different hash, whereas, the other is a packed .NET binary that is a version of the Coalabot botnet. Researchers also found that the websites have been infected since October, the skimmer was hosted by a Russian hosting provider, Selectel, and the domain name was registered by a Chinese company called Webnic. As of now, the malicious domain has been suspended.

See the full report here: https://www.zdnet.com/article/magecart-group-jumps-from-olympic-ticket-website-to-new-wave-of-e-commerce-shops/

Mysterious New Ransomware Targets Industrial Control Systems

According to researchers at Sentinel One and Dragos, Snake or EKANS is created to target industrial control systems and appears to be the work of cybercriminals, rather than nation-state hackers. EKANS is designed to terminate 64 different software processes on victim computers, including many that are specific to industrial control systems. The ransomware encrypts data and displays a note to victims demanding payment to release it; the name comes from a string it plants as a file marker on a victim computer to identify that its files have already been encrypted. EKANS poses dangerous consequences, such as preventing staff from remotely monitoring or controlling the equipment's operation.

See the full report here: https://www.wired.com/story/ekans-ransomware-industrial-control-systems/

Bouygues Construction Shuts Down Network to Thwart Maze Ransomware - BleepingComputer

Bouygues Construction, a French construction company was paralyzed by a cyberattack on January 30th, 2020. The company shut its network down to avoid having all of their data encrypted by the Maze Ransomware. The operators of Maze Ransomware claim to have encrypted 237 computers and over 1,000 Terabytes of data. The company states that construction activities have not been disrupted. As of now, it is unclear as to how the systems were infected and how much data was stolen from Bouygues Construction.

See the full report here: https://www.bleepingcomputer.com/news/security/bouygues-construction-shuts-down-network-to-thwart-maze-ransomware/

'Hack' Creates Fake Google Maps Traffic Jams With 99 Cell Phones - BleepingComputer

Simon Weckert, a German artist, created a virtual traffic jam in Google Maps using a hand cart filled with 99 active cell phones connected to Google Maps by simply walking around the streets of Berlin. Google Maps perceived cell phones to be a traffic jam due to a large number of devices reporting the same slow speed and turned a green street red. This could pose security consequences as threat actors can use this type of data manipulation to reroute vehicles down specifically chosen routes rather than ones defined by valid traffic data.

See the full report here: https://www.bleepingcomputer.com/news/software/hack-creates-fake-google-maps-traffic-jams-with-99-cell-phones/

Malware stew cooked up on Bitbucket, deployed in attacks worldwide

Threat actors are actively delivering an "unprecedented number of malware types" in a new international attack wave, according to Cybereason researchers. All of the malware has been hosted on Bitbucket, a web-based version control repository hosting service. With an array of user-profiles being used updated regularly, it is difficult to have users reported and malicious files removed. According to the report, over 500,000 machines have been infected by malware used in this campaign so far. Predator, Azorult and, Evasive Monero Miner are among the extensive malware families used in this campaign.

See the full report here: https://www.zdnet.com/article/malware-stew-cooked-up-on-bitbucket-deployed-in-attacks-worldwide/

WhatsApp Bug Allowed Attackers to Access the Local File System - BleepingComputer

Facebook has patched a high severity vulnerability, CVE-2019-18426, in WhatsApp that could allow potential attackers to read files from a user's local file system, on both macOS and Windows platforms. This flaw allows cross-site scripting and local file reading. Exploitation requires the victim to click a link preview from a specially crafted text message. All WhatsApp Desktop versions before v0.3.9309 are affected by this issue when paired with WhatsApp for iPhone versions before 2.20.10. Users are urged to apply the available patch to prevent future risks.

See the full report here: https://www.bleepingcomputer.com/news/security/whatsapp-bug-allowed-attackers-to-access-the-local-file-system/

Microsoft Office 365 Will Block Malicious Content Unless Overridden - BleepingComputer

Microsoft is soon going to introduce a new feature that will block malicious content in Office 365 regardless of the custom configuration unless manually overridden. This feature will enable EOP/ATP detonation, malware analysis, and block previously known malicious files and URLs. The "Office 365 ATP, Secure by Default" update is currently under active development and is estimated to be released in February 2020, for all environments.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-office-365-will-block-malicious-content-unless-overridden/

Sudo Bug Lets Non-Privileged Linux and macOS Users Run Commands as Root

Researchers at Apple security have found a significant vulnerability in sudo utility that could allow low privileged users or malicious programs to execute arbitrary commands with administrative privileges on Linux or macOS systems, under specific configuration. Sudo comes as a core-command pre-installed in Unix-like systems that allows the users to run programs with the security privileges of a superuser. The vulnerability, tracked as CVE-2019-18634, initiates from a stack-based buffer overflow issue that resides in Sudo versions before 1.8.26. This flaw could only be exploited when the pwfeedback option is enabled in the sudoers configuration file. A patch has been released to resolve this issue. Additionally, users can disable the pwfeedback option to prevent privilege escalation.

See the full report here: https://thehackernews.com/2020/02/sudo-linux-vulnerability.html