Threat Intelligence Bulletin: 02/14/2020 - 02/20/2020

Breach Disclosure: MGM Properties

In February 2020, the personal information of nearly 10.6 million people who lodged at MGM Resorts hotels has been published on a popular hacking forum. The data in the breach contains information that could be abused by hackers in spear-phishing and SIM swapping attacks. The breach in total contained 10.6 million rows of data, with 3.1M unique email addresses.

Recommendations

• Enable 2-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance

Details

In July 2019, MGM Resorts suffered a data breach impacting 10.6 million individuals and exposing 3.1M unique email addresses. A misconfigured cloud server is believed to be the source of the breach. According to an article by ZDNet, the breach includes personal and contact details of celebrities, tech CEOs, reporters, government officials, and employees at some of the world's largest tech companies. The breached information is available on a popular hacking forum, RaidForums.

The rows of the breach include:

• Full names
• Home addresses
• Phone numbers
• Emails
• Dates of birth

Breaking News: 2020-02-14 - 2020-02-20

SweynTooth Bug Collection Affects Hundreds of Bluetooth Products - BleepingComputer

Security researchers have disclosed multiple vulnerabilities, dubbed SweynTooth, in the implementation of the Bluetooth Low Energy technology on multiple system-on-a-chip (SoC) circuits. If exploited, these flaws can crash affected devices, force a reboot by sending them into a deadlock state or bypass the secure BLE pairing mode and access functions reserved for authorized users. Vendors such as NXP, Cypress, Texas Instruments, Dialog Semiconductors, Microchip, Telink Semiconductor, and STMicroelectronics, who have their system-on-a-chip integrated with BLE are affected by SweynTooth.

See the full report here: https://www.bleepingcomputer.com/news/security/sweyntooth-bug-collection-affects-hundreds-of-bluetooth-products/

Windows 10 KB4532693 Update Bug Hides User Data, Loads Wrong Profile - BleepingComputer

Installing Microsoft's cumulative update, Windows 10 KB4532693, could reset the Start menu and desktop to default state. After installing the latest update, users have reported that Windows is loading an incorrect or temporary user profile, and it removes the shortcuts or icons from both the desktop and Start menu. Fortunately, the update is not wiping the shortcuts and the files, but rather renaming the original user profile in the C:\Users folder. Some of the users who installed the update could resolve the issue by restarting Windows a few times or uninstalling the KB4532693 update.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb4532693-update-bug-hides-user-data-loads-wrong-profile/

Puerto Rico Gov Hit By $2.6M Phishing Scam

Puerto Rico’s Industrial Development Company, a government-owned corporation has lost nearly $2.6 million after falling victim to a phishing scam. Reportedly, the agency received an email alleging a change to a banking account tied to remittance payments, which is a transfer of money (often by a foreign worker) to an individual in their home country. The agency sent this payment to a fraudulent account, January 17. The agency has filed a police complaint to investigate the incident. However, it is currently not known if the agency’s operations have been impacted during the incident.

See the full report here: https://threatpost.com/puerto-rico-gov-hit-by-2-6m-phishing-scam/152856/

Rutter's store chain discloses security breach involving POS malware

Rutter's, a popular US convenience store and gas station chain, revealed a security breach involving point-of-sale (POS) malware, impacting its stores in Pennsylvania and West Virginia. The company says hackers gained access to its stores' network system and planted malware that collected payment card details as they were being processed. For most locations, the malware was present between October 1, 2018, through May 29, 2019. The malware is believed to have collected the victims' name, card number, expiration date, and internal verification code. The store chain has removed the malware from its payment systems, reported the incident to law enforcement, and is now notifying impacted customers.

See the full report here: https://www.zdnet.com/article/rutters-store-chain-discloses-security-breach-involving-pos-malware/

Google removes 500+ malicious Chrome extensions from the Web Store

Google has removed more than 500 malicious Chrome extensions that operated by injecting malicious ads (malvertising) inside users' browsing sessions from its official Web Store. The malicious code injected by the extensions activated under certain conditions and redirected users to malicious sites, such as a malware download site or a phishing page. Google has deactivated these extensions inside every user's browser, while also marking the extension as "malicious" so users would know to remove it and not reactivate it.

See the full report here: https://www.zdnet.com/article/google-removes-500-malicious-chrome-extensions-from-the-web-store/

Plastic Surgery Patient Photos, Info Exposed by Leaky Database - BleepingComputer

Personal information and highly sensitive photos of hundreds of thousands of plastic surgery patients of NextMotion were exposed online by an improperly secured Amazon Web Services (AWS) S3 bucket. The exposed bucket was used by NextMotion, a French plastic surgery tech firm that provides imaging and patient management services, to store roughly 900,000 files with highly sensitive patient images and videos, as well as plastic surgery, dermatological treatments, and consultation documents. Currently, the exact number of impacted patients is not known.

See the full report here: https://www.bleepingcomputer.com/news/security/plastic-surgery-patient-photos-info-exposed-by-leaky-database/

Apple iPhone Users Targeted with Bogus Dating App for Valentine’s Day

A malicious email campaign, targeting iPhone owners, has been discovered around Valentine’s Day by Bitdefender. The campaign begins with an email from “Nerve Renew,” where the email body consists of a static picture. If the victims click on the image, they are redirected to a range of themes such as a bogus dating app, a slot-machine app, or a sketchy VPN app. According to the researchers, this scam only works when the link is opened on an iPhone.

See the full report here: https://threatpost.com/apple-iphone-dating-app-valentines-day/152911/

SMS Phishing Campaign Targets Mobile Bank App Users in North America

Customers of RBC, HSBC, TD, Meridian, BNC, Chase, and other North American banks are being targeted in a new SMS phishing campaign. According to Lookout, a mobile security company, the victims received fake text messages regarding suspicious activities tied to their bank accounts. The SMS-based messages each included a link to one of over 200 phishing pages, prompting victims to enter their date of birth, credit-card expiration date, account number, username, and password. Attackers have tricked nearly 4,000 victims between June and last month.

See the full report here: https://threatpost.com/sms-phishing-bank-app-north-america/152896/

Nedbank says 1.7 million customers impacted by breach at third-party provider

Nedbank, one of the most eminent banks in the South Africa region, disclosed a security breach, impacting the personal details of 1.7 million customers. According to Nedbank, the attackers exploited a vulnerability in the systems of a third-party provider, Computer Facilities (Pty) Ltd, a South African company that the bank was using to send out marketing and promotional campaigns. The compromised contractor systems exposed customer information such as names, ID numbers, home addresses, phone numbers, and email addresses. The bank is notifying the affected customers and has taken the contractor's network offline to prevent future risks.

See the full report here: https://www.zdnet.com/article/nedbank-says-1-7-million-customers-impacted-by-breach-at-third-party-provider/

Windows Terminal 0.9 Released with Command Line Arguments and More - BleepingComputer

Microsoft's Windows Terminal 0.9 with new and improved features has been released. The latest update comes with command-line arguments, automatic creation of PowerShell profiles, and a new setting that allows users to close all tabs without confirmation.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-terminal-09-released-with-command-line-arguments-and-more/

Mobile Phishing Campaign Uses over 200 Pages to Spoof Bank Sites - BleepingComputer

A phishing campaign is reported to target mobile banking apps by using over 200 pages to impersonate legitimate websites for well-known banks in the U.S. and Canada. The list of targeted banks includes Scotiabank, CIBC, RBC, UNI, HSBC, Tangerine, TD, Meridian, Laurentian, Manulife, BNC, and Chase. Users were lured to the fake sites with short messages delivered through an automated tool in the phishing kit. The attackers also used links such as "Mobile Banking Security and Privacy" and "Activate Mobile Banking”, to lure targeted victims. Researchers have identified more than 200 phishing pages that were created for this campaign. Since June 27, 2019, the malicious links were accessed from over 3,900 unique IP addresses, most of them in North America. However, the campaign is no longer active and all the targeted banks have been informed about the campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/mobile-phishing-campaign-uses-over-200-pages-to-spoof-bank-sites/

Twitter says Olympics, IOC accounts hacked - Reuters

Twitter informed on Saturday that an official Twitter account of the Olympics and the International Olympic Committee’s (IOC) media Twitter account had been hacked. The accounts were hacked through a third-party platform. Twitter has temporarily locked the compromised Olympics & International Olympic twitter accounts and are working closely to restore them.

See the full report here: https://www.reuters.com/article/us-twitter-olympics-idUSKBN2090SA

Second Windows 10 update is now causing problems by hiding user profiles

Windows 10 users have reported a bug in Windows 10 February update that is hiding user profiles and their respective data on some Windows 10 systems. After installing the update, users are logged into a blank/default Windows 10 profile where all their previous data is missing. This includes access to installed apps, desktop wallpapers, desktops files, downloads, and others. The bug occurs because the Windows Update service creates a temporary profile to handle the installation procedure, but fails to remove it after installing KB4532693. The original user profile folders are still available on disk but renamed with a .000 or .bak extension. Issues with KB4532693 have been reported on Microsoft forums and tech support sites. Multiple users have reported that removing the faulty update restores their old profiles.

See the full report here: https://www.zdnet.com/article/second-windows-10-update-is-now-causing-problems-by-hiding-user-profiles/

Israeli soldiers tricked into installing malware by Hamas agents posing as women

Members of the Hamas Palestinian militant group have created Facebook, Instagram, and Telegram accounts posing as young teenage girls to lure Israeli soldiers into installing malware-infected apps on their phones. Israeli Defense Force (IDF) traced down six accounts used in the recent social engineering campaign. Soldiers who engaged in conversations were eventually lured towards installing one of three chat apps, named Catch & See, Grixy, and Zatu, where the agents promised to share more photos. Once installed, the apps would delete their icons from the phone and perform background activities to exfiltrate photos, SMS messages, contacts, install other malware on the device, track the phone's geo-location in real-time, and even take screenshots via the phone's camera.

See the full report here: https://www.zdnet.com/article/israeli-military-tricked-into-installing-malware-by-hamas-agents-posing-as-women/

Iranian hackers have been hacking VPN servers to plant backdoors in companies around the world

Iranian hackers are exploiting VPN bugs to infiltrate and plant backdoors in companies all over the world. The targeted sectors include IT, Telecommunication, Oil and Gas, Aviation, Government, and Security. The hackers are weaponizing vulnerabilities in Pulse Secure "Connect" VPN (CVE-2019-11510), Fortinet FortiOS VPN (CVE-2018-13379), Palo Alto Networks "Global Protect" VPN (CVE-2019-1579) and Citrix "ADC" VPNs (CVE-2019-19781), to breach enterprise networks, move laterally throughout their internal systems, and plant backdoors. The recent activities suggest that multiple Iranian groups are collaborating to pounce on the opportunity to exploit new VPN flaws once they become public.

See the full report here: https://www.zdnet.com/article/iranian-hackers-have-been-hacking-vpn-servers-to-plant-backdoors-in-companies-around-the-world/

Targeted Phishing Attack Aims For Well-Known Corporate Brands - BleepingComputer

Researchers at the Malwarehunter team have discovered an ongoing phishing campaign that targets companies using SLK (Symbolic Link) attachment. The hackers are targeting thirteen companies with specially crafted emails that pretend to be from the company's vendor or client. The email attachments contain an SLK file named after the company. When the recipients open the file, they are prompted to 'Enable Editing' and 'Enable Content' to properly display the spreadsheet. Once the content is enabled, the file executes a command and launches the payload stored at a remote site. The payload allows the attacker to gain admin privileges to fully compromise the network to install ransomware, perform BEC scams, or steal data. Users are advised to respond only to legitimate emails.

See the full report here: https://www.bleepingcomputer.com/news/security/targeted-phishing-attack-aims-for-well-known-corporate-brands/

US Charges Huawei With Conspiracy to Steal Trade Secrets, Racketeering - BleepingComputer

The U.S. Department of Justice have charged Huawei and two U.S. subsidiaries with conspiracy to steal trade secrets and to violate the Racketeer Influenced and Corrupt Organizations Act (RICO). The defendants include Huawei, Huawei Device Co. Ltd. (Huawei Device), Huawei Device USA Inc. (Huawei USA), Futurewei Technologies Inc. (Futurewei) and Skycom Tech Co. Ltd. (Skycom). Huawei and its US and Chinese subsidiaries allegedly mis copyrighted information and trade secrets including internet routers' manuals, software source code, antenna and robot testing technology. The obtained non-public information can significantly decrease research and development costs, thus obtaining an unfair competitive advantage.

See the full report here: https://www.bleepingcomputer.com/news/technology/us-charges-huawei-with-conspiracy-to-steal-trade-secrets-racketeering/

World Health Organization Warns of Coronavirus Phishing Attacks - BleepingComputer

The World Health Organization (WHO) warns of the phishing attacks around the Coronavirus hype which is actively being exploited to steal money, sensitive information, and deliver malware. The phishing messages are camouflaged as official messages from WHO, asking the targets to share sensitive info like usernames and passwords, redirect them to a landing page via malicious links embedded in the emails, or ask them to open malicious attachments containing malware payloads. WHO urges people to verify the authenticity of the messages before responding to them.

See the full report here: https://www.bleepingcomputer.com/news/security/world-health-organization-warns-of-coronavirus-phishing-attacks/

Bug in WordPress plugin can let hackers wipe up to 200,000 sites

A vulnerability residing in the ThemeGrill Demo Importer, a web development company that sells commercial WordPress themes, could allow remote attackers to send a specially crafted payload to vulnerable sites and wipe out entire content. Additionally, the attacker could gain access to the database containing the user named “admin” and take full control over the site. This vulnerability impacts all versions of the ThemeGrill Demo Importer plugin between version 1.3.4 and 1.6.1. If WordPress site owners use commercial themes provided by ThemeGrill, upgrading the plugin to version 1.6.2 could mitigate this issue.

See the full report here: https://www.zdnet.com/article/bug-in-wordpress-plugin-can-let-hackers-wipe-up-to-200000-sites/

Pay Up, Or We’ll Make Google Ban Your Ads

A new extortion scam is targeting Web site owners and threatening them to suppress their banner ads through Google’s Adsense program. Adsense allows publishers to easily place advertising on their sites, with Google offering mobile apps to track views and revenue. The fraudsters threaten to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud systems suspend the user’s AdSense account for suspicious traffic. The scammers demand bitcoin in exchange to withdraw their sabotaging operation. Google encourages publishers to refrain from communicating with parties that appear to be a threat of sabotage.

See the full report here: https://krebsonsecurity.com/2020/02/pay-up-or-well-make-google-ban-your-ads/

Firefox 73.0.1 Released With Fixes for Linux, Windows Crashes - BleepingComputer

Mozilla has released Firefox 73.0.1 to the Stable desktop channel for Windows, macOS, and Linux with crash fixes for users of Windows and Linux devices. The latest version resolves startup crashes caused by third-party security software such as G DATA and 0patch when running on Windows systems. It also fixes a loss of browser functionality in certain circumstances and RBC Royal Bank website connectivity problems. Windows, Mac, and Linux desktop users are automatically upgraded to the latest version.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-7301-released-with-fixes-for-linux-windows-crashes/

Dharma Ransomware Attacks Italy in New Spam Campaign - BleepingComputer

Threat actors are distributing a variant of Dharma ransomware in a new spam campaign targeting Windows users in Italy. Targeted users receive an email containing a link to an alleged invoice that when clicked on will bring the user to OneDrive page hosting a file called 'New documento 2.zip'. This file will be automatically downloaded when a user visits the page. It consists of a VBS script that installs the ransomware. The ransomware appends the ".ROGER" extension to encrypted files and displays a ransom note for payment information. As of now, there is no way to decrypt the files and infected users are recommended to recover files via a backup.

See the full report here: https://www.bleepingcomputer.com/news/security/dharma-ransomware-attacks-italy-in-new-spam-campaign/

AZORult Malware Infects Victims via Fake ProtonVPN Installer - BleepingComputer

A new malicious campaign has been discovered by Kaspersky, which delivers the AZORult information-stealing malware via a fake ProtonVPN website. AZORult is designed to collect and deliver sensitive information to its operators and is sold for roughly $100 on Russian underground forums. The campaign begins with victims visiting a counterfeit website and downloads a fake ProtonVPN installer and receive the AZORult botnet implant. After the fake ProtonVPN installer is launched, the malware collects system information and other additional information, exfiltrates it to the threat actors operating the malvertising campaign that abuses the ProtonVPN service.

See the full report here: https://www.bleepingcomputer.com/news/security/azorult-malware-infects-victims-via-fake-protonvpn-installer/

FC Barcelona Suffers Likely Credential-Stuffing Attack on Twitter

FC Barcelona’s official Twitter account was hacked in an apparent credential-stuffing attack by a hacker group called OurMine. According to OurMine, security issues in a third-party platform allowed them to gain control over FC Barcelona's account. The soccer team’s hacked account has been restored and tweets from outside the club have been deleted.

See the full report here: https://threatpost.com/fc-barcelona-credential-stuffing-twitter/152994/

SMS Attack Spreads Emotet, Steals Bank Credentials

In a new Emotet campaign, victims are being targeted through SMS phishing. Messages creating a false emergency of locked bank accounts are sent to the victims, purporting to be from local U.S. numbers and impersonate banks. The SMS-based message includes a link that redirects to an Emotet distributing domain, mimicking the bank’s mobile banking page. The phishing page prompts victims to hand over their banking credentials and download a file that infects their systems with the Emotet malware.

See the full report here: https://threatpost.com/sms-attack-spreads-emotet-bank-credentials/153015/

U.S. Pipeline Disrupted by Ransomware Attack

The natural gas compression facility in the U.S has fallen victim to a ransomware attack that resulted in a two-day pipeline shutdown. The threat actor gained initial access to the organization’s IT network via spear phishing and eventually infiltrated into operational technology (OT) networks. Upon infiltrating the network, the attacker deployed a ransomware payload to encrypt the organization’s IT and OT networks. The attack resulted in the loss of productivity and revenue as it directly affected the control and communication assets on the operational technology (OT) network. After a two-day shutdown, normal operations were up and running.

See the full report here: https://threatpost.com/pipeline-disrupted-ransomware-attack/153049/