Threat Intelligence Bulletin: 02/28/2020 - 03/05/2020

Threat Update: Coronavirus Used in Cyber Attacks

COVID-19 is a type of coronavirus that has been front-page news for the last two months. Whenever there is global news, there is an opportunity for cybercriminals to take advantage of the news cycle to perform fraud, issue cyberattacks or to use the news to lure people to fall victim to their toolset. This advisory summarizes a number of attacks that have used COVID-19 and “Coronavirus” as a pretext for attacks, and insight from ZeroFOX data into COVID-19 being used to stage potentially malicious domains.

Recommendations

• Consider monitoring news related to the COVID-19 coronavirus using the ZeroFOX platform, and contact your ZeroFOX Account Manager on enabling rules or use cases if you have a specific business or security need
• Be wary of misinformation related to COVID-19 news, and use reputable sources such as WHO and the CDC for up to date and accurate information about COVID-19
• Instruct employees to be wary of COVID-19 and coronavirus-themed emails and messages as a pretext for cyberattacks

Details

COVID-19, also known as “Coronavirus”, is an infectious disease that is closely related to SARS. With its ability to spread much like the flu, lack of scalable containment procedures in certain countries, and its effect on the US stock market, it is certainly at the forefront of news and conversations across the world.

This news makes COVID-19 an attractive pretext that can be leveraged by malicious actors in a variety of ways. Threatpost, for example, outlined an Emotet campaign that used Coronavirus themed emails to get victims to click on the delivered maldocs. Kaspersky reported phishing campaigns using look-alike domains to the CDC to attack individuals.

Using the ZeroFOX domain data source, which collects a variety of data sources for domain names, Alpha Team issued keyword queries for covid19, covid-19 and coronavirus.

Figure 1 - Domains that contain covid19

Figure 2 - Domains that contain covid-19

Figure 3 - Domains that contain coronavirus

Figure 1 & 2 show domains being collected with variants of covid19, whereas Figure 3 shows domains using the virus’ alternative descriptor, coronavirus. This could indicate that domains with coronavirus in the name are easier for people to fall victim to rather than COVID-19. According to Google Trends, coronavirus has had much more interest than covid19 or covid-19 variants, even after WHO assigned COVID-19 as the official name on February 11 2020.

Figure 4 - Google Trends Search

The blue line represents search interest for Coronavirus, while red and yellow represent COVID-19 and COVID19, respectively. The Google trend data, when compared with the ZeroFOX domain data, could indicate that people are more familiar with the term “Coronavirus” and because of this, cybercriminals registering potentially malicious domains are more likely to get clicks or interest using coronavirus. Due to the trend data, the domain data, as well as multiple reports of the use of COVID-19 as a pretext for attacks, it is almost certain that malicious actors will continue to use the news of Coronavirus as a way to deliver cyber attacks.

Breaking News: 2020-02-28 - 2020-03-05

Cerberus Android Malware Can Bypass 2FA, Unlock Devices Remotely - BleepingComputer

ThreatFabric security researchers have discovered an upgraded Cerberus banking Trojan with RAT functionality, capable of stealing victim’s Google authenticator two-factor authentication (2FA) code and is still under testing phase. The malware abuses Android accessibility privileges to steal Google Authenticator’s 2FA codes. When the trojan runs, it can access the content of the interface and send it to the C&C server of the attacker. Trojan has TeamViewer-based remote access trojan (RAT) capabilities using which the attacker can traverse the file system of the device and download its contents, can launch TeamViewer and thereby provides full remote access of the device. Furthermore, it comes with a screen-lock grabbing feature that uses overlays and aids the attacker in using built-in RAT to unlock the victim’s device remotely.

See the full report here: https://www.bleepingcomputer.com/news/security/cerberus-android-malware-can-bypass-2fa-unlock-devices-remotely/

Norton LifeLock Phishing Scam Installs Remote Access Trojan - BleepingComputer

Security researchers from PaloAlto have come across a phishing campaign that uses a bogus NortonLifelock document to trick victims into installing a remote access tool (RAT), used for legitimate purposes. The attack stems from a Microsoft Word document embedded with malicious macros. The pretext states that it is a password protected NortonLifelock document with personal information and prompts the victim into enabling the macros and type in the password which was provided in the phishing email. Upon entering the wrong password, a message pops up saying “Incorrect key” and malicious action will not be carried out. When the correct password, provided with the mail is entered, the macros are executed and the NetSupport manager, a legitimate remote control software will be installed only if the request has the user-agent string ‘Windows Installer’ which is a part of the "msiexec" command. After starting the RAT, the name of the victim computer is automatically sent to the attacker and all PowerShell scripts are removed from the %temp% folder.

See the full report here: https://www.bleepingcomputer.com/news/security/norton-lifelock-phishing-scam-installs-remote-access-trojan/

Facebook sues SDK maker for secretly harvesting user data

Facebook has filed a federal lawsuit against OneAudience, a New Jersey-based data analytics for allegedly harvesting users' data by paying app developers to install malicious software development kit (SDK) in their apps. The SDK was embedded in shopping, gaming, and utility-type apps, some of which were made available through the official Google Play Store. After a user installed one of these apps on their device, the malicious SDK enabled OneAudience to collect information about the user from their device and their Facebook, Google, or Twitter accounts, in instances where the user logged into the app using those accounts. However, OneAudience claims that the data was never intended to be collected or used.

See the full report here: https://www.zdnet.com/article/facebook-sues-sdk-maker-for-secretly-harvesting-user-data/

Microsoft Edge Now Lets You Block Potentially Unwanted Programs - BleepingComputer

Microsoft announced a new security feature for the Microsoft Edge 80.0.338.0 and subsequent versions where potentially unwanted applications (PUAs) can automatically be blocked from downloading. PUAs are apps that could use your device to mine cryptocurrency, to display ads, promotions, or survey prompts, or that have poor industry reputation. PUAs increase the risk of a computer or network from being infected with malware, making malware infections harder to detect and deal with, as well as waste computing resources and valuable time while cleaning them up. Users must first toggle on the Windows Security Microsoft Defender SmartScreen for the PUA blocking feature to work in the Microsoft Edge browser.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-edge-now-lets-you-block-potentially-unwanted-programs/

Nemty Ransomware Actively Distributed via 'Love Letter' Spam - BleepingComputer

Researchers at Malwarebytes and X-Force IRIS have discovered an ongoing malspam campaign where emails camouflaged as messages from secret lovers are used to deliver Nemty Ransomware payloads. Subject lines that hint at the contents of the email being sent by someone the recipient already knows are used to lure the victims. The email is attached with a ZIP archive with a name formatted as 'LOVE_YOU_######_2020.zip' with only the #s changing and the hash of the file is associated with a highly obfuscated malicious JavaScript file named 'LOVE_YOU.js'. The attackers use this to drop a Nemty ransomware executable on the victims' computers when executed by downloading the malicious payload from a remote server and launching it. The ransomware performs encryption of system files upon execution, leaving behind a ransom note demanding payment in exchange for the decryption key.

See the full report here: https://www.bleepingcomputer.com/news/security/nemty-ransomware-actively-distributed-via-love-letter-spam/

NVIDIA Fixes High Severity Flaw in Windows GPU Display Driver - BleepingComputer

NVIDIA has addressed multiple vulnerabilities in the Windows NVIDIA GPU display driver that could lead to code execution, local escalation of privileges, information disclosure, and denial of service on unpatched computers. The vulnerabilities can be exploited by gaining local access and installing malicious tools on vulnerable systems. NVIDIA advises all customers to patch their GeForce, Quadro, NVS, and Tesla Windows GPU display drivers by applying the security update available on the NVIDIA Driver Downloads page.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-fixes-high-severity-flaw-in-windows-gpu-display-driver/

US Railroad Contractor Reports Data Breach After Ransomware Attack - BleepingComputer

RailWorks Corporation, one of North America’s leading railroad track and transit experts, suffered a ransomware attack, exposing personally identifiable information of current and former employees, their beneficiaries and dependents, as well as that of independent contractors. The incident took place on January 27th, 2020, allowing unauthorized access to victims' PII including names, addresses, driver license numbers, government-issued IDs, Social Security numbers, dates of birth, and dates of hire/termination and/or retirement and encrypted company’s servers and systems. The company has notified the affected employees and is offering them free credit monitoring for a year.

See the full report here: https://www.bleepingcomputer.com/news/security/us-railroad-contractor-reports-data-breach-after-ransomware-attack/

Hackers Use Windows 10 RDP ActiveX Control to Run TrickBot Dropper - BleepingComputer

Security researchers have discovered a malware downloader called 'Ostap' adopted by TrickBot trojan. Ostap was delivered via phishing emails disguised as missing payment notifications containing a Word document embedded with malicious macros and an image that allegedly showed encrypted content. The JavaScript code for Ostap downloader had the same font color as that of its background to make the document content invisible. The threat actors have used 'MsRdpClient10NotSafeForScripting' class for remote control and have not populated the 'server' field, to evade the detection. It was also found that the '_OnDisconnected' function acted as a trigger only after an error was returned for failing to connect to a non-existent server. The backdoor is then executed immediately after taking the form of a ".BAT" file and the document form is closed.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-windows-10-rdp-activex-control-to-run-trickbot-dropper/

Sodinokibi Ransomware Posts Alleged Data of Kenneth Cole Fashion Giant - BleepingComputer

The authors of Sodinokibi ransomware have published customer data stolen from giant U.S. fashion house Kenneth Cole Productions. The leaked data allegedly belonging to Kenneth Cole includes employee severance information, cash projections, and money owed to the company. The attackers claim to possess over 70,000 documents with financial and work data, and more than 60,000 records with Kenneth Cole customers' personal information and threaten to publish the full data cache if the American fashion house fails to pay the ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-posts-alleged-data-of-kenneth-cole-fashion-giant/

Patch your Tomcat and JBoss instances to protect from GhostCat vulnerability (CVE-2020–1938 and…

Researchers have recently identified a vulnerability, dubbed as GhostCat, in the AJP protocol in Apache Tomcat servlet container. The vulnerability, CVE-2020–1938 / CNVD-2020–10487, could allow remote attackers to read the content of any file on a vulnerable web server (or servlet container) and obtain sensitive configuration files or source code, or execute arbitrary code if the server allows file upload. According to Shodan, there are 198,290 servers with exposed AJP port (8009) in the USA. There are multiple PoCs (proof-of-concept) available online and are exponentially growing to exploit the exposed servers. Users are recommended to upgrade to the latest version of Apache Tomcat 9.0.31, 8.5.51, and 7.0.100 to fix this vulnerability

See the full report here: https://securityboulevard.com/2020/02/patch-your-tomcat-and-jboss-instances-to-protect-from-ghostcat-vulnerability-cve-2020-1938-and/

PUBG developer apologizes for myriad issues amid fight against DDoS attacks - Digital Trends

PUBG players have been hit with a string of old problems: regular DDoS attacks against PUBG servers, cheaters and performance issues. The PlayerUnknown’s Battlegrounds’ servers have been increasingly targeted for these attacks. Hitting the server causes connection issues for all players, dropouts, increases in latency. The developer revealed that the game’s servers have been under constant DDoS attacks in recent months. These attacks reached a peak last November, and spiked again this month, forcing PUBG Corp to investigate new solutions. They're deploying a combination of solutions from external infrastructure providers, although some of the experiments resulted in constant packet loss issues for regular players.

See the full report here: https://www.digitaltrends.com/gaming/pubg-developer-apologizes-for-issues/

Hackers are actively exploiting zero-days in several WordPress plugins

During the past two weeks, researchers have observed a resurgence in attacks against WordPress sites. The new attacks focus on exploiting bugs in WordPress plugins to target unpatched sites. The targeted plugins include Duplicator, Profile Builder ThemeGrill Demo Importer, ThemeREX Addons and Flexible Checkout Fields for WooCommerce. Many of the attacks target recently patched plugin bugs, with the hackers hoping to hijack sites before site administrators had a chance to apply security patches. Additionally, some hackers are conducting sophisticated attacks to exploit zero-days in plugins. Web administrators are recommended to apply the available security patches.

See the full report here: https://www.zdnet.com/article/hackers-are-actively-exploiting-zero-days-in-several-wordpress-plugins/

Hiding Windows File Extensions is a Security Risk, Enable Now

By default, Microsoft has a feature to hide file extensions in Windows. This is a security risk as it's commonly abused by phishing emails and malware distributors to trick people into opening malicious files. Malware executables are hidden using legitimate file icon to trick users on clicking it. Windows users are advised to enable showing of file extensions to know the exact file type.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/hiding-windows-file-extensions-is-a-security-risk-enable-now/

49 million unique email addresses of Straffic Marketing firm exposed online

The Israeli marketing firm Straffic exposed 49 million unique email addresses due to mishandled credentials for an Elasticsearch database. The exposed Elasticsearch database contained 140GB of contact details, including names, email addresses, phone numbers, physical addresses, and genders. While it was password protected, it appears that the credentials were not properly stored. A security researcher found them in plain text on the webserver. A configuration text file (.ENV) file was discovered that pointed to an AWS Elasticsearch instance. The domain is no longer available. Straffic has assured that all their systems are secure at the moment and none of the data have been misused.

See the full report here: https://securityaffairs.co/wordpress/98733/data-breach/straffic-data-leak.html

Delicious irony: Credit rating builder Loqbox lets customer details and card numbers slip after 'sophisticated attack'

Loqbox, a fintech startup company that aims to help consumers improve their credit ratings, suffered a security breach, disclosing personal and financial details of its customers. The attack potentially exposed its customers' names, postal addresses, dates of birth, email addresses and phone numbers. Loqbox has notified the affected customers and taken steps to protect and assure that all funds are secure. However, the company urges customers to be vigilant as the stolen details can be used in various forms of fraud and scams.

See the full report here: https://www.theregister.co.uk/2020/03/02/financial_startup_loqbox_data_breach/

US Charges Two With Laundering $100M for North Korean Hackers - BleepingComputer

The U.S. Department of Justice has charged two Chinese nationals, Tian Yinyin and Li Jiadong for allegedly laundering over $100 million worth of cryptocurrency out of the nearly $250 million stolen by North Korean actors, Lazarus Group. Lazarus actors were able to steal nearly $250 million worth of virtual currency after hacking into an unnamed virtual currency exchange. The cyber actors were able to access customers’ personal information, such as private keys after an employee of the exchange unwittingly downloaded DPRK-attributed malware through an email. The North Korean actors used the private keys to steal virtual currencies from this exchange. From December 2017 up until around April 2019, Tian and Li have purportedly laundered more than $100 million worth of cryptocurrency, primarily sourced from Lazarus Group's virtual currency exchange hacks.

See the full report here: https://www.bleepingcomputer.com/news/security/us-charges-two-with-laundering-100m-for-north-korean-hackers/

New PwndLocker Ransomware Targeting US Cities, Enterprises - BleepingComputer

New ransomware, PwndLocker, is targeting U.S. cities and enterprises with ransom demands over $650,000. The ransomware has been active since late 2019 and has encrypted a stream of victims. The ransomware operators claim to be responsible for the Lasalle County cyberattack and are demanding a 50 bitcoin ransom ($442,000) for a decryptor. According to MalwareHunterTeam, upon execution, PwndLocker attempts disabling a variety of Windows services using the 'net stop' command to encrypt data. The ransomware also targets various processes and terminate them if detected and clears the Shadow Volume Copies to prevent recovery. Further, the malware encrypts files and drops ransom notes with an email address and Tor payment site.

See the full report here: https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/

US Drugstore Giant Walgreens Leaked Users' Sensitive Info - BleepingComputer

Walgreens, a US drugstore chain, disclosed that its mobile apps' users were able to accidentally access other users' sensitive information because of a bug. Sensitive information of users, including first and last name, prescription numbers and drug names, store numbers, and shipping address were accessible by other users. However, no financial information such as Social Security Numbers or bank account information was disclosed in this incident. The drugstore giant has fixed the bug and notified the affected customers and also recommends them to monitor their prescription and medical records.

See the full report here: https://www.bleepingcomputer.com/news/security/us-drugstore-giant-walgreens-leaked-users-sensitive-info/

Tesla, SpaceX Parts Manufacturer Suffers Data Breach

Visser Precision, a precision parts manufacturer for space and defense contractors, including Tesla Motors and SpaceX was hit by DoppelPaymer, a data-stealing malware. The breach was first detected when a security researcher noticed that a website was posting files that DoppelPaymer had stolen from Visser. The exposed files included folders with customer names, including Tesla, SpaceX, Lockheed Martin, and Boeing, and held nondisclosure agreements between Visser and its clients, as well as proprietary information.

See the full report here: https://www.darkreading.com/attacks-breaches/tesla-spacex-parts-manufacturer-suffers-data-breach/d/d-id/1337211

Cobalt Ulster Strikes Again With New ForeLord Malware

Security researchers at Dell SecureWorks have uncovered a new credential-stealing malware dubbed ForeLord. The malware is found to be linked to Iranian APT called Cobalt Ulster and has targeted organizations in Turkey, Jordan, Iraq, global government organizations and unknown entities in Georgia and Azerbaijan. The malware is distributed via spear-phishing campaigns using malicious Excel spreadsheet documents embedded with macros that prompt the victims to enable them to execute themselves. The malware’s command and control were handled via DNS text fields.

See the full report here: https://threatpost.com/cobalt-ulster-strikes-again-with-new-forelord-malware/153418/

Warning Issued For Millions Of Microsoft Windows 10 Users - Forbes

According to BleepingComputer, every Windows 10 computer is vulnerable to a serious system hack unless they change the default settings for viewing files. Microsoft hides file extensions in Windows by default though it's a security risk commonly abused by phishing emails and malware distributors to trick people into opening malicious files. To know exactly what type of file users are interacting with, it is strongly recommended that they enable the showing of all file extensions in Windows 10.

See the full report here: https://www.forbes.com/sites/gordonkelly/2020/03/03/microsoft-windows-10-warning-file-explorer-hack-upgrade-windows-10/

Let’s Encrypt to Revoke Millions of TLS Certs

Let's Encrypt, a popular free certificate authority will revoke around 3 million Transport Layer Security (TLS) certificates today, due to a Certificate Authority Authorization (CAA) bug in its Boulder software, causing to skip a check that is required to perform before issuing a certificate. The bug impacted the way its software checked domain ownership before issuing certificates and could open the door for a malicious attacker to take control of a TLS certificate on a website, allowing the hacker to eavesdrop on web traffic and gather sensitive data. Millions of websites and machine identities that rely on these certificates to protect sensitive data flow could be identified as insecure, or rendered unavailable.

See the full report here: https://threatpost.com/lets-encrypt-revoke-millions-tls-certs/153413/

Malicious Chrome extension caught stealing Ledger wallet recovery seeds

MyCrypto has discovered a malicious Chrome extension called Ledger Live targeting the Ledger cryptocurrency wallets. Ledger wallets are small hardware devices used to store cryptocurrency passwords in an offline format, safe from web-based attacks and phishing attempts. Ledger Live camouflages as a Chrome version of the legit app that allows Ledger wallet users to query their funds and approve transactions by syncing their hardware wallet with a trusted device. The extension prompts users to sync their wallets by entering the seed phrase, a recovery code to send the user's Ledger seed phrase to a Google Form. The exposed seed phrases can be used to gain access to victims' accounts and steal funds.

See the full report here: https://www.zdnet.com/article/malicious-chrome-extension-caught-stealing-ledger-wallet-recovery-seeds/

Ryuk Ransomware Attacked Epiq Global Via TrickBot Infection - BleepingComputer

Epiq Global, a legal services company suffered a Ryuk Ransomware attack and took its systems offline. The cyberattack affected Epiq Global's e-Discovery platforms, which made it impossible for legal clients to access documents needed for court cases and client deadlines. According to researchers, a computer on Epiq's network became infected with the TrickBot malware in December 2019, installed by the Emotet Trojan and spread through phishing emails. TrickBot harvested information and opened a reverse shell to the Ryuk operators, granting them access to Epiq Global's network and admin credentials. The ransomware began encrypting files on February 29th, 2020, leaving a ransom note named RyukReadMe.html in every folder.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-attacked-epiq-global-via-trickbot-infection/

Carnival Cruise Line Operator Discloses Potential Data Breach - BleepingComputer

Carnival Corporation & plc, the world's largest cruise ship operator, suffered a data breach that may have exposed its customers' names, addresses, Social Security numbers, government identification numbers, such as passport number or driver’s license number, credit card and financial account information, and health-related information. Attackers gained access to Carnival Corporation's employee's email accounts between April 11 and July 23, 2019, granting them entry to personal information regarding the company's guests. However, the company said that there is no evidence of misuse of the impacted customers' personal information.

See the full report here: https://www.bleepingcomputer.com/news/security/carnival-cruise-line-operator-discloses-potential-data-breach/

Ryuk ransomware hits Fortune 500 company EMCOR

EMCOR, a US-based Fortune 500 company specialized in engineering and industrial construction services, suffered a ransomware attack, resulting in a shut down of its IT systems. The attack took place on February 15th, 2020 and infection strain has been identified as Ryuk ransomware. The company claimed that only certain IT systems were affected by the attack and were immediately taken down to contain the infection. It also confirmed that there was no evidence of theft of any customer or employee data during the attack.

See the full report here: https://www.zdnet.com/article/ryuk-ransomware-hits-fortune-500-company-emcor/