Threat Intelligence Bulletin: 03/06/2020 - 03/12/2020

One Hat Cyber Team Targets Indian Government Sites

Opportunistic hackers are leveraging the increasing tensions between religious groups in India to target their victims. An Indonesian hacker group, One Hat Cyber Team, is one of these groups, with a history of defacing various websites across the world. Recently, they have been relentlessly targeting Indian government websites. The group claims that the reason for this activity is to protest against the anti-Muslim violence caused by the recent Delhi riots.

Recommendations

• Consider enabling the Cyber Attack Chatter rule to monitor developing threats to your organization
• Continue monitoring the Alpha Team Tab for reports related to the dark web and threat actor activities.
• For further assistance, reach out to [email protected]

Details

One Hat Cyber Team is an Indonesian hacker group known for defacing and hacking websites. ZeroFOX Alpha Team has tracked the group's activities, and has identified an uptick in activity intended to express solidarity with Muslim Indians who have been the target of violence in recent riots. These riots have broken out after rising tensions between Hindu and Muslim religious groups came to a head when legislation was passed, which prevents Muslims from gaining Indian citizenship. Protests against the Citizen Amendment Act, or CAA, have been ongoing. Although these protests were initially peaceful, some political groups have begun to incite violence against the majority-Muslim protesters.

One Hat Cyber Team has issued a warning to the government of India to stop the violence against Muslims in India or they will continue to hack and deface many more websites. Hacker groups like One Hat Cyber Team often target government websites to gain notoriety, spread a message, or achieve an agenda, as in this case.

Figure 1. Recent One Hat Cyber Team activity

The group started their cyber attacks on the Indian government by hacking and defacing a variety of Indian government sites starting on February 29, 2020, with the most recent defacement occurring on March 3, 2020. Compromised websites include a tourism site, a police site, and several other Indian government sites. The group tracks their defacement activity publicly, and posts a record of each defaced site on a popular website defacement forum. After the site is compromised, the below message is added to the front page, expressing solidarity with Muslims in India, and urging the Indian government to prevent future violence. As of March 07, 2020, none of the attacked websites have been recovered.

Figure 2. Indian government site hacked by the One Hat Cyber Team

The group is openly active on a variety of social media platforms including Facebook and Youtube, and also runs a blog where they host tools that can be used to deface websites. The Facebook page is used for similar content, and members discuss techniques for website defacement.

Figure 3. One Hat Cyber Team’s blog.

Conclusion

Less sophisticated or motivated attackers will often target companies that can't defend themselves properly, and then try to reap the benefits of this media exposure. In this case, the hacker group was politically motivated and was not looking to make any money by carrying out these attacks as they did not make any ransom demands. They did, however, seek to make a point politically in the message on the defaced site. Unfortunately, the lack of response of the targeted websites may give the attackers the confidence to continue this kind of defacement. To prevent attacks like these, website administrators should ensure they are restricting admin access as much as possible, regularly scan the site for malicious content, and use only modern plugins that are updated often.

Threat Update: Microsoft Redacts Wormable SMBv3 Vulnerability in Latest Patch Tuesday Release

A patch for CVE-2020-0796 was released on March 12, 2020. This patch can be downloaded at the link, here.

Microsoft has released an advisory indicating that there is a critical vulnerability within Server Message Block version 3 (SMBv3), which is the most recent version of the protocol. A flurry of social media chatter, as well as information mistakenly published by multiple reputable security vendors, indicates this may be wormable. Security vendors who posted information regarding the vulnerability have since removed it. At present, no patch exists for this vulnerability. As wild speculation abounds in the security community, this post seeks to clarify the information available at present.

Recommendations

• Ensure that you do not have SMB ports available to the Internet. Consider disabling SMBv3 as well as blocking TCP port 445
• Monitor the Alpha Team Tab and news sources for updates to this vulnerability
• Patch SMBv3 servers immediately when a patch is released

Details

On the morning of Patch Tuesday, March 10, 2020, multiple security vendors released, and then removed, information on a new vulnerability in Microsoft Server Message Block, version 3, or SMBv3. It appears that Microsoft elected to redact this vulnerability with little or no notice prior to Patch Tuesday, as multiple vendors first published, then redacted information on the vulnerability. Although Microsoft redacted the vulnerability from its Patch Tuesday release, Microsoft has since released an advisory. No patch is available at this time, but Microsoft listed a workaround to disable SMBv3 compression. An independent security researcher has released a tool that can be used to determine if you are running a vulnerable version of SMB, which can be found here.

SMB is a protocol used to share resources between Windows machines. Over the last several years, multiple high-profile wormable vulnerabilities have been discovered and exploited, including EternalBlue, in SMBv1 and BlueKeep, in RDP or Remote Desktop Protocol. In particular, EternalBlue was heavily utilized by attackers in ransomware attacks, including WannaCry and NotPetya, which occurred in early summer 2018. Although the cost of these attacks was great - it has been estimated that WannaCry cost affected organizations nearly $4 billion - it is important to note that they could have been much worse. The malware leveraged in the WannaCry attacks, in particular, included a built-in kill switch that allowed a researcher to shut down the malware’s spread. It is highly unlikely future malware will include a kill switch of this sort.

The description intended to accompany this CVE’s announcement, as mistakenly released by multiple security vendors, indicates that this vulnerability is wormable. This would allow attackers exploiting this vulnerability to move between machines easily, with no user interaction. A full description of the vulnerability, posted on Twitter by a researcher who caught the post before its removal, can be seen below.

Figure 1. Post from a security vendor containing details regarding a potential wormable SMBv3 vuln.

ZeroFOX Alpha Team is actively monitoring this situation as new details develop. ZeroFOX recommends enacting the recommendations above as a precaution until further information is made available.

Threat Update: Spotlight on Account Takeover

Account takeover is a form of identity theft where a fraudster accesses and takes control of a victim's accounts, particularly social media accounts. A successful account takeover attack can lead to fraudulent and unauthorized activities from the victim's compromised account. ZeroFOX Alpha Team has discovered a publicly available exploit that could bypass Instagram's security measures, resulting in the takeover of targeted accounts. Attackers could abuse this flaw to take over targeted Instagram accounts. Given the lack of evidence that this exploit is legitimate, however, this could prove to be a scam. Despite this, attackers have many options to compromise their desired social accounts.

Recommendations

If not already enabled, consider enabling the compromised credentials and hacked account self-post rules for all relevant entities and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance if needed Enable multi-factor authentication for all accounts to help prevent potential account takeover Practice healthy password habits and use unique passwords for every account. Consider using a password management system

Details

Account takeover has long been popular among attackers - particularly those with a message to share. Social media followings are difficult and expensive to build, often requiring significant time or financial investment. In an effort to circumvent these costs, would-be attackers often seek to compromise high-profile social media accounts. These accounts often have a built-in following. As an added bonus, these accounts are often viewed as highly credible, particularly if they have been verified by the social network, so their followers may be more likely to take posts from these accounts at face value.

Because of this, attackers who compromise these accounts often use them to spread malware or phishing links or use them to generate publicity and name recognition for themselves. This was the case with the recent rash of Twitter, Facebook, and Instagram account takeovers by the OurMine group.

Figure 1. Twitter post of compromised account, advertising OurMine’s so-called security services

Attackers can compromise social accounts in a variety of ways. Phishing pages are often used to obtain account credentials. Usually, these pages will be included as a link in a malicious email, masquerading as a password reset or account verification link. SIM swapping accounts are commonly used to gain access to the phone number associated with a social media account. This tactic usually involves an attacker who contacts the victim’s mobile provider. Using social engineering methods, the attacker ultimately convinces the provider to switch the phone number to a new SIM card, owned by the attacker. This could allow the attacker to either reset the password for a targeted social account using the phone number associated with the account or to potentially follow the same process to compromise the email address used for the account. Ultimately, either process would allow the attacker to reset the password for a targeted account and thus gain access.

Attackers with the financial means to do so may also buy ready-made exploits on criminal forums. One such exploit that claims to have the ability to hack almost any Instagram account by bypassing Instagram’s password security is available for the price of $2000 USD.

Figure 2. Exploit information with pricing.

The exploit runs a python script which takes the attacker to the victim’s password reset page. The only prior information needed to carry out the bypass, is the victim's Instagram username. Once the attacker lands on the password reset page, he/she could change the password of the victim’s account without having any knowledge about the previous password, sweeping the victim off from accessing their own account. In an effort to advertise the exploit, the seller has created a YouTube video demonstrating its use. The video is vague, and doesn’t fully explain the mechanics of the exploit. The administrator of the site recently posted that the exploit is currently available and works without any limitations. However, given the lack of detail and high price, this exploit is likely to be a scam.

Figure 3. Latest comment posted by the website administrator, claiming the exploit still works as intended

Conclusion

Account takeover can be utilized to monitor a victim’s social network activity, promote an attacker’s ideology or affiliation, or push scams and malware. In some cases, hijacked accounts have even been utilized to deface a victim’s image by posting highly offensive content, as in the case of the Jack Dorsey account takeover, where the attackers, who go by the name ChucklingSquad, posted anti-Semitic content in the brief period of time the account was compromised. Attackers have a variety of methods at their disposal to compromise accounts, including the purchase of ready-to-go exploits. Although some exploit offerings may be scams, some are likely legitimate. Only by actively monitoring social accounts can the risk of account takeover be mitigated.

Breach Disclosure: AnimeGame

Anime gaming site AnimeGame has experienced a data breach, exposing the credentials of over 1.4 million users. Email addresses, usernames, IP addresses, and salted MD5-hashed passwords were exposed as a result of the breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

AnimeGame is a site that hosts a variety of games, including a popular DragonBallZ game. The site also offers gaming guides, and a forum for users.

Figure 1. Raidforums sale ad for AnimeGame dump

The breach database was offered for sale on RaidForums, beginning February 27, 2020. Chatter on RaidForums indicates that the hashing algorithm used to store passwords on the site is known, and can potentially be dehashed.

Breaking News: 2020-03-06 - 2020-03-12

Attackers Deliver Malware via Fake Website Certificate Errors - BleepingComputer

Kaspersky researchers have discovered a new campaign where threat actors are distributing malware using fake security certificate update requests displayed on previously compromised websites, attempting to infect potential victims with backdoors and Trojans using a malicious installer. The victims are tricked into installing a security certificate by following an error message "NET::ERR_CERT_OUT_OF_DATE" presented within an iframe displayed over the site's actual contents to allow their connection to succeed. If the victims click on the Install button, following the error message, they end up downloading a Certificate_Update_v02.2020.exe binary that will infect them with malware instead of solving the made-up security certificate error.

See the full report here: https://www.bleepingcomputer.com/news/security/attackers-deliver-malware-via-fake-website-certificate-errors/

A Massive U.S. Property and Demographic Database Exposes 200 Million Records

A database containing around 200 million records of property-related information on US residents has been exposed on the internet which was accessible without any authentication. The leaked data contained a mix of personal and demographic details included: name, address, email address, age, gender, ethnicity, employment, credit rating, investment preferences, income, net worth, and property information, such as market value, property type, mortgage amount, rate, type, and lender, refinance amount, rate, type, and lender, previous owners, year built, number of beds and bathrooms and tax assessment information. The exposed database owner was unidentified and eventually, the database was taken down after a month. Altogether, the exposed database consisted of 201,162,598 records, with each entry corresponding to a unique individual.

See the full report here: https://thehackernews.com/2020/03/us-property-records-database.html

One of Roman Abramovich's companies got hit by ransomware

One of the world’s largest steel manufacturers and mining operations, EVRAZ, has been hit by Ryuk ransomware. Following the attack, the company's North American branches were shut down, including steel production plants across Canada and the US. According to the sources, manufacturing is halted at most plants and the company's IT team is currently working on containing the infection.

See the full report here: https://www.zdnet.com/article/one-of-roman-abramovichs-companies-got-hit-by-ransomware/

T-Mobile Data Breach Exposes Customer's Personal, Financial Info - BleepingComputer

T-Mobile suffered a data breach, exposing the personal and financial information of some of its customers. An unauthorized person was able to gain access to a T-Mobile employee's email accounts by hacking their email vendor. For all impacted customers, names and addresses, phone numbers, account numbers, rate plans, rate features, and billing information were the personal information exposed. For some customers, financial information such as Social Security numbers, financial account information, and government identification numbers was also exposed. The company has notified the affected customers and is offering a free two-year subscription to the myTrueIdentity online credit monitoring service for those whose financial information was exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-data-breach-exposes-customer-personal-financial-info/

Virgin Media exposes data of 900,000 users via unprotected marketing database

The personal information of nearly 900,000 customers of Virgin Media, a provider of telephone, television, and internet services in the UK, has been exposed due to an unprotected database server. Breached information includes customers' names, home addresses, emails, phone numbers, along with technical and product information. The company said that the exposed database was used for marketing activities and did not contain sensitive or financial information. Virgin Media is notifying the affected customers and warning them to be watchful of phishing attacks.

See the full report here: https://www.zdnet.com/article/virgin-media-exposes-data-of-900000-users-via-unprotected-marketing-database/

This Unpatchable Flaw Affects All Intel CPUs Released in Last 5 Years

An unpatchable vulnerability exists in all Intel processors released in the past 5 years. Hackers can exploit this vulnerability to compromise almost every hardware-enabled security technology. The vulnerability, tracked as CVE-2019-0090, exists in the hard-coded firmware running on the ROM (read-only memory) of the Intel's Converged Security and Management Engine (CSME). Intel CSME versions 11.x, Intel CSME version 12.0.35, Intel TXE versions 3.x, 4.x, and Intel Server Platform Services versions 3.x, 4.x, SPS_E3_05.00.04.027.0 are vulnerable. The security patches released by Intel will not entirely prevent attacks since the ROM flaw can be exploited by an attacker with physical access before the system even boots up. Only the latest Intel 10th generation processors, Ice Point chipsets and SoCs are not vulnerable to this issue.

See the full report here: https://thehackernews.com/2020/03/intel-csme-vulnerability.html

Critical Zoho Zero-Day Flaw Disclosed

Zoho patched a critical zero-day bug in its IT help desk ManageEngine software after a security researcher posted a PoC attack for the flaw on Twitter. The flaw allows remote attackers to execute arbitrary code on affected installations of ManageEngine Desktop Central, without any authentication. Users are recommended to install the patch to avoid future risks.

See the full report here: https://threatpost.com/critical-zoho-zero-day-flaw-disclosed/153484/

TrickBot Malware Targets Italy in Fake WHO Coronavirus Emails - BleepingComputer

Security researchers at Sophos have discovered a new spam campaign where the threat actors are exploiting the hype around Coronavirus (COVID-19) to distribute the Trickbot Malware. The campaign begins with victims receiving emails that are camouflaged as official messages from WHO, asking the targets to download a precaution document. When the recipients open the document, they are prompted to 'Enable Content', upon which malicious macros will be executed that extracts various files to install and launch the Trickbot malware. Once TrickBot is installed, it harvests information from the compromised computer and then attempts to spread laterally throughout a network. TrickBot eventually launches PowerShell Empire or Cobalt Strike to give the Ryuk Ransomware actors access to encrypt the files of all the infected computers on the network.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/

Boots Advantage Card: 150000 accounts targeted by hackers - Gazette

Boots, a UK-based health and beauty retailer, and pharmacy chain has suspended payment through its Advantage Card scheme following a cyber attack. The company said that an unusual activity on customers' loyalty accounts was noticed. Boots' main systems were not affected, but the hackers had obtained passwords for customers' accounts and were trying to purchase items with the accumulated points. The company has notified nearly 150,000 affected customers and will replace their Boots Advantage Card points if they have been used fraudulently.

See the full report here: https://www.newsandstar.co.uk/news/national/uk_today/18286556.boots-advantage-card-150-000-accounts-targeted-hackers/

Telus-Owned Koodo Mobile Announces Data Breach, Stolen Info for Sale - BleepingComputer

Telus-owned Kudoo Mobile disclosed a data breach that exposed its customer data from August and September 2017. On February 13, 2020, an unauthorized third party was able to access the company's systems and stole August/September 2017 data that included customers' mobility account number and telephone number. The exposed information can be used to port Koodo Mobile numbers to attacker's devices to receive 2-factor authentication codes, granting access to email and bank accounts. To prevent this, Koodo has enabled the 'Port Protection' feature on the affected accounts. The company also disclosed that they found the exposed details available for sale on the dark web and urges the impacted customers to be vigilant of phishing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/telus-owned-koodo-mobile-announces-data-breach-stolen-info-for-sale/

Bennett: Social Media Hack Attack Not a Security Risk - http://hamodia.com

Israeli Defense Minister Naftali Bennett’s official Twitter account was hacked on the night between Friday and Saturday. The hackers posted anti-Israel messages along with images of the Turkish and Palestinian flags. Also transmitted were pro-Palestinian slogans and an English translation of a portion of the Turkish national anthem. The account was hacked by Turkish groups who managed to get hold of Bennett’s password, but the damage was limited to his Twitter account. The attack did not compromise Israeli security and was not conducted by organized enemy hacking groups, Bennett’s office said in a statement. The takeover was short-lived and a few minutes after it was identified. The posts were removed, the password was changed, and the issue has been referred to security officials for further investigation.

See the full report here: https://hamodia.com/2020/03/08/bennett-social-media-hack-attack-not-security-risk/

Ransomware Attack: Defense Contractor CPI Pays Hackers $500K - Report - MSSP Alert

California-based Communications & Power Industries (CPI) was knocked offline after a ransomware attack. According to TechCrunch, the company paid a ransom of about $500,000 shortly after the incident in mid-January, but the company was not yet fully operational. According to the source, a “domain admin” — a user with the highest level of privileges on the network, clicked on a malicious link while they were logged in, which triggered the file-encrypting malware. Because the thousands of computers on the network were on the same, unsegmented domain, the ransomware quickly spread to every CPI office. The company confirmed the ransomware attack and they working with a third-party forensic investigation firm to investigate the incident.

See the full report here: https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/hackers-attack-defense-contractor-cpi/

AMD processors from 2011 to 2019 vulnerable to two new attacks

A new paper released by the Graz University of Technology details two new attacks that can leak secret data from AMD processors by manipulating the L1D cache predictor. The researchers claim that the vulnerability impacts all AMD processors from 2011 to 2019. The new potential attacks will be targeting a feature called L1D cache way predictor, a CPU performance related function that deals with how the cached data is processed within memory. The team has gathered enough information about the functions inside to outlay the exact mechanism that’s happening inside the L1D cache way predictor. This led them to find two new vulnerabilities as the “Collide+Probe” attack and “Load+Reload”. The research team claims to be notifying AMD about the vulnerabilities back in August 2019, but the maker didn’t address them yet.

See the full report here: https://www.zdnet.com/article/amd-processors-from-2011-to-2019-vulnerable-to-two-new-attacks/

IOTA Founder Confirms He Will Repay Victims of $1.97 Million Hack - Cointelegraph

On February 12, IOTA (MIOTA) suffered an attack targeting its official desktop wallet. The IOTA network went offline on the same day. The team asked all Trinity Wallet customers to stop using their mobile and PC wallets and not put any more funds on them. Cyber experts say that the attack was conducted via a third-party dependency from the payment provider Moonpay working with IOTA. The IOTA founder, David Sonstebo revealed that he will personally fully repay all 46 victims of last month’s IOTA hack to the tune of 8.52 million MIOTA, worth roughly $1.97 million.

See the full report here: https://cointelegraph.com/news/iota-founder-confirms-he-will-repay-victims-of-197-million-hack

Russian malware cripples some Durham city and county systems. NC SBI is investigating - Raleigh News & Observer

A malware attack hit the IT systems of the city of Durham and Durham County on Friday, the city and county announced Sunday. The cyberattack targeted the city’s operating systems, including its public safety phone networks. The city’s phone system was intentionally shut down to contain the attack. The origin of the attack is unknown and is being investigated by the North Carolina State Bureau of Investigation. WRAL first reported that the SBI said the malware used in the attack is of Russian origin and is spread through malicious email attachments and across network servers. The city and county’s websites are operating as normal, and there is no impact to the Durham County Sheriff’s Department 911 services. All non-emergency city operations and county governments will be open Monday.

See the full report here: https://www.newsobserver.com/news/local/article241015176.html

FBI: Hackers are targeting Office 365, G Suite users with business email compromise attacks - SiliconANGLE News

The U.S. Federal Bureau of Investigation has issued a new warning that hackers are currently targeting users of Microsoft Office 365 and Google G Suite in Business Email Compromise (BEC) attacks. The FBI said scams are initiated through specifically developed phish kits designed to mimic the cloud-based email services in order to compromise business email accounts and request or misdirect transfers of funds.

See the full report here: https://siliconangle.com/2020/03/08/fbi-warns-hackers-targeting-office-365-g-suite-users-business-email-compromise-attacks/

Foodmandu's website hacked, 50 thousand users' data dumped - myRepublica

Nepal’s no 1 online food delivery service provider company Foodmandu survived cyberattack last Saturday. A Twitter handle by the name of Mr. Mugger revealed the dump of data of 50 thousand Foodmandu users and also disclosed the link associated with the data. The hacker claims that they accessed 50,000 customers’ data but the company claims only 30,000 have been compromised. After the incident, Foomandu has released an official statement saying that the password and the databases are safe. Hackers only extracted certain users’ data through the web. Foodmandu has also confirmed that they are working with the Cyber Crime Division to apprehend the attackers and take down the data that has been uploaded.

See the full report here: https://myrepublica.nagariknetwork.com/news/foodmandu-s-website-hacked-50-thousand-users-data-dumped/

Netgear fixes a critical RCE that could allow to takeover Flagship Nighthawk routers

Netgear has addressed critical and high-severity flaws. A critical remote code execution vulnerability that could be exploited by an unauthenticated attacker to take over AC Router Nighthawk (R7800) hardware running firmware versions prior to 1.0.2.68, tracked as PSV-2019-0076. A high-severity flaw in several Netgear routers, the vendor tracked the flaw as PSV-2018-0352. The vulnerability is a post-authentication command injection issue and impacts Nighthawk (R7800) routers running firmware prior to version 1.0.2.60. The advisory published by the vendor also includes two high-severity issues affecting Nighthawk routers, 21 medium-severity flaws, and one low-severity vulnerability. The company did not disclose technical details of the vulnerability, it recommended to apply the necessary patches and upgrade the latest firmware.

See the full report here: https://securityaffairs.co/wordpress/99177/security/netgear-flagship-nighthawk-router-rce.html

PPP Daemon flaw opens Linux distros, networking devices to takeover attacks

Security researchers have discovered a vulnerability in the Point-to-Point Protocol Daemon (pppd) software. The vulnerability tracked as CVE-2020-8597 comes installed on many Linux-based and Unix-like operating systems and networking devices OpenSMTPD email server. The flaw can be exploited by unauthenticated attackers to achieve code execution on – and takeover of – a targeted system. The vulnerability affects Debian GNU/Linux, NetBSD, Red Hat, Ubuntu, OpenWRT, TP-LINK and Cisco offerings, and other software/products. Users are urged to apply the latest security patches to prevent jeopardies.

See the full report here: https://www.helpnetsecurity.com/2020/03/10/cve-2020-8597/

Spying concerns raised over Iran's official COVID-19 detection app

Google has removed an Android app called AC19, developed by the Iranian government to test and keep track of COVID-19 (coronavirus) infections from the Play Store. Several users accused the Iranian government of using the COVID-19 scare to trick citizens into installing the app and then collecting phone numbers and real-time geo-location data. However, the app analysis stated that it is not a malicious Trojan or spyware. Currently, the app is still being offered for download through the application's official website and other third-party app stores.

See the full report here: https://www.zdnet.com/article/spying-concerns-raised-over-irans-official-covid-19-detection-app/

Malware Spread as Nude Extortion Pics of Friend's Girlfriend

Attackers have recently warped sextortion scams into baits used to infect their targets with Raccoon (aka Legion, Mohazo, and Racealer) – information-stealing malware distributed under the MaaS (malware-as-a-service) model for $75/week or $200/month. The info stealer is delivered via exploit kits, phishing, and PUA (potentially unwanted applications). As IBM X-Force Threat Intelligence researchers discovered, attackers who claim to be the "Red Skull hacker crew" are now luring victims using emails promising to give access to the nude extortion pics of a friend's girlfriend. By playing the failed sextortion scam card, the campaign's operators attempt to tempt their potential victims to open a malicious attachment with a blurred image that requires them to enable content to be viewed. The malware payload will be deployed on their computers via embedded macros that run a Powershell command which downloads and installs the Raccoon info stealer.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-spread-as-nude-extortion-pics-of-friends-girlfriend/?&web_view=true

Malware found disguised as Vietnam government statement on Covid-19 - VnExpress International

CMC Cyber Security, an information security company, said hackers have attached malware to a file purporting to be the prime minister’s statement on the Covid-19 outbreak. Hackers have created a shortcut file named "Chi thi cua Thu tuong (prime minister’s directive) with the extension .lnk rather than the official .Ink. Since the last few characters in long file names are hidden when users open them on Windows, many are liable to click on download and infect their computer or phone. According to experts, the file contains many "abnormal" scripts, including for executing malicious code. The malware will create duplication and automatically activate the ability to run every time users start their computer. It will also create a backdoor to allow attackers to access the system and execute commands remotely, allowing them to download files and obtain users' information.

See the full report here: https://e.vnexpress.net/news/news/malware-found-disguised-as-vietnam-government-statement-on-covid-19-4066965.html

FBI arrests Russian behind Deer.io, a Shopify-like platform for cybercrime

The FBI has arrested a Russian national, believed to be behind Deer.io - a Shopify-like platform that hosts online stores where hackers advertise and sell hacked accounts and stolen user information. The suspect, named Kirill Victorovich Firsov, was arrested on Saturday, March 7, at the John F. Kennedy Airport, in New York, according to ZDNet. The site lets users host online stores for around $12/month, is believed to have hosted more than 24,000 shops and made more than $17 million, according to claims posted by Firsov on the Deer.io platform. US officials say Firsov has been in charge and running the Deer.io platform since its launch in October 2013. The FBI says that despite claims to host legitimate businesses, the Deer.io platform was used almost completely for cybercrime. They have checked more than 250 online stores hosted at Deer.io and found stores selling access to hacked accounts, hacked servers and personally identifiable information (PII) such as names, Social Security Numbers, dates of birth and addresses of victims.

See the full report here: https://www.zdnet.com/article/fbi-arrests-russian-behind-deer-io-a-shopify-like-platform-for-cybercrime/

Microsoft Leaks Info on Wormable Windows SMBv3 CVE-2020-0796 Flaw - BleepingComputer

Microsoft leaked information on a wormable pre-auth remote code execution vulnerability in its Server Message Block 3.0 (SMBv3) protocol that reportedly should have been disclosed in its Patch Tuesday. The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. Devices running Windows 10 Version 1903, Windows Server Version 1903 (Server Core installation), Windows 10 Version 1909, and Windows Server Version 1909 (Server Core installation) are impacted by this vulnerability according to a Fortinet advisory. Until Microsoft releases a security update to patch the CVE-2020-0796 RCE vulnerability and while no proof-of-concept exploits have been released yet, Cisco Talos shared that disabling SMBv3 compression and blocking the 445 TCP port on client computers and firewalls should block attacks attempting to exploit the flaw.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/

Firefox Bug Opens iPhone AirPods to Third-Party Snooping

Mozilla has addressed a Firefox flaw-CVE-2020-6812 that can impact Apple users in an unusual way. The vulnerability can allow a website with a camera or microphone access to gather information on the user through the connected AirPods. The first time AirPods are connected to an iPhone or other Apple devices, they become named after the user’s name by default and websites with camera or microphone permission can enumerate device names, disclosing the user’s name. To patch the issue, Mozilla has added a special case instance that renames devices containing the substring ‘AirPods’ to simply ‘AirPods’ to the Firefox 74 code.

See the full report here: https://threatpost.com/firefox-bug-opens-airpods-to-snooping/153569/

Avast AntiTrack certificate bug allowed others to snoop on your online activities

Security researchers have discovered a vulnerability, CVE-2020-8987, impacting Avast and AVG AntiTrack privacy software. The flaw is a certification validation issue that affects Avast AntiTrack before 1.5.1.172 and AVG AntiTrack before 2.0.0.178. The attackers can remotely exploit the vulnerability to carry out Man-in-The-Middle (MiTM) attacks, browser session hijack, and data theft. Avast has patched the vulnerability in Avast AntiTrack version 1.5.1.172 and AVG AntiTrack version 2.0.0.178 and rolled it out to the users.

See the full report here: https://www.zdnet.com/article/avast-antitrack-certificate-bug-allowed-others-to-snoop-on-your-online-activities/

Microsoft Hijacks Necurs Botnet that Infected 9 Million PCs Worldwide

Microsoft announced that it successfully disrupted the botnet network of the Necurs malware and also hijacked the majority of its infrastructure by breaking the domain generation algorithm (DGA) implemented by the Necurs malware. First detected in 2012, the botnet infected more than 9 million computers globally. Microsoft was also able to accurately predict over six million unique domains that would be created in the next 25 months and reported these domains to their respective registries in countries around the world so the websites can be blocked and thus prevented from becoming part of the Necurs infrastructure.

See the full report here: https://thehackernews.com/2020/03/necurs-botnet-takedown.html

Entercom Radio Giant Says Data Breach Exposed User Credentials - BleepingComputer

Radio network and broadcasting company, Entercom, has disclosed a data breach that took place in August 2019 after an unauthorized party was able to access database backup files stored third-party cloud hosting services and containing Radio.com user credentials. Based on the investigation, the company said the attacker was able to gain access to the names, usernames, and passwords of the impacted Radio.com users. The radio giant has notified the impacted users and urges them to change their passwords for Radio.com accounts and for any other accounts where the same password was used. At the moment, details about the number of affected users remain private.

See the full report here: https://www.bleepingcomputer.com/news/security/entercom-radio-giant-says-data-breach-exposed-user-credentials/

New TrickBot Variant Updates Anti-Analysis Tricks

Security researchers have discovered a new variant of the TrickBot malware that relies on anti-analysis techniques, an update in its payload downloading method and component integration. The malware spreads via malicious Word documents, which when opened asks the victim to click on “Enable Content”, after which a malicious macro (VBA code) gets executed. The VBA code extracts and runs the JavaScript file. When the JavaScript is executed it waits for a minute to bypass any auto-analysis tool and then executes a command to fetch all the running processes on the infected machine. Further, the JS file downloads the payload and copies itself into the Windows startup folder to maintain persistence. The new variant integrates the ‘system info’ module into the payload, to inform the server about the module's success. Also, there is a change in the command used to request up-to-date server configuration data.

See the full report here: https://threatpost.com/new-trickbot-variant-updates-anti-analysis-tricks/153616/

Beware of 'Coronavirus Maps' – It's a malware infecting PCs to steal passwords

The hype around the disastrous spread of COVID-19 (coronavirus) is actively being exploited by threat actors to target victims across the internet. Security researchers have discovered a new malware attack that targets people looking for cartographic presentations of the spread of COVID-19 on the Internet and tricks them into downloading a malicious application. On its front-end, the malicious application shows a map loaded from a legit online source but in the background compromises the computer. The malware is identified as AZORult, an information-stealing malicious software. AZORult malware collects information stored in web browsers, particularly cookies, browsing histories, user IDs, passwords, and even cryptocurrency keys.

See the full report here: https://thehackernews.com/2020/03/coronavirus-maps-covid-19.html

Phishing Attack Skirts Detection With YouTube

Security researchers have discovered a new campaign that is using legitimate YouTube redirect links to bypass security filters and redirect the victim to a phishing landing page. The attackers purported to be with SharePoint and sent phishing emails, originating from a fraud domain, sharepointonline-po.com, indicating that a new file has been uploaded to the target company’s SharePoint site, and included an option to “View File.” Hovering over the “View File” URL, showed a seemingly-legitimate embedded YouTube link. Upon clicking on the URL, victims are redirected to YouTube, and then immediately redirected to an attacker-controlled phishing landing page.

See the full report here: https://threatpost.com/phishing-skirts-detection-youtube/153639/

Nasty Phishing Scam Pretends to Be Your HIV Test Results - BleepingComputer

A new phishing scam has been uncovered that uses HIV test results as bait to trick victims into downloading malicious files. The scammers attack victims with phishing emails camouflaged as their HIV test results from Vanderbilt University. Malicious Excel spreadsheets named TestResults.xlsb are attached to these emails, which when opened, prompt the victims to 'Enable Content' to view the document. Upon enabling content, malicious macros will be executed that downloads and installs the Koadic penetration test and post-exploitation toolkit. Using Koadic, the attackers gain complete control over the infected computer and can execute commands to download further malware or steal files.

See the full report here: https://www.bleepingcomputer.com/news/security/nasty-phishing-scam-pretends-to-be-your-hiv-test-results/

Flaws Riddle Zyxel’s Network Management Software

Security researchers have identified nearly 16 vulnerabilities, ranging from multiple backdoors and default credentials to insecure memory storage in Zyxel's CNM SecuManager. The Zyxel CNM SecuManager is a networking management software solution that provides an integrated console to monitor and manage enterprise security gateways, such as the company’s own ZyWALL USG and its VPN series products. The company claims that its vulnerable software is used by a limited number of customers and assures that they are investigating the issue. However, the vulnerabilities reported by the researchers could not be found on the company’s security advisory page yet.

See the full report here: https://threatpost.com/flaws-zyxels-network-management-software/153554/