Threat Intelligence Bulletin: 03/13/20

Analysis of VMware Fusion Local Privilege Escalation Vulnerability

VMware released a security update for their Apple OS X specific virtualization software called Fusion. It has been reported to Alpha Team researchers the original patch for this issue failed to address the issue. After extensive analysis, Alpha Team has concluded that this vulnerability does not pose a significant threat to OS X security.

Vulnerability Details

A mixture of unique conditions in OS X and Fusion allow a local user to escalate their privileges to root. The vulnerability requires the attacker to already have a local account on the victim system. The vulnerability relies on OS X allowing users to create hard symbolic links to setuid binaries.

Recommendations

Apply patches. VMware has released a patch that addresses this issue that is described here.
Follow best practices for hardening your OS X.
Limit physical access to Apple hardware to reduce attack surface.

Analyst Insight

Although this vulnerability is not particularly groundbreaking, Alpha Team chose to review because according to OSINT sources, the original VMware patch does not actually fix the flaw. Patches that don’t fix the issue are worthing exploring because of the insights they offer into the software development cycle of the vendor.

Alpha Team assesses with high confidence that this vulnerability alone does not pose a significant risk to OS X integrity. This exploit could be included in OS X attack chains, but it will have to be used with other vulnerabilities.

Technical Analysis

The vulnerability was reported to VMware by Grimm, a cybersecurity-focused consulting company. When the original patch was released by VMware, Grimm released a detailed blog about discovery and exploitation of these flaws. The blog can be found here. Grimm’s blog links to a GitHub repository that contains sample code to take advantage of the vulnerabilities.

The issue is caused by incorection permissions being set on tools that Fusion requires to run. These permissions allow a normal user to elevate to root. We duplicated the steps detailed in the blog on a machine with the VMware patches installed.

The first step was determining if the Fusion binaries still had the same permissions set. A quick search using the command line utility find will show the answer.

Next is just running the exploit script. There are two scripts: one for Fusion core services and one specifically for the USB proxy tool. Testing has shown that the scripts have the same functionality and are equally reliable.

After running these scripts, we have a root shell on a patched version of VMware Fusion.

Research and Exploitation

This exploit alone does not pose a significant risk to OS X security due to the privilege level required for successful exploitation. Alpha Team has observed no occurrences of this exploit or vulnerability exploitation in the wild.

Breaking News: 2020-03-13 - 2020-03-19

Researchers Warn of Novel PXJ Ransomware Strain

Security researchers have discovered a new ransomware strain, PXJ. The initial infection vector of the malware is unknown. Once infected, it disables the system’s ability to restore the files from deleted stores, empties the recycle bin and executes a series of commands to prevent the recovery of the encrypted data. The encryption process uses double AES and RSA algorithms and drops a ransom note with the name “LOOK.txt”.

See the full report here: https://threatpost.com/novel-pxj-ransomware-strain/153673/

Open Exchange Rates Data Breach Affects Users of Well-Known Orgs - BleepingComputer

Open Exchange Rates, a company that allows organizations to query real-time and historical exchange rates for over 200 world currencies, suffered a data breach that exposed the personal information and salted and hashed passwords for customers of its API service. The company stated that its API service is used by companies such as Etsy, Shopify, Coinbase, Kickstarter, and more. Investigations show that the hackers had access to the company's customer database for almost a month between February 9th, 2020, and March 2nd, 2020. The breached information included customers' names, email addresses, encrypted/hashed account passwords, IP addresses, App IDs, and country of residence. Open Exchange Rates has disabled the password for all accounts created before March 2nd, 2020 and expects users to reset their passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/open-exchange-rates-data-breach-affects-users-of-well-known-orgs/

Fresh virus misery for Illinois: Public health agency taken down by... web ransomware. Great timing, scumbags

Illinois-based Champaign Urbana Public Health District (CHUPD), covering around 210,000 folks, including the state's biggest university, suffered a ransomware infection amidst the COVID-19 (coronavirus) fright. CHUPD had to set up an alternate website as the cyberattack that took down its primary site. However, the organization's Facebook page remains active with advice on how to prevent and report the COVID-19 infection. Currently, the organization is working to get its attacked website up and running.

See the full report here: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

New CoronaVirus Ransomware Acts as Cover for Kpot Infostealer - BleepingComputer

Security researchers have uncovered a campaign that distributes a newly discovered ransomware called “CoronaVirus" and the Kpot information-stealing Trojan. The malware gets distributed via a web site that impersonates the legitimate Windows system utility site called “WiseCleaner[.]com”. The fake web site downloads the installer named “WSHSetup.exe” that acts as a downloader for both the malware. The first file downloaded by the installer is the Kpot password-stealing Trojan which when executed steals cookies, login credentials from web browsers, messaging programs, VPNs, FTP, email accounts, gaming accounts such as Steam and Battle.net, and other services. The malware also takes a screenshot of the active desktop and attempt to steal cryptocurrency wallets stored on the infected computer. The second file is the CoronaVirus Ransomware, which it uses to encrypt the files on the infected computer. Upon encrypting, it renames the file name to attacker's email address also it renames the C drive to CoronaVirus and then drops a ransom note with the name “CoronaVirus.txt” demanding 0.008 bitcoins.

See the full report here: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/

Microsoft quickly releases patch for wormable SMB flaw

Microsoft announced the release of the KB4551762 security update, that addresses the pre-auth RCE Windows 10 vulnerability found in Microsoft Server Message Block 3.1.1 (SMBv3). The vulnerability could allow attackers to exploit the remote code execution found in SMBv3 by sending a specially-crafted packet to the targeted SMBv3 server. According to Microsoft, attacks exploiting the vulnerability have not been observed. However, users running Windows 10 version 1903 or 1909 are urged to install the update.

See the full report here: https://www.itpro.com/operating-systems/microsoft-windows/354992/microsoft-quickly-releases-patch-for-wormable-smb-flaw

Pacemakers and insulin pumps vulnerable to hacking-HPRA - BreakingNews.ie

The Health Products Regulatory Authority (HPRA) warns the public about exploit codes available in the wild that can hack medical devices running on Bluetooth Low Energy (BLE) protocol. Insulin pumps and pacemakers are two devices highlighted as possible targets. Hackers can force the devices to crash or reboot and threaten their users' health.

See the full report here: https://www.breakingnews.ie/business/pacemakers-and-insulin-pumps-vulnerable-to-hacking-hpra-987820.html

New Android Cookie-Stealing Malware Found Hijacking Facebook Accounts

A new Android malware strain called Cookiethief has been discovered that steals users' authentication cookies from the web browsing and other apps, including Chrome and Facebook, installed on the compromised devices. The Trojan could land up on the device by planting such malware in the device firmware before purchase, or by exploiting vulnerabilities in the operating system to download malicious applications. Once the device is infected, the malware connects to a backdoor called Bood, installed on the same infected device to execute "superuser" commands that facilitate cookie theft. The stolen information could later be used to hijack victims' social media accounts to spread malicious links and phishing attacks. Users are urged to block third-party cookies, clear the cookies regularly, browse using the private mode to mitigate the risks.

See the full report here: https://thehackernews.com/2020/03/android-cookies-malware-hacking.html

Browser vendor leaks data via open server

Personal details of thousands of web developers that had registered profiles with the Blisk website/browser has been exposed to the internet due to an unprotected Elasticsearch server. Researchers found nearly 2.9 million records, amounting to 3.4 GB of data that appeared to be log entries for actions developers were taking inside the browser, such as registering profiles or inviting friends. Personal details leaked via the exposed servers included email addresses and user-agent strings. However, the company claims that the leak did not expose sensitive information, such as passwords, financial information, or personally identifiable information (PII), such as names, billing info, or phone numbers, which were not stored on the leaked server.

See the full report here: https://www.zdnet.com/article/browser-vendor-leaks-data-via-open-server/

Czech hospital hit by cyberattack while in the midst of a COVID-19 outbreak

The Brno University Hospital, one of the Czech Republic's biggest COVID-19 testing laboratories suffered a cyber attack on 13 March 2020. Following the incident, the hospital was forced to shut down its entire IT network, postpone urgent surgical interventions and re-route new acute patients to nearby St. Anne's University Hospital. However, it is unclear if the hospital's coronavirus testing capability was impacted, even temporarily, by the cyber-attack. The other two branches of the hospital, the Children's Hospital, and the Maternity Hospital were also affected. Currently, the hospital is working on recovering their IT network.

See the full report here: https://www.zdnet.com/article/czech-hospital-hit-by-cyber-attack-while-in-the-midst-of-a-covid-19-outbreak/

Slack Bug Allowed Automating Account Takeover Attacks - BleepingComputer

Slack fixed a critical vulnerability discovered by security researchers, which could allow an attacker to automate the takeover of arbitrary accounts upon stealing session cookies using an HTTP Request Smuggling CL.TE hijack attack on hxxps://slackb.com/. The malicious actor could create automated bots that attack the vulnerable in-scope Slack asset continuously, jump to the victim's session, and steal all reachable data. Slack also fixed another bug that could have allowed attackers to steal a user's authentication token, giving them full control over the victim's messages and account.

See the full report here: https://www.bleepingcomputer.com/news/security/slack-bug-allowed-automating-account-takeover-attacks/

Microsoft Unveils New Windows 10 Automatic Driver Update Plan - BleepingComputer

Microsoft has unveiled a new Windows 10 automatic driver update plan that will reduce the number of reliability issues users experience in Windows 10. The new drivers will be gradually rolled out to a small group of programmatically chosen users before slowly releasing the driver to the rest of the Windows 10 population.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-unveils-new-windows-10-automatic-driver-update-plan/

Chinese APT Hackers Exploit MS Word Bug to Drop Malware Via Weaponized Coronavirus Lure Documents

Researchers uncovered a new COVID-19 campaign that leverages the Coronavirus scare to deliver unknown malware in Windows. The attack believed to initiated by the long-running Chinese APT group that targets various government and private sectors. Attackers are using new hacking tools to operate attack using suspicious RTF documents. The RTF documents were embedded with malicious code that exploits the Equation Editor vulnerabilities of Microsoft Word. Few of the malicious documents were written in the Mongolian language, with one of them allegedly from the Mongolian Ministry of Foreign Affairs and the document contains information about the new Coronavirus infections.

See the full report here: https://www.itsecuritynews.info/?p=841187

BlackWater Malware Abuses Cloudflare Workers for C2 Communication - BleepingComputer

A new backdoor malware called Blackwater is pretending to spread COVID-19 information by using Cloudflare Workers as an interface to the malware's command and control server. Cloudflare Workers are JavaScript programs that run directly on Cloudflare's edge so that they can interact with connections from remote web clients. They can be used to modify the output of a web site behind Cloudflare, disable Cloudflare features, or even act as independent JavaScript programs running on the edge that displays the output. According to MalwareHunterTeam, a RAR file is being distributed, containing "Important - COVID-19.docx.exe". The executable file, hidden using a Word icon, contains information on the COVID-19 virus and is used by the malware as a decoy to install other malicious software on the computer. The malware then connects Cloudflare Worker that acts as a command and control server to execute further commands. Attackers are using Cloudflare Worker instead rather than connecting directly to the C2 to prevent IP blocking.

See the full report here: https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/

Massive cyber attack hit the town hall of Marseille ahead local election

Ahead of the 2020 municipal elections in Marseille that will take place on 15 and March 22, a cyber attack hit the city of Marseille as well as the metropolis Aix-Marseille-Provence. The authorities confirmed that the town hall of Marseille and the metropolis were hit by a ransomware that was able to bypass defense measures that were adopted. About 300 machines that were supposed to create the proxy checklists, have been rendered inoperative according to the National Information Systems Security Agency (Anssi), in the Aix-Marseille-Provence metropolis as well as in Martigues and will not affect the elections. There are no details about the attack and the family of ransomware, yet.

See the full report here: https://securityaffairs.co/wordpress/99658/malware/marseille-city-massive-attack.html

Princess Cruises discloses data breach as coronavirus halts business - Business Insider - Business Insider

Princess Cruises announced a data breach last week that affected customers' personal, financial, and health data. The data breach occurred between April and July 2019 wherein hackers gained access to employee email accounts that contained personal information regarding our employees, crew, and guests. The breach announcement comes during a tough time for Princess, which announced Thursday that it would suspend operations globally through at least May 11 following COVID-19 outbreaks that occurred on 2 of its ships.

See the full report here: https://www.businessinsider.com/princess-cruises-discloses-data-breach-as-coronavirus-halts-business-2020-3

Coronavirus tracking app locks up Android phones for ransom - SC Magazine

DomainTools researchers have discovered a malicious Coronavirus tracking Android app that locks users’ phones and demands a ransom in order to restore access. Dubbed CovidLock, the newly discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone. Victims are given a 48-hour deadline to pay a $100 ransom in bitcoin. The ransomware program also threatens to erase one’s contacts, photos, videos and memory, as well as leak the victim’s social media accounts, if not paid. Cybercriminals are using dramatic events that cause people to be emotional or fearful to drive their profits.

See the full report here: https://www.scmagazine.com/home/security-news/news-archive/coronavirus/coronavirus-tracking-app-locks-up-android-phones-for-ransom/

Microsoft Bing team launches COVID-19 tracker

The Microsoft Bing team has today launched a web portal for tracking COVID-19 infections across the globe. The website, accessible at bing.com/covid, is a basic tracker that shows up-to-date infection statistics for each country around the globe and all the US states. Data is collected from authoritative sources including the World Health Organization (WHO), the US Centers for Disease Control and Prevention (CDC), and the European Centre for Disease Prevention and Control (ECDC).

See the full report here: https://www.zdnet.com/article/microsoft-bing-team-launches-covid-19-tracker/

Headlines2 days ago North Carolina Eyecare Practice Reports Malware Attack - InvisionMag

Randleman Eye Center in North Carolina has reported that it was the victim of a malware attack. The incident took place around 10th January 2020, in which some of the systems were accessed by an unauthorized person. The malware encrypted certain files, including on a server that contained patient protected health information. The affected data may include first and last name, date of birth, gender, and digital retinal images. There is currently no evidence that suggests this malware incident actually resulted in the acquisition of any personal information beyond its encryption. The company has engaged a third-party forensics firm to investigate the scope and source of the incident. Additionally, the affected patients are provided with one year of free credit monitoring services.

See the full report here: https://invisionmag.com/north-carolina-eyecare-practice-reports-malware-attack/

Google's Verily launches coronavirus website

Verily, one of Google’s subsidiaries has launched a website that encourages users to answer questions about their recent health and travel that determines whether they could get a free coronavirus test. The site is currently only available for adults based in northern California with testing centers in San Mateo and Santa Clara. The company has announced that the site will be soon available in the rest of the United States and other countries.

See the full report here: https://www.itpro.co.uk/news/355008/googles-verily-launches-coronavirus-website

US Health Department Hit by Cyber-Attack Amid Coronavirus - Gadgets 360

The US Department of Health and Human Services, a key part of the federal response to the fast-spreading coronavirus outbreak suffered a cyber attack on 15 March 2020. Department spokeswoman Caitlin Oakley said there had been a significant increase in activity on HHS cyber infrastructure. National Security Council spokesman John Ullyot said department networks are currently functioning normally and officials are investigating the unspecified cyber incident.

See the full report here: https://gadgets.ndtv.com/internet/news/us-health-department-hit-by-cyber-attack-amid-coronavirus-2195980

FBI Warns of Human Traffickers Luring Victims on Social Networks

The U.S. Federal Bureau of Investigation's Internet Crime Complaint Center warns the public to remain vigilant of the threats posed by criminals who lure individuals into forced labor or sex work using online platforms such as social media and dating platforms. According to the FBI, individuals who share personal information on online platforms are the ones most likely to be targeted by such criminals. Human traffickers pretend to be legitimate job recruiters or agents of employment agencies and bait potential victims using this personal information, with the promise of fake employment and subsequently coerce individuals into sex work or forced labor.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-human-traffickers-luring-victims-on-social-networks/

Intel CPUs vulnerable to new 'Snoop' attack

Intel processors are vulnerable to a new type of attack, "Snoop-assisted L1 Data Sampling” that can leak data from the CPU's internal memory. Tracked as CVE-2020-0550, the vulnerability exploits various CPU mechanisms like multiple cache levels, cache coherence, and bus snooping that can trigger errors and lead to data leak from the cache. Primarily, this issue affects Core and Xeon processors. The downside of this attack is that it's hard to pull off and requires certain conditions to successfully execute it. For users who run high-risk systems, Intel recommends applying the Foreshadow (L1TF) patches, released in August 2018. Furthermore, disabling the Intel TSX (Transactional Synchronization Extensions) feature also greatly reduces the attack surface and makes Snoop attacks even harder.

See the full report here: https://www.zdnet.com/article/intel-cpus-vulnerable-to-new-snoop-attack/

Virtual machines, real problems: VMware fixes bug trio including guest-to-host hole in Workstation, Fusion - The Register

VMware has released security patches for a trio of bugs in its desktop-class virtualization products. One of the critical vulnerabilities, CVE-2020-3947, in VMware Workstation and Fusion can be exploited by attackers in a guest VM to gain code execution on the host box via the vmnetdhcp component. The second bug, CVE-2020-3948 in VMware Workstation and Fusion with Cortado Thinprint could lead to privilege escalation in Linux virtual machines on Windows and macOS hosts when Virtual Printing is enabled. The third bug, assigned as CVE-2020-5543, is a privilege-escalation flaw present in VMware Horizon Client, VMRC and Workstation. Users are advised to update their machines to the latest available version of the software.

See the full report here: https://www.theregister.co.uk/2020/03/17/virtual_machines_patch/

Nation-Backed Hackers Spread Crimson RAT via Coronavirus Phishing - BleepingComputer

Researchers have discovered APT36's ongoing attacks where threat actors are attempting to deploy the Crimson Remote Administration Tool (RAT) onto the systems of targets via a spear-phishing campaign using Coronavirus-themed health advisories. APT36 uses two lure formats in this campaign: Excel documents with embedded malicious macros and RTF documents files designed to exploit the CVE-2017-0199 Microsoft Office/WordPad remote code execution vulnerability. Once the malicious documents are opened and the malicious macros are executed, a 32-bit or a 64-bit version of the Crimson RAT payload will be dropped based on the victim's OS type. After the device is compromised, the attackers can perform a wide range of data theft tasks and send all the collected information on the victim, including the list of running processes, the machine's hostname, and the currently logged in username.

See the full report here: https://www.bleepingcomputer.com/news/security/nation-backed-hackers-spread-crimson-rat-via-coronavirus-phishing/

Financial companies leak 425GB in company, client data through open database

An open database has exposed around 425GB of sensitive documents that belong to financial companies. The database appears to be associated with MCA Wizard, a now-defunct app developed by Advantage Capital Funding and Argus Capital Funding. According to the sources, the database was first discovered in December 2019 due to the lack of encryption, authentication or access credentials of an Amazon Web Services (AWS) S3 bucket. Anyone with an internet connection and the S3 bucket address was able to access the database. Over 500,000 highly sensitive documents were found, including private legal and financial files, that originated from Advantage and Argus. The exposed data includes entries related to the companies' businesses, credit reports, bank statements, contracts, legal documents, driver license copies, purchase orders and receipts, tax returns, Social Security information, and transaction reports.

See the full report here: https://www.zdnet.com/article/financial-apps-leak-425gb-in-company-data-through-open-database/

Trickbot gtag red5 distributed as a DLL file, (Wed, Mar 18th)

According to SANS researchers, Trickbot is using a Windows DLL file as bait in its new distribution mechanism. Trickbot is an information stealer/banking malware that uses modules to perform different functions. Previously, Trickbot was distributed as a Windows EXE but now users are tricked into enabling macros in the malicious document, used for propagation. On enabling, the Word document saves a copy of itself. A malware loader is installed on the system that stealthily executes functions to spread the infection across the system. The malware later installs a DLL file to keep Trickbot persistent. Authors of the malware are using a varied approach to initiate the propagation of Trickbot malware.

See the full report here: https://isc.sans.edu/diary/rss/25918

TrueFire Guitar Tutoring Website Suffers Magecart-style Credit Card Breach

According to The Hacker News, TrueFire, one of the popular guitar tutoring websites with over 1 million users reportedly suffered a 'Magecart' style data breach incident that may have potentially led to the exposure of its customers' personal information and payment card information. The breach notification reveals that an attacker gained unauthorized access to the company's web server somewhere around mid last year and stole payment information of customers that were entered into its website for over five months, between August 3, 2019, and January 14, 2020. The potentially exposed information includes customers' names, addresses, payment card account numbers, card expiration dates, and security codes. Customers who made online payments at the TrueFire website between last August and this January are urged to block their payment cards. All users are encouraged to change passwords for their TrueFire account and for any other online account where they use the same credentials.

See the full report here: https://thehackernews.com/2020/03/truefire-guitar-tutoring-data-breach.html

Two Trend Micro zero-days exploited in the wild by hackers

Trend Micro has patched two zero-day bugs in its Apex One and OfficeScan XG enterprise security products after the hackers tried to exploit them in the wild. The two zero-days are CVE-2020-8467, which could allow remote attackers to execute arbitrary code on affected installations (RCE), and CVE-2020-8468, which could allow an attacker to manipulate certain agent-client components. Patches for both zero-days were released on 19 March 2020, along with fixes for three other similarly critical vulnerabilities, CVE-2020-8470, CVE-2020-8598, and, CVE-2020-8599, all of which received a severity rating of 10 out of 10 on the CVSSv3 vulnerability scale.

See the full report here: https://www.zdnet.com/article/two-trend-micro-zero-days-exploited-in-the-wild-by-hackers/

New Nefilim Ransomware Threatens to Release Victims' Data - BleepingComputer

Security researchers have discovered a new ransomware called Nefilim that shares much of the same code as Nemty and is most likely spread through exposed Remote Desktop Services. The main difference between Nemty and Nefilim is that Nefilim has removed the Ransomware-as-a-Service (RaaS) component and now relies on email communications for payments rather than a Tor payment site. After encrypting files using AES-128 encryption, the ransomware appends these files with the .NEFILIM extension. A ransom note named NEFILIM-DECRYPT.txt with ransomware operators' contact and payment information is created throughout the system. Additionally, the ransom note contains a threat that they will leak data if a ransom is not paid within seven days of the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/

Hackers Hide Malware C2 Communication By Faking News Site Traffic - BleepingComputer

In a recent phishing campaign, hackers used a fake host header which was named after a known news site to protect the backdoor from analysis attempts. The backdoor was referred by the names Spark and EnigmaSpark which appears to be associated with the MoleRATs group. The infection begins with the delivery of a malicious Microsoft Word document, written in Arabic which prompts the victim to enable the 'Edit Content' option. According to the researchers, the document gets downloaded from a Google Drive link, embedded with a macro that delivers the final payload, 'runawy.exe.' Further, the macros were password-protected and base 64 encoding scheme was applied on the backdoor and the malware binary was packed with Enigma Protector, a legitimate tool for protecting executable files from illegal copying, hacking, modification, and analysis. Also, the hackers used a fake host header in the HTTP‌ POST request that delivers victim system info to the command and control (C2) server.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hide-malware-c2-communication-by-faking-news-site-traffic/

Firefox to remove support for the FTP protocol

Mozilla announced that it plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year. Users will still be able to view and download files via FTP, but they'll have to re-enable FTP support via a preference inside the about:config page. However, Mozilla plans to eventually remove the entire code that supports the FTP protocol inside Firefox, which is scheduled for the start of 2021, when there will be no workaround for re-enabling FTP support, and Firefox will stop handling FTP content altogether. After this, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser.

See the full report here: https://www.zdnet.com/article/firefox-to-remove-support-for-the-ftp-protocol/

France warns of new ransomware gang targeting local governments

France's CERT team, CERT-FR, has issued an alert warning about a new ransomware gang, Pysa ransomware, that's been targeting the networks of local government authorities. Pysa ransomware is a version of the Mespinoza ransomware and was first spotted last year, in October 2019. CERT-FR says the Pysa gang has moved to target French organizations, with the agency receiving reports of multiple infections. While CERT-FR is still investigating how the Pysa gang is gaining access to victim's networks, ransomware gang has also made victims outside France, across multiple continents, hitting both government and business-related networks.

See the full report here: https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/

Ransomware Gangs to Stop Attacking Health Orgs During Pandemic - BleepingComputer

BleepingComputer reached out to the operators of the Maze, DoppelPaymer, Ryuk, Sodinokibi/REvil, PwndLocker, and Ako Ransomware infections to ask if they would continue targeting health and medical organizations during the outbreak and learned that DoppelPaymer and Maze ransomware will stop targeting medical organizations until the end of the pandemic. The ransomware operators also told that healthcare victims should contact them on their email or Tor webpage to provide proof and get a decryptor.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gangs-to-stop-attacking-health-orgs-during-pandemic/

Trickbot, Emotet Malware Use Coronavirus News to Evade Detection - BleepingComputer

BleepingComputer has discovered that the crypters for TrickBot and Emotet are using text snippets from the Coronavirus pandemic news stories to attempt to bypass security software using artificial intelligence and machine learning to detect malware. A crypter is a program used to obfuscate or encrypt the malicious code and make the malware appear harmless and fully undetectable to antivirus software. It is not known if the use of these text strings has been of any benefit to the threat actors, but researchers believe that it could be useful against artificial intelligence and machine learning security engines. People are urged to be wary of any emails with unsolicited attachments about the Coronavirus.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-emotet-malware-use-coronavirus-news-to-evade-detection/

Magecart Cyberattack Targets NutriBullet Website

NutriBullet, a blender manufacturer website was targeted by the Magecart Group 8, in an attempt to steal the payment card data of its online customers. Researchers found that a JavaScript web skimmer code was first inserted on the website of the blender retailer (nutribullet.com) on 20 February 2020, specifically targeting the website’s checkout page, where customers input their payment information. The researchers also observed that the skimmer was removed on March 1, and was replaced with a new skimmer on the website on March 5. As of 17 March 2020, NutriBullet said that they have removed the malicious code from their website.

See the full report here: https://threatpost.com/magecart-cyberattack-targets-nutribullet-website/153855/