Threat Intelligence Bulletin: 03/20/2020 - 03/26/2020

Breach Disclosure: PropTiger

In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed. This week however, that database ended up on the popular hacking site, RaidForums for users to download and analyze. There were an estimated 2 million users affected by this security breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

PropTiger is an independent real estate advisor with a pan-India presence, which has around 500 relation managers spread across the country. This breach contained a decent amount of personal information, including things like IP addresses, passwords which were base64 encoded MD5 hashes, birthdates, and names.

Figure 1. Raidforums posting for PropTiger dump

Breach Disclosure: Tamodo

Tamodo experienced a data breach in February of this year, resulting in the loss of 495,000 records of users. This breach resulted in the exposure of names, email addresses, dates of birth and passwords stored as bcrypt hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Tamodo is an affiliate network, that acts as a middleman between advertisers and publishers. Tamodo failed to respond to multiple attempts to report the breach via published communication channels.

Figure 1. RaidForums sale ad for Tamodo dump

While passwords were included in this breach, multiple users in the RaidForums post for this breach said the passwrods would be too hard to decrypt, which makes this slightly less appealing than others, however, there is still valuable information included in this dump.

Threat Update: Microsoft Warns Of Windows Adobe Type Manager Library Out-of-Band Remote Code Execution Vulnerabilities: ADV200006

On 23 March 2020, Microsoft released an out-of-band security advisory ADV200006 to address two critical remote code execution vulnerabilities in Adobe Type Manager (ATM) Library. The name of the ATM library came from an Adobe developed tool, ATM Light. Microsoft included native support for the ATM fonts. These vulnerabilities exist within Windows’ native integration for support of PostScript fonts. Microsoft is aware of limited, targeted attacks exploiting these vulnerabilities in the wild.

Recommendations

Enhanced Security Configuration, which is turned on by default on Windows Servers, does not mitigate the vulnerabilities. While patches are not available for these vulnerabilities, Microsoft provided the following workarounds to secure vulnerable systems:

1. Disable the Preview Pane and Details Pane in Windows Explorer (WE)
2. Disable the WebClient service
3. Rename ATMFD.DLL or disable the registry key for Windows 8.1 and below

Disabling the Preview Pane and Details Pane in Windows Explorer(WE) Disabling the Preview and Details panes in WE prevents the automatic display of OTF fonts in WE. While this prevents malicious files from being viewed in WE, it does not prevent a local, authenticated user from running a specially crafted program to exploit this vulnerability. To disable these panes in Windows 8.1 and before, perform the following steps:

Open WE, click Organize, and then click Layout.

• Clear both the Details pane and Preview pane menu options.
• Click Organize, and then click Folder and search options.
• Click the View tab.
• Under Advanced settings, check the Always show icons, never thumbnails box.
• Close all open instances of WE for the change to take effect.
• Disable the WebClient service.

Disabling the WebClient service helps protect affected systems from attempts to exploit this vulnerability by blocking the most likely remote attack vector through the WebDAV client service. It is still possible for remote attackers who successfully exploit this vulnerability to cause the system to run programs located on the targeted user’s computer or the LAN, but users will be prompted for confirmation.

To disable the WebClient Service, perform the following steps:

• Click Start, click Run, type Services.msc, and click OK.
• Right-click WebClient service and select Properties.
• Change the Startup type to Disabled. If the service is running, click Stop.
• Click OK and exit the management application.

Rename ATMFD.DLL:

• Enter the following commands at an administrative command prompt:
• cd “%windir%\system32”
• takeown.exe /f atmfd.dll
• icacls.exe atmfd.dll /save atmfd.dll.acl
• icacls.exe atmfd.dll /grant Administrators:(F)
• rename atmfd.dll x-atmfd.dll
• Restart the system.

Optional procedure for Windows 8.1 operating systems and below (disable ATMFD):

• Method 1 (manual):
  • Run regedit.exe as Administrator.
  • In Reg Editor, navigate to the following sub key (or create it) and set its DWORD value to 1: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1
  • Close Registry Editor and restart the system.
• Method 2 (using a script):
  • Create a text file named ATMFD-disable.reg that contains the following text:
  • Windows Registry Editor Version 5.00
  • [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • “DisableATMFD”=dword:00000001
  • Run regedit.exe.
  • In the Registry Editor, click the File menu and then click Import.
  • Navigate to and select the ATMFD-disable.reg file that you created in the first step.
  • Click Open and then click OK to close Registry Editor.

Customers are advised to apply ADV200006 workarounds for affected operating systems until a patch is released to be protected from this vulnerability.

Details

Adobe Type Manager, provided by atmfd.dll, is a kernel module by Windows to support OpenType fonts. The vulnerabilities exist within the way that Windows parses OpenType fonts. Successful exploitation would require a remote attacker to convince a user to open a specially crafted document leading to memory corruption and executing arbitrary code on the system. This may result in a complete compromise of vulnerable systems.

Affected Systems:

• Windows 10
• Windows 8.1
• Windows 7
• Windows RT 8.1
• Windows Server 2008
• Windows Server 2008 R2
• Windows Server 2012
• Windows Server 2012 R2
• Windows 2016
• Windows Server 2019
• Windows Server, version 1803
• Windows Server, version 1903
• Windows Server, version 1909

Proof of concept: There are no known public proofs of concepts available for these vulnerabilities at this time, but Microsoft is aware of “limited targeted attacks” exploiting these vulnerabilities in the wild.

ZeroFOX Alpha Team is actively monitoring this situation as new details develop. ZeroFOX recommends enacting the recommendations above as a precaution until further information is made available.

Breach Disclosure: Federal Security Service (FSB)

The Federal Security Service (FSB) of the Russian Federation fell victim to a cyberattack after the Russian hacker group, Digital Revolution, breached a contractor for the FSB. According to an article on Forbes, the breach leaked technical documents, diagrams, and code fragments for an FSB project called Fronton. The FSB breach allegedly exposed the goal of the “Fronton Program” that aims to exploit IoT security vulnerabilities.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The breached information, accounted for nearly 12 technical documents that date back to 2017/2018. This information was published on the Russian hacker group, Digital Revolution's website, on March 18, 2020. Chatter on Digital Revolution's official website and their Twitter page indicate that the exposed documents exhibit an IoT botnet building process.

Figure 1. Digital Revolution’s Twitter handle advertising the leaked files.

According to several news articles, including Forbes and BBC Russia, the Fronton botnet would potentially be capable of performing a wide spectrum of cyberattacks on IoT devices with default factory settings. Upon a successful attack, the targeted internet security cameras and digital recorders (NVRs) device would be captured in the botnet.

Figure 2. Leaked folders, files, and images

This is not the first time the FSB was targeted by the Digital Revolution. According to the reports, an FSS (Federal Security Service) contractor SyTech was hacked. FSS had been working on an internet surveillance technology, and was hacked by a group named “0v1ru$”. Digital Revolution subsequently published SyTech’s leaked data on their sites in mid-2019.

Breaking News: 2020-03-20 - 2020-03-26

Rogers Data Breach Exposed Customer Info in Unsecured Database - BleepingComputer

Canadian ISP Rogers Communications has suffered a data breach due to an unsecured database that has exposed the personal information of its customers. The incident took place on February 26, 2020, wherein one of Rogers's external service providers had accidentally made the information available online which provided access to the database managed by the service provider. Immediately after which information was removed. The exposed data includes address, account number, email address, and telephone number. No credit card, banking, or password information was exposed by the database. The affected customers were directly notified by the company and were also provided with a complimentary Transunion credit monitoring subscription.

See the full report here: https://www.bleepingcomputer.com/news/security/rogers-data-breach-exposed-customer-info-in-unsecured-database/

Food Delivery Service in Germany Under DDoS Attack - BleepingComputer

Cybercriminals have targeted a food delivery service, Takeaway.com (Lieferando.de) in Germany with a distributed denial of service (DDoS) attack, in demand of 2 bitcoins. The CEO of Takeaway posted about the attack on Twitter, soon after which the German branch of the company announced that its systems were hacked and have entered maintenance mode to ensure the security of all data. Some customers have complained that the company accepted new orders even though it was under an attack, in response to which the company stated that it will refund orders that failed to deliver due to the attack. The company claimed that the attack has stopped and Lieferando website is up and running.

See the full report here: https://www.bleepingcomputer.com/news/security/food-delivery-service-in-germany-under-ddos-attack/

WHO Chief Impersonated in Phishing to Deliver HawkEye Malware - BleepingComputer

HawkEye, an information-stealing malware, is actively being distributed in an ongoing phishing campaign via emails camouflaged as official messages from the Director-General of the World Health Organization (WHO). The phishing emails are attached with a Coronavirus Disease (Covid-19) CURE.exe executable posing as a "file with the instructions on common drugs to take for prevention and fast cure to this deadly virus called Coronavirus Disease (COVID-19)." However, instead of coronavirus drug advice, the executable is a HawkEye keylogger loader with anti-VM and anti-sandbox capabilities that will attempt to turn off Windows Defender via registry and to disable scans and updates using PowerShell. According to researchers, HawkEye can capture keystrokes, screenshots, and steal user credentials from a wide range of applications and from the system clipboard. The malware harvests credentials from web browsers and email clients such as Firefox, Thunderbird, Postbox, SeaMonkey, WaterFox, PaleMoon, and more. All the data it collects is encrypted and sent to its operators by email via the SMTP protocol.

See the full report here: https://www.bleepingcomputer.com/news/security/who-chief-impersonated-in-phishing-to-deliver-hawkeye-malware/

Sodinokibi Ransomware Data Leaks Now Sold on Hacker Forums - BleepingComputer

The Sodinokibi Ransomware operators recently published over 12 GB of stolen data allegedly belonging to Brooks International for not paying the ransom. BleepingComputer has learned that other hackers and criminals are distributing and selling this data publicly on hacker forums. The stolen data can be very valuable to hackers as it contains user names, passwords, credit card statements, alleged tax information, and much more. Ransomware victims who do not pay a ransom and have their stolen files leaked are now at a bigger risk as ransomware attacks are also turning into data breaches with criminals selling the released files on hacker forums.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-data-leaks-now-sold-on-hacker-forums/

Russian state-sponsored hackers have been sniffing Middle East defence firms, warns Trend Micro

Trend Micro warns about the Russian state-sponsored hackers, APT28, who have been targeting defense companies with Middle Eastern outposts. While spear-phishing and malware are the common attacks carried out by the hacker crew, Trend Micro says APT28 has been port-scanning mail servers, including Microsoft Exchange Autodiscover boxen, on TCP ports 443 and 1433 in the hope of finding vulnerable machines to exploit and use as a staging post in their ongoing campaign. Organizations are advised to keep an eye on their infrastructure for any unusual access patterns, patch systems with the latest updates, and remain vigilant of unexpected emails with malicious links.

See the full report here: https://www.theregister.co.uk/2020/03/19/apt28_middle_east/

RedLine Info-Stealing Malware Spread by Folding@home Phishing - BleepingComputer

Researchers have discovered a new phishing campaign in which attackers are tricking people into installing the RedLine information-stealing malware. The phishing emails have a subject of "Please help us with Fighting corona-virus" and state that they want you to help "speed up our process of finding the cure" by downloading and installing the Folding@home client. Folding@home is a computing project that uses CPU and GPU cycles to research new drug opportunities against diseases and a greater understanding of various diseases. Embedded in the phishing email is a "Download now" button which when clicked downloads a file called foldingathomeapp.exe, which is the Redline information-stealing Trojan. It steals information from browsers such as login, autocomplete, passwords, and credit cards. It also collects information about the user and their systems such as the username, their location, hardware configuration, cryptocurrency cold wallets, and installed security software.

See the full report here: https://www.bleepingcomputer.com/news/security/redline-info-stealing-malware-spread-by-folding-home-phishing/

DDoS botnets have abused three zero-days in LILIN video recorders for months

LILIN patched three zero-day bugs in its digital video recorders (DVRs) in February 2020, after at least three botnet operators quietly exploited them for more than six months. The first zero-day is a vulnerability in the NTPUpdate process that lets attackers inject and run system commands. The second zero-day can be abused through the use of one of two hardcoded credentials (root/icatch99 and report/8Jg0SR8K50), using which an attacker can retrieve and modify a DVR's config file, and then execute commands on the device when the FTP (File Transfer Protocol) server configuration is periodically synchronized. The third zero-day is similar to the second but via the NTP (Network Time Protocol) service. According to the researchers, the first botnet to exploit one of the zero-days was the Chalubo botnet, which abused the first zero-day starting late August last year. The FBot botnet abused the second and third zero-days in January this year, after which the Moobot botnet abused the second zero-day, although not the third.

See the full report here: https://www.zdnet.com/article/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months/

PwndLocker Fixes Crypto Bug, Rebrands as ProLock Ransomware - BleepingComputer

After the initial failure of the PwndLocker Ransomware, which allowed security researchers to create a free decryptor, the developers rebranded their infection as ProLock Ransomware and are targeting the corporate networks again. According to the researchers, the new ProLock Ransomware is being distributed through a BMP image file, embedded with the executable, stored in C:\ProgramData named WinMgr.bmp. The BMP file renders properly in an image viewer with only a few dots appearing in the upper right corner. When viewed through a hex editor, it includes binary data embedded in it. This binary data is reassembled by a PowerShell script that injects it directly into memory. After successful infection, the files are encrypted and appended with the .proLock extension and a ransom note named [HOW TO RECOVER FILES].TXT that contains payment instructions is created in every encrypted folder.

See the full report here: https://www.bleepingcomputer.com/news/security/pwndlocker-fixes-crypto-bug-rebrands-as-prolock-ransomware/

200M Records of US Citizens Leaked in Unprotected Database

The personal information of US citizens was leaked in an unprotected database containing 800GB of data, including 200 million detailed user records. According to the researchers, the exposed database included three folders. The first folder included records that appeared to have originated in the United States Census Bureau, exposing individuals' full names and titles, email addresses, phone numbers, birthdates, credit ratings, home and mortgage real estate addresses, demographics, mortgage and tax records, and information about personal interests, and investments, as well as political, charitable, and religious donations. The other two folders held the call logs of a US-based fire department and a list of some 74 bike stations that formerly belonged to a bike-share program. The complete database was removed on 03 March 2020.

See the full report here: https://www.darkreading.com/cloud/200m-records-of-us-citizens-leaked-in-unprotected-database/d/d-id/1337377

Hackers breach FSB contractor and leak details about IoT hacking project

Digital Revolution, a Russian hacker group claims to be responsible for breaching a contractor of FSB, Russia's national intelligence service. The breach leaked technical documents, diagrams, and code fragments for a project called Fronton. According to the specifications of the leaked documents, the Fronton botnet would be able to carry out password dictionary attacks against IoT devices that use factory default logins and common username-password combinations. Once a password attack was successful, the device would be enslaved in the botnet. Fronton specs also say that the botnet should specifically target internet security cameras and digital recorders (NVRs).

See the full report here: https://www.zdnet.com/article/hackers-breach-fsb-contractor-and-leak-details-about-iot-hacking-project/

Printing company exposes 343GB of sensitive military data

A misconfigured Amazon Web Services (AWS) S3 bucket, belonging to a UK-based Printing company, Doxzoo, has mistakenly exposed around 343GB of data, including sensitive information said to relate to branches of the UK and US military. Nearly 100,000 users were potentially affected by the data leak, with roughly 270,000 records exposed. The exposed information includes customers' personal information, payment information, order details, passport information, and the contents of printing orders. Copyrighted and sensitive work of Doxzoo's military clients was also included in the leak.

See the full report here: https://www.itpro.co.uk/security/data-breaches/355056/vpnmentors-web-mapping-project-finds-more-exposed-military-files-via

UK Fintech Firm Finastra Hit By Ransomware, Shuts Down Servers - BleepingComputer

Finastra, a leading financial technology provider from the UK has suffered a ransomware attack. The firm discovered the incident on March 20th, 2020, after its security team spotted malicious activity on some of the company’s systems. Following the incident, the company servers were taken offline. Finastra's Chief Operating Officer said that they do not have any evidence that customer or employee data was accessed or exfiltrated, nor do they believe that their clients’ networks were impacted. However, the investigation is in place and the company is working on bringing back its systems online.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-fintech-firm-finastra-hit-by-ransomware-shuts-down-servers/

Extortion Emails Threaten to Infect Your Family With Coronavirus - BleepingComputer

In a recent sextortion campaign, the scammers attempt to capitalize on the COVID-19 pandemic by threatening the victims to infect their family with the SARS-CoV-2 virus besides revealing all their dirty secrets. The sextortion email has the subject as "[YOUR NAME] : [YOUR PASSWORD]" and warns the victims by saying that they know where victim live, as well as every dirty little secret in their lives that will be exposed if $4,000 worth of bitcoins is not paid within 24 hours. Further, it threatens the victims to infect their entire family with the coronavirus. The scammers have used Greek characters instead of Latin to bypass the text matching email protection features. It is recommended to mark such scam emails as spam to help your email service detect them before they land in your inbox and automatically block them in the future.

See the full report here: https://www.bleepingcomputer.com/news/security/extortion-emails-threaten-to-infect-your-family-with-coronavirus/

‘Surfing Attack’ – New Way to Hack Siri, Google Assistant With Ultrasonic Waves - SciTechDaily

Scientists from Washington University have demonstrated that the voice assistant systems such as Bixby, Siri and Google Assistant are susceptible to signal injection at inaudible frequencies. Scientists have already shown that ultrasonic waves can be used to deliver a single command through the air. Without making any sound, the ultrasonic waves can activate the voice assistant on your cellphone and have it make calls, take images, or read the contents of a text to a stranger, all without the phone owner’s knowledge. On observing, it was found that these waves can propagate through numerous solid surfaces to actuate voice recognition systems. The team tested 17 different phone models, including popular iPhones, Galaxy, and Moto models. All but two were vulnerable to ultrasonic wave attacks.

See the full report here: https://scitechdaily.com/surfing-attack-new-way-to-hack-siri-google-assistant-with-ultrasonic-waves/

Mukashi: A New Mirai IoT Botnet Variant Targeting Zyxel NAS Devices

A new variant of the Mirai botnet is exploiting a recently uncovered critical vulnerability in network-attached storage (NAS) devices that allow attackers to take over the vulnerable machines. Identified as “Mukashi”, the new variant of the malware employs brute-force attacks using different combinations of default credentials to log into Zyxel NAS, UTM, ATP, and VPN firewall products to take control of the devices. Mukashi exploits a pre-authentication command injection vulnerability, tracked as CVE-2020-9054, to allow attackers to perform remote code execution via command injection. On successful brute-force login, the malware not only reports the login attempt to a remote attacker-controlled command-and-control (C2) server but also launches DDoS attacks.All the Zyxel consumers are recommended to update to the latest firmware version. Updating default credentials with complex login passwords can prevent such brute-force attacks.

See the full report here: https://thehackernews.com/2020/03/zyxel-mukashi-mirai-iot-botnet.html

Netwalker Ransomware Infecting Users via Coronavirus Phishing - BleepingComputer

According to MalwareHunterTeam researchers, a new Coronavirus phishing campaign is spreading the Netwalker Ransomware via email attachments. Netwalker is a ransomware formerly called Mailto that has become active recently as it targets the enterprise and government agencies. The new campaign is using an attachment named "CORONAVIRUS_COVID-19.vbs" that contains an embedded Netwalker Ransomware executable and obfuscated code to extract and launch it on the targeted system. The ransomware encrypts the files on the computer and append a random extension to encrypted file names. Previously, two widely reported attacks related to Netwalker are the ones on the Toll Group and the Champaign Urbana Public Health District (CHUPD) in Illinois.

See the full report here: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-infecting-users-via-coronavirus-phishing/

Hacker selling data of 538 million Weibo users - ZDNet

Sina Weibo, a microblogging service and the Chinese language counterpart of Twitter, was reported to have been hacked. A hacker, named as "@weibo" on various dark web forums, claims to have breached Weibo in mid-2019 and obtained a dump of the company's user database. The database contains the details for 538 million Weibo users, including real names, site usernames, gender, location, and 172 million users' phone numbers. The company notified the authorities about the incident and is under investigation.

See the full report here: https://www.zdnet.com/article/hacker-selling-data-of-538-million-weibo-users/

Hackers leak data from medical company set to carry out COVID-19 vaccine trials - SiliconANGLE

Hammersmith Medicines Research Ltd. was targeted by the Maze ransomware group on March 14 that locked down its systems. The research center is known to develop vaccines for Ebola, Alzheimer's, COVID-19 and conduct clinical trials for the vaccines. The hacking group started to publish historic sensitive medical and personal information about thousands of former patients in an attempt to extort the company for payment. The exposed information includes medical questionnaires, copies of passports, driving licenses and national insurance numbers of over 2,300 of the organization’s patients, which date back 8 to 20 years. The company has successfully repelled the attack and restored all functions.

See the full report here: https://siliconangle.com/2020/03/22/data-leaked-medical-company-set-carry-covid-19-vaccine-trials/

Israel Govt's New 'Shield' App Tracks Your Coronavirus Exposure - BleepingComputer

The Israeli Ministry of Health has released a new mobile app called "The Shield" that will alert users if they have been at a location in Israel at the same time as a known Coronavirus patient. The application compares the user's data to the data in the downloaded JSON file and if the app detects that the user was exposed to a known Coronavirus patient, it will alert with a message stating that a match was found. This application is available for both Android and iOS and works by collecting the GPS and SSID (WiFi network) information of a user's mobile device throughout the day. This data is saved only on the mobile device and is not transmitted to the Ministry of Health, other government agencies, or any organization.

See the full report here: https://www.bleepingcomputer.com/news/technology/israel-govts-new-shield-app-tracks-your-coronavirus-exposure/

Windows Defender Bug in Windows 10 Skips Files During Scans - BleepingComputer

Users running Windows Defender on their systems are reporting an issue with its scanning feature. They complained that in an attempt to scan PCs, the antivirus skips some files rather than scanning all files. Some users claimed that the March 11 update broke the scanning functionality. The bug affects devices running Windows Defender version 4.18.2003.X. The exclusion doesn’t appear to be the issue in user reports and is likely to be associated with a particular defender update or other updates pushed by Microsoft and device manufacturers. Microsoft has yet to document problems with Windows Defender.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-defender-bug-in-windows-10-skips-files-during-scans/

Google to Abandon Chrome 82 Development Due to Release Delays - BleepingComputer

Due to the Coronavirus pandemic, Google has announced that they are no longer developing Chrome 82 and will skip to Chrome 83 instead. Last week, Google announced that it was pausing releases of new milestone versions of the Chrome browser due to the adjusted employee work schedules during the Coronavirus outbreak. This caused the Chrome 81 version that was scheduled for release on March 17th to not be released and stay in the Google Chrome Beta channel. With this change, Google Chrome 81 (M81) will remain in the Beta until it is released on the Stable branch, Chrome 82 (M82) will be abandoned, and Chrome 83 (M83) will be moved to the development branch.

See the full report here: https://www.bleepingcomputer.com/news/google/google-to-abandon-chrome-82-development-due-to-release-delays/

Tech Giant GE Discloses Data Breach After Service Provider Hack - BleepingComputer

Personally Identifiable Information(PII) of current and former employees, and beneficiaries of General Electric (GE), was exposed in a security incident experienced by Canon Business Process Services (Canon), a GE service provider. The incident took place between February 3 - 14, 2020 where attackers were able to gain access to an email acount containing sensitive information of GE employess. The exposed information include direct deposit forms, driver's licenses, passports, birth certificates, marriage certificates, death certificates, medical child support orders, tax withholding forms, beneficiary designation forms and applications for benefits such as retirement, severance and death benefits and other related forms. GE has confirmed that none of their systems are affected. Canon is offering free identity protection and credit monitoring services to affected individuals for two years.

See the full report here: https://www.bleepingcomputer.com/news/security/tech-giant-ge-discloses-data-breach-after-service-provider-hack/

Apache Tomcat Exploit Poised to Pounce, Stealing Files

According to Security Researchers, the popular Apache Tomcat web server vulnerability (CVE-2020-1938) may see active exploitation attempts with a proof-of-concept (PoC) exploit available on GitHub. The bug allows information disclosure via file retrieval on a vulnerable server without authentication or a user being tricked into a compromising interaction. And, in some situations, it could allow remote code execution. The recently patched bug affects Tomcat versions 7.0, 8.5, and 9.0. Researchers urge Web admins to update their Apache Tomcat instances to version 8.5.51, disable AJP connectors if not in use, or consider exposing the connector only in the trusted network segment to avoid becoming victims.

See the full report here: https://threatpost.com/apache-tomcat-exploit-stealing-files/154055/

Fake Coronavirus ‘Vaccine’ Website Busted in DoJ Takedown

The Department of Justice (DoJ) took down a fraudulent website, “coronavirusmedicalkit.com,” on 22 March 2020. The website purported to give away free vaccine kits that it claimed were manufactured by the World Health Organization (WHO). The website asked buyers to input their payment card information to pay a shipping charge of $4.95. Further, the website operators would steal credit card and personal information of the victims to carry out fraudulent purchases and identity theft. The Department of Justice also states that there are currently no legitimate COVID-19 vaccines and the WHO is not distributing any such vaccines and urges website users to always independently verify the identity of any company, charity, or individual that contacts them regarding COVID-19.

See the full report here: https://threatpost.com/fake-coronavirus-vaccine-website-busted-in-doj-takedown/154031/

Microsoft Warns of Critical Windows Zero-Day Flaw - Threatpost

Microsoft has warned of critical zero-day flaws in its Windows operating system that could enable remote code execution. Two remote code execution vulnerabilities exist in the way that Windows’ Adobe Type Manager Library handles certain fonts. Adobe Type Manager is a font management tool built into both Mac OS and Windows operating systems, and produced by Adobe. The unpatched flaws are being exploited by attackers in “limited, targeted” attacks. While no patches are available for the flaws, Microsoft has recommended a slew of mitigations and workarounds that can protect users.

See the full report here: https://threatpost.com/microsoft-warns-of-critical-windows-zero-day-flaws/154040/

Hackers Hijack Routers' DNS to Spread Malicious COVID-19 Apps - BleepingComputer

A new cyber attack is hijacking router's DNS settings to make web browsers display alerts for a fake COVID-19 information app from the World Health Organization. While the source of the attack is unknown, it is suspected that attackers leveraged weak passwords to gain access to the routers. Once the attackers gained access to the router, they changed the configured DNS servers to 109.234.35.230 and 94.103.82.249. On a successful connection, when Windows performs this NCSI active probe, instead of connecting to the legitimate 13.107.4.52 Microsoft IP address, the malicious DNS servers redirect to a web site located at 176.113.81.159. The attacker displays a page prompting the victim to download and install a fake 'Emergency - COVID-19 Informator' or 'COVID-19 Inform App' from the WHO that allegedly carry Vidar information-stealing malware. Users are recommended to configure the router to automatically receive its DNS servers from your ISP.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hijack-routers-dns-to-spread-malicious-covid-19-apps/

HPE Warns of New Bug That Kills SSD Drives After 40,000 Hours - BleepingComputer

Hewlett Packard Enterprise (HPE) has warned its customers that certain Serial-Attached SCSI solid-state drives will fail after 40,000 hours of operation unless a critical patch is applied. The current flaw affects drives in HPE server and Storage products including HPE ProLiant, Synergy, Apollo 4200, Synergy Storage Modules, D3000 Storage Enclosure, StoreEasy 1000 Storage. The SSD in these products running a firmware version older than HPD7 will face this issue. HPE also warns that, at the failure point, neither the data nor the drive can be recovered.

See the full report here: https://www.bleepingcomputer.com/news/security/hpe-warns-of-new-bug-that-kills-ssd-drives-after-40-000-hours/

TrickBot Bypasses Online Banking 2FA Protection via Mobile App - BleepingComputer

The TrickBot group is using a malicious Android application to bypass two-factor authentication (2FA) protection used by various banks after stealing transaction authentication numbers. The app, dubbed as TrickMo, is designed to intercept a wide range of transaction authentication numbers (TANs) including one-time password (OTP), mobile TAN (mTAN), and pushTAN authentication codes after victims install it on their Android devices. The app is being actively updated and pushed via the infected desktops of German victims with the help of web injects in online banking sessions. TrickMo is heavily obfuscated to hinder analysis and is capable of preventing users of infected devices from uninstalling it.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-bypasses-online-banking-2fa-protection-via-mobile-app/

Malware Found Hidden in Android Utility Apps, Children's Games

A new malware family has been discovered operating in 56 Google Play applications, which has been downloaded nearly one million times around the world. Dubbed as "Tekya," the malware aims to commit mobile ad fraud by imitating user actions to click advertisements. The attackers target Children's Games and Android Utility Apps and it uses the MotionEvent mechanism built into Android to imitate the user's actions and generate clicks for ads from agencies like Google's AdMob, AppLovin', Facebook, and Unity, researchers report. Google Play has removed all the infected apps from its Store.

See the full report here: https://www.darkreading.com/application-security/malware-found-hidden-in-android-utility-apps-childrens-games/d/d-id/1337396

Adobe Fixes Critical Vulnerability in Creative Cloud Application - BleepingComputer

Adobe has released a fix to mitigate a critical vulnerability in its Creative Cloud Application. The Adobe Creative Cloud is an application suite consisting of numerous apps such as Photoshop, Premiere Pro, Illustrator, Adobe Acrobat, InDesign, Lightroom, and XD. Users are advised to upgrade to Creative Cloud Desktop Application version 5.1.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-vulnerability-in-creative-cloud-application/

WordPress Malware Distributed via Pirated Coronavirus Plugins - BleepingComputer

Modified versions of Coronavirus plugins that inject a backdoor into a WordPress site are being distributed by the WordPress WP-VCD malware operators. The goal of these malicious plugins is to use the compromised WordPress site to display popups or perform redirects that generate revenue for the threat actors. Researchers found that these WordPress plugins were zip files containing what appeared to be legitimate commercial plugins named "COVID-19 Coronavirus - Live Map WordPress Plugin", Coronavirus Spread Prediction Graphs", and "Covid-19". BleepingComputer advises users to install WordPress plugins only from authorized sites to avoid having their sites infected.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-malware-distributed-via-pirated-coronavirus-plugins/

Microsoft Fixes Windows Defender Scan Bug With New Update - BleepingComputer

Microsoft has fixed the Windows Defender bug with the release of the KB4052623 update. The bug was excluding some items from scans if they were stored on a network device. With the new security update, the Windows Defender antimalware platform will increment the scan engine's version to 4.18.2003.8 and will prevent future notifications of files being skipped from appearing. According to Microsoft, all users will get the KB4052623 update automatically through Windows Update in the next few days, even if they have them paused.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-defender-scan-bug-with-new-update/

Tupperware Site Hacked With Fake Form to Steal Credit Cards - BleepingComputer

A popular home products line, Tupperware, was targeted by the hackers in an attempt to steal the payment card data of its online customers. Researchers found that the hackers integrated a malicious iframe that displays a fake payment form fields to shoppers at checkout of the Tupperware website. The iframe loaded the content from “deskofhelp[.]com,” a domain that was created on March 9 and was hosted on a server with multiple phishing domains. Tupperware fixed the issue and the payment form is currently loading from the legitimate domain cybersource.com, owned by Visa. However, code from the attackers is still available. The incident may have potentially exposed customers' first and last names, billing addresses, phone numbers, credit card numbers, credit card expiry dates, and the CVV (card verification value, required for online shopping).

See the full report here: https://www.bleepingcomputer.com/news/security/tupperware-site-hacked-with-fake-form-to-steal-credit-cards/

Three More Ransomware Families Create Sites to Leak Stolen Data - BleepingComputer

Nefilim, Clop, and Sekhmet Ransomware are the new ransomware families to create sites to leak the stolen data of their respective non-paying victims. The Nefilim Ransomware launched a site called "Corporate Leaks" to dump the data of victims who do not pay a ransom. Similarly, the CLOP Ransomware has also released a leak site called "CL0P^_- LEAKS" to publish stolen data for non-paying victims. Lastly, a relatively new ransomware called Sekhmet has also released a data leak site called "Leaks leaks and leaks" to drop the data of victims who fail to pay a ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/