Threat Intelligence Bulletin: 03/27/20 - 04/02/20

Cybercriminals Steal PII from Jio Users via Fake Recharge Scam

Alpha Team has identified a new scam that lures Jio users into disclosing their Personally Identifiable Information (PII) in exchange for a free recharge, or prepaid account credit. Amidst the COVID-19 outbreak, cybercriminals continue to find ways to trick people with fraudulent offers. One such viral scam circulating across WhatsApp claims to offer ₹498 recharge benefits for free to every Jio customer who enrolls in the program, as well as unlimited voice calls and 4G data. It further claims that the free recharge is a limited-time offer, applicable only until March 31, 2020, and lures Jio users to visit the embedded link where they are prompted to enroll in the fake program.

Recommendations

• Consider enabling the Cyber Attack Chatter rule to monitor developing threats to your organization
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities.
• Refrain from visiting any sort of promotional links before verifying their authenticity
• Continue monitoring the Alpha Team Tab for reports related to the dark web and threat actor activities
• For further assistance, reach out to [email protected]

Details

Reliance Jio Infocomm Limited, also known as Jio, is one of the largest telecommunications company in India with over 370 million customers across the country. On March 25, 2020, India began a 21-day lockdown to combat the coronavirus spread in the country. With an increased number of users staying at home, demand for the Internet has spiked and many telecom providers are offering benefits to support their users. Similarly, scam offerings have begun circulating on social media platforms, including WhatsApp. One such scam offer is this free recharge benefit of ₹498. The message detailing this fraudulent offer started circulating soon after the announcement of the lockdown on March 24th, 2020.

Figure 1. Whatsapp message advertising the fraudulent offer

The link in the post directs users to jiofree[.]online where they are prompted to enter their name, mobile number, and state of residence. Additionally, the users are also required to agree to the terms and conditions of the offer. In a span of 3 days, 5 similar structured sites have been registered. At the time of posting the domain jiofree.online is no longer actively hosting content. However, the site redirects users to any of the active sites listed below.

jionewoffer[.]online
jio-offer[.]online
jiofreerecharge[.]xyz
jiofreerecharges[.]online
jiorecharge[.]xyz

These similar sites are still actively hosting malicious content and continue to be circulated.

Figure 2. Homepage of the fake Jio site

Figure 3. Users are prompted to enter their details

Upon submitting the required details, the website displays a popup message to the users, instructing them to share the message advertising the recharge offer to 5 of their friends/contacts via WhatsApp to take advantage of the free offer.

Figure 4. Popup asking users to forward the message to 5 people

Conclusion

Scams of all kinds continue to circulate during the lockdown and attackers are not shying away from taking advantage of these difficult times. Scams like this one tend to create a false sense of urgency, to better trick victims into falling for limited-time offers. The PII harvested by this scam could be used for a variety of attacks, including SIM swaps, where social engineering techniques are used to convince a mobile provider to switch a victim’s phone number to an attacker-controlled SIM card. This kind of attack has become increasingly popular, as it can be used to gain access to linked accounts by resetting passwords on platforms that do this via an SMS code. As always, anything that looks too good to be true is likely a false promise. To reduce your risk of falling victim to scams like this one, Alpha Team recommends applying the recommendations given above.

Free Phishing Kit Targets Snapchat Users

ZeroFOX Alpha Team has obtained a novel phishing kit that is freely available on hacking and leak forums. This phishing kit has been available since 28th February 2020 and targets the users of a highly-used multimedia messaging application, Snapchat.

Phishing could be defined as a fraudulent attempt to obtain sensitive information such as usernames, passwords, and other details by disguising oneself as a trustworthy entity in an electronic communication. In this particular case, the phishing kit exhibits a fake login page almost identical to the legitimate Snapchat login page, making it difficult for the potential victims to differentiate between the two.

Recommendations

• Consider enabling multi-factor authentication for all accounts to prevent potential account takeover
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Consider enabling the compromised credentials rule for relevant entities. If needed, reach out to [email protected] for assistance
• Consider enabling the domain monitoring rules and phishing rules to identify websites targeting your organization and entities

Details

A phishing site tries to steal user account passwords or other confidential information by tricking victims into believing that they are on a legitimate website. Users could even land on a phishing site by mistyping a URL, or by clicking a link in a malicious email or social media post. Likewise, this phishing kit aims to steal user login credentials which could further be used to perform various cyberattacks. The landing page of this phishing kit spoofs the legitimate Snapchat site quite well and prompts the user to enter their account details.

Figure 1. Snapchat Phishing Kit Landing Page.

Upon entering their login details, the victims are redirected to the original Snapchat page. The information entered by the user is dumped into a Login.php file which is configured in such a way that the credentials from the victims will be dumped into a username.txt file every time a new victim enters their credentials.

Figure 2. Login.php script, used to log victims’ usernames and passwords

Additionally, the IP address and user agent details of the victim are logged in another file called ip.txt.

Figure 3. Ip.php script, used to log victim IP address and User-Agent

This kit is available for free on a popular hacking forum. An associated Telegram group has existed since late February 2020. At present, this group has a following of nearly 4472 people on Telegram, with almost 1619 views specifically of the Snapchat phishing kit. The kit download page remains active at the time of this publication.

Figure 4. Telegram group for the hacking forum, advertising this Snapchat kit.

Conclusion

This Snapchat phishing kit is free and easy-to-use, making it accessible to a wide range of would-be attackers, especially given that the group has a considerable amount of followers. ZeroFOX recommends implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of scams.

Breach Disclosure: Dueling Network

In early 2017, fansite DuelingNetwork suffered a data breach. The administrators of the website told Vice that the contents of their database were stolen from their website. The breach contains approximately 5.5 million rows of data, which include usernames, email addresses, MD5 hashed passwords and IP addresses.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

An administrator for Dueling Network claims that a MySQL vulnerability was the impetus to the breach. Multiple sales of the breach on the dark web, as well as the aforementioned Vice article, put the number of rows anywhere between 5.5 million and 6.5 million.

Breaking News: 2020-03-27 - 2020-04-02

An Elite Spy Group Used 5 Zero-Days to Hack North Koreans

Google's Threat Analysis Group revealed that an anonymous group of hackers used five zero-day vulnerabilities, secret hackable software flaws, to attack North Koreans and North Korea-focused professionals in 2019. The hackers exploited flaws in Internet Explorer, Chrome and Windows. The hacking operation involved phishing emails containing malicious attachments or links to malicious sites and waterhole attacks that planted malware on the machines of the victims when they visited certain websites that had been hacked to infect visitors through their browsers.

See the full report here: https://www.wired.com/story/north-korea-hacking-zero-days-google/

Critical CODESYS Bug Allows Remote Code Execution

A critical flaw in the CODESYS web server, which is used to display CODESYS system visualization screens in a web browser, has been discovered. Tracked as CVE-2020-10245, the vulnerability could allow a remote, unauthenticated attacker to crash the web server, lead to a denial-of-service condition or, may be utilized for remote code execution. The bug is rated 10 out of 10 on the CVSS v.2 vulnerability severity scale and requires little skill to exploit. All versions of CODESYS V3 runtime systems containing the web server before version V3.5.15.40 are affected, regardless of the CPU type or operating system. Users are advised to update to the latest patched version (V3.5.15.40) to eliminate the vulnerability.

See the full report here: https://threatpost.com/critical-codesys-bug-remote-code-execution/154213/

Hackers Used Local News Sites to Install Spyware On iPhones

A new watering-hole campaign is targeting Apple iPhone users in Hong Kong by using malicious website links as a lure to install spyware on the devices. The campaign uses links related to topics that are either sex-related, clickbait, or news related to the ongoing COVID-19 coronavirus pandemic. According to the researchers, the "Operation Poisoned News" campaign leverages a remote iOS exploit chain to deploy a feature-rich implant called 'LightSpy' through links to local news websites which when clicked, executes the malware payload and allows an interloper to exfiltrate sensitive data from the affected device and even take full control. It is recommended that users keep their devices up-to-date and avoid sideloading apps on Android from unauthorized sources.

See the full report here: https://thehackernews.com/2020/03/iphone-iOS-spyware.html

Unpatched iOS Bug Blocks VPNs From Encrypting All Traffic - BleepingComputer

A virtual private network (VPN) bypass vulnerability has been discovered in iOS 13.3.1 and later versions which are currently unpatched. The flaw prevents the VPN from encrypting all the traffic and can lead to some Internet connections bypass VPN encryption, exposing user data or their IP addresses. The bug exists as Apple's iOS does not terminate all existing Internet connections when the user connects to a VPN and lets them automatically reconnect to the destination servers after the VPN tunnel is established. Apple has acknowledged the VPN bypass flaw and is working on the mitigation. Until the bug is fixed, Apple recommends using "Always-on VPN" to mitigate this problem. However, the workaround cannot be used to mitigate the vulnerability for third-party VPN apps such as ProtonVPN.

See the full report here: https://www.bleepingcomputer.com/news/security/unpatched-ios-bug-blocks-vpns-from-encrypting-all-traffic/

Chubb Cyber Insurer Allegedly Hit By Maze Ransomware Attack - BleepingComputer

Chubb, a cyber insurer giant, allegedly suffered a ransomware attack. The operators of Maze ransomware claim to have encrypted the devices on the company's network in March 2020. Maze operators usually steal the victim files before encrypting them and threaten to publicly release the stolen data if the ransom is not paid. As of now, the operators have not published any of the allegedly stolen data, but have included the email addresses of executives. The company stated that they are investigating the incident and assured that their network remains fully operational, servicing all policyholder needs, including claims.

See the full report here: https://www.bleepingcomputer.com/news/security/chubb-cyber-insurer-allegedly-hit-by-maze-ransomware-attack/

FBI: Hackers Sending Malicious USB Drives & Teddy Bears via USPS - BleepingComputer

FBI warns organizations and security professionals about the FIN7 cybercriminal group delivering the GRIFFON malware. Hackers from the FIN7 group have been targeting various businesses with malicious USB‌ devices acting as a keyboard when plugged into a computer. Injected commands download and execute a JavaScript backdoor associated with this actor. The group has adopted the tactic of mailing USB devices via the United States Postal Service (USPS). Mailed packages sometimes include items like teddy bears or gift cards to employees of target companies working in the Human Resources (HR), Information Technology (IT), or Executive Management (EM) roles, the FBI warned.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-hackers-sending-malicious-usb-drives-and-teddy-bears-via-usps/

Hackers Exploit Zero-Day Bugs in Draytek Devices to Target Enterprise Networks

Hackers are targeting enterprise-grade networking devices manufactured by Taiwan-based DrayTek by exploiting two zero-day, critical remote command injection vulnerabilities (CVE-2020-8515) affecting DrayTek Vigor enterprise switches, load-balancers, routers, and VPN gateway devices to eavesdrop on network traffic and install backdoors. According to the researchers, at least two separate groups of hackers exploited the flaws and the two 0-day vulnerability command injection points are keyPath and rtick, located in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program is /usr/sbin/lighttpd. The first group only spied on the network traffic, whereas the second group of attackers used rtick command injection vulnerability. Affected organizations and individuals are highly recommended to install the latest firmware updates.

See the full report here: https://thehackernews.com/2020/03/draytek-network-hacking.html

Click-Fraud Malware Found in More than 50 Play Store Apps - IT News Africa

Security researchers at CheckPoint have discovered an auto-clicker malware family called “Tekya” which operates within Google Play Store. The Tekya malware found to be disguised in over 56 apps and was downloaded over 1 million times globally. The malware infiltrates the Play Store by hiding in native code which runs only on Android processors and thus evades the Google Play Protect detection. It imitates the actions of a user, clicking ads and banners from ad agencies like Google’s AdMob, AppLovin, Facebook and Unity. The researchers recommend uninstalling the infected apps if downloaded and to ensure the device is up-to-date with the latest security patch.

See the full report here: https://www.itnewsafrica.com/2020/03/click-fraud-malware-found-in-more-than-50-play-store-apps/

Zoom beams iOS user data to Facebook for targeted ads

Researchers at Motherboard have reported that Zoom, a video conferencing platform, is sending iOS users’ analytics data to Facebook without explicit consent. Even if users do not have an account with Facebook, the data is sent through one of the social media platform’s software development kits (SDKs). According to the reports, Zoom notifies Facebook when an iOS user opens the app, and then provides details on the user’s device, including the model, as well as their time zone, the city they are connecting from, their mobile network operator, and the unique advertiser identifier created by the device. Zoom’s privacy policy suggests that it can share a few information about the user with some third-party advertising partner. However, Zoom does not mention Facebook as being one of these partners explicitly.

See the full report here: https://www.itpro.co.uk/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads

Google Bans Infowars Android App Over Coronavirus Claims

Google removed an Android application called "InfoWars," a far-right American conspiracy theory and fake news website owned by Alex Jones, from its Play Store on March 27, 2020. The takedown comes after the app posted a video last week, which disputed the need for social distancing, shelter in place, and quarantine efforts meant to slow the spread of the novel coronavirus. A Google spokesperson stated, combating misinformation on the Play Store is a top priority for the company and apps that violate Play policy by distributing misleading or harmful information will be banned.

See the full report here: https://www.wired.com/story/google-bans-infowars-android-app-alex-jones-coronavirus/

The Whatsapp hack that could put your loved ones at risk - Telegraph.co.uk

Cybercriminals are targeting WhatsApp users with a hack that blocks them out of their accounts and sends potentially harmful messages to their loved ones. Cybersecurity experts warned the hack could be used to manipulate victims into parting with funds or use the panic around coronavirus to convince them to share bank account details. The cyberattack has recently re-emerged in the UK, begins when a six-digit code is sent from WhatsApp via text to a victim's phone. Once that's done the victim is then locked out of their account for up to 12 hours, allowing hackers to message people under the victim's alias. The hack can be avoided through WhatsApp’s dual-factor authentication system. The system adds an extra layer of security for users giving them their own six-digit pin.

See the full report here: https://www.telegraph.co.uk/technology/2020/03/28/whatsapp-hack-could-put-loved-ones-risk/

Source code of Dharma ransomware pops up for sale on hacking forums

The source code of a major ransomware strain named Dharma has been put up for sale on two Russian hacker forums over the weekend. Its source code is being sold for a price as low as $2,000. The FBI ranked Dharma the second most lucrative ransomware operation in recent years, having extorted more than $24 million in payments from victims between November 2016 and November 2019. The Dharma ransomware operation initially started out under the name of CrySiS Ransomware-as-a-Service (RaaS) operation in the summer of 2016. In November 2016, the CrySiS master decryption keys were leaked online and it was relaunched under the name of Dharma. Dharma is an advanced ransomware strain with a sophisticated encryption scheme and has been undecryptable since 2017.

See the full report here: https://www.zdnet.com/article/source-code-of-dharma-ransomware-pops-up-for-sale-on-hacking-forums/

Russian-Speaking Hackers Attack Pharma, Manufacturing Companies in Europe - BleepingComputer

Malware belonging to Russian-speaking threat actors was used in attacks in late January against two European companies in the pharmaceutical and manufacturing industries. The malware samples used in these attacks emerged on the VirusTotal scanning platform and were identified as "Silence.ProxyBot" & updated versions of "Silence.MainModule". Both of these samples are associated with the Silence group that is known for targeting banks globally. Further analysis revealed that the attacker leveraged two vulnerabilities, CVE-2019-1405 and CVE-2019-1322, in Windows 10. Researchers suspected TA505’s contribution in the attacks after they found the TinyMet Meterpreter stager, associated with this adversary in the past and compressed with the group’s custom packer. Experts suspect that the motive of the attack is either a ransomware infection or a complex supply-chain attack.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-speaking-hackers-attack-pharma-manufacturing-companies-in-europe/

Xbox Series X: hacker threatens to 'leak everything' about this console feature - T3 US/CA

According to Comicbook, a hacker has reportedly stolen the AMD graphics source code that the Xbox Series X runs on its next-generation GPUs and is demanding for a $1-million ransom. The hacker obtained source codes from a few AMD devices, namely the Navi 10 and Navi 21, as well as AMD’s Arden GPU. The Arden GPU is expected to be included in the upcoming Xbox Series X, which makes the information highly valuable. AMD is aware of the breach and says that the stolen information does not threaten the “competitiveness or security” of its products and not worth the ransom or any sort of panic. The hacker is still threatening to release the information if they don’t get the price they’re asking for.

See the full report here: https://www.t3.com/us/news/xbox-series-x-hacker-threatens-to-leak-everything-about-this-console-feature

Home Routers Hijacked to Deliver Info-Stealing Malware 'Oski'

A new type of attack is targeting home routers with COVID-19 themed malware. Using apps in the name of 'the latest information and instructions about COVID-19', users are redirected to an infected website after altering the DNS settings. It then drops a file-encrypting malware 'Oski' that encrypts the important files on a victim's system. It employs a sophisticated algorithm to encrypt the files and append .Osk extension to each file. After successfully carrying out the encryption process, the malware leaves a ransom note in all the folders. The targeted domains include aws.amazon.com, tidd.ly, goo.gl, bit.ly, fiddler2.com, washington.edu, winimage.com, imageshack.us, ufl.edu, disney.com, cox.net, xhamster.com, pubads.g.doubleclick.net and redditblog.com. Users are recommended to change their cloud account credentials, or any remote management account for their routers, to avoid any takeovers.

See the full report here: https://www.ehackingnews.com/2020/03/home-routers-hijacked-to-deliver-info.html

[The Hacker News[ Critical RCE Bug Affects Millions of OpenWrt-based Network Devices

A cybersecurity researcher has disclosed technical details and proof-of-concept of a critical remote code execution vulnerability affecting OpenWrt, a widely used Linux-based operating system for routers, residential gateways, and other embedded devices that route network traffic. Tracked as CVE-2020-7982, the vulnerability resides in the OPKG package manager of OpenWrt that exists in the way it performs integrity checking of downloaded packages using the SHA-256 checksums embedded in the signed repository index. If exploited successfully, a remote attacker could gain complete control over the targeted OpenWrt network device and network traffic. To fix this issue, affected users are advised to upgrade their device firmware to the latest OpenWrt versions 18.06.7 and 19.07.1

See the full report here: https://thehackernews.com/2020/03/openwrt-rce-vulnerability.html

Many Users Hacked Via Fake Google Chrome Update From Compromised WordPress Websites

Analysts from Dr.Web have found hackers actively targeting users with a malicious Chrome update. The hacker group managed to gain administrative access to several websites that began to be used in the infection chain. They embedded a malicious JavaScript code inside the compromised pages that redirect users to a phishing site, which is presented as a legitimate Google service. Target selection is based on geolocation and browser detection. The target audience is users from the USA, Canada, Australia, Great Britain, Israel, and Turkey – using the Google Chrome browser. The downloaded file has a valid digital signature identical to the signature of the fake NordVPN installer distributed by the same criminal group.

See the full report here: https://latesthackingnews.com/2020/03/30/many-users-hacked-via-fake-google-chrome-update-from-compromised-wordpress-websites/

Voter records for the entire country of Georgia published online

Voter information of more than 4.9 million Georgians, including deceased citizens, has been published on a hacking forum over the weekend, on Saturday. Leaked data including full names, home addresses, dates of birth, ID numbers, and mobile phone numbers were shared online in a 1.04 GB MDB (Microsoft Access database) file. The forum user claimed that the data originated from voters.cec.gov.ge, an official government portal where Georgians can log in and verify and update their voter registration records.

See the full report here: https://www.zdnet.com/article/voter-records-for-the-entire-country-of-georgia-published-online/

Phishing Attack Says Your Exposed to Coronavirus, Spreads Malware - BleepingComputer

A new phishing campaign has been spotted that pretends to be from a local hospital telling the recipient that they have been exposed to the Coronavirus and that they need to be tested. The email asks the recipient to print the attached EmergencyContact.xlsm attachment and bring it with them to the nearest emergency clinic for testing. On opening the attachment, users are prompted to 'Enable Content' to view the protected document. After enabling the content, malicious macros download a malware executable on the computer and launch it. This executable injects numerous processes into the legitimate Windows msiexec.exe file. This is done to hide the presence of the running malware and potentially evade detection by security programs. Users are advised to stay vigilant towards hoax mails.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-attack-says-your-exposed-to-coronavirus-spreads-malware/

Scammers Send Texts to Westpac Consumers Claiming Their Accounts Have Been Frozen and Will Not Be Recovered Un - Tech Times

Scammers have now been spamming and sending text messages to Westpac consumers claiming that all accounts will be frozen until they hand out their bank account details by clicking a certain link. These scammers were reported to be using the ongoing pandemic, novel coronavirus, as bait to prey on Australians using messages with the title "Important Message from Westpac". Phishing messages are designed to look real and often copy the format used by the organization that the scammer claims to represent, including their branding and logo. Westpac is aware of this scam and have reported it and created a scam alert on our Westpac Security Center. The Australian Competition and Consumer Commission (ACCC) is working with partner agencies to remove the phishing site.

See the full report here: https://www.techtimes.com/articles/248437/20200330/scammers-send-texts-westpac-consumers-claiming-accounts-frozen-will-recovered.htm

Hacker hijacks YouTube accounts to broadcast Bill Gates-themed crypto Ponzi scam

A hacker has hijacked the official YouTube accounts of Microsoft and is currently broadcasting a cryptocurrency Ponzi scam to tens of thousands of users, posing as a message from the company's former CEO Bill Gates. The hacks are part of a growing issue on YouTube, where hackers hijack popular accounts to broadcast a classic "crypto giveaway" where victims are tricked into sending a small sum of cryptocurrency to the scammer in order to double their earnings but never get any funds in return. Currently, the hacker has taken over 30+ YouTube profiles from where they are live streaming an old Bill Gates talk on startups that the former Microsoft CEO gave to an audience at Village Global in June 2019, but also asking users to participate in a scammy giveaway.

See the full report here: https://www.zdnet.com/article/hacker-hijacks-youtube-accounts-to-broadcast-bill-gates-themed-crypto-ponzi-scam/

Zeus Sphinx malware resurrects to abuse COVID-19 fears

Zeus malware has resurfaced in an attempt to capitalize on the coronavirus pandemic in a new wave of scams. IBM X-Force researchers said that Zeus Sphinx is being spread through phishing campaigns loaded with malicious files named "COVID 19 relief." Users are targeted with emails, containing a .doc or .docx form as attachments. Emails claim that a form must be filled out to receive funds. If downloaded and opened, the document requests that a user enables macros, which in turn triggers the Zeus Sphinx payload by way of hijacked Windows processes and a connected command-and-control (C2) server that hosts the malware. Once installed, Zeus Sphinx maintains persistence by dynamically writing itself to numerous files and folders, as well as creating registry keys. The malware also attempts to avoid detection as malicious software by using a self-signed certificate.

See the full report here: https://www.zdnet.com/article/zeus-sphinx-malware-resurrects-to-abuse-covid-19-fears-and-steal-banking-data/

New APT Targets Middle Eastern Victims

Security researchers from Kaspersky have uncovered a targeted campaign that distributes Milum, a malicious Trojan capable of gaining remote control of devices from various organizations. This ongoing operation has been dubbed as ‘WildPressure.’ Kaspersky believes most of the targets of this campaign are located in the Middle East. Once a system is infected, the Trojan can download and execute commands from its operator, collect various information from the attacked machine and send it over to the command and control server and upgrade itself to a newer version.

See the full report here: https://nationalcybersecurity.com/new-apt-targets-middle-eastern-victims/

FBI Warns of Ongoing Zoom-Bombing Attacks on Video Meetings - BleepingComputer

The US Federal Bureau of Investigation (FBI) warns organizations about hijackers who barge into Zoom video conferences used for online lessons and business meetings to either disrupt them or pull pranks to share on social media platforms. Multiple reports of VTC hijacking (also called 'Zoom-bombing') and conferences being disrupted by pornographic, hate images and, threats have been received by the FBI. As large numbers of people turn to video-teleconferencing (VTC) platforms to stay connected in the wake of the COVID-19 crisis, the FBI recommends organizations to take the following measures to prevent future hijacking attempts: do not make meetings or classrooms public, do not share Zoom conference links on public social media, manage screen-sharing options, ensure users keep their Zoom clients up to date.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-ongoing-zoom-bombing-attacks-on-video-meetings/

Hacked Houseparty App infiltrates Netflix and Spotify accounts

Houseparty, a social networking service that enables group video chatting through mobile and desktop apps available across iOS, Android, and macOS platforms, has seen a surge in popularity after strict self-isolation due to the coronavirus crisis. Numerous Houseparty users took on to Twitter to report that they've had their Spotify, PayPal and bank accounts hacked after downloading the app. Users claim that the smartphone and desktop application enabled the hack and are encouraging others to delete the account as soon as possible. Houseparty released an official statement claiming that the service is 100% secure and hasn’t been compromised. The company also assured that it doesn’t collect passwords for other sites.

See the full report here: https://www.itsecuritynews.info/hacked-houseparty-app-infiltrates-netflix-and-spotify-accounts/

Windows 10 KB4554364 Update Fixes Internet Connectivity Issues - BleepingComputer

Last week Microsoft confirmed that some Windows 10 devices were experiencing internet connectivity issues when using manual or auto-configured proxy, especially with a virtual private network (VPN). Microsoft released the out-of-band (OOB) Windows 10 update titled ' 2020-03 Cumulative Update for Windows 10 Version 1909 for x86-based Systems (KB4554364)' that resolves this issue. This OOB update is not being offered using Windows Update and must be installed manually from the Microsoft Catalog. Microsoft suggests that users install this update only if they are affected by this issue.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb4554364-update-fixes-internet-connectivity-issues/

Hackers Take Advantage of Zoom's Popularity to Push Malware

Attackers are attempting to take advantage of Zoom's increasing user base since the COVID-19 outbreak started by registering hundreds of new Zoom-themed domains for malicious purposes. Researchers at Checkpoint discovered malicious files using a zoom-us-zoom_##########.exe naming scheme which, when executed, will launch potentially unwanted programs or malicious payloads depending on the attackers' end goals. Other online collaborations platforms including Google Classroom and Microsoft Teams are also being used by hackers as part of potential attempts to exploit their users.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-take-advantage-of-zooms-popularity-to-push-malware/

Marriott data breach exposes personal data of 5.2 million guests

Marriott disclosed a data breach in which the hackers allegedly accessed the personal details of nearly 5.2 million guests. Marriott said that the information was accessed using the login credential of two employees with an application built to provide guest services. The breached data included contact details, loyalty account information, company, gender, birthday, partnerships and affiliations, and room preferences of the guests between mid-January and February 2020. However, the company claims that the leaked records didn't include Marriott Bonvoy account passwords or PINs, payment card information, passport information, national IDs, or driver’s license numbers. The company has notified the affected customers and is investigating the incident.

See the full report here: https://www.itpro.co.uk/security/data-breaches/355173/marriott-hit-by-data-breach-exposing-personal-data-of-52-million

Watering-Holes Target Asian Ethnic Victims with Flash Update Decoy

An extensive watering-hole campaign is targeting Windows users that belong to a specific Asian religious and ethnic group. Nearly 10 legitimate sites were compromised to trigger a drive-by-download attack. All compromised sites belong to high-profile personalities within the target group, public bodies, charities, and other organizations. The attack is a multistage affair. In the first stage, the website automatically serves as the JavaScript code which is obfuscated with Sojson 4. This script fingerprints the visitors to the watering hole and collects target information to send via HTTP GET requests to a remote server, which returns a response of either “true” or “false.” If it returns true, the second-stage is triggered where the JavaScript is obfuscated with Sojson 5. This script displays a website pop-up, prompting the users to download a supposed Flash player “update”, which in turn, downloads an installer package that includes a decoy, legitimate Flash update, and a stager. A module called “Godlike12,” which is a backdoor written in Go language sets up a command-and-control (C2) channel. Finally, the compromised machine has two versions of the open-source Stitch Python backdoor installed.

See the full report here: https://threatpost.com/watering-holes-asian-ethnic-flash-update-decoy/154323/

Office 365 Rebrands as Microsoft 365 With New Consumer Features - BleepingComputer

Microsoft has rebranded its Office 365 service to Microsoft 365 with a new consumer subscription package called “Microsoft 365 Personal and Family”. The package includes Office applications, OneDrive, Outlook, and a new Family Safety App and Teams for Consumer. Microsoft has introduced new AI-enhanced writing tools to help students and consumers write confidently. A new and dynamic template for Excel called "Money in Excel" that allows connecting the consumer to financial accounts and import their data is also an added feauture. The new Family Safety parental control service helps parents to monitor and restrict the activity of kids on their Windows 10 systems and Android devices. Additionally, the consumers can add a personal account to Microsoft Teams to facilitate family members to collaborate, plan events, share information, and share photos.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/office-365-rebrands-as-microsoft-365-with-new-consumer-features/

Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others — Krebs on Security

A spear-phishing attack this week hooked a customer service employee at GoDaddy.com, the world’s largest domain name registrar. The incident gave the phisher the ability to view and modify key customer records and change the domain settings for almost half a dozen customers. The hackers changed the DNS records for Escrow.com, a transaction brokering site that routes to an Internet address in Malaysia which is currently hosting a phishing site. The attacker also obtained free encryption certificates for escrow.com from Let’s Encrypt. The registrar locked down the impacted accounts involved in this incident to prevent further changes. The company has notified the impacted customers and successfully reverted malicious actions.

See the full report here: https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/

SBTech Victim of Cyber-Attack - USGamblingSites.com

More than 50 online sportsbooks, powered by SBTech, had to be taken offline following a potential cyberattack over the weekend. SBTech's monitoring systems flagged a potential security threat late Friday, after which, its data centers around the world were powered down as a precaution to mitigate further risks. This affected sites across the world experience a 72-hour downtime. On Monday, The technology provider confirmed to its partners that it had been the target of an attempted ransomware attack. According to SBTech, the threat has been resolved, all customer data was securely encrypted, and there was no data breach.

See the full report here: https://www.usgamblingsites.com/news/sbtech-victim-of-cyber-attack/

8-Year-Old VelvetSweatshop Bug Resurrected in LimeRAT Campaign

Researchers have discovered a new campaign that spreads LimeRAT leveraging Excel files and hardcoded VelvetSweatshop default passwords for encrypted files. LimeRAT is a remote access tool/backdoor that can allow attackers to access an infected system and install a range of malware strains. The attacker sends malicious, encrypted Excel file attachments in “read-only” mode via a phishing email. To decrypt the encrypted file, Excel first tries to use an embedded, default password, “VelvetSweatshop,” and open the file and run any onboard macros or other potentially malicious code. Meanwhile, it keeps the file in read-only mode. The Microsoft Office system does not generate any warning dialogs other than noting the file is read-only. Attackers can leverage this to execute LimeRAT and install payload on the system. Users are recommended to scrutinize all the email attachments and monitor network traffic for any outbound traffic.

See the full report here: https://threatpost.com/velvetsweatshop-bug-resurrected-limerat/154310/

Critical WordPress Plugin Bug Lets Hackers Turn Users Into Admins - BleepingComputer

A critical vulnerability was found in the WordPress SEO Plugin – Rank Math plugin that can allow attackers to elevate privileges of any WordPress sites with unpatched plugins. RankMath is a WordPress plugin, designed to help website owners to attract more traffic to their sites through search engine optimization (SEO). The privilege escalation vulnerability exists in an unprotected REST-API endpoint of the plugin. An unauthenticated attacker can leverage this flaw to update arbitrary metadata, including the ability to grant or revoke administrative privileges for any registered user on the WordPress site. Another bug was found in Rank Math’s optional plugin modules that could allow unauthenticated attackers to create redirects from almost any location on the WordPress site to any destination of their choice. Rank Math users are strongly recommended to update to the latest version 1.0.41.2 that contains fixes for both the issues.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-bug-lets-hackers-turn-users-into-admins/

Microsoft warns hospitals of sophisticated ransomware attacks targeting remote workforce - FierceHealthcare

Microsoft has warned hospitals of ransomware attacks that are targeting remote workers to gain access to their networks. As healthcare organizations move their non-essential employees to work remotely during the COVID pandemic, ransomware operators are trying to find vulnerabilities in network devices like gateway and virtual private network (VPN) appliances. Microsoft identified several dozen hospitals with vulnerable gateway and VPN appliances in their infrastructure and sent targeted notifications to these hospitals with information about the vulnerabilities and how attackers can take advantage of them. The company has recommended a slew of mitigations and workarounds that can protect users from exploits of these particular vulnerabilities and others.

See the full report here: https://www.fiercehealthcare.com/tech/microsoft-warns-hospitals-sophisticated-ransomware-attacks-targeting-remote-workforce

Cloudflare Launches a DNS-Based Parental Control Service - BleepingComputer

Cloudflare introduced a privacy-focused DNS resolver, '1.1.1.1 for Families,' to help parents safeguard their children's online security and privacy​​​​​​ by automatically filtering out bad sites, allowing them to focus on working from home. Cloudflare's CEO Matthew Prince said that 1.1.1.1 for Families leverages Cloudflare's global network to ensure that it is fast and secure around the world. 1.1.1.1 for Families comes with two options. The first option automatically blocks malware content only, while the second blocks both malware and adult content from reaching your children while they browse the web.

See the full report here: https://www.bleepingcomputer.com/news/security/cloudflare-launches-a-dns-based-parental-control-service/

Coronavirus Florida: Ransomware attack brings Jupiter’s email, other services to a halt - Palm Beach Daily News

Jupiter’s IT systems were hit by a ransomware attack on March 21st, 2020, allowing the attackers to encrypt the town's files using REvil/Sodinokibi malware. Following the incident, several online services including, utility payments, plan submission systems, and all town email accounts were taken down. The malware seems to have originated from a malicious website. As there is no decrypter available yet, the town is working on restoring the encrypted data from backups.

See the full report here: https://www.palmbeachdailynews.com/news/20200401/coronavirus-florida-ransomware-attack-brings-jupiterrsquos-email-other-services-to-halt

Zoom admits meetings don't use end-to-end encryption

According to reports, Zoom, a video conferencing application, admitted earlier this week that it does not use end-to-end encryption. Although Zoom offers “enable an end-to-end (E2E) encrypted meeting,” option to users and provides a green padlock that claims “Zoom is using an end to end encrypted connection,” the company disclosed that it offers no such thing. The company said that they only collect user data to improve the service and do not allow any of their employees to access specific content from the meetings and also claimed that they do not sell any user data to third parties. However, the company confirmed it could provide data from meetings, if needed, for legal proceedings.

See the full report here: https://www.itpro.co.uk/software/video-conferencing/355180/zoom-does-not-use-end-to-end-encrypted

A crypto-mining botnet has been hijacking MSSQL servers for almost two years

A malware botnet, Vollgar, has been targeting Microsoft SQL (MSSQL) databases to take over its admin accounts and install cryptocurrency mining scripts on the underlying operating system by launching brute-force attacks against it. According to the researchers at Guardicore, the botnet started in May 2018 and is still active, infecting about 3,000 new MSSQL databases every day and is capable of installing Monero and Vollar cryptocurrency miners. To help victims MSSQL administrators, Guardicore has published a GitHub repository with scripts to detect files and backdoor accounts created by the Vollgar malware on infected hosts.

See the full report here: https://www.zdnet.com/article/a-crypto-mining-botnet-has-been-hijacking-mssql-servers-for-almost-two-years/