Threat Intelligence Bulletin: 04/03/2020

Threat Update: Zoom Bombing on the Dark Web

With most organisations switching to work from home to prevent the spread of COVID-19, tools related to remote work and the cloud have surged in popularity in recent weeks. Zoom is one of the most popular cloud-based enterprise communication platforms and offers chat, video and audio conferencing, and options to host webinars and virtual meetings online. With this sudden spike in Zoom use, attackers are increasingly seeking to take advantage of users with a variety of tactics. Some attackers are registering new fake Zoom-related domains, which attempt to trick people into downloading malware. Other vectors include compromising Zoom accounts and offering them for sale on hacking forums, and a technique called war-dialing or Zoom bombing, detailed in this advisory.

Recommendations

If you have Zoom, enable Zoom Protection in the ZeroFOX Platform for your organization
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Beware of lookalike domains and avoid clicking directly on links embedded in emails. Threat actors often use URL shorteners to make malicious links more appealing
If your organization uses Zoom or any other video conferencing software, ensure that you have enabled password-protected meeting invites.

Details

War-dialing is possible because meeting IDs are hardcoded in Zoom URLs. This makes it possible to brute-force meeting ID values until an active meeting is found. This is also called Zoom bombing, which refers to attackers gaining access to unsecured calls and leveraging the call for their own devices. This may involve simply disrupting the call, or could potentially involve an attacker recording or eavesdropping on the call without the intended meeting participants’ knowledge.

A similar string of attacks occurred against Amazon Ring security cameras in December 2019. Lax Ring security protocols allowed hackers to compromise devices and interact with users, often harassing them. Because of the publicity of these attacks, moderators of the hacking forums used to organize these Ring hacks banned the discussion of the devices, in an attempt to fly under law enforcement’s radar. Similar chatter has begun to circulate through the forums, with users concerned that Zoom bombing will draw unwanted attention.

Figure 1. Chatter related to brute-forcing Zoom meetings, using nulled[.]to tools.

In many of the forums ZeroFOX monitors, all posts referencing Zoom appear to have been purged. Although cached posts referencing Zoom can be seen in search results, attempting to access these threads displays an error stating, “The specified thread does not exist.”

Figure 2. Search results for “Zoom” on one hacking forum.

Figure 3. Error message upon attempting to access Zoom-related threads

As hacking forums have restricted discussion of Zoom, chatter has shifted onto Discord channels. Many of these channel links are shared on social media platforms like Twitter, to improve visibility.

Figure 4. One of hundreds of tweets regarding Zoom trolling Discord groups.

ZeroFOX has also identified entire websites dedicated to sharing insecure Zoom call IDs, like this one, below, for sharing digital learning links.

Figure 5. Website dedicated to spamming classroom Zoom calls

In addition to these attacks against open Zoom calls, criminals have been offering compromised Zoom account credentials for sale. Although these sales ads do not specify the method with which these accounts have been compromised, one of the most commonly used methods is credential stuffing. This tactic involves brute force login attempts, where a list of passwords (often generated with breached passwords from other sites) is tried until the attacker achieves a successful login.

Figure 6. A variety of cracked account credentials offered for sale, many for Zoom accounts.

On one of the few hacking forums still allowing Zoom account sales, Alpha Team identified over 4,000 cracked accounts for sale.

Conclusion

The increase in use of video conferencing software like Zoom has also sparked an increase in threat actors targeting the platform. Although Zoom has recently released an update to default meeting configurations, and has paused feature updates for the next 90 days in order to focus on security and privacy, attackers are still able to abuse the platform and profit off of compromised account sales. To best protect your organizations from these risks, ZeroFox recommends practicing the recommendations listed above.

Breach Disclosure: HTC Mania

In January 2020, the Spanish mobile phone forum HTC Mania suffered a data breach, likely due to exploitation of a recent high-profile vBulletin vulnerability. The incident exposed 1.5M member email addresses, usernames, IP addresses, dates of birth, salted MD5 password hashes and password histories.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The website HTCMania[.]com was compromised by a hacker that goes by the name, DonJuji, and is being offered for sale on RaidForums.

Figure 1. RaidForums posting

One notable aspect of this breach is that the forum improperly logged users’ previously used passwords. This gives would-be attackers the ability to leverage these past passwords in credential stuffing attacks. With a list of historic passwords, attackers may be more likely to successfully compromise a victim’s other accounts if users have reused passwords across accounts.

Breach Disclosure: OGUsers (Again)

OGUsers, one of the most popular hacking forums on the Internet, has disclosed their second security breach of the last year. OGUsers’ administrator ACE, who notified the forum of the breach, stated that an unknown hacker was able to embed a shell in an avatar, upload this to the forum, and gain access to the OGUsers database. This incident exposed the website activity, usernames, emails, IP addresses, salted MD5-hashed passwords, website data and private messages of more than 200,000 registered users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

OGUsers is a cybercrime marketplace known for selling hacked databases and compromised accounts. The site also shares hacking tutorials including how to conduct SIM Swapping attacks. The popularity of OGUsers has attracted a lot of unwanted attention from rival sites'. In May 2019, the first 'face-off' attack exposed details for the site’s 113,000 users. Additionally, attackers completely wiped the forum’s hard drives and dumped the stolen data on a rival hacking forum. A similar second breach took place on April 2nd, 2020. This breach exposed site activity, usernames, emails, IP addresses, salted MD5-hashed passwords, website data and private messages of more than 200,000 registered users. Before taking the site offline, OGUsers administrators force-reset passwords and urged users to enable two-factor authentication (2FA) for their accounts.

Soon after the breach, the database was uploaded to RaidForums. The RaidForums post suggests that this breach was conducted as an act of revenge against ‘corrupt’ OGUsers administrators.

Figure 1. OGUsers breach posting on rival hacking forum, RaidForums

MD5-hashed passwords are easily cracked to the plaintext equivalent. It is likely that many of these passwords will be recovered.

Breaking News: 2020-04-03 - 2020-04-09

Data Breach Report: Popular Digital Wallet App Key Ring Exposes 14 Million Users - Security Magazine

Key Ring, an app that allows users to digitally store loyalty cards, upload scans, and photos onto a digital store has compromised the details of nearly 14 million users. A misconfigured AWS S3 bucket belonging to Key Ring exposed nearly 44 million images uploaded by the users, including government IDs, retail club membership and loyalty cards, NRA membership cards, gift cards, credit cards including CVV numbers, medical insurance cards, medical marijuana ID cards and many more. The leaky bucket also exposed CSV files containing the details of membership lists and reports for many of North America’s retail brands which disclosed PII data such as full names, email addresses, membership ID numbers, dates of birth, locations and zip codes of millions of users. The researchers also found four more unsecured S3 buckets, which contained a snapshot of the company’s database holding millions of records such as user emails, home addresses, device and IP address information, encrypted passwords and, the “salt” randomized data used to encrypt them. However, the company has secured all the unsecured S3 buckets.

See the full report here: https://www.securitymagazine.com/articles/92067-data-breach-report-popular-digital-wallet-app-key-ring-exposes-14-million-users

SOS Online Backup breach exposes 135 million customer records

Security researchers from vpnMentor have discovered an unsecured and unencrypted database that belongs to cloud backup provider SOS Online Backup. The exposed database contained 135 million records that estimate to nearly 70GB of metadata related to user accounts, including structural, reference, descriptive, administrative metadata, customers’ personal information, including full names, contact details, and usernames. The breach was discovered in November 2019, analyzed in December 2019, and reported to SOS Online Backup, after which, the company closed the breach in mid-December, 2019.

See the full report here: https://www.itpro.com/security/data-breaches/355206/sos-online-backup-breach-exposes-135-million-customer-records

Twitter Reveals That Firefox Cached Private Data For Up to 7 Days - BleepingComputer

Social networking giant Twitter disclosed an issue in the way Mozilla Firefox stores cached data that may have resulted in non-public information being inadvertently stored in the browser's cache. The firm stated that, if a user who accessed Twitter from a shared or public computer via Mozilla Firefox browser and took actions like downloading Twitter data archive or sending/receiving media via Direct Message, this information may have been stored in the browser’s cache even after user logs out of Twitter. Fortunately, the private data stored by the Firefox cache, including all the accidentally stored private info is removed automatically after the browser’s default cache retention period of 7 days. Twitter confirms that it has made a change to its platform to prevent Firefox from caching users' personal information going forward. It also recommends users to clear the cache before logging out, in case a shared computer is used to access Twitter.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-reveals-that-firefox-cached-private-data-for-up-to-7-days/

Office 365 Phishing Uses CSS Tricks to Bypass Email Gateways - BleepingComputer

In a new phishing campaign, attackers are using Office 365 voicemail baits to trick victims into them into visiting phishing pages designed to steal personal information or infect their computers with malware. Here, the phishing emails use the old trick of reversing some of the text elements in the source code and rendering forward within the email displayed to the target. But this time, it involves using Cascading Style Sheets (CSS). Reversing text in an email's HTML code can allow attackers to bypass some automated text matching models used by Secure Email Gateways (SEG) to differentiate between legitimate emails and phishing messages.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-uses-css-tricks-to-bypass-email-gateways/

In COVID-19 Scam Scramble, Cybercrooks Recycle Phishing Kits

According to the researchers at Akamai, old phishing kits are being rolled into service to catch up with the unusual rise in the volume of a whole new variety of scams that exploit the pandemic COVID-19. Phishing kits that have been previously deployed are now being used again to lure potential victims who are either working from home due to self-isolation, mandated quarantine, or corporate policy during the pandemic.

See the full report here: https://threatpost.com/covid-19-scam-scramble-cybercrooks-recycle/154383/

A hacker has wiped, defaced more than 15,000 Elasticsearch servers

More than 15,000 Elasticsearch servers have been hacked and defaced by a hacker. According to the researchers, the attacker used an automated script that scans the internet for ElasticSearch systems left unprotected, connects to the databases, attempts to wipe their content, and then creates a new empty index called nightlionsecurity.com. However, Night Lion Security has denied that they had anything to do with the ongoing attacks and has notified law enforcement about the attacks.

See the full report here: https://www.zdnet.com/article/a-hacker-has-wiped-defaced-more-than-15000-elasticsearch-servers/

More Than 8,000 Unsecured Redis Instances Found in the Cloud

Trend Micro has discovered nearly 8,000 unsecured Redis instances across the world, even the ones that are deployed in public clouds. These Redis instances were neither Transport Layer Security (TLS) encrypted nor password protected. Though Redis is originally intended to be used only in trusted environments, when left unsecured, cybercriminals can find and abuse Redis servers to launch attacks such as SQL injections, cross-site scripting, malicious file uploads, and even remote code execution, among others. Threat actors can also view, access, and modify stored data in exposed Redis instances.

See the full report here: https://blog.trendmicro.com/trendlabs-security-intelligence/?p=87053

iPhone Camera Hijacked Using Three Zero-Days: Apple Pays Hacker $75,000 - Forbes

An ethical hacker bagged a huge bug bounty prize of $75,000 after he found a total of seven zero-day vulnerabilities in Safari (CVE-2020-3852, CVE-2020-3864, CVE-2020-3865, CVE-2020-3885, CVE-2020-3887, CVE-2020-9784, & CVE-2020-9787) of which three were used to hack any iOS and macOS camera. The vulnerabilities involved the way that Safari parsed Uniform Resource Identifiers, managed web origins and initialized secure contexts, tricking a user into visiting a malicious website, which could directly access the camera, provided it had previously trusted a video conferencing site such as Zoom, for example.

See the full report here: https://www.forbes.com/sites/daveywinder/2020/04/03/iphone-camera-hijacked-using-three-zero-days-apple-pays-hacker-75000/

Discord Turned Into an Account Stealer by Updated Malware - BleepingComputer

AnarchyGrabber Discord malware has been updated to modify the Discord client files, evade detection, and steals user tokens every time the victim logs into the chat service. Discord is an app designed to help gamers talk to each other in real-time. The older version of the AnarchyGrabber malware was in the form of an executable that could easily be detected by security software and only steals tokens while it is running. Whereas the newer version of the malware offers persistence and modifies the JavaScript files used by the Discord client to inject its code every time it runs, making it harder for antivirus software to detect. When a victim logs into Discord, the malware is executed to steal victims' tokens and uploads it onto the threat actor's Discord channel. The uploaded token is collected and used by the threat actor, stealing the victim's identity.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-turned-into-an-account-stealer-by-updated-malware/

Firefox gets fixes for two zero-days exploited in the wild

Firefox has fixed two zero-day vulnerabilities that were being exploited in the wild. The two use-after-free vulnerabilities tracked as CVE-2020-6819 and CVE-2020-6820 could allow hackers to inject malicious code inside Firefox's memory and have it executed in the browser's context. Firefox users are advised to update to the latest fixed version Firefox 74.0.1 and ESR 68.6.1.

See the full report here: https://www.zdnet.com/article/firefox-gets-fixes-for-two-zero-days-exploited-in-the-wild/

Google rolls back Chrome privacy feature due to COVID-19

Google has announced that it is rolling back the Chrome browser privacy feature called “SameSite cookie” to ensure stability for websites providing essential services including banking, online groceries, government services, and healthcare that facilitate our daily life during the current coronavirus (COVID-19) outbreak. The feature was enabled in a small number of Chrome users, with the release of Chrome 80. Once the feature is enabled, it prevents third-party domains from creating cookie files while the user was not on their website. However, third-party cookies are also used in other contexts, for government sites, banking portals, intranets, and others. Google manager said that they will re-enable the feature in the future.

See the full report here: https://www.zdnet.com/article/google-rolls-back-chrome-privacy-feature-due-to-covid-19/

Self-Propagating Malware Targets Thousands of Docker Ports Per Day

Security researchers have uncovered a self-propagating cryptomining campaign that is targeting misconfigured open Docker Daemon API ports. The attack pattern begins with the attackers identifying a misconfigured Docker API port that has been left open to the public internet, access that open port and the Docker instance connected to it, and run a rogue Ubuntu container. The container issues a command that fetches the Kinsing malware, which in turn downloads and runs a cryptominer. In the final stage of the infection, Kinsing, a Golang-based Linux binary that uses several Go libraries, attempts to propagate to other containers and hosts.

See the full report here: https://threatpost.com/self-propagating-malware-docker-ports/154453/

Microsoft: Emotet Took Down a Network by Overheating All Computers - BleepingComputer

According to Microsoft, an Emotet infection was able to take down an organization's entire network by maxing out CPUs on Windows devices and bringing its Internet connection down to a crawl after an employee was tricked to open a phishing email attachment. A polymorphic virus, that propagates via network shares and legacy protocols, shut down the organization’s core services after delivering Emotet via phishing emails. However, Microsoft was able to completely eradicate the Emotet infection after uploading new antivirus signatures and deploying Microsoft Defender ATP and Azure ATP trials to detect and remove the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-emotet-took-down-a-network-by-overheating-all-computers/

Spearphishing Campaign Exploits COVID-19 To Spread Lokibot Infostealer

Lokibot, an information-stealing malware, is actively being distributed in an ongoing phishing campaign via emails utilizing the WHO trademark as a lure. The phishing emails are attached with a "COVID_19- WORLD HEALTH ORGANIZATION CDC_DOC.zip.arj" compressed file, which can be opened with 7-Zip. If victims click on the attachment and decompress the file, it transforms into a "DOC.pdf.exe" extension rather than the "Doc.zip.arj," unleashing the infostealer LokiBot that lifts a variety of credentials from the user’s system, including FTP credentials, stored email passwords, passwords stored in the browser and others.

See the full report here: https://threatpost.com/spearphishing-campaign-exploits-covid-19-to-spread-lokibot-infostealer/154432/

DOJ says Zoom-bombing is a crime

The US Department of Justice has published a press release on Friday warning pranksters that "Zoom-bombing" could lead to fines or arrests on a variety of state or federal charges. Zoom-bombing is becoming a favorite pastime for teenagers where they use a variety of social media platforms, including Discord, Reddit and Twitter to raid Zoom meetings. Miscreants then connect to Zoom channels and hurl insults, play pornographic material, or make death threats against other participants.

See the full report here: https://www.zdnet.com/article/doj-says-zoom-bombing-is-a-crime/

Windows PCs Exposed to Attacks by Critical HP Support Assistant Bugs - BleepingComputer

A security researcher has spotted critical vulnerabilities in HP Support Assistant that can expose Windows computers to remote code execution attacks and could allow attackers to elevate their privileges or to delete arbitrary files following successful exploitation. HP Support Assistant is a free self-help tool that delivers. automated support, updates, and fixes to HP PCs and printers. HP computers sold after October 2012 and running Windows 7, Windows 8, or Windows 10 operating systems all come with HP Support Assistant installed by default. The identified vulnerabilities include five privilege escalation flaws, two arbitrary file deletion vulnerabilities, and three remote code execution vulnerabilities. Although HP has partially fixed the flaws, three of the local privilege escalation vulnerabilities are still unpatched. To mitigate the vulnerabilities, users are recommended to uninstall the HP Support Assistant & HP Support Solutions Framework.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-pcs-exposed-to-attacks-by-critical-hp-support-assistant-bugs/

New York City schools won't be using Zoom anymore because of security concerns

Earlier this week, federal officials began warning of a new potential privacy and security concern called “Zoombombing.” Over 90,000 schools across 20 countries have been using the platform for online teaching since the company offered its services free of charge to schools because of the COVID-19 pandemic. Schools in New York City are moving away from using the video conference app after a review of security concerns. Several incidents have occurred during online Zoom classes, involving people yelling profanities or exposing themselves. The city’s Department of Education is directing schools to move away from using Zoom as soon as possible.

See the full report here: https://www.cnn.com/2020/04/04/us/nyc-schools-zoom-online-security/index.html

Facebook pulls down fake accounts linked to Egypt and France - CNET

Facebook has pulled down more than 300 fake accounts, pages and groups tied to France and Egypt in March, including some that posed as news outlets and shared content about topics such as the civil war in Yemen and Libya, coronavirus and sports. The company removed 81 Facebook accounts, 82 pages, one group and 76 Instagram accounts linked to Egypt for engaging in "coordinated inauthentic behavior". Another network of fake accounts on Facebook was linked to the Sète region of France. These accounts shared content in French about local news topics such as municipal elections and immigration. The social network also removed 51 Facebook accounts, 9 pages and 9 Instagram accounts linked to France.

See the full report here: https://www.cnet.com/news/facebook-pulls-down-fake-accounts-linked-to-egypt-and-france/

DarkHotel hackers use VPN zero-day to breach Chinese government agencies

Hackers are exploiting a zero-day vulnerability in Sangfor SSL VPN servers. The servers are used to provide remote access to enterprise and government networks. According to Qihoo 360, 174 of these servers were located on the networks of government agencies in Beijing and Shanghai, and the networks of Chinese diplomatic missions operating abroad. Hackers leveraged the flaw to gain control over Sangfor VPN servers, where they replaced a file named SangforUD.exe with a boobytrapped version. This file was later used by employees to install Sangfor VPN desktop app and connect to the servers. Researchers have tracked the attacks to a hacker group known as DarkHotel and believe that the recent attacks against Chinese government agencies could be related to the current coronavirus (COVID-19) outbreak. Sangfor has addressed the vulnerability and will release the patch soon. Sangfor customers can find additional details in the company's WeChat post and its SRC-2020-281 security advisory (non-public).

See the full report here: https://www.zdnet.com/article/darkhotel-hackers-use-vpn-zero-day-to-compromise-chinese-government-agencies/

Experts uncovered hidden behavior in thousands of Android Apps

Researchers from Ohio State University analyzed thousands of mobile applications for Android and discovered dangerous behavior, including backdoors and blacklists. The experts devised a tool, named INPUTSCOPE, that allows them to inspect the Android apps and find any suspicious behavior by detecting the execution context of user input validation and also the content involved in the validation. More than 150,000 Android applications, including the top 100,000 apps from the official Google Play, the top 20,000 apps from an alternative store, and 30,000 pre-installed apps extracted from Samsung smartphones’ firmware were analyzed. The researchers also found blacklists targeted content in Chinese, English, and Korean. The issues have been reported to the development team of the applications but they are yet to fix it.

See the full report here: https://securityaffairs.co/wordpress/101094/malware/android-apps-hidden-backdoors.html

Australian Digital Health Agency reveals two 'probable' instances of Medicare fraud - ZDNet

The Australian Digital Health Agency (ADHA), the agency responsible for oversight of My Health Record, has revealed instances where medical records were compromised. Approximately, 38 matters were reported to the Office of the Australian Information Commissioner (OAIC), last year related to potential unauthorized access, security, or integrity breaches. 37 of these matters were counted as breaches, and the ADHA admits that most were the result of administrative errors such as "intertwined" Medicare records or processing errors when creating records for infants. The exposed information includes name, address, date of birth, and Medicare information.

See the full report here: https://www.zdnet.com/article/australian-digital-health-agency-reveals-two-probable-instances-of-medicare-fraud/

Hackers’ forum hacked, OGUsers database dumped (again)

OGUsers, one of the most popular hacking forums on the internet disclosed a security breach, the second such incident in the past year. The brief announcement was spotted by data breach monitoring service Under the Breach. An unknown hacker was able to breach the server through a shell in avatar uploading in the forum software and get access to our current database. The incident exposed details of more than 200,000 registered users and dumped the stolen data on a rival hacking forum. Before taking the site down, administrators have reset passwords and urged users to enable two-factor authentication (2FA) for their accounts.

See the full report here: https://nakedsecurity.sophos.com/2020/04/06/hackers-forum-hacked-ogusers-database-dumped-again/

80% of all exposed Exchange servers still unpatched for critical flaw - BleepingComputer

A security flaw present in the Exchange Control Panel (ECP) component allows attackers to take over vulnerable Microsoft Exchange servers using any previously stolen valid email credentials. Over 350,000 of all Microsoft Exchange servers currently exposed on the Internet are unpatched against the CVE-2020-0688 post-auth remote code execution vulnerability affecting all supported Microsoft Exchange Server versions. Since Microsoft has no mitigating factors for this vulnerability, Rapid7 advises patching your servers before hackers find them and fully compromise your entire network.

See the full report here: https://www.bleepingcomputer.com/news/security/80-percent-of-all-exposed-exchange-servers-still-unpatched-for-critical-flaw/

Iran, Colombia, and Italy Put Citizens at Risk with COVID-19 Government Mobile Apps

Security Researchers at ZeroFOX have discovered many government-sponsored mobile applications on the Android platform, related to COVID-19, in which, numerous privacy concerns, vulnerabilities or backdoors were found. ZeroFOX has provided a technical analysis of nearly three applications that put citizens of Iran, Colombia, and Italy at risk with COVID-19 government mobile apps. The first highlights a potential malicious copycat of a legitimate, government-sanctioned application, the second details the risks of an application that was built without security in the development lifecycle, and the third discusses an application that was repackaged with a backdoor and abused by cybercriminals.

See the full report here: https://www.zerofox.com/blog/covid-19-mobile-apps/

FBI warns again of BEC scammers exploiting cloud email services - BleepingComputer

The US Federal Bureau of Investigation (FBI) warns organizations about cybercriminals abusing popular cloud-based email services as part of Business Email Compromise (BEC) attacks. The FBI has also reported a hike in the number of BEC scams exploiting the COVID-19 pandemic targeting US municipalities, financial institutions, and bank customers. To defend against BEC scams, FBI recommends users to enable multi-factor authentication for all email accounts, verify all payment changes and transactions in-person or via a known telephone number, and educate employees about BEC scams, including preventative strategies such as how to identify phishing emails and how to respond to suspected compromises.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-again-of-bec-scammers-exploiting-cloud-email-services/

Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others

Russia's state-owned telecommunications provider, Rostelecom, redirected the traffic meant for more than 200 of the world's largest content delivery networks (CDNs) and cloud hosting providers. The suspicious incident is a classic example of a Border Gateway Protocol hijack, a de-facto system used to route internet traffic between internet networks across the globe. The incident lasted for about an hour, affecting more than 8,800 internet traffic routes from nearly 200 networks including, Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Digital Ocean, Joyent, LeaseWeb, Hetzner, and Linode.

See the full report here: https://www.zdnet.com/article/russian-telco-hijacks-internet-traffic-for-google-aws-cloudflare-and-others/

Scammers target Australians financially affected by pandemic - BleepingComputer

The Australian Competition and Consumer Commission (ACCC) warns of scammers cold-calling people claiming to be from organizations that can help you get early access to superannuation, seeking to collect personal information, including information that will allow the crooks to fraudulently access the targets' superannuation funds. ACCC is enabling individuals affected by the coronavirus to access up to $10,000 of their superannuation in 2019-20 and a further $10,000 in 2020-21. Superannuation is a company pension plan and it is a partly compulsory system requiring Australians to deposit a minimum percentage of their income into an account that will provide them with an income stream after retirement.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-target-australians-financially-affected-by-pandemic/

Ransomware attack hits Coffee County Sheriff's Department | Coronavirus News - Manchestertimes

Coffee County Sheriff's Department was hit by a ransomware attack, allowing the attackers to take down its entire system. The documents including files and arrest, booking and sentencing records for all inmates were encrypted during the attack. Following the incident, a message was sent demanding a ransom to unlock the encrypted files.

See the full report here: https://www.manchestertimes.com/news/coronavirus_news/ransomware-attack-hits-coffee-county-sheriffs-department/article_a78af2c0-7860-11ea-b2a6-e357a0012117.html

FIN6 and TrickBot Combine Forces in ‘Anchor’ Attacks

Two cybercriminal groups, FIN6 (also known as ITG08) and the operators of the TrickBot malware, have teamed up to target several organizations with TrickBot’s malware framework called Anchor. TrickBot's Anchor is an all-in-one attack framework, which is made up of various submodules that can help attackers spread laterally on a network, to install backdoors. According to the researchers, the attacks emanate via malicious spam campaigns, delivering TrickBot. Upon successful TrickBot infection, compromised organization's access, along with the use of the Anchor and PowerTrick malware, are sold to ITG08, which then takes over the intrusion into the victim network.

See the full report here: https://threatpost.com/fin6-and-trickbot-combine-forces-in-anchor-attacks/154508/

Chrome 81 Released With 32 Security Fixes and Web NFC API - BleepingComputer

Google has released Chrome 81 with bug fixes, new features, and 32 security fixes for Windows, macOS, and Linux operating systems. The new features include auto-upgrading of mixed image content and the Web NFC API. The new version of the browser is well equipped to read and write to NFC tags when they are close to the user's laptop or computer. It will also automatically attempt to load all HTTP image content on a web page via HTTPS and block the content if it cannot be delivered over a secure connection. This release also includes console warnings on mixed content downloads.

See the full report here: https://www.bleepingcomputer.com/news/google/chrome-81-released-with-32-security-fixes-and-web-nfc-api/

Health sites are 'unlawfully' sharing medical data with Facebook and Google

According to the Irish Data Protection Commission (DPC), health-related websites are illegally sharing users’ medical data with various third parties. These websites are embedded with third-party trackers and cookies, leaking patients’ details to third parties including Facebook and Google. This transfer of data is either done through the use of explicit user profiles of logged-in customers, or through predictive profiles based on unique identifiers.

See the full report here: https://www.itpro.co.uk/policy-legislation/data-protection/355250/health-sites-sharing-users-medical-data-with-major-tech

Shipbuilder Austal was hacked with stolen creds sold on dark web - iTnews

Austal, an ASX-listed shipbuilder and defense contractor, was compromised in mid-October 2018 after an attacker was able to access the Austal’s system using stolen credentials and move laterally. Following the attack, the company shut down all its systems and external ports. The company responded to the incident by implementing a complex password policy and enabling multi-factor authentication.

See the full report here: https://www.itnews.com.au/news/shipbuilder-austal-was-hacked-with-stolen-creds-sold-on-dark-web-546165

Beaumont dental clinic breached by ransomware attack - Beaumont Enterprise

On February 4th, 2019, Rainbow Dental Care suffered a ransomware attack potentially exposing patients' information such as name, address, telephone number, date of birth, age, Social Security number, insurance information, and dental records. However, financial and credit card information was not affected by this incident. Out of an abundance of caution, the company sent letters to those who might have been affected. The company has taken steps to build its security posture to prevent future risks.

See the full report here: https://www.beaumontenterprise.com/news/article/Beaumont-dental-clinic-breached-by-ransomware-15185166.php

NASA under 'significantly increasing' hacking, phishing attacks - BleepingComputer

Multiple baits linked to the novel coronavirus outbreak including requests for donations, tax refunds, safety measures, fake vaccines, updates on virus transmissions, and various disinformation campaigns are being used by nation-states and cybercriminals to exploit and target NASA electronic devices, networks, and personal devices. According to NASA's Chief Information Officer, the attackers are aiming at accessing sensitive information, user names, user passwords, conducting denial of service attacks, spreading disinformation, and carrying out scams. Attackers are also using malicious emails embedded with malware to infect employees. NASA’s Security Operations Center (SOC) successfully blocked these cyberattacks to protect users from potential malicious attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/nasa-under-significantly-increasing-hacking-phishing-attacks/

WhatsApp Axes COVID-19 Mass Message Forwarding

A Facebook-owned messaging platform, WhatsApp, has made an effort to stop the spread of misinformation on its platform by limiting the number of recipients to which its users can forward certain messages about the COVID-19 pandemic. With this modification, a user can only forward messages with double arrows, i.e., those that did not originate from a close contact, to one person rather than multiple WhatsApp contacts. The limit was first tested in India by restricting the message forwarding to five users and also removed a “quick forward” button that had accompanied media messages.

See the full report here: https://threatpost.com/whatsapp-covid-19-mass-message-forwarding/154563/

Chinese APT groups are targeting Linux servers

Security researchers from Blackberry have released a new report called “Decades of RAT’s” that examines how five Chinese sponsored APT groups targeted Linux servers, Windows systems, and Android mobile devices while remaining undetected for nearly a decade. The APT groups have exploited the "always on, always available" nature of Linux servers by establishing a "beachhead" that can then be used for coordinated attacks.

See the full report here: https://www.itpro.co.uk/security/hacking/355259/apt-groups-targeting-linux-servers-for-china

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

A security researcher has created a proof-of-concept attack, exploiting the weakness in PowerPoint’s Open XML Slide Show files, called PPSX, designed for presentation playback only, and can’t be edited. The hacker can manipulate a PowerPoint file to download and begin the installation of malware, simply by hovering over a hypertext link. This technique does require a victim to accept a pop-up dialogue box to run or install a program. Hence, Microsoft does not consider this a vulnerability. However, the researcher believes this could be a novel attack vector that triggers the installation of malware.

See the full report here: https://threatpost.com/powerpoint-weakness-mouse-over-attack/154589/

'Unkillable' Android Malware App Continues to Infect Devices Worldwide

The "Unkillable" Android malware app, xHelper, has infected more than 55,000 Android devices across the world. According to the researchers at Kaspersky, xHelper is distributed under the face of genuine apps such as "cleaners" and "speed-up" for Android smartphones and is also downloaded by malware that comes preinstalled on Android smartphones from some device manufacturers. Once installed, the malware collects unique device information, such as android_id, manufacturer, model, and other data useful for targeted advertising purposes. The malware significantly reduces the performance of the device and constantly displays intrusive ads. Users are urged to avoid downloading apps from unofficial, third-party Android application stores.

See the full report here: https://www.darkreading.com/mobile/unkillable-android-malware-app-continues-to-infect-devices-worldwide/d/d-id/1337519

ThreatList: Skype-Themed Apps Hide a Raft of Malware

Security researchers have revealed nearly 120,000 suspicious malware and adware packages in the wild, impersonating as versions of the popular video calling app, Skype. According to the researchers, Skype isn’t the only one being targeted, a total of 1,300 suspicious files not using the Skype name, 42 percent were disguised as Zoom, followed by WebEx (22 percent), GoToMeeting (13 percent), Flock (11 percent) and Slack (11 percent). Users are advised to validate the legitimacy of the online social meeting tools and always keep them patched.

See the full report here: https://threatpost.com/skype-apps-hide-malware/154566/

Dark Nexus: A New Emerging IoT Botnet Malware Spotted in the Wild

Security researchers have identified a new IoT botnet called Dark Nexus which can compromise smart devices to stage distributed denial-of-service attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. Currently, Dark Nexus has compromised nearly 1,372 bots, acting as a reverse proxy, across China, South Korea, Thailand, Brazil, and Russia. The botnet works by employing credential stuffing attacks against a variety of devices, such as routers (from Dasan Zhone, Dlink, and ASUS), video recorders, and thermal cameras, to co-opt them into the botnet.

See the full report here: https://thehackernews.com/2020/04/darknexus-iot-ddos-botnet.html

Microsoft to add DANE and DNSSEC support to Exchange Online servers

Microsoft has announced plans to release DANE and DNSSEC for SMTP to its cloud-hosted email server offering, Office 365 Exchange Online, in two phases. DANE and DNSSEC are two internet protocols for ensuring that communications take place over properly encrypted and authenticated connections. The company plans to release the first phase which includes only outbound support (mail sent outbound from Exchange Online) by the end of the calendar year 2020. The second phase will add inbound support for Exchange Online and Microsoft plans to enable that by the end of 2021.

See the full report here: https://www.zdnet.com/article/microsoft-to-add-dane-and-dnssec-support-to-exchange-online-servers/