Threat Intelligence Bulletin: 04/10/2020

Alpha Team Research: Anatomy of a Job Scam

Companies in the manufacturing and construction industries may find themselves inundated with scammers offering jobs at their companies that do not exist. A common way that firms attempt to combat these job scams is by working tirelessly to remove all the associated infrastructure: job posts, accounts, websites, and emails. Though this approach may be effective with the right resources, we suggest instead that companies focus efforts on the areas that may be most harmful to their company and their hiring process. This piece acts as a primer on the job scam process and explains some of the core functionalities of a job scam: how scammers reach targets, the job offer process, and what the fake job offers look like.

Recommendations

Use the ZeroFOX platform to Identify and remove fake job postings, scammers’ accounts, and associated infrastructure, but focus on the areas that may cause the greatest impact to your hiring. Consider focusing on the areas that target your most important applicant pools. Reach out to [email protected] for assistance, if needed
Work within your industry on ways to reduce the easy of job scams and increase visibility around the legitimate hiring process
Monitor for outreach from job candidates regarding scams and fraudulent postings

Details

Scammers initially engage with victims in a variety of manners in the digital space. There are two broad categories of engagement: passive and active. In passive engagement, the scammers are hoping the victims will come to them, whereas in active engagement, they initiate contact with victims to draw them in.

In this section, we are using the example of Gulf Job Careers as a case study; however, a variety of similar groups, accounts, sites, and organizations exist offering jobs around the world.

Channels of Engagement

For construction and manufacturing scams, passive engagement includes a wide variety of Facebook posts, in large part within job-focused groups.

Figure 1. A Facebook group with likely fraudulent job postings across the oil and gas, manufacturing, construction, and other industries.

Instagram and Twitter are also methods to promote job scams, though not yet as commonly used as Facebook. Comparing the Gulf Job Career Facebook group in Figure 1 with its Twitter and Instagram accounts (linked by its custom site, gulfjobcareers[.]com reveals significantly lower engagement on the latter two. The Facebook group has over 300,000 followers, while their Instagram has 12,900 and their Twitter account has only 9,400.

Professionally oriented social media sites are commonly used as well to post fake job listings, such as on LinkedIn, Indeed, and Glassdoor. These postings are particularly concerning because their professional association may lend an air of authenticity not posed by Facebook, Instagram, or Twitter.

Many social media posts also link to posts on custom-built sites. These sites usually contain the same information but with the added lure of improved search capabilities for job seekers. The disadvantage for companies targeted by these scams is that it can be more difficult to remove fraudulent information from a custom-built domain as opposed to social media, since fraudulent job postings clearly violate social media Terms of Service.

Figure 2. Gulfjobcareers[.]com, which is associated with the social media pages by the same name.

As awareness of these scams and others begins to spread, scammers are moving to private and encrypted channels. Gulfjobcareers also maintains a Telegram group, and many job postings are published in WhatsApp groups. Though the initial posts may be public, they can quickly be privatized or moved to encrypted direct message channels.

In addition to passive posts, scammers often also reach out to potential victims through WhatsApp or other private channels, actively soliciting interest and job applications. Interest expressed by victims on public channels frequently results in outreach via Facebook or LinkedIn direct message, text message, or email. Whatever the initial contact, scammers are looking to move the conversation to private channels that cannot be publicly monitored.

The Job Offer Process

Once the conversation is established in private channels, there may be some perfunctory discussion about what the candidate is interested in, their skills, job requirements. The conversation will quickly move to getting the candidate a job offer as fast as possible. Interviews may or may not occur; if they are not completely bypassed, they might be scheduled but then later canceled, they might occur “in writing,” and on occasion, an actual virtual interview may occur.

Interview or not, the candidate is quickly provided a job offer indicating they have been selected. The job offer letter also includes or is accompanied by instructions and paperwork for submitting for visa sponsorship in order to emigrate. The applicant is told to fill out this paperwork and submit it either to a fake visa officer/office, or to a third party that will help “expedite” the application. Along with submitting a wide variety of personal information that could be used to impersonate the victim applicant or steal their identity, the victim is also told they must pay a fee for the visa — theoretically to be reimbursed by the company later — usually ranging US$1,000 - 3,000.

Characteristics of the Jobs Offered

Job postings or initial advertisements typically list multiple job types, rather than listing an opening for one particular job or type of job. Fraudulent job postings target the manufacturing/construction, hospitality/tourism, agriculture, and domestic worker industries above all else, potentially because these areas are readily perceived as suitable for non-native workers or that have a high proportion of immigrant workers. Engineering, project management, and administrative positions are the types of jobs most frequently listed in the construction and manufacturing industries. Some job postings will list broadly available positions not specific to a particular company, including positions ranging from engineering to waiters to drivers.

No matter the type of job, the posting will often advertise an unusual number of benefits at no cost to the job candidate: housing, transportation, a vehicle, some meals included, plane tickets back home once a year, a weekly “allowance,” etc. The postings will also list salaries that are unusually high, not counting the additional benefits; posts for engineering and construction positions in Canada in 2019 and 2020 listed salaries of CAN$5,000 - 16,000 per month in addition to benefits such as meals, plane tickets, and/or a weekly allowance of up to CAN$500.

By offering positions readily available to immigrants and advertising attractive benefits, scammers ensure they entice a wide pool of potential victims. Indeed, when these jobs are posted on social media, at times dozens or hundreds of users will reply expressing interest and asking how they can apply.

Conclusion

Scammers tend to target the vulnerable, as in this case, where job seekers are being taken advantage of. It is likely that these kinds of job scams will increase, given that the global unemployment level has so rapidly increased due to the economic effects of COVID-19. To best protect your candidate pool from scams of this nature, ZeroFOX recommends implementing the recommendations listed above.

Breaking News: 2020-04-10 - 2020-04-16

Data Breach Report: RigUp Exposes More Than 70000 Private Files - Security Magazine

Security researchers at vpnMentor have discovered a breached database belonging to an American software company called “RigUp” that has exposed more than 70,000 private files belonging to its US energy sector clients. The exposed database was an Amazon S3 bucket, labeled as “ru” was a ‘file dump’ used by RigUp to store various kinds of files belonging to its clients, contractors, job seekers, and candidates for employment. The human resource files being leaked included employee and candidate resumes, personal photos, including some private family photos, paperwork, and IDs related to insurance policies and professional IDs, profile photos, including US military personnel, scans of professional certificates in different fields. These files contained considerable PII data for the people affected, including full contact details: names, address, phone numbers, home addresses, social security information, dates of birth, Insurance policy and tax numbers, personal photos and further information on education, professional experience, personal lives.

See the full report here: https://www.securitymagazine.com/articles/92098-data-breach-report-rigup-exposes-more-than-70000-private-files

Copycat Site Serves Up Raccoon Stealer

Security researchers from Malwarebytes have come across a fake copycat Malwarebytes site that serves Raccoon information stealer malware via Fallout exploit kit (EK) . The attackers have set up malicious domain “malwarebytes-free[.]com” that has extra JavaScript code to check which kind of browser victim is running, and if it happens to be Internet Explorer, the victim is redirected to a malicious URL belonging to the Fallout exploit kit. Upon visiting the URL, the Fallout exploit kit is used to infect vulnerable machines with the Raccoon data-harvesting malware. Raccoon scours systems for credit card information, cryptocurrency wallets, passwords, emails, cookies, system information and data from popular browsers (including saved credit-card info, URLs, usernames and passwords), and then sends that data back to its operator.

See the full report here: https://threatpost.com/malwarebytes-copycat-site-raccoon-stealer/154638/

Phishing emails impersonate the White House and VP Mike Pence - BleepingComputer

Phishing scammers have discovered a new way to distribute malware or perform extortion scams. In emails, the threat actors have started impersonating President Trump and Vice President Mike Pence to convince the victims. These emails state they are the latest "Coronavirus Guidelines for America" or the company is involved in human trafficking, drug dealing, and money laundering and that Pence wants to reach an "agreement" before bringing the issue to President Trump. Users are advised to stay vigilant and not respond to any emails from strangers.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-emails-impersonate-the-white-house-and-vp-mike-pence/

Cloudflare dumps reCAPTCHA as Google intends to charge for its use - ZDNet

Cloudflare, a DNS and reverse-proxy provider has decided to drop the well known Google reCaptcha service and integrate a new anti-bot CAPTCHA system into the Cloudflare products named hCaptcha, provided by California based company Intuition Machines, Inc. Google's plan to charge the reCaptcha service in the future is the reason behind the move taken by Cloudflare.

See the full report here: https://www.zdnet.com/article/cloudflare-dumps-recaptcha-as-google-intends-to-charge-for-its-use/

Over 3.6M users installed iOS fleeceware from Apple's App Store - BleepingComputer

Sophos has identified a set of 32 iOS applications downloaded by users nearly 3,680,000 times. The apps were installed after being advertised through several channels, including social media platforms, YouTube videos, and in-app ads. The users were also tricked into installing using five-star reviews on the apps' App Store entries, supposedly 'planted' by their developers to artificially inflate their overall rating. Many of these apps are being advertised as free apps instead of trials, breaking the App Store Review Guidelines that require developers to accurately describe their apps' functionality and licensing model.

See the full report here: https://www.bleepingcomputer.com/news/security/over-36m-users-installed-ios-fleeceware-from-apple-s-app-store/

San Francisco Intl Airport discloses data breach after hack - BleepingComputer

San Francisco International Airport (SFO) revealed a data breach where two of its websites, SFOConnect[.]com, and SFOConstruction[.]com were hacked. The incident took place in March 2020, wherein the attackers inserted malicious computer code on these websites to steal some users’ login credentials. The users who have accessed these two websites from outside the airport network through Internet Explorer on a Windows-based personal device or a device not maintained by SFO are affected by this incident. Soon after discovering the attack, the SFO has removed the malicious code from its two compromised websites and also urged its users to change their credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/san-francisco-intl-airport-discloses-data-breach-after-hack/

Compromised Zoom Credentials Swapped in Underground Forums

Security researchers have discovered a database containing more than 2,300 compromised Zoom credentials shared on the dark web forum. The exposed database contains usernames and passwords for Zoom accounts, including corporate accounts belonging to banks, consultancy companies, educational facilities, healthcare providers and, software vendors. Some of the accounts included meeting IDs, names, and host keys in addition to credentials. Compromised Zoom credentials could give cybercriminals access to web conference calls, where sensitive files, intellectual property data, and financial information are shared.

See the full report here: https://threatpost.com/compromised-zoom-credentials-underground-forums/154616/

VMWare releases fix for critical vCenter Server vulnerability - BleepingComputer

VMware has fixed a critical vulnerability in the vCenter Server virtual infrastructure management platform that could allow attackers to gain access to sensitive information and potentially take control of affected virtual appliances or Windows systems. The vulnerability has been tracked as CVE-2020-3952 and has received a CVSS3 base score 10. vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected only if it was upgraded from a previous release line such as 6.0 or 6.5 and clean installations of vCenter Server 6.7 are not affected.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-releases-fix-for-critical-vcenter-server-vulnerability/

WooCommerce Falls to Fresh Card-Skimmer Malware

WooCommerce, an open-source e-commerce plugin for WordPress was targeted with JavaScript-based card-skimming malware. Researchers found that the attackers have modified a benign JavaScript file that was intentionally used on the compromised site. The malicious JavaScript file harvests the card details and saves both the payment-card numbers and CVV card security codes in plain text in the form of cookies. It then uses the legitimate file_put_contents function to collect them into two separate image files (a .PNG file and a JPEG).

See the full report here: https://threatpost.com/woocommerce-card-skimmer-malware/154699/

Ransomware scumbags leak Boeing, Lockheed Martin, SpaceX documents after contractor refuses to pay

DoppelPaymer crew has publicly shared stolen confidential data from Visser Precision after they failed to pay the ransom demands. Visser is a manufacturing and design contractor in the US whose clients include aerospace, automotive, and industrial manufacturing outfits. However, the leaked files, in particular, belonged to Tesla, Lockheed Martin, Boeing, and SpaceX. The exposed documents include details of Lockheed-Martin-designed military equipment, such as the specifications for an antenna in an anti-mortar defense system. Other stolen documents include billing and payment forms, supplier information, data analysis reports, legal paperwork, and documents outlining SpaceX's manufacturing partner program.

See the full report here: https://www.theregister.co.uk/2020/04/10/lockheed_martin_spacex_ransomware_leak/

Unique P2P Architecture Gives DDG Botnet ‘Unstoppable’ Status

DDG, a coin-mining botnet, has adopted a proprietary peer-to-peer (P2P) mechanism, turning it into a highly sophisticated threat. The new P2P network acts as a fall-back [failsafe] that even if the C2 is taken down, the infected devices are still going to perform the mining tasks. Researchers have identified nearly 900 active IP nodes in the P2P network, each representing multiple infected devices or bots.

See the full report here: https://threatpost.com/p2p-ddg-botnet-unstoppable/154650/

Maropost database left 95 million customer records unsecure

A database owned by the email delivery and marketing firm Maropost was found open and unsecured, exposing about 95 million customer records. Researchers at CyberNews found the database in early February that contained 19.2 million unique email addresses and marketing logs containing the relevant metadata for emails. These email addresses and metadata could be used in phishing and BEC scams. No PII was included in the database. The data was hosted on a Google Cloud server and was locked down on April 1.

See the full report here: https://www.itsecurityguru.org/2020/04/09/maropost-database-left-95-million-customer-records-unsecure/

Google and Apple Plan to Turn Phones into COVID-19 Contact-Tracking Devices

Google and Apple are collaborating to develop an interoperable contract-tracing tool that will help individuals determine if they have come in contact with someone infected with COVID-19. As part of this new initiative, the companies will be releasing an API that public agencies can integrate into their apps. Later, a built-in system-level platform will be developed to use Bluetooth low energy (BLE) beacons to allow for contact tracing on an opt-in basis. Unlike other tracking apps, the proposed system doesn't involve tracking user locations, instead, it uses BLE beacons to identify if an individual has been around other people who have tested positive COVID-19, thus ensuring that personal privacy is not compromised. The APIs are expected to be available mid-May for Android and iOS.

See the full report here: https://thehackernews.com/2020/04/iphone-android-coronavirus-tracing.html

Messaging app Signal may pull out of U.S. if encryption bill passes

Signal, the popular and trusted encrypted messaging app, may drop off the U.S. markets if the anti-encryption bill is introduced. The EARN IT Act, introduced into the Senate last month, urges companies to follow government-designated “best practices” to prevent the online sexual exploitation of children. Companies are required to align their user policies with the new law and receive a certification that continues to grants them legal protection under Section 230. Anyone who doesn’t comply with these recommendations will lose their Section 230 protection. Signal claims the bill has the potential to undermine end-to-end encryption, as it gives U.S. Attorney the power to dictate how internet companies fight online child exploitation.

See the full report here: https://www.itpro.com/security/encryption/355294/messaging-app-signal-may-pull-out-of-us-if-encryption-bill-passes

Fake Cisco ‘Critical Update’ used in phishing campaign to steal WebEx credentials

The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign that aims to harvest Cisco WebEx credentials using a Cisco security advisory related to a critical vulnerability as a lure. The phishing messages link the legitimate advisory for the CVE-2016-9223 vulnerability and urge users to "join" to learn more about the “update.” On clicking the link, victims are redirected to the phishing landing page, which is a clone of the legitimate Cisco WebEx login page. Hackers then attempt to steal Webex credentials to access web conference calls and steal sensitive files and data shared by participants.

See the full report here: https://securityaffairs.co/wordpress/101355/cyber-crime/phishing-webex-credentials.html

Google removes Android VPN with ‘critical vulnerability’ from Play Store

VPNpro, a company that reviews and advises on VPN products, has identified a critical vulnerability in an Android VPN program, SuperVPN. It is a free VPN Android app that lets users create encrypted connections to online servers that then serve as their gateway to the Internet. The application has more than 100 million installs on the Play store. The vulnerability in the product could allow hackers to intercept communications between the user and the provider, and can even redirect to the malicious VPN server. After multiple warnings and reports, Google removed the SuperVPN application from Play Store. The android users are advised to uninstall both Pro & Free versions of the SuperVPN app.

See the full report here: https://nakedsecurity.sophos.com/2020/04/09/google-removes-android-vpn-with-critical-vulnerability-from-play-store/

Dutch police take down 15 DDoS services in a week

In a press release, Dutch police confirmed to have seized around 15 DDoS-for-hire services in only a single week. The operation was part of an extensive crackdown against DDoS service providers in which the Dutch Police was supported by the Europol, Interpol, the FBI, web hosting services, and domain registrars. The names of the services taken down last week haven’t been revealed by the authorities. Dutch police have arrested the primary suspect, 19-year old teen, in the DDoS attacks against two of the country’s main information access and document portals for citizens on March 19, 2020. This is the second time in the past six months that Dutch police intervened against DDoS-for-hire services.

See the full report here: https://www.zdnet.com/article/dutch-police-take-down-15-ddos-services-in-a-week/

Google and Apple Plan to Turn Phones into COVID-19 Contact-Tracking Devices

See the full report here: https://thehackernews.com/2020/04/iphone-android-coronavirus-tracing.html

Windows Defender incorrectly flagged Winaero Tweaker as HackTool - BleepingComputer

Users have reported that the popular third-party Windows tweaking app called 'Winaero Tweaker' has been flagged as 'potentially unwanted software' or 'Hacktool' in Windows Defender. Windows Defender ATP is built-in antivirus software on Windows 10 and uses machine learning tools to find and block suspicious files on your system. The app allows you to customize Windows, is being removed by Windows Defender who is detecting the executable as "HackTool: Win32/WinTweak" or "!#UACTrigger.A. The developer of Winaero Tweaker explained that the app is not a 'potentially unwanted software' as it only allows users to customize Windows experience, turn off Windows Update, disable Windows Defender and telemetry. Microsoft has addressed the false positive detection and fixed it in Windows Defender version 1.313.1221.0.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-defender-incorrectly-flagged-winaero-tweaker-as-hacktool/

Over $250k in cryptocurrency stolen from Bisq Bitcoin exchange users

The decentralized exchange (DEX) Bisq stopped trading activities late Tuesday night after it uncovered a critical security vulnerability that was exploited by a hacker to steal more than $250,000 worth of cryptocurrency from users. The malicious actor poses as a seller and start trading with potential buyers and wait for the time limit to end. Since the destination gets changed, funds, instead of coming back to the legitimate owner, will go to the hacker address with the buyer's payment and security deposit. The issue was caused by a recent update to the network that gave the opportunity to criminals to manipulate the outwait time and fallback addresses to control funds. Although Bisq resolved the issue and resumed trading, some users continue to report the failure of trades and the disappearance of funds.

See the full report here: https://www.2-spyware.com/over-250k-in-cryptocurrency-stolen-from-bisq-bitcoin-exchange-users

Hacker Hit Italy-Owned Bank's Emails, Data Breach Unknown - pymnts.com

Italian state-owned bank Monte Dei Paschi has suffered a security breach on March 30, 2020. According to Reuters, customers were notified about a hacking attempt where hackers gained access to the mailboxes of some employees and sent emails with voice mail attachments to clients. Currently, it is unclear if attackers have stolen company and customer data. The bank is yet to confirm the incident.

See the full report here: https://www.pymnts.com/news/security-and-risk/2020/hacker-hit-italy-owned-banks-emails-data-breach-unknown/

New Wiper Malware impersonates two respected security researchers

A malware distributor is playing a nasty prank by locking victim's computers before they can start Windows and then blaming the infection on two well-known security researchers, Vitali Kremez and MalwareHunterTeam. When a user downloads and installs the software from untrusted sources, the system may get infected with "MBRLockers" which prevents the operating system from booting and displays a ransom note or a message. The message points to Vitali Kremez and MalwareHunterTeam making them responsible for the infection and the user should tweet on their twitter handles to get the recovery code. Another infection variant, identified as "SentinelOne Labs Ransomware" is being distributed and targets only Vitali Kremez and discloses his email addresses and phone numbers. Furthermore, the user is forced to buy SentinelOne antivirus to get unlock code. These pranks are being actively being used to tarnish the image of well-known security researchers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-wiper-malware-impersonates-two-respected-security-researchers/

1.1 Million Customers Records of SCUF Gaming Exposed Online

A customer database of more than 1.1 million records was exposed online by 'SCUF Gaming', a subsidiary of Corsair – maker of high-end gamepads and video game peripherals. The incident led to the exposure of clients' names, payment info, contact info, repair tickets, order histories, and other sensitive information. The company's staff data and internal API keys were also compromised. Researchers discovered that the data was accessible on the web without a password or any other authentication. The data was exposed for about two days before it was discovered and reported. Meanwhile, bot crawlers got enough time to locate the exposed database and a ransom note was found demanding 0.3 BTC from the company. SCUF clients and staff face the risk of phishing attacks, identity theft, and fraud by the cybercriminals. They are advised to stay vigilant for any suspicious activity.

See the full report here: https://www.ehackingnews.com/2020/04/11-million-customers-records-of-scuf.html

Overlay Malware Leverages Chrome Browser, Targets Banks and Heads to Spain

Security researchers have uncovered a malicious campaign that leverages a fake Chrome browser plugin to target the accounts of banking customers in Spain. The malware is spread via coronavirus-themed videos to trick users into downloading Grandoreiro banking malware, a type of remote overlay banking trojan. After successful download, Grandoreiro establishes a connection with its command-and-control (C2) server, allowing the malware to send notifications about machine information and facilitate remote access capabilities to the attacker when a victim accesses a banking site.

See the full report here: https://threatpost.com/overlay-malware-exploits-chrome-browser-targets-banks-and-heads-to-spain/154713/

Account details for 4 million Quidd users shared on hacking forum - ZDNet

Quidd, an online marketplace for trading stickers, cards, toys, and other collectibles, suffered a data breach in 2019, and the details of around four million users are now being shared for free on underground hacking forums. The exposed data contains customers' usernames, email addresses, and hashed account passwords secured with the bcrypt hashing algorithm. Last month, a data trader posted a copy of the Quidd data on a publicly accessible hacker forum. However, Quidd has not disclosed any recent security incident. Quidd users are advised to change their account passwords as soon as possible.

See the full report here: https://www.zdnet.com/article/account-details-for-4-million-quidd-users-shared-on-hacking-forum/

Microsoft Outlook outage affecting Australians since Saturday - BleepingComputer

Microsoft's Outlook.com webmail service is experiencing a three-day-long outage since the weekend, preventing its Australian users from accessing their accounts or signing in. Users have reported multiple login failures via various protocols within the Australia region. Microsoft has analyzed the issue and confirmed it is being caused by a third party ISP networking. The analysts are trying to contact the third-party ISP to troubleshoot the issue and find alternative solutions for the affected users.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-outage-affecting-australians-since-saturday/

Dell releases new tool to detect BIOS attacks

Dell has released a new security tool that detects attacks attempting to modify a computer's BIOS component. Named as Dell SafeBIOS Events & Indicators of Attack, the tool detects any changes to Dell computer's BIOS configuration and raises an alert in companies' management consoles. Its purpose is to provide system administrators the ability to isolate workstations that may have been compromised, to be set aside for remediation. It does not replace the capabilities of an endpoint security system, instead provides additional protection against BIOS attacks. The tool will be available for free to all Dell Enterprise customers and can also be downloaded as part of the Dell Trusted Device solution.

See the full report here: https://www.zdnet.com/article/dell-releases-new-tool-to-detect-bios-attacks/

Attackers Hacked the Digital Pass System of Moscow residents

Around last week, special digital passes were introduced in Moscow to facilitate the quarantined residents' personal and public transport. The residents would receive a QR code on the City Hall website for each exit from their homes. The program for generating these QR codes had not yet left the beta test but has already been hacked and generated universal promotional codes, allowing the residents to go around Moscow, unlimited. A bot appeared in Telegram that offers citizens to get a digital pass through the messenger. It asks for the phone number and personal data of the citizens, including passport information. Also, hackers offer to issue a pass on social networks. Moscow's residents are warned about scammers who offer to issue digital passes for moving around the city on social networks.

See the full report here: https://www.ehackingnews.com/2020/04/attackers-hacked-digital-pass-system-of.html

Zoom will be rolling out new call controls for paid customers

Beginning April 18, every paid Zoom customer will be able to select the countries through which their virtual meetings are routed. Zoom announced this after a report from the University of Toronto’s Citizen Lab revealed that Zoom calls were being routed through data centers in China, even though none of the users in the meeting were based in the country. Zoom currently groups its data centers in Australia, Canada, China, Europe, India, Japan/Hong Kong, Latin America, and the US regions. Users on the company’s free tier will not be able to change their default region. Zoom has assured that data belonging to non-China users won't be routed through China.

See the full report here: https://www.neowin.net/news/zoom-will-be-rolling-out-new-call-controls-for-paid-customers/

Microsoft opens AccountGuard to healthcare providers on the COVID-19 front lines

After multiple reports of cyberattacks on hospitals and clinics during the ongoing COVID-19 pandemic, Microsoft is offering its AccountGuard, an anti-phishing protection service, for free to healthcare organizations working on the front lines of the coronavirus outbreak. The AccountGuard program provides extra protection and attention to its customers, including additional security features for their email accounts to detect spear-phishing emails that originate from the infrastructure of known hacker groups, and especially nation-state actors.

See the full report here: https://www.zdnet.com/article/microsoft-opens-accountguard-to-healthcare-providers-on-the-covid-19-front-lines/

TA505 Crime Gang Deploys SDBbot for Corporate Network Takeover

TA505 cybercrime group deploys the SDBbot remote-access trojan (RAT), offering tenacious access, data exfiltration, and lateral network movement. SDBbot performs typical RAT functions, such as communicating with command-and-control servers (C2s), receiving commands and obtaining system information, allowing the attackers to drop and execute additional malicious payloads, control infected systems and perform authorized user actions. According to the researchers, SDBbot consists of an installer, a loader and the payload itself. The SDBbot RAT installer is x64-packed and decrypt parts of SDBbot’s code and strings upon execution, the SDBbot RAT loader meanwhile decompresses and executes the SDBbot payload, and the SDBbot RAT payload itself, it retrieved a C2 address from a hard-coded file or a default server.

See the full report here: https://threatpost.com/ta505-crime-gang-sdbbot-corporate-network-takeover/154779/

RagnarLocker ransomware hits EDP energy giant, asks for €10M - BleepingComputer

Portuguese multinational energy giant, Energias de Portugal (EDP) was hit by the Ragnar Locker ransomware, allowing the attackers to encrypt its systems. The attackers claim to have stolen over 10 TB of sensitive company files, including confidential information on billing, contracts, transactions, clients, and partners. The attackers threaten the company to leak all the stolen data if they fail to pay a ransom of an enormous 1580 BTC ($10.9M or €9.9M).

See the full report here: https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/

TikTok Flaw Allows Threat Actors to Plant Forged Videos in User Feeds

Security researchers have created a proof-of-concept (PoC) hack using a technique called a man-in-the-middle (MiTM) to demonstrate a security weakness in TikTok, a popular video-sharing app. The vulnerability could allow local attackers to hijack any video content streamed to a user’s TikTok feed and swap it out with hacker-generated content. The flaw is that the TikTok app uses insecure HTTP for video content to improve the speed with which it can transfer data. This vulnerability can be exploited to make the popular video-sharing app the latest platform for threat actors to engage in spreading misinformation, especially during the COVID-19 pandemic.

See the full report here: https://threatpost.com/tiktok-flaw-allows-threat-actors-to-plant-forged-videos-in-user-feeds/154760/

Adobe Fixes ‘Important’ Flaws in ColdFusion, After Effects and Digital Editions

Adobe has fixed important-severity vulnerabilities in its ColdFusion, After Effects and Digital Editions applications. Adobe ColdFusion flaws included an insufficient input validation flaw (CVE-2020-3767) that could enable an application-level denial of service (DoS), a DLL search-order hijacking glitch (CVE-2020-3768) that could enable privilege escalation and improper access control (CVE-2020-3796) which could lead to system file structure disclosure. Adobe After Effects and Digital Editions included vulnerabilities (CVE-2020-3809 and CVE-2020-3798) that could allow remote attackers to disclose sensitive information. Users are advised to update to the latest fixed versions to prevent future risks.

See the full report here: https://threatpost.com/adobe-fixes-important-flaws-in-coldfusion-after-effects-and-digital-editions/154780/

ZeroFOX Announces Advanced Security for Zoom and Slack

Remote work and business collaboration platforms like Zoom and Slack are rapidly expanding the publicly accessible attack surface of every organization. The ZeroFOX Alpha Team uncovered thousands of cracked Zoom accounts for sale on a single hacking forum and entire websites dedicated to sharing insecure Zoom call IDs. Although Zoom has recently released updates focused on security and privacy, attackers are still able to easily target organizations and their employees through a variety of attacks that abuse the platform. Organizations using these digital platforms require visibility and protection to identify risks like sensitive information leakage, malicious links and file sharing, and compliance violations. The ZeroFOX Enterprise Remote Workforce Protection solution offers advanced threat protection for both Zoom and Slack. To help organizations immediately address these issues, ZeroFOX is offering complimentary,15-day trial, Zoom and Slack protection during this unprecedented time.

See the full report here: https://www.businesswire.com/news/home/20200415005077/en/ZeroFOX-Announces-Advanced-Security-Zoom-Slack

Taxpayers Targeted With Improved NetWire RAT Variant

Security researchers have uncovered a malspam campaign that uses a new variant of NetWire RAT to target taxpayers. The malicious email purports to contain an important Internal Revenue Service (IRS) letter and comes with an OLE (Object Linking and Embedding) format Excel file attachment, named “1040 W2 IRS letter.xls.” When the victim clicks on the attachment, a Microsoft Excel sheet opens and asks the victim to click on the “Enable Content” button which instead enables the malicious Excel 4.0 Macro and executes it. Following this, a program “powershell.exe” is executed, which then triggers the download of an MSI file that further downloads the EXE file. This EXE file acts as a malware loader to install the payload of a new NetWire variant. The NetWire payload implements the keylogger and sends the command and control (C2) server various data on the victim’s login user, the computer name, as well as screenshots of the victim’s screen.

See the full report here: https://threatpost.com/taxpayers-targeted-with-improved-netwire-rat-variant/154830/

Wappalyzer discloses security breach after hacker starts emailing users

Wappalyzer disclosed a data breach after a hacker began emailing its customers and offering to sell Wappalyzer's database for $2,000. The breach took place on January 20 when an intruder accessed one of its misconfigured databases that were exposed online. The company claims that the exposed database mostly contained outdated information and technographic data. However, emails for up to 16,000 Wappalyzer customers were also taken during the incident. Sensitive information such as passwords and card details were not compromised in the incident. The company has notified the affected customers and urges them to refrain from replying or clicking on any links sent via hacker email as it's likely a scam.

See the full report here: https://www.zdnet.com/article/wappalyzer-discloses-security-breach-after-hacker-starts-emailing-users/

49 New Google Chrome Extensions Caught Hijacking Cryptocurrency Wallets

Google has removed 49 Chrome browser extensions from its Web Store disguised as cryptocurrency wallets but contained malicious code to steal sensitive information and digital currencies. The malicious extensions phish for secrets, mnemonic phrases, private keys, and keystore files. Once the user enters the data, the extension sends an HTTP POST request to its backend, where the bad actors receive the secrets and empty the accounts. Cryptocurrency wallet brands that were impacted included Ledger, Trezor, Jaxx, Electrum, MyEtherWallet, MetaMask, Exodus, and KeepKe, via 14 unique command-and-control (C2) servers that received the phished data.

See the full report here: https://thehackernews.com/2020/04/chrome-cryptocurrency-extensions.html

Slack Incoming Webhooks Can Be Weaponized in Phishing Attacks

Security researchers have discovered a flaw in the collaboration platform, Slack, that could allow phishing attacks against users. The flaw resides in the way Slack's Incoming Webhooks, a feature designed to give people an easy way to share messages from external applications in the platform, could be leveraged to launch phishing attacks. According to the researcher, attackers could override the webhook target channel by adding the "channel" key to their JSON payload. If they gain access to a webhook for one channel, they can use the same webhook in others. This may prompt them to send a webhook to Slack channels, likely to have a larger group of people in it, overriding the channel's posting permissions.

See the full report here: https://www.darkreading.com/cloud/slack-incoming-webhooks-can-be-weaponized-in-phishing-attacks/d/d-id/1337573

Think before filling in that convenient flight refund form with all your delicious details – there's a scam going about

Mimecast warns of an ongoing flight refund scam that is leveraging on current fears that airlines are reluctant to give refunds to customers who cannot fly because of the global coronavirus shutdown. The scam begins by offering a fake flight refund form via emails, where the targets are encouraged to enter their names and credit card details. The personal and financial data such as phone numbers, email addresses, credit card payment card details entered by the victims are sent directly to cybercriminals.

See the full report here: https://www.theregister.co.uk/2020/04/15/flight_refund_email_scam/

Using Cisco IP phones? Fix these critical vulnerabilities

Security flaws in Cisco IP Phones could allow unauthenticated remote attackers to trigger a stack-based buffer overflow. The vulnerabilities tracked as CVE-2020-3161 and CVE-2016-1421 can be exploited by sending a crafted HTTP request, which could ultimately lead to a DoS condition, or may allow the attacker to execute code with root privileges. Admins are advised to upgrade the firmware for vulnerable IP phones used in their organization.

See the full report here: https://www.helpnetsecurity.com/2020/04/16/cisco-ip-phones-vulnerabilities/