Threat Intelligence Bulletin: 04/17/2020 - 04/23/2020

Breach Disclosure: Aptoide

Independent Android app store Aptoide experienced a breach last week and had 20 million user accounts exposed in the breach. Breached data included emails, IP addresses, names, and SHA1 password hashes. On April 18th, 2020, Aptoide acknowledged the breach in a blog post with information about the breach and what was contained in the breached data.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Aptoide is one of the largest third-party Android app stores, with a claimed global userbase of 150 million users, and a million apps. The hacker responsible for this breach claimed to have stolen the details for 39 million of those 150 million, and has only released 20 million so far.

Aptoide initially claimed that the only data available in the breach was passwords and login email addresses, however, the PostgreSQL export file obtained by the hacker, consisted of user's real names, device details, and if provided, date of birth.

Based on this breach, Aptoide has stopped all new account registrations and reset user's passwords while they conduct a forensic investigation into how this breach happened and what data was actually compromised.

This breach has already ended up on popular data breach hosting sites like the one below. This specific breach is offered free for all users of the breach dump site.

Figure 1. Forum posting advertising Aptoide data breach

ReOpen States Anti-Quarantine Campaigns Wrought with Red Flags and Astroturfing

As the coronavirus quarantine wears on, cabin fever has set in for many Americans. As people grow tired of staying at home and the impact of the economic shutdown continues to escalate, frustrations have mounted to the point that rallies are now taking place across the country to protest shutdowns. ZeroFOX Alpha Team has analyzed hundreds of Facebook groups being used to organize anti-shutdown rallies and protests all over the United States. This analysis has demonstrated similarities between the activity in these groups, with the coordinated activity of the 2016 presidential election. Additionally, ZeroFOX has identified multiple instances of legitimate non-profit organizations being hijacked to support this coordinated activity. Lastly, we compare these group’s tactics, techniques & procedures (TTPs) to some of the tactics used by the Internet Research Agency (IRA) during the 2016 US Presidential election.

Recommendations

• Continue monitoring the Alpha Team Tab for updates on coordinated campaigns such as the ones detailed in this report. Reach out to [email protected] for assistance, if needed
• For more information on social media influence campaigns, and what platforms are doing to prevent them, see here.

Details

In 2018, the Mueller report revealed the extent of Russian interference in the 2016 U.S. presidential election. Much of this interference manifests itself as coordinated campaigns conducted on various social media platforms by an agency known as the Internet Research Agency (IRA). The IRA created a variety of social media groups, political ads and posts focused on spreading highly polarizing content. Additionally, the IRA created a number of fake social media accounts used to share content originating from these groups. Ultimately, the content amplified by the IRA sought to promote the election campaigns of both Donald Trump and Bernie Sanders, in an effort to prevent Hillary Clinton from being elected. To support this agenda, the IRA also purchased ad space on Facebook to influence opinions and sow discord of US citizens.

Figure 1. Ad purchased by IRA promoting Trump and political division (source: NYTimes)

Figure 2. Sponsored Anti-Trump Ad by IRA (source: NYTimes)

The lessons learned from the influence operations of the 2016 Election have helped the networks combat blatant abuse, misinformation and astroturfing. But when they are not so blatant is when these companies have to take a case-by-case analysis of the potential abuse. One such potential abuse going on in the current COVID-19 climate is the enabling of “anti-quarantine” and “re-open” groups and rallies being organized.

On April 15, 2020, ZeroFOX Alpha Team observed a sudden rash of Facebook groups created to promote anti-quarantine rallies and protests. These groups follow naming conventions like “Marylanders Against Excessive Quarantine,” and “Reopen Michigan.” The most active of these, “Pennsylvanians Against Excessive Quarantine”, is currently listed as gaining 840 new posts each day. The groups are primarily used for posting articles related to reopening state businesses and for organizing protest activity to support the cause. In total, ZeroFOX identified 177 anti-lockdown groups, and 61 future protest events as of April 20, 2020.

Figure 3. A selection of “Operation Gridlock” anti-quarantine Facebook events

Although Facebook announced Monday, April 20, 2020, that the platform would take action against these events, Facebook’s content moderation depends on employees who have been affected by COVID-19, as the platform itself states upon entering the page reporting process.

The curious nature of these groups, though, is that they were seemingly created all around the same timeframe and by the same people, yet, are labeled and organized as a grassroots movement. The creation of many of these groups can be traced back to the same individuals, as reported by the Washington Post.

As discussed in this article, many of these groups are operated by the Dorr brothers and have similar group descriptions.

Figure 4. Group Description for Pennsylvanians Against Excessive Quarantine

Figure 5. Group Description for Ohioans Against Excessive Quarantine

Both URLs listed in Figures 4 & 5 link to petition websites for their respective states, with very similar appearances.

Figure 6. ReopenPA[.]com home page

Figure 7. Reopenohio[.]com home page

Both of these sites reference gun rights groups in the top left corners. A further look into the “Pennsylvania Firearms Association” suggests it may not be the legitimate non-profit it claims to be. A quick Google search for the group name reveals that there is another similarly named group, the “Pennsylvania Firearm Owners Association,” which has been registered as a non-profit since 2007. The latter group has made posts on their forum discussing the group run by the ReopenPA founders.

Figure 8. PFOA Member discussing Pennsylvania Firearms Association

The forum posts says

If one looks at their affiliates page ('https://www.pennsylvaniafirearmsassociation.org/affiliated-groups/') it appears like 3/4 of their so called affiliates were put together by the same person or group. This really looks like a get rich quick by riding the coattails of public sentiment and PAFOA.

The affiliates page of the suspect Pennsylvania Firearms Association includes many other groups of dubious nature. The Dorr brothers are behind many of these, as linked in non-profit registration records, including the Iowa Gun Owners group which has been publicly called out by Iowa lawmakers as being a scam. Similarly, the Dorr-controlled Minnesota Gun Rights group had its nonprofit status revoked in 2016 for failing to file required forms that account for the group’s financials. Very few Dorr non-profits report their financial records as required for non-profit organizations. Additionally, many of the Reopen domains for states mentioned in Dorr-controlled gun groups either redirect to sites hosted on the gun group website itself, or link to the gun group on the homepage.

Figure 9. Affiliate Groups Listed on Pennsylvania Firearms Association Website

Alpha Team did not find any ads purchased by these Reopen groups. This could mean that the Facebook political ad prevention mechanism is working, or that the groups did not purchase any ads.

Conclusion

Many of the tactics used in these Reopen campaigns have some similarities to the IRA’s tactics. First, there is a coordinated campaign that masquerades as a grassroots movement. This was one of the more effective strategies that the IRA employed against US Citizens during the 2016 Presidential election. Secondly, these grassroots movements tend to be divisive and polarizing, further creating a rift between US Citizens and increasing tension, which can lead to dehumanization of the two sides. This was also apparent during the 2016 election, where bouts of violence happened at rallies, which arguably were fueled by some of these polarizing groups. Although freedom of speech is touted by most of these public platforms, the use of social media platforms in coordinated influence campaigns is a matter separate from the issue of free speech. These influence campaigns can be leveraged by opportunists, looking to cash in on donations to a falsified cause, or as in the case of the Russian IRA, to influence entire elections. With the 2020 presidential election quickly approaching, it has become crucial to proactively identify efforts to sway public opinion to fit the agenda of influence groups, rather than doing so after the fact, as was the case in the 2016 election.

Breach Disclosure: Vianet

Personal details, including names, locations, emails, phone numbers and addresses of around 170,000 Vianet customers have been leaked online stemming from a breach this month. The breach was first disclosed by hackers this past Tuesday for one of Nepal's leading ISP's. It is unclear what the source of the breach was, and Vianet officials have not disclosed how this breach happened, only that they have identified and found the source of the breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

On April 21, 2020, hackers disclosed the breach on Twitter. Another hacker who had compromised the food delivery platform Foodmandu had posted praise and links to the hacker's twitter account claiming they had dumped 160,000 records from Vianet, and claimed that the dump appeared legitimate.

Figure 1. Hacker responsible for Foodmandu breach praising Vianet hacker

The hacker posted a link to an .onion site containing the breach data, with the original tweet and account being suspended due to violating Twitter's Terms of Service.

Breaking News: 2020-04-17 - 2020-04-23

Gmail blocked 18M COVID-19-themed phishing emails in a week - BleepingComputer

Google claims that the malware scanners built within the Gmail free email service have blocked around 18 million phishing and malware emails using COVID-19 lures during last week. The company stated that proactive monitoring is in place for COVID-19-related malware and phishing. As and when it identifies a threat, it will be added to the Safe Browsing API, which protects users in Chrome, Gmail, and all other integrated products by showing warnings to users when they attempt to navigate to dangerous sites or download dangerous files.

See the full report here: https://www.bleepingcomputer.com/news/security/gmail-blocked-18m-covid-19-themed-phishing-emails-in-a-week/

Hackers steal WiFi passwords using upgraded Agent Tesla malware - BleepingComputer

Security researchers have uncovered a new variant of Agent Tesla info-stealer malware that comes with a dedicated module for stealing the Wi-Fi passwords from the compromised computers. The malware issues a "netsh" command with a “wlan show profile” argument for listing all available Wi-Fi profiles. To fetch the Wi-Fi passwords, it issues a new "netsh" command adding the Wi-Fi network name and a "key=clear" argument to show and extract the password in plain text for each profile. Additionally, it collects information about the compromised system including FTP clients, browsers, file downloaders, machine info (username, computer name, OS name, CPU architecture, RAM), which could be used in future attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/

ICEBUCKET group mimicked smart TVs to steal ad money

White Ops has uncovered an extensive online fraud operation that has been mimicking smart TVs to trick online advertisers and gain free profits from online ads. The operation has been named ICEBUCKET and is described as "the largest case of SSAI spoofing" to date. According to the researchers, the ICEBUCKET group exploited weaknesses in the SSAI server communications mechanism to connect to SSAI servers and request ads to show on non-existing devices. The group spoofed more than 1,000 different device types (user-agents) using more than 2 million IP addresses located across more than 30 countries with its primary targets being CTV (Connected TV) devices, such as Roku streaming units, Samsung Tizen smart TVs, the now-defunct GoogleTV, and Android-based streaming devices.

See the full report here: https://www.zdnet.com/article/icebucket-group-mimicked-smart-tvs-to-steal-ad-money/

Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository - Internet

More than 700 malicious packages written in Ruby programming language, designed to steal funds by redirecting cryptocurrency transactions to a wallet address under the attacker's control, were caught distributing through the RubyGems repository. This supply chain attack particularly targets Ruby developers with Windows systems making Bitcoin transactions. The malicious campaign leveraged the typosquatting technique where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead.

See the full report here: https://thehackernews.com/2020/04/rubygem-typosquatting-malware.html

New PoetRAT Hits Energy Sector With Data-Stealing Tools

A new remote access trojan (RAT) called "PoetRAT" has been discovered that is actively targeting the energy sector, with a slew of post-exploitation tools to log keystrokes, record footage from webcams and steal browser credentials. Researchers have discovered three separate documents that are distributing the malware. The first document revealed blurred pictures with no text. The other two documents used lures related to the ongoing coronavirus pandemic. For all of these documents, once the macros are enabled, a Visual Basic script dropper is executed. The script loads its document into memory, which is a ZIP file (“smile.zip”) that contains a Python interpreter, as well as a Python script that is the RAT.

See the full report here: https://threatpost.com/new-poetrat-hits-energy-sector-with-data-stealing-tools/154876/

Fake Valorant beta key generators are stealing gamers' passwords - BleepingComputer

The hype around Riot Games' Valorant is being misused by the hackers to distribute malware samples to users who are trying to play the game or get beta keys. The fake key generators being distributed for Valorant are installing information-stealing trojans such as QuasarRAT and njRAT. Once installed, these types of malware will attempt to steal passwords stored in Chrome, Firefox, Yandex Browser, Opera, WinSCP, and FileZilla. Most also include some keylogger functionality and the ability to execute commands on the infected machine.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-valorant-beta-key-generators-are-stealing-gamers-passwords/

GitHub accounts stolen in ongoing phishing attacks - BleepingComputer

Security researchers have uncovered an ongoing phishing campaign targeting active GitHub users by tricking them into visiting a malicious link embedded in the phishing emails. Upon clicking the link, the victims will be redirected to a fake GitHub login page that collects their credentials and sends them to attacker-controlled servers. The phishing landing page can also exfiltrate the victims' 2FA codes in real-time if they're using a time-based one-time password (TOTP) mobile app. However, accounts protected by hardware security keys are not vulnerable to this attack.

See the full report here: https://www.bleepingcomputer.com/news/security/github-accounts-stolen-in-ongoing-phishing-attacks/

Details of 20 million Aptoide app store users leaked on hacking forum

A data breach monitoring service called “Under the breach” has uncovered a data leak that has exposed the details of around 20 million users of Aptoide, a third-party app store for Android application. Users who had registered with Aptoide or used the app between July 21, 2016, and January 28, 2018, are believed to be affected by this breach. The leaked data includes users' email addresses, hashed passwords, real names, sign-up dates, sign-up IP addresses, device details, and dates of birth (if provided). Other technical information such as account status, sign-up tokens, developer tokens if the account was a super admin or referral origin were also included.

See the full report here: https://www.zdnet.com/article/details-of-20-million-aptoide-app-store-users-leaked-on-hacking-forum/

Zoom Bombing Attack Hits U.S. Government Meeting

The Committee on Oversight and Reform called for government officials to immediately suspend any current or future use of Zoom systems for official committee activities after they fell victim for a Zoom bombing attack. The meeting was supposedly disrupted at least three different times by uninvited attendees. Immediate steps are to be evaluated by the Committee’s internal cybersecurity to prevent hackers from accessing sensitive committee information through the Zoom platform.

See the full report here: https://threatpost.com/zoom-bombing-attack-hits-u-s-government-meeting/154903/

Hackers Update Age-Old Excel 4.0 Macro Attack

Researchers have identified a new malspam campaign that sends Excel 4.0 xls 97-2003 files with a compromised macro in email messages, attempting to dupe users with themes ranging from fake invoices to COVID-19 related lures. In past campaigns, this type of attack uses a password-protected Excel 4.0 document. Similar to the previous attack mechanism, the updated technique maintains the encrypted Excel document and also requires user interaction. The difference is, when a victim opens the password-protected document, hackers have devised a way that opens the encrypted and password-protected document without requiring the physical input of a password, readily exposing targets to potential malware infections.

See the full report here: https://threatpost.com/hackers-update-age-old-excel-4-0-macro-attack/154898/

CISA Warns Patched Pulse Secure VPNs Could Still Expose Organizations to Hackers

Pulse Secure VPN servers contained a remote code execution vulnerability (CVE-2019-11510) that could allow threat actors to steal victim organization's credentials and move laterally through the victim's network. Though the organization has patched this vulnerability and has not changed the stolen credentials, threat actors can still be able to access, and move laterally through, the organization's network. Hence, The United States Cybersecurity and Infrastructure Security Agency (CISA) urges organizations to change all their Active Directory credentials as a defense against cyberattacks trying to leverage a known remote code execution (RCE) vulnerability in Pulse Secure VPN servers, even if they have already patched it.

See the full report here: https://thehackernews.com/2020/04/pulse-secure-vpn-vulnerability.html

Facebook will now warn you if you’ve interacted with fake, dangerous coronavirus posts

To tackle the spread of COVID-19 misinformation, Facebook has announced new measures that will notify the users if they have liked, reacted to, or commented on debunked coronavirus-related content. If a user has previously interacted with content that has been proven incorrect by the World Health Organization (WHO) and removed, Facebook will then forward a message containing a shareable link to the WHO's page concerning the COVID-19 rumor mill and fact-checking resources. With the new feature, Facebook aims at connecting people who may have interacted with harmful misinformation about the virus with the truth from authoritative sources.

See the full report here: https://www.zdnet.com/article/facebook-will-now-warn-you-if-youve-interacted-with-fake-dangerous-coronavirus-posts/

Beaumont Health says 112K patients were impacted by data breach - FOX 2 Detroit

Beaumont Health System disclosed a data breach, impacting 112,000 individuals after an unauthorized third-party was able to access employee accounts between May 23, 2019, to June 3, 2019. The breached data contained patient information such as name, date of birth, diagnosis, diagnosis code, procedure, treatment location, treatment type, prescription information, Beaumont patient account number and medical record numbers. A limited number of individuals’ Social Security numbers, financial account information, health insurance information, and driver's license or state identification numbers were also contained in the impacted email accounts. Beaumont Health System has notified the affected people and has taken steps to improve its internal security procedures to prevent future risks.

See the full report here: https://www.fox2detroit.com/news/beaumont-health-says-112k-patients-were-impacted-by-data-breach

Attacks on Linksys Routers Trigger Mass Password Reset - Threatpost

Home Linksys router users were targeted in a cyberattack that changed router settings, and redirected requests for specific webpages and domains to malicious Coronavirus-themed landing pages that were booby-trapped with malware. Linksys Smart Wi-Fi app is a password-protected webpage that allows customers to easily manage their Wi-Fi and router settings. Once compromised, attackers were able to manipulate the device’s domain name system routing function and redirect victims to malicious websites. The websites displayed a message from WHO and prompted users to install an application that offers instructions and information about COVID-19. The application was used as a dropper to install the final Oski infostealer payload on compromised systems. More than 1,200 Linksys Smart Wi-Fi accounts were compromised via credential-stuffing attacks. Linksys has advised all the users to reset their passwords immediately.

See the full report here: https://threatpost.com/attacks-on-linksys-routers-trigger-mass-password-reset/154914/

Hacker leaks 23 million usernames and passwords from Webkinz children's game

An anonymous hacker has leaked usernames and passwords of nearly 23 million players of Webkinz World, the online counterpart of Canadian toy company Ganz. The security breach happened earlier this month. The hacker posted a part of the game's database on a well-known hacking forum. The exposed file, of size 1GB, contained 22,982,319 pairs of usernames and passwords, with the passwords being encrypted with the MD5-Crypt algorithm. The hacker allegedly gained access to the game's database using an SQL injection vulnerability present in one of the website's web forms. Webkinz has detected the intrusion and patched the hacker's point of entry into their systems. Webkinz claims to archive accounts that have been inactive for more than 18 months. Currently, it is still unclear whether the leaked data are archived or active accounts.

See the full report here: https://www.zdnet.com/article/hacker-leaks-23-million-usernames-and-passwords-from-webkinz-childrens-game/

IT services giant Cognizant suffers Maze Ransomware cyber attack - BleepingComputer

Information technologies services giant Cognizant suffered a cyber attack Friday night allegedly by the operators of the Maze Ransomware. The company sent a security breach notification mail to its clients and shared IoCs related to the threat that affected its systems and other technical information of a defensive nature. The IOCs provided by the company are associated with past infections attributed to the Maze Ransomware crew, it included IP addresses of servers and file hashes for the kepstl32.dll, memes.tmp, and maze.dll files. BleepingComputer contacted Maze operators about this attack but they deny being responsible. The company said that they have implemented internal security associated with leading cyber defense firms and taking steps to contain this incident. They also engaged with the law enforcement authorities.

See the full report here: https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/

This Open-Source Program Deepfakes You During Zoom Meetings, in Real Time

A new deepfake tool known as Avatarify can transform users in real-time during video calls on Zoom and Skype. Its developer Ali Aliev used the open-source code from the “First Order Motion Model for Image Animation” to create. The usual face-swapping algorithms such as deepfake need to be trained on the face you want to swap. This tool requires several images of the face you’re trying to animate. Avatarify can face-swap in real-time by training the algorithm on similar categories of the target. Available for Windows, macOS, and Linux, the software requires a powerful graphics card and basic command line knowledge to both install and operate. The code is available on Github for anyone to use.

See the full report here: https://www.vice.com/en_au/article/g5xagy/this-open-source-program-deepfakes-you-during-zoom-meetings-in-real-time

Hackers steal $25 million worth of cryptocurrency from Uniswap and Lendf.me

Hackers have stolen more than $25 million cryptocurrencies from the Uniswap exchange and the Lendf.me platform, over the weekend. Uniswap and Lendf.me are decentralized lending platforms with instant borrowing and withdrawal capabilities. Hackers used a vulnerability with ERC777 tokens and Uniswap/Lendf.Me contracts to perform reentrancy attacks. Reentrancy attacks allow hackers to withdraw funds repeatedly, in a loop, before the original transaction is approved or declined. Both websites have been taken down and blocked all new transactions to prevent further attacks.

See the full report here: https://www.zdnet.com/article/hackers-steal-25-million-worth-of-cryptocurrency-from-uniswap-and-lendf-me/

Windows 10: Manage Reserved Storage from the command line

Microsoft will be rolling out Windows May 2020 update with new features to manage Reserved Storage from the command line. Reserved Storage, introduced with May 2019 update, is a feature that sets aside a portion of the Windows system drive to be used for critical system and driver updates. It addresses storage shortage problems while performing updates by reserving a certain amount of space for apps, updates, and drivers that are needed Windows to function smoothly. This reserved storage, though, starts at a minimum of 7GB and can increase in size as needed for existing Windows 10 computers. For OEMs and new PCs, 32GB of reserved storage will be required. With May 2020 update, Microsoft is introducing new options to tweak Reserved Storage via the DISM command-line tool.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-manage-reserved-storage-from-the-command-line/

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days

The new Mootbot botnet is leveraging a pair of zero-days to target fiber routers. According to NetLab 360 researchers, the flaw is a remote code-execution bug with a public proof-of-concept (PoC) exploit and can successfully compromise fiber routers, combined with a second vulnerability. Moobot is a new botnet family based on Mirai botnet, which targets the internet of things (IoT) devices with zero-day exploits. Most affected vendors are OEM products of the same original vendor. Researchers have not released the original vendor’s name and details of the second vulnerability. Users with fiber-based internet access routers are recommended to update their device firmware and disable default accounts.

See the full report here: https://threatpost.com/mootbot-fiber-routers-zero-days/154962/

Starbleed bug impacts FPGA chips used in data centers, IoT devices, industrial equipment

Researchers have discovered a new security bug that affects Xilinx FPGA (Field Programmable Gate Arrays) chipsets. Named as Starbleed, the bug allows attackers to extract and tamper with an FGPA's bitstream (configuration file) to reprogram the chip with malicious code. FPGAs are small integrated circuit boards designed to run a very specific code that is programmed inside the FPGA by the device owner based on their own needs. Researchers believe that replacing the FPGA altogether is the only fix available, as the encryption and bitstream mechanism is designed to work at a hardware level and would require a silicon chip redesign.

See the full report here: https://www.zdnet.com/article/starbleed-bug-impacts-fpga-chips-used-in-data-centers-iot-devices-industrial-equipment/

UniCredit Staff Data for Sale on Cybercrime Forum After Hack - Bloomberg

Information of nearly 3,000 UniCredit SpA employees was reportedly put up for sale on hacking forums. According to the hacker, the exposed database included UniCredit workers' information such as names, emails, phone numbers, and encrypted passwords. Security researchers say that the database appears to be genuine and the potential result of a SQL injection attack, a malicious code-insertion technique used to attack an application. Currently, UniCredit is investigating the incident.

See the full report here: https://www.bloomberg.com/news/articles/2020-04-20/unicredit-workers-data-for-sale-on-cybercrime-forums-after-hack

Nintendo accounts are getting hacked and used to buy Fortnite currency - ZDNet

Users of online Nintendo accounts have reportedly been receiving email notices that their accounts were being accessed by outside parties. The source of the attack is currently unknown and it is also unclear if hackers are using credential stuffing to gain access to Nintendo accounts. Many users also reported losing money to the hackers who mostly bought other Nintendo games. In several incidents, victims said the hackers bought Fortnite game currency through a card or PayPal account linked to the main Nintendo profile. Nintendo is yet to release a formal statement about the attacks. Earlier this month, the company has recommended users to enable two-step verification (2SV) for their accounts, to prevent intrusions.

See the full report here: https://www.zdnet.com/article/nintendo-accounts-are-getting-hacked-and-used-to-buy-fortnite-currency/

Chinese hackers targeted company behind 'Ragnarok Online' MMORPG

According to QuoIntelligence, hackers have attempted to breach the internal network of Gravity, the South Korean gaming company behind popular Ragnarok Online MMORPG (Massive Multiplayer Online Role-Playing Game). The malware strain is attributed to a Chinese hacker group known as Winnti (aka APT41, BARIUM, Blackfly). Hackers used "the Winnti Dropper," to infect a victim's computer, and then download other malware strains. The group has a history of hacking video games industries, especially the companies operating from South Korea and Taiwan. Gravity is yet to confirm the intrusion.

See the full report here: https://www.zdnet.com/article/chinese-hackers-targeted-company-behind-ragnarok-online-mmorpg/

German government loses 'tens of millions' in COVID-19 phishing attack

The government of North Rhine-Westphalia(NRW) in western Germany has reportedly lost tens of millions of Euros after hackers impersonated its website for distributing emergency coronavirus finding. Personal details provided by the users were leveraged by the hackers to file requests and collect funds on their behalf by replacing the bank account, in the impersonated website, where funds were to be wired. The scheme lasted for nearly a month, from mid-March until 9 April, when the NRW government finally took down the website and suspended payments. However, before the website was taken down, the local police had reportedly received nearly 576 official reports of fraud related to the scam.

See the full report here: https://www.itpro.co.uk/security/phishing/355369/german-government-falls-victim-to-coronavirus-phishing-attack

New iOS exploit discovered being used to spy on China's Uyghur minority

A new iOS exploit was being used in the wild to spy on China's oppressed Uyghur minority between January 2020 and March 2020. The exploit, named Insomnia, was embedded in several Uyghur-themed websites and affects iOS versions 12.3, 12.3.1, and 12.3.2. Once victims visited the corrupted site, the Insomnia exploit was loaded on the device, granting the attacker root access which could be used to steal plaintext messages from various instant messaging clients, emails, photos, contact lists, and GPS location data. Additionally, the exploit was expanded to target emails from the ProtonMail app and images transferred via the Signal app. Further analysis reveals that the Evil Eye, a state-sponsored hacking group, operating from Beijing, was behind these attacks. Updating the unsafe devices to iOS 12.4 release can help users eliminate the vulnerability.

See the full report here: https://www.zdnet.com/article/new-ios-exploit-discovered-being-used-to-spy-on-chinas-uyghur-minority/

Researcher discloses four IBM zero-days after refusal to fix - BleepingComputer

A security researcher has disclosed four zero-day vulnerabilities in IBM Data Risk Manager, a tool designed to help uncover, analyze and visualize data-related business risks. The vulnerabilities include an authentication bypass, a command injection, an insecure default password, and an arbitrary file download. The exploitation of these vulnerabilities might lead to a full-scale company compromise, as it stores credentials to access other security tools. IBM has assessed the flaws and has currently refused to fix them as the impacted product is only used as ‘enhanced’ support.

See the full report here: https://www.bleepingcomputer.com/news/security/researcher-discloses-four-ibm-zero-days-after-refusal-to-fix/

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

A security expert has demonstrated how criminals may be able to compromise users by downloading their Whatsapp accounts to third-party devices. This can make WhatsApp users susceptible to shoulder surfing attacks due to the way the service restores accounts to a new device. By obtaining a victim’s phone number, hackers can download WhatsApp on a clean device and enter this to request an account restoration code be sent via text message. The hackers can obtain the code by spying on the victim’s smartphone and can fully compromise the victim’s WhatsApp account. Researchers recommended WhatsApp users to turn off previews for SMS messages, and, more importantly, never leave their devices unattended. Using WhatsApp's two-factor authentication process can help users guard against the attack.

See the full report here: https://www.itpro.co.uk/security/hacking/355382/whatsapps-flaw-shoulder-surfing

Microsoft releases OOB security updates for Microsoft Office - BleepingComputer

Microsoft has released new security updates to resolve the remote code execution and DoS vulnerabilities in the Autodesk FBX library integrated into Microsoft Office and Paint 3D applications. Remote code execution vulnerabilities exist in Microsoft products that utilize the FBX library when processing specially crafted 3D content. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Office users are advised to install these security updates to mitigate further risks.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-oob-security-updates-for-microsoft-office/

DoppelPaymer Ransomware hits Los Angeles County city, leaks files - BleepingComputer

The City of Torrance, a suburb of Los Angeles, has supposedly suffered a DoppelPaymer Ransomware attack. According to BleepingComputer, the DoppelPaymer operators stated that in an attack on March 1st, they erased the City's local backups and then encrypted approximately 150 servers and 500 workstations and also claim to have stolen approximately 200+ GB of files. The exposed data includes city budget financials, various accounting documents, document scans, and an archive of documents belonging to the City Manager. DoppelPaymer is demanding a ransom of 100 bitcoins or approximately $680,000 for a decryption key.

See the full report here: https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-hits-los-angeles-county-city-leaks-files/

Hackers Target Top Officials at World Health Organization - Bloomberg

Hackers are now targeting the top officials at the World Health Organization, including the Director-General Tedros Adhanom Ghebreyesus, as well as Bruce Aylward, a senior WHO envoy who led a COVID-19 response team in China. The WHO's chief information officer, Bernardo Mariano said that some of the attacks had been perpetrated by suspected nation-state hackers. Many of the attacks have been phishing or spear-phishing attempts to lure WHO staff into clicking on a malicious link in an email, that will download malware onto their computers or mobile phones. Mariano confirmed that the WHO hadn’t been hacked, but that the passwords of some WHO employees had been obtained from other data breaches. Mariano also revealed that the WHO has identified the origins of the attack and the suspected perpetrator with the help of national cybersecurity agencies.

See the full report here: https://www.bloomberg.com/news/articles/2020-04-21/top-officials-at-world-health-organization-targeted-for-hacks

Oil and Gas Firms Targeted With Agent Tesla Spyware

In a recent spear-phishing campaign, hackers are targeting energy companies located in Malaysia, the United States, Iran, South Africa, Oman, Turkey, and the Philippines with the Agent Tesla spyware. The first campaign was spotted on March 31, 2020, where attackers mimicked a known Egyptian engineering contractor, Enppi, claiming to invite victims to submit a bid for equipment and materials as part of the Rosetta Sharing Facilities Project, on behalf of a well-known gas company (Burullus). Another campaign started on 12th April and purported to be from the Glory Shipping Marine, asking the victims to send an Estimated Port Disbursement Account (ERDA) for a shipping vessel, and information about container-flow management. The attachments in both campaigns contained files embedded with the spyware to collect sensitive information and send it to the attacker-controlled C&C server.

See the full report here: https://threatpost.com/oil-and-gas-agent-tesla-spyware/154973/

Are you still watching? Streaming scammers hope so

Phishing sites and stolen account credentials are two major threats to the media and entertainment organizations across digital platforms. The ZeroFOX Alpha Team has identified new scams that target streaming service users into disclosing their account information in exchange for the false promise of a free streaming service membership. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the “offer.” A hacked user’s account can lead to customer dissatisfaction and ultimately a loss in revenue for the streaming service. The ZeroFOX Alpha Team is continuing to monitor the sites actively conducting scams. If you are a user of a streaming service, make sure you are always logging in to the legitimate service.

See the full report here: https://www.zerofox.com/blog/streaming-scams/

Vietnam alleged to have hacked Chinese organisations in charge of COVID-19 response

According to FireEye, APT32, a hacking group previously linked to the Vietnamese government allegedly attempted to access the personal and professional email addresses of staff at China's Ministry of Emergency Management and the government of Wuhan, where it is believed the pandemic started. Between January and April, APT32 sent Chinese officials phishing emails that contained a tracking link claiming to direct the reader to a report on office equipment bids. When clicked, the link would report back to the hackers, indicating that the target was vulnerable to malware.

See the full report here: https://www.theregister.co.uk/2020/04/23/vietnamese_hackers_hit_chinese_organisations/

Fast-Moving DDoS Botnet Exploits Unpatched ZyXel RCE Bug

A new variant of the Hoaxcalls botnet is exploiting an unpatched vulnerability in the Zyxel Cloud CNM SecuManager, a network management appliance designed to provide an integrated console to monitor and manage security gateways. The bug that Hoaxcalls is leveraging can be exploited via API calls that abuse the path “/live/CPEManager/AXCampaignManager/delete_cpes_by_ids?Cpe_ids =” according to the researchers at Radware. When an API call is made, the output is stored in the “Axess” chroot, which the researchers said ultimately makes it possible to open up a “connect-back” shell, providing access to the appliance. Zyxel is yet to address the bug.

See the full report here: https://threatpost.com/fast-moving-ddos-botnet-unpatched-zyxel-rce-bug/155059/

State-backed phishing targets govt employees with fast food lures - BleepingComputer

Google’s Threat Analysis Group (TAG) has identified over a dozen government-backed attacker groups using COVID-19 themes as a lure for phishing and malware attempts. These ongoing phishing attacks employed fast food lures, few messages offered free meals and coupons in response to COVID-19 while others suggested recipients to visit sites disguised as online ordering and delivery options. Once the victim clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials. The domains used in this phishing campaign were blocked by Google's Safe Browsing and most of them were directly delivered into the targeted people's spam folder without reaching the inbox.

See the full report here: https://www.bleepingcomputer.com/news/security/state-backed-phishing-targets-govt-employees-with-fast-food-lures/

Customer complaint phishing pushes network hacking malware - BleepingComputer

Security researchers have uncovered a new phishing campaign that targets a company’s employees with fake customer complaints that install a new backdoor called “bazaloader”. The fake emails pretend to be from the company’s corporate lawyer and state that a customer complaint has received against the employee and provides a google docs link to view the complaint. When a victim clicks on the "Expand and Preview" link, a file named “Prevew.PDF[.]exe” will be downloaded that installs “bazaloader” backdoor. When executed, the malware will inject itself into the legitimate C:\Windows\system32\svchost[.]exe. Further, the backdoor deploys Cobalt Strike on infected networks and thereby gain full access to the victim's computer and use it to compromise the rest of the network to install ransomware or steal data to be used for extortion.

See the full report here: https://www.bleepingcomputer.com/news/security/customer-complaint-phishing-pushes-network-hacking-malware/

Valve reassures gamers after CS:GO and Team Fortress 2 leaks - BleepingComputer

The source code belonging to Valve Corporation’s online games, Team Fortress 2 (TF2) and Counter-Strike: Global Offensive (CS: GO) were leaked online. The company has confirmed the leak and said the source code for both CS: GO and TF2 dated 2017/2018 was made available to source engine licenses that were leaked to the public on April 22nd, 2020. The company urges the gamers to continue playing and assures to keep them informed if a reason to be alarmed arose upon further investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/valve-reassures-gamers-after-cs-go-and-team-fortress-2-leaks/

Google unveils secure remote access service to unburden enterprise VPNs

To help companies cope with a sudden and massive increase in remote workforce, resulting in overburdening the company’s VPN infrastructure, Google has made available BeyondCorp Remote Access. BeyondCorp Remote Access is a cloud-based, zero trust service that allows employees, contractors, and partners to securely access specific corporate resources from untrusted networks without having to use the company’s VPN. The web apps that can be accessed through the service can be hosted on Google Cloud, on other clouds, or the customer’s premises. Google also plans to offer the same capability, control, and additional protections for virtually any application or resource a user needs to access.

See the full report here: https://www.helpnetsecurity.com/2020/04/23/google-remote-access-service/

Apple iPhone at risk of hacking through email app - BBC News

Security researchers have discovered a bug in the Mail app that makes iPhones and iPads susceptible to sophisticated attacks. To exploit this flaw, hackers would send a seemingly blank message to an iPhone or iPad user's Mail account, the email app on iOS devices. Upon opening the email, it would crash the app forcing the user to reboot. During the reboot, hackers would be able to access information on the device, without having to download any malware. Reportedly, an Apple spokesperson said a fix would be included in upcoming software updates.

See the full report here: https://www.bbc.com/news/technology-52391759