Threat Intelligence Bulletin: 04/24/2020 - 04/30/2020

Dark Web Update: OpenBullet Credential Stuffing Configurations Leaks on Cracking Forum

On or around April 20, 2020, Cracked forum user r0x posted in Configs/OpenBullet forum of cracked[.]to a direct download link to 750 OpenBullet configurations. A few days after that, Cracked forum user Arnab leaked 4615 OpenBullet configurations. OpenBullet is an open-source web application testing tool similar to Burp Suite. The users of Cracked modded OpenBullet in order to have private configurations for Cracked users. Although the modded version claims it should not be used for DDoS or credential stuffing, almost all of these configurations are used for credential stuffing against online platforms.

Recommendations

• If you find your organization in one of the leaked configurations, reach out to [email protected] to connect with an analyst to receive the configuration
• Consider building signatures in your firewall, WAF or logging solution to detect when attackers are trying to use these configurations against your applications
• Consider enabling additional dark web coverage to find mentions of your brand on the dark web

Details

OpenBullet is ".. a webtesting suite that allows to perform requests towards a target webapp and offers a lot of tools to work with the results. This software can be used for scraping and parsing data, automated pentesting, unit testing through selenium and much more". This software is an open source alternative to the widely-used web app pentesting framework BurpSuite. Users can download this software and modify web requests and responses as they travel to a web server to test various security vulnerabilities against the target web server.

In August of 2019, Cracked[.]to moderator ForlaxPy released a mod for OpenBullet. The purpose of this mod is to allow the Cracked community to share OpenBullet configurations with each other, as well as for the forum to make money off the mod by selling Authorization keys for the software.

Figure 1: Post by ForlaxPy for the Cracked OpenBullet mod

Although ForlaxPy says it is illegal to use this mod for credential stuffing and DDoS, he goes on to mention how users of Cracked can use this mod for checkers. Checker software is a term used by cybercriminals when identifying ways to check the validity of credentials against a target endpoint. The workflow to use this tool is to acquire combolists or data breaches, which contain username and password configurations, and then programmatically “check” the target login endpoint to see how many accounts within the list are valid credentials. Afterward, cybercriminals can use the account personally or sell access to others. As of 27 April 2020, there are over 357 pages of replies to ForlaxPy's post, which enables users to see the hidden content to download the software.

Cracked has a whole subforum dedicated to OpenBullet and the Cracked mod. On or around April 20, 2020, Cracked forum user r0x dumped approximately 750 OpenBullet configurations. r0x is a regular of Cracked and has over 156 posts in 2 years on the website. The user also links their own website for buying configs, located at www.cracking[.]zone.

Figure 2: Post by r0x advertising the dump

Once users reply to his post, they are presented with a direct download link to the dump and they can begin to use the configurations immediately.

On April 23 2020, Cracked forum user Arnab dumped a larger list of configurations, totaling 4,614 files.

Figure 3: Post by Arnab advertising the dump

Arnab is also a regular of Cracked and has over 100 posts in 2 years on the website.

ZeroFOX Alpha Team obtained both dumps to analyze the configurations. Arnab’s dump contained all but 4 OpenBullet configurations that were dumped by r0x. Most of the configurations that were dumped are clearly designed for credential stuffing checks. For example, a simple grep for password of all the files yielded 4461 matches, while a grep for password= parameter yielded 1421 results.

Many of these configurations have signatures that can be used for detection mechanisms. For starters, order of headers, parameters and the uniqueness of values to these parameters or headers can help identify someone performing credential stuffing.

For the full list of affected endpoints, applications or companies, refer to our posted Github Gist.

Breaking News: 2020-04-24 - 2020-04-30

Hackers leak credentials of WHO and Gates Foundation employees

Hackers have exposed nearly 25,000 email addresses and passwords allegedly belonging to the employees of the World Health Organisation (WHO), the US National Institutes of Health (NIH), the Centers for Disease Control and Prevention (CDC), the World Bank, the Gates Foundation and the Wuhan Institute of Virology. Reportedly, NIH had 9,938 credentials posted online. The CDC and the WHO had 6,857 and 2,732 credentials leaked. The Gates Foundation and the Wuhan Institute of Virology lost 269 and 21 credentials respectively. The attackers posted the credentials on sites such as 4chan and Pastebin. However, the authenticity of the leaked email addresses and passwords has not been verified yet.

See the full report here: https://www.itpro.co.uk/security/cyber-security/355411/health-orgs-employees-credentials-leaked-online

Hackers Trick 3 British Private Equity Firms Into Sending Them $1.3 Million

Hackers tricked three British private equity firms into wire-transferring a total of $1.3 million to attacker-controlled bank accounts in a new BEC scam. According to security researchers, nearly $700,000 of the total wire transferred amount has permanently lost to the attackers, with the rest of the amount recovered after researchers alerted the targeted firms in time. Dubbed 'The Florentine Banker,' the hacker group sent one mail each from the spoofed domains to the counterparty, thus inserting itself into the conversation and deceiving the recipient into thinking that the source of the email is legitimate. The attackers then begin injecting fraudulent bank account information (associated with accounts located in Hong Kong and the UK) in the emails to intercept money transfers and initiate new wire requests.

See the full report here: https://thehackernews.com/2020/04/bec-scam-wire-transfer-money.html

ESET takes down VictoryGate cryptomining botnet

Slovak cyber-security firm ESET has announced that it has taken down the command and control server of a malware botnet called “VictoryGate” and has set up a sinkhole to monitor and control the infected hosts. The botnet was active since May 2019 and whose primary purpose was to infect victims with malware that mined the Monero cryptocurrency. The botnet propagates via removable devices. Once the malicious USB is connected to the victim's computer, the malware gets installed on the device. VictoryGate also has a component that copies the USB infector to new USB devices connected to a computer that helps it to spread to new devices.

See the full report here: https://www.zdnet.com/article/eset-takes-down-victorygate-cryptomining-botnet/

SeaChange video platform allegedly hit by Sodinokibi ransomware - BleepingComputer

SeaChange, a leading supplier of Video Delivery Software Solutions was reportedly targeted by Sodinokibi Ransomware. In an update to Sodinokibi's data leak site, they have published the images of some of the documents that they have stolen during an alleged attack. These images include a screenshot of folders on a server they claim to have had access to, a bank statement, insurance certificates, a driver's license, and a cover letter for a proposal for a Pentagon video-on-demand service.

See the full report here: https://www.bleepingcomputer.com/news/security/seachange-video-platform-allegedly-hit-by-sodinokibi-ransomware/

Creative Skype phishing campaign uses Google's .app gTLD - BleepingComputer

Security researchers have uncovered an ongoing phishing campaign targeting Skype users by tricking them into visiting a malicious link embedded in the phishing emails purporting to be notifications from the service. Upon clicking the link, the victims are redirected to a ".APP" generic top-level domain (gTLD) that is managed by Google. After that, the fake Skype login page loads at ("hxxps://skypeonline0345[.]web[.]app"). According to the researchers, the use of the ".APP" gTLD is likely helping the attacker bypass available phishing protection. The fake login page has the username already filled in and the victim only has to enter their password and the attacker gets it automatically. Not clicking on links in email and typing yourself the legitimate login address in the browser bar is the best option to stay safe from this sort of threat.

See the full report here: https://www.bleepingcomputer.com/news/security/creative-skype-phishing-campaign-uses-googles-app-gtld/

“Paay” Left an Unprotected Database Online Containing Credit Card Details - TechNadu

An unprotected database belonging to Paay, a New York-based card payment processor, has exposed approximately 2.5 million credit card transactions. The leaked credit card transactions were dated September 1, 2019, and it includes credit card numbers in plaintext form, the expiry date, and the transaction amount. However, the cardholder names and the CVV codes were not stored in the exposed database.

See the full report here: https://www.technadu.com/paay-database-unprotected-online-credit-card-transactions/99764/

SBA reveals potential data breach impacting 8,000 emergency business loan applicants

The US Small Business Administration (SBA) disclosed a potential data breach impacting more than 8,000 applicants to the Economic Injury Disaster Loan program (EIDL), which offers up to $10,000 to small business owners currently struggling due to the coronavirus pandemic. The incident may have compromised applicants' details such as Social Security numbers, physical and email addresses, dates of birth, citizen status, and insurance information. However, there is no evidence that applicant data has been abused and the agency is offering a year of free credit monitoring for those who are potentially impacted. Currently, new applicants are not being accepted due to "available appropriations funding."

See the full report here: https://www.zdnet.com/article/sba-reveals-potential-data-breach-impacting-8000-emergency-business-loan-applicants/

400.000 US, South Korean card records put up for sale online - BleepingComputer

More than 400,000 payment card details related to US and South Korean financial organizations and banks are put up for sale on the internet's largest carding fraud forum, Joker's Stash. According to Group-IB, the card dump includes 198,233 items belonging to South-Korean card records (about 49.9% of the total number of items) and 49.3% are from US banks and financial organizations. Currently, Joker's Stash is selling the details of these cards at a total price tag of $1,985,835 for the full set, accounting for a median price of $5 per record, and states that the buyers should expect a validity rate of around 30-40%.

See the full report here: https://www.bleepingcomputer.com/news/security/400000-us-south-korean-card-records-put-up-for-sale-online/

Nintendo accounts hacked: 160,000 accounts accessed by hackers - HackRead

Nintendo confirms that it suffered a massive data breach, impacting nearly 160,000 Nintendo accounts which were accessed by hackers. The company said that the incident took place due to vulnerability in Nintendo’s Nintendo Network ID (NNID) system. The breached information includes account holders' usernames and passwords, nicknames, email addresses, genders, dates of birth, and country/region. However, Nintendo says that no payment card data was exposed. The company is urging users to choose different passwords for NNID and Nintendo account and use the two-factor authentication (2FA).

See the full report here: https://www.hackread.com/nintendo-accounts-hacked-accessed-by-hackers/

Hackers set up fake NHS website to spread malware - HackRead

According to Kaspersky, hackers impersonated the official website of the National Health Service (NHS) of the United Kingdom to spread malware infection via phishing and typosquatting. Upon visiting the fake site, the victims are presented with a file named “COVID19”, which when downloaded, installs the info-stealer trojan. The malware is capable of stealing information such as passwords, files from the victim’s PC, cookies, payment information such as credit/debit card numbers from the victim’s browser, and cryptocurrency wallets. People are urged to confirm the authenticity of the websites before interacting with them.

See the full report here: https://www.hackread.com/hackers-setup-fake-nhs-website-spread-malware/

Symlink race bugs discovered in 28 antivirus products

RACK911 researchers have found symlink race condition vulnerabilities in 28 popular antivirus products across Linux, Mac, and Windows operating systems. A symlink race condition is a vulnerability that takes place when you link a malicious and a legitimate file together and end up executing malicious actions on the legitimate file. These bugs could allow attackers to delete files used by the antivirus or by the operating system, resulting in crashes or rendering the computer unusable. Researchers have created proof-of-concept scripts to demonstrate these bugs and have also informed the vulnerable vendors. Most of the antivirus vendors have fixed their products, and a few vendors are yet to patch.

See the full report here: https://www.zdnet.com/article/symlink-race-bugs-discovered-in-28-antivirus-products/

US universities targeted with malware used by state-backed actors - BleepingComputer

Faculty and students at several U.S. colleges and universities were targeted in phishing attacks with a remote access trojan (RAT) called Hupigon. The Hupigon RAT has been active since 2010 and is well-known for being employed by Chinese APTs such as APT3. The recent phishing attacks used adult dating lures to trick victims into choosing one of two dating profiles to connect with and when clicked on one of these profiles, an executable used to install the Hupigon RAT is downloaded on their computers. Once the devices are infected, attackers use the malware to steal sensitive personal info including user credentials, screenshots, and audio recordings, to control the webcam and to gain full control of infected computers.

See the full report here: https://www.bleepingcomputer.com/news/security/us-universities-targeted-with-malware-used-by-state-backed-actors/

Phishing uses lay-off Zoom meeting alerts to steal credentials - BleepingComputer

A new phishing campaign has been discovered that targets Zoom users who work in a corporate environment, by using a fake Zoom meeting notifications. The phishing emails mimic legitimate Zoom meeting reminders stating target's layoff in a meeting with their company's Human Resources and Payroll Administrative Head scheduled to start within minutes. The embedded links within the email redirect the recipients to the malicious landing page hosted at zoom-emergency.[]myftp.org where it asks the victim to enter the organization email login to proceed, thereby stealing their credentials and making them available to the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-uses-lay-off-zoom-meeting-alerts-to-steal-credentials/

Latest Apple Text-Bomb Crashes iPhones via Message Notifications

Apple devices are vulnerable to a new “text bomb” attack, where simply looking at the messages or posts containing characters in the Sindhi language, an official language used in Pakistan, can crash devices. The Sindhi-language characters will make the system to crash if the character string shows up in a text message, looking at a message notification containing a message preview, viewing messages within apps, or reading social media posts on one’s phone or Mac. The bug affects iPhone, iPad, Macs, and Apple Watches, and arises from macOS and iOS which fails to properly render a Unicode symbol as this symbol confuses the operating systems. However, Apple is yet to address the issue.

See the full report here: https://threatpost.com/apple-text-bomb-crashes-iphones-message-notifications/155144/

Hackers are exploiting a Sophos firewall zero-day

Cyber-security firm Sophos has published an emergency security update on Saturday to patch a zero-day vulnerability in its XG enterprise firewall product that was being abused in the wild by hackers. Sophos XG Firewall devices that had their administration (HTTPS service) or the User Portal control panel exposed on the internet were targeted. The attack used an SQL injection vulnerability to download a payload and gain access to the device. The stolen data could include usernames and hashed passwords for the firewall device admin, for the firewall portal admins, and user accounts used for remote access to the device. But the passwords for customers' other external authentication systems were unaffected. The companies are recommended to reset all passwords and reboot device. The security update will also add a special box in the XG Firewall control panel to let device owners know if their device has been compromised.

See the full report here: https://www.zdnet.com/article/hackers-are-exploiting-a-sophos-firewall-zero-day/

New Coronavirus screenlocker malware is extremely annoying

A fake WiFi hacking program is being used to distribute a new Coronavirus themed malware that locks the user out of Windows while making some very annoying sounds. Screenlockers are malware programs that display a lock screen when logging into Windows and prevent the user to access the Windows desktop or interact with installed programs and files. Discovered by a security researcher Max Kersten, this new Screenlocker is called CoronaLocker, will extract numerous VBS files and a batch file, when used together, create Screenlocker functionality. Once installed, the computer will reboot, and upon restart, users will be shown a lock screen stating "you are infected of Coronavirus" with a contact email. The malware creates a variety of Registry settings that prevent the Task Manager and Run commands from working, the Desktop icons are hidden, and Start Menu is disabled. It is not known how this malware is being distributed.

See the full report here: https://www.bleepingcomputer.com/news/security/new-coronavirus-screenlocker-malware-is-extremely-annoying/

Password-free database of exercise app Kinomap leaks 42m user records

42 million records belonging to users of a fitness technology app, Kinomap were exposed online for almost a month due to a misconfigured database. According to vpnMentor, the exposed records contain Personally Identifiable Information (PII) including full names, home country, email addresses, usernames, account details, gender, timestamps for exercises & the date of joining. The records didn’t contain any passwords or payment-related data. The researchers also claimed that access keys for the Kinomap API were available and might be used to hijack accounts. The company has protected the data on 12th April 2020 from public access. The leak could enable attackers to craft Phishing and identity fraud schemes or to install malware on target devices. Kinomap users are advised to vigilant on phishing attacks.

See the full report here: https://nakedsecurity.sophos.com/2020/04/23/password-free-database-of-exercise-app-kinomap-leaks-42m-user-records/

BazarBackdoor: TrickBot gang’s new stealthy network-hacking malware

A new phishing campaign is delivering a stealthy backdoor, named BazarBackdoor, to compromise and gain full access to corporate networks. The developers of TrickBot trojan are believed to be behind this new backdoor due to code similarities, executable crypter, and its infrastructure. Targeted users receive phishing emails via Sengrid, containing a wide variety of lures such as customer complaints, COVID-19 themed payroll reports, and employee termination lists that contain links to documents hosted on Google Docs. The campaign is carefully crafted to look familiar as the attackers have designed the landing pages with similar icons of what they’ve sent in emails. When the link is clicked, an executable is downloaded that uses an icon and name associated with the icon shown on the landing page. By deploying Cobalt Strike, a legitimate cybersecurity application, the backdoor penetrates in order to steal sensitive data, deploy ransomware, or sell the network access.

See the full report here: https://www.bleepingcomputer.com/news/security/bazarbackdoor-trickbot-gang-s-new-stealthy-network-hacking-malware/

Stuck at home, UK lockdown DIY fans slammed with Robert Dyas data breach

UK hardware store Robert Dyas was hit by a data breach that exposed its user's confidential details. The breach affected approximately 20,000 customers. In an email sent to affected customers, the company disclosed the security breach stating that a card skimmer was present for several days in March 2020 on its payment processing website. A preliminary investigation revealed that hackers were able to access some customer data on transactions made between 7th March and 30th March 2020. It enabled them to steal the long card number, expiry date and CVV code of customers' debit/credit cards, although no user password or details of product purchases made by customers were compromised in this incident. The company spotted the incident and blocked the malware.

See the full report here: https://www.zdnet.com/article/stuck-at-home-uk-lockdown-diy-fans-slammed-by-robert-dyas-data-breach/

Bad actor sells Huiying Medical Technology’s source code for AI-assisted COVID-19 detection

Researchers from the data breach notification firm Cyble have identified a credible bad actor that goes online with moniker ‘THE0TIME’ claiming to have gained access to Huiying Medical Technology’s COVID-19 detection’s technology code, as well as COVID-19 experiments data. Huiying Medical Technology developed an AI-based system that can detect suspected contours of pneumonia from CT Chest DICOM images and identify the symptoms of a COVID-19 infection. Huawei, which partners with Huiying, currently sells the system for USD $50,000 per month. The threat actors are offering for sale the source code for AI-assisted COVID-19 detection and experimental data for sale at 4 BTC. The dump includes 1.5 MB of Users data, 1GB of Technology & source code, and 150 MB of Knowledge for Covid-19 Experiments information.

See the full report here: https://securityaffairs.co/wordpress/102270/data-breach/huiying-medical-technology-data-breach.html

Reopen States Movements Hijacked for Influence Activity

On April 15, 2020, ZeroFOX Alpha Team observed a sudden rash of Facebook groups created to promote Reopen States rallies. Many of these groups follow standardized naming conventions like “Marylanders Against Excessive Quarantine,” and “Reopen Michigan.” The most active of these, “Pennsylvanians Against Excessive Quarantine”, is currently listed as gaining 840 new posts each day. The groups are primarily used for posting articles related to reopening state businesses and for organizing activity to support the cause. In total, ZeroFOX observed 177 reopen states groups, and 61 events as of April 20, 2020. Although many of these groups are legitimate, some group’s intentions may be different than what they appear at first glance. The team has uncovered demonstrated similarities between the activity in some of these groups and the coordinated influence campaign activity used by the Internet Research Agency (IRA) during the 2016 US presidential election. The operators behind the groups in question can be linked to dubious non-profit organizations likely intended to generate profit for the founders rather than for the cause of the group.

See the full report here: https://www.zerofox.com/blog/reopen-states-movements-hijacked/

Rabobank security cert expires and gives its Australian Android app a case of internet-blindness

Users have reported an outage issue in Rabobak’s android app where users were unable to access their bank accounts on mobile devices. The issue was caused by an expired security certificate within the bank’s mobile banking app. Although the bank fixed the issue, the fix didn’t work for some users. As a workaround, impacted customers are advised to re-install and re-register the app.

See the full report here: https://www.theregister.co.uk/2020/04/27/rabobank_australia_android_app_outage/

Hackers have breached 60 ad servers to load their own malicious ads

An unknown hacker group has been taking over the Ad servers for the past nine months appending malicious ads into the Ad inventory and redirecting users to malicious sites. Around 60 Revive ad servers have been compromised by this hacker group. According to Confiant researchers, the hackers are targeting advertising networks running old versions of the Revive open-source ad server and append malicious code to existing ads. Once the tainted ads load on legitimate sites, the malicious code hijacks and redirects site visitors to websites offering malware-laced files, usually disguised as Adobe Flash Player updates. The users are advised to block any ads from Ad placements.

See the full report here: https://www.zdnet.com/article/hackers-have-breached-60-ad-servers-to-load-their-own-malicious-ads/

Your Whole Company’s Microsoft Teams Data Could’ve Been Stolen With An ‘Evil GIF’

A vulnerability was discovered in Microsoft Teams that could allow hackers to steal users' data via a malicious GIF. The flaw affects Microsoft Teams version for desktop and web browsers. The problem lays in the way Microsoft handles authentication tokens for viewing images in Teams. CyberArk has released a proof-of-concept to demonstrate the attack. They discovered that if a hacker could force a target to visit the hijacked subdomains, the authentication tokens could be passed to the attacker’s server allowing to create another token, the skype token, which would grant access to scrape the victim’s account data. This attack could spread automatically from one compromised account to others in the same organization. On April 20, Microsoft released a patch to mitigate the risk.

See the full report here: https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-whole-companys-microsoft-teams-data-couldve-been-stolen-with-an-evil-gif/

WHO Confirms Email Credentials Leak

The World Health Organisation (WHO) has admitted the email addresses and passwords belonging to its staff have been publicly leaked online recently. WHO reportedly had around 450 active email addresses and passwords dumped online in recent days by an unknown entity. The organization stated that the leaked data does not pose any risk to current WHO systems as the exposed data is not recent. But does affect an older extranet used by current and retired WHO staff and by its partners. WHO did not disclose the breach details.

See the full report here: https://www.darkreading.com/attacks-breaches/who-confirms-email-credentials-leak/d/d-id/1337650

Biopharmaceutical Firm Suffers Ransomware Attack, Data Dump

ExecuPharm, a pharmaceutical clinical research organization, suffered a ransomware attack during which the attackers stole the information and later dumped it onto a Dark Web site. The incident exposed employee data including Social Security numbers, taxpayer and bank account information, passport, and credit card information. Additionally, some user information from ExecuPharm's business partner, Parexel, which had been stored on the compromised servers, was also exposed during the attack. The company said it has fully restored and secured the servers.

See the full report here: https://www.darkreading.com/attacks-breaches/biopharmaceutical-firm-suffers-ransomware-attack-data-dump/d/d-id/1337673

Fake Fedex and UPS delivery issues used in COVID-19 phishing - BleepingComputer

Scammers are continuously seeking opportunities to capitalize on a pandemic crisis by creating new scams. In a new phishing campaign, scammers are using a COVID-19 theme to impersonate well-known shipping carriers such as FedEx, UPS, and DHL. Attackers send phishing emails to victims, stating details about package delivery. Users are lured to click on the attachments for further information. The attachment is a malware executable that downloads and installs Remote Access Trojan (RAT). Once infected, the attacker can gain full access to the victim's computer.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-fedex-and-ups-delivery-issues-used-in-covid-19-phishing/

WordPress plugin bug lets hackers create rogue admin accounts - BleepingComputer

WordPress owners are vulnerable to a Cross-Site Request Forgery flaw that allows attackers to inject malicious code in the sites and create rogue admin accounts. It is a Cross-Site Request Forgery flaw that leads to Stored Cross-Site Scripting attacks and impacts all Real-Time Find and Replace versions up to 3.9. The Real-Time Find and Replace WordPress plugin are used to temporarily replace text and code content on their sites in real-time without having to actually go into the sites' source code and make permanent changes. An attacker can leverage the functionality of the plugin to replace any content on a targeted site with malicious code. All users are advised to update to version 4.0.2 of the plugin.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-plugin-bug-lets-hackers-create-rogue-admin-accounts/

GDPR Compliance Site Leaks Git Data, Passwords

Researchers have discovered a .git folder exposing passwords and other details of the website grpr.eu, a site that advises organizations about complying with the General Data Protection Regulation (GDPR) rules. Researchers were able to discover the open .git folder on GDPR.EU using a simple DotGit browser plugin, which checks whether .git is exposed on a given website. Upon further investigation, they were able to view various WordPress pages associated with the website, including wp-config, a core WordPress file that contains the information necessary to make the WordPress website operate. The file exposed open-source MySQL database management settings such as name, host, username, and password. The operators of the site have fixed the issue.

See the full report here: https://threatpost.com/data-leak-gdpr-advice-site/155199/

UAMS shuts down information network after 'malware virus' detected - Northwest Arkansas Democrat-Gazette

The FBI was notified of a malware incident last weekend that caused the University of Arkansas for Medical Sciences to shut down its information network. The hospital temporarily deactivated some of its systems after detecting a malware virus. According to UAMS, they started an internal investigation while bringing the systems back online, employee emails sent and received during the weekend were deleted and no data was compromised.

See the full report here: https://www.nwaonline.com/news/2020/apr/28/uams-shuts-down-information-network-aft-1/

Asnarök malware exploits firewall zero-day to steal credentials - BleepingComputer

Sophos firewall products were attacked with a new Trojan malware, dubbed Asnarök. The malware exploited a zero-day SQL injection vulnerability that could lead to remote code execution on any unpatched physical and virtual firewalls it targets and intends to steal sensitive data. The exploit drops a shell script that makes the malware installer script executable and launches it on the compromised devices. The malware was specifically designed for harvesting and exfiltrating firewall usernames and hashed passwords, as well as some system information. However, credentials associated with external authentications systems such as Active Directory services and LDAP were not targeted by Asnarök. Sophos has blocked all the indicators and pushed mitigations to affected firewall devices.

See the full report here: https://www.bleepingcomputer.com/news/security/asnar-k-malware-exploits-firewall-zero-day-to-steal-credentials/

Critical Security Patches Released for Magento, Adobe Illustrator and Bridge

Adobe has released emergency updates for three of its products - Adobe Illustrator, Adobe Bridge, and Magento e-commerce platform that contain a total of 35 vulnerabilities where each one of them is affected with multiple critical arbitrary code execution flaws. According to the advisory, all the critical arbitrary code execution can only be exploited by a malicious authenticated user or an attacker with the compromised admin-equivalent account whereas some of the important and moderate severity flaws don't need admin rights. However, an attacker still must need to have access to a low-privileged account to exploit those issues. Users are urged to upgrade to the fixed version at the earliest.

See the full report here: https://thehackernews.com/2020/04/adobe-software-updates.html

Rogue affiliates are running fake antivirus expiration scams - BleepingComputer

In a new scam campaign, Rogue security software affiliates are sending emails that falsely tell recipients that their Norton and McAfee antivirus software is expiring and prompt them to renew their license to earn a commission from the sale. The scam starts with emails containing an expiration warning, which contains a link stating, "Your Protection Can Expire TODAY!". Upon visiting the link, the users are redirected through the DigitalRiver affiliate network, which drops a tracking cookie on the browser, and then redirects the user to a purchase page for Norton or McAfee. Users are advised to remain vigilant while interacting with such scam emails.

See the full report here: https://www.bleepingcomputer.com/news/security/rogue-affiliates-are-running-fake-antivirus-expiration-scams/

‘Black Rose Lucy’ is Back, Now Pushing Ransomware

Researchers have discovered more than 80 malware samples tied to Lucy, cybercriminals behind the Android-based dropper malware Black Rose Lucy, along with identifying one new active Lucy variant in the wild. The new malware is distributed by enticing the targets to download a video player booby-trapped with the Lucy dropper. Another update to Lucy’s attack strategy is the Black Rose Lucy malware fortifies its C2 servers. The malware family, operated by the Lucy Gang, encrypts targeted Android devices and delivers a spoofed FBI message. The ransom note demands $500 and claims the phone’s user has visited “forbidden pornographic sites” on their phone and that a “snapshot” of their face was uploaded to the agency.

See the full report here: https://threatpost.com/black-rose-lucy-is-back-now-pushing-ransomware/155265/

Hackers threaten to leak data from high-end architecture firm Zaha Hadid

Zaha Hadid Architects, one of the world's leading architectural firms, suffered a ransomware attack last week, allowing the attackers to intrude into its network, steal and, encrypt its files. The ransomware gang appears to go by the name "Light" and could be a new ransomware group. The attackers claim to have stolen payroll records, bank documents, files holding employee details, life insurance details, employee contracts, email inbox dumps, and more. The attackers threaten the company to leak all the stolen data if they fail to pay a hefty ransom in demand.

See the full report here: https://www.zdnet.com/article/hackers-threaten-to-leak-data-from-high-end-architecture-firm-zaha-hadid/

PhantomLance spying campaign breaches Google Play security

Security researchers have discovered an ongoing campaign, called PhantomLance, in which malicious applications hosted by Google Play are secretly spying and stealing Android user data. The campaign has been active for at least four years and approximately 300 infection attempts have been traced to Android devices in countries including India, Vietnam, Bangladesh, and Indonesia since 2016. The malicious applications are harboring a new Trojan that has been discovered in Google Play. The multiple variations of PhantomLance malware have the basic functions of spyware, such as exfiltration functions for stealing user information including phone call logs, contacts, GPS data, SMS messages, and device model and OS information. The Trojan can build a backdoor to transfer this data to the operator's command-and-control (C2) server as well as deploy additional malicious payloads. Google has removed the malicious applications from its Play Store.

See the full report here: https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-google-play-security/

This new Android mobile malware targets banks, financial services across Europe

Security researchers have identified a new Android mobile malware, called EventBot, that targets financial and banking services across Europe and the United States, by abusing Android's accessibility features to compromise devices. EventBot targets over 200 mobile financial and cryptocurrency applications, such as PayPal, Barclays, CapitalOne UK, Coinbase, TransferWise, and Revolut. EventBot combines a Trojan and information stealer capable of exfiltrating user financial application data, as well as conducting secret spying on victims while masquerading as a legitimate application on the user's device. Researchers believe that the malware is still under active development and can become a serious mobile threat in the future.

See the full report here: https://www.zdnet.com/article/this-new-android-mobile-malware-is-striking-banks-financial-services-across-europe/

Google updates Chrome Web Store policy to block extension spam - BleepingComputer

Google said the increase in adoption of the extension platform has attracted spammers and fraudsters introducing low-quality and misleading extensions in an attempt to deceive and trick users into installing them to make a quick profit. Hence, Google has updated the Chrome Web Store's spam policy to block extension spam so that users can potentially avoid malicious extensions while sifting through 200,000 add-ons available in the store. Google also forbids developers from attempting to manipulate their extensions placement in the Chrome Web Store, which means that inflating their ratings, download, counts, or posting fake reviews.

See the full report here: https://www.bleepingcomputer.com/news/security/google-updates-chrome-web-store-policy-to-block-extension-spam/

High-Severity Cisco IOS XE Flaw Threatens SD-WAN Routers

A high-severity flaw in Cisco's IOS XE software for SD-WAN routers could allow a local, authenticated attacker to execute arbitrary commands with root privileges. The vulnerability tracked as CVE-2019-16011 can be exploited by authenticating to the device and submitting crafted input to the CLI utility. Cisco has fixed the flaw and urges users to update to the latest versions to avoid further risks.

See the full report here: https://threatpost.com/cisco-ios-xe-flaw-sd-wan-routers/155319/

Microsoft releases Sysmon 11 with auto-backup of deleted files - BleepingComputer

Microsoft has released Sysmon 11 with an important feature that allows users to monitor for and automatically archive deleted files on a monitored system. Sysmon or System Monitor is a Sysinternals tool, designed to monitor systems for malicious activity and log those events to the Windows event log. The new version can now monitor for file deletions and automatically archive files when they are deleted, making it easier for incident responders to gain access to the tools and malware executables used in an attack. By having these files, researchers can obtain information on the tactics, techniques, and procedures (TTP) of an attacker, allowing better defenses to be created.

See the full report here: https://www.bleepingcomputer.com/news/software/microsoft-releases-sysmon-11-with-auto-backup-of-deleted-files/

Numerous sites leak user emails to advertising, analytics services - BleepingComputer

Security researchers have discovered that multiple online services including Quibi.com, JetBlue.com, KongHQ.com, NGPVan.com, Mailchimp’s Mandrill.com, WashingtonPost.com, Wish.com and many more are reportedly leaking their user’s email data to third-party advertising and analytics companies such as Google, Facebook, Twitter, Mixpanel, Wistia, Pardot, CrazyEgg, New Relic, DrawBridge. The improper setup of marketing analytics systems results in collecting the user email addresses from email systems on the scenarios such as a new user who clicked on the email confirmation link, the subscribers who have clicked a link in a marketing email or the unsubscribe process. The researchers have notified the issue to the organization and they have rebuilt their email infrastructure and launched a new auto-login flow via email.

See the full report here: https://www.bleepingcomputer.com/news/security/numerous-sites-leak-user-emails-to-advertising-analytics-services/

Microsoft Warns of Malware Hidden in Pirated Film Files

With people staying at home to stop the spread of COVID-19, attackers are using popular movies as bait to spread malware. Microsoft warns of an ongoing malware campaign in which attackers embed a malicious payload into files bundled with pirated movies including "John Wick 3," "Contagion," and other popular films. According to Microsoft, attackers hide a malicious VBScript in the same ZIP folder as a movie download. When victims click on these malicious ZIP files, a VBScript is launched that runs a command to download more components, including an AutoIT script. This decodes a second-stage DLL, which aims to inject coin-mining code directly into memory. The threat has reached at least tens of thousands of people in Spain and Spanish-speaking countries such as Mexico and Chile.

See the full report here: https://www.darkreading.com/threat-intelligence/microsoft-warns-of-malware-hidden-in-pirated-film-files/d/d-id/1337688

Google Meet: Video meetings built on a secure foundation, soon free for everyone

Google Cloud announced that it is offering Google Meet, Google’s premium video-conferencing solution, free for everyone with availability rolling out soon. Google Meet comes with enhanced security and privacy features by default. Starting in early May, anyone with an email address can sign up for Meet and avail many of the same features available to G Suite’s business and education users, such as simple scheduling and screen sharing, real-time captions, and layouts that adapt to your preference, including the expanded tiled view.

See the full report here: https://www.helpnetsecurity.com/2020/04/29/google-meet/