Threat Intelligence Bulletin: 05/01/20 - 05/07/20

NoName Hacking Group Targets Email[.]it

An Italian email service provider, Email[.]it, has experienced a data breach resulting in the exposure of data belonging to nearly 600,000 users. A hacker group called NN (No Name) Hacking Group claims to be responsible for the breach and that they have stolen 44 databases from Email[.]it's servers. The breached data is available for sale on the dark web for a price varying between 0.5 and 3 bitcoin ($3,500 and $22,000).

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

NN Hacking Group alleges to be an international hacking group with operatives from countries across the world. The group seeks payouts for hacking company servers. Initially they will try to get the company to pay a ransom to avoid public disclosure of stolen data. If a company refuses, they will then sell it on the dark web. No Name Hacking Group claims to have breached the Italian email provider, Email.it, two years ago. The breach timeline as detailed by the hackers is as follows:

January 01, 2018: NNHackingGroup compromised and dropped a backdoor in Email[.]it’s server and began to exfiltrate data from the company's servers.

February 1st, 2020: NNHackingGroup reached out to Email.it, disclosing the breach and requesting a ransom, but the company declined to respond.

February 18, 2020: Email.it quietly tried to patch their servers, but failed to prevent NNHackingGroup’s from retaining access. The company also refuted NNHackingGroup’s claims that passwords were saved in clear text.

Figure 1: NN Hacking Group’s official Web page.

April 05, 2020: NNHacking group published the stolen data, advertising their shaming website on Twitter where the data was made available for sale, for a price varying between 0.5 and 3 bitcoin ($3,500 and $22,000) depending on the data included.

Figure 2: NN Hacking Group’s Twitter handle, promoting the breached data available for sale and calling out the breached organization.

Figure 3: Screenshot of NN Hacking Group’s price chart for Email.it’s data.

The group was likely able to gather so much information because Email[.]it allegedly saved all passwords in cleartext, allowing the hackers to access the accounts of nearly 600k users. The hackers were able to steal about 44 databases containing the user and business information from 2007 to 2020. The exposed information included:

• Usernames
• Passwords (Plaintext)
• Mobile numbers
• Email addresses
• Email content and attachments
• Sent/Received SMS information
• Sent/Received Fax information
• Web application source code

Figure 4: NNHG-provided sample data exposing user passwords stored in plain text.

Figure 5: NNHG-provided sample data exposing Email.it’s web application source code.

Figure 6: NNHG-provided sample data exposing unencrypted emails and attachments.

Conclusion

NoName Hacking Group is the latest in a string of self-proclaimed hacking groups that seeks to name and shame victims. These groups generally breach their victims, gather sensitive data, and threaten to publicly release this info if the ransom is not paid. If the breached organization does not pay the ransom demand, they are named on a blog or website run by the hacking team, and the stolen information is posted for the world to see. This is done to increase the likelihood that a victim will pay. ZeroFOX recommends enacting the recommendations above to reduce risk of compromise due to a third-party breach.

Ransomware Victim Disclosures : Maze, NEFILIM compromise new victims

The Maze, NEFILIM, and EVILEAKS ransomware groups have been busy over the last week, compromising a laundry list of new victims. Victims include organizations across a variety of verticals, including banking and financial services, healthcare, and communications.

Recommendations

• Consider enabling additional ZeroFOX dark web coverage to identify mentions or discussion of targeting of your brand on the dark web
• If you are interested in further insight, reach out to [email protected] for assistance

Details

Maze group infects new organizations across a variety of verticals

Initially observed in May 2019, the Maze ransomware is known for notable, high-profile attacks. Maze is a particularly sophisticated strain of Windows ransomware that encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. Actors are known to exfiltrate data from the network for further extortion. Maze spreads mainly using email spam and various exploit kits, notably Spelevo and Fallout. The Maze group utilizes a public website to name and shame victims who do not pay ransom demands.

On April 30, 2020, the Maze group posted a new disclosure, claiming to have infected Banco BCR Bank. Banco BCR is a state-owned commercial bank that operates in Costa Rica. It is one of the largest banks in both Costa Rica and Central America. The hackers claim to have initially gained access to Banco BCR's network in August 2019. After the bank failed to secure the network, the hackers once again gained access to the bank's network in February 2020. They claim 11 million credit card credentials were stolen. Of these credit cards, 4 million are stated to be unique and 140,000 allegedly belong to people from the USA.

Other recent Maze targets include a domain owned by an American plastic surgeon ( kristintarbetmd[.]com), US-based chemical company PeroxyChem, global communications company ClearOne, regional ISP Dakota Carrier, American CPA Dakota & Morgan, and Colorado-based consulting company Homestead Management Corporation.

MAS Holdings targeted by NEFILIM

On April 27, 2020, sensitive data belonging to MAS Holdings, a major South Asian apparel manufacturer, was leaked by the operators of NEFILIM ransomware. MAS Holdings is one of South Asia’s largest apparel manufacturers, and has 53 manufacturing facilities in 17 countries, employing over 93,000 people globally. The hackers claim to have downloaded 300 gb of their private files from the breached organization’s network.

NEFILIM ransomware surfaced and began spreading at the end of February 2020. The ransomware encrypts files with AES-128 encryption and appends ".NEFILIM" to infected files. The malware shares code with the Nemty ransomware family but instead of using a Tor payment site, the malicious software relies on email communication for payment. The threat actor behind NEFILIM threatens to release stolen data if the ransom is not paid within seven days.

Brazlian National Supplementary Health Agency Shamed on EVILEAKS

On May 1, 2020, the threat actor, Razor, posted about 61GB of data belonging to Brazil’s National Supplementary Health Agency on EVILEAKS shaming website. Brazil’s National Supplementary Health Agency (ANS) was founded in 2000 by the ministry of health. The ANS monitors trends in private plan costs, providers, and inputs, authorizes corporate splits, mergers, acquisitions, transfer of shares, and articulates with consumer protection organizations. The ANS website (ans[.]gov[.]br) is currently down.

Conclusion

Ransomware operators continue to target organizations with the goal of extorting demands from victims in exchange for decrypting valuable data. Many ransomware operators have resorted to shaming their victims by leaking their information from the files stolen during the attack if the ransom is not paid. This tactic is likely an attempt to increase the likelihood that a compromised organization concedes to ransom demands.

Breach Disclosure: Tokopedia

Indonesia’s largest online store group, Tokopedia, has experienced a data breach resulting in exposure of data belonging to 91 million users. 15 million records are being offered for sale on hacking forum RaidForums. The remainder of the breached data is available for sale on a separate forum for a price of $5000. Breached records include name, password, email address and phone numbers of Tokopedia users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On Friday, a hacker leaked 15 million records of Tokopedia users, on a public hacking forum.

Figure 1: Leak related to Tokopedia on a hacker forum

Later, the same actor was found selling the complete leaked Tokopedia database of 91 million users on a separate dark web forum for $5000.

The actor claims that the site was hacked in March 2020. Exposed information includes name, password, email address and phone numbers of Tokopedia users.

Figure 2: Second post from the hacker selling 91 Million user records

Figure 3: Tokopedia records for sale on a dark web marketplace

Breach Disclosure: Elanic

Major Indian fashion reseller Elanic has experienced a data breach involving over 2 million user records. This breach appears to date back to January 2020. These records contain email addresses of site users. Although Elanic has confirmed the breach, they have stated that they will not disclose the breach either publicly or privately to the affected users. It is unclear as to whether the company will take any remedial action.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Both Elanic and the data dump seller allege that the data is old, and was exposed via an insecure test server. The data dump was offered for sale on a public hacking forum. In total, 2.8 million email addresses, with being 2.3 unique addresses, were included in this dump.

Figure 1. Breach data dump offered for sale on a hacking forum

Breach Disclosure: TaiLieu

Vietnamese educational website, TaiLieu[.]vn, experienced a data breach resulting in the exposure of user data. It is currently unknown as to who is responsible for the breach. Nearly 7 million user records, including usernames and unsalted MD5 hashed passwords, have been exposed. This breach is available for sale on a popular hacker forum for a minimal price.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In November 2019, TaiLieu was breached and the leaked data was recently posted on a popular hacker forum. The incident resulted in the exposure of more than 7,000,000 records that contained the Personally Identifiable Information (PII) of TaiLieu[.]vn users, which is now available for sale on the dark web for an insignificant price of approximately 8 credits. This poster also included a screenshot of the breached data, which appears to be legitimate.

Figure 1: Screenshot of the leak advertised on a popular hacker forum.

The breached information included the following details:

• User names
• Email addresses
• Dates of birth
• Gender information
• Passwords

The exposed passwords were stored as unsalted MD5 hashes. The MD5 hash algorithm is relatively trivial to reverse, and it is likely plain text passwords will be revealed.

Breaking News: 2020-05-01 - 2020-05-07

US govt agencies to disable DoH until federal service is ready - BleepingComputer

The US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) recommended disabling third-party encrypted DNS services until an official DNS resolution service with DNS over HTTPS (DoH) and DNS over TLS (DoT) support is ready. Until then, it reminded the government agencies to use the EINSTEIN 3 Accelerated (E3A) DNS server which comes with a sinkhole capability that blocks access to malicious infrastructure by overriding public DNS records identified as harmful, as the primary DNS resolver for any government workstations and communications. The support for DoH is enabled by default for Firefox users in the US, Chrome is currently experimenting with the feature, and Microsoft has announced plans to support DoH inside Windows in the upcoming future.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-agencies-to-disable-doh-until-federal-service-is-ready/

Surge in phishing attacks using legitimate reCAPTCHA walls

Security researchers at Barracuda Networks have discovered that cyber scammers are using the Google-owned legitimate reCAPTCHA walls to prevent automated URL analysis systems from accessing the actual content of phishing pages. According to the researcher, a single email credential phishing campaign had sent out more than 128,000 emails to various organizations and employees using reCAPTCHA walls to conceal fake Microsoft login pages. These phishing emails claim that the victim has received a voicemail message and once the victim solves the reCAPTCHA, they are redirected to the actual phishing page, which spoofs the Microsoft login page. When the victim enters the login information, it will be sent to the cyber scammers, who will likely use this information to hack into the real Microsoft account.

See the full report here: https://www.helpnetsecurity.com/2020/05/01/recaptcha-walls/

Spear-phishing campaign compromises executives at 150+ companies

Security researchers from Group-IB have uncovered a cybercrime group called “PerSwaysion” operating since mid-2019 and has breached the email accounts of high-ranking executives at more than 150 companies. The group relies on the spear-phishing technique wherein it sends the boobytrapped emails with a PDF file as an attachment to the victims. Once opened, it asks them to click on a link to view the actual content. The link redirects the victim to a Microsoft Sway (newsletter service) page, where a similar file asks the victim to click on another link. This last link redirects the victim to a page mimicking the Microsoft Outlook login page, where hackers collect the victim's credentials and send it to their C&C server. Finally, they generate new phishing PDF files with the current victim's full name, email address, and company legal name which will be sent to the new people who tend to be outside of the victim's organization and hold significant positions.

See the full report here: https://www.zdnet.com/article/spear-phishing-campaign-compromises-executives-at-150-companies/

Ninja Forms WordPress plugin patch prevents takeover of 1M sites - BleepingComputer

The developers of Ninja Forms have patched a critical Cross-Site Request Forgery (CSRF) vulnerability. Ninja Forms is a WordPress plugin with over more than 1 million installations. The vulnerability can be exploited by tricking WordPress admins into clicking specially crafted links that inject malicious JavaScript code as part of a newly-imported contact form. Users are advised to apply the security fix.

See the full report here: https://www.bleepingcomputer.com/news/security/ninja-forms-wordpress-plugin-patch-prevents-takeover-of-1m-sites/

Critical vulnerabilities in WordPress plugins lead to e-learning platform hijacking

Checkpoint researchers have discovered severe security flaws, tracked as CVE-2020-6008, CVE-2020-6009, CVE-2020-6010, and CVE-2020-6011 in popular WordPress plugins LearnPress, LearnDash, and LifterLMS. Unauthenticated attackers can exploit the security flaws to hijack e-learning platforms, steal sensitive data, change grades, tamper with assignments, forge certificates, and other malicious activities. Users are advised to update the plugins to stay protected.

See the full report here: https://www.zdnet.com/article/critical-vulnerabilities-in-wordpress-plugins-can-lead-to-e-learning-platform-hijacking/

French daily Le Figaro database exposes users' personal info - BleepingComputer

Security researchers have discovered a misconfigured Elasticsearch server belonging to Le Figaro, a French daily newspaper, that has exposed around 7.4 billion records containing personally identifiable information (PII) of reporters and employees, as well as of at least 42,000 users. The exposed database contained records with information on newly registered accounts between February and April 2020, as well as records of pre-existing user accounts that were logging in during that period. For pre-existing users, the database leaked only PII data, while in the case of new records login credentials were also leaked.

See the full report here: https://www.bleepingcomputer.com/news/security/french-daily-le-figaro-database-exposes-users-personal-info/

TrickBot Attack Exploits COVID-19 Fears with DocuSign-Themed Ploy

Security researchers have discovered a new spam campaign that takes advantage of COVID-19 pandemic to spread TrickBot trojan. The spam begins by distributing malicious emails to targets. These emails claim to be from the Department of Labor’s Family and Medical Leave Act (FMLA) and contain a Microsoft Office Themes File called “US-DoL.eml” with three attachments: us -logo.png, faq.png, and Family and Medical Leave of Act 22.04.doc, with the final document being the malicious component. Once opened, the document asks the victim to enable macros, from which malicious scripts will be launched to fetch the malware from the attacker’s designated domain.

See the full report here: https://threatpost.com/trickbot-attack-covid-19docusign-themed-malw/155391/

Critical SaltStack RCE Bug (CVSS Score 10) Affects Thousands of Data Centers

F-Secure researchers have discovered two severe vulnerabilities in the open-source SaltStack Sat configuration framework that could allow an adversary to execute arbitrary code on remote servers deployed in data centers and cloud environments. The vulnerabilities tracked as CVE-2020-11651 and CVE-2020-11652 are rated with CVSS score 10. The Salt users are urged to update the software packages to the patched version.

See the full report here: https://thehackernews.com/2020/05/saltstack-rce-vulnerability.html

New phishing campaign packs an info-stealer, ransomware punch - BleepingComputer

A new phishing campaign has been discovered by researchers, that distributes a malware combo. The attackers first infect the systems with Lokibot malware, which steals the credentials stored in different applications and then drops Jigsaw ransomware to encrypt the files to get ransom from the victims. The phishing campaign utilizes a malicious spreadsheet to exploit an old Excel vulnerability. Applying the latest security updates on Office Applications can protect users from this phishing campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/new-phishing-campaign-packs-an-info-stealer-ransomware-punch/

Upgraded Cerberus Spyware Spreads Rapidly via MDM

Researchers have recently discovered an upgraded variant of Cerberus Android Trojan capable of mobile remote accessibility. The new variant is also capable of logging all keystrokes, stealing two-factor authentication SMS and Google Authentication data, and taking complete control of the device remotely via TeamViewer. Cerberus is the first variant discovered that spreads by abusing Mobile Device Management (MDM) servers.

See the full report here: https://threatpost.com/cerberus-trojan-major-spyware-targeted-attack/155415/

Convincing Office 365 phishing uses fake Microsoft Teams alerts - India Gone Viral

Researchers have discovered a new phishing campaign that steals Office 365 credentials. The attackers using cloned imagery from automated Microsoft Teams notifications to convince the victims. Since Microsoft Teams is linked to Microsoft Office 365, the attackers may have access to other information available with the user’s Microsoft credentials via single-sign-on.

See the full report here: https://www.bleepingcomputer.com/news/security/convincing-office-365-phishing-uses-fake-microsoft-teams-alerts/

Microsoft Edge getting improved security, work at home features - BleepingComputer

Microsoft is releasing a new version of Edge with Insiders to make it more secure for those are working remotely. After Edge's latest update, SmartScreen can potentially block unwanted apps that are downloaded as ClickOnce or DirectInvoke apps. By adding support for both of these technologies, Microsoft Edge can now block a large range of malicious documents from being opened. For Microsoft Edge 83 and newer, another new feature called Automatic Profile Switching is rolling out, which will allow users to switch to the work profile while navigating to a work site.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-getting-improved-security-work-at-home-features/

Hacker leaks 15 million records from Tokopedia, Indonesia's largest online store

On Friday, a hacker posted details of 15 million users registered on Tokopedia, Indonesia's largest online store. The data was claimed to be obtained in an intrusion that took place in March 2020. The leaked file is a PostgreSQL database dump, containing user information such as full names, emails, phone numbers, hashed passwords, dates of birth, and Tokopedia profile-related details. Currently, Tokopedia is investigating the incident.

See the full report here: https://www.zdnet.com/article/hacker-leaks-15-million-records-from-tokopedia-indonesias-largest-online-store/

Xiaomi tracks private browser and phone usage, defends behavior - BleepingComputer

New research claims that China-based Xiaomi is tracking sensitive information via Mi browsers. Mi browser is bundled up by default with all Redmi and Mi phones. According to Forbes security researchers, Xiaomi's Mi Browser app sends your internet searches, including incognito mode sessions, to Xiaomi servers in Singapore and Russia. Furthermore, the data could be easily used to track back to particular users. Researchers observed similar behavior in Mi Browser Pro and the Mint Browser as well. Xiaomi has refuted these claims and assured that the data is fully anonymized.

See the full report here: https://www.bleepingcomputer.com/news/technology/xiaomi-tracks-private-browser-and-phone-usage-defends-behavior/

Hackers breach LineageOS servers via unpatched vulnerability

On Saturday, hackers have gained access to the infrastructure of LineageOS, a mobile operating system based on Android. Hackers leveraged an unpatched vulnerability to breach its Salt installation. Salt is an open-source framework provided by Saltstack, deployed to manage and automate servers inside data centers, cloud server setups, or internal networks. The LineageOS team has taken down all of its servers to investigate the incident and to patch the vulnerable servers. The team has confirmed that the operating system's source code, the system builds and the signing keys were unaffected.

See the full report here: https://www.zdnet.com/article/hackers-breach-lineageos-servers-via-unpatched-vulnerability/

Maze Ransomware operators claim to have stolen millions of credit cards from Banco BCR

Maze Ransomware operators claim to have hacked the network of the state-owned Bank of Costa Rica Banco BCR and stolen internal data, including 11 million credit card credentials. The data includes 4 million unique credit card records, and 140,000 allegedly belonging to USA citizens. As proof of this theft, Maze posted 240 credit card numbers, with the last four digits removed, along with expiration dates and credit card verification codes (CVC). The hackers claim to have compromised the bank's network in August 2019 and exfiltrated the data before encrypting the files. The bank is yet to confirm the breach.

See the full report here: https://securityaffairs.co/wordpress/102595/cyber-crime/maze-ransomware-banco-bcr.html

Security lapse at India’s Jio exposed coronavirus symptom checker results

India’s cellular network provider Jio, a subsidiary of Reliance, launched its coronavirus self-test symptom checker in late March. A security lapse in the app exposed one of the core databases to the internet. According to a security researcher, the leaked database contain millions of logs and records starting April 17. The data includes name of the users who took the test, alongwith gender, age, user’s browser, operating system information. Reliance Jio was notified of the issue after which it pulled the system offline.

See the full report here: https://techcrunch.com/?p=1982979

Employee data stolen in latest hack of edtech company Chegg - SiliconANGLE

For the third time since 2018, attackers have hacked education technology firm Chegg, this time stealing personally identifiable information (PII) belonging to some 700 Chegg employees. According to reports, compromised employee information includes full names and Social Security numbers. As in previous hacks, unauthorized users were able to gain access to sensitive information on Chegg systems. The company is working with a forensic firm and informed law enforcement of the breach.

See the full report here: https://siliconangle.com/2020/04/29/employee-data-stolen-latest-hack-edtech-company-chegg/

Nintendo Wii source code, design files acquired by hackers, leaked online - Digital Trends

According to Atheerios, hackers have targeted the servers of BroadOn, the company that developed most of the Nintendo Wii’s hardware and software. The incident has apparently leaked datasheets, block diagram, and Verilog files for all of the Wii’s components, which revealed everything that was used to create the Wii.

See the full report here: https://www.digitaltrends.com/gaming/nintendo-wii-source-code-leak/

LockBit Is the New Ransomware for Hire

Security researchers warn of a fairly new ransomware strain called LockBit, prevalent in countries including the US, the UK, France, Germany, Ukraine, China, India, and Indonesia. LockBit is self-spreading and uses a dual method to map out and infect the victimized network. ARP tables, which map local IP addresses to device MAC addresses, helped to locate accessible systems, and server message block, a protocol used for sharing files and folders among networked machines, allowed the infected nodes to connect to uninfected ones. LockBit then executes a PowerShell script that spread the ransomware to those machines.

See the full report here: https://arstechnica.com/information-technology/2020/05/lockbit-the-new-ransomware-for-hire-a-sad-and-cautionary-tale/

Ghost blogging platform servers hacked and infected with crypto-miner

A hacking campaign allegedly linked to the breach of LineageOS servers has now hacked Ghost, a Node.js-based blogging platform, built and advertised as a simpler alternative to WordPress. According to the Ghost developer team, the hackers leveraged the vulnerabilities CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal) to take control over its Salt master server. The company said that no financial information or user credentials were stolen during the incident. However, the hackers did install a cryptocurrency miner, which spiked the CPUs and quickly overloaded most of Ghost's systems. The Ghost team has patched and redeployed all the servers and they are now up and running.

See the full report here: https://www.zdnet.com/article/ghost-blogging-platform-servers-hacked-and-infected-with-crypto-miner/

CursedChrome turns your browser into a hacker's proxy

To raise awareness of malicious Chrome extensions and the damage they can cause in enterprise environments, a security researcher published a proof-of-concept Chrome extension, named CursedChrome, that can turn Chrome browsers into proxy bots. This can allow hackers to navigate the web using an infected user's identity. CursedChrome consists of two different parts, a client-side component (the Chrome extension itself) and a server-side counterpart (a control panel where all CursedChrome bots report). After the extension has been installed on a few browsers, the attacker can log into the CursedChrome control panel and establish a connection to each infected host. Once the attacker has connected to an infected host, they can then navigate the web using the infected browser, and by doing so, hijack logged-in sessions and online identities to access forbidden areas, such as intranets or enterprise apps.

See the full report here: https://www.zdnet.com/article/cursedchrome-turns-your-browser-into-a-hackers-proxy/

Apple-Google COVID-19 virus contact-tracing API to bar location-tracking access

Apple Inc and Alphabet Inc's Google released a set of new guidelines regarding ExposureNotification. The companies will ban location-tracking by apps using their new coronavirus contract-tracing API. According to new guidelines, only public health authorities will be able to use the API and only one app per country will be permitted into app stores. The first version of the API was released to developers last week. The recent release includes a new set of resources to help developers get started on the app development, including example UI assets and sample code for both iOS and Android. Both companies will continue to release updates and development kits before releasing a public version of the API to consumers later this month.

See the full report here: https://www.theregister.co.uk/2020/05/05/apple_googles_exposurenotification_api_update/

Office 365 to stop data theft by disabling external forwarding - BleepingComputer

Microsoft is planning to restrain enterprise data theft via email forwarding by disabling Office 365's email forwarding to external recipients by default. The improved external email forwarding controls will allow Office 365 admins to enable the feature only to select employees in their organizations. The company plans to roll out these new features to all environments with an Office 365 Advanced Threat Protection (ATP) in the fourth quarter of 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-to-stop-data-theft-by-disabling-external-forwarding/

New VCrypt Ransomware locks files in password-protected 7ZIPs - BleepingComputer

New ransomware called VCrypt is targeting French victims by utilizing the legitimate 7zip command-line program to create password-protected archives of data folders. When executed, it extracts the legitimate 7zip command-line program called 7za.exe to the Temp folder as mod_01.exe. Then a series of commands execute to archive the files in the Windows folders in password-protected archives. The encrypted files use a naming format: username_foldername.vxcrypt. Each archive created by VCrypt will use the same hardcoded password when archiving files and then will delete the data in the folder. For other driver letters on the computer, the ransomware acts as a wiper. It also launches Internet Explorer to display a ransom note, written in French, stating details of retrieving the files. Since the ransom site is offline, the ransom amount is unknown.

See the full report here: https://www.bleepingcomputer.com/news/security/new-vcrypt-ransomware-locks-files-in-password-protected-7zips/

Microsoft warns of multiple malspam campaigns carrying malicious disk image files

Microsoft advanced machine learning threat detection models detected multiple malicious spam campaigns distributing disk image files infected with malware. Last week, experts detected a COVID-19-themed spam campaign to trick users into downloading and mounting ISO or IMG file attachments. The bait ISO or IMG files were infected with a strain of the Remcos remote access trojan (RAT). Major multiple malicious spam campaigns monitored by Microsoft include attacks at US small businesses, manufacturing companies in South Korea, and accountants in the US.

See the full report here: https://www.zdnet.com/article/microsoft-warns-of-multiple-malspam-campaigns-carrying-malicious-disk-image-files/

Hackers are targeting UK universities to steal coronavirus research, NCSC warns

The UK’s National Cyber Security Centre (NCSC) warned of targeted attacks against UK universities and scientific facilities that are involved in the COVID-19 research. According to NCSC, the nation-state actors are carrying out cyber espionage campaigns aimed at gathering intelligence on studies conducted by UK universities and scientific facilities related to novel Coronavirus including vaccination research. It is believed that state-sponsored groups operate for Russia, Iran, and China have pivoted to this valuable data and are targeting British universities and research departments in increasing numbers.

See the full report here: https://www.zdnet.com/article/hackers-are-targeting-uk-universities-to-steal-coronavirus-research-ncsc-warns/

Hackers Breach LineageOS, Ghost, DigiCert Servers Using SaltStack Vulnerability - Internet

A hacking campaign allegedly linked to the breach of LineageOS and Ghost has now hacked Digicert servers. On May 3, DigiCert deactivated its Certificate Transparency (CT) 2 log server after determining that the key used to sign SCTs may have been exposed via critical SALT vulnerabilities. The hackers leveraged the vulnerabilities CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal) to take control over its DigiCert's servers. According to F-Secure, more than 6,000 Salt vulnerable servers can be exploited via these vulnerabilities, if left unpatched. Companies are advised to update the Salt software packages to the latest version to resolve the flaws.

See the full report here: https://thehackernews.com/2020/05/saltstack-rce-exploit.html

Transport biz Toll Group suffers second ransomware infection in just three months

Transport company Toll Group suffered a ransomware attack for the second time in three months. The company is based out of Australia with its centers across the globe. Investigations reveal that the identified ransomware could be Nefilim. Toll was previously hit by a variant of the Mailto ransomware in early February 2020, where they took actions to immediately isolate and disable a few systems to limit the spread of the attack.

See the full report here: https://www.theregister.co.uk/2020/05/06/toll_group_second_ransomware_attack/

Details of 44m Pakistani mobile users leaked online, part of bigger 115m cache

The details of nearly 44 million Pakistani mobile subscribers have been leaked online this week by the attackers. The majority of entries in the leaked files contained mobile phone numbers belonging to Jazz (formerly Mobilink), a Pakistani mobile operator. Further analysis revealed that the leaked data contained both personally-identifiable and telephony-related information, including customer full names, home addresses (city, region, street name), national identification (CNIC) numbers, mobile phone numbers, landline numbers, and dates of subscription. The incident is currently under investigation.

See the full report here: https://www.zdnet.com/article/details-of-44m-pakistani-mobile-users-leaked-online-part-of-bigger-115m-cache/

GoDaddy notifies users of breached hosting accounts - BleepingComputer

GoDaddy, the world’s largest domain registrar and web hosting company, confirms that it suffered a data breach, impacting nearly 28,000 customers. The company said that the incident took place on October 19, 2019, and was discovered on April 23, 2020, after the company's security team discovered an altered SSH file in GoDaddy's hosting environment and suspicious activity on a subset of GoDaddy's servers. The breached information exposed only customers' hosting accounts, while their main GoDaddy account was not accessible to the attackers. However, the company says that it has not yet found any evidence of the attackers misusing the impacted accounts' hosting. GoDaddy is providing one year of free Website Security Deluxe and Express Malware Removal services to the impacted customers.

See the full report here: https://www.bleepingcomputer.com/news/security/godaddy-notifies-users-of-breached-hosting-accounts/

New Kaiji Botnet Targets IoT, Linux Devices

The new Kaiji botnet is infecting the internet of things (IoT) devices and Linux-based servers and leveraging them in distributed denial-of-service (DDoS) attacks. The malware features various DDoS attack modules, an SSH brute-forcer module to continue its spread, and another SSH spreader that hijacks local SSH keys to infect known hosts which the server has connected to in the past. Once an SSH connection is established, a /usr/bin/lib directory is created and then Kaiji is installed under the filename ‘netstat’, ‘ps’, ‘ls’, or another system tool name. Once the malware is executed, it copies itself to /tmp/seeintlog and launches various malicious operations, including decrypting command-and-control (C2) addresses and registering the newly infected server to one of the command servers. Finally, the botnet fetches commands from the C2 server with instructions for specific DDoS attacks.

See the full report here: https://threatpost.com/kaiji-botnet-iot-linux-devices/155463/

GitHub shuts down Popcorn Time repositories due to MPA DMCA notice - BleepingComputer

Due to a DMCA infringement notice, from the Motion Picture Association, GitHub was forced to take down two of its repositories used by the Popcorn Time developers for their Desktop client and API. Popcorn Time is a BitTorrent client with an integrated media player and the ability to browse through a list of copyrighted television shows and movies that can be streamed and watched directly in the client. While the Popcorn Time developers appear willing to push back against these DMCA notifications, GitHub likely will stay neutral and let courts decide if the infringement notifications should be enforced.

See the full report here: https://www.bleepingcomputer.com/news/software/github-shuts-down-popcorn-time-repositories-due-to-mpa-dmca-notice/

Google Android RCE Bug Allows Attacker Full Device Access

Android OS contained a remote code execution vulnerability (CVE-2020-0103) that could allow attackers to completely take over someone’s device to install programs, steal or change data, or create new accounts with full privileges. This flaw is among the 39 vulnerabilities affecting Android OS builds that use older security profiles and are spread throughout various components of Android. Google has patched the issue in its latest security update and recommends that Android users install the latest security patch to be on the safer side.

See the full report here: https://threatpost.com/google-android-rce-bug-full-device-access/155460/

Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets

The newly identified security issues in Citrix's ShareFile specifically affect customer-managed on-premises Citrix ShareFile storage zone controllers, a component that stores corporate data behind the firewall. The vulnerabilities are tracked as CVE-2020-7473, CVE-2020-8982, and CVE-2020-8983. If exploited, these vulnerabilities could allow an unauthenticated attacker to compromise the storage zones controller potentially and access sensitive ShareFile documents and folders. Users are advised to install the latest patched and follow the mitigations released by Citrix.

See the full report here: https://thehackernews.com/2020/05/citrix-sharefile-vulnerability.html

Phishing, Fraud, Fakes: Top 3 Digital Threats Targeting FinServ Today

With an increasing number of users relying on mobile banking through apps and online portals, financial institutions are getting more prone to risks of digital transformation. Financial services involve the exchange of money and sensitive information that if exposed or stolen could put both consumers as well as the integrity of the institution at risk. Public platforms like social media, websites, mobile apps, and support portals provide new vectors on which to host attacks, and, unsurprisingly, attackers are utilizing new methods for fraud and impersonation to take full advantage. A new report by ZeroFOX Alpha Team reveals the top three emerging and persistent digital attack tactics facing the financial services industry based on data from ZeroFOX’s own FinServ customer ecosystem over 12 months. Over the past few years, phishing attacks have spiked drastically, with a growing number of phishing kits developed and sold online. Banking mobile applications is another lucrative attack vector where attackers impersonate original apps to phish for banking credentials or exfiltrate sensitive information from the victim’s phone. Scammers also promote a variety of financial scams on social media, including money flipping and money muling that may lead to illegal money transfer. FinServ institutions, and their consumer bases, are frequently targeted with digital attacks due to the nature of the business and the handling of funds. As events like the Coronavirus pandemic have taken place, both the span of the attack surface and the frequency of attacks has increased.

See the full report here: https://www.zerofox.com/blog/phishing-fraud-finserv-report/

Samsung patches 0-click vulnerability impacting all smartphones sold since 2014

Samsung has released a patch in its latest security update that fixes a critical 0-click vulnerability that can be exploited in a zero-click scenario, without any user interaction, impacting all smartphones sold since 2014. The security flaw resides in the way that Android OS flavor running on Samsung devices handles the custom Qmage image format (.qmg). The bug is tracked as SVE-2020-16747 in Samsung's security bulletin and impacts only Samsung smartphone devices as it appears to have modified the Android OS to support the custom Qmage image format. Users are urged to apply the patch at the earliest.

See the full report here: https://www.zdnet.com/article/samsung-patches-0-click-vulnerability-impacting-all-smartphones-sold-since-2014/

Hacker claims to have breached Microsoft's GitHub private repos - BleepingComputer

Over 500GB of data belonging to Microsoft's private GitHub repositories has allegedly been hacked and leaked on the dark web. The stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. According to Cyber intelligence firm Under the Breach, from what was shared, there does not appear to be anything significant for Microsoft to worry about, such as Windows or Office source code. However, the leak does raise concerns over private API keys or passwords that could have accidentally been left behind in some of the private repositories.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-claims-to-have-breached-microsofts-github-private-repos/

Cisco Webex phishing uses fake cert errors to steal credentials - BleepingComputer

Security Researchers have discovered a new phishing campaign that aims at stealing Cisco Webex credentials. The attackers are using fake certificate error warnings with graphics and formatting lifted from Cisco Webex, a video and team collaboration solution, emails to convince the victims and steal their account credentials. Currently, the phishing emails have already landed in the mailboxes of up to 5,000 targets that use Cisco Webex while working remotely. To prevent falling victim to such phishing attacks, users are advised to verify the authenticity of suspicious emails before interacting with them.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-webex-phishing-uses-fake-cert-errors-to-steal-credentials/

Hackers use website favicon to camouflage credit card skimmer - BleepingComputer

Security researchers from Malwarebytes have discovered that hackers have created a fake icon portal camouflaged as a favicon to host and load a JavaScript web skimmer onto compromised e-commerce portals to steal payment info. While browsing the compromised online stores, the attackers load a benign image on all website pages except for checkout pages. Once the victim opens a checkout page, the innocuous favicon PNG image was automatically replaced with malicious JavaScript code designed to steal credit card information and send it to the attackers' servers.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-website-favicon-to-camouflage-credit-card-skimmer/

Hacker sells 22 million Unacademy user records after data breach - BleepingComputer

Unacademy, one of India's largest online learning platforms, suffered a data breach, impacting nearly 22 million users after a hacker gained access to their database and started selling the account information. The leaked database contains a total of 21,909,707 user records, including accounts from Wipro, Infosys, Cognizant, Google, and Facebook. The breach has exposed information including usernames, SHA-256 hashed passwords, date joined, last login date, email addresses, first and last names, and whether the account is active, a staff member, or a superuser. Registered Unacademy learners and educators are strongly advised to immediately change their account passwords on the site.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-sells-22-million-unacademy-user-records-after-data-breach/

Europe’s Largest Private Hospital Operator Fresenius Hit by Ransomware

Fresenius, Europe’s largest private hospital operator and a major provider of dialysis products and services, has been hit by a ransomware attack. It appears that Snake ransomware was behind the attack and has affected every part of the company’s operations around the globe. The company has confirmed that it has detected a computer virus on its systems and has taken precautionary measures to prevent further spread of the infection.

See the full report here: https://krebsonsecurity.com/2020/05/europes-largest-private-hospital-operator-fresenius-hit-by-ransomware/

Attackers Claim Identity of Financial NGO to Steal Sharepoint, Office Credentials

FINRA(Financial Industry Regulatory Authority) has warned about an ongoing phishing campaign that targets investment brokers with fraudulent emails for stealing their Microsoft SharePoint and Office credentials. The attack stems through an email purported to be from the specific officers at the FINRA and having the source domain name ‘@broker-finra[.]org’ and requests immediate attention to an attachment. The attachment is a PDF file that directs the victims to a website, where they are prompted to enter their Microsoft Office or SharePoint password. FINRA recommends that anyone who may have received one of the fraudulent emails and already entered their password, change it immediately. It also reminded people to verify the legitimacy of any email before responding to it or opening any of its embedded links or attachments.

See the full report here: https://threatpost.com/attackers-identity-financial-ngo-steal-sharepoint-office-credentials/155502/

Adult live streaming site CAM4 found leaking data of millions of users

Security researchers have discovered a misconfigured database containing nearly 7 terabytes of sensitive user and company information belonging to an adult live streaming site, CAM4. The database apparently contains 10.88 billion records, which contain different combinations of sensitive information such as: names, email addresses, usernames, gender preference and sexual orientation, payment information, IP addresses, as well as user and inter-user conversations, chat transcripts between users and CAM4, fraud and spam detection logs, and hashed passwords. The Irish company Granity Entertainment, which owns CAM4.com has pulled the database offline.

See the full report here: https://www.helpnetsecurity.com/2020/05/06/cam4-leaking-data/