Threat Intelligence Bulletin: 05/08/2020 - 05/14/2020

__ Patch Tuesday 05/12/2020 Notes __

This advisory addresses the latest vulnerabilities announced from Microsoft for their "Patch Tuesday" announcement. This advisory summarizes vulnerabilities and issues, along with highlighting any notable vulnerabilities that may impact our customers.

Recommendations

• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information
• Be sure to apply patches in a timely manner to mitigate these and other vulnerabilities

Details

There were 112 vulnerabilities in total this Tuesday, with 5 being rated as Critical, 80 being rated as High, 8 as High/Medium and the remaining 19 being rated as Medium.

The Critical rated vulnerabilities are Remote Code Execution (RCE) vulnerabilities impacting Microsoft Sharepoint along with one vulnerability impacting Visual Studio Code, the popular code-editing app.

79 vulnerabilities (~70%) impact Microsoft Windows 10 32-bit Systems, with various components affected, along with various levels of severity.

One of the more notable Critical level vulnerabilities (CVE-2020-1192) which affects Visual Studio Code could impact a large amount of users using this popular editor. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.

Other critical vulnerabilities include:

CVE-2020-1069

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server.

CVE-2020-1023

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.

CVE-2020-1024

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.

CVE-2020-1102

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.

Two other products had a relatively decent number of vulnerabilities impacting them as well, including Microsoft Sharepoint (Enterprise Server 2013 and Enterprise Server 2016) and Internet Explorer 11 (Windows 10 32-bit Systems), with 12 and 6 vulnerabilities impacting these products respectively. Three of the vulnerabilities impacting Sharepoint were rated as Critical due to allowing remote code execution capabilities

Breach Disclosure: Ulmon

Travel app creator Ulmon has experienced a data breach involving a leak of over 1.3 million user records. This breach appears to date back to January 2020. The stolen user account information includes usernames, email addresses, hashed passwords (only strongly bcrypt encrypted/hashed passwords have been stolen) and, in some cases, Twitter names, Facebook account URLs, telephone numbers, and user “about” texts. Ulmon has confirmed the breach and has notified the affected users via email.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On April 27, 2020, Ulmon became aware of a data breach. An unauthorized party stole data associated with certain Ulmon user accounts in January 2020. The service had almost 1.3M records with 777k unique email addresses, names, passwords stored as bcrypt hashes and in some cases, social media profile IDs, telephone numbers and bios exposed to the hackers. The data was subsequently posted for sale to a popular hacking forum.

Figure 1: Breached data offered for sale on a hacking forum.

Breaking News: 2020-05-08 - 2020-05-14

India's Covid-19 Contact Tracing App Could Leak Patient Locations

An independent security researcher has discovered that Aarogya Setu, a smartphone app that can help to track the spread of Covid-19, created by the Indian government's National Informatics Centre, could reveal the location of Covid-19 patients not only to government authorities but also to any hacker who can exploit the flaws that reside in it. The one feature of the app, designed to let users check if there are infected people nearby, instead allows users to spoof their GPS location and learn how many people reported themselves as infected within any 500-meter-radius. In areas that have relatively sparse reports of infections, the hackers could even use the so-called triangulation attack to confirm the diagnosis of someone they suspect to be positive.

See the full report here: https://www.wired.com/story/india-covid-19-contract-tracing-app-patient-location-privacy/

Malicious Bots Infiltrate Online Food Delivery

As the demand for online grocery shopping has risen during the Covid-19 pandemic, new add-ons have emerged that purport to secure slots for users. These add-ons perform functions like scanning for and alerting users to delivery slots and completing the checkout. However, they can inadvertently present a new pathway for malicious bots to harvest the user's information. The installed browser extensions could be infected or malicious, harvesting personally identifiable information for future use, or logging keystrokes to get passwords and account numbers.

See the full report here: https://www.darkreading.com/cloud/malicious-bots-infiltrate-online-food-delivery-/d/d-id/1337773

Tokopedia and Microsoft Breach Broker selling fresh trove of 26 million accounts

ZeroFOX security researchers have identified three high-profile databases that were being sold on the Dark Web by a threat actor named ShinyHunters. The three leaked databases belong to a meal kit delivery service HomeChef, photo print service ChatBooks, and a news source for higher education, Chronicle[.]com. The HomeChef breach contains 8 million records that expose emails, bcrypt passwords, IP addresses, and several columns of PII such as last 4 of social security numbers, zip codes, and phone numbers. The Chatbooks breach contains 15 million rows of data, exposing emails, SHA-512 password hashes, social media access tokens and other personally identifiable information. The Chronicle[.]com breach contains 3 million records, however, no sample data was posted. Collectively, the three databases reveal nearly 26 million accounts, ranging between an ask price of $1,500 and $2,500.

See the full report here: https://www.zerofox.com/blog/shinyhunters-breach/

Ruhr University Bochum shuts down main servers after cyberattack - BleepingComputer

The Ruhr University Bochum (RUB), Ruhr-Universität Bochum in German, suffered a cyberattack between May 6 and May 7, impacting most of its operations. Following the incident, the University had to shut down large parts of its central IT infrastructure, including the backup systems. The University said that they do not have any evidence if data belonging to students, employees, or researchers was accessed or exfiltrated, or if any of their systems were infected with a malware strain. However, the investigation is in place and the University is working on bringing back its systems online.

See the full report here: https://www.bleepingcomputer.com/news/security/ruhr-university-bochum-shuts-down-main-servers-after-cyberattack/

SilverTerrier BEC scammers target US govt healthcare agencies - BleepingComputer

Security researchers from Palo Alto's Unit 42 have uncovered Business Email Compromise (BEC) phishing campaigns coordinated by multiple Nigerian BEC actors tracked as "SilverTerrier" who use COVID-19 themed lures. The phishing emails sent by the actors behind these BEC campaigns also dropped hundreds of samples of Agent Tesla, NanoCore remote access trojans, LokiBot, Formbook info stealers, as well as PowerShell scripts that would later download malicious payloads on victims' devices. The SilverTerrier BEC attacks also use a Microsoft Office memory corruption vulnerability (CVE-2017-11882 ) to execute code remotely and infect their targets with malware payloads downloaded from attacker-controlled servers.

See the full report here: https://www.bleepingcomputer.com/news/security/silverterrier-bec-scammers-target-us-govt-healthcare-agencies/

Unemployed Americans offered 'remote jobs' as money mules - BleepingComputer

Security Researchers have discovered a new phishing campaign that is exploiting the increasing number of layoffs during the current pandemic to recruit new money mules. The attackers are using remote job lures to convince targets from Canada and the United States who might have lost their jobs due to the COVID-19 outbreak, promising them $5,000 per month. The potential victims are not provided with any other information regarding what the remote jobs require but are instead asked to request more information via email. Last month, the FBI warned about cybercriminals behind the money mule scheme increasingly exploiting the public fear and uncertainty surrounding the COVID-19 pandemic. To prevent falling victim to such phishing attacks, people are advised to verify the authenticity of suspicious emails before interacting with them.

See the full report here: https://www.bleepingcomputer.com/news/security/unemployed-americans-offered-remote-jobs-as-money-mules/

Blue Mockingbird Monero-Mining Campaign Exploits Web Apps

A known vulnerability (CVE-2019-18935) found in the Progress Telerik UI front-end offering for ASP.NET AJAX is actively being exploited, in a campaign dubbed Blue Mockingbird by cybercriminals to achieve remote code execution before moving laterally through the enterprise. In the current attacks, Blue Mockingbird attackers are uncovering unpatched versions of Telerik UI for ASP.NET, deploying the XMRig Monero-mining payload in a dynamic-link library (DLL) form on Windows systems, then executing it and establishing persistence using multiple techniques. Researchers recommend that patching the vulnerable web servers, web applications and dependencies of the applications can help mitigate the risks.

See the full report here: https://threatpost.com/blue-mockingbird-monero-mining/155581/

Cisco Fixes High-Severity Flaws In Firepower Security Software, ASA

Ciscos's Adaptive Security Appliance software and Firepower Threat Defense software contain flaws that can be exploited by unauthenticated remote attackers to launch attacks varying from denial of service (DoS) to information disclosure. The most severe flaw exists in the web service interfaces for ASA software and FTD software. This bug (CVE-2020-3187) could allow an unauthenticated, remote attacker to conduct directory traversal attacks. Cisco has patched nearly 12 flaws impacting its ASA and FTD software in its latest security update. Users are advised to apply the relevant patches at the earliest.

See the full report here: https://threatpost.com/cisco-fixes-high-severity-flaws-in-firepower-security-software-asa/155568/

US Marshals Service exposed prisoner details in security breach

The US Marshals Service (USMS) has suffered a security lapse last year and is now notifying inmates that some of their personal details might have been exposed online. The incident came into light on December 30, 2019, when the USMS Information Technology Division (1TD) received an alert from the Department of Justice Security Operations Center (JSOC) about a breach of a public-facing USMS server that housed information on current and former USMS prisoners, including data such as names, dates of birth, social security numbers, and home addresses. It is currently unclear how many current or former inmates had their data exposed, what kind of server was breached, the nature of the breach, or if the intrusion also affected the USMS' internal IT systems.

See the full report here: https://www.zdnet.com/article/us-marshals-service-exposed-prisoner-details-in-security-breach/

Twitter warns of legacy site theme shutting down on June 1 - BleepingComputer

Twitter has warned that it is going to shut down the legacy version of Twitter[.]com on June 1, 2020. The users who are using the tricks to impersonate Internet Explorer 11 which is unsupported into displaying original legacy versions are requested to switch to a supported browser i.e Firefox, Edge, Safari, and Google Chrome or disable the extension which masks the browser.

See the full report here: https://www.bleepingcomputer.com/news/technology/twitter-warns-of-legacy-site-theme-shutting-down-on-june-1/

DigitalOcean Data Leak Incident Exposed Some of Its Customers Data

DigitalOcean, one of the biggest modern web hosting platforms has recently suffered a data breach that exposed some of its customers' data. The company has not publicly released a statement yet but it has started to warn the affected customers via an email. According to the breach notification, the leak happened due to negligence where DigitalOcean unintentionally left an internal document accessible to the Internet without requiring any password which contained customer's email address and/or account name as well as some data about customer's account that may have included Droplet count, bandwidth usage, some support or sales communications notes, and the amount customer paid during 2018. However, the document was taken down.

See the full report here: https://thehackernews.com/2020/05/digitalocean-data-breach.html

REvil ransomware threatens to leak A-list celebrities' legal docs - BleepingComputer

Sodinokibi also called REvil ransomware group allegedly hacked Grubman Shire Meiselas & Sacks (GSMLaw) and threatened to release hundreds of gigabytes of legal documents. GSMLaw is based in New York, a prominent entertainment and law firm that counts dozens of international stars as their clients. To support their claim, the hackers published a screenshot of the folders they have and they said that the data includes contracts, phone numbers, email addresses, personal correspondence, non-disclosure agreements.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-threatens-to-leak-a-list-celebrities-legal-docs/

DocuSign Phishing Campaign Uses COVID-19 as Bait

Researchers at Abnormal Security has discovered a new phishing campaign that targets DocuSign users on Office 365. The coronavirus quarantine has forced more people to work remotely, which increased the demand for a service like DocuSign. The phishing email using legit DocuSign images and contents to convince the victims to open the COVID-19 document review link. The link redirects to a malicious page, attempting to capture DocuSign credentials as well as business email addresses.

See the full report here: https://www.darkreading.com/attacks-breaches/docusign-phishing-campaign-uses-covid-19-as-bait/d/d-id/1337776

Mac RAT Rides 2FA App Onto Systems

Security researchers at Malwarebytes have discovered a new variant of Dacls remote access Trojan (RAT) that targets macOS. The RAT infects on the victim's computer through MinaOTP, a Trojanized two-factor authentication application. Dacls RAT is associated with North Korea's Lazarus Group, also known as Hidden Cobra and APT 38.

See the full report here: https://www.darkreading.com/attacks-breaches/mac-rat-rides-2fa-app-onto-systems/d/d-id/1337770

A hacker group is selling more than 73 million user records on the dark web

A hacker group that goes by the name ShinyHunters, claims to have breached ten companies and is currently selling their respective user databases on a dark web marketplace. The listed databases total for 73.2 million user records, which the hacker is selling for around $18,000, with each database being sold separately. The group has also shared samples from some of the stolen databases. The authenticity of the exposed data yet to be verified. Multiple sources in the threat intel community believe that ShinyHunters is a legitimate threat actor.

See the full report here: https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/

Microsoft adds protection against Reply-All email storms in Office 365

Microsoft has rolled out new features to Office 365 customers that detect and stops Reply-All email storms. This situation occurs when employees use the Reply-All option in mass-mailed emails, such as company-wide notifications. This generates massive amounts of traffic that usually slows down or crashes email servers. Reply All Storm Protection feature will block all email threads with more than 5,000 recipients that have generated more than 10 Reply-All sequences within the last 60 minutes. Once the feature gets triggered, Exchange Online will block all replies in the email thread for the next four hours, helping servers prioritize actual emails and shut down the Reply-All storm.

See the full report here: https://www.zdnet.com/article/microsoft-adds-protection-against-reply-all-email-storms-in-office-365/

Microsoft Edge is getting a new feature to reduce web spam - BleepingComputer

The new version of Microsoft Edge will allow users the ability to hide pesky browser notification dialog boxes that are commonly used by websites to push their content, or even spam, on visitors. Browser notifications allow websites to ask visitors if they would like to sign up to receive notifications of new content. The websites can then push content to subscribers via the browser, even when a visitor is not on the website or when the browser is not being used. Lately, this tactic is being widely used by scam sites to stream unwanted advertisements associated with online dating sites, browser extensions, adult sites, web games, and even malware. The new feature called Quiet notification requests to the Edge browser will allow users to block all browser notification dialogs.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-is-getting-a-new-feature-to-reduce-web-spam/

Kids horrified as hacker streams obscene video during Zoom class

A hacker streamed child sex abuse footage when about 60 children were participating in a fitness class over video meet app Zoom in Plymouth in southwest England. The incident occurred when the class was being hosted this week by a sports club in Plymouth. According to local police, an unknown hacker gained access after the Zoom call’s details were published on online forums. Recently, the US Federal Bureau of Investigation (FBI) warned people about porn material being popped up during the Zoom video meetings.

See the full report here: https://www.siasat.com/kids-horrified-hacker-streams-obscene-video-during-zoom-class-1886769/

Microsoft Reportedly in Talks to Acquire CyberX

The U.S. software giant Microsoft is expected to announce the acquisition of Israeli cybersecurity startup CyberX for $165 million. Earlier this year, CyberX announced a new API-level integration with Microsoft Azure Security Center for IoT, giving customers of both the ability to view security across managed and unmanaged IoT devices. The company also confirmed it had joined the Microsoft Intelligent Security Association, a group of companies that integrated their technology with Microsoft tools. Microsoft and CyberX declined to comment on the acquisition.

See the full report here: https://www.darkreading.com/threat-intelligence/microsoft-reportedly-in-talks-to-acquire-cyberx/d/d-id/1337751

15-year-old hacker and crew of ‘evil geniuses’ accused of $24 million crypto theft - The Boston Globe

A cryptocurrency investor has accused a group of teenagers of conducting multimillion-dollar cyber heists. Michael Terpin, the founder and CEO of Transform Group accused Pinsky and his gang of digital bandits of stealing $24m as part of a sophisticated cybercrime spree. According to Terpin, the criminals gained access to his mobile phone number and took control of his cryptocurrency accounts. Although these accounts were protected with two-factor authentication, the authentication method, using codes texted by SMS, rather than being generated through an app, allowed hackers to intercept the texts.

See the full report here: https://www.bostonglobe.com/2020/05/08/business/15-year-old-hacker-crew-evil-geniuses-accused-24-million-crypto-theft/

Naikon APT Targeting Seven APAC Governments via a New Backdoor

A China-based group has quietly carried out cyber-espionage against governments within Australia, Indonesia, Philippines, Vietnam, Thailand, Myanmar, and Brunei through "government-to-government" attacks. According to Check Point, Naikon APT hacking group specifically targets government ministries of foreign affairs, science, and technology, as well as government-owned companies. The threat actors deploy multiple methods through which they achieve the planting of the Aria-body backdoor onto their targets. Activity attributed to the Naikon has been spotted for the first time after 2015.

See the full report here: https://www.technadu.com/naikon-apt-targeting-7-apac-governments-via-new-backdoor/101325/

Microsoft Offer $100,000 To Hack Azure Sphere Linux IoT OS Using RCE Exploits

Microsoft has announced a bounty of $100,000 to hack its very first Linux-based operating system focused on the Internet of Things (IoT). The Azure Sphere is a combination of secure, connected, crossover microcontroller unit (MCU) and a custom high-level Linux-based operating system. Microsoft will test the security of Azure Sphere OS by letting hackers breach the Pluton security system or Secure World sandbox, and reward the successful hacker. The bug bounty program is scheduled from June 1 until August 31, which is a part of the three-month research program.

See the full report here: https://gbhackers.com/azure-sphere-linux/

Sodinokibi ransomware can now encrypt open and locked files - BleepingComputer

The Sodinokibi (REvil) ransomware is updated to encrypt victim's files, even those that are opened and locked by another process. According to the researchers at Intel471, Sodinokibi is now using the Windows Restart Manager API. The Restart Manager enables all but the critical system services to be shut down and restarted. This frees files that are in use and allows installation operations to complete. The Sodinokibi (REvil) ransomware is using this API to close processes or shut down Windows services keeping a file open during encryption.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-can-now-encrypt-open-and-locked-files/

Microsoft and Intel project converts malware into images before analyzing it

Microsoft and Intel have collaborated on a new research project called STAMINA (STAtic Malware-as-Image Network Analysis), involving a new technique that converts malware samples into grayscale images and then scans the image for textural and structural patterns specific to malware samples. STAMINA consists of a few simple steps, such as taking an input file and converting its binary form into a stream of raw pixel data and converted it into a 2D photo so that normal image analysis algorithms can analyze it. After assembling the raw pixel stream into a normal-looking 2D image, researchers then resized the resulting photo to a smaller dimension. The resized images were then fed into a pre-trained deep neural network (DNN) that scanned the image (2D representation of the malware strain) and classified it as clean or infected. According to the researchers, STAMINA achieved an accuracy of 99.07% in identifying and classifying malware samples, with a false positives rate of 2.58%.

See the full report here: https://www.zdnet.com/article/microsoft-and-intel-project-converts-malware-into-images-before-analyzing-it/

Law Firm Representing Lady Gaga, Madonna, Bruce Springsteen, Others Suffers Major Data Breach - Variety

Grubman Shire Meiselas & Sacks, a large media and entertainment law firm, allegedly fell victim to a cyberattack, resulting in the theft of private information of many celebrities, according to a data security researcher. The stolen data was posted on the dark web by a popular ransomware gang, who claim to have stolen nearly 756 gigabytes of data from the law firm. The leaked data included contracts, nondisclosure agreements, phone numbers, and email addresses, and “personal correspondence,” belonging to high profile celebrities including music artists, actors and TV personalities, sports stars, and media and entertainment companies.

See the full report here: https://variety.com/2020/digital/news/entertainment-law-firm-hacked-data-breach-lady-gaga-madonna-bruce-springsteen-1234602737/

Rail vehicle manufacturer Stadler hit by cyberattack, blackmailed - BleepingComputer

Stadler, an international rail vehicle construction company, suffered a cyberattack after attackers managed to infiltrate its IT network and infect some of its machines with malware and, possibly steal company and employee data from the compromised devices. The incident impacted the entire Stadler group, including locations from Switzerland and abroad. Following the incident, Stadler took measures to contain the damage and claims to have backups for the affected data and that it is working on restarting and, potentially, restoring the impacted systems. However, the threat actors are demanding a large ransom and are attempting to blackmail the company by threatening to leak stolen data.

See the full report here: https://www.bleepingcomputer.com/news/security/rail-vehicle-manufacturer-stadler-hit-by-cyberattack-blackmailed/

Unpatched Bugs in Oracle iPlanet Open Door to Info-Disclosure, Injection

Oracle’s iPlanet Web Server is vulnerable to sensitive data exposure and image injections flaws. Tracked as CVE-2020-9315 and CVE-2020-9314, these flaws that could allow attackers to obtain read-only access to any page within the administration console without authentication and replace any URL for any page within the administration console. The bugs reside in the web administration console of iPlanet version 7, which has reached end-of-life and is no longer supported. Hence, no patch is expected for either flaw. However, according to Nightwatch, users can implement other controls to mitigate the problem and reduce risk, such as restricting network access to the administration console from the internet.

See the full report here: https://threatpost.com/unpatched-bugs-oracle-iplanet/155639/

Thunderbolt Vulnerabilities Could Threaten Millions of PCs

Security researchers have found seven new vulnerabilities in Intel's Thunderbolt port design and created nine attack scenarios in which someone could bypass defenses and read and copy data on a target machine, leaving millions of computers exposed to attackers. An attacker would need physical access to a Thunderbolt-enabled Windows or Linux system, a screwdriver, and a few off-the-shelf tools to pull this off. Even so, the attack is stealth, meaning a victim would not notice any traces of activity and it does not require any user interaction. Intel has confirmed the vulnerabilities and advises following standard security practices, including the use of only trusted peripherals and blocking unauthorized physical access to prevent exposure to the "Thunderspy" attack that affects Windows and Linux devices manufactured pre-2019.

See the full report here: https://www.darkreading.com/endpoint/thunderbolt-vulnerabilities-could-threaten-millions-of-pcs/d/d-id/1337789

An Undisclosed Critical Vulnerability Affect vBulletin Forums — Patch Now

The vBulletin software is vulnerable to an undisclosed critical flaw originated from an incorrect access control affecting versions before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1, according to NVD. vBulletin has released an important patch update but didn't reveal any information on the underlying security vulnerability, identified as CVE-2020-12720. Forum administrators are urged to install respective patches as soon as possible.

See the full report here: https://thehackernews.com/2020/05/vBulletin-access-vulnerability.html

Maze ransomware fails to encrypt Pitney Bowes, steals files - BleepingComputer

Maze operators have published multiple screenshots of directories on Pitney Bowes computers after they managed to steal some data as Pitney Bowes stopped the Maze ransomware attack before the encryption routine could be deployed. From the screenshots published by Maze to prove that they stole data from the company, the actor had access to folders with company reports, forecasts, operating expenses, meetings' agendas, and calendars of customer operations. Pitney Bowes said that there is no evidence of further unauthorized access to the company's IT systems and is currently investigating the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-fails-to-encrypt-pitney-bowes-steals-files/

Sphinx Malware Returns to Riddle U.S. Targets

Sphinx malware has seen a recent resurgence in the United States, with some modifications and using COVID-19 spam as lures to take advantage of the interest and news around government relief payments. The Zeus Sphinx banking trojan has been upgraded to harvest user credentials and other personal information from online banking sessions, in the process-injection and bot-configuration aspects of the malware’s operations. When infected users land on a targeted online banking portal, Sphinx dynamically fetches web injections from its command-and-control (C2) server to modify the page that the user sees, so that the information that the user enters into the log-in fields is sent to the cybercriminals.

See the full report here: https://threatpost.com/sphinx-riddle-us-targets-modifications/155621/

Hackers' private chats leaked in stolen WeLeakData database - BleepingComputer

A dump of WeLeakData.com's vBulletin forum database from January 9th, 2020, is available for sale on the dark web, which includes member's login name, email address, hashed passwords, IP addresses that they registered and posted under, and private messages. WeLeakData.com was a hacker forum and marketplace that primarily focused on discussing, trading, and selling databases stolen during data breaches and combolists that are used in credential stuffing attacks. Researchers also claim that this database was later used to launch a new site called Leaksmarket.com, whose forum contains the same posts, private messages, and users that were in the dump.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-private-chats-leaked-in-stolen-weleakdata-database/

WordPress plugin bugs can let hackers take over almost 1M sites - BleepingComputer

Wordfence's Threat Intelligence team has discovered two vulnerabilities in the Page Builder WordPress plugin that could allow hackers to create new admin accounts, plant backdoors, and take over the compromised websites. Page Builder is a popular plugin developed by SiteOrigin to help users easily build responsive grid page content using a widget-based page creating editor and is installed on more than 1,000,000 sites. The vulnerabilities in Page Builder versions up to and including 2.10.15 could allow attackers to trick WordPress site administrators into clicking specially crafted links or attachments and execute malicious code in their browsers, as well as forge requests on their behalf. The development team has released a patch to fix both the vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-plugin-bugs-can-let-hackers-take-over-almost-1m-sites/

Ransomware Hit ATM Giant Diebold Nixdorf

Diebold Nixdorf, a major Ohio-based financial and retail technology company, has suffered a ransomware attack that disrupted some of its operations. According to Diebold, on April 25, 2020, the company’s security team discovered anomalous behavior on its corporate network and immediately disconnected systems on that network to restrain the spread of the malware. According to researchers, the intruders installed the ProLock ransomware to steal information and encrypt the files in the targeted network. The incident affected services for over 100 of the company’s customers but did not affect customer networks or the general public.

See the full report here: https://krebsonsecurity.com/2020/05/ransomware-hit-atm-giant-diebold-nixdorf/

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4000 apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information of their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. Firebase is a popular mobile application development platform that offers a variety of tools to help third-party app developers build apps, securely store app data and files, fix issues, and even engage with users via in-app messaging features. Mobile apps using Google Firebase to store user data are not properly secured, allowing anyone to access databases. Apart from 155,066 apps having publicly exposed databases, the researchers found 9,014 apps with write permissions, thus potentially allowing an attacker to inject malicious data and corrupt the database, and even spread malware.

See the full report here: https://thehackernews.com/2020/05/android-firebase-database-security.html

Healthcare giant Magellan Health hit by ransomware attack - BleepingComputer

Magellan Health Inc. has been hit by a ransomware attack which resulted in temporary systems outage and theft of sensitive and personal information from one of its corporate servers. The company confirmed an unauthorized intrusion where the actor was able to gain access to its systems after sending a phishing email on April 6 that impersonated a Magellan client. The stolen information includes personal information such as name, address, employee ID number, and W-2 or 1099 details such as Social Security number or Taxpayer ID number and, in limited circumstances, may also include usernames and passwords. The company said that they currently do not have any evidence of misuse of the stolen data. Magellan is notifying its customers, employees, and impacted individuals and is investigating the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/healthcare-giant-magellan-health-hit-by-ransomware-attack/

Google removed 813 creepware apps from the Android Play Store

Following a report from a group of academics who developed an algorithm named CreepRank, Google has removed a batch of 813 "creepware" apps from its Android Play Store. The algorithm identifies creepware-like behavior inside mobile apps, and then assigns a creep score to each app, The term creepware refers to mobile apps that don't possess the full features of a spyware or stalkerware product but they can still be used to stalk, harass, defraud, or threaten another person, directly or indirectly. The eliminated apps included apps that enable spoofing (114 apps), harassment (80 apps, including SMS bombers), hacking tutorials (63 apps), and others.

See the full report here: https://www.zdnet.com/article/google-removed-813-creepware-apps-from-the-android-play-store/

On the three-year anniversary of WannaCry, US exposes new North Korean malware

On the third anniversary of the WannaCry ransomware outbreak, US cyber-security officials have published details about three new malware strains, COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH, that have been used by North Korea's government-sponsored hackers to attack targets all over the world. COPPERHEDGE is a remote access trojan (RAT) capable of running arbitrary commands, performing system reconnaissance, and exfiltrating data. TAINTEDSCRIBE is a malware implant (trojan) that's installed on hacked systems to receive and execute the attacker's commands. PEBBLEDASH is a malware that can download, upload, delete, and execute files, enable Windows CLI access, create and terminate processes, and perform target system enumeration. The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS CISA) has published official advisories addressing these malware strains on its website.

See the full report here: https://www.zdnet.com/article/on-the-three-year-anniversary-of-wannacry-us-exposes-new-north-korean-malware/

Anubis Malware Upgrade Logs When Victims Look at Their Screens

The Anubis malware, a banking trojan that targets Google Android apps and devices, is updated to allow the malware to identify if a victim is looking at his or her screen. According to the researchers, this new feature has not been released in the wild yet but is a part of an updated control panel for the malware that’s currently in development. The new feature is a small eyeball icon included in the control panel that can be used to recognize whether a user of a device with Anubis installed is looking at the device or not. This can prevent an attacker from performing nefarious activities on the device while the person is looking at it. According to reports, Anubis operators are also developing a way to integrate Yandex maps into the malware to show the location of infected devices.

See the full report here: https://threatpost.com/anubis-malware-upgrade-victims-screens/155644/

SAP May 2020 Security Patch Day delivers critical updates - BleepingComputer

Enterprise software maker SAP has released its May security patches which cover six critical issues, three of them with a severity score very close to maximum. All but one of these flaws are remotely exploitable, require no user interaction, and have a low attack complexity. SAP customers are strongly recommended to apply May month's patches, available via the company's support portal.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-may-2020-security-patch-day-delivers-critical-updates/

US govt shares list of most exploited vulnerabilities since 2016 - BleepingComputer

US government cybersecurity agencies and specialists have released a list of the top 10 routinely exploited security vulnerabilities between 2016 and 2019. Cybersecurity and Infrastructure Security Agency (CIA) says that, of the top 10, the three vulnerabilities used most frequently across state-sponsored cyber actors from China, Iran, North Korea, and Russia are CVE-2017-11882, CVE-2017-0199, and CVE-2012-0158 and these vulnerabilities are related to Microsoft’s OLE technology. In 2020, the attackers were exploiting unpatched Citrix VPN (CVE-2019-11510) and Pulse Secure VPN (CVE-2019-19781) vulnerabilities because of remote working caused by the COVID-19 pandemic. The attackers also took advantage of hasty deployments of cloud collaboration services like Microsoft Office 365.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-shares-list-of-most-exploited-vulnerabilities-since-2016/

WordPress Page Builder Plugin Bugs Threaten 1 Million Sites with Full Takeover

Page Builder by SiteOrigin, a WordPress plugin with a million active installs that are used to build websites via a drag-and-drop function, has two flaws that can allow full site takeover. According to researchers at WordPress, both security bugs can lead to cross-site request forgery (CSRF) and reflected cross-site scripting (XSS) which allow attackers to forge requests on behalf of a site administrator and execute malicious code in the administrator’s browser. Both flaws are assigned with a severity rating of 8.8 out of 10 but no CVEs have yet been assigned. It is recommended that admins should upgrade their plugins to version 2.10.16 to avoid full site takeover.

See the full report here: https://threatpost.com/wordpress-page-builder-bugs-takeover/155659/

Astaroth malware hides command servers in YouTube channel descriptions - ZDNet

The Astaroth malware has evolved into one of today's stealthiest malware strains, with anti-analysis and anti-sandbox checks to prevent detection. The malware is now using YouTube channel descriptions to hide the URL for its command and control (C2) servers. According to Talos, after Astaroth infects a victim, the trojan connects to a YouTube channel, from where it retrieves the channel description field, which contains encrypted and base64-encoded text with the URLs of its command and control server. After decoding the text, Astaroth connects to these URLs to receive new instructions and to send stolen information for future storage.

See the full report here: https://www.zdnet.com/article/astaroth-malware-hides-command-servers-in-youtube-channel-descriptions/

New Ramsay malware steals files from air-gapped computers - BleepingComputer

ESET researchers have discovered multiple samples of a new malware toolkit called Ramsay that can collect sensitive files from systems isolated from the internet. The malware lands on a victim's computer via a malicious RTF file and scans removable drives and network shares for Word documents, PDF files, and ZIP archives. There are three variants of this ransomware, v1, v2.a, and v2.b. All variants analyzed by ESET collect all Microsoft Word documents on the file system of the target computer. Additionally, newer versions also search for PDF files and ZIP‌ archives on network drives and removable drives. Researchers believe that the Ramsay framework is still under development.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ramsay-malware-steals-files-from-air-gapped-computers/

PrintDemon vulnerability impacts all Windows versions

Security researchers have discovered a vulnerability (CVE-2020-1048) in the Windows printing service that impacts all Windows versions going back to Windows NT 4, released in 1996. The vulnerability is dubbed PrintDemon and resides in the primary Windows component responsible for managing print operations, Windows Print Spooler. This local privilege escalation vulnerability can allow the attacker to run unprivileged PowerShell command to gain administrator-level privileges over the entire OS. The attacker can initiate the print operation, crash the Print Spooler service intentionally, by running the printing operation with SYSTEM privileges, allowing it to overwrite any files anywhere on the OS. Microsoft has released a fix for PrintDemon in its latest security update.

See the full report here: https://www.zdnet.com/article/printdemon-vulnerability-impacts-all-windows-versions/

Giant Food Warns Customers of Potential Credit Data Breach - W7 News

Supermarket chain Giant Food is warning its customers of a potential data breach after the detection of an illegal card-reading device in one of its stores in D.C. The company said that it took immediate security measures, including reviewing video surveillance, contacting law enforcement, and reaching out to a third-party forensic investigator. The breached information possibly exposed the names of cardholders, their payment account numbers, as well as the expiration dates of some customers who used the impacted self-checkout terminal for a limited time before March 5. Giant Food says that it has not yet found any evidence of the attackers misusing the impacted information and is currently investigating the issue.

See the full report here: https://w7news.com/giant-food-warns-customers-of-potential-credit-data-breach/