Threat Intelligence Bulletin: 05/15/2020 - 05/21/2020

40 Million Wishbone Users’ Information for Sale on Dark Web

The social quiz platform Wishbone has been breached for the second time in three years. A new breach broker using the alias “Megadimarus” is offering a database of over 40 million users for sale on a hacking forum. In addition to the Wishbone breach, this actor is selling breach dumps that include sensitive information related to over 2,000,000,000 compromised accounts.

Recommendations

• Enable two-factor authentication for all of your organization’s accounts to help prevent phishing and credential stuffing attacks.
• Monitor your assets on your network and shut down any internet-facing services that aren’t required to be public-facing.
• ZeroFOX customers are advised to closely monitor their compromised credentials, network scanning, and entity-based alerts for illegitimate activity.

Details

ZeroFOX Alpha Team identified an actor who is allegedly selling a database of over 40,000,000 users of the social media app, Wishbone.io. This actor has posted the details for sale on a popular cybercrime and breach forum:

Figure 1: Wishbone breach dump sale ad.

This isn’t the first time Wishbone has experienced a major breach. In 2017, the site exposed 2.2 million email addresses and 287,000 cell phone numbers. A mere three years later, Wishbone is targeted again. Except, the 2020 breach has almost 20 times the amount of exposed accounts.

The threat actor claims that today’s breach is separate from 2017’s breach, and that the data was obtained this year. For data on 40,000,000 Wishbone user profiles, the actor is asking for $8,000 USD. The data inside includes email addresses, names, usernames, phone numbers, geographic locations, genders, social media profiles and SHA1 hashed passwords.

Megadimarus’ Impact Goes Beyond the Wishbone Breach

The Wishbone breach is just one of many breach dumps offered for sale by this actor. As of May 20, 2020, the user has made 55 “for sale” posts since May 1, 2020. The profile is selling some older breaches, but the Wishbone breach and several others appear to be new datasets.

In total, these 55 breach sale posts include over 2,000,000,000 compromised accounts. These include older breaches and potential combolists. Some users have noted that not all of these sales are private, and may not be unique to this particular seller.

Figure 2: A forum user notes that the Tokopedia breach was offered for sale earlier in the month by the ShinyHunters group.

Conclusion

Without verification from the breached company, it is hard to accurately identify the legitimacy of the data. Large data breaches can be effective tools for cybercriminals, however.

The breached data contains SHA-1 hashed passwords. SHA-1 is a known insecure cryptographic hashing algorithm, where the search space of a hash can be attacked and reduced, undermining the security of the algorithm. Secondly, SHA-1 can be dangerous due to its inherent speed of generating output hashes. Crackers use a combination of techniques to effectively reverse these hashes into passwords at a much higher rate than other, safer cryptographic hashing algorithms.

Cracked passwords from these breaches can then be used for credential stuffing and targeted attacks. Other data inside the breach can be used for spamming, whether via email or SMS, and traded, repackaged and used for phishing and malware attacks.

Breaking News: 2020-05-15 - 2020-05-21

New Microsoft 365 sign-in pages already spoofed for phishing - BleepingComputer

Microsoft stated that their Azure AD and Microsoft 365 sign-in pages, was updated at the end of February, have already been spoofed by attackers to adapt their phishing campaigns to use the newly updated design and trick victims into opening booby-trapped attachments and hand over their sensitive information on phishing landing pages. In one of these recent phishing campaigns, attackers are delivering phishing emails with the 'Business Document Received' subject line and PDF attachments that attempt to pass as OneDrive documents that require the potential victims to sign in for viewing. Upon clicking the 'Access Document' button on the PDF file, victims are redirected to a phishing landing page that perfectly mimics the new Azure AD and Microsoft 365 sign-in page design.

See the full report here: https://www.bleepingcomputer.com/news/security/new-microsoft-365-sign-in-pages-already-spoofed-for-phishing/

ProLock Ransomware teams up with QakBot trojan for network access - BleepingComputer

Security researchers have presented ProLock ransomware's tactics, techniques, and procedures (TTP), to understand the malware and defend against it. ProLock uses QakBot (QBot) for distribution and access via public-facing remote desktop (RDP) servers. Researchers reveal that both QakBot and ProLock rely on PowerShell to get the payload running. If ProLock operators use RDP access to reach their victim, persistence is established using valid accounts and lateral movement activity begins after the operators obtain credentials to some servers. The ransomware is then deployed using the command-line interface for Windows Management Instrumentation (WMI). After exfiltration, a PowerShell script is executed to extract the ProLock binary embedded in an image file and unleash it across the enterprise network to encrypt data on reachable systems. Each encrypted file is appended with extensions .proLock, .pr0Lock, .proL0ck, .key, or .pwnd, and recovery instructions are provided in a text file dropped in every folder.

See the full report here: https://www.bleepingcomputer.com/news/security/prolock-ransomware-teams-up-with-qakbot-trojan-for-network-access/

Microsoft Patch for Reverse RDP Flaw Leaves Room for Other Attacks

Security researchers at Checkpoint found that the second patch issued by Microsoft in February, addresses the vulnerability in the RDP client itself, it does not fix the problem in an associated application programming interface (API) that triggered the problem. As a result, attackers can still take advantage of the original underlying issue to access sensitive information on a system, modify critical files, steal password files, expose source code of Web applications, and carry out other malicious tasks. The security vendor said it had contacted Microsoft about the issue but it had not received any comment from the company. It is recommended that IT staff in large enterprises that use Windows should install Microsoft's February Patch (CVE 2020-0655) to make sure their RDP client is protected. However, it is also advised that all programs that include the API function in question are still vulnerable to a path traversal attack.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/microsoft-patch-for-reverse-rdp-flaw-leaves-room-for-other-attacks-/d/d-id/1337828

Scammers steal $10 million from Norway's state investment fund - BleepingComputer

Norfund, Norway’s state investment fund has lost $10 million after hackers tricked them into a business email compromise scam. The robbery occurred on March 16 when a microfinance institution in Cambodia was supposed to receive a loan of $10 million, but the money was sent to an account in Mexico, controlled by the fraudsters. The scammers created a Norfund email address to impersonate an individual authorized to wire large sums of money through DNB, the bank Norfund uses for these operations. Norfund discovered the scam on April 30, when the attackers tried to rob Norfund again, but this time the intrusion was detected and stopped.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-steal-10-million-from-norways-state-investment-fund/

Coronavirus hospital construction firms hit with cyber attacks

Two companies, Bam Construct and Interserve, involved in the construction of emergency hospitals for the coronavirus outbreak in the UK, suffered a cyberattack after attackers managed to break into a human resources database which contained personal details belonging to up to 100,000. The incident potentially exposed sensitive data such as employee names, addresses, bank details, payroll information, next of kin details, HR records, dates of absences, and pension information.

See the full report here: https://www.itpro.co.uk/security/cyber-attacks/355651/cyber-criminals-target-coronavirus-hospital-construction-companies

New software enables existing sensors to detect ransomware

Engineers from SMU’s Darwin Deason Institute for Cybersecurity have developed software that can detect ransomware attacks, including zero-day ransomware attacks. The software uses a sensor-based ransomware detection method which searches for small, yet distinguishable changes in certain sensors that are found inside computers to detect when unauthorized encryptions take place. When attackers try to encrypt files, certain circuits inside the computer will have specific types of power surges as files are scrambled. The computer sensors detect these specific types of surges and the software immediately alerts the computer to suspend or terminate the ransomware infection from completing the encryption process.

See the full report here: https://www.helpnetsecurity.com/2020/05/15/software-detect-ransomware/

UK electricity middleman hit by cyber-attack

Elexon, a crucial middleman in the UK power grid network, has fallen victim to a cyberattack. The company said that the incident affected its internal IT network, employee laptops as well as the company's email server, which was taken down later. Systems that managed the UK's electricity transit were unaffected. The company claims to have identified the root cause of the incident and is working to restore its internal network.

See the full report here: https://www.zdnet.com/article/uk-electricity-middleman-hit-by-cyber-attack/

New COMpfun malware variant gets commands from HTTP error codes - BleepingComputer

Security researchers at Kaspersky have discovered a new variant of COMpfun remote access trojan (RAT). COMpfun is controlled using HTTP status codes and was used in attacks targeting European diplomatic entities. The malware variant comes with all the capabilities of a RAT malware. Once it infects a target's system, it harvests geolocation info, system data, logs window titles, all keystrokes on compromised systems, and take screenshots that allow it to capture sensitive information from the victim's screen. The most interesting feature is the HTTP status-based communication module which allows the malware operators to bypass detection. Depending on the HTTP status code received by systems infected with COMpfun malware, the attackers can request them to exfiltrate all the collected data to the C2 server, to gain persistence, fingerprint the hosts, enumerate network resources, propagate to USB removable devices, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/new-compfun-malware-variant-gets-commands-from-http-error-codes/

Ransomware gang asks $42m from NY law firm, threatens to leak dirt on Trump

REvil ransomware operators have threatened Grubman Shire Meiselas & Sacks (GSMS), a New York-based law firm to release sensitive files on the company's celebrity clients. The extortion attempt is the result of a ransomware infection that GSMS suffered last week. The hackers gave the company a week to negotiate and pay the ransom and as the time expired last night, the hackers have posted a second message on their website. The gang said that GSMS offered to pay only $365,000 of the $21 million they asked, and as a result, they have now doubled the ransom demand to $42 million. Furthermore, as the company failed to pay in time, the REvil gang released a 2.4 GB archive containing Lady Gaga legal documents and also threatened to release files related to US President Donald Trump.

See the full report here: https://www.zdnet.com/article/ransomware-gang-asks-42m-from-ny-law-firm-threatens-to-leak-dirt-on-trump/

Templates Make Coronavirus Phishing Campaigns Easy

Security researchers have come across ready-made website templates that make it simple for criminals to create fake government and NGO websites for COVID-19 related phishing campaigns. Using the templates, the criminals can quickly create high-quality, malicious web domains that mimic key government agencies and non-government organizations involved in fighting COVID-19. In most cases, the look-alike website is a trap for credential mining, capturing information that can be used for identity theft, financial fraud, and enterprise system intrusion.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/templates-make-coronavirus-phishing-campaigns-easy/d/d-id/1337837

WordPress malware finds WooCommerce sites for Magecart attacks - BleepingComputer

Security researchers from Sucuri have discovered a new WordPress malware used by threat actors to scan for and identify WooCommerce online shops. WooCommerce is an open-source WordPress plugin with over 5 million active installs. The hackers are taking advantage of security vulnerabilities found in WordPress plugins to hack WooCommerce-based webshops and install this new malware in the form of a malicious PHP script. By exploiting these flaws, hackers get access to the e-store's internal structure, discover if the site is using the WooCommerce platform, and later collect and exfiltrate info about the WooCommerce installation to attacker-controlled servers.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-malware-finds-woocommerce-sites-for-magecart-attacks/

Hoaxcalls Botnet Exploits Symantec Secure Web Gateways

Security researchers at Palo Alto Networks’ Unit 42 have discovered that attackers are targeting post-authentication remote code-execution vulnerability in unpatched Symantec Secure Web Gateway version 5.0.2.8, which is a product that became end-of-life (EOL) in 2015 and end-of-support-life (EOSL) in 2019 as part of their new Mirai and Hoaxcalls botnet attacks. The Symantec bug was disclosed in March 2020. Since it affects older versions of the gateway it remained unpatched. The vulnerability as mentioned is a post-authentication bug, meaning that the exploit is only effective for authenticated sessions. However, the latest version of the Symantec Web Gateway, version 5.2.8 is not affected by this vulnerability. Hence, updated devices are protected.

See the full report here: https://threatpost.com/hoaxcalls-botnet-symantec-secure-web-gateways/155806/

RATicate Group Hits Industrial Firms With Revolving Payloads

Researchers have discovered a new cybercrime group named RATicate that is using revolving payloads including LokiBot, FormBook, BetaBot, Agent Tesla, and Netwire that leverage Nullsoft Scriptable Install System (NSIS) as an installer to target industrial companies. The group has targetted more than nine companies including an electrical equipment manufacturer in Romania, a Kuwaiti construction services and engineering company, a Korean internet company, and Korean telecommunications and electrical cable manufacturers.

See the full report here: https://threatpost.com/raticate-group-industrial-firms-revolving-payloads/155775/

Hundreds of thousands of Android users hit by Google Play spyware

Researchers from Bitdefender have discovered an Android spyware application named Mandrake that likely to have affected hundreds of thousands of users. The researchers believe that the spyware application was active since 2016 and was left undetected for the last four years. Mandrake was also involved in phishing attacks on applications including Amazon, Gmail, Paypal, Google Chrome, as well as popular cryptocurrency wallet apps such as Lunoor, Coinbase, and numerous banking apps from around the world.

See the full report here: https://www.itpro.co.uk/security/spyware/355664/hundreds-of-thousands-of-android-users-hit-by-google-play-spyware

Critical WordPress plugin bug allows for automated takeovers - BleepingComputer

Attackers can inject malicious code and take over the sites by exploiting a vulnerable WordPress Product Review Lite plugin installed over 40,000 WordPress sites. The plugin provides pre-defined templates which help the site owners to create custom review articles. Researchers have discovered that the website authentication can be bypassed by exploiting the plugin with Cross-Site Scripting attacks. The vulnerability has been fixed and users are advised to update the plugin to its latest version.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-bug-allows-for-automated-takeovers/

Backdoors in recent espionage attempts link to Microcin malware - BleepingComputer

Antivirus has prevented attack attempts to penetrate a governmental institution and corporate networks of two companies in the telecommunications and gas sector. The discovered backdoors in the attack attempts are configured to allow the attacker to modify and delete files, take screenshots, manipulate services and processes, run console commands, and deploy the self-delete routine. The analyzed samples contain links to Micronin malware.

See the full report here: https://www.bleepingcomputer.com/news/security/backdoors-in-recent-espionage-attempts-link-to-microcin-malware/

U.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs

The US Secret Service has issued a warning about a Nigerian crime ring that is exploiting the COVID-19 crisis to commit large-scale fraud against multiple state unemployment insurance programs. The group has been filing unemployment claims in different states using Social Security numbers and other personally identifiable information (PII) from victims conduct identity theft. The targeted states include Washington, North Carolina, Massachusetts, Rhode Island, Oklahoma, Wyoming, and Florida. Financial institutions are advised to stay vigilant to such fraud filings.

See the full report here: https://krebsonsecurity.com/2020/05/u-s-secret-service-massive-fraud-against-state-unemployment-insurance-programs/

APT group targets high profile networks in Central Asia

Antivirus firms have uncovered and foiled an advanced cyber-espionage campaign that targeted governmental institution, telecommunications and gas sectors. The attackers used multiple commodity malware and previously unknown backdoors to remain uncovered for several years. Most of the command-and-control servers used by the attackers are hosted by Choopa, LLC. The use of Gh0st RAT malware attributes to China-linked cyberespionage groups. The researchers discovered three backdoors that collectively tracked as Mikroceen. The backdoors allow hackers to manage the target file system, establish a remote shell, take screenshots, manage services and processes, and run console commands. Attackers use a version of the Mimikatz post-exploitation tool and rely on Windows Management Instrumentation (WMI) for lateral movement. Both Avast and ESET have published a list of indicators of compromise (IoC) for the above threats.

See the full report here: https://securityaffairs.co/wordpress/103321/apt/apt-group-central-asia.html?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-central-asia

Hackers leak over 20,000 unemployment applicants bank information - FOX13 Memphis

The Arkansas Division of Workforce Services was notified of the data breach Friday morning. An applicant got illegal access to the system, discovered the exposed data. According to reports, the social security numbers, bank account, and routing numbers of around 30,000 people have been exposed. The website is temporarily down and a team of experts is investigating the breach and the possible damage.

See the full report here: https://www.fox13memphis.com/news/local/hackers-leak-over-20000-unemployment-applicants-bank-information/OL2CZV7GM5DLLPPI3QTPCHDRNM/

Microsoft is open-sourcing COVID-19 threat intelligence

Microsoft announced it is open-sourcing its COVID-19 threat intelligence to help organizations to repeal Coronavirus-themed attacks. The company will publicly release some of its threat indicators. The indicators are made available via Azure Sentinel GitHub repo and Microsoft Graph Security API. Azure Sentinel customers can import the indicators using a Playbook or access them directly from queries. Microsoft experts have already been sharing examples of malicious lures and have provided guided hunting of COVID-themed attacks through Azure Sentinel Notebooks. Microsoft users are protected against these attacks by Microsoft Threat Protection (MTP), Office 365 ATP, and Microsoft Defender ATP.

See the full report here: https://securityaffairs.co/wordpress/103314/security/ms-covid-19-threat-intelligence.html?utm_source=rss&utm_medium=rss&utm_campaign=ms-covid-19-threat-intelligence

QNodeService Trojan spreads via fake COVID-19 tax relief

Researchers uncovered a new malware dubbed QNodeService that is employed in COVID-19 lure, promising victims' tax relief. The trojan is written in Node.js and is delivered through a Java downloader embedded in the .jar file. QNodeService can perform a broad range of activities, such as download/upload/execute files, steal credentials from Chrome/Firefox browsers, perform file management, steal system information including IP address and location, download additional malware payloads, and exfiltrate stolen data. One of the most interesting features of QNodeService is the support for an “HTTP-forward” command, which allows attackers to download files without connecting to a victim’s computer. The malware only targets Windows systems, but experts believe that developers are working to make it a cross-platform threat.

See the full report here: https://securityaffairs.co/wordpress/103302/malware/qnodeservice-coronavirus-phishing.html?utm_source=rss&utm_medium=rss&utm_campaign=qnodeservice-coronavirus-phishing

What's new in Windows Subsystem for Linux 2.0, coming soon

The Windows Subsystem for Linux (WSL) feature allows you to install and run Linux distributions within Windows 10. Windows Subsystem for Linux 2 (WSL2) is being released soon with the May 2020 Update and comes with new features and performance. According to Microsoft, WSL 2 includes a new architecture that changes how the Linux binaries interact with Windows and hardware. Microsoft says it will update Linux kernel through Windows Updates automatically. The updated WSL will still provide the same user experience as WSL 1. WSL 2 uses virtualization technology to run the Linux kernel within a lightweight utility virtual machine, but it won't be a traditional VM experience with limited resources and reduced integration.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/whats-new-in-windows-subsystem-for-linux-20-coming-soon/

Wannabe ransomware operators arrested before hospital attacks - BleepingComputer

The Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT) arrested a group of individuals that were planning ransomware attacks against healthcare institutions in the country. The criminal group operated under the name PentaGuard Hackers Crew. Authorities say that PentaGuard had file-encrypting malware, remote access trojans (RATs), tools for SQL injection, and website defacement attacks. At the beginning of the year, PentaGuard resurfaced as a group with fewer members and resumed their defacement activity with an agenda of legalizing sex work in Romania. Apart from posts about defacing websites, they also published images with illegal substances and messages about their plan to attack the government of Romania.

See the full report here: https://www.bleepingcomputer.com/news/security/wannabe-ransomware-operators-arrested-before-hospital-attacks/

Celebrity law firm targeted by ransomware group denies Trump was a client - SiliconANGLE

Grubman Shire Meiselas & Sacks suffered a ransomware attack on May 12. REvil, the European hacking group behind the attack, claimed that they had damaging information on the President and demanded a payment of $42 million to not release the stolen data. Subsequently, the group released a tranche of internal emails from the law firm that mostly focused on rights discussions and approvals for videos featuring the President. Though the law firm has confirmed that they have ever worked with President Donald Trump and denied claims by the ransomware group, the hackers continue to persist possession of damaging material that will be released if their payment demand is not met.

See the full report here: https://siliconangle.com/2020/05/17/celebrity-law-firm-targeted-ransomware-group-denies-president-trump-client/

This ‘EventBot’ banking Trojan can steal money from your phone: What should you do - The Indian Express

The Indian Computer Emergency Response Team (CERT-In) has issued a warning against a trojan called EventBot, which can affect the citizens' Android smartphones to steal their personal and financial information. The mobile-banking Trojan is an info-stealer that abuses Android’s in-built accessibility features to steal user data from financial applications, read and interpret users' SMS messages, allowing malware to bypass two-factor authentication. It has targeted over 200 different financial applications, including banking applications, money-transfer services, and cryptocurrency wallets, and financial applications based in the US and European regions. As remote work becomes the norm, organizations are advised to continuously monitor and assess their networks for security vulnerabilities.

See the full report here: https://indianexpress.com/article/technology/tech-news-technology/this-banking-trojan-can-steal-money-from-your-phone-what-should-you-do-6413008/

FBI warns of ProLock ransomware decryptor not working properly - BleepingComputer

The FBI warns of ProLock's defective decryptor which can cause data loss. Files larger than 64MB may become corrupted during the decryption process. Integrity loss of 1 byte per 1KB is possible with files over 100MB and additional work may be needed to make the decryptor work properly, this increases the downtime of an organization even after they meet the actor's demands. With ProLock ransomware leaving no option for recovering the encrypted files without paying backups and ransom demands between $175,000 to over $660,000, it is as serious a threat.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-prolock-ransomware-decryptor-not-working-properly/

CERT-In alerts about Covid-19 related scams

Cert-In warns citizens about the ongoing COVID-19 themed scams that are increasingly attempting to trick people into money fraud via fake charity schemes and steal personal banking information through phishing scams. Scammers are using lures such as fake Zoom, Google Meet, and Microsoft Team, Aarogya Setu, WHO emails, and various coronavirus aid across platforms like WhatsApp, SMS, emails and other social media platforms. Cert-In urges people to be vigilant to such scams and recommends to verify the authenticity of the applications before downloading them.

See the full report here: https://www.gadgetsnow.com/slideshows/government-security-agency-issues-alert-about-scams-on-aarogya-setu-who-and-other-covid-19-related-websites-dos-and-donts/photolist/75795208.cms

Chinese APT Tropic Trooper target air-gapped military Networks in Asia

According to a recent report from Trend Micro, the threat group Tropic Trooper, aka KeyBoy, is currently infiltrating the physically isolated networks of the Philippine and Taiwanese armies, as well as many government institutions, military hospitals, and national banks in these countries. The method of infiltration is through a USB malware called USBferry. It acts like a worm, infecting air-gapped machines by ferrying a malware installer on the network. USBferry needs a USB pen drive to be connected to the target machine to drop the payload. Other tools that are used by Tropic Trooper include Command-line remote control listener/port relay, Backdoor payload/steganography payload execution loaders, and Port scanning tools, which are available on the internet.

See the full report here: https://securityaffairs.co/wordpress/103292/apt/tropic-trooper-air-gapped-networks.html?utm_source=rss&utm_medium=rss&utm_campaign=tropic-trooper-air-gapped-networks

Supercomputers hacked across Europe to mine cryptocurrency

Supercomputers across Europe were hacked over the last week by an unknown group that has been injecting cryptocurrency mining software. Several security incidents are reported in Germany, the U.K., Switzerland, and Spain, with many computers being taken offline as a result of the hacks. The first system targeted is believed to be Archer, a supercomputer at the University of Edinburgh, that was being used to perform analysis of coronavirus research before being taken offline. The attackers gained access to the targeted supercomputers by stealing login credentials from compromised networks at universities in China and Poland. The attacker behind these incidents is using a compromised SSH account and then exploiting a vulnerability (CVE-2019-15666) in the Linux kernel to gain root access and install Monero or XMR crypto mining software, which had been set up to run only at night to evade detection. The motivation behind the attacks remains unknown.

See the full report here: https://www.zdnet.com/article/supercomputers-hacked-across-europe-to-mine-cryptocurrency/

Transportation agency hacked in 2nd Texas government attack - fortworthbusiness.com

Texas’ transportation agency (TxDOT) says in a statement that on May 14, there was an unauthorized access to the network in a ransomware event and that they took immediate steps to isolate the incident and shut down any further unauthorized access. Their website and web services are down after the attack. TxDOT has become the second part of the state government to be hit by a ransomware attack in recent days. The agency is working with the FBI to investigate the breach.

See the full report here: https://fortworthbusiness.com/transportation/transportation-agency-hacked-in-2nd-texas-government-attack/

Netwalker ransomware actors go fileless to make attacks untraceable - SC Magazine

Malicious actors have been spotted using a sneaky fileless malware technique called reflective dynamic-link library (DLL) injection, aka reflective DLL loading. According to Trend Micro, Netwalker ransomware malware is not complied but executed directly in memory, without storing the actual binaries into the disk. The process eliminates the need for registering the DLL as a loaded module of a process, and allowing evasion from DLL load monitoring tools. This allows the ransomware to maintain persistence and evade detection by abusing tools that are already in the system to initiate attacks. The malware variants encrypt common user files using six random characters as an extension and place a ransom note in various folders demanding payment for the restoration of files. It also deletes Shadow Volume copies and terminates certain processes and services, including those associated with back-up software, data-related applications, and security software.

See the full report here: https://www.scmagazine.com/home/security-news/ransomware/netwalker-ransomware-actors-go-fileless-to-make-attacks-untraceable/

PsyGenics notifies patients after discovering employee email patient info to her personal email account

PsyGenics, Inc. has disclosed an incident that may affect the security of some of its customers. On March 24, 2020, a PsyGenics employee forwarded a customer information contained within Excel spreadsheets to their personal email address without authorization. The impacted spreadsheets contained information for certain individuals: name, diagnosis code, appointment time, and provider name. Treatment notes or similar information were not included. Currently, the company is unaware of any attempted or actual misuse of this information. PsyGenics will notify all the affected individuals to remain vigilant against incidents of identity theft and fraudulent activities.

See the full report here: https://www.databreaches.net/psygenics-notifies-patients-after-discovering-employee-email-patient-info-to-her-personal-email-account/

Illinois blames ‘glitch’ for exposure of PUA applicant Social Security numbers, private data

The Illinois Department of Employment Security (IDES) has acknowledged a security lapse that exposed the private information of independent contractors and the self-employed. A glitch in the new system, known as Pandemic Unemployment Assistance (PUA) that was rolled out to process the claims of citizens in the state of Illinois who need to file for unemployment benefits, may have lead to the incident. There were over 44,000 applicants registered to the scheme website. The leaked information includes Social Security numbers, phone numbers, and addresses. The issue was remediated within an hour. However, it is not known how many applicants may have been impacted.

See the full report here: https://www.zdnet.com/article/illinois-blames-glitch-for-exposure-of-applicant-social-security-numbers-private-data/

Mercedes-Benz onboard logic unit (OLU) source code leaks online

The source code for "smart car" components installed in Mercedes-Benz vans has been leaked online over the weekend. A security researcher discovered a Git web portal belonging to Daimler AG, the German automotive company behind the Mercedes-Benz car brand. After registering on Daimler's code-hosting portal, the researcher was able to download more than 580 Git repositories containing the source code of onboard logic units (OLUs) installed in Mercedes vans. OLUs are used to access and manage live vehicle data. Further analysis revealed that Daimler doesn't implement a whitelist for the registration process, which can allow anyone to register an account on the company's official GitLab server, even without a Daimler corporate email.

See the full report here: https://www.zdnet.com/article/mercedes-benz-onboard-logic-unit-olu-source-code-leaks-online/

Fake US Dept of Treasury emails spreads new Node.js malware - BleepingComputer

Abuse.ch researchers have discovered a new Node.js based remote access trojan(RAT) that is being distributed through malicious emails pretending to be from the U.S. Department of the Treasury. The spam email subject to payment for a government contract was not paid due to incorrect banking information. It then prompts the user to examine the document, which is an archive named 'CONTRACT PAYMENT.zip' containing a file named 'CONTRACT PAYMENT.jar'. When executed, this JAR file downloads Node.js and a script that allows the malware to gain persistence. The malware gains full control of the victim’s system and steals sensitive data.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-us-dept-of-treasury-emails-spreads-new-nodejs-malware/

Edison Mail iOS Bug Exposes Emails to Strangers

Edison Mail, a popular third-party email app, has warned its iOS users that their emails may have been compromised after a security flaw exposed them to complete strangers. A recent iOS update caused a temporary bug in the app that allowed the unauthorized email account access of 6,480 iOS Edison Mail users to other users. The company has confirmed that no passwords or credentials were exposed or compromised. The issue is currently resolved and all accounts have been secured. As an additional precaution, impacted users are advised to change their email account passwords.

See the full report here: https://threatpost.com/edison-mail-ios-bug-exposes-emails-to-strangers/155814/

Anglo-Eastern suffers ransomware attack - Splash 247

Anglo-Eastern, one of the world's largest ship managers, has been hit by a ransomware attack. According to the company, nearly 20% of its workstations and 10% of its servers were encrypted during the attack. The company has taken precautionary measures to prevent further spread of the infection and has notified the impacted clients. Anglo-Eastern is currently working on getting back its systems online and has warned that the process may take time.

See the full report here: https://splash247.com/anglo-eastern-suffers-ransomware-attack/

Hacker sells 129 million sensitive records of Russian car owners - BleepingComputer

A database with 129 million records of car owners in Moscow is available for sale on the dark web, which includes the car’s make and model, place of registration, and the date of first and last registration. The seller claims that a full version of the database can be obtained for BTC 0.5, about $2,900, containing full names, addresses, passport numbers, dates of birth, and contact information of the car owners. An offer for exclusive access is available, for 1.5 bitcoins, which converts to about $14,500. The information trove has been verified by the Vedomosti business publication.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-sells-129-million-sensitive-records-of-russian-car-owners/

Smartphones, laptops, IoT devices vulnerable to new BIAS Bluetooth attack

A new vulnerability in the Bluetooth wireless protocol could allow attackers to spoof the identity of a previously paired/bonded device and successfully authenticate and connect to another device without knowing the long-term pairing key that was previously established between the two. Dubbed as BIAS (Bluetooth Impersonation AttackS), the flaw resides in the way that devices handle the link key, a key generated when two Bluetooth devices pair (bond) for the first time, and impacts the classic version of the Bluetooth protocol, broadly used to interconnect devices, such as smartphones, tablets, laptops, and smart IoT devices. Products with Bluetooth chips from Cypress, Qualcomm, Apple, Intel, Samsung, and CSR were found to be vulnerable. According to the researchers, if an attacker combines BIAS (CVE-2020-10135) and KNOB (CVE-2019-9506), they can break the authentication even on Bluetooth Classic devices running in a secure authentication mode. It is recommended that Bluetooth-capable devices receive patches against both the BIAS (CVE-2020-10135) and KNOB (CVE-2019-9506) attacks to be fully secure.

See the full report here: https://www.zdnet.com/article/smartphones-laptops-iot-devices-vulnerable-to-new-bias-bluetooth-attack/

FBI warns about attacks on Magento online stores via old plugin vulnerability

The US Federal Bureau of Investigation (FBI) warns about attacks on Magento online stores via a three-year-old vulnerability in a Magento plugin. The vulnerability (CVE-2017-7391) is a cross-site scripting (XSS) bug that allows the attacker to plant malicious code inside an online store's HTML code. The FBI says hackers are exploiting this vulnerability to steal environment credentials for a Magento online store, which they're using to take full control over the targeted sites and plant malicious scripts that records and steals buyers' payment card data. The FBI flash alert contains indicators of compromise (IOCs) that Magento operators can deploy inside their web application firewalls (WAFs) to prevent attacks against their sites.

See the full report here: https://www.zdnet.com/article/fbi-warns-about-attacks-on-magento-online-stores-via-old-plugin-vulnerability/

Beer rating app reveals homes and identities of spies and military bods, warns Bellingcat

According to Bellingcat, Untappd, a beer and pub-rating app that uses location-tracking API, poses a risk to the security of military and intelligence personnel. Untappd's location tracking features can allow researchers or attackers to uncover sensitive information about people. By deploying Untappd as an intelligence-gathering tool and a little knowledge of how the app works plus access to online map websites that lists pub, bar, and restaurant details, it can be very simple to find the sensitive geo-locations and other information of spies and military personnel.

See the full report here: https://www.theregister.co.uk/2020/05/19/bellingcat_beer_app_osint/

Google rolls out new Enhanced Safe Browsing security feature - BleepingComputer

Google has announced a new security feature called Enhanced Safe Browsing to offer real-time protection against known malicious web sites and downloads. With this feature, when users browse a site or download a file, Chrome will share additional information with Google Safe Browsing to check URLs for malicious activity. However, the new feature can sacrifice some of the users browsing data for better protection, as Chrome will also send a small sample of pages and suspicious downloads to help discover new threats against users. Currently, this latest feature has been rolled out to Chrome 83 users.

See the full report here: https://www.bleepingcomputer.com/news/google/google-rolls-out-new-enhanced-safe-browsing-security-feature/

WolfRAT targets WhatsApp, Facebook Messenger app users on Android devices

Researchers at Cisco Talos have discovered a new malware variant of the DenDroid Remote Access Trojan called WolfRAT. The malware has been caught targeting Thai users of Whatsapp, Facebook Messenger, and Line messaging apps on the Android mobile platform. WolfRAT uses fake update lures abusing legitimate services, including Flash and Google Play, to trick victims into installing RAT on the target Android device. The malware is capable of performing spying functions, including gathering device data, taking photos and video, compromising SMS messaging, recording audio, and both stealing and transferring files to a C2.

See the full report here: https://www.zdnet.com/article/wolfrat-targets-users-of-whatsapp-facebook-messenger-apps-on-android-devices/

Hundreds of thousands of QNAP devices vulnerable to remote takeover attacks

A security researcher has discovered vulnerabilities in the firmware of QNAP network-attached storage (NAS) devices, which could result in remote takeover attacks. The three bugs exist in the Photo Station app, a photo album app that comes preinstalled with all recent versions of QNAP NAS systems. The three vulnerabilities are identified as CVE-2019-7192, CVE-2019-7194, and CVE-2019-7195. The bugs can be chained together to bypass authentication, inject malicious code, and drop web shells on unpatched QNAP devices. Since the Photo Station app runs with root privileges, attackers can exploit the three bugs to take full control over QNAP devices. Users are advised to update to the latest firmware versions.

See the full report here: https://www.zdnet.com/article/hundreds-of-thousands-of-qnap-devices-vulnerable-to-remote-takeover-attacks/

REvil Ransomware found buyer for Trump data, now targeting Madonna - BleepingComputer

Threat actors behind REvil ransomware claim to have buyers ready for documents containing damaging information about the US‌ President Donald Trump and are preparing to auction data on international celebrity Madonna. Recently, the hackers breached the network of Grubman Shire Meiselas & Sacks (GSMLaw), a law firm representing a huge number of A-list celebrities, stealing sensitive data before encrypting it. Numerous sources reveal that the leaked data is harmless and did not contain damaging information related to President Trump.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-found-buyer-for-trump-data-now-targeting-madonna/

Brazil's Biggest Cosmetic Brand Natura Exposes Personal Details of Its Users

A security researcher has discovered two unprotected Amazon-hosted servers belonging to Brazil's biggest cosmetic brand, Natura, which has exposed approximately 192 million records containing customers' personal and payment-related information. The leaked information includes personally identifiable information on 250,000 Natura customers, their full names, mother's maiden names, dates of birth, nationality, gender, hashed login passwords with salts, usernames, nicknames, MOIP account details, API credentials with unencrypted passwords, recent purchases, telephone numbers, access tokens for wirecard.com.br, email, and physical addresses. It's currently unknown if these unprotected servers were also accessed by a malicious actor before they went offline. Natura customers are advised to change their passwords and remain vigilant of suspicious activities.

See the full report here: https://thehackernews.com/2020/05/natura-data-breach.html

EasyJet Hackers Take Off with Travel Details for 9M Customers

A British airline company, EasyJet, suffered a massive data breach that exposed details of over 9 million users. It was a highly sophisticated attack that exposed the email addresses and travel itineraries of the victims, along with payment-card information for 2,208 customers. The company has addressed the incident and is taking measures to inform all the affected customers. Additionally, affected EasyJet customers are advised to stay over social-engineering attacks that could make use of the travel information to craft highly convincing emails bent on luring victims into clicking on malicious links, attachments, or submitting more personal information via a phishing page.

See the full report here: https://threatpost.com/easyjet-hackers-travel-details-9m-customers/155894/

Home Chef announces data breach after hacker sells 8M user records - BleepingComputer

Home Chef, a US-based meal kit and food delivery service, officially disclosed a data breach, impacting nearly 8 million user records after a threat actor was selling them on a dark web marketplace for $2,500. The leaked database contains customers' email address, name, phone number, encrypted passwords, the last four digits of credit card numbers, and other account information. Home Chef states that only the last four digits of a customer's credit card were accessed and that they do not store complete payment information in their databases. Home Chef customers are advised to change their account passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/home-chef-announces-data-breach-after-hacker-sells-8m-user-records/

Snake ransomware leaks patient data from Fresenius Medical Care - BleepingComputer

Fresenius Medical Care, a large private hospital operator in Europe, fell victim to the Sanke ransomware, impacting medical data, and personally identifiable information of their patients. The hackers have published the sample data, containing patient details from Fresenius Medical Care center in Serbia, which provides dialysis services for people with chronic kidney failure. According to BleepingComputer, the leaked batch consisted of less than 200 records, including first and last names, gender, birth date, the nationality of the patient, profession, postal address, phone number. Next of kin details are also available (names and phones). Medical data in the dump refers to the name and phone number of the general practitioner, notes on allergies, test results, and doctor’s observations regarding the treatment. The hackers also announced that they will shortly be publishing more data.

See the full report here: https://www.bleepingcomputer.com/news/security/snake-ransomware-leaks-patient-data-from-fresenius-medical-care/

Adobe releases Critical out-of-band security update - BleepingComputer

Adobe has released an out-of-band security update to address a critical remote code execution flaw in Adobe Character Animator (CVE-2020-9586) and important information disclosure flaws in Adobe Premiere Pro (CVE-2020-9616), Adobe Audition (CVE-2020-9618), and Adobe Premiere Rush (CVE-2020-9617). Though the risks of being affected by these vulnerabilities are low, users are urged to upgrade to the latest version as soon as possible to best protect themselves from the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-releases-critical-out-of-band-security-update/

GhostDNS exploit kit source code leaked to antivirus company - BleepingComputer

Malware analysts at Avast gained unrestricted access to the components of GhostDNS exploit kit, after the complete source code for the malware kit and multiple phishing pages was uploaded to a file-sharing platform by a reckless user. The functionality of GhostDNS was enclosed in a file called “KL DNS.rar, hinting that the tool uses DNS hijacking and keylogging to obtain sensitive info from its victims and Avast confirmed this when looking at the source code structure. Further analysis revealed two methods for attacking routers, Router EK and BRUT, both requiring CSRF requests to change the DNS‌ settings on the device. Router EK attacks from the local network and requires the user to click on a malicious link. BRUT is a mass scanner that looks for routers exposed on the public internet and attacks them without any user intervention.

See the full report here: https://www.bleepingcomputer.com/news/security/ghostdns-exploit-kit-source-code-leaked-to-antivirus-company/

Vulnerability in Qmail mail transport agent allows RCE

Researchers at Qualys have developed a proof of concept for a Qmail vulnerability, CVE-2005-1513, that could allow both, remote code execution (RCE) and local code execution. It was earlier considered the flaw could not be exploited in a default Qmail installation as the memory consumption of each qmail-smtpd process is severely limited by default, hence the flaw was not addressed. The proof of concept is a reliable, local, and remote exploit against Debian’s Qmail package in its default configuration. This proof of concept requires 4GB of disk space and 8GB of memory and allows an attacker to execute arbitrary shell commands as any user, except root (and a few system users who do not own their home directory). Qualys suggests updating to a fixed version (v1.50) of qmail-verify.

See the full report here: https://www.helpnetsecurity.com/2020/05/20/qmail-rce/

Vigilante hackers target 'scammers' with ransomware, DDoS attacks - BleepingComputer

A hacking group called CyberWare has created new ransomware, dubbed MilkmanVictory, to target companies that perform loan scams. The attacks stem through phishing emails containing links to executables masquerading as PDF files. They also conduct denial of service attacks to bring down the company's web sites. According to the attackers, the ransomware is based on HiddenTear, which means that even if a key is not saved, it can still be decrypted using brute force attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/vigilante-hackers-target-scammers-with-ransomware-ddos-attacks/

Microsoft issues mitigation for the NXNSAttack DNS DDoS attack - BleepingComputer

Microsoft has released a security advisory (ADV200009) for the NXNSAttack vulnerability in DNS servers that could be used to amplify a single DNS request into a DDoS attack against authoritative DNS servers. An attacker who successfully exploited this vulnerability could cause the DNS Server service to become nonresponsive. To mitigate this attack, Microsoft recommends administrators use the "Set-DnsServerResponseRateLimiting" PowerShell cmdlet to enable Response Rate Limiting.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-issues-mitigation-for-the-nxnsattack-dns-ddos-attack/

Breach Broker Claims To Have Obtained Large User Database of Social Media App Wishbone

ZeroFOX Alpha Team has identified a threat actor named "Megadimarus", who seems to be a breach broker, allegedly selling a database of over 40 million users of the social media app, Wishbone[.]io. The actor has posted the details for sale on a popular cybercrime and breach forum and offering it for $8,000. The social quiz platform, Wishbone, has been breached for the second time in three years. The leaked data includes email addresses, names, usernames, phone numbers, geographic locations, genders, social media profiles, and SHA1 hashed passwords.

See the full report here: https://www.zerofox.com/blog/wishbone-breach/