Threat Intelligence Bulletin: 05/22/2020

Breach Disclosure: Artsy

In 2018, art consignment website Artsy experienced a data breach that would ultimately end up being offered for sale on various hacking forums by notorious breach broker Gnosticplayers. Exposed information includes the email and IP addresses, usernames, and salted SHA-512 hashed passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The data stolen from Artsy was initially offered for sale on dark web marketplace Dream Market in February 2019. The breach was bundled with data stolen from 16 organizations (for a total of 620 million user records), including MyFitnessPal, 500px, HauteLook, and WhitePages. The breach has been made available individually on RaidForums, for free.

Figure 1: Free download of the Artsy breach offered on RaidForums.

In response to this breach, Artsy notified affected users via email, and conducted an investigation into the root cause of the breach. The company also reported that additional security measures were put in place, although they did not specify what updates were made.

Breach Disclosure: LifeBear

Gnosticplayers has returned with a fourth round of breached data, and among the companies impacted was LifeBear, a Japanese scheduling app. The breached data included 3.67 million records containing emails, MD5 hashed passwords, usernames, event details and application settings. LifeBear confirmed this breach on the 20th of May, with a statement "...it has been revealed that there is a high possibility that the account information was acquired due to hacking damage caused by unauthorized access from a third party." which can be viewed on their blog.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In addition to LifeBear, Gnosticplayers has also announced the following other companies were included in this latest breach dump:

GameSalad (Game Development Platform)
Estante Virtual (Brazillian Book Shop)
Coubic (Scheduling Software)
Bukalapak (Indonesian e-commerce Site)
YouthManual.com (Indonesian Youth Student and Career Site)

While Gnosticplayers initially tried to sell this data on dark web marketplaces for ฿0.2618 (~$2,300), a popular hacking site has made the database available for free.

Figure 1: Breached data offered for sale on a hacking forum.## Breach Disclosure: Nulled[.]ch

In May 2020, the hacking forum Nulled[.]ch was breached and the breached data was published on a rival hacking forum. Over 43k records were compromised which included IP and email addresses, usernames, and passwords stored as salted MD5 hashes alongside the private message history of the website's admin.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On May 20, 2020, the administrator of RaidForums announced they breached rival hacking forum Nulled[.]ch website. RaidForums claims to have deleted Nulled's leak section and exposed 43K users' information along with the private message history of the site admin. The leaked data includes usernames, email addresses, passwords, IP addresses, date of birth, website activity, and admin private messages.

Figure 1: Screenshot of the post on a popular hacking forum

Figure 2: Screenshot from Forum announcement section of Nulled[.]ch

Breach Disclosure: PetFlow

In May of 2020, a file appearing to be from the October 2017 breach of the pet care delivery service PetFlow appeared on the dark web. This breach is related to one of the larger breaches in recent years from Gnosticplayers, which consisted of 16 sites totaling around 620 million users. Various sites were compromised due to unknown flaws, with some researchers speculating the breaches were from an undisclosed SQL vulnerability. 8 new sites were added to that list of compromised sites early last year, containing sites like YouNow, Houzz, Ixigo and Petflow.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This month, a popular hacking forum posted the PetFlow breach data for all users to view, which was previously being sold on various dark web forums. It is possible someone or a group of individuals purchased this breach and began giving it away to others, however, it is not known at this time how the users responsible acquired the original breached data. Almost 1 million accounts were impacted and the breach exposed email addresses and passwords stored as unsalted MD5 hashes.

Figure 1: Breached data offered for sale on a hacking forum.

Breach Disclosure: LiveJournal

Blogging platform LiveJournal appears to have suffered a security breach in 2014, according to multiple hackers on various dark web and hacking forums. Recently, hackers have begun redistributing the credentials of LiveJournal on multiple hacking forums. The leaked information contains 26M unique usernames and email addresses alongside plain text passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Rumors about a LiveJournal security breach have been circulating online for almost two years. In October 2018, multiple users reported receiving their unique/old LiveJournal passwords as part of sextortion email spam campaigns. DreamWidth, a fork of LiveJournal with a shared user base, has also been targeted by multiple credential stuffing attacks. The company has confirmed cases where hackers used old LiveJournal username and password combinations to breach DreamWidth accounts.

In May 2020, hackers were spotted redistributing LiveJournal’s user database on the dark web and on hacking forums. The data contained the usernames, emails, and plaintext passwords of 26,372,781 LiveJournal users.

Figure 1: RaidForums posting of the database, for free

Figure 2: Distribution of LiveJournal database for free on a hacking forum

Breaking News: 2020-05-22 - 2020-05-28

Breach Broker Claims To Have Obtained Large User Database of Social Media App Wishbone

After identifying a threat actor named "Megadimarus" who was allegedly selling Wishbone[.]io's database for $8,000 on a popular hacker forum, Zerfox Alpha team has provided an update that ShinyHunters posted on the same hacker forum, leaking the Wishbone[.]io trove for free to users. Shiny Hunters also claim that they are responsible for the breach. However, Wishbone is yet to confirm the breach.

See the full report here: https://www.zerofox.com/blog/wishbone-breach/

Supreme Court Phish Targets Office 365 Credentials

In an ongoing phishing campaign, attackers are delivering the U.S. Supreme Court subpoenas to trick victims into submitting their Office 365 credentials. The phishing email creates a sense of false emergency, forcing the victims to click on the embedded link to view the subpoena. Clicking the link redirects victims through multiple pages, including two fully functioning CAPTCHA pages. The final credential landing page impersonates an Office 365 login page, where the targets hand over their credentials to attackers. Compromised credentials from these targets can be used to launch secondary attacks on other employees, customers, and third-party vendors or could also be used to exfiltrate sensitive or confidential data from the targets’ Office 365 accounts.

See the full report here: https://threatpost.com/supreme-court-phish-targets-office-365-credentials/155955/

Ransomware deploys virtual machines to hide itself from antivirus software

UK cyber-security firm Sophos has uncovered a new trick used by operators of the RagnarLocker ransomware to evade antivirus software. Instead of running the ransomware directly on the victim machine, the gang downloads and installs Oracle VirtualBox (a type of software that lets you run virtual machines) and configures the virtual machine to give full access to all local and shared drives, allowing the virtual machine to interact with files stored outside its storage. It then boots up the virtual machine, runs a stripped-down version of the Windows XP SP3 operating system, called MicroXP v0.82. At last, loads the ransomware inside the virtual machine (VM) and runs it. Because the ransomware runs inside the VM, the antivirus software won't be able to detect the ransomware's malicious process.

See the full report here: https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/

Hackers tried to use Sophos Firewall zero-day to deploy Ransomware - BleepingComputer

The hotfix issued by Sophos has blocked the hacker's attempts to exploit a Zero-day SQL injection vulnerability that leads to remote code execution in Sophos XG firewalls. The attackers used this vulnerability to install various ELF binaries and scripts called "Asnarök Trojan" which was designed to steal data from the firewall that could have also allowed the attackers to compromise the network remotely. Sophos hotfix has closed the SQL injection vulnerability and removed the malicious scripts. However, the attackers revised their attack to distribute the Ragnarok Ransomware on unpatched Windows machines on the network by altering their scripts on hacked firewalls to use a 'dead man switch' that would activate a ransomware attack at a later if a particular file was deleted and the device was rebooted. Sophos hotfix prevented this attack as well by deleting the necessary components without a reboot of the firewall needed.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-tried-to-use-sophos-firewall-zero-day-to-deploy-ransomware/

New PipeMon malware uses Windows print processors for persistence - BleepingComputer

Researchers at ESET have found a new backdoor, dubbed PipeMon, associated with Winnti.‌ Two variants of the malware were found on servers of multiple developers of massively multiplayer online (MMO) games from South Korea and Taiwan. To gain persistence on the infected systems, Winnti used Windows print processors (DLLs) that converts spooled data from a print job into a format readable by a print monitor. A malicious DLL‌ loader drops where the print processors reside and registered as an alternative print processor. The malware then restarts the print spooler service to load the malicious process, achieving persistence.

See the full report here: https://www.bleepingcomputer.com/news/security/new-pipemon-malware-uses-windows-print-processors-for-persistence/

Silent Night Banking Trojan Charges Top Dollar on the Underground

A descendant of the infamous Zeus banking trojan, dubbed Silent Night, has emerged with a host of functionalities available in a spendy malware-as-a-service (MaaS) model. The features include web injections and form grabber with support for Google Chrome, Mozilla Firefox, and Internet Explorer, proxy services via HiddenVNC and SOCKS5, keylogger for browser activity, the ability to take screenshots, cookie stealer for Chrome, Firefox and IE, and a password-stealer for Chrome. According to researchers, all of the malicious modules are obfuscated and the characteristics of the obfuscation indicate that it has been applied to the source-code and pre-compilation.

See the full report here: https://threatpost.com/silent-night-banking-trojan/155981/

Thousands of Israeli sites defaced with code seeking permission to access users' webcams

Over 2000 Israeli websites, most of which were hosted on uPress, a local Israeli WordPress hosting service, have been defaced to show an anti-Israeli message and with malicious code seeking permission to access visitors' webcams. According to sources, the attack was carried out by a new hacker group called "Hackers of Savior" and was timed to take place on "Jerusalem Day," an Israeli national holiday. uPress took down all defaced websites and pulled the file hackers were exploiting, but a few are still available online, most likely cached by CDN providers. The Israeli National Cyber-Directorate (INCD) has warned users against interacting with any of the hacked websites.

See the full report here: https://www.zdnet.com/article/thousands-of-israeli-sites-defaced-with-code-seeking-permission-to-access-users-webcams/

Japan investigates potential leak of prototype missile data in Mitsubishi hack

Following the disclosure of cyberattack on Mitsubishi Electric Corp., Japan has launched an investigation into the potential exposure of confidential missile data. The missile, a speed glider known as HGV, was documented in files Mitsubishi and other manufacturers held as part of a bidding process. The Chief Cabinet Secretary, Yoshihide Suga, said that Japan's Defense Ministry is analyzing the "possible impact of the information leak on national security."

See the full report here: https://www.zdnet.com/article/japan-investigates-potential-leak-of-prototype-missile-design-in-mitsubishi-hack/

NSO Group Impersonates Facebook Security Team to Spread Spyware — Report

An investigation from Motherboard claims a Facebook security lookalike domain was set up to spread Israeli security company NSO Group's Pegasus hacking tool. It also claimed to have found evidence that servers inside the United States were used to spread the spying tool. The Pegasus spyware, once installed, can read text messages and other data on the phone, track its location with GPS, and access the microphone and camera.

See the full report here: https://threatpost.com/nso-group-impersonates-facebook-security/156021/

Voter info for millions of Indonesians shared on hacker forum - BleepingComputer

A threat actor has shared the 2014 voter information for close to 2 million Indonesians on a popular hacker forum and claims they will release a total of 200 million at a later date. The actor states that the voter records are stored in individual PDF files that they took from the KPU, the general election commission of Indonesia. The PDFs were organized by Indonesia cities and each folder contains PDF files that include the ID numbers, names, places of birth, dates of birth, and addresses for Indonesian voters. The KPU stated they are looking into the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/voter-info-for-millions-of-indonesians-shared-on-hacker-forum/

Windows malware opens RDP ports on PCs for future remote access

Security researchers from SentinelOne have discovered a new version of Sarwent malware that opens RDP (Remote Desktop Protocol) ports on infected computers so hackers could gain hands-on access to infected hosts. The new variant has two critical updates. The first is the ability to execute custom CLI commands via the Windows Command Prompt and PowerShell utilities. Another feature is that Sarwent now registers a new Windows user account on each infected host, enables the RDP service, and then modifies the Windows firewall to allow for external RDP access to the infected host. The Sarwent gang could use the RDP access themselves (to steal proprietary data or install ransomware), could rent the RDP access to other cybercrime or ransomware gangs, or could be listing the RDP endpoints on so-called RDP shops.

See the full report here: https://www.zdnet.com/article/windows-malware-opens-rdp-ports-on-pcs-for-future-remote-access/

‘Coronavirus Report’ Emails Spread NetSupport RAT, Microsoft Warns

Security researchers from Microsoft have discovered a new spear-phishing campaign that uses ongoing coronavirus pandemic as a lure as well as malicious Excel 4.0 documents to spread the weaponized NetSupport Manager remote access tool (RAT), which is a legitimate tool used for troubleshooting and tech support. The spear-phishing emails, purporting to come from the Johns Hopkins Center with a malicious Excel 4.0 document as an attachment, if enabled, downloads the macro and the NetSupport Manager RAT is executed which further drops multiple components, including several .dll, .ini, and other .exe files, a VBScript, and an obfuscated PowerSploit-based PowerShell script. It then connects to a C2 server, allowing attackers to send further commands.

See the full report here: https://threatpost.com/coronavirus-emails-netsupport-rat-microsoft/156026/

Critical Cisco Bug in Unified CCX Allows Remote Code Execution

Cisco's customer interaction management solution, Cisco Unified Contact Center Express (CCX) contains a critical remote code execution flaw (CVE-2020-3280) that could allow the attacker to execute arbitrary code as the root user on an affected device. The vulnerability is due to the insecure deserialization of user-supplied content by the affected software. Cisco has patched the flaw in its latest security update. Also fixed were several medium-severity flaws and a high-severity flaw (CVE-2020-3272) in Cisco's Prime Network Registrar. Users are advised to apply the relevant patches at the earliest.

See the full report here: https://threatpost.com/critical-cisco-rce-flaw-unified-ccx/155980/

Mathway investigates data breach after 25M records sold on dark web - BleepingComputer

A threat actor is selling 25 Million records belonging to Mathway, a popular math problem solver, on DarkWeb. It appears that the leaked data mostly contained email addresses, hashed passwords, and system data. With the help of cybersecurity experts, Mathway is currently investigating the reports of a data breach. All Mathway users are advised to change their password on the site.

See the full report here: https://www.bleepingcomputer.com/news/security/mathway-investigates-data-breach-after-25m-records-sold-on-dark-web/

Chafer APT Hits Middle East Govs With Latest Cyber-Espionage Attacks

Researchers have discovered a cybercrime campaign from Chafer, an advanced persistent threat (APT) group. The group has conducted attacks in the Middle East region, dating back to 2018. The attacks were carried out using modified PLINK tools to automate operations. The primary targets of this group are organizations from the IT, telecom, oil and gas, aviation, government, and security sectors in Israel.

See the full report here: https://threatpost.com/chafer-apt-hits-middle-east-govs-with-latest-cyber-espionage-attacks/156002/

ZLoader banking malware is back, deployed in over 100 campaigns - BleepingComputer

Researchers have discovered a new variant of ZLoader banking malware, which is spreading through various malicious email campaigns. The new variant is capable of stealing credentials and sensitive banking information including cookies and passwords. The threat actors use the stolen data to make transactions from compromised computers.

See the full report here: https://www.bleepingcomputer.com/news/security/zloader-banking-malware-is-back-deployed-in-over-100-campaigns/

Online education site EduCBA discloses data breach after hack - BleepingComputer

Online education site EduCBA has started notifying customers that they are resetting their passwords after suffering a data breach. EduCBA is an online education site based out of India that offers over 2,500 online courses and job oriented learning programs focusing on finance, technology, and business to their 500,000 learners. The leaked data included email, name, password, and courses visited. The company has also clarified that no financial information was accessed as they use third-party processors such as PayPal and 2Checkout to process payments.

See the full report here: https://www.bleepingcomputer.com/news/security/online-education-site-educba-discloses-data-breach-after-hack/

Privilege escalation vulnerability patched in Docker Desktop for Windows

Cybersecurity researchers from Pen Test Partners have publicly disclosed a privilege escalation vulnerability in the Windows Docker Desktop Service. The core of the issue lies with the fact that the Docker Desktop Service, the primary Windows service for Docker, communicates as a client to child processes using named pipes. The vulnerability, tracked as CVE-2020-11492, uses the high privilege Docker Desktop Service to trick into connecting to a named pipe that has been setup by a malicious lower privilege process. Once the connection is made, the malicious process can then impersonate the Docker Desktop Service account (SYSTEM) and execute arbitrary system commands with the highest level privileges. Users are advised to update to Docker version 2.3.0.2 to fix this vulnerability.

See the full report here: https://www.zdnet.com/article/privilege-escalation-vulnerability-patched-in-docker-desktop-for-windows/

Experts observed a spike in COVID-19 related malspam emails containing GuLoader

Researchers from Vipre Labs observed a spike in the use of GuLoader in COVID-19-themed campaigns since March 2020. First observed in 2019, GuLoader is a popular remote access trojan (RAT) distributor written in VB5/6 and compressed in a .rar/.iso file. These are usually employed in spam campaigns using bill payments, wire transfers, or COVID lures and allow the attackers to control, monitor, or steal information from the infected machine. This malware downloader utilizes cloud hosting services (Microsoft OneDrive or Google Drive) to keep its payload encrypted. To achieve persistence, it also creates a folder in which to place a copy of itself and modifies a registry key. Some of the common payloads downloaded by the loader are Formbook, NetWire, Remcos, Lokibot, and others.

See the full report here: https://securityaffairs.co/wordpress/103683/malware/covid-19-related-malspam-guloader.html

Personal data of 2.9 crore Indian job seekers leaked on dark web

Data of 29 million Indian job seekers have leaked on the dark web for free, according to Cyble. A 2.3 GB zipped file was posted on a hacking forum, containing details of the job seekers’ data from different states. The original leak appears to be from a resume aggregator service that collects data from various known job portals. The exposed information includes sensitive information such as email, phone, home address, qualification, work experience, etc. Cybercriminals are always on the lookout for such personal information to conduct various nefarious activities such as identity thefts, scams, and corporate espionage.

See the full report here: https://indianexpress.com/article/technology/tech-news-technology/29-million-indian-job-seekers-data-leak-6424383/

Zoom call hacker threatens to blow up school in Cary - Northwest Herald

According to Cary Police Department, a teacher at Oak Knoll Early Childhood Center in Cary was on a Zoom call Monday with her class when a hacker, disguising their voice, threatened to blow up the school. It was notified to the school administration. There were no children in the school building at the time of the incident as the school was locked. There was no threat to anyone’s safety found at the school. The issue is currently under investigation.

See the full report here: https://www.nwherald.com/2020/05/23/zoom-call-hacker-threatens-to-blow-up-school-in-cary/ay4dmfg/

Hackers leak credit card info from Costa Rica's state bank - BleepingComputer

Maze ransomware operators have published stolen credit card information from the Bank of Costa Rica (BCR) on their shaming site. On April 30, Maze ransomware operators claimed to have more than 11 million cards from BCR, with 4 million being unique and 140,000 belonging to “US citizens.” In a recent post, the hackers shared a 2GB spreadsheet with payment card numbers from customers. The attackers released the data to draw attention to the bank’s security lapses that fail to protect sensitive information. However, the bank officials have issued a public statement, denying any unauthorized access.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leak-credit-card-info-from-costa-ricas-state-bank/

New Unc0ver jailbreak released, works on all recent iOS versions

A known hacking team has released a new jailbreak package for iOS devices. By default, Apple does not allow users to have full control over their iPhones and other iOS devices due to security reasons. Jailbreaks are a type of custom software that works by exploiting bugs in the iOS operating system to grant users root access and full control over their device. Named as Unc0ver 5.0.0, the tool utilizes a zero-day vulnerability in the iOS operating system to root and unlock and unlock all iOS devices, even those running the most recent iOS v13.5.

See the full report here: https://www.zdnet.com/article/new-unc0ver-jailbreak-released-works-on-all-recent-ios-versions/

Discord client turned into a password stealer by updated malware - BleepingComputer

A threat actor updated the AnarchyGrabber trojan into a new version that steals passwords and user tokens, disables 2FA, and spreads malware to a victim's friends. AnarchyGrabber is a popular trojan that is commonly spread for free on hacker forums and within YouTube videos. Threat actors distributed the on Discord, pretending it to be a game cheat, hacking tool, or copyrighted software to steal a victim's Discord user token and login to the victim’s account. Earlier this week, a modified AnarchyGrabber trojan was released with enhanced features. The new variant, AnarchyGrabber3, allowed an attacker to steal a victim's plain text password and command an infected client to spread malware to a victim's friends on Discord. Attackers can also use the stolen password in credential stuffing attacks to compromise the victim's accounts at other sites. The only way to remove AnarchyGrabber3 is to uninstall the Discord client and install it again.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-client-turned-into-a-password-stealer-by-updated-malware/

A massive database of 8 billion Thai internet records leaks

Thailand’s largest cell network AIS has pulled a database offline that was spilling billions of real-time internet records on millions of Thai internet users. Security researcher Justin Paine discovered the database, containing DNS queries and Netflow data, on the internet without a password. Thailand’s national computer emergency response team (ThaiCERT), contacted AIS and the database was inaccessible a short time later. Using the exposed data anyone with access to the database could know about user-owned devices, antivirus, browser details, and websites. Still not known who owns the database.

See the full report here: https://techcrunch.com/?p=1993005

Google Messages app is preparing end-to-end encryption for RCS chat

An analysis of the latest update to Google Messages suggests it may be moving closer to having end-to-end encryption for RCS. An unreleased build of Messages was obtained by APKMirror, reports that the app mentions end-to-end encryption as an option for RCS. The key security upgrade would put it on a par with the likes of iMessage and WhatsApp. RCS in Google Messages is an upgrade on SMS, the current lack of end-to-end encryption is one reason why you might not use it as your preferred messaging platform of choice.

See the full report here: http://www.techradar.com/news/google-messages-app-is-preparing-end-to-end-encryption-for-rcs-chat

eBay port scans visitors' computers for remote access programs - BleepingComputer

eBay performs a port scan on their visitor who accesses their website via browser. The script “check.js” will run a local port scan of the computer to detect remote support and remote access applications. The script performs these scans using WebSockets to connect to the localhost on the specified port. Fourteen different ports are scanned along with their associated programs. According to Nullsweep, the scan does not occur when browsing the site with Linux. As the port scan is only looking for remote access programs, it is most likely being done to check for compromised computers used to make fraudulent eBay purchases.

See the full report here: https://www.bleepingcomputer.com/news/security/ebay-port-scans-visitors-computers-for-remote-access-programs/

RangeAmp attacks can take down websites and CDN servers

A team of researchers has discovered a new technique to abuse HTTP packets to amplify web traffic and bring down websites and content delivery networks (CDNs). Named RangeAmp, this new Denial-of-Service (DoS) technique exploits incorrect implementations of the HTTP "Range Requests" attribute. HTTP Range Requests are part of the HTTP standard that allows clients (usually browsers) to request only a specific portion (range) of a file from a server. There are two different RangeAmp attacks, Small Byte Range (SBR) and Overlapping Byte Ranges (OBR) that can use malformed HTTP Range Requests to amplify how web servers and CDN systems react when having to deal with a range request operation. These attacks were very dangerous as they require a minimum of resources to carry out and can cause a huge impact on the network.

See the full report here: https://www.zdnet.com/article/rangeamp-attacks-can-take-down-websites-and-cdn-servers/

Samsung develops new security chip for smartphones

Samsung has launched a new secure element (SE) chip to protect private and sensitive data on mobile devices. According to Samsung, the new chip protects mobile devices such as smartphones and tablets when performing booting, isolated storage, mobile payment, among other applications. It can also be used for e-passports and cryptocurrency hardware wallets, and to support the hardware-based root of trust and device authentication and can also work independently from the security performance of a device's main processor. The chip, dubbed S3FV9RR, will be offered as a standalone turnkey with security software. With the 6+ certification, the SE chip has the highest rating to date for a mobile component. The SE chip will be available in the third quarter of the year.

See the full report here: https://www.zdnet.com/article/samsung-develops-new-security-chip-for-smartphones/

Thousands of enterprise systems infected by new Blue Mockingbird malware gang

Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird. The group has been active since December 2019 and are known to attack public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component. Hackers leverage the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. Then, they use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain reboot persistence. After gaining full access to a system, they download and install a version of XMRRig cryptocurrency mining app for the Monero (XMR) cryptocurrency. They also target public-facing IIS servers to penetrate into a company's internal network and spread internally via weakly-secure RDP (Remote Desktop Protocol) or SMB (Server Message Block) connections. Organisations are advised to block exploitation attempts for CVE-2019-18935 at their firewall level.

See the full report here: https://www.zdnet.com/article/thousands-of-enterprise-systems-infected-by-new-blue-mockingbird-malware-gang/

Hacker extorts online shops, sells databases if ransom not paid - BleepingComputer

More than two dozen SQL databases stolen from online shops in various countries are being offered for sale on a public website. In total, the seller provided around 1,620,000 rows of records of email addresses, names, hashed passwords postal addresses, gender, dates of birth, depending on the store. More than half of the listed databases are from online stores in Germany, the U.S., Italy, India, Spain, and Belarus and they run e-commerce platforms like Shopware, JTL-Shop, PrestaShop, OpenCart, Magento. Hackers target insecure servers via public web, copy the databases, and leave a ramson note. The victims are threatened to pay BTC 0.06 as ransom within 10 days else the the database would be posted publicly. A couple of wallets used by the attacker recorded more than 100 received transactions for a combined total of BTC 5.8. Databases are still attractive to cybercriminals and can be leveragred to increase their profits by selling the data to multiple parties, including the victim.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-extorts-online-shops-sells-databases-if-ransom-not-paid/

Russian cyberspies use Gmail to control updated ComRAT malware - BleepingComputer

Cybersecurity researchers have discovered a new version of the ComRAT backdoor that is controlled using the Gmail web interface. It is used by the state-backed Russian hacker group Turla for harvesting and stealing in attacks against governmental institutions. The ComRAT v4, aka Agent.BTZ and Chinch, uses an entirely new code base and is way more complex than the earlier variants. ComRAT is typically installed via PowerStallion, a lightweight PowerShell backdoor used to install other backdoors. The exfiltrated data comprises user details and security-related log files to check if their malware samples were detected during a scan of the infected systems. The level of sophistication of this group indicates that the malware has intentions to stay in the machine for a longer time.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-cyberspies-use-gmail-to-control-updated-comrat-malware/

Pak’s ISI creates fake Aarogya Setu app to snoop on Indian officials

The ISI-sponsored Pakistani hackers have launched a phishing attack on India's cyberspace through the Aarogya Setu app and their links were sent to several governments and army officials. The Maharashtra cyber intelligence and analytical cell has alerted other security agencies across the country about the threat. An advisory is also released state-wide by the agency.

See the full report here: https://timesofindia.indiatimes.com/city/nagpur/paks-isi-creates-fake-aarogya-setu-app-to-snoop-on-indian-officials/articleshow/75984781.cms

3 Hacking Forums Hacked! Database Leaked Online - CISO MAG

Hackers turned against their own when they leaked databases from hacking forums. Security researchers have discovered database leaks of three hacking forums Sinful Site, Suxx, and Nulled. All these hacking forums are based on general discussion and sharing of related resources. The databases of hacking forums Suxx and Nulled contained information of their users, which appears to be dumped on May 20, 2020. And the database of Sinful Site includes private messages of hackers in the forum, which appear to be dumped on May 15, 2020. The actors behind the database leak are unknown.

See the full report here: https://www.cisomag.com/3-hacking-forums-hacked-database-leaked-online/

Hacking group builds new Ketrum malware from recycled backdoors - BleepingComputer

The Ke3chang group, also known as APT15, has developed new malware dubbed Ketrum by merging features and source code from their older Ketrican and Okrum backdoors. This group operations target a wide range of military and oil industry entities, as well as government contractors and European diplomatic missions and organizations. Security researchers identified three recently uploaded samples from VirusTotal that share code with older APT15 implants. The samples seem to be a mix of the Ketrican and Okrum backdoors. The new backdoor still follows the same principle of providing a basic backdoor that can be used by Ke3chang operators to take control of a targeted device, connect to it from a remote server, and manually go through the other steps of the operation. Indicators of compromised (IOCs) and additional details regarding the new Ketrum umbrella are available.

See the full report here: https://www.bleepingcomputer.com/news/security/hacking-group-builds-new-ketrum-malware-from-recycled-backdoors/

Botnets Playing Peekaboo in Fake Zoom Installers

Cybercriminals are taking advantage of remote working conditions by abusing and spoofing popular legitimate applications to infect systems with malicious routines. Two malware samples have been discovered that pose as Zoom installers, spreading through unofficial distribution channels, contain backdoor and botnet capabilities. One malware is capable of enabling backdoor for an attacker to gain access and other involves in the installation of Devil Shadow botnet on compromised devices. Remote workers are highly prone to phishing attacks during the pandemic with hackers aiming to steal data. Users are recommended to download apps and software only from official marketplaces and platforms.

See the full report here: https://cyware.com/news/botnets-playing-peekaboo-in-fake-zoom-installers-0b180d72/?&web_view=true

26 million LiveJournal accounts being shared on hacker forums - BleepingComputer

LiveJournal, a Russian social networking service, suffered a data breach containing 26 million unique LiveJournal user accounts, including plain text passwords. Although the breach dates back to 2017, the links to a data dump have been redistributed on various hacker forums. According to posts sharing the links, the database dump contains email addresses, usernames, profile URLs, and passwords. The passwords were converted to plain text after initially being stored as MD5 hashes. There have been reports of credential abuse against Dreamwidth beginning in 2018, a fork of LiveJournal with a significant crossover in user base. LiveJournal is yet to confirm a data breach. Users are advised to change passwords on their LiveJournal accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/26-million-livejournal-accounts-being-shared-on-hacker-forums/

Critical Android bug lets malicious apps hide in plain sight - BleepingComputer

Researchers have identified a critical vulnerability in Android devices that can allow malicious apps to camouflage as most legitimate applications and steal sensitive information from Android users. Dubbed the “StrandHogg 2.0” vulnerability (CVE-2020-0096), is an enhanced version of the original StrandHogg bug and impacts all devices running Android 9.0 and below. Attackers can leverage this flaw without root access and allow malicious apps to trick users by replacing the interface of legitimate apps after they are launched using reflection and remaining fully hidden. They can gain access to private SMS messages and photos, steal victims’ login credentials, track GPS movements, make and/or record phone conversations, and spy through a phone’s camera and microphone. Google has released a fix for Android versions 8.0, 8.1, and 9.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-android-bug-lets-malicious-apps-hide-in-plain-sight/

Qihoo & Baidu disrupt malware botnet with hundreds of thousands of victims

Qihoo 360 researchers have discovered DoubleGuns trojan that is exclusively found in China and is believed to have infected hundreds of thousands of Chinese users. DoubleGuns is a malware trojan that targets Windows devices and has been operating since July 2017. It is primarily distributed via boobytrapped apps shared on Chinese websites, with most being pirated games made available on Chinese social networks and gaming forums. Users are targeted using MBR and VBR bootkits that install various malicious drivers, and then steal credentials from local apps, with a focus on Steam accounts. Additionally, it also acts as an adware and spamming module. Qihoo 360 has announced to team up with Chinese tech giant, Baidu to disrupt the botnet's operations and take down its infrastructure.

See the full report here: https://www.zdnet.com/article/qihoo-baidu-disrupt-malware-botnet-with-hundreds-of-thousands-of-victims/

Arbonne MLM data breach exposes user passwords, personal info - BleepingComputer

Arbonne International, an International multi-level marketing (MLM) firm has suffered a data breach where personal information and credentials of thousands of users were exposed. On April 20, 2020, the firm became aware of unusual activity within a limited number of its internal systems. The investigation identified a data table containing limited personal information that may have been accessible to an unauthorized actor. The exposed personal information includes names, email and mailing addresses, order purchase histories, phone numbers, and Arbonne account passwords. The firm has forced a password reset for all users whose passwords may have been compromised. It has also provided twelve months of free credit monitoring, fraud consultation, and identity theft restoration services from Kroll.

See the full report here: https://www.bleepingcomputer.com/news/security/arbonne-mlm-data-breach-exposes-user-passwords-personal-info/

Macs 'partially affected' by unpatchable Thunderbolt security exploit

A security researcher has discovered a Thunderbolt vulnerability that could allow attackers to bypass system defenses and access the contents of a locked computer's drive in minutes. The new vulnerability dubbed as Thunderspy, with just a few minutes of physical access and a couple of hundred dollars of easily purchased equipment, could allow an attacker to bypass a computer's security mechanisms even if it's locked and can encrypt the hard drive. The vulnerability affects all Thunderbolt-equipped PCs manufactured before 2019, though macOS devices are only "partially affected." A proof-of-concept is demonstrated. Users are advised to avoid plugging in untrusted peripherals or storage devices.

See the full report here: https://appleinsider.com/articles/20/05/11/macs-partially-affected-by-unpatchable-thunderbolt-security-exploit

OpenSSH to deprecate SHA-1 logins due to security risk

OpenSSH, the most popular utility for connecting to and managing remote servers, has announced plans to drop the support for SHA-1 authentication scheme due to security concerns with the SHA-1 hashing algorithm. The OpenSSH app uses the "ssh-rsa" mode to generate SSH authentication keys and by default, these keys are generated using the SHA-1 hashing function, meaning these keys are susceptible to SHAterred (a technique that could make two different files appear as they had the same SHA-1 file signature) attacks, allowing threat actors to generate duplicate keys. The OpenSSH project will be disabling the ssh-rsa mode by default in a future (currently unspecified) release, however, before that, they also plan to enable the UpdateHostKeys feature by default, to allow server owners to automatically migrate from the old ssh-rsa mode to better authentication algorithms.

See the full report here: https://www.zdnet.com/article/openssh-to-deprecate-sha-1-logins-due-to-security-risk/

Valak targets Microsoft Exchange servers to steal enterprise data

Valak, a previously known malware loader is updated as an information stealer to target individuals and enterprises. The malware has been spotted in active campaigns mainly focused entities in the US and Germany. The most recent Valak variants have been tracked in attacks against Microsoft Exchange servers. The malware contains two main payloads, project.aspx and a.aspx. The project.aspx manages registry keys, task scheduling for malicious activities, and persistence. a.aspx, internally named PluginHost.exe, is an executable that manages additional components. Valak's "ManagedPlugin" module has functions that include a system information grabber that harvests local and domain data. The "Exchgrabber" function aims to infiltrate Microsoft Exchange by stealing credentials and domain certificates, a geolocation verifier, screenshot capture, and "Netrecon," a network reconnaissance tool.

See the full report here: https://www.zdnet.com/article/valak-targets-microsoft-exchange-servers-to-steal-enterprise-data-in-active-campaigns/

Michigan State University hit by ransomware gang

The Netwalker ransomware group has allegedly infected Michigan State University (MSU), one of the US' oldest educational institutes. The ransomware group threatens to leak the documents stolen from the university's network if the ransom demand is not met. To support their claim, the NetWalker operators have published five images on their site, including two images showing a directory structure allegedly from the university's network, a passport scan for a student, and two scans of Michigan State financial documents. MSU is yet to respond to the incident.

See the full report here: https://www.zdnet.com/article/michigan-state-university-hit-by-ransomware-gang/

Germany govt urges iOS users to patch critical Mail app flaws - BleepingComputer

Due to the criticality of zero-click security vulnerabilities, found by ZecOps, in iOS and iPadOS, the Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany's federal cybersecurity agency, urges iOS users to immediately install the iOS and iPadOS security updates released by Apple on May 20 to patch the vulnerabilities impacting the default email app. According to the iOS 13.5 security release notes, the vulnerabilities affect iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation. These vulnerabilities are a memory consumption issue tracked as CVE-2020-9819 that may lead to heap corruption and an out-of-bounds write issue tracked as CVE-2020-9818 which may lead to unexpected memory modification or application termination, both of them triggered after the Mail app processes a maliciously crafted mail message.

See the full report here: https://www.bleepingcomputer.com/news/security/germany-govt-urges-ios-users-to-patch-critical-mail-app-flaws/

Microsoft warns about attacks with the PonyFinal ransomware

Microsoft's security team has warned organizations to deploy protections against a new strain of ransomware dubbed "PonyFinal" that has been in the wild over the past two months. PonyFinal is Java-based ransomware that is deployed in human-operated ransomware attacks whose intrusion point is an account on a company's systems management server breached using brute-force attacks. Once inside, the gang deploys a Visual Basic script that runs a PowerShell reverse shell to dump and steal local data. It also deploys a remote manipulator system to bypass event logging. It then spread to other local systems and deploys the actual PonyFinal ransomware. The files encrypted with the PonyFinal ransomware have a ".enc" file extension added to the end of each encrypted file. However, there is no known way or free decrypter that can recover encrypted files.

See the full report here: https://www.zdnet.com/article/microsoft-warns-about-attacks-with-the-ponyfinal-ransomware/

Microsoft is investigating ten Windows 10 2004 known issues Image - BleepingComputer

Microsoft has added ten known issues under investigation in the Windows 10 2004 and Windows Server 2004 releases. Some issues prevent devices from connecting to more than one Bluetooth device, cause refresh rate issues for devices with Intel GPUs, and trigger errors when plugging or unplugging a Thunderbolt dock. Others cause issues when older drivers for Nvidia display adapters (GPU) are installed and could lead to unexpected restarts for some devices using Always On, Always Connected capable network adapters. Microsoft recommends users to prevent attempting to manually update using the Update now button or the Media Creation Tool until the issue has been resolved.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-is-investigating-ten-windows-10-2004-known-issues/