[InfoSec MASHUP] 37/2024
[InfoSec MASHUP] 37/2024
Meta fixes WhatsApp's "View Once" feature vuln.; U.S. elections still target of nation state threat actors; New sextortion scams using spouse's name; Patch Tuesday; Fortinet confirms customer breach;
Welcome to the 45 new members from the last 30 days! This newsletter now has 1,539 subscribers.
Partners and Affiliates
🔐 NordVPN - Save up to 75% + 3 Extra Months!
Breaches & Security Incidents
🇳🇱 🔓 Kawasaki Motors Europe is recovering from a cyberattack by the RansomHub ransomware gang, which claims to have stolen 487 GB of data — The company is working with cybersecurity experts to cleanse its systems and restore its server infrastructure. RansomHub threatens to leak the stolen data if their demands are not met by tomorrow [Sep 14, 2024].
🇺🇸 🔓 Fortinet has confirmed a data breach after a hacker claimed to steal 440GB of files from its Microsoft Sharepoint server — The hacker, known as "Fortibitch," attempted to extort the company for ransom, but Fortinet refused to pay. The company stated that unauthorized access affected a limited number of customer files and is communicating directly with those impacted.
🇺🇸 🔓 Kemper Sports Management reported a data breach after unauthorized access to its computer network — The breach exposed sensitive consumer information, including names and Social Security numbers. They began notifying affected individuals on September 9, 2024.
🇬🇧 🔓 Transport for London (TfL) is dealing with a cyberattack that has lasted for two weeks — They updated their statement to remove a claim that no customer data was compromised, emphasizing the importance of data security. Some of TfL's online services are still offline, but the transit system itself is operating normally.
British teen arrested over cyberattack on London transportation agency
TfL requires in-person password resets for 30,000 employees after hack
🇺🇸 🔓 Highline Public Schools in Washington state has closed all schools and canceled activities due to a cyberattack on its technology systems. The district is working with partners to restore and secure its systems while prioritizing student safety. An investigation is ongoing, and updates will be provided to families about the situation.
🇺🇸 🔓 Slim CD, a payment gateway provider, experienced a data breach impacting nearly 1.7 million credit card owners — Hackers accessed sensitive information, including names and credit card numbers, for about a year before being detected in June 2024. Although the stolen data does not include CVV numbers, Slim CD advises affected individuals to monitor for fraud and report any suspicious activity.
🇺🇸 🔓 Avis Car Rental reported a data breach where unknown attackers accessed a business application and stole personal information from some customers. The company took steps to stop the breach and improve security, while warning customers about risks of identity theft. Avis is offering affected individuals a free year of credit monitoring to help detect and resolve any potential identity theft issues.
🇮🇷 🔓 An Iranian IT vendor named Tosan, which serves many banks, was hit by a major cyberattack and is paying a ransom to hackers despite the government's claims that no hack occurred. The attack compromised data from at least 20 banks, exposing sensitive information about millions of customers. Tosan is making payments in bitcoin, totaling 35 bitcoins, to prevent the hackers from selling the stolen data.
➝ More breaches:
Wisconsin Insurer Discloses Data Breach Impacting 950,000 Individuals
Healthcare Provider to Pay $65M Settlement Following Ransomware Attack
23andMe to pay $30 million in genetics data breach settlement
Cybercrime, Cyber Espionage, APT’s
🇺🇸 ⚖️ A group of information security professionals is urging Columbus City Attorney Zach Klein to drop a lawsuit against Connor Goodwolf, who is accused of sharing data stolen by a ransomware group — They argue that the lawsuit hinders public knowledge about ongoing risks from the attack and misdirects resources away from addressing the real threat. The professionals emphasize the importance of transparency and public safety over punitive actions against individuals acting in good faith.
🇸🇬 ⚖️ The Singapore Police have arrested six men, including five Chinese nationals and one Singaporean, for their involvement in cybercrime activities — The arrests followed raids where authorities seized laptops, mobile phones, cash, and cryptocurrency linked to malicious operations. The suspects face charges under the Computer Misuse Act, highlighting Singapore's commitment to combating cybercrime.
🇺🇸 ⚖️ Four men from Delaware have been arrested for an international sextortion scheme that targeted victims in the U.S., U.K., and Canada — They allegedly posed as young women online to extort nearly $2 million from thousands of victims. The men face serious charges, including conspiracy and money laundering, with potential prison sentences of up to 20 years.
🇷🇺 🇰🇿 Two men, Alex Khodyrev and Pavel Kublitskii, were indicted for running a cybercrime forum called WWH Club while living in Miami. They face up to 20 years in prison for their roles in promoting illegal activities online. Despite their arrest, the cybercrime forum continues to operate and has seen an increase in activity.
🇨🇳 👨🏻💻 A Chinese hacking group called Stately Taurus is using Visual Studio Code to target government networks in Southeast Asia for cyberespionage. They exploit a feature in the software to execute malicious commands and steal sensitive information. This new tactic was first observed in 2023 and is linked to other malicious activities involving different malware.
🇺🇸 🇷🇺 The U.S. government has linked a Russian hacking group called Cadet Blizzard to major cyber attacks aimed at disrupting aid to Ukraine — They have offered a reward of up to $10 million for information on five indicted Russian military officers involved in these cyber operations. The hacking group has targeted critical infrastructure in NATO and other countries since at least 2020, using various malware to create chaos and gather sensitive information.
👀 🇨🇳 A new cyber espionage group called TIDRONE is targeting drone manufacturers in Taiwan, likely linked to Chinese-speaking entities. They use custom malware and remote desktop tools to access sensitive information and disrupt security measures. Researchers believe this campaign is part of a broader effort by unidentified Chinese threat actors.
🇺🇸 🇷🇺 Two men, Alex Khodyrev and Pavel Kublitskii, have been indicted in the U.S. for managing a dark web marketplace called WWH Club that sold sensitive personal and financial information — The FBI's investigation revealed that the site also offered training for cyber criminals on committing fraud. If convicted, both could face up to 20 years in prison and are required to forfeit luxury vehicles purchased with illicit profits.
Government, Politics, and Privacy
⚖️ ❌ Apple has dropped its lawsuit against NSO Group due to concerns that the case could expose sensitive security information — The company warned that even winning the case might not effectively address the broader issue of spyware threats, as many other companies also engage in similar practices. Apple believes that continuing the lawsuit poses too great a risk to its security efforts.
🇪🇺 🤖 European Union regulators are investigating Google's AI model, PaLM2, for compliance with privacy rules — The Irish Data Protection Commission is leading the inquiry to assess potential risks to individuals' rights in the EU. This scrutiny is part of broader efforts to ensure AI systems handle personal data responsibly.
🇺🇸 🇷🇺 🇮🇷 🇨🇳 Intel officials warn that Russia, Iran, and China are likely to increase foreign influence efforts targeting U.S. voters as the 2024 election approaches. Recent actions include sanctions against Russian nationals involved in a scheme to spread pro-Russian narratives through American influencers. Officials are closely monitoring these activities and potential threats to election security.
Partners and Affiliates
🌐 Stay connected and secure on the go with Airalo's global eSIMs — Use the code NEWTOAIRALO15 if you’re new to Airalo to get an additional 15% discount.
Malware & Threats
Palo Alto Unit 42’s Threat Assessment on the different North Korean Threat Groups they Track
🦠 📺 A new malware called Vo1d has infected nearly 1.3 million outdated Android TV boxes across 197 countries — This malware can secretly download and install other software, primarily affecting devices in countries like Brazil and Pakistan. Its spread may be linked to vulnerabilities in older operating systems or unofficial firmware used by budget manufacturers.
🦠 🇩🇪 A new malware campaign is targeting Linux systems, specifically exploiting Oracle Weblogic servers for cryptocurrency mining — The malware, called Hadooken, installs a crypto miner and a DDoS botnet and spreads by using weak credentials to access other servers. Researchers have linked the campaign to two IP addresses associated with a bulletproof hosting provider in Germany.
🦠 🇮🇷 Iranian cyber group OilRig has launched a sophisticated malware attack targeting Iraqi government networks, including the Prime Minister's Office and Ministry of Foreign Affairs — The attack uses new malware called Veaty and Spearal, employing custom command-and-control methods that exploit compromised email accounts. This campaign demonstrates the ongoing threat posed by Iranian cyber actors in the region.
🦠 🇰🇵 Cybersecurity researchers have discovered malicious Python packages targeting developers through fake coding tests, linked to the North Korean Lazarus Group — These packages often appear in public repositories and trick developers into executing them without proper security checks. The attackers impersonate legitimate companies to lure potential victims, increasing the risk of malware infections.
🦠 🇨🇳 Chinese hackers known as Mustang Panda are using new malware to steal data from government networks — They have shifted their tactics, now spreading malicious software through infected removable drives instead of just spear-phishing emails. Their recent attacks focus on collecting specific document types from targeted organizations, especially in the Asia-Pacific region.
🦠 🕸️ The Quad7 botnet is expanding its attacks by targeting various SOHO devices, including Zyxel VPN appliances and Ruckus wireless routers, with new custom malware. It has evolved its tactics to evade detection, using new communication methods and backdoors for better control. To protect against these threats, users should update their device firmware, use strong passwords, and consider upgrading unsupported devices.
🦠 🇨🇴 Blind Eagle is a threat actor targeting the Colombian insurance sector with a customized version of the Quasar remote access trojan (RAT) — The attacks start with phishing emails that impersonate the Colombian tax authority, tricking victims into clicking malicious links. This malware can log keystrokes, steal data, and monitor banking activities, using sophisticated methods to avoid detection.
🦠 🇰🇵 North Korean hackers are using LinkedIn job scams to deliver malware called COVERTCATCH to developers — They disguise this malware as coding challenges, allowing them to compromise victims' systems. This attack is part of a broader strategy involving social engineering and software supply chain attacks targeting the cryptocurrency industry.
🎣 💕 A new sextortion email scam claims that a person's spouse is cheating, using their names to lure recipients into believing the threats — Scammers demand payments to avoid sharing fake evidence of infidelity, even though many recognize these emails as scams. It’s important to delete these messages and not click on any links.
🦠 💸 A new Android malware called SpyAgent uses optical character recognition to steal cryptocurrency recovery phrases from images on mobile devices. This malware targets users by pretending to be legitimate apps and can spread through SMS and social media. To protect against it, users should avoid downloading apps outside of Google Play and regularly check for malware.
AI, Crypto, Tech & Tools
Flipper Zero releases Firmware 1.0 after three years of development
WordPress.org to require 2FA for plugin developers by October
🛠️ 🦅 Microsoft is redesigning how anti-malware products connect with the Windows kernel to prevent issues like the recent CrowdStrike update failure. The changes will introduce new capabilities in Windows 11, allowing security vendors to operate outside of kernel mode for better reliability. Microsoft is also promoting Safe Deployment Practices to ensure safer updates and improve security in the Windows ecosystem.
🫱🏻🫲🏼 Criminal IP has teamed up with IPLocation.io to enhance IP address risk detection and analysis — This integration allows IPLocation.io users to access detailed threat intelligence and behavioral patterns from Criminal IP's database. The collaboration improves the accuracy of IP tracking and helps users identify potential online threats more effectively.
🤖 🦻🏻 Ford is applying for a patent for technology that listens to conversations in cars to deliver personalized ads based on the occupants' discussions and travel data. The system will analyze factors like location, speed, and trip types to show relevant advertisements during the drive. Ford emphasizes that filing patent applications is a standard business practice and does not indicate specific product plans.
🦀 Google is encouraging the use of Rust in old firmware to improve memory safety and reduce security vulnerabilities — By replacing legacy code written in C and C++, they aim to make firmware more secure while maintaining performance. This shift has already led to a notable decrease in memory safety issues in Android.
🤖 🪖 Over 90 countries, including the U.S. and China, are meeting in Seoul to discuss guidelines for using AI in the military — They aim to set principles for responsible AI deployment, especially as nations like Ukraine adopt new technologies. Recently, the U.S., Britain, and the EU signed an AI treaty focused on protecting human rights related to AI use.
🇺🇸 🦠 Kaspersky's customers in the U.S. will have their antivirus subscriptions moved to Pango’s UltraAV due to a ban on Kaspersky software. Customers need to switch to other products by September 29, or they will lose access to updates. UltraAV offers various security features, including malware protection and identity theft insurance, but lacks some protections found in Kaspersky's product.
Vulnerabilities, Research, and Threat Intelligence
Adobe Patches Critical, Code Execution Flaws in Multiple Products
Cisco Patches High-Severity Vulnerabilities in Network Operating System
GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution
Intel Informs Customers About Over a Dozen Processor Vulnerabilities
Ivanti Releases Urgent Security Updates for Endpoint Manager Vulnerabilities
Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
SAP Releases 16 New Security Notes on September 2024 Patch Day
🪳 💬 WhatsApp's "View Once" feature, designed to allow users to send media that disappears after being viewed, has a privacy flaw that attackers can exploit to save and share these messages. The feature does not prevent screenshots on desktop platforms, and researchers have found ways to bypass its protections. Meta is aware of the issue and is working on updates, but the flaw has been used for over a year.
🩹 🚨 Progress Software has released an emergency fix for a critical vulnerability in its LoadMaster products that allows remote attackers to execute commands. The flaw, tracked as CVE-2024-7591, affects multiple versions and can be mitigated by installing a new add-on package. Users of the free version of LoadMaster remain at risk, and all users are advised to secure their systems.
ICS, OT & IoT
ICS Patch Tuesday: Advisories Published by Siemens, Schneider, ABB, CISA
👨🏻💻 A study by Claroty reveals that many organizations use multiple remote access tools in their operational technology (OT) environments, which can lead to increased cybersecurity risks — Over half of the organizations analyzed rely on four or more remote access tools, with some using as many as 15-16. These tools often lack essential security features, making it harder to manage vulnerabilities and increasing operational costs.