Cyware Monthly Threat Intelligence

The Good

As we gear up to a new month of the year, let’s quickly glance through all that happened over the past month. Before we get into the cybersecurity incidents and the new threats, let’s first acknowledge all the positive events that happened over the past month. Google has added two new privacy and security features in Chrome. Microsoft has introduced the passwordless authentication method ‘Windows Hello’, to enable Windows 10 users to sign in to their devices using biometric. Meanwhile, Amazon has launched a new feature dubbed ‘Alexa Guard’ which transforms the Echo smart speaker into a smart home security system.

• Google plans to add two new privacy and security features in Chrome, namely same-site cookies and anti-fingerprinting protection. The anti-fingerprinting protection blocks certain types of ‘user fingerprinting’ techniques that are being abused by online advertisers.
• Microsoft has announced the passwordless authentication method ‘Windows Hello’, that allows Windows 10 users to sign in to their devices using biometric information. The FIDO2 certified authenticator, Windows Hello enables users to authenticate secure access to their devices with a fingerprint, iris scan or facial recognition.
• Researchers from the University of Bath and Goldsmiths and the University of London are developing a technology inspired by fitness trackers that could prevent cyber attacks. This technology would signal when someone is resetting a password or updating anti-virus software with sound, lights, and vibration.
• Amazon has introduced a new feature dubbed ‘Alexa Guard’ which transforms the Echo smart speaker into a smart home security system. Alexa Guard feature will send alerts to users via their mobile devices if any problem is suspected at home. This feature is compatible with the Amazon Echo, Echo Dot, Echo Plus, Echo Show, Echo Spot, and Echo Input.
• New York’s Department of Financial Services has announced the formation of a dedicated ‘Cybersecurity Division’, which will focus on protecting consumers and industries from cyber threats. The new division will enforce cybersecurity regulation, advise on cybersecurity issues, provide guidance on DFS’s cyber regulation, and conduct cyber-related investigations.
• Singapore to launch a tool called ‘SG-Verify’ as a part of its smart nation efforts. This tool enables businesses to verify user identity and transfer data via QR codes. In addition, this tool will enhance situational awareness through the collection, sharing, and analysis of data and help government agencies provide more pre-emptive and responsive services.

The Bad

The month of May witnessed numerous data breaches and cyber attacks that saw the exposure of millions of people's personal information across the globe. Amazon has disclosed that it was hit with an extensive fraud last year, where attackers compromised almost 100 seller accounts and stole the loan funds. The networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers. Last but not least, HCL has inadvertently leaked employees’ personal information and plaintext passwords, customer reports, and web applications for managing personnel.

• Amazon has revealed that it was hit with an extensive fraud last year, where attackers compromised almost 100 seller accounts and stole the loan funds. Amazon noted that the accounts were likely compromised by phishing techniques that tricked sellers into providing their account details and login credentials.
• A new group dubbed ‘Mirrorthief’ has injected JavaScript-based payment card skimming script on the payment checkout pages of almost 201 campus online stores in the US and Canada. The malicious skimming script designed to steal payment card and personal details of customers is Trojan.JS.MIRRORTHEIF.AA.
• Attackers have targeted GitHub, GitLab, and Bitbucket users by replacing the code and commits from the victims’ Git repositories and leaving a ransom note that demands a ransom payment of 0.1 Bitcoin (~$570). A GitHub search revealed that almost 400 Github repositories have been targeted.
• The networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers. However, Potter County managed to get some of its computers back online, and restored its email services and Internet access last week.
• An unprotected database belonging to ApexSMS Inc., a SMS text marketing company, has exposed records of almost 80 million people. The exposed data includes hashed email addresses, names, city locations, IP addresses, phone numbers, and carrier network for mobile.
• Magecart threat group has injected its card skimming script on Forbes’ subscription website in order to steal the credit card data that customers enter on the checkout page. The infected website has been taken down with the help of Freenom’s anti-abuse API, however, the obfuscated Magecart skimmer script is still present on the forbesmagazine[.]com.
• Attackers hacked the webcast of the first Eurovision semi-final to display faked explosions along with a warning about a missile attack. Viewers switching on to the Kan webcast saw the warning “Risk of missile attack. Please take shelter,” along with the sound of a rocket-warning siren. The Israeli national broadcaster, Kan, suspects Hamas to be behind this action.
• HCL has inadvertently leaked employees’ personal information and plaintext passwords, customer reports, and web applications for managing personnel. The exposed employee information includes candidate ID, name, mobile number, joining date, joining location, recruiter SAP code, recruiter name, created date, user name, cleartext password, BGV status, offer accepted, and a link to the candidate form.
• Over 12,000 unprotected MongoDB databases have been deleted by Unistellar attackers, who left behind a ransom note asking the owners of the databases to contact them to have the data restored. The reason for asking the owners to contact might be the fact that the hacker could charge ransom amount in cryptocurrency according to the sensitivity of the database.
• The SLCERT has uncovered that websites of almost 11 institutions in Sri Lanka have been hacked and defaced by attackers. The impacted websites include those of the Kuwait Embassy in Colombo, the Tea Research Institute in Talawakelle, The Rajarata University in Mihintale and 10 other private institutions. However, none of the gov.lk websites have been affected by the attacks.
• Salesforce deployed a database script to its production environment that inadvertently broke the access permission settings across organizations and gave employees access to all of their company's files. Salesforce customers in Europe and North America were the most impacted by this incident.
• An unprotected database belonging to Chtrbox, a social media marketing firm, has exposed the contact information of over 49 million Instagram influencers, celebrities, Food bloggers, and brand accounts. The exposed information includes Instagram bio, profile picture, number of followers, email addresses, locations, and phone numbers.
• Google accidentally stored unhashed passwords for some of its G suite users for almost 14 years due to an implementation error. Google confirmed that there has been no evidence of any improper access to or misuse of the impacted G Suite passwords.
• Unauthorized third-parties have hacked the databases of the news aggregation site Flipboard and have potentially downloaded the user data contained within them. The hacked databases contained Flipboard users’ account information including user names, hashed and salted passwords, email addresses, and digital tokens used to login to Flipboard using site credentials from Google, Facebook, and Twitter.
• The website of First American Financial Corp exposed almost 885 million sensitive documents online including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. According to the researcher who uncovered the breach, anyone who knew the URL for a valid document at the firstam.com website could view other documents by simply modifying a single digit in the link.
• Canva, an Australia-based company that provides graphic design service, has been hacked by ‘Gynosticplayers’ and data for roughly 139 million users have been compromised. The stolen data included users personal information including names, usernames, email addresses, residential city, and country. The compromised data also includes password hashes for almost 61 million users and Google token for other users.
• A misconfigured database belonging to Amadeus has exposed information on 36 million booked flights, 15 million passengers, over one million hotel bookings, and 700,000 visa applications. Information on international travel plans of high-ranking Israeli diplomats including Israeli Prime Minister Benjamin Netanyahu has been exposed.
• Attackers hacked the gift card website of the major UK pub chain, Greene King, and accessed customers’ personal information. The compromised information includes names, email addresses, user IDs, encrypted passwords, addresses, postcode, and gift card order numbers of customers.
• Attackers implanted malware on point-of-sale systems at 102 Checkers and Rally’s locations in order to steal customers’ payment card data. The payment card information stored on the magnetic stripe of payment cards including cardholder names, payment card numbers, card verification codes, and expiration dates have been compromised.
• Security researchers Noam Rotem and Ran Locar from VpnMentor have uncovered an unprotected Elasticsearch database belonging to Pyramid Hotel Group. The unsecured database has exposed almost 85GB in security logs of major hotels including Aloft Sarasota of Marriott property, Tarrytown House Estate in New York, Carton House Luxury Hotel in Ireland, Aloft Hotels in Florida, and Temple Bar Hotel in Ireland.

New Threats

Several new malware, ransomware, vulnerabilities, and threat groups emerged over the past month. Threat actor group TA542 ’s signature payload Emotet was found distributing third-party payloads such as Qbot, The Trick, IcedID, and Gootkit. The Department of Homeland Security (DHS) has published a detailed analysis of the ELECTRICFISH malware, which is associated with the North Korean government. Meanwhile, WhatsApp had a critical vulnerability in its audio call feature that could allow attackers to install spyware on mobiles via a WhatsApp call.

• A new ransomware dubbed ‘MegaCortex’ has been discovered. This ransomware targeted corporate networks in the US, Italy, Canada, Netherlands, Ireland, and France. The attackers behind the ransomware have highly employed automation and a number of tools to propagate the ransomware in large numbers.
• The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have published a detailed analysis of a new malware called ‘ELECTRICFISH’, which is associated with the threat group ‘HIDDEN COBRA’. This group is affiliated with the North Korean government.
• A cybersecurity firm uncovered that APT3 Chinese threat actor group had used NSA hacking tools in 2016 attacks, a year before the Shadow Brokers leaked the NSA hacking tools. The researchers also noted that another malware family known as Filensfer was used by the threat group.
• Researchers have spotted a new malware dubbed ‘ATMitch’ that has been active since 2017. Researchers noted that the malware might have been a part of a 2016 advanced cyber-espionage campaign targeting a Russian bank. Its capabilities include reading commands from a file included into “c:\intel” folder, interacting with the ATM drivers to retrieve information about the current amount and the dispensed amount, and initiating communication between the PIN pad and Dispenser components using ‘msxfs.dll’ library.
• Threat actor group TA542 ’s signature payload Emotet was found distributing third-party payloads such as Qbot, The Trick, IcedID, and Gootkit. Researchers also noted that this new version of Emotet loaded its modules for spamming, credential stealing, email harvesting, and spreading on local networks.
• A serious buffer overflow vulnerability was identified in the audio call feature of WhatsApp. This vulnerability could allow attackers to install spyware on mobiles via a WhatsApp call. The buffer overflow vulnerability (CVE-2019-3568) has been patched in WhatsApp versions v2.19.134 (Android), v2.19.51 (iOS), v2.18.348 (Windows Phone) and v2.18.15 (Tizen). The bug has also been patched in WhatsApp Business versions v2.19.44 (Android) and v2.19.51 (iOS).
• Researchers have uncovered security flaws in Intel’s hardware that could allow attackers to siphon sensitive data from a computer’s CPU. The series of vulnerability and exploits are classified as MDS attacks (Microarchitectural Data Sampling attacks) which include RIDL (Rogue In-flight Data Load), ZombieLoad, and Fallout.
• Security researchers spotted a new variant of the Trickbot trojan that is distributed via Redirection URL in a spam email campaign. This variant deploys additional modules for various nefarious tasks such as stealing browser data and system information, stealing credentials from Filezilla, Microsoft Outlook, and WinSCP.
• A new variant of Mirai botnet has been found using a total of 13 different exploits to target routers and other IoT devices. The malware is dubbed as Backdoor.Linux.MIRAI.VWIPT and includes both backdoor and DDoS capabilities.
• A security researcher who goes by the name ‘SandboxEscaper’ has published the demo exploit code for three Microsoft zero-day vulnerabilities. The first vulnerability is found in the Windows 10 systems, the second vulnerability in Windows Error Reporting service and the third vulnerability in Internet Explorer 11.
• A new variant of Satan ransomware has been found leveraging three new vulnerabilities to spread across public and private networks. The new three vulnerabilities include Spring Data REST Patch Request (CVE-2017-8046), ElasticSearch (CVE-2015-1427), and ThinkPHP 5.X Remote Code Execution (no CVE assigned).
• A Cross-Site Scripting (XSS) vulnerability has been detected in the WordPress plugin ‘Slimstat’, which has currently over 100k installs. The vulnerability could allow an attacker to inject arbitrary JavaScript code on the plugin access log. This XSS vulnerability has impacted all Slimstat plugin versions prior to 4.8.1.
• Researchers from IBM X-Force have observed malspam campaigns targeting business users with the Hawkeye keylogger malware during the last two months. The malspam campaigns distribute Hawkeye keyloggers in order to steal accounts credentials and sensitive data from business users, which can be later used in BEC scams and account takeover attacks.
• Researchers have detected several compromised Content Management Sites (CMS) such as WordPress and Joomla that were serving Shade ransomware, backdoors, redirectors, and a variety of phishing pages. The core reason for the compromise of Wordpress and Joomla sites could be unpatched vulnerabilities and outdated plugins, themes, and extensions.
• Researchers have revealed that Emotet banking trojan was the most prevalent email-based threat in the first three months of 2019. The analysis revealed that in the first three months of 2019, 82% of all payloads were either Emotet or other banking trojans. Emotet is now widely considered a botnet, frequently downloading additional modules.