Cyware Weekly Threat Intelligence, April 20 - 24, 2020

The Good

While the whole world continues to fight against the COVID-19 outbreak, here’s some good news from cyberspace to cheer you up. Researchers have successfully disrupted the operations of the notorious VictoryGate botnet that was primarily used by cybercriminals to mine Monero cryptocurrency. The botnet had infected more than 35,000 computers worldwide. On the other hand, the US Department of Justice (DoJ) has notified that hundreds of online domains related to COVID-19 scams were disrupted in an ongoing joint effort between law enforcement agencies and private companies.

• ESET researchers disrupted the operation of VictoryGate botnet by taking down more than 35,000 infected computers. The botnet that enabled its attackers to mine Monero cryptocurrency, had more than 90% of the total victims in Peru.
• The National Cyber Security Center (NCSC) along with other government departments successfully took down more than 2,000 online scams related to coronavirus in the last month. This crackdown is a part of a ‘Suspicious email reporting service’ program that aims to protect people from fraudsters and phishing scams.
• The US Department of Justice (DoJ) announced the takedown of hundreds of online domains related to COVID-19 scams, in a joint effort with law enforcement agencies, and a number of private sector companies. These domains were registered by cybercriminals to commit fraud and other crimes.
• The National Security Agency (NSA) and Australian Signals Directorate have jointly released an advisory for mitigating web shell malware. The advisory includes a detailed description of the attack process and mitigation techniques.

The Bad

Talking about the bad, Cognizant made headlines this week for being attacked by Maze ransomware operators. Just like the previous weeks, there were also reports of credentials and personal data dumping on dark web forums. These credentials belonged to users of Facebook, Webkinz World, and the Aptoide app.

• Cognizant confirmed that it was hit by the Maze ransomware last weekend. The attack had caused disruption for some of its clients.
• Personal information of 267 million active Facebook users was put up on the dark web for a mere price of $600. Most of these records belonged to users in the United States and included Facebook profiles, full names, unique IDs for each account, timestamps, and more.
• The credentials of over 23 million Webkinz World players also made their way to the dark web after a hacker breached a database using an SQL injection vulnerability.
• Two cryptocurrency firms - Lendf.Me and Uniswap - suffered a major loss after hackers stole $25 million worth of cryptocurrencies. The hackers used the reentrancy attack to siphon funds from each platform into their wallet. After some days of attack, the stolen amount was returned back to the firms by the attackers.
• Cybercriminals breached the database of the Aptoide app to steal 39 million customer records. Out of these, 20 million customer details, including login emails and hashed passwords, were published on a popular hacker forum.
• An unsecured database belonging to Kinomap leaked 42 million records including PII. The records belonged to users across the globe, including North America, Australia, Japan, the UK, and several European countries.
• Unknown activists posted nearly 25,000 email addresses and passwords belonging to the National Institutes of Health (NIH), World Health Organization (WHO), Gates Foundation, and other groups working to combat the coronavirus pandemic. The lists were posted on 4chan, Pastebin, Twitter, and Telegram.
• Beaumont Health notified about 114,000 patients that their personal data was breached in a phishing attack in 2019. The attackers had hacked several email accounts to access health and contact information.
• DoppelPaymer leaked confidential data belonging to the City of Torrance on its ‘Dopple Leaks’ website. The data included the city’s budget financials, various accounting documents, document scans, and an archive of documents belonging to the City Manager. In a different incident, SeaChange, a leading supplier of video delivery software solutions, became the latest victim of the Sodinokibi ransomware.
• An error in the official website of the U.S. Small Business Administration (SBA) had leaked personal information linked to 7900 businesses to other applicants that had applied for COVID-19 relief funds. This leaked data included Social Security numbers, income accounts, names, addresses, and contact information.
• An unsecured database belonging to Paay had exposed about 2.5 million transaction records online. These records were left open to the public for three weeks before it was secured.
• Data of around 3000 employees working with UniCredit S.p.A went on sale on the dark web on April 19. The attacker who sold the data claimed to have compromised UniCredit’s systems and exfiltrated the data. The compromised information included names, email addresses, phone numbers, and encrypted passwords.

New threats

Among the new threats discovered, FPGA chips were found to be affected by two flaws that could expose several critical systems to attack. One of these flaws is a new Starbleed vulnerability that affects Xilinx FPGA chips. Meanwhile, researchers also uncovered that a dozen state-backed hacking groups are using COVID-19 themes as a lure to target US government employees and healthcare organizations.

• A group of academics demonstrated a new technique to break into an FPGA system by using the FPGA’s own encryption engine. The technique involved abusing a MultiBoot function that allows users to specify an address to begin execution after reboot.
• Nearly all antivirus products could be turned into destructive tools by exploiting a vulnerability found in them. The issue resides in the fact that there’s a small time window between the file scan and the cleanup operation. Researchers noted that the attack could be performed via a directory junction in Windows, or through a symlink in Linux and macOS.
• Over a dozen state-backed hacking groups have been found actively using COVID-19 themes as a lure to target U.S. government employees and healthcare organizations. The purpose is to get their targets to click on malicious links and download files.
• Reports of exploitation of virtual meeting apps like Skype and Zoom also came to light this week. While Skype was used as a medium to steal credentials from users in a phishing campaign, Zoom was found to be impacted by a bug that could let hackers record meetings anonymously.
• There were also new variants of Hoaxcalls botnet and Emotet trojan. While the new Hoaxcalls variant exploited a vulnerability in the Zyxel Cloud CNM SecuManager, the new variant of Emotet came with additional obfuscation modules to evade detection.
• Security researchers also uncovered new malware like Bazaloader and CoronaLocker in different phishing campaigns. While BazaLoader acted as a backdoor on a compromised network, CoronaLocker locked a victim out of Windows by displaying a warning message.
• Phishing campaigns targeting various sectors also made news this week. In one case, the attackers had targeted the energy industry across the globe to spread the AgentTesla keylogger. In another incident, attackers tricked Office 365 users into sharing their Zoom login credentials.
• The Field Programmable Gate Array (FPGA) chips made by Xilinx were found to be impacted by a new vulnerability called Starbleed. Attackers can exploit the weakness to take over many safety-critical devices and launch attacks.