Cyware Weekly Threat Intelligence, December 09 - 13, 2019

The Good

Ready to kickstart your weekend celebrations? Same here. But before we proceed, let’s quickly glance at positive developments made in cybersecurity this week. Google introduced better password protections and new real-time alert systems for phishing attempts on devices. Also, the U.S. Senate formally approved the legislation to establish a consortium to develop and prepare state and local governments’ cyber readiness program.

• Google has introduced a new real-time alert system that warns users of phishing attempts. These new protections can inspect the URLs of pages visited with Safe Browsing’s servers in real-time. The additional features include phishing protections and tab freezing to further control tab actions. Google expects that predictive phishing protection will protect hundreds of millions of people.
• The U.S. Senate has passed legislation to formally charter a National Cybersecurity Preparedness Consortium (NCPC) to foster preparedness among state and local governments and first responders for cyber emergencies. With Norwich as a founding member, the new law will allow DHS and NCPC to work together to develop multi-year plans for improving cyber readiness.

The Bad

Meanwhile, it remained a challenging week for organizations with big hacks and ransomware incidents. Over 2.7 billion email and password combinations were leaked online on an unprotected server. Also, Maze ransomware operators have taken the credit for the attack on leading wire and cable manufacturer Southwire Company. Further, over 752,000 birth applications were left exposed in the U.S due to an unguarded AWS storage bucket.

• More than 2.7 billion email addresses were left open on the web by an unnamed party. Surprisingly, over a billion of these records contained passwords in plain-text. Many of those leaked email addresses used domains of China’s biggest internet companies such as Tencent, Sina, Sohu, and NetEase. The database owner is yet to be identified.
• Maze Ransomware operators claimed responsibility for the attack on Southwire Company, LLC (Southwire) from Carrollton, Georgia. The ransomware affected computing systems on a company-wide basis and demanded 850 BTC, which is approximately $6 million in ransom.
• More than 752,000 applications were compromised when an online company, that allows people in the U.S. to obtain a copy of their birth certificate, left its AWS storage bucket server open. U.K-based Fidus Information Security reported about the exposed data and TechCrunch verified the same by matching names and addresses against public records.
• Researchers disclosed that more than 455,000 Turkish payment cards were being sold online on the popular Joker's Stash marketplace. After going through the card types and issuing banks, researchers suggested that the data came from a source that handles payments. Authorities are suspecting Magecart attackers (JS skimmers) behind this, also because of the popularity, it has earned recently.
• Airtel, India’s third-largest telecom network, admitted to an API security flaw in its smartphone app which could have exposed the personal data of more than 300 million users. Potentially exposed information includes name, address, email, date of birth, and network information among others.
• In Argentina, attackers encrypted 10 years’ worth of government data using a ransomware. Approximately 7,700 GB of data was compromised as a result of the attack. Reports suggested that attackers demanded somewhere between $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files. However, the government said that it had recovered 90 percent of data by itself.
• The details of over 15 million Iranian bank cards were published online after hundreds of bank branches were set on fire last month by demonstrators. Experts suspect a state-sponsored cyberattack and the largest financial scam in Iran’s history. The breach, which mostly targeted Iran’s three largest banks, affected close to one-fifth of the population.
• STCS, a Saudi Arabian telecom company, was found exposing hundreds of thousands of constantly updated GPS locations on its server. The unknown source reported that the unprotected server contained an instance of Kibana, a piece of software for sorting and visualizing data. The last 15 minutes of rolling data consisted of over 140,000 entries.
• The networks of BMW and Hyundai car manufacturers were breached by the Ocean Lotus hacker group. The attackers said to have used a penetration testing toolkit called Cobalt Strike as a backdoor to compromise networks.
• Colorado-based IT provider Complete Technology Solutions fell victim to a ransomware attack that impacted the operations of more than 100 dental practices in the U.S. Experts suggested that the intruders compromised a remote access tool that did not have two-factor authentication (2FA) activated.

New Threats

The week was seemingly full of threats and alerts. A new version of VegaLocker ransomware called Zeppelin was found affecting IT and healthcare services in the U.S. Canada, and Europe. In other news, a cyberespionage group returned with new evasion techniques only to target technology companies and government agencies in East Asia. Also, there was a critical flaw reported to be existing in Intel CPUs that use SGX, a solution designed to protect data in the private regions of memory.

• Zeppelin ransomware, a new variant of VegaLocker, has been spotted infecting the U.S. Canada, and European tech and healthcare companies via targeted attacks. It is not known how the ransomware is being distributed, but it is likely through Remote Desktop servers that are publicly exposed to the internet.
• Waterbear campaign, associated with the cyberespionage group BlackTech, returned with new evasion techniques. Researchers found that the bad actors are now using API hooking techniques to avoid being detected by a specific security product. The campaign uses two different APIs, namely ‘ZwOpenProcess’ and ‘GetExtendedTcpTable’ to hide its specific processes. The campaign mainly targets technology companies and government agencies in East Asia.
• Intel CPUs were discovered with a critical ‘Plundervolt’ flaw that directly breaches SGX’s integrity guarantees. The flaw exploits a dynamic voltage scaling feature that CPUs already have, and that can be triggered from software through a special Model Specific Register (MSR). Here, attackers could extract sensitive data, including full RSA encryption keys.
• A new malware campaign targeting iPhone users, dubbed Krampus-3PC, impacted more than 100 publisher websites including online newspapers and international weekly news magazines. The web redirect campaign masqueraded as a grocery store reward ad. Along the way, the malware proceeds to harvest users’ sessions and cookie information, thus giving attackers the ability to log into the victim’s various online accounts.
• Hundreds of fraudulent sites selling fake branded shoes were found to be infected with web skimmer malware. This not only disappointed the shoppers with faux merchandise but could also result in the loss of personal and financial data to Magecart fraudsters. Researchers noted that all had one thing in common: they were running outdated versions of Magento and PHP.
• The Gamaredon hacking group is said to be targeting Ukranian officials since October 2019. The group, that has a history of targeting individuals associated with the Ukranian government, used weaponized documents with malicious code as the initial infection vector in this campaign. According to security researchers, this campaign is still ongoing.
• A group of attackers was found using Microsoft Office 365 OAuth apps to hijack recipients’ accounts and their data. The attack involved recipients receiving phishing emails that pretend to be shared OneDrive or SharePoint files that contain a malicious link to the shared document. Attackers could gain access to a user's OneNote notebooks, stored files, and the ability to read their email and contacts.
• Google has fixed a critical security flaw that could potentially be exploited by sending a specially crafted message, resulting in permanent denial of service (DoS) in Android. It also fixed other high severity flaws including a remote code execution, an elevation of privilege, and five information disclosure weaknesses. Overall, over 40 vulnerabilities were addressed by the tech giant.
• Apple has addressed a bug found in AirDrop in iOS version 13.3. The bug allowed users to share files repeatedly between iOS devices that are within the wireless range while temporarily locking users out of their iPhones and iPads. The issue was mitigated by adding a rate-limit that prevents a barrage of requests over a short period of time.
• NVIDIA has released security updates for six high severity vulnerabilities impacting chips used in various devices such as Mercedes infotainment system, Mercedes Infotainment System, and Android tablets. The flaws are said to potentially provide attackers with a number of privileges to trigger denial-of-service (DoS) states, execute arbitrary code, escalate privileges, and launch information disclosure attacks.