Cyware Weekly Threat Intelligence - June 10–14

The Good

We’re back with the most interesting threat intel of the week. The past week witnessed several cybersecurity advancements, security incidents, as well as the emergence of new threats. To begin with, let’s first glance through all the positive developments that have emerged over the past week. Google has announced its expansion of Android’s security key technology to iOS devices. Researchers have developed a framework to measure the agility of cyber attackers and defenders. Meanwhile, Microsoft’s Windows 10 v1903, allows users to sign-in to their Microsoft account without a password.

• Google has announced that it is expanding Android’s security key technology to iOS devices. This implies that iPhone and iPad users could use Android smartphones as a security key while logging into their Google accounts on an iOS device. For this to work, users should have Bluetooth enabled on both their iOS and Android devices.
• A research team from the University of Texas at San Antonio (UTSA) has developed the first framework to score and quantify the agility of cyber attackers and defenders. This cyber agility project is funded by the Army Research Office. This framework will help government and industry organizations to test out numerous and varied responses to an attack.
• Microsoft has released Windows 10, version 1903, which allows users to add a passwordless phone number Microsoft account to Windows and to sign-in with the Microsoft Authenticator app. This Microsoft Authenticator app allows users to create a Microsoft account with just their phone number in mobile Office apps and unlock their Microsoft account without a password.

The Bad

Several data breaches and security incidents were witnessed in the past week. The US Customs and Border Protection agency disclosed that the photos of travelers and license plates have been compromised in a cyber attack at one of its contractors. Telegram suffered a powerful DDoS attack originating from China during the Hong Kong protests. Last but not least, ASCO, one of the world’s largest airplane parts manufacturer, suffered a ransomware attack paralyzing the production in factories across various countries.

• ASCO, one of the largest airplane parts manufacturer, suffered a ransomware attack crippling production in factories across four countries including Belgium, Germany, Canada, and the United States. ASCO factory in Zaventem, Belgium was hit by a ransomware infection causing major downtime as most of the plant’s IT systems were infected. As a result of which, almost 1,000 of its 1,400 workers were sent home.
• The City of Edcouch suffered a data breach after a hacker gained access to the city’s network and stole all the city’s information. The hacker then threatened to erase all the information if a ransom of $40,000 in BTC was not paid. The compromised information includes the personal data of over 3000 residents. The hacker also stole information from the water department and city finances.
• A Distributed Denial of Service (DDoS) attack on Telegram messenger caused service outages and connection problems for users primarily in South and North America and other parts of the world. A botnet formed of compromised computers sent huge traffic to Telegram servers which resulted in unstable connections as the messenger could not handle all the requests. The attack originated from China during the Hong Kong protests.
• Hackers stole several archived mini discs from the Radiohead’s lead singer Thom Yorke and demanded a ransom payment of $150,000 to stop them from being released to the public. The mini discs contained 18 tracks of OK Computer sessions. Instead of meeting the hacker’s demand, Radiohead themselves released all the stolen tracks on Bandcamp for £18, with all the proceeds going to Extinction Rebellion.
• The e-invitations platform Evite has admitted that it suffered a data breach in February. The stolen user data was actually put up for sale in the Dream Market marketplace by the infamous hacker ‘Gnosticplayers’. Evite also provided additional details about the breach. The social planning website revealed that an unauthorized third party gained access to an inactive data storage file that contained Evite user accounts prior to 2013.
• Three major private banks in Russia, OTP Bank, Alfa Bank, and HCF Bank had its customer data leaked online. A publicly available database listed as OTP Bank contained personal data of almost 800,000 clients. Another unsecured database that contained data of HCF bank held almost 24,400 customers’ personal information. DeviceLock uncovered two databases that contained customer data of Alfa Bank. The first database included personal data of over 55,000 customers and the second database contained just 504 entries.
• The retro gaming site ‘Emuparadise’ suffered a data breach in April 2018, which led to the exposure of account details of almost 1.1 million Emuparadise forum members. The exposed account information included members’ email addresses, IP addresses, usernames, and passwords stored as salted MD5 hashes.
• The US Customs and Border Protection agency disclosed that the photos of travelers and license plates have been compromised in a cyber attack at one of its contractors. The CBP said that one of its contractors transferred copies of license plate images and traveler photos collected by CBP to the company’s network, which was later compromised by an attacker. The agency did not reveal the name of the contractor, however, CBP’s public statement sent to the Washington Post included the name “Perceptics” in the title: “CBP Perceptics Public Statement”, indicating that the contractor is Perceptics.
• A misconfiguration in the Kingman Regional Medical Center website allowed unauthorized individuals to view and access the information entered into the website by KRMC customers. The information that was accessible by unauthorized persons included customer’s names, dates of birth, and limited medical information.
• An unprotected Elasticsearch database belonging to Shanghai Jiao Tong University which is sized 8.4TB has exposed almost 9.5 billion rows of email metadata. Based on the metadata, the researchers were able to find out that all emails were being sent or received by a specific person. The data included the IP address and user agent of the person checking their email.
• The City Hall in Lake City, Florida has been hit with the ‘Triple Threat’ ransomware, crippling the City Hall’s email and telephone services. However, all emergency services including Police and Fire are not affected by the attack. Public Safety networks have also been isolated and protected by encryption.

New Threats

The past week also witnessed the occurrence of several new malware strains and vulnerabilities. A new variant of Mirai botnet that uses 18 exploits to target IoT devices has been spotted. FIN8 threat group has resurfaced with a new variant of ShellTea/PunchBuggy backdoor targeting the hospitality industry. Meanwhile, Researchers have uncovered an ongoing crypto jacking campaign, wherein attackers are using NSA hacking tools to compromise vulnerable computers of businesses across the globe.

• Researchers have uncovered a new variant of Mirai botnet that uses 18 exploits to target IoT devices. This variant includes 8 new exploits apart from the 10 existing exploits. It is capable of targeting devices ranging from wireless presentation systems to set-top-boxes, SD-WANs, and even smart home controllers. It also includes exploits targeting the Oracle WebLogic Server RCE vulnerability.
• Microsoft has issued a warning on an ongoing malspam campaign that drops a backdoor trojan by abusing an old MS Office vulnerability. This campaign targets European users with emails written in various European languages. The spam emails include malicious RTF documents which when opened, download a backdoor trojan without any user interaction. However, the good news is that the backdoor trojan’s C&C server has been taken down since Microsoft issued a security alert.
• Microsoft has released its June 2019 Updates which fixes 88 security flaws affecting a range of its products. Out of the 88 flaws, 21 were rated ‘critical’ by Microsoft. The security updates also fix 9 remote code execution vulnerabilities found in the tech giant’s Office products such as Word 2010, Word 2013, Word 2016, Office 2010, Office Online Server, SharePoint Foundation 2013, Project Server 2010, SharePoint Server 2010, and SharePoint Server 2010 Office Web Apps.
• Security researchers have uncovered a new cryptocurrency mining malware that targets Oracle WebLogic servers. The malware exploits a known vulnerability to hijack insecure Oracle servers and install a Monero cryptocurrency mining bot on the servers. Researchers noted that the malware used in the attack remained hidden inside certificate files and later dropped Monero miners in the system.
• A new malspam campaign targeting UK users has been spotted in the wild. Researchers observed a number of spam emails related to this campaign with the scammers attempting to abuse DNS records in their methods. The IP addresses associated with the campaign are likely linked with Necurs botnet. The spam emails include HTML attachments, which upon clicking redirect users to a fraudulent trading site.
• Security researchers uncovered several vulnerabilities in the HSM of a major vendor that could allow attackers to retrieve sensitive data stored inside Hardware Security Modules. Attackers could also exploit a cryptography bug in the firmware signature verification to upload a modified firmware to the HSM that includes a persistent backdoor.
• An analysis by Google Security has revealed that hackers in 2017 had cleverly loaded adware into Android devices by tampering with the pre-installed software. The malware, a variant of the Triada adware family, was inserted through apps and programs built by third-party vendors. The adware was installed during the manufacturing process of Android phones. The affected smartphone models are Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20.
• FIN8 threat group is back with a new variant of ShellTea/PunchBuggy backdoor targeting the hospitality industry. The ShellTea malware is capable of creating and executing files, writing the data or shellcode it received from the C&C server, and executing the shellcode. The malware leverages a hashing algorithm to evade detection from antivirus tools.
• Researchers have uncovered a new variant of the Hide ‘N Seek botnet that includes exploits of two new vulnerabilities in the ThinkPHP installations and the Sonatype Nexus Repository Manager software installations. The vulnerabilities are tracked as CVE-2018-20062 and CVE-2019-7238 respectively. This new variant targets Android devices via ADB.
• Twitter URLs could be abused by bad actors for various nefarious activities including distributing malware, spread fake news, and redirecting users to a phishing page. Bad actors could abuse a tweet URL by simply changing the username but using a status ID that points to a tweet from an account controlled by them. In this way, attackers could spread fake news or malicious content as users click on the tweet thinking it is from a trusted source.
• Researchers have uncovered an ongoing crypto jacking campaign, wherein attackers are using NSA hacking tools to compromise vulnerable computers of businesses across the globe. The NSA hacking tools used in this campaign include EternalBlue and EternalChampion. Using these tools, attackers target unpatched Windows computers to install XMRig Monero miners.