Cyware Weekly Threat Intelligence - May 06–10

The Good

We’re back with the most interesting threat intel of the week. The past week witnessed several cybersecurity advancements, security incidents, as well as the emergence of new threats. To begin with, let’s first glance through all the good that has happened in cyberspace over the past week. Google plans to add two new privacy and security features in Chrome, namely same-site cookies and anti-fingerprinting protection. The UK government has published a consultation document on the proposed regulation of consumer IoT devices. Meanwhile, Singapore's Parliament has voted to pass the ‘Protection from Online Falsehoods and Manipulation’ bill, despite strong criticism from various global tech companies.

• A bipartisan group of Senators has introduced a bill in order to stop U.S. Customs and Border Protection (CBP) from selling the personal data of citizens who move overseas. At present, the CBP has access to information such as residential addresses, Social Security numbers and passport numbers that are included on the shipping manifests. However, this bill would require this information to be removed from the manifests.
• The UK government has published a consultation document on the proposed regulation of consumer IoT devices. The consultation document helps the government to make a decision on measures which can be taken forward into legislation.
• Singapore's Parliament has voted to pass the ‘Protection from Online Falsehoods and Manipulation’ bill, despite strong criticism from various global tech companies. This bill has been voted to pass after a two-day debate, with 72 Members of Parliament voting in favor and nine members from opposition party Workers' Party voting against it.
• Google plans to add two new privacy and security features in Chrome, namely same-site cookies and anti-fingerprinting protection. The anti-fingerprinting protection blocks certain types of ‘user fingerprinting’ techniques that are being abused by online advertisers.
• Microsoft has announced the passwordless authentication method ‘Windows Hello’, that allows Windows 10 users to sign in to their devices using biometric information. The FIDO2 certified authenticator, Windows Hello enables users to authenticate secure access to their devices with a fingerprint, iris scan or facial recognition.

The Bad

Several data breaches and security incidents were witnessed over the past week. Attackers have targeted GitHub, GitLab, and Bitbucket users by replacing the code and commits from the victims’ Git repositories and leaving a ransom note behind. In another instance, Binance cryptocurrency exchange suffered a massive security breach compromising 7,000 Bitcoins, worth nearly $41 million from its hot wallet. Last but not least, the networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers.

• An unprotected MongoDB database exposed almost 275, 265, 298 records with personally identifiable information (PII) such as names, email addresses, genders, dates of birth, phone numbers, educational details, professional skills, employment history, current employer and salary. A hacker group named ‘Unistellar’ deleted all the data and left a message behind.
• Amazon has revealed that it was hit with an extensive fraud last year, where attackers compromised almost 100 seller accounts and stole the loan funds. Amazon noted that the accounts were likely compromised by phishing techniques that tricked sellers into providing their account details and login credentials.
• A new group dubbed ‘Mirrorthief’ has injected JavaScript-based payment card skimming script on the payment checkout pages of almost 201 campus online stores in the US and Canada. The malicious skimming script designed to steal payment card and personal details of customers is Trojan.JS.MIRRORTHEIF.AA.
• Attackers have targeted GitHub, GitLab, and Bitbucket users by replacing the code and commits from the victims’ Git repositories and leaving a ransom note that demands a ransom payment of 0.1 Bitcoin (~$570). A GitHub search revealed that almost 400 Github repositories have been targeted.
• Airbnb users have complained that their accounts were hacked and used for making bookings, thereby charging them thousands of pounds. Few users complained that their previous bookings have been canceled. Users also noted that they have been locked out of their accounts, leaving them unable to reset their passwords. Meanwhile, some users had their accounts deleted.
• Wyzant, an online tutoring marketplace has suffered a data breach compromising users’ personal information such as names, email addresses, zip codes, and Facebook profile images. The compromise was a result of an unauthorized third-party gaining illegal access to Wyzant’s database.
• Scammers are sending phishing emails with links to malicious sites hosted on legitimate cloud services such as Amazon Web Services (AWS), Microsoft Azure, Alibaba Cloud. The phishing sites are designed to steal victims’ personal information. Scammers are also abusing Google Docs in order to bypass spam filters.
• Scammers are taking advantage of the recently released ‘Avengers: Endgame’ movie and are tricking fans into providing their email addresses, passwords, and billing information by promising them a full movie download.
• Binance cryptocurrency exchange suffered a security breach on May 07, 2019, wherein hackers stole users’ API keys, two-factor authentication codes, and other information. Additionally, hackers also withdrew 7,000 Bitcoins, worth nearly $41 million from Binance’s hot wallet. Hackers leveraged phishing, malware, and other attacks to gain access to Binance user accounts.
• An unprotected database belonging to Burger King has exposed 37,900 records of Kool King Shop customers including names, dates of birth, phone numbers, email addresses, passwords, voucher codes, links to the externally stored certificates, and more. The database also contained CRM access details for 25 Burger King administrators such as email addresses, names, encrypted passwords, and e-commerce CRM backend logs, with internal details and debug information.
• The networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers. However, Potter County managed to get some of its computers back online, and restored its email services and Internet access last week.
• An unprotected Elasticsearch database belonging to Apptium, a third-party service provider that manages Freedom Mobile’s customer data, has exposed almost 5 million records of customer data. The compromised data includes customers’ names, email addresses, phone numbers, postal addresses, dates of birth, customer types, and Freedom Mobile account numbers.
• An unprotected database belonging to ApexSMS Inc., a SMS text marketing company, has exposed records of almost 80 million people. The exposed data includes hashed email addresses, names, city locations, IP addresses, phone numbers, and carrier network for mobile.

New Threats

The past week also witnessed the occurrence of new malware strains and vulnerabilities. The Department of Homeland Security (DHS) has published a detailed analysis of the ELECTRICFISH malware, which is associated with the North Korean government. A cybersecurity firm has uncovered that APT3 Chinese threat actor group had used NSA hacking tools in 2016 attacks. Meanwhile, the latest versions of UC Browser and UC Browser Mini Android apps have been found to be vulnerable to URL spoofing attacks.

• A new ransomware dubbed ‘MegaCortex’ has been discovered this past week. This ransomware targeted corporate networks in the US, Italy, Canada, Netherlands, Ireland, and France. The attackers behind the ransomware have highly employed automation and a number of tools to propagate the ransomware in large numbers.
• The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have published a detailed analysis of a new malware called ‘ELECTRICFISH’, which is associated with the threat group ‘HIDDEN COBRA’. This group is affiliated with the North Korean government.
• A new variant of Retefe banking trojan has been observed using a different obfuscation technique to infect Windows and macOS systems. This new variant uses Smoke Loader as an intermediate loader. It leverages stunnel encrypted tunneling mechanism to evade detection by anti-virus software.
• Orpak Systems contained a string of security vulnerabilities in its fuel station management software, Siteomat. One of the serious flaws among them was the use of hard-coded usernames and passwords for application login that could allow attackers to access customer details and then steal sensitive information.
• The Russian-linked espionage group ‘Turla’ has been observed compromising Microsoft Exchange mail servers with the help of a backdoor dubbed ‘LightNeuron’. LightNeuron uses a technique called ‘Transport Agent’ to gain persistence on an infected machine. By using this technique, the malware can read and modify any email going through the mail server. Furthermore, it can compose and send new emails, as well as block any email.
• A cybersecurity firm uncovered that APT3 Chinese threat actor group had used NSA hacking tools in 2016 attacks, a year before the Shadow Brokers leaked the NSA hacking tools. The researchers also noted that another malware family known as Filensfer was used by the threat group.
• Researchers uncovered vulnerabilities in PrinterLogic Print Management software that could allow an attacker to reconfigure the software and remotely execute arbitrary code. The vulnerability has impacted all PrinterLogic agent versions up to 18.3.1.96. A security update to fix the vulnerabilities is currently not available.
• Researchers have spotted a new malware dubbed ‘ATMitch’ that has been active since 2017. Researchers noted that the malware might have been a part of a 2016 advanced cyber-espionage campaign targeting a Russian bank. Its capabilities include reading commands from a file included into “c:\intel” folder, interacting with the ATM drivers to retrieve information about the current amount and the dispensed amount, and initiating communication between the PIN pad and Dispenser components using ‘msxfs.dll’ library.
• A new variant of Dharma ransomware has been observed leveraging a new technique to hide its malicious activities. This variant is propagated via spam emails disguised as an ESET AV Remover Installer to trick users into downloading it.
• The latest versions of UC Browser (12.11.2.1184) and UC Browser Mini (12.10.1.1192) Android apps have been found to be vulnerable to URL spoofing attacks. These browsers have over 600 million installs across the world.