NEWS:
New Cyber Espionage Group Targeting Ministries of Foreign Affairs
Cybersecurity researchers on Thursday took the wraps off a new cyberespionage group that has been behind a series of targeted attacks against diplomatic entities and telecommunication companies in Africa and the Middle East since at least 2017. Dubbed “BackdoorDiplomacy,” the campaign involves targeting weak points in internet-exposed devices such as web servers to perform a panoply of cyber hacking activities, including laterally moving across the network to deploy a custom implant called Turian that’s capable of exfiltrating sensitive data stored in removable media.
https://thehackernews.com/2021/06/new-cyber-espionage-group-targeting.html
Biden Sets Red Line for Putin Over Ransomware Attacks
US President Joe Biden delivered a stern warning Wednesday to Russian leader Vladimir Putin over ransomware attacks emanating from Russia, saying he was prepared to retaliate against any more cyber assaults on American infrastructure. Speaking after the two leaders’ first summit in Geneva, Biden said he laid down the line on Moscow not taking action against hackers who have extorted hundreds of millions of dollars from western governments, companies, and organisations from the safety of Russian soil. “I pointed out to him we have significant cyber capability and he knows it,” Biden said in a press conference after their talks. “He doesn’t know exactly what it is, but it’s significant. If in fact they violate these basic norms, we will respond.”In a separate press conference following the three-and-a-half hours of discussions, Putin rejected the allegations and insisted that the United States itself was behind a large number of cyberattacks.
https://www.securityweek.com/biden-sets-red-line-putin-over-ransomware-attacks
Hiccup in Akamai’s DDoS Mitigation Service Triggers Massive String of Outages
An hour-long outage hit airlines, banks and the Hong Kong Stock exchange. It’s thought to have been caused by a DDoS mitigation service. UPDATE Major financial institutions, airlines and the Hong Kong stock exchange were knocked offline by a backfiring distributed denial-of-service (DDoS) mitigation service Thursday. The hour-long outage, which was triggered at approximately 1 a.m. EST Thursday, is tied to Akamai Technology’s anti-DDoS Prolexic service. In a statement to Threatpost at 7:44 a.m. EST, Akamai confirm a segment of its Prolexic platform was impacted and is now back up and running. “We are continuing to validate services. We will share more details of what transpired, but our first priority is ensuring all customer impact is mitigated,” wrote Chris Nicholson, senior public relations manager, Akamai.
A New Spyware is Targeting Telegram and Psiphon VPN Users in Iran
Threat actors with suspected ties to Iran have been found to leverage instant messaging and VPN apps like Telegram and Psiphon to install a Windows remote access trojan (RAT) capable of stealing sensitive information from targets’ devices since at least 2015. Russian cybersecurity firm Kaspersky, which pieced together the activity, attributed the campaign to an advanced persistent threat (APT) group it tracks as Ferocious Kitten, a group that has singled out Persian-speaking individuals allegedly based in the country while successfully operating under the radar.
https://thehackernews.com/2021/06/a-new-spyware-is-targeting-telegram-and.html
Here’s why you should restart Google Chrome at least once a week
One of the biggest mistakes I see people who use Google Chrome do is run the browser for days, weeks, and sometimes even months without restarting it. I know of a few people who only ever restart the browser when it crashes, or an update forces a reboot of their computer. This is a bad idea, not only because it allows Chrome to eat system resources over an extended period, but also because it delays the installation of important security updates, leaving your system vulnerable to attack.
https://www.zdnet.com/article/heres-why-you-should-restart-google-chrome-at-least-once-a-week/
INCIDENTS:
Poland institutions and individuals targeted by an unprecedented series of cyber attacks
“Lately we’ve been subject to an unprecedented cyber attack against Poland, against Polish institutions and against individual email account users,” Morawiecki told the Polsat News television channel on Tuesday. Last week, hackers breached the private email account of Michal Dworczyk, the head of the prime minister’s office and member of the ruling Law and Justice party (PiS). The emails were later leaked through the instant messaging system Telegram. The media reported that the politicians targeted by the hackers used their private Gmail accounts for communications, instead of using their secure government accounts.
https://securityaffairs.co/wordpress/119043/hacking/poland-hit-cyber-attacks.html
REvil ransomware hits US nuclear weapons contractor
US nuclear weapons contractor Sol Oriens has suffered a cyberattack allegedly at the hands of the REvil ransomware gang, which claims to be auctioning data stolen during the attack. Sol Oriens describes itself as helping the “Department of Defense and Department of Energy Organizations, Aerospace Contractors, and Technology Firms carry out complex programs.” However, job postings first spotted by CNBC correspondent Eamon Javers provide some insight into Sol Orien’s operations, who are seeking program managers, consultants, and a ‘Nuclear Weapon System Subject Matter Expert’ to work with the National Nuclear Security Administration (NNSA).
https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-us-nuclear-weapons-contractor/
Monumental Supply-Chain Attack on Airlines Traced to State Actor
A monster cyberattack on SITA, a global IT provider for 90 percent of the world’s airline industry, is slowly unfurling to reveal the largest supply-chain attack on the airline industry in history. The enormous data breach, estimated to have already impacted 4.5 million passengers, has potentially been traced back to the Chinese state-sponsored threat actor APT41, and analysts are warning airlines to hunt down any traces of the campaign concealed within their networks.
MALWARE:
Researchers Uncover ‘Process Ghosting’ — A New Malware Evasion Technique
Cybersecurity researchers have disclosed a new executable image tampering attack dubbed “Process Ghosting” that could be potentially abused by an attacker to circumvent protections and stealthily run malicious code on a Windows system. Process Ghosting expands on previously documented endpoint bypass methods such as Process Doppelgänging and Process Herpaderping, thereby enabling the veiled execution of malicious code that may evade anti-malware defences and detection.
https://thehackernews.com/2021/06/researchers-uncover-process-ghosting.html
Paradise Ransomware source code released on a hacking forum
The complete source code for the Paradise Ransomware has been released on a hacking forum allowing any would-be cyber criminal to develop their own customized ransomware operation. Released on the hacking forum XSS, the link to the source code is only accessible to active users on the site who have previously replied to or reacted to other posts on the site. Security Joes researcher Tom Malka, who shared the source code with BleepingComputer, compiled the package and found it creates three executables – a ransomware configuration builder, the encryptor, and a decryptor.
https://therecord.media/source-code-for-paradise-ransomware-leaked-on-hacking-forums
https://securityaffairs.co/wordpress/119006/cyber-crime/paradise-ransomware-code-leaked.html
Handy guide to a new Fivehands ransomware variant
NCC Group’s Incident Response team observed a new variant of the FiveHands ransomware, deployed by an affiliate leveraging publicly available tools to progress their attack. This blog post aims to describe the developments in the ransomware variant and the techniques used by the affiliate. The affiliate appears to have been active for a long period of time. Open-source intelligence suggests a link to UNC2447, matching several characteristics shown through the campaign. Including aggressive tactics when urging the victim to pay the ransom. In this instance, attempts were made to directly call individuals within the organisation using spoofed caller IDs.
VULNERABILITIES:
Thousands of VMware vCenter Servers Remain Open to Attack Over the Internet
Thousands of instances of VMware vCenter Servers with two recently disclosed vulnerabilities in them remain publicly accessible on the Internet three weeks after the company urged organizations to immediately patch the flaws, citing their severity. The flaws, CVE-2021-21985 and CVE-2021-21986, basically give attackers a way to take complete control of systems running vCenter Server, a utility for centrally managing VMware vSphere virtual server environments. The vulnerabilities exist in vCenter Server versions 6.5, 6.7, and 7.0.
Vulnerabilities Allow Hackers to Disrupt, Hijack Schneider PowerLogic Devices
Vulnerabilities discovered in some older Schneider Electric PowerLogic products can allow hackers to remotely take control of devices or disrupt them. Schneider informed customers earlier this month that its PowerLogic EGX100 and EGX300 communication gateways are affected by six types of vulnerabilities that could be exploited to access devices, launch denial-of-service (DoS) attacks, and for remote code execution. The impacted products are part of the company’s power monitoring and control offering, but they have reached end of life.
Google fixes seventh Chrome zero-day exploited in the wild this year
Google has released Chrome 91.0.4472.114 for Windows, Mac, and Linux to fix four security vulnerabilities, with one of them a high severity zero-day vulnerability exploited in the wild. This version, released today, June 17th, 2021, to the Stable desktop channel, has started rolling out worldwide and will become available to all users over the next few days. Google Chrome will automatically attempt to upgrade the browser the next time you launch the program, but you can perform a manual update by going to Settings > Help > ‘About Google Chrome’.
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
