17.09.2021
NEWS:
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware
Bitdefender announced the availability of a universal decryptor for REvil/Sodinokibi. Created in collaboration with a trusted law enforcement partner, this tool helps victims encrypted by REvil ransomware to restore their files and recover from attacks made before July 13, 2021. On July 13 of this year, parts of REvil’s infrastructure went offline, leaving infected victims who had not paid the ransom unable to recover their encrypted data. This decryption tool will now offer those victims the ability to take back control of their data and assets.
Passwordless authentication – Introducing password removal for Microsoft Accounts
Common attacks such as phishing, password spray, and credential stuffing rely on one unchanging truth: when it comes to passwords, human behaviour is predictable. Armed with this predictability, bad actors still succeed most of time when attempting these types of attacks, even though the tools they’re using are 30 years old. Starting today, we’re excited to announce that anyone using a consumer Microsoft account can go completely passwordless! You can now delete your password from your Microsoft account—or set up a new account with no password—and sign-in using other more secure and convenient authentication methods such as the Microsoft Authenticator app, Windows Hello, or physical security keys.
Household Names Hit with £500K Fine for Spamming Consumers
Three big-name UK brands have been collectively fined nearly half a million pounds by the privacy regulator after sending hundreds of millions of nuisance marketing messages to consumers. We Buy Any Car was fined £200,000 by the Information Commissioner’s Office (ICO) after bombarding consumers with over 191 million emails and 3.6 million nuisance texts. Saga Services and Saga Personal Finance were handed £150,000 and £75,000 penalties, respectively, for sending 157 million emails between them. Recipients had not given direct consent to receive such messages, and the firms have been hit with an additional enforcement notice warning that court action could follow if their illegal marketing continues.
https://www.infosecurity-magazine.com/news/household-brands-500k-fine/
‘Significant threat:’ cyber-attacks increasingly targeting critical infrastructure
A quarter of cyber incidents reported to Australian security officials over the past year have targeted critical infrastructure and essential services, including health care, food distribution and energy. The Australian Cyber Security Centre (ACSC) disclosed the incidents in a report published yesterday, warning of “significant targeting, both domestically and globally, of essential services.” These incidents have “underscored the vulnerability of critical infrastructure to significant disruption in essential services, lost revenue and the potential of harm or loss of life.” monitor showing data and network activity last month at the Internet 2.0 office in Canberra, Australia. The report will also show ransomware attacks disclosed to the ACSC increased 15 percent in the 2020-21 financial year, when compared with the previous financial year.
https://taipeitimes.com/News/feat/archives/2021/09/16/2003764442
INCIDENTS:
Ransomware encrypts South Africa’s entire Dept of Justice network
The justice ministry of the South African government is working on restoring its operations after a recent ransomware attack encrypted all its systems, making all electronic services unavailable both internally and to the public. As a consequence of the attack, the Department of Justice and Constitutional Development said that child maintenance payments are now on hold until systems are back online. The incident happened on September 6 and the department activated the contingency plan for such events to ensure the continuation of some activity in the country.
Mass Personal Data Theft From Paris Covid Tests: Hospitals
Hackers stole the personal data of around 1.4 million people who took Covid-19 tests in the Paris region in the middle of 2020, hospital officials in the French capital disclosed on Wednesday. Hospital officials said they filed a complaint with the Paris prosecutor’s office on Wednesday after confirming on September 12 that such a cyber attack took place over the summer. Stolen were the identities, social security numbers and contact details of people tested as well as the identities and contact details of health professionals who dealt with them, along with the test results, the hospital organisation said. In all, “the stolen files concern 1.4 million people, almost exclusively for tests taken in the middle of 2020” in the Paris region, the hospitals organisation said in a statement.
https://www.securityweek.com/mass-personal-data-theft-paris-covid-tests-hospitals?&web_view=true
German election authority confirms likely cyber attack
BERLIN (AFP) – Suspected hackers last month briefly disrupted the website of the authority running Germany’s Sept 26 General Election, a spokesman for the body told AFP on Wednesday (Sept 15). The development, first reported by Business Insider, comes as German federal prosecutors probe alleged cyber attacks against lawmakers during the campaign to choose a new Parliament and a successor to Chancellor Angela Merkel. “At the end of August, the website of the Federal Returning Officer only had limited accessibility for a few minutes due to a malfunction,” said the spokesman when asked about the hacking report.
https://www.straitstimes.com/world/europe/german-election-authority-confirms-likely-cyber-attack
Technology giant Olympus hit by BlackMatter ransomware
Olympus said in a brief statement that it is “currently investigating a potential cybersecurity incident” affecting its European, Middle East and Africa computer network. “Upon detection of suspicious activity, we immediately mobilized a specialized response team including forensics experts, and we are currently working with the highest priority to resolve this issue. As part of the investigation, we have suspended data transfers in the affected systems and have informed the relevant external partners,” the statement said. But according to a person with knowledge of the incident, Olympus is recovering from a ransomware attack that began in the early morning of September 8.
MALWARE:
New Zloader attacks disable Windows Defender to evade detection
An ongoing Zloader campaign uses a new infection chain to disable Microsoft Defender Antivirus (formerly Windows Defender) on victims’ computers to evade detection. According to Microsoft’s stats, Microsoft Defender Antivirus is the anti-malware solution pre-installed on more than 1 billion systems running Windows 10. The attackers have also changed the malware delivery vector from spam or phishing emails to TeamViewer Google ads published through Google Adwords, redirecting the targets to fake download sites.
Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread
Recently, there has been a plethora of UPX packed crypto-mining malware written in Golang targeting Linux systems and web applications popping up in the news. The malware’s primary tactic is to spread by taking advantage of vulnerable systems and weak administrative credentials. Once they’ve been infected, these systems are then used to mine cryptocurrency. I’ve named the sample I examined for this post ‘Capoae,’ based on the code’s output to my terminal. Around the same time the news was spreading about these crypto mining malware attacks, SIRT honeypots were infected with PHP malware that arrived via a backdoored addition to a WordPress plugin named download-monitor.
VULNERABILITIES:
Apple iPhone iOS 14.8 patches security exploit used by Pegasus spyware
Apple has released security updates for its devices after researchers identified a so-called “zero-click” exploit affecting its iMessage messaging service. The previously-unidentified vulnerability affects all of Apple’s current devices, including iPhones, iPads, Apple Watches and Mac computers, the researchers said, adding that Apple users should “immediately” update their devices. The exploit, named “FORCEDENTRY” by the University of Toronto Citizen Lab researchers, takes advantage of the way iMessage renders images to skirt the built-in security systems of Apple’s latest operating systems.
Third Critical Bug Affects Netgear Smart Switches — Details and PoC Released
New details have been revealed about a recently remediated critical vulnerability in Netgear smart switches that could be leveraged by an attacker to potentially execute malicious code and take control of vulnerable devices. The flaw — dubbed “Seventh Inferno” (CVSS score: 9.8) — is part of a trio of security weaknesses, called Demon’s Cries (CVSS score: 9.8) and Draconian Fear (CVSS score: 7.8), that Google security engineer Gynvael Coldwind reported to the networking, storage, and security solutions provider. The disclosure comes weeks after Netgear released patches to address the vulnerabilities earlier this month, on September 3.
https://thehackernews.com/2021/09/third-critical-bug-affects-netgear.html
FBI and CISA warn of state hackers exploiting critical Zoho bug
The FBI, CISA, and the Coast Guard Cyber Command (CGCYBER) today warned that state-backed advanced persistent threat (APT) groups are actively exploiting a critical flaw in a Zoho single sign-on and password management solution since early August 2021. Zoho’s customer list includes “three out of five Fortune 500 companies,” including Apple, Intel, Nike, PayPal, HBO, and many more. The vulnerability tracked as CVE-2021-40539 was found in the Zoho ManageEngine ADSelfService Plus software, and it allows attackers to take over vulnerable systems following successful exploitation.
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
