04.02.2022
NEWS:
Microsoft blocked billions of brute-force and phishing attacks last year
Office 365 and Azure Active Directory (Azure AD) customers were the targets of billions of phishing emails and brute force attacks successfully blocked last year by Microsoft. “From January 2021 through December 2021, we’ve blocked more than 25.6 billion Azure AD brute force authentication attacks and intercepted 35.7 billion phishing emails with Microsoft Defender for Office 365,” said Vasu Jakkal, Microsoft’s Corporate Vice President for Security, Compliance, and Identity. Multi-factor authentication (MFA) and passwordless authentication would make it a lot harder for threat actors to brute force their way into their targets’ Microsoft accounts, Jakkal added.
New Malware Used by SolarWinds Attackers Went Undetected for Years
The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary’s ability to maintain persistent access for years. According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.
https://thehackernews.com/2022/02/new-malware-used-by-solarwinds.html
Massive social engineering waves have impacted banks in several countries
A massive social engineering campaign has been delivered in the last two years in several countries, including Portugal, Spain, Brazil, Mexico, Chile, the UK, and France. According to Segurança Informática publication, the malicious waves have impacted banking organizations with the goal of stealing the users’ secrets, accessing the home banking portals, and also controlling all the operations on the fly via Command and Control (C2) servers geolocated in Brazil. In short, criminal groups are targeting victims’ from different countries to collect their homebanking secrets and payment cards. The campaigns are carried out by using social engineering schemas, namely smishing, and spear-phishing through fake emails.
1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information
Data leaks have always been a concern for organizations. The exposure of sensitive information can result in damage to reputation, legal penalties, loss of intellectual property, and even impact the privacy of employees and customers. However, there is little research about the challenges posed to industrial organizations when threat actors disclose sensitive details about their OT security, production, operations, or technology. In 2021, Mandiant Threat Intelligence continued observing ransomware operators attempting to extort thousands of victims by disclosing terabytes of stolen information on shaming sites.
https://www.mandiant.com/resources/ransomware-extortion-ot-docs
INCIDENTS:
European Oil Port Terminals Hit by Cyberattack
Major oil terminals in some of Western Europe’s biggest ports have fallen victim to a cyberattack, sources confirmed on Thursday. Belgian prosecutors have launched an investigation into the hacking of oil facilities in the country’s ports, including Antwerp, Europe’s second biggest port after Rotterdam. According to a specialised broker, the alleged hacking is affecting several European ports and is disrupting the unloading of barges in an already strained oil market. “There was a cyber attack at various terminals, quite some terminals are disrupted,” said Jelle Vreeman, senior broker at Riverlake in Rotterdam.
https://www.securityweek.com/european-oil-port-terminals-hit-cyberattack
Unsecured AWS server exposed 3TB in airport employee records
On Monday, the SafetyDetectives cybersecurity team said the server belonged to Securitas. The Stockholm, Sweden-based company provides on-site guarding, electronic security solutions, enterprise risk management, and fire & safety services. In a report shared with ZDNet, SafetyDetectives said one of Securitas’s AWS S3 buckets was not appropriately secured, exposing over one million files on the internet.
https://www.zdnet.com/article/unsecured-aws-server-exposed-airport-employee-records-3tb-in-data/
NSO Group Pegasus Spyware Aims at Finnish Diplomats
Finland is weathering a bout of Pegasus infections, along with a Facebook Messenger phishing scam. The controversial Pegasus spyware, developed by NSO Group, has been found on the devices of Finland’s diplomatic corps serving outside the country as part of a wide-ranging espionage campaign, according to Finnish officials.
They also said the infections were of the zero-click variety.
https://threatpost.com/nso-group-pegasus-spyware-finnish-diplomats/178113/
MALWARE:
New Variant of UpdateAgent Malware Infects Mac Computers with Adware
Microsoft on Wednesday shed light on a previously undocumented Mac trojan that it said has underwent several iterations since its first appearance in September 2020, effectively granting it an “increasing progression of sophisticated capabilities.” The company’s Microsoft 365 Defender Threat Intelligence Team dubbed the new malware family “UpdateAgent,” charting its evolution from a barebones information stealer to a second-stage payload distributor as part of multiple attack waves observed in 2021. “The latest campaign saw the malware installing the evasive and persistent Adload adware, but UpdateAgent’s ability to gain access to a device can theoretically be further leveraged to fetch other, potentially more dangerous payloads,” the researchers said.
https://thehackernews.com/2022/02/new-variant-of-updateagent-malware.html
SEO poisoning pushes malware-laced Zoom, TeamViewer, Visual Studio installers
A new SEO poisoning campaign is underway, dropping the Batloader and Atera Agent malware onto the systems of targeted professionals searching for productivity tool downloads, such as Zoom, TeamViewer, and Visual Studio. These campaigns rely on the compromise of legitimate websites to plant malicious files or URLs that redirect users to sites that host malware disguised as popular apps. Upon downloading and executing the software installers, the victims unknowingly infect themselves with malware and remote access software. As part of this campaign, the threat actors perform search engine optimization (SEO) techniques to legitimate compromised sites into search results for popular applications. The targeted keywords are for popular applications like Zoom, Microsoft Visual Studio 2015, TeamViewer, and others.
VULNERABILITIES:
Zimbra zero-day vulnerability actively exploited to steal emails
A cross-site scripting (XSS) Zimbra security vulnerability is actively exploited in attacks targeting European media and government organizations. Zimbra is an email and collaboration platform that also includes instant messaging, contacts, video conferencing, file sharing, and cloud storage capabilities. According to Zimbra, more than 200,000 businesses from over 140 countries are using its software, including over 1,000 government and financial organizations.
Cisco Patches Critical Vulnerabilities in Small Business RV Routers
Cisco this week announced patches for multiple vulnerabilities in its Small Business RV160, RV260, RV340, and RV345 series routers, including critical bugs that could lead to the execution of arbitrary code with root privileges. The most severe of these issues is CVE-2022-20699 (CVSS score of 10.0), as it allows an unauthenticated, remote attacker to execute arbitrary code on a vulnerable device. The bug exists because there aren’t sufficient boundary checks performed during the processing of specific HTTP requests.
https://www.securityweek.com/cisco-patches-critical-vulnerabilities-small-business-rv-routers
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
