PandaBuy, a platform enabling international purchases from Chinese e-commerce giants such as Tmall, Taobao, and JD.com, has been compromised in a recent breach. Allegedly orchestrated by 'Sanggiero' and 'IntelBoker,' the attack exploited critical vulnerabilities in the platform's API and other bugs to gain access to its internal services. The stolen data, which includes over 3 million unique user details like names, phone numbers, emails, login IPs, order information, and addresses, has been shared on a forum. Access to this data was available to registered members for a symbolic cryptocurrency payment. To authenticate the leaked information, a sample containing email addresses, customer names, order details, and payment IDs was provided. Troy Hunt confirmed 1.3 million valid email addresses, refuting the inflated claim of 3 million. Despite this breach, PandaBuy has yet to address the situation publicly.

Researchers came across ransomware’s recycling campaign, which uses publicly available resources. Nokoyawa appeared and was first found by FortiGuard researchers. This was similar to Karma which can be tracked by Nemty.The April 2022 samples include three new features that increase the number of files that Nokoyawa can encrypt. The code was copied from numerous public sources e.g source of the now-defunct Babuk ransomware. It deletes volume snapshots by resizing the allocated space for snapshots of volume shadow copies to 1 byte – and because this size is insufficient for storing snapshots, Windows will delete them.Stopping an attacker earlier is important, and focusing on a few detected TTPs can stop a malware's assault capabilities in instances.To prioritize security strategies can impact on how businesses maximize their protection.Cyber hygiene is the second priority- learning the fundamentals of cyberwarfare can help everyone defend their organizations against attacks. Multi-factor authentication and password protection can help protect remote workers’ personal information, and knowing how to spot phishing emails and malvertising schemes will help employees avoid falling for these social engineering ploys.

University of Hamburg, Germany: Researchers conducted a field experiment capturing thousands of passersby's WiFi connection probe requests to determine the type of data transmitted without the device owners realizing it.  Many firms track their customers' position and movement. This tracking only uses anonymized MAC addresses, often regarded as GDPR compliant. Experiment was conducted on the busisest streets of Germany with 6 antennae for 3 hrs which captured 252,242 probe requests.  The sniffed passwords correspond to SSIDs which additionally can be verified by setting up fake access points on the fly using the potential credentials. The main implication here is persistent tracking. Even though more recent iOS and Android version are more protective, the andorid 8 and lower version are found with every 4th account. The easiest way to protect is to update the OS  version. Remove the SSIDs that you no longer need, and disable auto join network function.

Reports have been coming up related to the activity of the Hello XD ransomware, where an updated sample with more robust encryption has been deployed.  From the first appearance of Hello XD in November 2021, it was based on the leaked source code of Babuk and used for double-extortion attacks where the corporate data was compromised and stolen before encrypting devices. As reported by Unit 42, the new update features a custom packing for detection avoidance and encryption algorithm changes. The ransomware operation currently isn't using a Tor payment site to collect ransom but instructs victims through a TOX chat service. Recently, a link to an onion site was added to the ransom note, but the site is offline, probably under construction.

Github discloses login details of roughly 100,000 npm accounts by mid-April, data was breached with stolen OAuth apps token issued to Heroku and Travis-CI. Threats were escalated with a compromised AWS access key, after downloading multiple private npm repositories using the stolen OAuth user tokens. GitHub, Travis CI, and Heroku revoked all OAuth tokens to block further hacking attempts. Breached data included all private package manifests and metadata of April 7, 2021. Password hashes are generated operating weak hashing algorithms like PBKDF2 or salted SHA1 and can be cracked to take over accounts. Attempts would be automatically blocked by email verification enabled on all accounts since March 1, 2022, if they're not enrolled in 2FA. GitHub resets all passwords of affected npm users and informs all organizations and users whose data has been accessed by the attacker. Data found in internal logs includes npm access tokens, a few of cleartext passwords exploited to sign in to npm accounts, and some GitHub Personal Access Tokens sent to npm services. GitHub uncovered numerous plaintext user credentials for the npm registry that were captured in internal logs following the integration of npm into GitHub logging systems

After a relatively stable presence since the start of this year, the ChromeLoader malware is seeing a rise in detection, posing a widespread threat. The malware can alter a user's web browser history and promote unwanted content from which the attacker stands to receive financial gain by redirecting user traffic to advertising sites. What makes ChromeLoader stand out apart from its widespread nature is the abuse of PowerShell.A malicious ISO archive file posing as a cracked version file for a game or software that the victims are likely to download on their computers through malicious sites. These files also contain an executable with names such as "CS_installer.exe" pretending to be a legit file. Then the ChromeLoader executes and decodes the PowerShell command that fetches an archive from a remote source and loads it as a chrome extension which manipulates the search engine results. Apart from windows, the malware is also capable of attacking macOS, targeting both chrome and safari browsers. The infection is transmitted similarly, but a DMG file is used instead of an ISO file. The macOS variant uses an installer bash script that decompresses the ChromeLoader into the "private/var/tmp" directory. 

Anonymous, an activist group has announced a cyber-war against the pro-Russian group Killnet which attacked European institutions. Anonymous declared a “cyberwar” against Putin’s government after its Ukrainian invasion. It includes leaking over 360,000 Russian federal agency files in the process. On Twitter, the @YourAnonOne account announced the cyber war against the pro-Russian hacker group #Killnet. Anonymous published a message announcing that the official Killnet site was taken offline later. Last week, Killnet attacked the websites of Italian institutions and government ministries: the superior council of the judiciary, its foreign affairs, education & cultural heritage ministries. May 16 reports Killnet launched attacks in early May targeting Italy’s upper house of parliament, the National Health Institute (ISS) and the Automobile Club d’Italia. Cybersecurity agencies in the US, UK, Australia, Canada &  New Zealand issued a warning to organisations beyond Ukraine’s borders that pro-Russian hackers may soon become targets. Five Eyes Alliance (FVEY) published its most detailed threat assessment on the last day, including information on Kremlin-backed units and cybercrime groups pledging to support Russia. Reports claimed– cybercrime groups could threaten Western critical national infrastructure (CNI) organizations including data leak extortionists the CoomingProject, DDoS-ers Killnet, Emotet operators Mummy and Sality botnet developer Salty Spider.

WAF is a web application firewall that provides web application security from malicious attacks such as SQL injection, DDOS, etc. But recently, Google’s WAF was bypassed using POST requests. This has been reported by the researchers at Kloudle (a security consultancy firm) woho were able to bypass Google Cloud Platform (GCP) and Amazon Web Services (AWS) by making a POST request of more than 8 kilobytes in size. This may lead the attacker to an underlying application. Basically, the WAFs are assumed to prevent web-based attacks even in cases where the underlying application is still vulnerable. Bypassing WAF and having a targeted endpoint that accepts HTTP POST requests triggers the underlying vulnerability, which leads the attacker one step closer to attacking the web-hosted application. The cloud armor WAF from Google comes with a set of predefined firewall rules that draw from OWASP. Users can block potential attack vectors by configuring a custom cloud armor rule to intercept HTTP requests of size greater than or equal to 8192 bytes since the attack payload appears after the 8192nd byte/character in the request body. Kloudle researchers decried GCP for failing to highlight this issue to users. They also mentioned many other cloud-based WAFs exhibit the same problem with request-body limitations between 8-128kb.

DevOps security firm JFrog informed that it found and helped remove 25 malicious JavaScript libraries from the official npm package repository. This is the second time in three months that JFrog found malicious npm packages designed to steal Discord tokens and environment variables after reporting 17 similar packages in December 2021. All 25 libraries had the names of more popular libraries and contained different types of malicious code, which suggests they were created by different threat actors, each targeting different goals. The libraries in issue leveraged typo squatting strategies and masqueraded as other legit deals such as shades.js, crypto-js, discord.js, marked, and noblox.js. 17 of the 25 libraries were designed to steal Discord access tokens from the computers where the malicious code was executed. Discord tokens are valuable resources that allow attackers to access accounts without providing a password. Spammers often acquire these tokens and use them to gain access to user accounts and then flood Discord channels and their respective users with ads and even malicious links. Five other packages contained code that stole environment variables from the details of the infected projects from a developer’s local programming environment. These variables typically store OS information, but in some cases, they can also contain API keys and login credentials for cloud services, information that many attackers like to collect. But the most dangerous packages were the last three, which allowed attackers to run their own commands on user systems via either Python code or shell commands. While all of this involved minimal effort, if the packages weren’t detected, the attacks would have had a high return on investment (ROI), which is why they expect to see similar malicious packages flood the npm repository in the future.

The Russia-Ukraine standoff in the physical world has also spilled into the cyber realm. Politicians and cybersecurity experts warn of potential attacks against the U.S. financial industry. Many conventional security rules are changing, according to Victor Wieczorek, a nation-state red teamer and director of threat and attack simulation at cybersecurity firm GuidePoint Security. U.S. financial firms are raising security awareness and testing employees about potential fraudulent incursions. This came after Biden administration officials announced that they believed Russian-backed bad actors had targeted Ukraine banks and the Ukraine Ministry of Defense. They are also preparing an initial sanctions package against Russia, which includes barring U.S. financial institutions from processing transactions for central Russian banks. They’ve found Russia responsible for at least one major distributed denial of service (DDoS) attack. The hackers can cause disruptions in the U.S. infrastructure and severely impact the reputation of the financial institutions that they might breach. With the vulnerability to execute code as root, attackers will look to implement this into malware and rootkits quickly for a whole exploit chain, said Steve Povolny, principal engineer and head of advanced threat research at Trellix. Critical infrastructure could be a primary target. In the coming days of warfare, the command, control, and logistics of an adversary are among the first targets, said Mark Carrigan, cyber vice president of process safety and OT cybersecurity at Hexagon PPM. A commitment to prepare resources for defending against potential cyber threats was voiced by U.S. President Joe Biden.

The combination of Squirrelwaffle, ProxyLogon, and ProxyShell against Microsoft Exchange Servers is being used to conduct financial fraud through email hijacking. On Tuesday, researchers from Sophos revealed a recent incident in which a Microsoft Exchange Server, which had not been patched to protect it against a set of critical vulnerabilities disclosed last year, was targeted to hijack email threads and spread malspam. While the ProxyLogon/ProxyShell vulnerabilities are now well-known, some servers are still unpatched and open to attacks. The recent case documented by Sophos combined the Microsoft Exchange Server flaws with Squirrelwaffle, a malware loader first documented last year in malicious spam campaigns. The loader is often distributed through malicious Microsoft Office documents or DocuSign content tacked on to phishing emails. If an intended victim enables macros in the weaponized documents, Squirrelwaffle then is often used to pull and execute CobaltStrike beacons via a VBS script. Customer data was taken, and a victim organization was selected. The attackers registered a domain with a name very close to the victim (a technique known as typo-squatting) and then created email accounts through this domain to reply to the email thread outside of the server. Over six days, the attackers tried to direct a legitimate financial transaction to a bank account they owned. The payment was on its way to being processed, and it was only due to a bank involved in the transaction realizing the transfer was likely fraudulent that the victim did not fall prey to the attack.

Several websites of Ukraine's government and military were offline on Tuesday following a series of attacks that targeted the country's banks and military.A Ukrainian cyber defense official said there was no sign of other disruptive actions that the attackers could have carried out. And emergency teams are working to recover the damage caused by the attackers. Although the attackers failed to access depositors' funds, a government agency noted that they could not disrupt the military's communications, Said by the Ukrainian Information Ministry's center for strategic communications and information security. The Ukrainian Foreign Ministry accused Russia of involvement in the attack. It noted that the suspect might have resorted to petty mischief to distract from his overall plan. Experts said that a cyberattack on Ukraine's emergency services and insurance companies on January 14 was designed to look like ransomware. Attacks on Ukraine's infrastructure, which the GRU intelligence agency carried out, are expected to continue as President Vladimir Putin tries to weaken the country's institutions. The GRU was accused of carrying out the 2017 NotPetya attack, which caused over $10 billion worth of damage globally. It was also disguised as a ransomware attack.

Recently human rights activists, human rights defenders, academics, and lawyers across India have fallen prey to targeted attacks by a previously unknown hacking group. 'SentinelOne,' a cybersecurity firm, has attributed the intrusions to a group it tracks as "ModifiedElephant," which has been acting as a threat since 2012. ModifiedElephant's primary purpose is to make long-term surveillance of targeted individuals easier, eventually leading to the distribution of "evidence" on the victims' compromised systems to frame and incarcerate vulnerable opponents. SentinelOne researchers Tom Hegel and Juan Andres Guerrero-Saade said in a report that a few of this group's targets include individuals involved with the renowned case of  2018 Bhima Koregaon violence in Maharashtra. The group uses spear-phishing emails to infect its victims and uses attack chains that lead them to files or links that are weaponized with malware capable of taking control of victim machines. The group operates using commercially available remote access trojans (RATs) and has potential ties to the commercial surveillance industry. Also distributed using phishing emails is an unidentified commodity trojan targeting Android that enables the attackers to intercept and manage SMS and call data, wipe or unlock the device, perform network requests, and remotely administer the infected devices. SentinelOne characterized it as an "ideal low-cost mobile surveillance toolkit." Using the phishing emails, ModifiedElepehant also distributes an unidentified commodity trojan that targets androids, enabling the attacks to intercept and message SMS and call data and giving them access to wipe or unlock the device. Sentinel One has characterized it as an "ideal low-cost mobile surveillance toolkit."

TThe Lazarus Group, also known as APT38, Hidden Cobra, Whois Hacking Team, and Zinc, is a known cybercrime group with ties to the North Korean government that recently abused the Windows Update Client to distribute malware. The researchers said they were investigating a phishing campaign mimicking Lockheed Martin, American aerospace, information security, and technology corporation. The group was distributing two files Lockheed_Martin_JobOpportunities.docx, and Salary_Lockheed_Martin_job_opportunities_confidential.doc. The documents themselves carried malicious macros, which, if activated, drop a WindowsUpdateConf.lnk file in the target endpoint's start-up folder and a DLL file (wuaueng.dll) in the Windows/System32 folder. After that, the .lnk file launches the Windows Update Client, which, in turn, launches the malicious DLL. Lazarus used this interesting technique to run its malicious DLL using the Windows Update Client to bypass antivirus solutions and other security mechanisms. With this method, the threat actor can execute its malicious code through the Microsoft Windows Update client by passing the following arguments: /UpdateDeploymentProvider, Path to malicious dll, and /RunHandlerComServer argument after the dll. We are yet to see what Microsoft will do about it, but, as usual, one should be extra careful when downloading and running documents coming in through the mail, especially if they require the activation of macros. "Lazarus APT is one of the advanced APT groups that is known to target the defense industry," the researchers concluded.en vulnerabilities in HP Support Assistant, a utility pre-installed on all HP computers sold after October 2012, were found by a security researcher. Computers running Windows 7, Windows 8, and Windows 10, were affected, which included five local privilege escalation flaws, two arbitrary file deletion bugs, and three remote code execution bugs.  

Microsoft has disclosed details of phishing campaigns used to target organizations by using stolen credentials to register on devices on the victim's network and spread spam emails to increase the infection pool. Microsoft also said that the attack occurs through the accounts that were not secured using multi-factor authentication ( MFA), making it easier to take advantage of the target's bring your policy policies. The dual staged campaign starts with initially stealing the credentials of the target organizations, which predominantly belong in Australia, Singapore, Indonesia, and Thailand. These stolen credentials are used in the second phase when the attackers use the compromised accounts to expand their foothold within the organization via lateral phishing and beyond the network via outbound spam. The campaign starts with users receiving a link that redirects them to a rogue website posing as the login page for Office 365 to steal the credentials. The credential theft resulted in the compromise of over 100 mailboxes across different companies. It was followed by a second attack wave that abused the lack of MFA protections to enroll an unmanaged Windows device to the company's Azure Active Directory (AD) instance and spread the malicious messages. "To launch the second wave, the attackers leveraged the targeted user's compromised mailbox to send malicious messages to over 8,500 users, both in and outside of the victim organization," Microsoft said. "The emails used a SharePoint sharing invitation lure as the message body in an attempt to convince recipients that the 'Payment.pdf' file being shared was legitimate." In addition to turning on MFA, implementing best practices such as good credential hygiene and network segmentation can "increase the 'cost' to attackers trying to propagate through the network."Such safe practices limit the attacker's options and prevent them from moving laterally or compromising assets.

  The the Ministry of Electronics and Information Technology has announced that the Government is planning to promote the creation of an "indigenous" mobile Operating System to compete with iOS and Android. India is an increasingly important market to Apple, but it continues to face fierce competition from Android devices in the country. Apple has steadily increased the number of its devices manufactured in India, with up to 70 percent of all iPhones sold in the country being made there. Mass production of the iPhone 13 in India is set to start next month and the country's first retail store is also on the way. The homegrown Indian mobile OS is specifically intended to "create an alternative to iOS and Android" in India. iOS and Android drive the development of hardware ecosystems, which is something that the Government hopes the new platform will mirror, giving an Indian brand space to develop. The Government is hence looking for suitable startups and academic institutions that are capable of developing a new OS. Minister of State for Electronics and IT Rajeev Chandrasekhar hinted that start-ups and companies working on an Indian OS may be attractive to domestic and foreign investment when raising capital.

On Tuesday, 25th January 2022, cybersecurity researchers Tuesday took the wraps off a multi-stage espionage campaign targeting high-ranking government officials overseeing national security policy and individuals in the defense industry in Western Asia. Trellix, a new company created following the merger of security firms McAfee Enterprise and FireEye, said that the attack is unique as it leverages Microsoft OneDrive as a command-and-control (C2) server and is split into as many as six stages to stay as hidden as possible. First signs of activity are said to have commenced June 18, 2021, with two victims reported on September 21 and 29, followed by 17 more in a short span of three days between October 6 and 8. The Russia-based APT28 group, the threat actor behind the compromise of SolarWinds in 2020, are thought to be responsible for these attacks with moderate confidence owing to its similarities in the source code as well as in the attack indicators and geopolitical objectives. The execution of a Microsoft Excel file containing an exploit for the MSHTML remote code execution vulnerability (CVE-2021-40444) which is used to run a malicious binary that acts as the downloader for a third-stage malware dubbed Graphite starts the infection chain. OneDrive is used as the C2 server via the Microsoft Graph API by the DLL executable to retrieve additional stager malware that ultimately downloads and executes Empire, an open-source PowerShell-based post-exploitation framework widely abused by threat actors for follow-on activities.

Researchers have disclosed a security shortcoming affecting three different WordPress plugins that impact over 84,000 websites and could be abused by a malicious actor to take over vulnerable sites. Login/Signup Popup is installed on over 20,000 sites, while Side Cart Woocommerce and Waitlist Woocommerce have been installed on more than 4,000 and 60,000 sites, respectively. Tracked as CVE-2022-0215, the cross-site request forgery (CSRF) flaw is rated 8.8 on the CVSS scale and impacts three plugins maintained by Xootix—Login/Signup Popup (Inline Form + Woocommerce), Side Cart Woocommerce (Ajax), and Waitlist Woocommerce (Back in stock notifier). Following responsible disclosure by Wordfence researchers in November 2021, the issue has been addressed in Login/Signup Popup version 2.3, Side Cart Woocommerce version 2.1, and Waitlist Woocommerce version 2.5.2. The findings come a little over a month after attackers exploited weaknesses in four plugins and 15 Epsilon Framework themes to target 1.6 million WordPress sites as part of a large-scale attack campaign originating from 16,000 IP addresses.

CyberManipal.

Recent News

MALVERTISER- advertising malware

Anonymous announces cyber-war against Russian Killnet

Google WAF bypassed by oversized POST requests

25 Malicious JavaScript Libraries Distributed via NPM Package Repository

US Banks prepare for potential attack as Russian cybercriminals become emboldened

More Stories

Browse by category

Write for us

More of MIST

About MIST