Cyware Weekly Threat Intelligence, March 30-April 03, 2020

Share Blog post

The Good

With hundreds of organizations heavily relying on video teleconferencing (VTC) platforms to perform their business operations during this ongoing COVID-19 pandemic, it has become important to protect these tools from any kind of cyberattacks. Keeping this in mind, the FBI has issued a list of security measures against VTC hijacking and Zoom-bombing attacks for users and administrators. The guidelines aim to improve the cybersecurity of VTC software. In other developments, the Ministry of Defense in Japan has decided to build an AI-based system to detect malicious emails and other unwanted intrusions. 

  • The Federal Bureau of Investigation (FBI) has released guidelines on defending against video teleconferencing (VTC) hijacking and Zoom-bombing attacks. The recommendations are proposed for those individuals and organizations that are increasingly dependent on VTC platforms like Zoom and Microsoft Teams. 
  • Japan’s Ministry of Defense has planned to invest a sum of $237 million in cybersecurity this year. A portion of this amount will be diverted towards an artificial intelligence-based system that can counter cyberattacks.
  • Akamai, Amazon Web Services, Azion, Cloudflare, Facebook and Netflix have joined the Internet Society-backed Mutually Agreed Norms for Routing Security (MANRS) initiative that was launched six years ago. The program aims to advance the security and resiliency of the Internet’s routing infrastructure.
 
The Bad

Talking about data breaches, Marriott International revealed that the personal information of about 5.2 million guests was impacted due to unauthorized access to its employees’ login credentials. In a different incident, SOS Online Backup had leaked over 135 million records due to an unprotected database.  

  • Voter information of more than 4.9 million Georgians was affected after cybercriminals had put it on sale on a hacking forum. The information included full names, home addresses, dates of birth, ID numbers, and mobile numbers of individuals. 
  • Marriott International disclosed a data breach that impacted the personal information of about 5.2 million hotel guests. The breach had occurred after hackers gained unauthorized access to the login credentials of two employees at a franchise property. 
  • SOS Online Backup had inadvertently leaked over 135 million records last year due to a misconfigured database. The exposed information included full names, email addresses, phone numbers, internal company details, and account usernames of clients.
  • The popular video-conferencing app, Zoom, came under fire for leaking personal information of at least a thousand users due to an issue in its settings. The bug resulted in the leak of users’ email addresses and photos. 
  • A spear-phishing attack on GoDaddy.com gave phishers the ability to view and modify key customer records. The incident had affected the domain settings for a half-dozen of its customers, including the transaction brokering site, escrow.com.  
  • A trove of 42 million records from a third-party app of Telegram was leaked through an Elasticsearch cluster targeted by a group called ‘Hunting system’. The exposed data included usernames, phone numbers, account IDs, hashes, and secret user keys. 
  • A new skimmer dubbed ‘MakeFrame’ compromised 19 different e-commerce websites to steal customers’ payment data. The attacks were attributed to Magecart Group 7.  
  • A hacker had managed to break into over 15000 Elasticsearch servers and defaced them as they were not protected with passwords.

New threats

The week saw a tremendous increase in cyberattacks related to COVID-19 disease. Two of these attacks were executed using phishing emails and distributed malware like the new BlueTea Action trojan, LokiBot trojan, Zeus Sphinx trojan, and Remcos RAT. The widely used Zoom came under the scanner after researchers detected two zero-day flaws in the macOS version of the app. Additionally, security experts discovered several trojanized versions of the video conferencing app that were distributed via third-party stores. 

  • Researchers detected several COVID-19-themed attacks to infect users across the globe. One of these campaigns stole Microsoft login credentials, while another campaign distributed LokiBot trojan. A third campaign was also found distributing a new ‘BlueTea Action’ trojan.
  • Several trojanized Zoom video conferencing apps available on different third-party stores were found infecting users’ devices with adware and trojan payloads. The primary purpose of these apps was to generate revenue for developers and steal information from users.
  • Researchers identified an active Vollgar botnet campaign that targeted Microsoft SQL database servers for nearly two years. The campaign used brute-force attacks against MSSQL servers to gain admin access and later installed Monero cryptocurrency mining scripts.
  • A complex cyberespionage that distributed a wide variety of malware such as XMRig, AZORult, a variant of Remcos RAT, and DarkVNC backdoor trojan, was uncovered by security experts. The infection chain began with a ZIP file that contained an ISO disk image file.
  • All versions of Windows 10 are affected by over 25 potential vulnerabilities, out of which some can lead to elevation of privileges. The bugs impact the user interface win32 kernel component of Windows.
  • DarkHotel APT group exploited two vulnerabilities in Firefox and Internet Explorer to launch attacks in Japan and China. The flaws were tracked as CVE-2019-17026 (in Firefox) and CVE-2020-0674 (in Internet Explorer).
  • A watering hole attack campaign, active since May 2019, was found targeting people in a few Asian countries. The attackers’ toolset included Sojson obfuscation, NSIS installer, open-source code, Go language, and Google Drive-based C2 channels.
  • Threat actors used Microsoft Excel spreadsheet’s VelvetSweatshop default password bug to deliver LimeRAT trojan. Once the trojan was launched on a victim’s system, it allowed the attackers to deliver ransomware, cryptominer, a keylogger and create a bot client.
  • Vulnerabilities affecting Rank Math and Contact Form 7 Datepicker WordPress plugins could allow attackers to take over WordPress sites. These flaws have been patched with new versions of the plugins.
  • Threat actors exploited two zero-day remote code execution vulnerabilities affecting some DrayTek router models to perform a series of attacks. These vulnerabilities existed in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program in /usr/sbin/lighttpd.
  • Iranian government-backed hackers attempted to break into the personal email accounts of staff at the WHO during the coronavirus outbreak. The attack was conducted using malicious messages designed to mimic Google web services.

 Tags

sos online backup
marriott international inc
lokibot trojan
rank math plugin
zeus sphinx trojan
velvetsweatshop default password
limerat trojan
draytek router models

Posted on: April 03, 2020

Get the Weekly Threat Briefing delivered to your email!



More from Cyware

Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.



Join Thousands of Other Cyware Followers!