Security Advisory

Threat Landscape Bulletin - July 31, 2024

admin Security Advisory 04 August 2024

July 31, 2024

Produced by Symantec's Threat Hunter Group, the Threat Landscape Bulletin brings you an up-to-date summary of all the news from the world of cybersecurity. Every weekday, we curate and deliver all the information you need to know directly to your inbox.

Check out the Threat Landscape Bulletin archive, which contains all previous editions and can be searched by keyword.

For updates on how Symantec products protect you against threats that are in the news, visit the Symantec Protection Bulletin.

Leafperforator: New attacks target maritime facilities

A new cyberespionage campaign carried out by the nation-state advanced persistent threat (APT) group Leafperforator (aka SideWinder) targets ports and maritime facilities in the Indian Ocean and Mediterranean Sea.

According to the BlackBerry Research and Intelligence Team, regions targeted by the spear-phishing campaign include Pakistan, Egypt, Sri Lanka, Bangladesh, Myanmar, Nepal, and the Maldives.

Active since at least 2012, Leafperforator is assessed to be affiliated with India. “SideWinder makes use of email spear-phishing, document exploitation and DLL side-loading techniques in an attempt to avoid detection and deliver targeted implants,” BlackBerry researchers said. The latest campaign uses lures related to sexual harassment, employee termination, and salary cuts in order to trick recipients into opening booby-trapped Microsoft Word documents.

The attackers exploit known vulnerabilities (CVE-2017-0199 and CVE-2017-11882) in their attacks to establish contact with a malicious domain, download additional files, and execute JavaScript. While the end result of the JavaScript code is unknown, based on prior Leafperforator campaigns, the end goal is likely intelligence gathering.

Protection
For the latest protection updates, please visit the Symantec Protection Bulletin.

DigiCert revokes large number of certificates at short notice due to issuing error

Some admins who were using SSL/TLS certificates issued by DigiCert had only 24 hours to replace them before they were revoked by DigiCert recently. The reason given for the revoking of "approximately 0.4 percent of the applicable domain validations we have in effect" was an error in the issuing process, which was first introduced back in 2019.

The process, which involves a step called Domain Control Verification (DCV), is supposed to verify that the applicant of a certificate is actually the owner of the domain name. This process was performed improperly for a small proportion of certificates issued because an underscore prefix was not added to a random value used in the verification DNS CNAME record.

Even though the risk posed by this error is said to be extremely low, due to the rules governing the technology, affected certificates must be revoked within 24 hours of discovery without any exception.

Customers impacted by this action were notified by DigiCert and provided with appropriate steps to take to avoid any service disruptions.

HealthEquity to notify 4.3 million victims of data breach discovered in June 2024

After a period of investigation into a data breach that occurred in March 2024, HealthEquity, a major U.S. financial services institution focused on helping people save for healthcare expenses, has notified the Maine Attorney General of its intentions to send communications and offer free credit monitoring and other services to 4.3 million individuals who may be impacted by the breach.

The breach is reported to have exposed private data for almost a third of the company’s 15 million customers. The data exposed includes personally identifiable information (PII) such as names, addresses, phone numbers, Social Security numbers, information about employers and dependents, as well as payment card information in some cases.

The cause of the breach is said to be due to the compromise of a user account at a third party vendor, which allowed the attacker to gain access to an “unstructured data repository” which was hosted outside of HealthEquity’s own networks.

Fortune 500 firm pays record-breaking $75 million ransom

The Dark Angels ransomware group received a $75 million ransom payment from a Fortune 500 company, breaking the record for the largest ransomware-related transaction ever reported.

According to Zscaler researchers, the unnamed company paid the ransom following an attack that occurred in early 2024. The $75 million ransom beats the previous record of $40 million paid by insurance giant CNA following an Evil Corp ransomware attack.

While Zscaler did not name the company that made the ransom payment, BleepingComputerspeculates that it could be pharmaceutical giant Cencora. The Fortune 50 firm suffered a ransomware attack in February 2024; however, no ransomware group claimed responsibility for the incident, potentially indicating that the company paid the ransom.

Active since at least May 2022, the Dark Angels ransomware group targets a range of sectors, including healthcare, government, finance, and education, and has recently focused on large industrial, technology, and telecommunications companies.

Major SMS stealing campaign targets Android users in 113 countries

A major Android malware campaign is reported to have hit users from across 113 different countries. The most heavily affected countries by far are India and Russia, followed by Brazil, Mexico, the U.S., Ukraine, and Spain.

Victims of the campaign are believed to be infected via a number of methods including fake app stores being advertised online, as well as ending up chatting with one of the 2,600 Telegram bots operated by the attackers when searching for pirated Android apps online. In one instance observed by researchers, the Telegram bot requested the phone number of the intended victim. The phone number was then used to customize the APK offered to the victims to sideload onto their devices.

Once installed, the malicious APK requests various permissions to enable it to perform its malicious activities, which include intercepting SMS messages and stealing data such as one-time passwords used for multi-factor authentication for sites belonging to over 600 different brands. In addition to stealing information, the malware connects to one of 13 command-and-control servers, enabling the attackers to access and execute commands on the device remotely.

The campaign is said to have involved the use of over 100,000 distinct malware samples, though this may be due to the customization of each APK used for infection with the victim’s phone number.

Protection
For the latest protection updates, please visit the Symantec Protection Bulletin.

Cybersecurity lapses led to breach of 40 million UK voters’ data

The UK's privacy watchdog on Tuesday (July 30) reprimanded the country’s Electoral Commission for security failings leading to the compromise of personal information of 40 million people during a 2021 cyberattack.

The Information Commissioner’s Office (ICO) found that the election agency failed to ensure systems were up to date with the latest security updates and did not have sufficient password policies. “If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened,” ICO Deputy Commissioner Stephen Bonner said in a statement.

Chinese state-backed hacking group Sheathminer (aka APT31), who carried out the attack, accessed the personal information, including names and home addresses, of people registered to vote in the UK since 2014. Sheathminer accessed the Electoral Commission’s Microsoft Exchange Server by impersonating a user account and exploiting known vulnerabilities in the system. Patches for the vulnerabilities in question (ProxyShell) had been made available in April and May 2021, months before the attack, according to the ICO.

You can control who receives email notifications for a specific report type in the ICDm console.
See this topic for more details: Managing and configuring report recipients

This is an automated message. Please do not reply to this email.

Threat Landscape Bulletin - August 1, 2024

admin Security Advisory 04 August 2024

August 1, 2024

Check out the Threat Landscape Bulletin archive, which contains all previous editions and can be searched by keyword.

For updates on how Symantec products protect you against threats that are in the news, visit the Symantec Protection Bulletin.

Vulnerabilities in hosted email services could allow for industrial-scale email spoofing

A pair of vulnerabilities found in typical hosted email service provider environments could allow an attacker to bypass normal email security protocols such as DMARC. Using the newly discovered vulnerabilities (CVE-2024-7208 and CVE-2024-7209), an authorized attacker in a hosted multi-tenant environment could modify the header in emails they send so as to make it appear as if they came from another tenant from the same hosted service.

The exploit works by exploiting a situation where many hosted email services do not check what domains an authenticated user is allowed to send emails for. By exploiting this method to send spoofed emails, an attacker could bypass protection provided by DMARC with the email arriving into recipient inboxes unhindered and appearing to be fully legitimate.

To protect their users, email service providers are advised to implement the necessary checks to verify the identity of authenticated senders against authorized domains.

According to the advisory published by Carnegie Mellon University, a number of hosted email service providers are impacted by these issues but many, including major service providers, have yet to confirm whether they are affected or not.

Ransomware attack disrupts operations at OneBlood blood bank

OneBlood, a blood bank serving over 300 U.S. hospitals, suffered a ransomware attack that disrupted medical operations. The not-for-profit organization helps ensure a stable blood supply to hospitals, causing concerns that surgeries and treatments may be impacted by the attack.

While OneBlood is still operational, it is functioning at a significantly reduced capacity. “In an effort to further manage the blood supply we have asked the more than 250 hospitals we serve to activate their critical blood shortage protocols and to remain in that status for the time being,” said Susan Forbes, OneBlood senior vice president of corporate communications and public relations.

OneBlood did not provide details about the attack, such as the ransomware that infected its systems and if it had suffered a data breach.

BingoMod Android malware empties bank accounts, wipes devices

A newly uncovered Android malware dubbed BingoMod wipes victims’ devices after stealing money from their bank accounts.

Researchers at Cleafy discovered the malware, which is promoted through text messages and poses as a legitimate mobile security tool. According to the researchers, BingoMod is under active development, with its author currently working on reducing the malware’s detection rate by adding code obfuscation and various evasion mechanisms.

Upon installation, the malware requests permission to use Accessibility Services, giving it extensive control of the device. Once installed, the malware steals login credentials, takes screenshots, and intercepts SMS messages.

BingoMod then establishes a socket-based channel to receive commands and an HTTP-based channel to send screenshots. Using information from screenshots, the threat actors can bypass bank users’ identity verification and authentication processes, and avoid behavioral detection techniques applied by banks to identify suspicious money transfers. The malware can also conduct overlay attacks.

BingoMod typically wipes infected devices after a successful fraudulent transfer, in an attempt to hinder forensic investigations.

North Korean threat actors targeting developers worldwide with fake jobs

A North Korean-based threat actor responsible for carrying out an attack campaign dubbed DEV#POPPER, originally only targeting South Korean developers, is said to be back. Researchers saw a new campaign that targets users from different regions as well as multiple platforms. The latest campaign targets victims in multiple regions including Europe, the Middle East, and North America.

The attackers are believed to be targeting software developers in these regions with fake job offers and even conducting fake remote job interviews to convince the victim of the legitimacy of the process. During the course of the fake selection process, the candidate is requested to participate in a practical challenge where they are required to download a ZIP file (onlinestoreforhirog.zip) and execute its contents.

The ZIP file contains mostly legitimate code but embedded within it is heavily obfuscated JavaScript that contains functionality to collect data about the local environment and send it to a command-and-control (C&C) server. It then downloads a second-stage ZIP file that contains Python code. This decodes and dumps an additional file that provides typical backdoor functionality to the attackers, such as information stealing, keylogging, remote access, and uploading/downloading files. The malware used in the new campaign adds some functionality, as well as enhancing previously seen functions, to help the attackers achieve a more robust infection.

Microsoft Azure outage caused by DDoS attack

Microsoft revealed that the global nine-hour outage of several Azure and Microsoft 365 services on July 30 was caused by a distributed denial-of-service (DDoS) attack, which was exacerbated by “an error” in its response to the attack.

Microsoft said the outage impacted several services, including Azure App Services, Application Insights, Azure IoT Central, Azure Log Search Alerts, Azure Policy, the Azure portal, and Microsoft 365 and Microsoft Purview services.

“While the initial trigger event was a Distributed Denial-of-Service (DDoS) attack, which activated our DDoS protection mechanisms, initial investigations suggest that an error in the implementation of our defenses amplified the impact of the attack rather than mitigating it,” Microsoft explained. The incident led to an unexpected usage spike that “resulted in Azure Front Door (AFD) and Azure Content Delivery Network (CDN) components performing below acceptable thresholds, leading to intermittent errors, timeout, and latency spikes.”

To address the issue, the company implemented networking configuration changes and used a failover process for alternate networking paths.

You can control who receives email notifications for a specific report type in the ICDm console.
See this topic for more details: Managing and configuring report recipients

This is an automated message. Please do not reply to this email.

Attack Vectors: How Malicious Actors Penetrate Networks

admin Security Advisory 04 August 2024

Dear customer,

The most effective way to block a sophisticated attack is at the first step—the attack vector. This new whitepaper from Symantec's Threat Hunter Team looks at current attack vectors used to gain access to and compromise networks.

The whitepaper includes current information on exploits, botnets, email, and supply chain attacks; real-world examples of how threat actors use these vectors to gain an initial foothold on networks; and advice on protecting against targeted attacks.

Note: You are receiving this email because Symantec Threat Intelligence reports are now shared with customers via the ICDm console. You can add and remove report recipients using the “Reports and Templates” tab of the console. See here for more details.

You can control who receives email notifications for a specific report type in the ICDm console.
See this topic for more details: Managing and configuring report recipients

This is an automated message. Please do not reply to this email.

INFINITY CYBERSEC

Infinity Cybersec Pte Ltd, also known as iCyber, is a cybersecurity services provider based in Singapore, delivering comprehensive cybersecurity solutions across the Asia region.

ATSOC, operated by iCyber in Singapore, functions as a Security Operations Center, offering SOC, MDR, and MSS services to both partners and customers.

Infinity Cybersec holds licenses in Singapore to provide services for SOC (License No. CS/SOC/C-2022-0089R) and PTS (License No. CS/PTS/C-2022-0089R).

News Release

Corporate

Certificates