Cyber Security News and Trends - June

1. A new phishing campaign exploits the Windows search protocol (search-ms URI) via HTML attachments to deliver malware. Attackers use these attachments to push batch files from remote servers, bypassing local device searches. This technique enables the phishing emails to execute malicious scripts hosted on remote servers. The Windows Search protocol allows applications to perform specific searches and even query file shares on remote hosts. This method highlights a novel abuse of the Windows Search functionality to spread malware.??
2. Amazon Web Services (AWS) now supports FIDO2 passkeys for multi-factor authentication (MFA), improving security and usability. AWS also reminds users that root accounts must enable MFA by July 2024, following their announcement last October. This move aims to enhance overall account protection on the platform. The new passkeys provide a more secure and user-friendly authentication method.??
3. Google has patched 50 security vulnerabilities in its Pixel devices, including a zero-day flaw already exploited in targeted attacks. The high-severity elevation of privilege flaw, tracked as CVE-2024-32896, affects Pixel firmware. Google warns that this vulnerability is under limited, targeted exploitation. The patches aim to mitigate these security risks. Users are urged to update their devices promptly to protect against potential threats.??
4. A new phishing toolkit enables the creation of progressive web apps (PWAs) that mimic corporate login forms to steal credentials. PWAs, built with HTML, CSS, and JavaScript, can be installed like regular desktop apps, with shortcuts added to Windows and macOS systems. These apps run in a browser but appear as standalone desktop applications, hiding standard browser controls. The toolkit is being utilized by cybercriminals and red teamers to execute more convincing phishing attacks. Users are advised to be cautious of unfamiliar login prompts.??
5. The TellYouThePass ransomware gang is exploiting the newly patched CVE-2024-4577 PHP remote code execution vulnerability to breach servers. Attacks began on June 8, within 48 hours of the security update release, using publicly available exploit code. This ransomware group is notorious for swiftly leveraging public exploits of widely impactful vulnerabilities. Previously, they exploited an Apache ActiveMQ RCE last November and the Log4j exploit in December 2021. The current attacks involve delivering webshells and executing encryptor payloads on compromised systems.??
6. England's NHS Blood and Transplant (NHSBT) urgently calls for O Positive and O Negative blood donors after a ransomware attack on Synnovis disrupted London hospitals. The June 4 attack, carried out by the Russian cybercrime group Qilin, affected multiple large NHS hospitals. As a result, blood transfusions were impacted, causing cancellations and redirections of many non-urgent procedures. The cyberattack has led to a critical blood shortage in the affected hospitals. Donors are encouraged to book appointments immediately to help alleviate the shortage.
7. A new cross-platform malware, Noodle RAT, has been used by Chinese-speaking threat actors for espionage or cybercrime since at least July 2016. Unlike previous categorizations as a variant of Gh0st RAT and Rekoobe, Trend Micro's Hara Hiroaki confirms it as a distinct new type. Noodle RAT, also known as ANGRYREBEL and Nood RAT, targets both Windows and Linux systems. The malware's emergence adds to the tools, like PlugX and ShadowPad, used by Chinese government hackers in numerous attacks. Gh0st RAT, its predecessor, was first released by the C. Rufus Security Team in 2008.??

1. CVE-2024-4985: This critical vulnerability allows attackers to bypass authentication in the GitHub Enterprise Server by forging SAML responses. Exploiting this flaw permits unauthorized access to an instance without prior authentication, significantly compromising the security of the system. The issue impacts all versions of GHES prior to 3.13.0 and has been addressed in versions 3.9.15, 3.10.12, 3.11.10, and 3.12.4.
2. CVE-2024-4323: Dubbed the Linguistic Lumberjack vulnerability, this flaw in Fluent Bit can lead to denial-of-service (DoS), information disclosure, or remote code execution by exploiting memory corruption in the built-in HTTP server. It affects versions from 2.0.7 through 3.0.3, with a fix available in version 3.0.4. The vulnerability allows attackers to send maliciously crafted requests to the monitoring API, bypassing input validation.
3. CVE-2024-5274: This high-severity type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine allows arbitrary code execution and has been actively exploited in the wild. As reported by Clément Lecigne and Brendon Tiszka, the flaw can cause out-of-bounds memory access, crashes, and execution of arbitrary code. Users are urged to update to Chrome version 125.0.6422.112/.113 to mitigate the threat.
4. CVE-2024-29849: This vulnerability in Veeam Backup Enterprise Manager allows unauthenticated attackers to log in as any user, potentially leading to unauthorized access and data breaches. It carries a CVSS score of 9.8 and affects all versions prior to 12.1.2.172. Alongside this, other related flaws such as CVE-2024-29850, CVE-2024-29851, and CVE-2024-29852 have also been disclosed and addressed.
5. CVE-2024-24919: A critical flaw in Check Point's Network Security gateways, this vulnerability allows attackers to extract password hashes and compromise local accounts. Impacting multiple products including CloudGuard Network and Quantum Security Gateways, it enables unauthorized actors to read sensitive information and escalate privileges. Hotfixes are available for affected versions to mitigate the risk.
6. CVE-2024-5035: This critical security flaw in TP-Link Archer C5400X gaming routers allows remote unauthenticated attackers to execute arbitrary commands by exploiting a vulnerability in the "rftest" binary related to radio frequency testing. The issue has been patched in firmware version 1_1.1.7. Users are urged to update to prevent potential exploits.
7. CVE-2024-4577: This vulnerability in PHP on Windows allows remote code execution through CGI argument injection. It affects all PHP versions on Windows and has been patched in versions 8.3.8, 8.2.20, and 8.1.29. Attackers can bypass previous protections by exploiting a Windows feature, emphasizing the need for immediate patching.
8. CVE-2024-4358: This critical flaw in Telerik Report Server allows remote attackers to bypass authentication and create rogue administrator accounts, impacting versions prior to 2024 Q2 (10.1.24.514). Exploiting this bug enables attackers to gain unauthorized access and control, making it essential for users to update to the latest version to secure their systems

Ransomware - A Growing Threat to Cybersecurity

In recent years, ransomware attacks have emerged as one of the most prevalent and damaging forms of cyber threats. It is crucial to understand the nature of ransomware, how cybercriminals employ it, recent trends in such attacks, the impact of these attacks on organizations, and the necessary steps to prevent ransomware.

Read more insights here:

Identity theft: the silent menace

Identity theft is a malicious act where an unauthorized individual obtains and uses someone else's personal data, such as their name, Social Security number, banking information, or other identifiers, to commit fraud or other crimes. It can lead to loss of reputation, financial loss, and a long and often arduous recovery process for the victim.

Read more insights here:

The Threat of Mailbombing: Understanding, Impact, and Prevention

Mailbombing, also known as email bombing or letter bomb attack, is a malicious cyberattack in which a massive volume of emails is sent to a targeted email address or mail server with the intent to overwhelm and disrupt the recipient's inbox or the mail server itself. This inundation of emails can render the victim's email account or server inoperable, causing significant disruption and potential loss of productivity.

Read more insights here:

1. Frontier Communications has alerted 750,000 customers of a data breach following an April 2024 cyber attack by the RansomHub ransomware group. The breach exposed sensitive personal information, including names and Social Security Numbers, but no financial data. Frontier has notified regulatory authorities and offered affected customers free credit monitoring and identity theft protection. RansomHub has threatened to leak or sell the stolen data if Frontier doesn't meet their demands by June 14, 2024.
2. Debt collection agency FBCS has updated the number of people affected by a February data breach to over 3.2 million, up from the initially reported 1.9 million. The breach exposed sensitive information such as names, Social Security Numbers, dates of birth, account information, and driver's license numbers. Impacted individuals have been notified and offered free 24-month credit monitoring and identity restoration services. FBCS is implementing stronger security measures and advises affected customers to be vigilant against phishing, fraud, and social engineering attacks.
3. Threat actor ShinyHunters is claiming to sell data from a Santander Bank breach, affecting 30 million customers and employees, shortly after the bank disclosed a data breach in Chile, Spain, and Uruguay. The stolen data reportedly includes 28 million credit card numbers and 6 million account details. Santander's financial report, however, lists only 19.5 million customers in those regions, casting doubt on the claim. ShinyHunters, known for breaching and selling data from numerous companies, has posted the data for $2 million on BreachForums and the Russian-speaking Exploit forum.
4. First American Financial Corporation disclosed that a December cyber attack affected 44,000 individuals, exposing sensitive personal data. The company, a major title insurance provider, took systems offline to contain the breach and has offered affected individuals free credit monitoring and identity protection services. This breach comes shortly after First American settled a $1 million penalty for a 2019 data exposure incident. The company has completed its investigation and is notifying those impacted by the December attack.
5. Sav-Rx, a pharmacy benefit management company, disclosed a data breach affecting 2.8 million Americans, stemming from an October 2023 cyberattack. The breach exposed sensitive personal information, including names, Social Security Numbers, and insurance details. Despite restoring systems quickly, Sav-Rx's investigation took eight months to complete, concluding in April 2024. The company has implemented enhanced security measures and offers two years of credit monitoring and identity theft protection to affected individuals, urging them to monitor their credit reports for any signs of fraud.
6. WebTPA disclosed a data breach affecting nearly 2.5 million insurance policyholders, including customers of major companies like The Hartford and Transamerica. The breach, occurring between April 18 and April 23, 2023, exposed personal information such as names, Social Security Numbers, and insurance details. WebTPA discovered the breach in December 2023 and notified affected individuals by May 2024. Although no financial or medical treatment information was compromised, WebTPA offers two years of credit monitoring and identity theft protection through Kroll, advising vigilance against potential fraud.

1. Chinese hackers breached 20,000 FortiGate systems worldwide using a critical vulnerability (CVE-2022-42475) between 2022 and 2023, the Dutch Military Intelligence and Security Service (MIVD) revealed. This cyber-espionage campaign, larger than initially reported, affected numerous Western governments, international organizations, and defense companies. The Coathanger remote access trojan (RAT) malware used in the attacks also infiltrated a Dutch Ministry of Defence network but was contained due to network segmentation.
2. Previously identified by eSentire, the Warmcookie Windows malware breaches corporate networks through fake job offer phishing campaigns. Discovered by Elastic Security Labs, Warmcookie can fingerprint machines, capture screenshots, and deploy additional payloads. The ongoing campaign sees threat actors creating new domains weekly and using compromised infrastructure to send phishing emails.
3. Kaspersky has launched KVRT, a free virus removal tool for Linux, allowing users to scan and remove malware. Despite perceptions of Linux's security, threats like the XZ Utils backdoor highlight vulnerabilities. KVRT is a standalone scanner that detects and cleans malware, adware, and other threats, but it does not provide real-time protection.
4. Cybercriminals are distributing malware through cracked Microsoft Office versions on torrent sites. The malware includes RATs, cryptocurrency miners, downloaders, proxy tools, and anti-AV programs. AhnLab Security Intelligence Center (ASEC) warns against downloading pirated software, noting that attackers use lures like Microsoft Office, Windows, and Korea's popular Hangul Word Processor.
5. The 'Pumpkin Eclipse' botnet disrupted internet access for 600,000 SOHO routers in 2023, primarily affecting the Midwest. Lumen's Black Lotus Labs reported the attack occurred between October 25-27, leaving users with no choice but to replace their routers. The incident targeted one ISP and three specific router models: ActionTec T3200s, ActionTec T3260s, and Sagemcom F5380.
6. Operation Endgame, an international law enforcement effort, seized over 100 servers used by major malware loaders like IcedID and Trickbot between May 27-29, 2024. The operation included 16 searches across Europe, resulting in four arrests—one in Armenia and three in Ukraine. Police also identified eight fugitives linked to these operations, who will be added to Europol’s ‘Most Wanted’ list.
7. Attackers have compromised the installer of Justice AV Solutions (JAVS) courtroom recording software with malware, enabling system takeovers. JAVS, which has over 10,000 installations worldwide, has removed the infected version from its website. The company states the malicious fffmpeg.exe binary did not originate from JAVS or any associated third party.
8. The banking trojan "Grandoreiro" is resurging in a large-scale phishing campaign, targeting customers of 1,500 banks in over 60 countries. In January 2024, an international operation involving Brazil, Spain, Interpol, ESET, and Caixa Bank disrupted the malware, which had caused $120 million in losses since 2017. The operation led to five arrests and thirteen searches in Brazil, but details about the suspects' roles remain undisclosed.

Stay updated with "Cybersecurity News and Trends from Intelliroot." For the latest stories shaping the cybersecurity landscape, follow us on LinkedIn or visit our Cybersecurity News and Trends page.

Threat Feeds:

https://www.binarydefense.com/banlist.txt

https://threatfox.abuse.ch/browse/

https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt

https://threatfeeds.io/