News – September 2021


  • RaidForums data marketplace accidentally exposes private staff page

    September 22, 2021

    Underground marketplace and hacker forum, RaidForums, recently exposed internal pages from its website, meant for staff members only. RaidForums is a data breach marketplace where threat actors often sell or leak illicitly obtained data dumps. Read more… Source: Bleeping Computer  

  • Microsoft Exchange Autodiscover bugs leak 100K Windows credentials

    September 22, 2021

    Bugs in the implementation of Microsoft Exchange’s Autodiscover feature have leaked approximately 100,000 login names and passwords for Windows domains worldwide. In a new report by Amit Serper, Guardicore’s AVP of Security Research, the researcher reveals how the incorrect implementation of the Autodiscover protocol, rather than a bug in Microsoft Exchange, is causing Windows credentials to ...

  • Detection evasion in CLR and tips on how to detect such attacks

    September 21, 2021

    In terms of costs, the age-old battle that pits attacker versus defender has become very one sided in recent years. Almost all modern attacks (and ethical offensive exercises) use Mimikatz, SharpHound, SeatBelt, Rubeus, GhostPack and other toolsets available to the community. This so-called githubification is driving attackers’ costs down and reshaping the focus from malware ...

  • Russian state hackers use new TinyTurla malware as secondary backdoor

    September 21, 2021

    Russian state-sponsored hackers known as the Turla APT group have been using new malware over the past year that acted as a secondary persistence method on compromised systems in the U.S., Germany, and Afghanistan. Named TinyTurla due to its limited functionality and uncomplicated coding style, the backdoor could also be used as a stealthy second-stage malware ...

  • Database containing personal info on 106m people who traveled to Thailand found open to the internet – report

    September 21, 2021

    A database containing personal information on 106 million international travelers to Thailand was exposed to the public internet this year, a Brit biz claimed this week. Bob Diachenko, head of cybersecurity research at product-comparison website Comparitech, said the Elasticsearch data store contained visitors’ full names, passport numbers, arrival dates, visa types, residency status, and more. It ...

  • Epik Confirms Hack, Gigabytes of Data on Offer

    September 21, 2021

    Epik, the domain registrar known for hosting several large right-wing organizations, has confirmed a hack of its systems, a week after attackers branding themselves with the Anonymous hacktivist collective label said that the group had obtained and leaked gigabits of data from the hosting company, including 15 million email addresses. “On September 15, we confirmed that ...

  • Malicious PowerPoint Documents on the Rise

    September 21, 2021

    McAfee Labs have observed a new phishing campaign that utilizes macro capabilities available in Microsoft PowerPoint. In this campaign, the spam email comes with a PowerPoint file as an attachment. Upon opening the malicious attachment, the VBA macro executes to deliver variants of AgentTesla which is a well-known password stealer. These spam emails purport to be ...

  • CISA: Sharing Information To Get Ahead Of Supply Chain Risks

    September 21, 2021

    The increase in digitization and use of information and communications technology (ICT) has improved ability of many companies to provide National Critical Functions. ICT enables access to real-time information, remote entry to networks, instant communication, and so much more. At the same time, nation-states seeking to cause harm to the United States (i.e., espionage or ...

  • UK: 250 Afghan interpreters’ details in data breach, MoD confirms

    September 21, 2021

    The Ministry of Defence has launched an investigation into a data breach involving the details of 250 Afghan interpreters. An MoD spokeswoman told Sky News 250 email addresses are part of the breach, but it is not yet known if they contain the names or photos of the translators involved. The breach was carried out by the ...

  • Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

    September 20, 2021

    A fileless campaign that used a new HCrypt variant to distribute numerous remote access trojans (RATs) in victim systems uses a newer obfuscation mechanism compared to what has been observed in past reports. It reached the peak of activity in the middle of August 2021. HCrypt is a crypter and multistage generator that is considered difficult ...

  • VoIP.ms phone services disrupted by DDoS extortion attack

    September 20, 2021

    Threat actors are targeting voice-over-Internet provider VoIP.ms with a DDoS attack and extorting the company to stop the assault that’s severely disrupting the company’s operation. VoIP.ms is an Internet phone service company that provides affordable voice-over-IP service to businesses around the world. Read more… Source: Bleeping Computer  

  • Is it OK to use stolen data? What if it’s scientific research in the public interest?

    September 20, 2021

    There’s a fine line between getting hold of data that may be in the public interest and downright stealing data just because you can. And simply because the data is out there – having been stolen by online intruders and then leaked – does not mean it is right to use it. A paper published in ...

  • Europol: 106 arrested in a sting against online fraudsters

    September 20, 2021

    The Spanish National Police (Policía Nacional), supported by the Italian National Police (Polizia di Stato), Europol and Eurojust, dismantled an organised crime group linked to the Italian Mafia involved in online fraud, money laundering, drug trafficking and property crime. The suspects defrauded hundreds of victims through phishing attacks and other types of online fraud such as ...

  • Microsoft MSHTML Flaw Exploited by Ryuk Ransomware Gang

    September 17, 2021

    Criminals behind the Ryuk ransomware were early exploiters of the Windows MSHTML flaw, actively leveraging the bug in campaigns ahead of a patch released by Microsoft this week. Collaborative research by Microsoft and RiskIQ revealed campaigns by Ryuk threat actors early on that exploited the flaw, tracked as CVE-2021-40444. The bug is a remote code execution ...

  • U.S. to sanction crypto exchanges, wallets used by ransomware

    September 17, 2021

    The Biden administration is expected to issue sanctions against crypto exchanges, wallets, and traders used by ransomware gangs to convert ransom payments into fiat money. With ransomware attacks against US interests and infrastructure escalating over the past two years, the White House has increased its efforts to disrupt ransomware operations Read more… Source: Bleeping Computer