Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Cybercrime Supply Chain 2023:
Measurements and Assessments of Cyber Attack Resources and Where Criminals Acquire Them

Source: Interisle

Interisle researchers, using data from the Cybercrime Information Center, analyzed more than 10 million cybercrime records and found distinct, persistent patterns of exploitation and abuse covering a 365-day period from September 2022 to August 2023. Read more.

Android Malware Masquerades As Chrome Browser Reads SMS & Intercepts Emails

Source: GBHackers

Cybersecurity researchers at K7 Security Labs recently identified Rusty Droid RAT, a stealthy Android malware masquerading as a Chrome browser to read SMS and intercept emails. Read more.

The Rise of S3 Ransomware: How to Identify and Combat It

Source: The Hacker News

Despite S3 being a secure service from a reputable provider, its pivotal role in handling vast amounts of sensitive data (customer personal information, financial data, intellectual property, etc.), provides a juicy target for threat actors. Read more.

Quishing: Tricks to look out for

Source: HELP NET SECURITY

By now, most people know what a QR code looks like and that they need to scan it to get to information “embedded” in it. Unfortunately, not many users know that QR codes are not inherently safe and may be used for malicious purposes. Read more.

New iLeakage attack steals emails, passwords from Apple Safari

Source: BLEEPING COMPUTER

Academic researchers created a new speculative side-channel attack they named iLeakage that works on all recent Apple devices and can extract sensitive information from the Safari web browser. Read more.

The Danger of Forgotten Pixels on Websites: A New Case Study

Source: The Hacker News

Recently, Reflectiz, an advanced website security solution provider, released a case study focusing on a forgotten and misconfigured pixel that had been associated with a leading global healthcare provider. This overlooked piece of code surreptitiously gathered private data without user consent, potentially exposing the company to substantial fines and damage to its reputation. Read more.

ServiceNow quietly addresses unauthenticated data exposure flaw from 2015

Source: The Register

ServiceNow’s widgets act as powerful APIs for the platform’s Service Portal. Despite a code change earlier this year to improve safety, the default configuration of these widgets was to set their records public, meaning that if they’re left unchanged, they will return the type of data an attacker specifies. Read more.

The Duck is Hiring in Italy: DUCKTAIL Spread via Compromised LinkedIn Profiles
By Clus

Source: DuskRise

Cluster25 observed a malicious campaign that employs LinkedIn messages as a vector for executing identity theft attacks. In this campaign, compromised LinkedIn accounts are utilized to send messages to users with the aim of compromising their accounts by illicitly procuring their cookies, session data, and browser credentials. Read more.

Trojanized PyCharm Software Version Delivered via Google Search Ads

Source: The Hacker News

A new malvertising campaign has been observed capitalizing on a compromised website to promote spurious versions of PyCharm on Google search results by leveraging Dynamic Search Ads. Read more.

Latest Cloudflare distributed denial-of-service report details record-setting attack

Source: silicon ANGLE

The record-breaking attack in question hit an unprecedented 201 million requests per second. The figure is notably higher than the previous largest recorded attack, which stood at 71 million rps and was detailed by Cloudflare in February. Read more.

A cascade of compromise: unveiling Lazarus’ new campaign

Source: SECURELIST

The adversary demonstrated a high level of sophistication, employing advanced evasion techniques and introducing SIGNBT malware for victim control. In addition, other malware found in memory included Lazarus’ prominent LPEClient, a tool known for victim profiling and payload delivery that has previously been observed in attacks on defense contractors and the cryptocurrency industry. Read more.

Citrix Bleed: Leaking Session Tokens with CVE-2023-4966

Source: Assetnote

Earlier this month Citrix released a security bulletin which mentioned “unauthenticated buffer-related vulnerabilities” and two CVEs. These issues affected Citrix NetScaler ADC and NetScaler Gateway. Read more.

Hackers Cripple Five Ontario Hospitals by Hitting a Single Service Provider

Source: Bitdefender

Five hospitals in Canada are unable to continue normal caretaking of patients due to a cyberattack against their joint service provider. Non-emergency patients are told to visit their local clinic. Read more.

Hacktivism in the Israel-Hamas Conflict | Citizen Data Leaked Using Old Malware

Source: SentinelOne

So far, the use of novel malware/scareware and tools such as Redline Stealer and PrivateLoader by these threat actors continue to target Israeli citizens, businesses, and critical sector entities, causing data leaks and widespread disruptions. Read more.

Want more articles? Check out the previous edition of Security Signals. Want Tips for Establishing Your Security Program, check out the Malware Patrol blog post: Tips for Establishing Your Security Program.

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Hackers Using Secure USB Drives To Attack Government Entities

Source: GBHackers

An ongoing attack on government agencies in the APAC region has been claimed to have compromised a secure USB device with hardware encryption. Read more.

Number of Cisco Devices Hacked via Unpatched Vulnerability Increases to 40,000

Source: SECURITY WEEK

The exploited vulnerability is CVE-2023-20198, a critical flaw affecting the IOS XE web interface that can be exploited by remote, unauthenticated attackers for privilege escalation. Read more.

Google Play Protect Introduces Real-Time Code-Level Scanning for Android Malware

Source: The Hacker News

Google has announced an update to its Play Protect with support for real-time scanning at the code level to tackle novel malicious apps prior to downloading and installing them on Android devices. Read more.

A Threat Actor Is Selling Access To Facebook And Instagram’s Police Portal

Source: Security Affairs

The portal allows law enforcement agencies to request data relating to users (IP, phones, DMs, device info) or request the removal of posts and the ban of accounts. Read more.

DarkGate malware campaign

Source: W/ Labs

It rapidly became apparent that the lure documents and targeting were very similar to recent DuckTail infostealer campaigns, and it was possible to pivot through opensource data from the DarkGate campaign to multiple other infostealers which are very likely being used by the same actor/group. Read more.

Another InfoStealer Enters the Field, ExelaStealer

Source: FORTINET

FortiGuard Labs research reveals that ExelaStealer is a largely open-source InfoStealer with paid customizations available from the threat actor. Read more.

Ragnar Locker ransomware group taken down

Source: Malwarebytes LABS

Even though it had a long run for a ransomware group, it seems the bell might be tolling for Ragnar Locker. On October 19, 2023, the group’s leak site was seized by an international group of law enforcement agencies. Read more.

Attacks on 5G Infrastructure From User Devices: ASN.1 Vulnerabilities in 5G Cores

Source: TREND MICRO

In the second part of this series, we will examine how attackers can trigger vulnerabilities by sending control messages masquerading as user traffic to cross over from user plane to control plane. Read more.

Clever malvertising attack uses Punycode to look like KeePass’s official website

Source: CISA

In a recent malvertising campaign, we observed a malicious Google ad for KeePass, the open-source password manager which was extremely deceiving. Read more.

CISA, NSA, FBI, and MS-ISAC Release Update to #StopRansomware Guide

Source: CISA

The update includes new prevention tips such as hardening SMB protocols, revised response steps, and added threat hunting insights. Read more.

Walmart Jumps to Top Spot as the Most Impersonated Brand for Phishing Scams in Q3 2023

Source: CHECK POINT

Our latest Brand Phishing Report for Q3 2023 highlights the brands that were most frequently imitated by cybercriminals in their attempts to steal individuals’ personal information or payment credentials during July, August and September 2023. Read more.

Email Security Best Practices for Phishing Prevention

Source: TREND MICRO

Trend Micro Research reported a 29% growth in phishing attacks blocked and detected in 2022. Explore the latest phishing trends and email security best practices to enhance your email security and reduce cyber risk. Read more.

Threat Actors Breached Okta Support System And Stole Customers’ Data

Source: Security Affairs

Okta revealed that threat actors breached its support case management system and stole sensitive data that can be used in future attacks. Read more.

Admin behind E-Root stolen creds souk extradited to US

Source: The Register

A Moldovan who allegedly ran the compromised-credential marketplace E-Root has been extradited from the UK to America to stand trial. Read more.

Want more articles? Check out the previous edition of Security Signals. Want to learn more about AI-Enabled Phishing Tactics, check out the Malware Patrol blog post: Phishing’s Next Wave: AI-Enabled Tactics for Attackers and Cybersecurity Pros.

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Threat Actor Profile: Strox Phishing-as-a-Service

Source: PhishLABS

Strox has become one of the most complete phishing solutions for fraud actors available, offering advanced phishing kits, hosting services, mail spam scripts, and an automated market for selling stolen credentials. Read more.

The Art of Concealment: A New Magecart Campaign That’s Abusing 404 Pages

Source: Akamai

This campaign stands out because of its three advanced concealment techniques, one of which we had never seen before — specifically, manipulating the website’s default 404 error page to hide malicious code — that poses unique challenges for detection and mitigation. Read more.

Vulnerability Exposed in WordPress Plugin User Submitted Posts

Source: InfoSecurity Magazine

A new vulnerability in the User Submitted Posts WordPress plugin (versions 20230902 and below) has been discovered by the Patchstack team. With over 20,000 active installations, this popular plugin is used for user-generated content submissions and is developed by Plugin Planet. Read more.

ShellBot DDoS Malware Installed Through Hexadecimal Notation Addresses

Source: ASEC

ASEC has recently discovered a change in the distribution method of the ShellBot malware, which is being installed on poorly managed Linux SSH servers. The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value. Read more.

Microsoft: State hackers exploiting Confluence zero-day since September

Source: BLEEPING COMPUTER

Microsoft says a Chinese-backed threat group tracked as ‘Storm-0062’ (aka DarkShadow or Oro0lxy) has been exploiting a critical privilege escalation zero-day in the Atlassian Confluence Data Center and Server since September 14, 2023. Read more.

Multiple Citrix NetScaler Flaw Leads to DoS Attack and Data Exposure

Source: GBHackers

Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway have exposed sensitive information and a denial of service attack. A malicious cyber actor can exploit one of these vulnerabilities to gain control of an affected machine. Citrix has published security upgrades to address the vulnerabilities impacting several products. Read more.

Microsoft Fixes Exploited Zero-Days in WordPad, Skype for Business

Source: SECURITY WEEK

Microsoft’s security response team on Tuesday pushed out a massive batch of software and OS updates to cover more than 100 vulnerabilities across the Windows ecosystem and warned that three of the flaws are already being exploited in the wild. Read more.

Microsoft to Phase Out NTLM in Favor of Kerberos for Stronger Authentication

Source: The Hacker News

Microsoft has announced that it plans to eliminate NT LAN Manager (NTLM) in Windows 11 in the future, as it pivots to alternative methods for authentication and bolster security. Read more.

#StopRansomware: AvosLocker Ransomware (Update)

Source: CISA

AvosLocker affiliates compromise organizations’ networks by using legitimate software and open-source remote system administration tools. AvosLocker affiliates then use exfiltration-based data extortion tactics with threats of leaking and/or publishing stolen data. Read more.

Fortinet Releases Security Updates for Multiple Products

Source: CISA

Fortinet has released security advisories addressing vulnerabilities in multiple products. These vulnerabilities may allow cyber threat actors to take control of the affected systems. Read more.

Juniper Networks Patches Over 30 Vulnerabilities in Junos OS

Source: SECURITY WEEK

The most severe of these issues is an incorrect default permissions bug that allows an unauthenticated attacker with local access to a vulnerable device to create a backdoor with root privileges. Read more.

Biggest DDoSes of all time generated by protocol 0-day in HTTP/2

Source: ars TECHNICA

Unlike other high-severity zero-days in recent years—Heartbleed or log4j, for example—which caused chaos from a torrent of indiscriminate exploits, the more recent attacks, dubbed HTTP/2 Rapid Reset, were barely noticeable to all but a select few engineers. Read more.

Ransomlooker, A New Tool To Track And Analyze Ransomware Groups’ Activities

Source: Security Affairs

The researchers have created the tool to help cybersecurity experts in their daily jobs by providing real-time updates and actionable insights. It offers various statistical insights into data, the ability to determine attack perpetrators, and incorporates filtering by country, industries, time span, and other parameters for journalistic investigations. Read more.

Dozens of Squid Proxy Vulnerabilities Remain Unpatched 2 Years After Disclosure

Source: SECURITY WEEK

Dozens of vulnerabilities affecting the Squid caching and forwarding web proxy remain unpatched two years after a researcher responsibly disclosed them to developers. Read more.