Title: New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught
Date Published: September 30, 2021
https://thehackernews.com/2021/09/new-azure-ad-bug-lets-hackers-brute.html
Excerpt: “Threat actors can exploit the autologon usernamemixed endpoint to perform brute-force attacks. This activity is not logged in Azure AD sign-in logs, enabling it to remain undetected. As of this publication, tools and countermeasures to detect brute-force or password spray attacks are based on sign-in log events. CTU analysis indicates that the autologon service is implemented with Azure Active Directory Federation Services (AD FS). Microsoft AD FS documentation recommends disabling internet access to the windowstransport endpoint. However, that access is required for Seamless SSO. Microsoft indicates that the usernamemixed endpoint is only required for legacy Office clients that predate the Office 2013 May 2015 update.”
Title: Federal Indictment in Chicago Charges Turkish National With Directing Cyber Attack on Multinational Hospitality Company
Date Published: September 30, 2021
Excerpt: “In August 2017, IZZET MERT OZEK used the WireX botnet, which consisted of compromised Google Android devices, to direct large amounts of network traffic to the hospitality company’s website, preventing legitimate users from completing hotel bookings, according to an indictment returned Tuesday in U.S. District Court in Chicago. The hospitality company, which managed luxury hotels and resorts, was headquartered in Chicago and the servers for its website were located in northern Illinois. The indictment charges Ozek, 32, with one count of intentionally causing damage to a protected computer. Ozek is believed to be residing in Turkey, and a warrant for his arrest will be issued.”
Title: These Systems Are Facing Billions of Attacks Every Month as Hackers Try to Guess Passwords
Date Published: September 30, 2021
https://www.welivesecurity.com/wp-content/uploads/2021/09/eset_threat_report_t22021.pdf
Excerpt: “Cybersecurity researchers at ESET detected 55 billion new attempts at brute-force attacks between May and August 2021 alone – more than double the 27 billion attacks detected between January and April. Successfully guessing passwords can provide cyber criminals with an easy route into networks and an avenue they can use to launch further attacks, including delivering ransomware or other malware. Once in a network, they’ll attempt to use that access to gain additional permissions and manipulate the network, performing actions like turning off security services so they can go about their activities more easily.”
Title: RansomEXX Ransomware Linux Encryptor May Damage Victims’ Files
Date Published: September 30, 2021
Excerpt: “Some strains of Linux ransomware will attempt to acquire a file lock using fcntl while others will often not attempt to lock files for writing, and instead either knowingly choose to take the risk of corrupting the files or do so unknowingly due to lack of Linux programming experience,” Morris told BleepingComputer. “The Linux version of RansomEXX did not attempt to lock the file at all.” When RansomExx encrypts a file, it will append an RSA encrypted decryption key to the end of each encrypted file. If a victim pays a ransom, the threat actor supplies a decryptor that can decrypt each file’s encrypted decryption key and then use it to decrypt the file’s contents.”
Title: Hackers Posed as Amnesty International, Promising Anti-Spyware Tool That Actually Collects Passwords
Date Published: September 30, 2021
https://www.cyberscoop.com/amnesty-international-spyware-scam-pegasus/
Excerpt: “Hackers can use that access to download and execute other malicious tools as well as exfiltrate data such as passwords. The campaign preys on growing concerns around the threat of spyware. Human rights advocates have long criticized the NSO Group for the use of its technology by governments to spy on activists, dissidents and journalists. A sweeping July report by Amnesty International and partners revealed that the spyware was using a vulnerability in the previous version of iOS to target more than three dozen victims. Apple patched the vulnerabilities in September. In light of the growing number of victims, groups including the United Nations have called for a moratorium on spyware technology until it meets international human rights standards.”
Title: 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
Date Published: September 28, 2021
https://www.recordedfuture.com/chinese-apt-groups-target-afghan-telecommunications-firm/
Excerpt: “The targeting of the same organization by activity groups under the same state sponsorship is not unusual, particularly for Chinese adversaries. Many of these groups have separate intelligence requirements and, due to the scale of the Chinese intelligence apparatus, are often not coordinated in their targeting and collection. In this case, as visible in Figure 1, there has been an increase in data exfiltration events associated with the Calypso APT and Winnti intrusions in August and September 2021. This is indicative of both historical strategic collection targeting Afghanistan as well as a further concentration of activity in line with major geopolitical events.”
Title: Thousands of University Wi-Fi Networks Expose Log-In Credentials
Date Published: September 30, 2021
https://threatpost.com/misconfiguration-university-wifi-login-credentials/175157/
Excerpt: “Specifically, researchers discovered flaws in the implementation of the Extensible Authentication Protocol (EAP) that Eduroam uses, which provides different stages of authentication as people connect to the network. Some of those authentication phases aren’t configured properly in some universities, opening security holes, they said. “Any students or faculty members using Eduroam or similar EAP-based Wi-Fi networks in their faculties with the wrong configuration are at risk,” researchers wrote in a report posted Wednesday. “If you are using an Android device and have Eduroam Wi-Fi set to auto-connect, malicious people could capture your plaintext username and password by only getting 20 or so meters in range of you”.”
Title: Ghostemperor: From Proxylogon to Kernel Mode
Date Published: September 30, 2021
https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
Excerpt: “We identified multiple attack vectors that triggered an infection chain leading to the execution of malware in memory. We noticed that the majority of the GhostEmperor infections were deployed on public facing servers, as many of the malicious artefacts were installed by the ‘httpd.exe’ Apache server process, the ‘w3wp.exe’ IIS Windows server process, or the ‘oc4j.jar’ Oracle server process. This means that the attackers likely abused vulnerabilities in the web applications running on those systems, allowing them to drop and execute their files.”
Title: Ransomware Gangs Are Complaining That Other Crooks Are Stealing Their Ransoms
Date Published: September 30, 2021
Excerpt: “One forum user claimed to have had suspicions of REvil’s tactics, and said their own plans to extort $7 million from a victim was abruptly ended. They believe that one of the REvil authors took over the negotiations using the backdoor and made off with the money. Another user on the Russian-speaking forum complained they were tired of “lousy partner programs” used by ransomware groups “you cannot trust”, but also suggested that the status of REvil as one of the most lucrative ransomware-as-a-service schemes means that wannabe ransomware crooks will still flock to become affiliates. That’s particularly the case now the group is back in action after appearing to go on hiatus earlier in the summer.”
Title: CISA Releases Insider Risk Mitigation Self-Assessment Tool
Date Published: September 30, 2021
Excerpt: “The Cybersecurity and Infrastructure Security Agency (CISA) released an Insider Risk Mitigation Self-Assessment Tool today, which assists public and private sector organizations in assessing their vulnerability to an insider threat. By answering a series of questions, users receive feedback they can use to gauge their risk posture. The tool will also help users further understand the nature of insider threats and take steps to create their own prevention and mitigation programs.” reads the announcement published by CISA.”