The City of Wichita in Kansas was forced to shut down its computer systems after a ransomware attack.

The City of Wichita, Kansas, was the victim of a ransomware attack and shut down its network to contain the threat.

The security breach took place on May 5th, 2024, and immediately started its incident response procedure to prevent the threat from spreading.

The City is investigating and containing the incident with the help of third-party security experts and federal and local law enforcement authorities.

“We regret to report that certain online City services may be unavailable as we thoroughly review and assess an incident that affected some of our computer systems. As part of this assessment, we turned off our computer network.” reads the security breach notification. “This decision was not made lightly but was necessary to ensure that systems are securely vetted before returning to service.”

The City warns that some services may be temporarily unavailable while systems are offline.

City of Wichita is still investigating the scope of the incident and has yet to determine if the company has suffered a data breach.

The City hasn’t disclosed the family of ransomware that infected its systems and the name of the extortion gang behind the attack.

“We are working with specialists to thoroughly review and assess systems before putting them back online. Systems will be restored on a staggered basis to minimize disruptions. We do not have a definitive timeline for returning all systems to production.” the city noted.

“This [the name of the group that is claiming responsibility for the attack] is not being shared for operational security purposes.” states the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, City of Wichita)

Virtual private networking (VPN) companies market their services as a way to prevent anyone from snooping on your Internet usage. But new research suggests this is a dangerous assumption when connecting to a VPN via an untrusted network, because attackers on the same network could force a target’s traffic off of the protection provided by their VPN without triggering any alerts to the user.

When a device initially tries to connect to a network, it broadcasts a message to the entire local network stating that it is requesting an Internet address. Normally, the only system on the network that notices this request and replies is the router responsible for managing the network to which the user is trying to connect.

The machine on a network responsible for fielding these requests is called a Dynamic Host Configuration Protocol (DHCP) server, which will issue time-based leases for IP addresses. The DHCP server also takes care of setting a specific local address — known as an Internet gateway — that all connecting systems will use as a primary route to the Web.

VPNs work by creating a virtual network interface that serves as an encrypted tunnel for communications. But researchers at Leviathan Security say they’ve discovered it’s possible to abuse an obscure feature built into the DHCP standard so that other users on the local network are forced to connect to a rogue DHCP server.

“Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway,” Leviathan researchers Lizzie Moratti and Dani Cronce wrote. “When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.”

The feature being abused here is known as DHCP option 121, and it allows a DHCP server to set a route on the VPN user’s system that is more specific than those used by most VPNs. Abusing this option, Leviathan found, effectively gives an attacker on the local network the ability to set up routing rules that have a higher priority than the routes for the virtual network interface that the target’s VPN creates.

“Pushing a route also means that the network traffic will be sent over the same interface as the DHCP server instead of the virtual network interface,” the Leviathan researchers said. “This is intended functionality that isn’t clearly stated in the RFC [standard]. Therefore, for the routes we push, it is never encrypted by the VPN’s virtual interface but instead transmitted by the network interface that is talking to the DHCP server. As an attacker, we can select which IP addresses go over the tunnel and which addresses go over the network interface talking to our DHCP server.”

Leviathan found they could force VPNs on the local network that already had a connection to arbitrarily request a new one. In this well-documented tactic, known as a DHCP starvation attack, an attacker floods the DHCP server with requests that consume all available IP addresses that can be allocated. Once the network’s legitimate DHCP server is completely tied up, the attacker can then have their rogue DHCP server respond to all pending requests.

“This technique can also be used against an already established VPN connection once the VPN user’s host needs to renew a lease from our DHCP server,” the researchers wrote. “We can artificially create that scenario by setting a short lease time in the DHCP lease, so the user updates their routing table more frequently. In addition, the VPN control channel is still intact because it already uses the physical interface for its communication. In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.”

The researchers say their methods could be used by an attacker who compromises a DHCP server or wireless access point, or by a rogue network administrator who owns the infrastructure themselves and maliciously configures it. Alternatively, an attacker could set up an “evil twin” wireless hotspot that mimics the signal broadcast by a legitimate provider.

ANALYSIS

Bill Woodcock is executive director at Packet Clearing House, a nonprofit based in San Francisco. Woodcock said Option 121 has been included in the DHCP standard since 2002, which means the attack described by Leviathan has technically been possible for the last 22 years.

“They’re realizing now that this can be used to circumvent a VPN in a way that’s really problematic, and they’re right,” Woodcock said.

Woodcock said anyone who might be a target of spear phishing attacks should be very concerned about using VPNs on an untrusted network.

“Anyone who is in a position of authority or maybe even someone who is just a high net worth individual, those are all very reasonable targets of this attack,” he said. “If I were trying to do an attack against someone at a relatively high security company and I knew where they typically get their coffee or sandwich at twice a week, this is a very effective tool in that toolbox. I’d be a little surprised if it wasn’t already being exploited in that way, because again this isn’t rocket science. It’s just thinking a little outside the box.”

Successfully executing this attack on a network likely would not allow an attacker to see all of a target’s traffic or browsing activity. That’s because for the vast majority of the websites visited by the target, the content is encrypted (the site’s address begins with https://). However, an attacker would still be able to see the metadata — such as the source and destination addresses — of any traffic flowing by.

KrebsOnSecurity shared Leviathan’s research with John Kristoff, founder of dataplane.org and a PhD candidate in computer science at the University of Illinois Chicago. Kristoff said practically all user-edge network gear, including WiFi deployments, support some form of rogue DHCP server detection and mitigation, but that it’s unclear how widely deployed those protections are in real-world environments.

“However, and I think this is a key point to emphasize, an untrusted network is an untrusted network, which is why you’re usually employing the VPN in the first place,” Kristoff said. “If [the] local network is inherently hostile and has no qualms about operating a rogue DHCP server, then this is a sneaky technique that could be used to de-cloak some traffic – and if done carefully, I’m sure a user might never notice.”

MITIGATIONS

According to Leviathan, there are several ways to minimize the threat from rogue DHCP servers on an unsecured network. One is using a device powered by the Android operating system, which apparently ignores DHCP option 121.

Relying on a temporary wireless hotspot controlled by a cellular device you own also effectively blocks this attack.

“They create a password-locked LAN with automatic network address translation,” the researchers wrote of cellular hot-spots. “Because this network is completely controlled by the cellular device and requires a password, an attacker should not have local network access.”

Leviathan’s Moratti said another mitigation is to run your VPN from inside of a virtual machine (VM) — like Parallels, VMware or VirtualBox. VPNs run inside of a VM are not vulnerable to this attack, Moratti said, provided they are not run in “bridged mode,” which causes the VM to replicate another node on the network.

In addition, a technology called “deep packet inspection” can be used to deny all in- and outbound traffic from the physical interface except for the DHCP and the VPN server. However, Leviathan says this approach opens up a potential “side channel” attack that could be used to determine the destination of traffic.

“This could be theoretically done by performing traffic analysis on the volume a target user sends when the attacker’s routes are installed compared to the baseline,” they wrote. “In addition, this selective denial-of-service is unique as it could be used to censor specific resources that an attacker doesn’t want a target user to connect to even while they are using the VPN.”

Moratti said Leviathan’s research shows that many VPN providers are currently making promises to their customers that their technology can’t keep.

“VPNs weren’t designed to keep you more secure on your local network, but to keep your traffic more secure on the Internet,” Moratti said. “When you start making assurances that your product protects people from seeing your traffic, there’s an assurance or promise that can’t be met.”

A copy of Leviathan’s research, along with code intended to allow others to duplicate their findings in a lab environment, is available here.

More than 50% of the 90,310 hosts have been found exposing a Tinyproxy service on the internet that's vulnerable to a critical unpatched security flaw in the HTTP/HTTPS proxy tool. The issue, tracked as CVE-2023-49606, carries a CVSS score of 9.8 out of a maximum of 10, per Cisco Talos, which described it as a use-after-free bug impacting versions 1.10.0 and 1.11.1, the latter of

The recently uncovered cyber espionage campaign targeting perimeter network devices from several vendors, including Cisco, may have been the work of China-linked actors, according to new findings from attack surface management firm Censys. Dubbed ArcaneDoor, the activity is said to have commenced around July 2023, with the first confirmed attack against an unnamed victim

Resecurity found a massive leak involving the exposure of personally identifiable information (PII) of over five million citizens of El Salvador on the Dark Web.

Resecurity identified a massive leak of the personally identifiable information (PII) of over five million citizens from El Salvador on the Dark Web, impacting more than 80% of the country’s population.

The threat actor, going by the alias ‘CiberinteligenciaSV,’ posted the 144 GB data dump to Breach Forums, writing that the leak included 5,129,518 high-definition photos, each labeled with the corresponding Salvadorian’s document identification (DUI) number. Resecurity assesses that the real intellectual authors of this breach appear to have an interest in obscuring their involvement, using the background specter of the Guacamaya group and its unofficial proxies to form a cloud of uncertainty surrounding the real threat actors and attack chain that caused the data leak.

The data dump includes the following fields:

– ID
– Identification document (DUI)
– Names/Last names
– Date of birth
– Telephone
– Email
– Address
– Photo of the victim

Ultimately, this data leak is significant because it marks one of the first instances in cybercrime history where virtually the entire population of a country has been affected by a compromise of biometric data. A Federal Trade Commission advisory published last year states, “Biometric information refers to data that depict or describe physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body.”

Beyond the massive scale of Salvadorian PII records, threat actors also obtained a headshot of each victim, which represents a crucial biometric data marker – particularly in the golden age of generative AI. Notably, the vast scale of this biometric and PII data breach places most of El Salvador’s population at significant risk for identity theft and fraud. Armed with modern deep fake technology, threat actors can leverage victim headshots and related PII to stage more convincing frauds across a broad universe of digital-first financial, merchant, and government portals.

The detailed report is available here:

https://www.resecurity.com/blog/article/massive-dump-of-hacked-salvadorean-headshots-and-pii-highlights-growing-threat-actor-interest-in-biometric-data

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, El Salvador)

Cybercriminals are vipers. They’re like snakes in the grass, hiding behind their keyboards, waiting to strike. And if you're a small- and medium-sized business (SMB), your organization is the ideal lair for these serpents to slither into.  With cybercriminals becoming more sophisticated, SMBs like you must do more to protect themselves. But at what price? That’s the daunting question

Multiple security vulnerabilities have been disclosed in various applications and system components within Xiaomi devices running Android. "The vulnerabilities in Xiaomi led to access to arbitrary activities, receivers and services with system privileges, theft of arbitrary files with system privileges, [and] disclosure of phone, settings and Xiaomi account data," mobile security firm

Finland’s Transport and Communications Agency (Traficom) warned about an ongoing Android malware campaign targeting bank accounts.

Traficom, Finland’s Transport and Communications Agency, issued a warning regarding a current Android malware campaign aimed at bank accounts.

Traficom reported that clients of multiple banks received text messages in the Finnish language that instruct recipients to call a service number, from which the bank user is directed to install malware on the Android device. Threat actors used a phone number that seems to be the number of a domestic telecom operator or a local network.

The text messages purportedly from various companies, claiming debt collection or unusual account activity. The messages urge recipients to call a specified service number. Upon calling, recipients are warned of potential fraud and recommended to secure their device by downloading an antivirus software. Then the victims receive a follow-up text message containing a link to a security software which is actually malware disguised as McAfee antivirus. Once installed, the malware grants access to the victim’s applications and messages, including online banking, allowing crooks to steal funds from the victim’s online bank.

“According to reports received by the Cyber ​​Security Center, targets have been advised to download the McAfee application. The download link offers the installation of an .apk application intended for Android devices that can be downloaded from outside the application store.” reads the alert published by the Traficom. “However, it is not an anti-virus software, but a malware that can be installed on the phone. With the help of the malware, the criminal can access the phone’s applications and messages, including online banking. The criminal uses malware to steal money from the victim’s online bank.”

The alert remarks that banks or authorities do not call the customer and ask to hand over online service credentials, make payments, or install applications from outside the app store on the device.

The ongoing campaign is only targeting Android users, Traficom is not aware of attacks against iPhone users.

Below is the list of recommended actions for those recipients who have installed the malware:

1. Contact your bank. If you used a banking application or processed credit card information on an infected device, contact your bank immediately to limit the damage.

2. Reset the device to factory settings. When restoring from a backup, you must ensure that a backup that was created before the malware was installed is restored to the device. In some cases, restoring to factory settings may not be possible. If restoring to factory settings does not work, we recommend contacting the seller of the device.

3. Protect your user account. Change passwords for services you’ve used on your device. The malware may have stolen your password if you have logged into the service after installing the malware.

4. File a criminal report with the police. File a criminal complaint about financial losses.

The Finnish OP Financial Group also issued an alert about the ongoing Android malware campaign.

“Criminals send text messages in the name of companies urging them to call the service number immediately. If you call the given number and click on the link received via text message during the call, the criminal can install malware on the phone.” reads the alert.

Both Traficom and OP Financial Group haven’t shared technical details about the malware family that targeted the bank users.

Google has previously confirmed to BleepingComputer that Android’s in-built anti-malware tool, Play Protect, automatically protects against known versions of Vultur, so keeping it active at all times is crucial.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android malware)

Cybersecurity researchers have discovered a new information stealer targeting Apple macOS systems that's designed to set up persistence on the infected hosts and act as a spyware. Dubbed Cuckoo by Kandji, the malware is a universal Mach-O binary that's capable of running on both Intel- and Arm-based Macs. The exact distribution vector is currently unclear, although there are

Law enforcement seized the Lockbit group’s Tor website again and announced they will reveal more identities of its operators

Law enforcement seized the Lockbit group’s Tor website again. The authorities resumed the Lockbit seized leak site and mocked its administrators.

According to the countdown active on the seized, law enforcement that are currently controlling the website will reveal the identities of the LockBitSupps and other members of the gang on May 7, 2024, at 14:00:00 UTC.

#LOCKBIT SEIZED LEAK SITE RESURRECTED!!! And it LockBitSupps days of anonymity are numbered! Countdown to revealing who he is has started. This time, I don’t think we will be disappointed! It’s coming ON 2024-05-07 14:00:00 UTC!!!#FuckRansomware pic.twitter.com/uD09m7AukH

— Jon DiMaggio (@Jon__DiMaggio) May 5, 2024

However, researchers at VX-underground have spoken with Lockbit ransomware group administrative staff regarding the return of the old domain and the gang claims law enforcement is lying.

“I don’t understand why they’re putting on this little show. They’re clearly upset we continue to work.” Lockbit told vx-underground.

Lockbit confirmed that their operation is still active and will continue to “bring” new victims.

Today we spoke with Lockbit ransomware group administrative staff regarding the return of the old domain and new messages from FBI, NCA UK, and EURPOL.

Lockbit ransomware group states law enforcement is lying.

Lockbit also said and quote: "I don't understand why they're…

— vx-underground (@vxunderground) May 5, 2024

In February, a joint law enforcement action, code-named Operation Cronos, conducted by law enforcement agencies from 11 countries disrupted the LockBit ransomware operation.

The operation led to the arrest of two members of the ransomware gang in Poland and Ukraine and the seizure of hundreds of crypto wallets used by the group.

The British NCA took control of LockBit’s central administration environment used by the RaaS affiliates to carry out the cyberattacks. The authorities also seized the dark web Tor leak site used by the group.

The Tor leak site was seized by the NCA and was used to publish updates on the law enforcement operation and provide support to the victims of the gang.

The NCA also obtained the source code of the LockBit platform and a huge trove of information on the group’s operation, including information on affiliates and supporters.

Law enforcement also had access to data stolen from the victims of the ransomware operation, a circumstance that highlights the fact that even when a ransom is paid, the ransomware gang often fails to delete the stolen information.

The NCA and its global partners have secured over 1,000 decryption keys that will allow victims of the gang to recover their files for free. The NCA will reach out to victims based in the UK in the coming days and weeks, providing support to help them recover encrypted data.

However a few days later, the LockBit gang relaunched its RaaS operation, the group set up a new infrastructure and threatened to carry out cyber attacks on the government sector.

“Very simple, that I need to attack the .gov sector more often and more, it is after such attacks that the FBI will be forced to show me weaknesses and vulnerabilities and make me stronger. By attacking the .gov sector you can know exactly if the FBI has the ability to attack us or not.” wrote the gang.

In a few days, the gang added tens of entries to its website, but only a few of them are new victims of the group. It seems that the group is re-populating its tor leak site.

At the end of February, the gang fully recovered its operations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

NATO and the European Union formally condemned cyber espionage operations carried out by the Russia-linked APT28 against European countries.

NATO and the European Union condemned cyber espionage operations carried out by the Russia-linked threat actor APT28 (aka “Forest Blizzard”, “Fancybear” or “Strontium”) against European countries.

This week the Federal Government condemned in the strongest possible terms the long-term espionage campaign conducted by the group APT28 that targeted the Executive Committee of the Social Democratic Party of Germany.

“The Federal Government’s national attribution procedure regarding this campaign has concluded that, for a relatively long period, the cyber actor APT28 used a critical vulnerability in Microsoft Outlook that remained unidentified at the time to compromise numerous email accounts.” reads the announcement published by the German Bundesregierung.

The nation-state actor exploited the zero-day flaw CVE-2023-23397 in attacks against European entities since April 2022. The Russia-linked APT also targeted NATO entities and Ukrainian government agencies.

The vulnerability is a Microsoft Outlook spoofing vulnerability that can lead to an authentication bypass.

In December 2023, Palo Alto Networks’ Unit 42 researchers reported that the group APT28 group exploited the CVE-2023-23397 vulnerability in attacks aimed at European NATO members.

The experts highlighted that over the previous 20 months, the APT group targeted at least 30 organizations within 14 nations that are probably of strategic intelligence significance to the Russian government and its military.

In March 2023, Microsoft published guidance for investigating attacks exploiting the patched Outlook vulnerability tracked as CVE-2023-23397.

In attacks spotted by Microsoft’s Threat Intelligence at the end of 2023, the nation-state actor primarily targeted government, energy, transportation, and non-governmental organizations in the US, Europe, and the Middle East.

According to Unit 42, APT28 started exploiting the above vulnerability in March 2022.

“During this time, Fighting Ursa conducted at least two campaigns with this vulnerability that have been made public. The first occurred between March-December 2022 and the second occurred in March 2023.” reads the report published by the company.

“Unit 42 researchers discovered a third, recently active campaign in which Fighting Ursa also used this vulnerability. The group conducted this most recent campaign between September-October 2023, targeting at least nine organizations in seven nations.”

The researchers pointed out that in the second and third campaigns, the nation-state actor continued to use a publicly known exploit for the Outlook flaw. This implies that the benefits of the access and intelligence produced by these operations were deemed more significant than the potential consequences of being discovered.

The list of targets is very long and includes:

1. Other than Ukraine, all of the targeted European nations are current members of the North Atlantic Treaty Organization (NATO)
2. at least one NATO Rapid Deployable Corps
3. critical infrastructure-related organizations within the following sectors:
   1. Energy
   2. Transportation
   3. Telecommunications
   4. Information technology
   5. Military industrial base

Microsoft’s Threat Intelligence also warned of Russia-linked cyber-espionage group APT28 actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts and steal sensitive information.

In October, the French National Agency for the Security of Information Systems ANSSI (Agence Nationale de la sécurité des systèmes d’information) warned that the Russia-linked APT28 group has been targeting multiple French organizations, including government entities, businesses, universities, and research institutes and think tanks.

The French agency noticed that the threat actors used different techniques to avoid detection, including the compromise of low-risk equipment monitored and located at the edge of the target networks. The Government experts pointed out that in some cases the group did not deployed any backdoor in the compromised systems.

ANSSI observed at least three attack techniques employed by APT28 in the attacks against French organizations:

• searching for zero-day vulnerabilities [T1212, T1587.004];
• compromise of routers and personal email accounts [T1584.005, T1586.002];
• the use of open source tools and online services [T1588.002, T1583.006]. ANSSI investigations confirm that APT28 exploited the Outlook 0-day vulnerability CVE-2023-23397. According to other partners, over this period, the MOA also exploited other vulnerabilities, such as that affecting Microsoft Windows Support Diagnostic Tool (MSDT, CVE-2022-30190, also called Follina) as well as
  than those targeting the Roundcube application (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026).

According to the recent announcement published by the German government, the APT28 campaign targeted government authorities, logistics companies, armaments, the air and space industry, IT services, foundations, and associations in Germany, other European countries, and Ukraine. This group was also responsible for the 2015 cyber attack on the German Bundestag. These actions violate international cyber norms and require particular attention, especially during election years in many countries.

The Czech Ministry of Foreign Affairs also condemned long-term cyber espionage activities by the group APT28. The Ministry’s statement also confirmed that Czech institutions have been targeted by the Russia-linked APT28 exploiting the Microsoft Outlook zero-day from 2023

“Based on information from intelligence services, some Czech institutions have also been the target of cyber attacks exploiting a previously unknown vulnerability in Microsoft Outlook from 2023. The mode of operation and the focus of these attacks matched the profile of the actor APT28.” reads the announcement. “Affected subjects were offered technical recommendations and cooperation to enhance security measures. The actor APT28 has also been the subject to active measures in Czechia as part of the global operation Dying Ember.”

NATO issued similar statements, the Council of the European Union and the governments of the United States and the United Kingdom.

“The European Union and its Member States, together with international partners, strongly condemn the malicious cyber campaign conducted by the Russia-controlled Advanced Persistent Threat Actor 28 (APT28) against Germany and Czechia.” states the Council of the European Union.

“Russia’s pattern of behavior blatantly disregards the Framework for Responsible State Behavior in Cyberspace, as affirmed by all United Nations Member States.  The United States is committed to the security of our allies and partners and upholding the rules-based international order, including in cyberspace.” reads the statement published by the US government. “We call on Russia to stop this malicious activity and abide by its international commitments and obligations.  With the EU and our NATO Allies, we will continue to take action to disrupt Russia’s cyber activities, protect our citizens and foreign partners, and hold malicious actors accountable.”

The APT28 group (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The group was involved also in the string of attacks that targeted 2016 Presidential election.

The group operates out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS).

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Blackbasta gang claimed responsibility for Synlab Italia attack

LockBit published data stolen from Simone Veil hospital in Cannes

Russia-linked APT28 and crooks are still using the Moobot botnet

Dirty stream attack poses billions of Android installs at risk

ZLoader Malware adds Zeus’s anti-analysis feature

Ukrainian REvil gang member sentenced to 13 years in prison

Pro-Russia hackers target critical infrastructure in North America and Europe

HPE Aruba Networking addressed four critical ArubaOS RCE flaws

Threat actors hacked the Dropbox Sign production environment

CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog

Panda Restaurant Group disclosed a data breach

Ex-NSA employee sentenced to 262 months in prison for attempting to transfer classified documents to Russia

Cuttlefish malware targets enterprise-grade SOHO routers

A flaw in the R programming language could allow code execution

Muddling Meerkat, a mysterious DNS Operation involving China’s Great Firewall

Notorious Finnish Hacker sentenced to more than six years in prisonBlackbasta gang claimed responsibility for Synlab Italia attack

CISA guidelines to protect critical infrastructure against AI-based threats

NCSC: New UK law bans default passwords on smart devices

The FCC imposes $200 million in fines on four US carriers for unlawfully sharing user location data

Google prevented 2.28 million policy-violating apps from being published on Google Play in 2023

Financial Business and Consumer Solutions (FBCS) data breach impacted 2M individuals

Cyber-Partisans hacktivists claim to have breached Belarus KGB

The Los Angeles County Department of Health Services disclosed a data breach

Multiple Brocade SANnav SAN Management SW flaws allow device compromise

ICICI Bank exposed credit card data of 17000 customers

Okta warns of unprecedented scale in credential stuffing attacks on online services

Targeted operation against Ukraine exploited 7-year-old MS Office bug

International Press – Newsletter

Cybercrime    

Man Who Mass-Extorted Psychotherapy Patients Gets Six Years 

Panda Restaurants discloses data breach after corporate systems hack

UnitedHealth CEO Says Hackers Lurked in Network for Nine Days Before Ransomware Strike

Sodinokibi/REvil Affiliate Sentenced for Role in $700M Ransomware Scheme      

Cybersecurity consultant arrested after allegedly extorting IT firm

Cannes Simone Veil hospital center – CYBER ​​ATTACK PRESS RELEASE  

Malware

2024 Bad Bot Report  

Dragos Industrial Ransomware Analysis: Q1 2024  

Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware  

Eight Arms To Hold You: The Cuttlefish Malware  

Zloader Learns Old Tricks  

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks   

Hacking 

How to Block Residential Proxies using Okta  

AI models inch closer to hacking on their own   

Hackers use developing countries as testing ground for new ransomware attacks  

Hackers claim to have infiltrated Belarus’ main security service 

R-BITRARY CODE EXECUTION: VULNERABILITY IN R’S DESERIALIZATION  

A recent security incident involving Dropbox Sign

DEFENDING OT OPERATIONS AGAINST ONGOING PRO-RUSSIA HACKTIVIST ACTIVITY

“Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps  

Intelligence and Information Warfare 

Germany grapples with wave of spying threats from Russia and China   

A CUNNING OPERATOR: MUDDLING MEERKAT AND CHINA’S GREAT FIREWALL 

Former NSA Employee Sentenced to Over 21 Years in Prison for Attempted Espionage  

Iranian state-backed cyber spies continue to impersonate media brands, think tanks 

US moves to bar Huawei, other Chinese telecoms from certifying wireless equipment

Cybersecurity   

Japanese police create fake support scam payment cards to warn victims

Why ICICI Bank has blocked thousands of credit cards

Discord dismantles Spy.pet site that snooped on millions of users

Assessing the Cyber Threat to the Nation’s Water Supply  

Safety and Security Guidelines for Critical Infrastructure Owners and Operators

How we fought bad apps and bad actors in 2023

FCC fines carriers $196 million for selling customer location data

Smart devices: new law helps citizens to choose secure products      

Semaforum with Joseph Cox: ‘I was just blown away by its audacity’  

Mind-Bending Math Could Stop Quantum Hackers—but Few Understand It  

2024 Data Breach Investigations Report  

The PLA Navy’s Blue Team Center Games for War

NSA, cybersecurity partners issue urgent OT threat warning        

Why hundreds of U.S. banks may be at risk of failure  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

The Blackbasta extortion group claimed responsibility for the attack that in April severely impacted the operations of Synlab Italia.

Since April 18, Synlab Italia, a major provider of medical diagnosis services, has been experiencing disruptions due to a cyber attack.

The company initially cited technical issues as the cause leading to “temporary interruption of access to computer and telephone systems and related services.” However, a concerning scenario has emerged a few hours later.

The company has released a statement informing customers of the ongoing attack and has “disabled” all company computer systems in Italy as a precautionary measure.

The company’s statement announced the suspension of all activities at sampling points, medical centers, and laboratories in Italy until further notice.

The operations of the preview points in Italy have been suspended for several days, and only since the end of April have they slowly begun to resume, with different modalities from region to region.

Synlab immediately investigated the incident and is working with external experts to contain it.

The company has yet to disclose a data breach e never mentioned in its update that it was the victim of a ransomware attack.

Certain statements of the first press release published by the company raised particular concerns:

“SYNLAB informs all Patients and Customers that it has been the victim of a hacker attack on its computer systems throughout the national territory. As a precaution, all company computer systems in Italy were immediately disabled following the identification of the attack and in accordance with the company’s computer security procedures.”

“[SYNLAB] is currently unable to determine when operations can be restored.”

In my previous post I wrote:

“These statements highlight the need for the company to isolate systems to prevent the spread of the threat and mitigate its impact. Such drastic containment measures are typically associated with malware infections, while the unavailability of affected systems often suggests a ransomware infection.

Therefore, companies that suffer a ransomware attack cannot predict when they will be operational again because they need to eradicate the threat from affected systems and restore any backups.

Another concern for companies affected by ransomware is the potential exfiltration of data. If health information is stolen in the case of SYNLAB Italy, it would pose a serious risk to affected customers’ privacy and security.”

Researchers at the platform Ransomfeed.it today revealed that the criminal group Blackbasta claimed responsibility for a ransomware attack on Synlab.

The group claimed the theft of 1.5 TB of data, including company data, employees’ personal documents, customer personal data, medical analyses (spermograms, toxicology, anatomy…), and more.

As proof of the data breach, the group published images of passports, ID cards and medical analyses.

One of the images published by the group lists the folders exfiltrated, some of which have names of medical exams, while others have the names of centers located in the Campania region, even though the attack impacted the sampling points throughout Italy.

The BlackBasta ransomware group will publish the stolen data on May 11, 2024.

Black Basta has been active since April 2022, like other ransomware operations, it implements a double-extortion attack model.  

In November 2022, Sentinel Labs researchers reported having found evidence that links the Black Basta ransomware gang to the financially motivated hacking group FIN7.

In November 2022, experts at the Cybereason Global SOC (GSOC) team observed a surge in Qakbot infections as part of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US.

The attack chain starts with a QBot infection, The operators use the post-exploitation tool Cobalt Strike to take over the machine and finally deploy the Black Basta ransomware. The attacks began with a spam/phishing email containing malicious URL links.

The researchers noticed that once obtained access to the network, the threat actor moves extremely fast. In some cases observed by Cybereason, the threat actor obtained domain administrator privileges in less than two hours and moved to ransomware deployment in less than 12 hours.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Synlab Italia)

Czechia and Germany on Friday revealed that they were the target of a long-term cyber espionage campaign conducted by the Russia-linked nation-state actor known as APT28, drawing condemnation from the European Union (E.U.), the North Atlantic Treaty Organization (NATO), the U.K., and the U.S. The Czech Republic's Ministry of Foreign Affairs (MFA), in a statement, said some unnamed

LockBit ransomware operators have published sensitive data allegedly stolen from the Simone Veil hospital in Cannes.

In April, a cyber attack hit the Hospital Simone Veil in Cannes (CHC-SV), impacting medical procedures and forcing personnel to return to pen and paper.

Non-urgent surgical procedures and consultations scheduled at the time of the attack were postponed.

The French hospital was forced to take all computers offline while the telephone lines were not impacted The hospital is investigating the incident with the help of ANSSI, Cert Santé, Orange CyberDéfense, and GHT06.

The Hospital Simone Veil in Cannes is a public hospital located in Cannes, France. The hospital provides a range of medical services and healthcare facilities to the local community and surrounding areas.

CHC-SV has more than 2,000 employees and has a capacity of more than 800 beds.

The LockBit ransomware group claimed responsibility for the attack and on May 1st published stolen confidential data after the hospital refused to pay the ransom.

Yesterday the Cannes Simone Veil hospital center published a statement on its website to confirm that the data published by the ransomware group belongs to it.

“The qualification of the exfiltrated data continues and detailed and personalized feedback will be provided in the coming days to the people and institutions concerned. This feedback will also include cybersecurity advice to follow in these circumstances. Accompanied by CERT-Santé and various partners specializing in cybersecurity, the management of the hospital center confirms having filed a complaint and is actively contributing to the ongoing investigation. An alert was also sent to the CNIL and ANSSI.” reads the statement. “Furthermore, the hospital’s activity has resumed its almost normal course. The normal functioning of its information system is being restored at a sustained pace in accordance with the action plan defined at the start of the crisis.”

In the past, other French hospitals were victims of cyber attacks.

In December 2022, the Hospital Centre of Versailles was hit by a cyber attack that forced it to cancel operations and transfer some patients in other hospitals.

In August 2022, the Center Hospitalier Sud Francilien (CHSF), a hospital southeast of Paris, suffered a ransomware attack over the weekend. The attack disrupted the emergency services and surgeries and forced the hospital to refer patients to other structures. According to local media, threat actors demand a $10 million ransom to provide the decryption key to restore encrypted data.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

The Ubiquiti EdgeRouter botnet is still used by Russia-linked group APT28 and cybercriminals organizations.

Trend Micro researchers reported that the EdgeRouter botnet, called Moobot, used by the APT28 group is still active and is also used by cyber criminal organizations.

In January, the Federal Bureau of Investigation (FBI), National Security Agency (NSA), US Cyber Command, and international partners released a joint Cybersecurity Advisory (CSA) to warn that Russia-linked threat actors are using compromised Ubiquiti EdgeRouters to evade detection in cyber operations worldwide.

The US agencies and international partners (peers from Belgium, Brazil, France, Germany, Latvia, Lithuania, Norway, Poland, South Korea, and the United Kingdom) observed multiple Russia-linked threat actors (the Russian General Staff Main Intelligence Directorate (GRU), 85th Main Special Service Center (GTsSS), also known as APT28, Fancy Bear, and Forest Blizzard (Strontium)) using the Moobot botnet.

The threat actors used the botnet harvest credentials, collect NTLMv2 digests, proxy network traffic, and host spear-phishing landing pages and custom tools.

The Moobot botnet has been active since at least 2016, it also includes other routers and virtual private servers (VPS). After FBI took down the botnet, the operators set up a new C2 infrastructure to control the compromised systems. Multiple bots were still infected even after the takedown operated by law enforcement.

Trend Micro also discovered that at least two prominent cybercriminal groups and the Russia-linked APT group Pawn Storm used the botnet.

The researchers observed hundreds of Ubiquiti EdgeRouter routers being used for different purposes, including Secure Shell (SSH) brute forcing, pharmaceutical spam, employing server message block (SMB) reflectors in NTLMv2 hash relay attacks, proxying stolen credentials on phishing sites, multi-purpose proxying, cryptocurrency mining, and sending spear phishing e-mails. 

“We attribute the NTLMv2 hash relay attacks and the proxying of credential phishing to Pawn Storm, while the pharmaceutical spam looks to be related to the infamous Canadian Pharmacy gang.” reported Trend Micro. “Apart from the EdgeRouter devices, we also found compromised Raspberry Pi and other internet-facing devices in the botnet. Moreover, we found more than 350 datacenter VPS IP addresses that were still compromised even after the FBI disruption. Many of these compromised servers previously called back to the old C&C and later called back to the new C&C infrastructure. These could be easily abused by Pawn Storm or any other threat actor, as the criminal botnet operator protects their stolen assets poorly.”

During the investigation into a Linux botnet targeted in a partial takedown by the FBI in January 2024, the researchers discovered another Linux botnet running on some of the same EdgeRouters previously exploited by Pawn Storm.

This second botnet exhibits greater discretion and improved operational security, as the associated malware operates exclusively in memory, leaving no malicious files on the disk. The analysis of memory dumps and command-and-control connections revealed that the botnet is running a variant of the Ngioweb malware. Evidence suggests that these bots are part of a residential botnet available for commercial use to subscribers. The discovery underscores significant interest among different threat actors in compromising internet-facing routers.

The following table shows simultaneous activity found by Trend Micro on compromised EdgeRouters.

Intrusion set	Motivation	TTP	TTP	Time range
Pawn Storm	Espionage	Shell scripts, SSH tunneling	Credential Phishing, NTLMv2 hash relay attack	April 2022 – April 2024
					Water Zmeu	Financial gain	Shell scripts, SSHDoor	Proxy service, Data theft, Scanning, Cryptocurrency mining	2016 – 2024
Water Barghest	Financial gain	Reverse proxy, Multilayered C&C infrastructure	Residential proxy service	2018-2024

“Internet-facing devices like SOHO routers are also a popular asset for criminal purposes and espionage.” concludes the report. “In the specific case of the compromised Ubiquiti EdgeRouters, we observed that a botnet operator has been installing backdoored SSH servers and a suite of scripts on the compromised devices for years without much attention from the security industry, allowing persistent access. Another threat actor installed the Ngioweb malware that runs only in memory to add the bots to a commercially available residential proxy botnet. Pawn Storm most likely easily brute forced the credentials of the backdoored SSH servers and thus gained access to a pool of EdgeRouter devices they could abuse for various purposes.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, APT28)

Microsoft devised an attack technique, dubbed ‘Dirty Stream,’ impacting widely used Android applications, billions of installations are at risk.

Microsoft is warning Android users about a new attack technique, named Dirty Stream, that can allow threat actors to take control of apps and steal sensitive data.

The IT giant describes Dirty Stream as an attack pattern, linked to path traversal, that affects various popular Android apps. The technique allows a malicious app to overwrite files in the vulnerable app’s home directory, potentially leading to arbitrary code execution and the theft of tokens.

An attacker can trigger the flaw to grant full control over the app and access to user accounts and sensitive data.

The researchers identified multiple vulnerable applications in the official Google Play Store that count over four billion devices. 

“We identified this vulnerability pattern in the then-current versions of several Android applications published on the Google Play Store, including at least four with more than 500 million installations each. In each case, we responsibly disclosed to the vendor. Two example vulnerable applications that we identified are Xiaomi Inc.’s File Manager (1B+ installs) and WPS Office (500M+ installs).” continues the advisory.

Microsoft notified developers of the affected apps through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR).

The company worked with Xiaomi, Inc. and WPS Office security teams to address the issue. Fixes have been deployed for the affected apps as of February 2024, and users are urged to update their devices and installed applications.

The problem resides in the content provider component, and its ‘FileProvider’ class, of the Android’s data and file sharing system.

“FileProvider, a subclass of ContentProvider, is intended to provide a secure method for an application (“server application”) to share files with another application (“client application”).” reported Google. “However, if the client application does not properly handle the filename provided by the server application, an attacker-controlled server application may be able to implement its own malicious FileProvider to overwrite files in the client application’s app-specific storage.”

The component facilitates file sharing among installed apps, however incorrect implementation of this mechanism can pose significant vulnerabilities.

“The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application’s implementation. Arbitrary code execution can provide a threat actor with full control over an application’s behavior. Meanwhile, token theft can provide a threat actor with access to the user’s accounts and sensitive data.” reads the advisory published by Microsoft.

The issue arises when the receiving application fails to verify the content of the file it receives and relies on the filename provided by the sending application. The receiving application caches the file within its internal data directory opening the door to potential exploitation if the sending application uses a malicious version of FileProvider. In this scenario a malicious app can exploit Dirty Stream to overwrite important files within the receiving application.

“To prevent these issues, when handling file streams sent by other applications, the safest solution is to completely ignore the name returned by the remote file provider when caching the received content. Some of the most robust approaches we encountered use randomly generated names, so even in the case that the content of an incoming stream is malformed, it won’t tamper with the application.” concludes Microsoft.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Android)

In today's rapidly evolving digital landscape, the threat of Distributed Denial of Service (DDoS) attacks looms more significant than ever. As these cyber threats grow in sophistication, understanding and countering them becomes crucial for any business seeking to protect its online presence. To address this urgent need, we are thrilled to announce our upcoming webinar, "Uncovering Contemporary

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of Broadcom, said in a report shared with The Hacker News.