Scammers Leveraging Microsoft Team GIFs In Phishing Attacks.

 

Cybersecurity consultant Bobby Rauch has discovered a new attack tactic in which threat actors exploit Microsoft Team vulnerabilities. According to Rauch, attackers can easily leverage Microsoft Teams GIFs through these vulnerabilities to launch phishing, command execution, and data filtration schemes.

What is GIFShell?

Rauch has named the newly discovered attack technique involving MS Teams GIFs as GIFShell. The technique allows attackers to create a reverse shell to facilitate malicious command delivery via base64-encoded GIFs in MS Teams.

Using a malicious stager executable, the attackers can establish their dedicated MS Teams tenant and start the attack using the GIFShell Python script.

GIFShell installs malware on the device and can sneakily extract data under the guise of harmless GIF images. Rauch noted that the attack entails the exploitation of multiple vulnerabilities in MS Teams to create a chain of command executions.

Furthermore, attackers only need to infiltrate MS Teams and any of the GIFs. Utilizing Microsoft’s web infrastructure, they can unpack commands and install them directly on computers.

Microsoft’s Response

In a blog post, Rauch stated that he notified Microsoft in May 2022. However, Microsoft claims that immediately releasing fixes for the attack is impossible. Moreover, the tech giant stated that the attack techniques “reported” by Rauch don’t meet the requisites for developing an urgent security fix.

Therefore, the best line of defense for you is not to open any GIFs shared by someone on MS Teams.

 

 

WT1SHOP Cybercrime Market Seized by US And Portuguese Authorities.

 

The UD Department of Justice (DoJ) has confirmed that the notorious cybercrime marketplace WT1SHOP has been taken down by the US and Portuguese authorities for its involvement in nefarious activities.

According to the federal criminal complaint against the marketplace, it made millions of dollars by selling PII (personally identifiable information) over the years. This was one of the largest cybercrime marketplaces and offered around 6 million records for sale.

Complaint Details.

According to the complaint filed on 21 April 2022, WT1SHOP was operated by a 36-year-old national of the Republic of Moldova identified as Nicolai Colesnicov. The marketplace offered vendors stolen information including around 1.7 million login credentials like PII, approx. 25,000 scanned passports, driver’s licenses, 108,000 bank accounts, and 21,800 credit cards – Buyers could buy the records using Bitcoin. 

The website had 106,273 registered users and 94 registered sellers as of December 2021. By June 2020, WT1SHOP had sold 2.4 million credentials for $4 million. This included retailers’ and financial institutions’ login credentials, email credentials, PayPal accounts, and ID card details. Moreover, it also sold credentials for remote access and control of computers, network devices, and servers.

Shutting Down of WT1SHOP.

Authorities traced Bitcoin sales on the marketplace, and payments were made to its web host and email IDs. The login information was identified to be linked to Colesnicov. WT1SHOP was seized by Portuguese authorities, and four domains (wt1shop.net, wt1store.cc, wt1store.com, and wt1store.net) were taken down by their counterparts in the USA.

After the website and its domains were seized, the DoJ unsealed the website seizure and criminal complaint. It was announced by the US Attorney for the District of Maryland, Erek L. Barron, and FBI’s Washington Field Office, Criminal Division’s Special Agent in Charge, Wayne Jacobs. 

Colesnicov has been charged with trafficking in unauthorized access devices and conspiracy. He could get a maximum penalty of ten years in federal prison if convicted.

 

 

Samsung Data Breach Exposed Private Data of US Customers.

 

Samsung has announced that it suffered a data breach in July 2022 involving the personal data of US customers. The incident happened in late July this year and was discovered on August 4th, 2022.

According to the South Korean technology giant, the incident resulted in the breach of private user data such as names, dates of birth, product registration data, demographic information, and contact numbers.

Samsun sent out an email alert to its users after a hacker managed to breach the security of the tech giant’s US systems and stole customers’ data.

The company assured that the breach didn’t impact its customers’ credit card numbers and social security data, which was also stored in the system. The company has yet to disclose the number of affected customers but has notified them through an email sent on Friday.

Samsung noted that the breached data may vary according to relevant customers and that none of the consumer devices were hacked by this breach. It also stated that its business operations or customers stayed unaffected.

Nevertheless, the company claims to have implemented necessary measures to prevent similar incidents and offers uninterrupted services to its customers. Samsung has also hired a private cybersecurity and law enforcement agency to investigate the latest incident.

Those impacted in this breach are advised to remain cautious of phishing scams, track their credit profiles, and check Samsung’s privacy policy and FAQs section.

Second Data Breach in 2022

It is currently unclear who perpetrated this attack. But, it is certainly not the first time the tech vendor has suffered a data breach. In fact, Samsung has been a victim of several data breaches in the recent past. In March 2022, the company confirmed suffering a data breach after the Lapsus hackers leaked 189 GB worth of sensitive data online.

 

The Lessons To Learn From Nomad Crypto Hack.

 

In what sounds like a case of gross negligence, Nomad, a new start-up in the cryptocurrency space, lost $190 million in a series of hacks. But in this instance, calling it hacks is being too nice. Usually, hackers require skills and strategies that take time and effort to execute. 

Apparently, in Nomad’s case, the attacks were a “free-for-all” crypto spree where anyone, even people with no prior IT skills, could seize on the platform’s shortcomings and withdraw crypto from its accounts. To make matters worse, the hackers could even withdraw more that was available in the accounts. 

If you’re baffled like we are, grab onto your socks and keep reading to learn more about what might have transpired at Nomad.

What is Nomad Crypto Startup?

Nomad is a crypto wallet or bridge that lets you transfer crypto from one blockchain network to another safely and conveniently. Obviously, not. But crypto bridges work by wrapping tokens on one network to an equivalent amount on another. This might sound complicated, but it’s really not. Think of wrapped tokens as representations of the value of the original token on other platforms. 

Furthermore, Nomad is a blockchain messaging platform that allows players such as developers to share arbitrary data across chains and even make smart contracts. The service makes online collaborations when developing blockchain applications while working from different regions much more convenient.

What Safety Considerations Should You Have When Buying Crypto?

It’s unfortunate, but the world of cryptocurrency is cutthroat in every sense of the word. On the business side, hundreds of currencies exist, and more are joining the market every day, driving up the competition. There are also hundreds of different crypto products at various stages of their development process. Furthermore, we are also only starting to understand the real implications of blockchain technology and cryptocurrencies.

Unfortunately, this has also created the perfect storm for scammers and players with malicious intent to thrive. For instance, in the case of Nomad, even though we still maintain that this is a case of gross negligence, it also reflects the prevalent evils in this space. However, vulnerabilities, where anyone can just walk into a platform and withdraw more than there is, should not exist in the first place. 

The pill is easier to swallow when you hear hackers went on a phishing expedition or discovered a system flaw that moves the industry’s security forward. As such, you should be very keen with any dealings or transactions you make with crypto to avoid being one of the victims. 

One way to protect yourself is to buy crypto with a prepaid card that does not link back to your primary accounts or personal information. This will limit your risk of losing more than is on the prepaid card if you get hacked or compromised somehow. 

You should also only sign on to crypto services like bridges, wallets, exchanges, and currencies on reputable platforms with a proven safety record. As important as first adapters are to the product introduction cycle, we can all agree it’s safer to step back from new ones in the crypto scene. This will ensure you’re not one of the people who lose their investments from hacks like the one witnessed at Nomad.

A problem to Solve

The truth is that stories of people invested in a new crypto venture losing their money are common in the news today, and we have all but grown numb and accustomed to them. But it should not be this way. 

For far too long, hackers and ill-prepared crypto platforms have cost far too many their crypto investments and confidence in the system. And even though, in Nomad’s case, they have attempted to recover the lost funds, we think it’s time authorities take a hard look at the crypto industry and provide ulasting solutions to the problems that plague it.

 

 

Worok Hackers Targeting Orgs, Govts In Asia, Middle East And Africa.

 

ESET telemetry has discovered a new malware campaign targeting local governments and high-profile organizations in Asia, the Middle East, and Africa.

In the recently discovered targeted attacks, undocumented tools are being used by a lesser-known cyberespionage group identified as Worok discovered by ESET researcher Thibaut Passilly.

This group has been active since 2020, when it targeted governments and organizations in multiple countries, including a telecom firm in East Asia, a bank in Central Asia, and a Southeast Asian maritime sector firm.

Worok is primarily targeting organizations in banking, telecommunication, marine, military, energy, public sectors, and government in its current campaign. The group claims to be a cyberespionage collective that develops its own tools and uses existing tools to compromise the target. Its custom toolset in 2021 included:

• CLRoad (a first-stage loader).
• PNGLoad (a second-stage loader).
• A full-featured PowHeartBeat backdoor written in PowerShell.

The backdoor can command and process execution and perform file manipulation. 

Campaign Details

According to ESET’s research, attackers sometimes exploited the infamous ProxyShell vulnerability (CVE-2021-34523) discovered in 2021 to gain initial access. Malware operators are looking to obtain sensitive information from their targets as their focus has been on “high-profile entities in Asia and Africa,” and they have targeted both public and private sector firms. Besides, they are also focusing on government entities.

After gaining initial access, the operators deploy numerous publicly available tools for further infiltration, including EarthWorm, Mimikatz, NBTscan, and ReGeorg. Then they deploy their custom implants, including a first-stage loader followed by a second-stage .NET loader. The researchers could not identify the final payloads.

After observing the Worok group’s activity in 2020, ESET noticed a break between May 2021 and January 2022, and then it resurfaced in February 2020, during which it targeted an energy firm in Central Asia and a public sector organization in Southeast Asia.

Twitter Confirms Data Breach as 5.4M Accounts Sold On Hacker Forum.

 

Twitter was forced to investigate the incident when a hacker offered the personal details of 5.4 million Twitter users on a hacker forum for $30,000 last month.

On Friday, Twitter confirmed that a threat actor exploited a vulnerability that risked user privacy on the platform. The company revealed that this breach had a “global impact,” and it is yet unclear exactly how many Twitter accounts got impacted.

Details of the Breach.

According to Twitter’s press blog, the vulnerability was exploited to match private data with pseudonymous Twitter accounts. Reportedly, the vulnerability lets a bad actor match phone numbers or email IDs to any Twitter account linked to that information and identify the user.

A Twitter spokesperson explained that passwords weren’t compromised in this breach that occurred in January 2022.

It is worth noting that around two weeks back, a hacker named “Devil” was offering email IDs and phone numbers linked to the impacted accounts on a hacker forum which surfaced as an alternative to popular and now-sized Raidforums. The hacker was selling the data for no less than $30,000. 

The post was connected to a vulnerability in Twitter, which was discovered in January 2022 by a security researcher. The flaw was discovered via HackerOne’s bug bounty platform used by Twitter. Twitter paid HackerOne bug bounty worth $5,040 for the issue.

The bug that caused the breach originated from an update to Twitter’s code in June 2021 and was fixed quickly, said Twitter.

On the other hand, according to the hacker, the impacted accounts were of “celebrities, OGs, and companies, among others.” On 22 July 2022, Twitter announced to investigate the information posted by Devil.

On Friday, it confirmed that the data was legitimate and was stolen by exploiting the same bug that was fixed. 

The Nation-State Hacker Connection.

The social media giant urges users to avoid adding information like a publicly known email ID or contact number to their Twitter accounts if they want to protect their identity from nation-state actors and other hackers. 

Twitter further added that people with anonymous accounts could be easy targets for state-backed hackers. The data could be valuable for countries like China, Russia, North Korea, Iran, or Saudi Arabia as state actors are always looking for private accounts and often employ social engineering to reveal personal information.

Affected users will be notified accordingly. The company has decided to publish the update as it cannot confirm every account impacted by this breach. Although passwords weren’t exposed, the company asked users to enable 2FA and other security measures. It is, however, unclear if the hacker sold the data or not.

 

 

 

LockBit Ransomware Gang Blames Victim For DDoS Attack On Its Website.

 

LockBit Ransomware Gang claims its leak site was hit by a massive DDoS attack allegedly carried out by security company Entrust.

The LockBit ransomware gang’s data leak website has been taken offline through a DDoS attack (distributed denial of service attack). The attack seems to respond to the group’s exposure of data stolen from security firm Entrust.

Entrust Breach Details.

Security firm Entrust was targeted in a cyberattack on 18 June 2022. The firm notified its customers regarding the data breach on July 6th. The intrusion was publicly disclosed on 21 July after a security researcher accessed a copy of the company’s data breach notification sent to its customers. A ransomware attack was suspected of targeting Entrust, but the operators weren’t named.

On August 18th, the LockBit ransomware gang took responsibility for Entrust data breach. It threatened the firm to leak the entire trove of data, approximately 30GB if the company refused to pay the ransom within 24 hours.

Per researcher Soufiane Tahiri, who accessed a copy of the communication between the LockBit gang and Entrust, the attackers initially demanded $8 million in ransom. They later reduced it to $6.8 million, while Entrust claimed it could only pay $1 million.

DDoS Attack Details.

As soon as LockBit ransomware operators started publishing data stolen from Entrust, their Tor-based leak site received a DDoS attack. Cisco Talos researcher Azim Shukuhi revealed that the LockBit group claimed to receive 400 requests per second from over 1,000 servers.

The requests included a string forcing the ransomware operators to delete the data. It is currently unclear who launched this DDoS attack. Their website (LockBit 3.0) is currently offline.

According to LockBit, Entrust is responsible for DDoSing its website, but the company is least likely to admit it even if it is actually involved because of being a legit cybersecurity-oriented firm. It could also be the work of a rival ransomware group that wanted to target LockBit operators and blame Entrust.

LockBit Operators Hit Back After Website Taken Offline.

The gang has vowed to employ aggressive tactics in retaliation to a DDoS attack on its website. In a tweet, the group claimed it would attack its targets with a triple extortion model instead of their previously preferred double extortion model. The group announced that it is recruiting new members as part of its modified strategy.

For your information, triple extortion is a recently devised method to target victims. This technique was recently used in attacks by the REvil group. This method adds an additional layer of threat, such as a DDoS attack against the victim to force them to pay. 

Conversely, in the double extortion technique, hackers steal data and encrypt it on their targeted device before asking for ransom. Additionally, LockBit will start including randomized payment links in its ransom notes to make it difficult for countering tactics like DDoS to affect their payment site.