Russian hackers stole Microsoft corporate emails in month-long breach

Microsoft disclosed Friday night that some of its corporate email accounts were breached and data stolen by the Russian state-sponsored hacking group Midnight Blizzard.

Link

Watch out for "I can't believe he is gone" Facebook phishing posts

A widespread #Facebook #Phishing campaign stating, "I can't believe he is gone. I'm gonna miss him so much," leads unsuspecting users to a website that steals your Facebook credentials.

Link

 Tesla hacked, 24 zero-days demoed at Pwn2Own Automotive 2024

Security researchers hacked a #Tesla Modem and collected awards of $722,500 on the first day of Pwn2Own Automotive 2024 for three bug collisions and 24 unique zero-day exploits.

Link

 iPhone apps abuse iOS push notifications to collect user data

Numerous #iOS apps are using background processes triggered by push notifications to collect user data about devices, potentially allowing the creation of fingerprinting profiles used for tracking.

Link

 Ransomware payments drop to record low as victims refuse to pay

The number of ransomware victims paying ransom demands has dropped to a record low of 29% in the final quarter of 2023, according to ransomware negotiation firm Coveware.

Link

Cyberattack Hits Georgia County Where Trump Is Charged

🔘 Outage halted some transactions, disrupted tax services
🔘 Former president #DonaldTrump is charged with election interference

Link

Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider

On Jan. 9, 2024, U.S. authorities arrested a 19-year-old Florida man charged with wire fraud, aggravated identity theft, and conspiring with others to use SIM-swapping to steal cryptocurrency. Sources close to the investigation say the accused was a key member of a criminal hacking group blamed for a string of cyber intrusions at major U.S. technology companies during the summer of 2022.

Link

Microsoft Teams phishing pushes DarkGate malware via group chats

New phishing attacks abuse #Microsoft Teams group chat requests to push malicious attachments that install DarkGate malware payloads on victims' systems.

Link

China's hackers are preparing to 'wreak havoc' and 'cause real world harm' to Americans: FBI director

#China's hackers are preparing to "wreak havoc" and "cause real-world harm" to Americans, #FBI Director Christopher Wray will warn in congressional testimony submitted on Wednesday.

Director Wray, along with U.S. Cyber Command Cmdr. Gen. Paul Nakasone, Department of Homeland Security Cybersecurity and Infrastructure Security Agency Director Jen Easterly and Harry Coker, the director of the National Cyber Director office, will be testifying in front of the House Select Committee on the Chinese Communist party.

Wray says in selected testimony released by the FBI ahead of the hearing:

There has been far too little public focus on the fact that PRC hackers are targeting our critical infrastructure -- our water treatment plants, our electrical grid, our oil and natural gas pipelines, our transportation systems. And the risk that poses to every American requires our attention -- now

Cloudflare hacked using auth tokens stolen in Okta attack

#Cloudflare disclosed today that its internal #Atlassian server was breached by a suspected 'nation state attacker' who accessed its Confluence wiki, Jira bug database, and Bitbucket source code management system.

The threat actor first gained access to Cloudflare's self-hosted Atlassian server on November 14 and then accessed the company's Confluence and Jira systems following a reconnaissance stage.

Cloudflare CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas said:

They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil

Link

Is AnyDesk Compromise?

Recent unscheduled maintenance by #AnyDesk, which included a 48-hour downtime window, has prompted the company to rotate its code signing certificate. Users have been advised to update their AnyDesk instances as a result.

This action, although a standard security practice, has led to speculations in the cybersecurity community about a possible breach. The details of these speculations are still unclear, but concerns have been raised regarding the use of AnyDesk, particularly in sensitive or critical infrastructure environments. According to online discussions, there is an unofficial suggestion to exercise caution with AnyDesk, especially where it has been used in crucial operational environments. Users are advised to monitor systems where AnyDesk was active during January 2024 closely and to conduct malware scans if necessary.

In light of the potential security concerns, it is prudent for users to update their AnyDesk software to the latest version, which includes the updated code signing certificate. Keeping software up to date is a key step in protecting against known vulnerabilities and ensuring the integrity of remote access tools. Users should also remain vigilant and stay informed on any official statements or updates from AnyDesk regarding these events.

 AnyDesk says hackers breached its production servers, reset passwords

AnyDesk confirmed today that it suffered a recent cyberattack that allowed hackers to gain access to the company's production systems. @InformationTechnologySecurity was first to report this.

Read more

Fake LastPass password manager spotted on Apple’s App Store

#LastPass is warning that a fake copy of its app is being distributed on the #Apple App Store, likely used as a phishing app to steal users' credentials.

Link

Security Alert

A high-priority security advisory was published by #ConnectWise for all on-premise partners using ScreenConnect (versions 23.9.7 and prior). Critical vulnerabilities were identified on February 13, 2024, and there are urgent remediation steps you need to take.

Summary of the Issue: Two critical vulnerabilities have been reported:
• CWE-288: An authentication bypass issue.
• CWE-22: A path traversal flaw.

Both pose severe risks, with the authentication bypass being rated at a maximum severity score of 10, and the path traversal at 8.4.

Affected Versions:
• ScreenConnect 23.9.7 and earlier.

Immediate Remediation Steps:
• For Cloud Users: No action needed. The hosted services on “screenconnect.com” and “hostedrmm.com” are already updated.
• For On-Premise Users: Update immediately to ScreenConnect version 23.9.8 to apply the necessary patch.

While updated versions for releases from 22.4 through 23.9.7 addressing this issue will be provided, it is strongly recommended to update to version 23.9.8 for the most complete solution.

Action Required:
Please follow the upgrade instructions detailed in the Upgrade an on-premise installation documentation. You can download the patch directly from the ConnectWise ScreenConnect Download page.

Why Is This Urgent?
These vulnerabilities could allow unauthorized remote code execution or access to confidential data. They are considered critical and have a high chance of being exploited.
Please prioritize this update to protect your systems and data.

Stay safe!

https://t.me/InformationTechnologySecurity

ScreenConnect servers hacked in LockBit ransomware attacks

Attackers are exploiting a maximum severity authentication bypass vulnerability to breach unpatched #ScreenConnect servers and deploy #LockBit ransomware payloads on compromised networks.

The maximum severity CVE-2024-1709 auth bypass flaw has been under active exploitation since Tuesday, one day after ConnectWise released security updates and several cybersecurity companies published proof-of-concept exploits. ConnectWise also patched the CVE-2024-1708 high-severity path traversal vulnerability, which can only be abused by threat actors with high privileges. Both security bugs impact all ScreenConnect versions, prompting the company on Wednesday to remove all license restrictions so customers with expired licenses can upgrade to the latest software version and secure their servers from attacks. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog today, ordering U.S. federal agencies to secure their servers within one week by February 29. CVE-2024-1709 is now widely exploited in the wild, according to security threat monitoring platform Shadowserver, with 643 IPs currently targeting vulnerable servers.

Image: Shodan currently tracks over 8,659 ScreenConnect servers, with only 980 running the ScreenConnect 23.9.8 patched version.

White House urges developers to switch to memory-safe programming languages

Hijacked subdomains of major brands used in massive spam campaign

A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.

The campaign is called "SubdoMailing, as the threat actors hijack abandoned subdomains and domains belonging to well-known companies to send their malicious emails.

As these domains belong to trusted companies, they gain the benefit of being able to bypass spam filters and, in some cases, take advantage of configured SPF and DKIM email policies that tell secure email gateways that the emails are legitimate and not spam.

Some notable brands that fell victim to this domain hijacking campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay.

#SubdoMailing

FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks

Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks.

Link

Pharmaceutical giant Cencora says data was stolen in a cyberattack

The Company had $262.2 billion in revenue for fiscal year 2023 and employs approximately 46,000 people. In a Form 8-K filing with the SEC, Cencora disclosed they suffered a cyberattack that led to data theft. "On February 21, 2024, Cencora, Inc. (the "Company"), learned that data from its information systems had been exfiltrated, some of which may contain personal information," reads the SEC filing.

Link

Rhysida ransomware wants $3.6 million for children’s stolen data

The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month. Lurie is a leading pediatric acute care institution in the U.S. that provides care to over 200,000 children annually.

The cyberattack forced the healthcare provider to take its IT systems offline and postpone medical care in some cases. Email, phone, access to MyChart, and on-premises internet were all impacted. Ultrasound and CT scan results were rendered unavailable, patient service prioritization systems were taken down, and doctors were forced to switch to pen and paper for prescriptions.

Link

Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094

We've obtained intelligence about an ongoing supply chain attack affecting XZ Utils versions 5.6.0 and 5.6.1. This activity has been assigned CVE-2024-3094. XZ Utils is a data compression software that may be included in Linux distributions. The malicious code could potentially allow unauthorized access to impacted systems.

We recommend downgrading XZ Utils to an uncompromised version, such as XZ Utils 5.4.6 Stable.


https://t.me/InformationTechnologySecurity