Fake Emails Sent From FBI Address via Compromised Law Enforcement Portal

Thousands of fake emails coming from an FBI email address were sent out on Friday by someone who exploited a vulnerability in a law enforcement portal. The FBI has confirmed the breach, but said impact was limited.

Threat intelligence organization Spamhaus reported seeing more than 100,000 fake emails being sent out in two waves.

Spamhaus warning

The hoax emails, coming from “[email protected],” carried the subject line “Urgent: Threat actor in systems.” The message appeared to come from the DHS and it informed recipients about “exfiltration of several of your virtualized clusters in a sophisticated chain attack.”

Fake FBI email

The emails claimed the threat actor was identified as Vinny Troia. Troia is a security researcher who claims to have been targeted numerous times by some hackers for exposing them.

Troia on Twitter said he suspected an individual who uses the online moniker “pompompur_in” was behind the attack. He said the individual is associated with a cybercrime group named The Dark Overlord, whose alleged members were exposed in a report published last year by Troia’s company, NightLion Security.

Indeed, an individual with the online nickname pompompurin contacted security blogger Brian Krebs shortly after the fake FBI emails were sent out, taking credit for the attack.

In a statement issued on Sunday, the FBI said the emails were sent out by someone who leveraged a “software misconfiguration” affecting the Law Enforcement Enterprise Portal (LEEP), which is used by the agency to communicate with state and local law enforcement partners.

“While the illegitimate email originated from an FBI operated server, that server was dedicated to pushing notifications for LEEP and was not part of the FBI’s corporate email service,” the FBI stated. “No actor was able to access or compromise any data or PII on the FBI’s network. Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks.”

Pompompurin told Krebs that they exploited a vulnerability in the LEEP portal account registration process to be able to send out emails from the fbi.gov email address.

Specifically, the registration process involves sending a one-time passcode to the email address of the user who creates an account on the LEEP portal. Pompompurin discovered — or learned from someone else — that this one-time passcode was generated on the client side and included in a POST request. The same request also included parameters for the subject and body content of an email coming from eims(at)ic.fbi.gov, which the hacker replaced with their own subject and content.

The hacker created a script that automated the process, enabling them to send out thousands of fake emails.

The FBI says it has taken steps to prevent exploitation of the weakness leveraged in this attack.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

https://www.securityweek.com/fake-emails-sent-fbi-address-compromised-law-enforcement-portal

HPE Says Customer Data Compromised in Aruba Data Breach

Hewlett Packard Enterprise (HPE) has confirmed that a small amount of customer data was compromised in a data breach involving its subsidiary Aruba Networks.

The incident, HPE says, was discovered on November 2, and involved the use of an access key to gain unauthorized access to “a limited subset of information held in the Aruba Central cloud environment.”

Two data repositories were compromised in the incident, one containing network telemetry data on Wi-Fi client devices connected to most Aruba Central customer networks, and another storing location data about Wi-Fi devices, such as details on devices being in proximity of other devices.

Some of the compromised information, HPE explains, includes Media Access Control (MAC) and IP addresses, device operating system details, hostnames, and usernames where authentication is used. Additionally, records of date, time, and the Wi-Fi access point a device was connected to were also stored in the affected repositories.

“The environment did not include any sensitive or special categories of personal data (as defined by GDPR),” the company says.

HPE believes that “a very small amount” of data was exfiltrated, but also notes that it couldn’t specifically identify which customers were impacted by the incident, because the data repositories “are used for streaming of high-volume machine learning data” and no individual file access is logged within these repositories.

“Through traffic volume accounting, we have concluded that unauthorized access, if any, is limited to a small fraction of overall data, but we do not know which specific files or which specific customers might be part of that activity,” the company continues.

Although the data was stored in Apache Parquet format and not in plain text, the adversary was also in the possession of the schema file that allowed them to convert records to plain text.

HPE also explains that the attacker compromised the repositories using a key that provided access to data in multiple buckets, located in various regions, and that data in these buckets is purged every 30 days, meaning that the oldest records there were dated September 10.

The access key employed in this incident was first used on October 9 and automatically decommissioned and rotated on October 27, meaning that the adversary potentially had access to the compromised repositories for 18 days.

Only data collected from Wi-Fi networks was affected in the incident and no vulnerability was exploited in the attack, as the adversary did not access the repositories through the Aruba Central application.

HPE says it’s in the process of notifying potentially affected customers of the incident.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/hpe-says-customer-data-compromised-aruba-data-breach

BlackMatter Ransomware Gang Announces Shutdown

The cybercriminals behind the BlackMatter Ransomware-as-a-Service (RaaS) operation this week announced plans to close shop.

Active since July 2021, BlackMatter is the product of the Coreid cybercrime group, which also operated the DarkSide ransomware. BlackMatter’s use in assaults on critical infrastructure entities in the United States has resulted in the U.S. government recently issuing an alert on the RaaS operation.

On Monday, the BlackMatter operators posted on their RaaS website a message announcing that the entire operation would be shutting down within 48 hours.

In their message, the miscreants mention increased pressure from the authorities and say that part of the team is no longer available “after the latest news,” most likely a reference to last week’s wave of arrests in Europe.

A total of 12 suspects were arrested, most of them being considered high-value targets due to their involvement in multiple high-profile cases, Europol said.

Despite operating for only four months, BlackMatter emerged as one of the most prolific ransomware operations out there, with more than 50 businesses being hit to date.

At an average ransom demand of $5.3 million, the attackers could have made hundreds of millions from the operation, but the total amount is yet unknown. In September, the cybercriminals demanded $5.9 million from Iowa-based New Cooperative.

The highest ransom demand made by the BlackMatter gang was of $30 million, requested from Japan’s Olympus Corporation, Singapore-based cybersecurity firm Group-IB says.

BlackMatter ransomware

The estimates are based on the negotiation chats the cybercriminals had with their victims. Responding to a SecurityWeek inquiry, Group-IB didn’t make an estimate as to how much the BlackMatter gang might have made from the operation.

“The identified cryptocurrency wallets had no transactions as they were related to the victims who refused to pay the ransom and whose data was published on the gang’s DLS. The number of victims who actually paid the ransom as well as the gang’s earnings are unknown,” Oleg Skulkin, head of DFIR Lab at Group-IB, said.

More than half (52%) of the organizations hit by BlackMatter are from the U.S., with others located in Austria (11%), Italy (7%) and France (7%), as well as eight other countries. The production sector was affected the most, Group-IB says.

Both Windows and Linux versions of the BlackMatter ransomware were observed and earlier this week security researchers warned that the group had developed a custom data exfiltration tool to accelerate their attacks. The stolen data was being used to pressure victims into paying the ransom.

Despite the shutdown announcement, however, security researchers believe that the gang won’t retire completely. In fact, several security experts have told SecurityWeek that BlackMatter will likely return under a different name, just as DarkSide did.

They also warn that some of the group’s members might join active RaaS operations out there and encourage organizations to strengthen their defenses against ransomware and other malicious attacks.

“This is highly unlikely to be the end of the threat actors behind the BlackMatter group and this looks like a classic rebrand or splintering. Organisations must recognise this threat and invest in their cybersecurity and help to alleviate the risk of ransomware,” Carl Wearn, head of e-crime at Mimecast, said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/MVALUM8zee0/blackmatter-ransomware-gang-announces-shutdown

Massachusetts Health Network Hacked; Patient Info Exposed

A Worcester, Mass. health care network says someone hacked into its employee email system, potentially exposing the personal information of thousands of patients.

UMass Memorial Health notified patients earlier this month if their information was involved in the breach, which occurred between June 2020 and January. The personal data included Social Security numbers, insurance information and medical information, The Telegram & Gazette reported Thursday.

More than 200,000 patients and health plan participants could have been affected by the breach, according to a federal database of cybersecurity incidents at medical facilities.

The hospital says it has investigated the incident but couldn’t determine how much of the personal information may have been stolen.

Affected patients will receive free credit monitoring and data protection assistance.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/YU9uxRmCLa4/massachusetts-health-network-hacked-patient-info-exposed

Russian Man Extradited to U.S. for Role in TrickBot Malware Development

A Russian national has been extradited from South Korea to the United States to face charges for his alleged role in the cybercriminal organization behind the TrickBot malware.

The man, Vladimir Dunaev, 38, allegedly was part of the TrickBot group from November 2015 through August 2020, stealing money and information and damaging the computers of financial institutions, school districts, government entities, private businesses, and utility companies, court documents reveal.

The TrickBot group allegedly used “a network of co-conspirators and freelance computer programmers” to develop, deliver, and maintain TrickBot. Millions of computers globally have been infected with the Trojan, the indictment claims.

According to the U.S. Justice Department, Dunaev worked as a developer for the cybercrime group in various roles, such as supervising the malware execution, building browser modifications, and helping with hiding the malware from security software.

TrickBot was created to capture online banking credentials and other sensitive information, such as credit card numbers, dates of birth, emails, passwords, social security numbers, and more. More recent versions of the malware were designed to help distribute ransomware.

The indictment alleges that the TrickBot operators used the stolen credentials and other personal data to access victims’ online bank accounts, make unauthorized transfers, and to launder money.

Dunaev is charged with aggravated identity theft, wire fraud, bank fraud, conspiracy to commit computer fraud, and money laundering, among others. If convicted on all counts, he faces up to 60 years in prison.

TrickBot, which has been around since 2016, is believed to be operated by the same cybercriminal organization that operated the Dyre Trojan.

In October 2020, Microsoft announced an operation aimed at taking down TrickBot, but the malware managed to survive the attempt and even received several updates after. In March, CISA and the FBI warned of continuous attacks employing TrickBot.

In June, U.S. authorities announced charges against a Latvian woman who allegedly also helped develop TrickBot.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/pt1G2wRPn3Y/russian-man-extradited-us-role-trickbot-malware-development

12 People Arrested Over Ransomware Attacks on Critical Infrastructure

Europol and Norwegian Police on Friday announced the arrests of 12 individuals suspected of being involved in ransomware attacks launched against companies around the world, including critical infrastructure organizations.

According to Europol, the suspects played various roles in ransomware attacks that impacted more than 1,800 victims across 71 countries, including many major corporations that suffered significant disruptions due to the attacks.

The law enforcement operation targeting the 12 suspects was carried out on October 26 in Ukraine and Switzerland, and it resulted in the seizure of cash, luxury vehicles and electronic devices.

“Most of these suspects are considered high-value targets because they are being investigated in multiple high-profile cases in different jurisdictions,” Europol said.

Each of the alleged cybercriminals played a different role. Some of them were in charge of breaching an organization’s systems using brute-force attacks, SQL injections, phishing emails and stolen credentials. Others focused on lateral movement and deployment of malware such as Trickbot or post-exploitation frameworks such as PowerShell Empire and Cobalt Strike. Some of the suspects were allegedly in charge of laundering ransom payments.

The malicious hackers used various ransomware families, including LockerGoga, MegaCortex and Dharma.

Norwegian Police said one of the victims of these threat actors was Norwegian metals and energy giant Norsk Hydro, which lost tens of millions of dollars following an attack in 2019.

Just before Europol announced the arrests, the U.S. Department of Justice revealed that a Russian national who was allegedly part of a cybercrime group that used the Trickbot malware had been extradited from South Korea to the United States. This was the second Trickbot-related arrest in recent months as part of an operation conducted by the DoJ’s Ransomware and Digital Extortion Task Force.

The Trickbot suspect, 38-year-old Vladimir Dunaev, faces up to 60 years in prison for his role in the cybercrime operation.

Earlier this month, Europol announced the arrests of two alleged members of a prolific ransomware group in Ukraine. The ransomware was not named at the time due to what the police agency described as “an operational reason.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/lNcRfzrW8vg/12-people-arrested-over-ransomware-attacks-critical-infrastructure

Ransomware Attack Hits PNG Finance Ministry

A cyberattack on Papua New Guinea’s finance ministry briefly disrupted government payments and operations, officials said late Thursday.

Ransomware infiltrated and compromised a core server at the department of finance last week, hampering the government’s access to foreign aid, its ability to pay cheques and carry out other basic functions in the midst of a spiralling Covid-19 surge.

“The department has now managed to fully restore the system, however, because of the risk, we are playing safe by not allowing full usage of the affected network,” said John Pundari, acting treasurer.

Pundari said the department “did not pay any ransom to the purported hacker or any of its third party agents. We have managed to restore normalcy.”

The attack took place in the middle of the night on October 22.

The platform controls budgeting and financing for the entire Papua New Guinea government.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/ebZeBtN0_Iw/ransomware-attack-hits-png-finance-ministry

Chrome 95 Update Patches Exploited Zero-Days, Flaws Disclosed at Tianfu Cup

A Chrome 95 update released by Google on Thursday patches two actively exploited Chrome vulnerabilities, as well as flaws that were disclosed recently at a Chinese hacking contest.

The actively exploited vulnerabilities are tracked as CVE-2021-38000, which has been described as an insufficient validation of untrusted input in Intents, and CVE-2021-38003, an inappropriate implementation issue affecting the V8 JavaScript engine. CVE-2021-38000 was discovered in September and CVE-2021-38003 was identified just three days ago.

Google employees have been credited for both zero-day vulnerabilities. No information has been made available regarding the attacks in which these vulnerabilities have been exploited.

More than a dozen Chrome vulnerabilities discovered this year have been exploited in the wild, according to data from Google’s Project Zero group.

The latest Chrome 95 update includes eight security fixes, including at least seven classified as high severity. Wei Yuan of MoyunSec VLab earned $10,000 for a use-after-free bug, and while that is the highest bounty awarded by Google, two of the CVEs patched this week earned two research teams a total of $300,000 at the Tianfu Cup hacking contest that took place recently in China.

The Kunlun Lab and 360 Alpha Lab teams each earned $150,000 for Chrome exploit chains that achieved remote code execution with a sandbox escape. The rewards were paid out by the organizers of Tianfu Cup — Google does not pay out separate rewards for vulnerabilities disclosed at hacking competitions such as Tianfu Cup and Pwn2Own.

SecurityWeek has learned that the Kunlun Lab exploit also involved a Windows kernel bug that has yet to be patched.

At the Tianfu Cup, participants earned a total of $1.9 million for demonstrating exploits targeting Windows 10, Ubuntu, iOS 15 on iPhone 13 Pro, Microsoft Exchange, Chrome, Safari, Adobe Reader, Parallels Desktop, QEMU, Docker, VMware ESXi and Workstation, and ASUS routers.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/dCutI0Cf03M/chrome-95-update-patches-exploited-zero-days-flaws-disclosed-tianfu-cup

After Nation-State Hackers, Cybercriminals Also Add Sliver Pentest Tool to Arsenal

The cybercriminal group tracked as TA551 recently showed a significant change in tactics with the addition of the open-source pentest tool Sliver to its arsenal, according to cybersecurity firm Proofpoint.

Also referred to as Shathak, TA551 is an initial access broker known for the distribution of malware through thread hijacking – a technique where the adversary gains access to compromised email accounts or stolen messages to make contact with its victims.

Previously, the cybercrime group was observed delivering malware such as Emotet, IcedID, Qbot, and Ursnif, as well as providing ransomware operators with access to the compromised systems.

Earlier this week, Proofpoint noticed that the adversary started sending out emails that pretended to be replies to previous conversations and which contained as attachments password-protected, archived Word documents.

These attachments, Proofpoint says, ultimately led to the deployment of the Sliver framework, an open-source red teaming tool for adversary simulation. The tool, developed by offensive security assessment firm Bishop Fox, provides command and control (C&C) functionality, process injection and information harvesting capabilities, and more, and is available for free.

According to Brad Duncan, security researcher and handler at the SANS Institute’s Internet Storm Center, just as Proofpoint raised the alarm on TA551’s shift in tactics, Sliver-based malware started being delivered as part of a malicious email campaign he has been tracking for months.

Named “Stolen Images Evidence”, the campaign employs emails generated via contact form submissions on various websites, “describing a copyright violation to the intended victim,” Duncan explains. A Google-based URL included in the message body claims to offer proof of stolen images leading to that violation.

A zip archive that contains a JavaScript file is delivered to the victim’s web browser, aiming to deliver malware such as BazarLoader, Gozi/ISFB/Ursnif, and IcedID (Bokbot). Starting Wednesday, October 20, Sliver-based malware is being employed, Duncan says.

The adoption of Sliver by cybercriminals comes just a few months after government agencies in the U.S. and the U.K. warned that Russian state-sponsored cyberspy group APT29 (aka the Dukes, Cozy Bear and Yttrium) added the pentest framework to their arsenal.

The move, however, is not surprising, as security researchers have long warned of the blurred line between nation-state and cybercriminal activities, with each side adopting tactics from the other, to better hide their tracks, or engaging in both types of operations.

According to Proofpoint, the use of red teaming tools among cybercriminals is becoming increasingly popular, with Cobalt Strike registering a 161% surge in threat actor use between 2019 and 2020. Cybercriminals are also using offensive frameworks such as Lemon Tree and Veil.

“TA551’s use of Sliver demonstrates considerable actor flexibility. […] With Sliver, TA551 actors can gain direct access and interact with victims immediately, with more direct capabilities for execution, persistence, and lateral movement. This potentially removes the reliance on secondary access,” Proofpoint notes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/f8rx4fWUAtk/after-nation-state-hackers-cybercriminals-also-add-sliver-pentest-tool-arsenal

Cookie Theft Malware Used to Hijack YouTube Accounts

Google says it has disrupted phishing attacks in which threat actors were attempting to use cookie theft malware to hijack YouTube accounts and abuse them to promote cryptocurrency scams.

As part of these campaigns, which have been ongoing since 2019, hackers recruited on a Russian-speaking forum targeted thousands with phishing emails that promised fake collaboration opportunities.

The scammers sent their phishing messages to the email addresses that YouTube channel owners make public for business purposes, Google explains.

After gaining the target’s trust, the hackers would send a URL, either via email or a PDF on Google Drive, promising legitimate software but which instead took the victim to a malware landing page.

Once executed, the malware steals cookies from the victim’s browser using a smash-and-grab technique. The attackers then use the cookies to hijack the victim’s session and take over their account, which is either sold on the dark web (for between $3 and $4,000, depending on the number of subscribers), or repurposed for cryptocurrency scams.

Malware used in these attacks included Azorult, Grand Stealer, Kantal, Masad, Nexus stealer, Predator The Thief, RedLine, Raccoon, Vikro Stealer, and Vidar, alongside open source tools such as Sorano and AdamantiumThief. The malware could steal both passwords and cookies.

In furtherance of their scheme, the adversaries registered roughly 15,000 accounts, as well as domains associated with fake companies, and more than 1,000 websites that were used to deliver malware.

Google says that its action against this malicious activity has included blocking 1.6 million messages the attackers sent to their victims. The Internet search giant also displayed roughly 62,000 Safe Browsing warnings for the identified phishing pages, blocked 2,400 files, and restored roughly 4,000 impacted accounts.

“With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com). Moreover, to protect our users, we have referred the below activity to the FBI for further investigation,” Google says.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/JjBIqS3BLPs/cookie-theft-malware-used-hijack-youtube-accounts