Cyber Briefing: 2024.06.07. 👉 What are the latest cybersecurity… | by CyberMaterial | Jun, 2024

First time seeing this? Please subscribe.

1. Commando Cat Hijacks Docker for Cryptomining

The threat actor known as Commando Cat has been identified in an ongoing cryptojacking campaign targeting poorly secured Docker instances. Researchers from Trend Micro, Sunil Bharti and Shubham Singh, revealed that the attackers use a Docker image container named cmd.cat/chattr, which retrieves the malicious payload from their command-and-control (C&C) infrastructure. This Docker image is then used to instantiate a container, allowing the attackers to break out of its confines using the chroot command and gain access to the host operating system.

2. Chinese Hackers Exploit ThinkPHP with Dama

Chinese threat actors are exploiting old vulnerabilities in ThinkPHP applications to install a persistent web shell named Dama. This web shell allows for extensive exploitation of breached systems, enabling remote control and further malicious activities. The campaign, first detected in October 2023, has recently intensified, targeting even non-ThinkPHP systems opportunistically.

3. EmailGPT Vulnerability Exposes Data

A critical flaw in EmailGPT (CVE-2024–5184) enables prompt injection, allowing attackers to manipulate the AI service, potentially compromising sensitive data. By exploiting the API service, malicious actors gain control over the logic of the system, paving the way for various forms of exploitation. This vulnerability poses profound implications, from data breaches to denial-of-service attacks, highlighting the urgency for remedial action.

4. SickSync Targets Ukraine’s Defense

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning regarding a series of cyber attacks directed at the country’s defense forces. These attacks are part of an espionage campaign known as SickSync, involving the deployment of a sophisticated malware called SPECTR. The agency has attributed these attacks to a threat actor identified as UAC-0020, also known as Vermin, believed to have ties with security agencies of the Luhansk People’s Republic (LPR).

5. Finesse Vulnerabilities Enable XSS Attacks

Cisco has identified vulnerabilities within its Finesse platform that expose users to the risk of stored cross-site scripting (XSS) attacks. These vulnerabilities, designated CVE-2024–20404 and CVE-2024–20405, allow attackers to inject malicious scripts into web pages accessed through the Cisco Finesse web interface. The exploitation of these vulnerabilities could lead to unauthorized access, data theft, or manipulation of sensitive information.

6. GitHub Attackers Wipe Repositories

Attackers are wiping GitHub repositories and instructing victims to contact them on Telegram for further information. The campaign, discovered by security researcher Germán Fernández, likely involves compromising GitHub accounts with stolen credentials. The attackers claim to have stolen the victims’ data, offering a backup in exchange for contact on Telegram.

7. EU Voting Begins Amid Dutch Cyber Attacks

Cloudflare detects DDoS attacks targeting Dutch political websites during the 2024 European Parliament election. These attacks coincide with the absence of the UK in the first European election post-Brexit. HackNeT, a pro-Russian hacker group, claims responsibility for targeting political party websites in the Netherlands.

8. Panorama Eyecare Data Breach Update

Panorama Eyecare, a physician-led management services organization in Fort Collins, CO, has disclosed a significant data breach affecting 377,911 individuals, a year following a ransomware attack. The breach, attributed to the LockBit ransomware group, compromised sensitive data, including names, Social Security numbers, dates of birth, driver’s license numbers/state IDs, financial account information, dates of service, and medical provider names.

9. Disney Server Breach Exposes Secrets

Threat actors infiltrated Disney’s servers seeking old Club Penguin data but made off with 2.5 GB of current internal information, including details on Disney+ and corporate strategies. Despite Disney’s silence, leaked documents expose tools like Helios and Communicore, potentially jeopardizing the company’s security. The breach highlights ongoing frustration among Club Penguin fans after its closure in 2017.

10. Data Breach at Bimbo Bakeries

On February 13, 2024, Bimbo Bakeries discovered unauthorized access to its network, including servers containing personal information. While names, Social Security numbers, and dates of birth were compromised, financial and credit card data remained secure. Bimbo Bakeries swiftly blocked access, initiated investigations, and engaged cybersecurity experts to mitigate the breach and safeguard affected individuals’ information.

11. US Seeks $5.3M Recovery from Scam

A civil forfeiture action aims to recoup $5.3 million lost in a Massachusetts workers union BEC scam. Cybercriminals impersonated a trusted investment consulting firm via spoofed email, directing the union to transfer funds. Authorities traced $5.3 million to seized bank accounts, part of a larger effort to combat BEC fraud nationwide.

12. Interpol-FBI Foil Red Notice Plot

Interpol and FBI joined forces, detaining four in Moldova, disrupting a scheme targeting Red Notices, crucial for global law enforcement. The operation exposed an intricate network spanning Russia, Ukraine, and Belarus, aiming to undermine international justice through bribes and corruption. Interpol vows to safeguard its systems against further misuse, emphasizing the ongoing fight against global corruption.

13. Microsoft Enhances NTLM Security

Microsoft announces the gradual retirement of all NTLM versions to bolster Windows security against evolving threats. Developers are advised to replace NTLM calls with Negotiate, a security package primarily utilizing Kerberos for enhanced protection. System administrators should conduct thorough audits and plan for a smooth transition to Negotiate, ensuring compatibility with future Windows updates.

14. Bank Data Breach Settlement Finalized

Guardian Analytics and Webster Bank settle $1.4M data breach lawsuit, addressing inadequate data protection. The breach exposed 192,000 individuals, leading to accusations of insufficient safeguarding of sensitive information. The agreement compensates for financial losses and underscores the critical need for robust cybersecurity measures.

15. UK Trio NFT Fraud Charges

Three UK nationals face charges for their role in the “Evolved Apes” NFT scam, accused of wire fraud and money laundering by orchestrating a rug pull scheme. The trio’s alleged actions involved falsely promising a video game development linked to NFT sales, ultimately vanishing with investors’ funds. The indictment reveals their laundering of misappropriated funds through cryptocurrency transactions, highlighting the serious consequences of NFT fraud in the digital art market.

Subscribe and Comment.

Copyright © 2024 CyberMaterial. All Rights Reserved.

Follow CyberMaterial on:

LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium.