29th November – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 29th November, please download our Threat Intelligence Bulletin.

Top Attacks and Breaches

GoDaddy has announced they suffered a data breach with data of up to 1.2 million of its customers being exposed after an unauthorized person used a compromised password to gain access to the company’s Managed WordPress hosting environment.
Iranian airline Mahan Air has been victim of a cyber-attack which resulted in its website going offline. The company still operated its flights on schedule without major disruptions.
A threat group is leveraging a new custom-made malware called “Tardigrade”, which is spread via phishing emails or infected USB drives, to attack biomanufacturing companies. The attacks aim at intellectual property theft and eventually infect the systems with a ransomware.
Security analysts have discovered a new malware campaign on Huawei’s AppGallery catalog which led to 9,300,000 downloads from 190 different games containing the Android Trojan Cynos that is able to collect user phone number, device location and other parameters.
A new Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide by leveraging a Microsoft MSHTML RCE flaw tracked CVE-2021-40444 and using a new PowerShell-based stealer called PowerShortShell.

Check Point IPS, Anti-Virus and Anti-Bot protect against this threat (Microsoft Internet Explorer MSHTML Remote Code Execution (CVE-2021-40444); HEUR:Exploit.MSOffice.CVE-2021-4044)

IKEA is currently victim of a cyberattack where threat actors are targeting employees in internal phishing attacks using stolen reply-chain emails – replying on legitimate internal emails and attaching or linking to malicious documents. IKEA suppliers and business partners are compromised as well.
A new malware campaign has been discovered on Discord deploying the Babadeda crypter to hide malware that targets cryptocurrencies, NFTs, and DeFi communities.

Vulnerabilities and Patches

Check Point Research has identified security flaws in the smartphone chip made by Taiwanese manufacturer MediaTek, used in 37% of the world’s smartphones. The security flaws were found inside the chip’s audio processer. MediaTek patched the vulnerabilities, which could have enabled a hacker to eavesdrop on Android users, elevate privileges and execute commands.

Check Point Harmony Mobile provides protection against this threat

A researcher has demonstrated how the patch for CVE-2021-41379 can be bypassed, enabling elevation of privileges in Windows 10 and 11 and Windows Server.
Unofficial patches have been made available to protect Windows users from a local privilege escalation zero-day flaw in the Mobile Device Management Service concerning all Windows 10 versions.

Threat Intelligence Reports

Security researchers have found CronRAT, a new remote access Trojan for Linux servers that conceals itself by hiding in tasks scheduled for execution on a date that does not exist, February 31st. The malware is used to enable server-side Magecart data theft.
The FBI is warning of a surge in spear-phishing email campaigns targeting customers of “brand-name companies”, delivered in both emails and SMS messages.
A new JavaScript based malware strain called RATDispenser is being used to deliver remote access Trojans and info stealers and potentially steal cryptocurrency information. The delivery vector is a malicious email with an executable attachment.
Researchers have set up 320 publicly accessible honeypots to see how quickly malicious actors would target exposed cloud services, and report that 80% of them were compromised in under 24 hours. All honeypots were compromised within a week.
Researchers have spotted the TrickBot malware that evades detection by checking the screen resolution of a victim system, only executing on standard configurations.

BLOGS AND PUBLICATIONS

Check Point Research Publications
Global Cyber Attack Reports
Searchable
Threat Research

February 17, 2020

“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign

Check Point Research Publications
Global Cyber Attack Reports
Searchable
Threat Research
Uncategorized

January 22, 2020

The 2020 Cyber Security Report

Global Cyber Attack Reports

December 15, 2021

StealthLoader Malware Leveraging Log4Shell

Results for “"ounce"”

Log4J added to DHS bug bounty program

29th November – Threat Intelligence Report