InfoSecBulletin Cybersecurity for mankind
An unsecured database belonging to RateForce ended up exposing 93.93 GB of personal information of users. This is a reminder to secure your cloud buckets. We also have two more victims of the MOVEit ransomware attack. This time, it is the largest public pension fund in the U.S. and an insurance firm. In other news, there is an update on the Dole ransomware attack that took place in February this year. The corporation disclosed the number of impacted individuals. Read on to know more.
RateForce Data Leak
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
An unsecured database belonging to the U.S. auto insurance price comparison site RateForce leaked 255,756 records (93.93 GB) containing scans and images of vehicle registrations, driver’s licenses, state Medicaid health coverage cards, and others.
MOVEit Ransomware Attacks
The MOVEit ransomware attack has claimed two more victims: the largest public pension fund in the U.S. and an insurance firm. The attack on the pension fund compromised the personal data of 2.5 million Genworth Financial policyholders, while the attack on the insurance firm compromised the personal information, including Social Security numbers, of 769,000 retired California state employees.
GitHub RepoJacking
Aqua Nautilus has warned that millions of GitHub repositories are potentially vulnerable to RepoJacking, a type of attack that steals sensitive data from repositories. Some vulnerable repositories belong to Google, Lyft, and other anonymous firms.
New JS Dropper Variant
Deep Instinct has spotted a new variant of JS dropper, named PindOS, that is deploying next-stage payloads such as IcedID and Bumblebee. These malware, in turn, serve as loaders for other malware, including ransomware.
Dole Ransomware Attack Update
Dole has confirmed that the February ransomware attack compromised the names, addresses, driver’s license numbers, passport numbers, dates of birth, phone numbers, and other employment information of 3,885 employees.
Chinese APT Groups Exploit Microsoft Office Vulnerability
SentinelOne has revealed that Chinese APT groups exploited a 17-year-old Microsoft Office vulnerability to launch malware attacks against foreign government officials who attended a G7 summit in Hiroshima, Japan.
NIST Creates First-Ever Cybersecurity Framework for Water Infrastructure
The National Institute of Standards and Technology (NIST) is creating the first-ever cybersecurity framework for water infrastructure to address unique cyber challenges impacting America’s complex water systems.
Microsoft Discovers Cryptomining Campaign
Microsoft has discovered a cryptomining campaign targeting IoT devices and internet-facing Linux systems. The attackers are using a backdoor that deploys a broad range of tools and an IRC bot to steal device resources for mining.
NSA Issues Guidance on Defending Against BlackLotus UEFI Bootkit Malware
The National Security Agency (NSA) has issued guidance on defending against BlackLotus UEFI bootkit malware attacks. The guidance recommends that system administrators apply the latest security updates, update recovery media, and customize UEFI Secure Boot to block older signed Windows boot loaders.
Unit 42 Researchers Observe Mirai Botnet Variant
Unit 42 researchers have observed a variant of the Mirai botnet that is targeting multiple vulnerabilities in popular IoT devices, with a focus on D-Link, Zyxel, and Netgear devices. The variant has been identified in two ongoing campaigns that started on March 14 and spiked in April and June.
