SAN MATEO, CA, April 15, 2024 — Cybersecurity news weekly roundup. Stories, news, politics, and events that impacted the network security industry last week. Brought to you by NetworkTigers.
576,000 Roku accounts hacked in credential stuffing attack
Roku is warning customers that 576,000 accounts have been hacked in a credential-stuffing attack. The news comes on the heels of a previous incident in March that saw 15,000 accounts compromised. “After concluding our investigation of [the] first incident, we [..] continued to monitor account activity closely [and] we identified a second incident, which impacted approximately 576,000 additional accounts,” Roku said. The company goes on to say that in “less than 400 cases” the hackers logged in to stolen accounts and purchased streaming subscriptions and Roku hardware using the payment method that the victims had saved. However, complete credit card numbers were not exposed. Roku has resent the passwords of all affected accounts and will refund any fraudulent charges. Read more.
Palo Alto Networks PAN-OS zero-day bug under active attack
A major flaw affecting Palo Alto Networks PAN-OS software is under active exploitation in the wild, the company warns. The bug, CVE-2024-3400, is described by the company as “a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations.” The flaw, which has received a maximum CVSS score of 10.0, “may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.” A patch for the bug is expected to be issued on April 14, but Palo Alto Networks is “recommending customers with a Threat Prevention subscription to enable Threat ID 95187 to secure against the threat.” Read more.
CISA responds to breach of Sisense exposing users to supply chain attacks
A breach of Sisense, a power player in the world of business analytics used by more than 2,000 major companies around the globe, has prompted CISA to issue a warning to their customers. The nature of the attack has not yet been publicized. However, it could have exposed hundreds of Sisense clients to a supply chain attack and “provided the attacker with a door into the company’s customer networks.” It’s also not clear who is responsible for the breach. CISA’s alert urges Sisense customers to change their login credentials and report suspicious activity to the agency. The company has not yet responded to requests for comment on the incident. Still, an email to customers said they are “aware of reports that certain Sisense company information may have been made available on what we have been advised is a restricted access server (not generally available on the internet).” Read more.
Apple’s spyware alert system now warns victims of mercenary attacks
Apple has updated its mercenary spyware threat notification system documentation, detailing that it will not alert a user if it detects an attack has specifically targeted them. “Though deployed against a very small number of individuals — often journalists, activists, politicians, and diplomats — mercenary spyware attacks are ongoing and global,” Apple said. TechCrunch reports that the company sent out alerts to users in 92 countries at the same time explaining the revision. While Apple’s documentation on the system calls out NSO’s Pegasus spyware specifically, threat notifications do not “attribute the attacks or resulting threat notifications” to any particular group or location. Read more.
Raspberry Robin malware finds new life in malicious Windows Script File campaign
Raspberry Robin, a malware that has previously been “known to spread through removable media like USB drives,” has been discovered being spread through malicious Windows Script Files since March of 2024. It’s not currently known how threat actors are getting victims to visit the URLs that lead to the malware, but it’s believed that they’re using spam or malvertising campaigns. Raspberry Robin, the QNAP worm, was discovered in September 2021. The malware has evolved into a “downloader for various other payloads in recent years, such as SocGholish, Cobalt Strike, IcedID, BumbleBee, and TrueBot, and also serving as a precursor for ransomware.” Read more.
Malicious Visual Studio projects spreading crypto stealing malware on GitHub
A report from Checkmarx indicates that hackers are using GitHub automation features and malicious Visual Studio projects to spread a clipboard-hijacking malware called Keyzetsu. The campaign is designed to steal cryptocurrency payments, and the threat actors responsible are creating GitHub repositories with “names that have a higher chance of ranking well in search results” and using “various methods to artificially boost their popularity and visibility on the platform.” For example, the repositories are automatically updated at a very high frequency to ensure they remain highly listed in the “most recently updated” search results. To protect against attacks on GitHub, users are urged to review repository activity for suspicious patterns. Read more.
Popular YouTube channels hacked to spread infostealer malware
Threat actors, discouraged by the lack of engagement generated by their own YouTube channels, are increasingly hacking famous ones with as many as 800,000 subscribers to spread infostealers to unsuspecting subscribers. Targeted channels vary as the hackers seek out influencers with large follower counts. After being hacked, the attackers post videos about cracking popular software and include a download link in the video description that delivers a compressed file to victims that, when decompressed, turns out to be either the Vidar or LummaC2 infostealer. Hackers stealing legitimate accounts can cause tremendous damage to the owner’s reputation and subscriber count as they turn channels against their viewers. Read more.
Change Healthcare hit with second ransomware attack
Change Healthcare, still reeling from an attack from the ALPHV ransomware gang, has been hit again with an attack from a group called RansomHub. Demanding payment for 4TB of stolen data, RansomHub has reportedly given Change Healthcare 12 days to respond to the threat of selling it online. “Change Healthcare and United Health, you have one chance in protecting your clients data,” RansomHub reportedly stated. “The data has not been leaked anywhere and any decent threat intelligence would confirm that the data has not been shared nor posted.” There is speculation surrounding RansomHub, with some researchers believing it may be a rebranding of ALPHV and others wondering if the healthcare giant has been caught in a conflict between two rival criminal enterprises. Read more.
Multi-stage malware attacks being spread through invoice phishing
Fortinet Fortiguard Labs has released a technical report detailing an “intricate multi-stage attack that leverages invoice-themed phishing decoys to deliver a wide range of malware such as Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a stealer that targets crypto wallets.” The infection sequence, being spread through emails, is engaged when a victim clicks an attached Scalable Vector Graphics (SCG) file. According to the report, the attack’s pattern “is notable for the use of the BatCloak malware obfuscation engine and ScrubCrypt to deliver the malware in the form of obfuscated batch scripts.” The attack also delivers a stealer to the victim that can exfiltrate data from folders associated with Atomic Wallet, Electrum, Ethereum, Exodus, Jaxx Liberty, Zcash, Foxmail, and Telegram. Read more.
More than 90K LG Smart TVs potentially vulnerable to remote hacking
Researchers at Bitdefender have reported four vulnerabilities within WebOS, the operating system installed in LG’s smart TVs, that could allow “varying degrees of unauthorized access and control over affected models, including authorization bypasses, privilege escalation, and command injection.” The attacks are made possible due to “the ability to create arbitrary accounts on the device using a service that runs on ports 3000/3001, which is available for smartphone connectivity, using a PIN.” An update from LG that fixed these vulnerabilities was made available in March 22, 2024 and all LG smart TV users are strongly encouraged to install the patch immediately. Read more.
More cybersecurity news
- Last week’s news
- More cybersecurity news
- All articles brought to you by NetworkTigers
