• In the last week, the hacker group who goes by the name of ‘PokemonGo Team’ had uploaded the personal information of several Federal agents.
• The hackers could have exploited a flaw in the third-party software used by the websites associated with the FBINAA in order to steal the data.

The hacker group, who previously had exposed the personal information FBI agents, is back with a fresh batch of data. This time, the group has leaked information of tens of thousands of American Advertising Federation (AAF) members.

Background – In the last week, the hacker group who goes by the name of ‘PokemonGo Team’ had uploaded the personal information of several Federal agents and law enforcement officers on the internet. They breached three sites associated with the FBI National Academy Association to gain access to the data.

As detailed by FBINAA’s press release, the hackers could have exploited a flaw in the third-party software used by the websites in order to steal the data.

The stolen document contained 4000 unique records that included member names, job titles, email addresses, phone numbers, and postal addresses.

TechCrunch reported that the hackers have hacked more than 1,000 sites and that they are in the process of structuring and selling the data.

What’s the new update – According to a report from Bleeping Computer, the ‘PokemonGo Team has published the personal information of 22,013 AAF members. The exposed records represent a list of people being watched by the FBI.

The new data leak contained full names, companies, work area information and email addresses of AAF members.

After releasing the data, the hacking group has its Twitter account suspended. Meanwhile, the leaked ‘FBI watchlist’ of AAF members is still available on the group’s website.

• Attackers compromised Microsoft support agent’s credentials and gained access to view ‘limited’ number of users’ email account information.
• Upon learning about the incident, Microsoft immediately disabled the compromised support agent’s credentials.

What is the issue – Microsoft notified its users via email that a certain ‘limited’ number of users who use web email services managed by Microsoft might have had their accounts compromised.

What happened?

Attackers compromised Microsoft support agent’s credentials and gained access to view ‘limited’ number of users’ email account information such as email addresses, folder names, subject lines, and the names of other email addresses users have communicated between January 1, 2019, and March 28, 2019.

However, attackers did not view any content of emails or attachments.

What was the immediate action taken?

• Upon learning about the incident, Microsoft immediately disabled the compromised support agent’s credentials.
• Microsoft notified the potentially affected users about the incident and provided additional guidance and support.
• The company has requested its users ‘out of caution’ to reset their email account passwords.
• It has further enhanced its detection and monitoring services in order to protect affected accounts.

“As a result, you may receive phishing emails or other spam mails. You should be careful when receiving any e-mails from any misleading domain name, any e-mail that requests personal information or payment, or any unsolicited request from an untrusted source,” Microsoft said in the email notification, TechCrunch reported.

“We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators’ access,” a spokesperson for Microsoft told TechCrunch in an email.

• RobinHood renames the encrypted files something similar to Encrypted_b0a6c73e3e434b63.enc_robinhood.
• The ransomware drops 4 ransom note with different names at the same time.

A new ransomware named RobinHood has been found targeting computers within an entire network. The operators of the ransomware are so particular about victims’ privacy that they delete the encryption keys and IP addresses after the payment is received.

How does the ransomware operate – The propagation method of the ransomware is unknown. However, once it is installed, RobinHood renames the encrypted files something similar to Encrypted_b0a6c73e3e434b63.enc_robinhood.

After this, the ransomware drops 4 ransom note with different names at the same time. The names of these notes are _Decryption_ReadMe.html, _Decrypt_Files.html, _Help_Help_Help.html, and _Help_Important.html.

What do these ransom notes say – The ransom notes include information regarding what happened to the victim’s files, the ransom amount and links to the TOR sites.

The TOR links are the ones where the victim is required to leave a message for the attackers or where they can decrypt 3 files of up to 10MB in size for free.

The ransom varies depending on the number of computers that are encrypted.

“For example, in a ransom note seen by BleepingComputer, the ransom was 3 bitcoins per computer or 7 bitcoins for the network,” Bleeping Computer noted.

By the fourth day, the ransom increases by $10,000 per day if the victim fails to pay on time.

Once the ransom is received, the attackers delete the encryption key and IP address to protect the privacy of the victim.

More than 50 universities in the United Kingdom had their cyber-defenses tested by ethical hackers, and the ‘grades’ aren’t pretty

A team of ethical hackers recently conducted tests on the cybersecurity defenses of more than 50 universities in the United Kingdom. In each case, it took them less than two hours to gain access to “high-value data”.

This is according to The Higher Education Policy Institute (HEPI) and the non-profit Jisc, which provides digital services to academia in the UK.

Key to the 100-percent success rate of the simulated attacks was spear-phishing, a targeted form of phishingthat involves sending a bespoke email to a well-researched prospective victim. These emails, where the sender pretends to be a trusted entity in a bid to convince the victim to open malicious attachments or visit fake websites, worked to breach the network of each participating university.

“Alarmingly, when using spear-phishing as part of its penetration testing service, Jisc has a 100-percent track record of gaining access to a higher education institution’s high-value data within two hours,” reads the report.

In some cases it took the white hats less than an hour to “reach student and staff personal information, override financial systems and access research databases”, said the BBC.

It is no wonder that security experts are concerned. “We are not confident that all UK higher education providers are equipped with the adequate cybersecurity-related knowledge, skills and investment,” said John Chapman, head of Jisc’s Security Operations Centre.

According to the UK’s National Cyber Security Centre (NCSC), most actual attacks that target universities in the country are related to phishing and attempts to gain entry for ransomware and other malware, including with the aim of stealing sensitive research data and intellectual property.

Needless to say, besides the personal information of employees and students, universities hold staggering amounts of highly-valuable and commercially-sensitive research data.

• Threat actors revive old email conversation threads to inject a link to an Emotet-infected file.
• The tactic has been previously used by a North Korean hacker group to target various individuals.

The operators of Emotet trojan have evolved their tactics to spread the malware. Lately, they have been observed reviving old email conversation threads to inject a link to an Emotet-infected file.

How does it work – Users involved in the previous email exchanges would receive an email that pretends to be from the previous correspondents. However, the email actually comes from Emotet servers.

The email conversation thread would be left intact but the Emotet gang would insert an URL at the top of the email that would link to an Emotet-infected file or a malicious document.

How old is the tactic – The tactic has been previously used by a North Korean-based hacking group to target various individuals across the world. In 2017, Palo Alto Networks Unit 42 researchers had noted that the threat actors had leveraged the tactic to compromise multiple email accounts tied to a legitimate domain in North East Asia.

How long the Emotet gang is using the tactic – The Emotet gang has taken this new approach in October last year. This enabled the group to launch a mass-harvesting campaign.

According to a report from Cofense, the gang has been actively using the tactic from April 9, 2019, thus calling it as a ‘Major evolution in the way Emotet works’.

This new Emotet email thread spam isn’t limited to English emails. The operators are also leveraging English and German email threads to launch attacks.

“The injected reply is usually prefaced with ‘Attached is your confidential docs. These templates are pretty limited in run and not very numerous compared to the ‘normal’ [Emotet] malspam,” said Cryptolaemus Group researcher Joseph Roosen, ZDNet reported.

Which other malware has used the tactic – The creators of URSnif trojan used a similar tactic in March and October 2018. They created the email threads from scratch, instead of reviving the threads, to spread the malware.

GREENVILLE, NC (WITN) – Most city-owned computers remain offline for the second day as the FBI has joined in the investigation into the ransomware attack.

The city shut down most computers early Wednesday after a police department employee noticed the virus.

A city spokesman said they are victims of the “RobbinHood” ransomware, but they will not say how much the ransomware is asking to free up infected computers.

Brock Letchworth says they are exploring all options to fix their systems, but right now they have no plans to pay the ransom.

He said in addition to the FBI, they have brought in outside experts to help.

It’s not known how long the city’s computers will be shut down. For the time being, all payments must be made in person with cash.

Those wishing to pay a parking or red light ticket can still do so online via third-party vendors.

Previous Story

Greenville has confirmed that ransomware attacked the city’s computers.

The attack was noticed overnight and a spokesman said the city shut down most of its computers to keep the virus from spreading.

Brock Letchworth said even with the shutdown, all public safety systems were functioning, and they have no reason to believe any personal information has been compromised.

“There is no public safety concern, but it’s certainly a major headache,” Letchworth said.

Ransomware is a computer virus that denies owners access to systems or data until a ransom is paid. It is often spread through emails containing links that are clicked on by the unsuspecting recipient.

The city says for now all payments must be made with cash, and they do not have an estimate on when the computers will be back online. Operations at city hall have been slowed down because they are now having to use paper records.

Some people hoping to pay parking tickets Wednesday said it was frustrating not to be able to get it all taken care-of right away.

“It’s just wasting time, you know I just want to check on it,” James Evrett said after not being able to check on a parking fine.

Greenville says it will gradually be bringing servers back online to evaluate the virus, while the city is looking at all options for restoring their systems.

Greenville Utilities is not impacted by this shutdown, according to the city.

Last fall, the Onslow Water And Sewer Authority had a similar attack and had to shut down its computers for several days. ONWASA did not pay the ransom to restore their system.

• The e-commerce platform released patches for both Magento Commerce and Magento Open Source variants.
• The SQL flaw found in versions 2.3.1 and earlier could allow attackers to steal sensitive information from databases connected to Magento-based sites.

Content management software provider Magento has released a string of updates to fix multiple security holes in its platform. These updates come after the platform was targeted in a number of attacks since February.

One critical flaw that was addressed with the updates is a SQL-injection bug that could allow attackers to execute malicious codes, and obtain sensitive information from databases used by Magento-based sites.

The big picture

• The new versions 2.3.1, 2.2.8 and 2.1.17 fix the security vulnerabilities discovered in both Magento Commerce as well as Magento Open Source.
• In the advisory published by Magento, online sites using versions below Magento 2 are advised to move to Magento Commerce & Open Source.
• The SQL-injection bug, designated as ‘PRODSECBUG-2198’ by Magento, could allow an unauthenticated user to run malicious arbitrary code and subsequently steal sensitive data. As of now, no technical details are available for this bug.
• Other bugs that were patched include remote code execution, cross-site scripting, privilege escalation, cross-site request forgery, and information disclosure flaws.

Databases at risk

Since SQL injections corrupt databases, Magento users are advised to update to the latest versions as soon as possible.

“Unauthenticated attacks, like the one seen in this particular SQL Injection vulnerability, are very serious because they can be automated — making it easy for hackers to mount successful, widespread attacks against vulnerable websites,” Sucuri stated in its blog.