- Byte Federal Bitcoin ATM Firm Hacked via GitLab Vulnerability, Exposing 58K Users’ Data:Byte Federal, the largest U.S. Bitcoin ATM operator, disclosed a data breach that exposed the personal information of 58,000 customers. Hackers exploited a vulnerability in GitLab, a third-party platform used for project management and collaboration, to gain unauthorized access to Byte Federal's systems in November 2024. Sensitive data accessed includes full names, dates of birth, addresses, phone numbers, government-issued IDs, Social Security numbers, transaction history, and user photos. The company took immediate action by securing compromised servers and resetting customer accounts. Although no funds were compromised, the breach could expose users to identity theft, SIM swap attacks, and phishing risks. Byte Federal has not offered identity theft protection, and forensic analysis is still ongoing with law enforcement involved. Customers are urged to monitor their accounts and credit reports for suspicious activity.
- Ransomware Attack Disrupts Heart Surgery Device Maker Artivion:Artivion, a leading heart surgery device manufacturer, suffered a ransomware attack on November 21 that impacted its operations and forced systems offline. The Atlanta-based company, with over 1,250 employees globally and facilities in Georgia, Texas, and Germany, initiated an investigation and engaged external advisors to manage the breach. While the company didn't explicitly mention ransomware, it disclosed the encryption and theft of data from compromised systems. Artivion is working to restore its systems and evaluate any necessary notifications. Although order processing and shipping disruptions have been mostly resolved, the company expects additional costs beyond insurance coverage. No ransomware group has claimed responsibility yet, but this could change if demands remain unmet. The attack follows a wave of recent ransomware incidents in the U.S. healthcare sector, with other hospitals experiencing similar breaches.
- New Android Spyware Discovered on Seized Phone:A new spyware was found on the phone of Kirill Parubets, a Russian programmer arrested by the FSB for alleged support of Ukraine. After being detained, his phone was returned with unusual behavior, leading to suspicions it was tampered with. Forensic analysis confirmed the device had been infected with spyware masquerading as the popular app "Cube Call Recorder." This malware, likely an updated version of Monokle, was developed by St. Petersburg's Special Technology Center. It grants the attacker extensive access, including location tracking, SMS and contacts monitoring, and call recording. The spyware can also capture keystrokes, access messaging apps, and install malicious packages. It uses advanced encryption and obfuscation techniques to avoid detection. Analysts also found hints that a similar version could target iOS devices.
- DroidBot Android Malware Targets 77 Banking, Crypto Apps:DroidBot, a new Android banking malware, is designed to steal credentials from over 77 banking and cryptocurrency apps across the UK, Italy, France, Spain, and Portugal. Discovered by Cleafy researchers, it operates as a malware-as-a-service (MaaS) platform, costing $3,000 per month for affiliates. Active since June 2024, DroidBot's developers, likely Turkish, provide malware builders, C2 servers, and management tools for cybercriminal groups to customize their attacks. The malware masquerades as Google Chrome or Play Store apps to trick users into installing it. DroidBot uses keylogging, fake login overlays, SMS interception, and VNC to gain control of infected devices. It abuses Android's Accessibility Services to monitor actions and simulate taps. Affected apps include Binance, KuCoin, BBVA, Metamask, and more. Users are advised to download apps only from Google Play and scrutinize permission requests.
- Rockstar 2FA Phishing Service Targets Microsoft 365 Accounts:A new phishing-as-a-service (PhaaS) platform, "Rockstar 2FA," enables large-scale adversary-in-the-middle (AiTM) attacks on Microsoft 365 accounts, bypassing multifactor authentication (MFA) by intercepting session cookies. The service works by tricking victims into entering their credentials on fake login pages, while the AiTM server acts as a proxy to forward those credentials to Microsoft’s legitimate service. The attackers capture the session cookie, granting them direct access to the account, even if MFA is enabled. Rockstar 2FA, an updated version of earlier phishing kits DadSec and Phoenix, has gained traction in the cybercrime community, offering features like support for Microsoft 365, randomized source code, and Cloudflare Turnstile Captcha integration. It is sold for $200 for two weeks or $180 for API access renewal, and has been used in over 5,000 phishing operations since May 2024. These campaigns use legitimate platforms and various lures, including document-sharing alerts and payroll messages, to spread phishing links. The platform employs evasion techniques like QR codes, URL shortening, and IP checks to filter out targets, redirecting bots or security researchers to decoy pages. Despite law enforcement takedowns of other major PhaaS platforms, Rockstar 2FA highlights the persistent threat posed by affordable, easy-to-use phishing services.
- Hackers Breach US Firm Using "Nearest Neighbor Attack" from Russia:APT28, a Russian state-sponsored hacking group, breached a U.S. company via a novel "nearest neighbor attack," exploiting the target's enterprise WiFi network. The hackers, based in Russia, initially compromised a nearby organization and then leveraged dual-home devices to access the target's network remotely. By connecting through compromised WiFi, they bypassed multi-factor authentication (MFA) protections. Once inside, they used remote desktop connections and Windows tools to exfiltrate sensitive data. The group, known as GruesomeLarch, also exploited a zero-day vulnerability in the Windows Print Spooler service. This attack highlights the need for stronger WiFi security, especially as cyber adversaries use creative methods to bypass traditional protections.
- Ubuntu Linux Impacted by Decade-Old 'Needrestart' Flaw Allowing Root Access:Five local privilege escalation (LPE) vulnerabilities in Ubuntu's 'needrestart' utility, introduced in version 0.8, were discovered by Qualys. These flaws allow attackers with local access to escalate privileges to root. Needrestart helps identify services requiring restart after updates but mismanages interpreter environment variables, creating vulnerabilities. The flaws allow malicious code execution via Python, Ruby, and Perl interpreters. A race condition and insecure Perl module use also expose systems to privilege escalation. While requiring local access for exploitation, the flaws pose significant risks, especially with widespread needrestart usage. Upgrading to version 3.8 or later patches these issues, and users are advised to disable interpreter scanning in the configuration file to further mitigate risks. This vulnerability has been present for over a decade, increasing the likelihood of its exploitation over time. Due to the utility’s common use in critical systems, attackers could leverage this flaw for root access on vulnerable machines.
Summary: Broken Access Control is a serious and frequent security problem that happens when an application does not correctly enforce rules about what different users can or cannot do. Essentially, when access control is broken, the application might not check properly whether a user has the right permissions before allowing them to access certain features or data.
- Ford disclosed an alleged security breach on November 21, 2024, affecting up to 44,000 customer records. The breach, claimed by cybercriminals IntelBroker and EnergyWeaponUser via BreachForums, involved the leak of sensitive information such as customer names, addresses, and purchase details. The data was shared for free, likely to damage Ford’s reputation rather than for financial gain. While Ford denies a direct compromise of its systems, they are investigating the potential involvement of a third-party supplier. Security experts urge affected individuals to remain vigilant for identity theft or phishing attempts.
- A ransomware attack on Blue Yonder, a third-party supplier, disrupted Starbucks' operations on November 26, 2024. Blue Yonder’s systems, crucial for employee scheduling and payroll, were compromised, forcing Starbucks to adopt manual processes to manage barista schedules and payroll continuity. The breach also affected other retailers relying on Blue Yonder’s software. Starbucks is working with cybersecurity firm CrowdStrike to contain the issue, enhance defenses, and ensure system resilience against future threats.
- Finastra, a global fintech leader, is investigating a significant data breach disclosed on November 19, 2024, involving its Secure File Transfer Platform (SFTP). The platform, used for transferring sensitive financial data, was allegedly compromised by a hacker who has since claimed responsibility. The full scope of the breach remains unclear. Finastra is collaborating with law enforcement and cybersecurity experts to understand the impact and secure its systems. Clients relying on the SFTP platform are advised to monitor for suspicious activity.
- Amazon confirmed on November 12, 2024, that employee data was exposed due to a third-party breach tied to the MOVEit vulnerability, exploited earlier by the Cl0p hacking group. The breach impacted a property management vendor, leading to the exposure of employee contact details, including email addresses, desk phone numbers, and building locations. Amazon emphasized that its internal systems remain secure but highlighted the risks associated with third-party vendors. Affected individuals are urged to remain cautious of phishing attempts.
- Star Health Insurance experienced a massive data breach on November 3, 2024, compromising 31 million customer records, including PAN numbers, Aadhaar numbers, medical records, and insurance claim details. The hacker, xenZen, alleged that the data was purchased for $43,000 in a deal involving Star Health’s Chief Information Security Officer (CISO), a claim that the company denies. Star Health insists it was a malicious cyberattack and has filed lawsuits against the hacker and related platforms. The company is conducting an internal investigation while advising affected individuals to safeguard their personal data.
- New stealthy Pumakit Linux rootkit malware spotted in the wild: Security researchers have uncovered Pumakit, a sophisticated Linux rootkit employing stealth and privilege escalation to evade detection. Discovered by Elastic Security via a suspicious 'cron' binary on VirusTotal, the malware consists of a dropper, memory-resident executables, a kernel module rootkit, and a userland shared object rootkit. Pumakit’s infection begins with a dropper ('cron') that executes payloads entirely in memory, deploying a kernel module ('puma.ko') and a userland rootkit ('libs.so') for advanced system manipulation. Using 'LD_PRELOAD,' it intercepts system calls for process injection. Such tools are typically leveraged by advanced threat actors targeting critical infrastructure and enterprise environments.
- New IOCONTROL malware used in critical infrastructure attacks: Iranian threat actors, linked to the CyberAv3ngers group, are deploying a new malware called IOCONTROL to target IoT and OT/SCADA systems in Israel and the U.S. The malware compromises devices like routers, PLCs, HMIs, IP cameras, and fuel management systems from manufacturers such as D-Link, Hikvision, and Phoenix Contact. Discovered by Claroty’s Team82, IOCONTROL is a modular cyberweapon capable of causing severe disruptions to critical infrastructure. Recent attacks include claims of compromising 200 gas stations, with malware samples found on Gasboy systems and Unitronics devices. These campaigns have escalated amid geopolitical tensions, with new activity detected in mid-2024. Alarmingly, the malware remains undetected by antivirus tools on VirusTotal as of December 2024.
- Crypto-stealing malware posing as a meeting app targets Web3 pros: Cybercriminals are luring Web3 professionals into fake video meetings via a malicious platform named "Meeten," active since September 2024. The malware, available for Windows and macOS, steals cryptocurrency, banking data, browser-stored information, and Mac Keychain credentials. Discovered by Cado Security Labs, the campaign uses rotating brand names like "Clusee" and "Meetio" to appear legitimate, supported by AI-generated websites and social media content. Victims are tricked via phishing into downloading Realst stealer, disguised as a meeting application. The campaign highlights the evolving sophistication of phishing tactics targeting the crypto sector.
- New DroidBot Android malware targets 77 banking, crypto apps: A new Android malware named 'DroidBot' is targeting credentials for over 77 cryptocurrency exchanges and banking apps in the UK, Italy, France, Spain, and Portugal. Discovered by Cleafy, DroidBot has been active since June 2024 and operates as a malware-as-a-service (MaaS) platform, priced at $3,000/month. At least 17 affiliate groups use the malware to tailor attacks, with 776 infections identified across Europe and Turkey. While DroidBot lacks advanced features, its activity suggests significant adoption and ongoing development. Cleafy warns of potential expansion to regions like Latin America as the malware evolves.
- BootKitty UEFI malware exploits LogoFAIL to infect Linux systems : Bootkitty, the first Linux-specific UEFI bootkit, exploits the LogoFAIL flaw (CVE-2023-40238) to compromise vulnerable firmware, according to recent discoveries by ESET and Binarly. LogoFAIL, a flaw in UEFI image-parsing code, allows attackers to bypass Secure Boot by embedding malicious payloads in images or logos on the EFI System Partition (ESP). Bootkitty uses specially crafted BMP files to inject rogue certificates into the MokList variant, authorizing a malicious bootloader and hijacking execution flow. Currently targeting specific Ubuntu versions, Bootkitty is in development but showcases a significant threat to Linux systems. Researchers warn that Bootkitty erases tampering signs by restoring overwritten memory, making detection challenging.
- New Android spyware found on phone seized by Russian FSB: Citizen Lab has identified spyware on the device of Kirill Parubets, a Russian programmer detained by the FSB for alleged donations to Ukraine. Upon his phone's return, unusual behavior and a notification reading "Arm cortex vx3 synchronization" raised suspicion. Analysis revealed the spyware masquerades as the legitimate Android app 'Cube Call Recorder,' granting attackers extensive permissions for device monitoring. Citizen Lab suggests the malware is either an updated version of Monokle spyware, developed by Russia's Special Technology Center, Ltd., or new software built using Monokle's code. Monokle was first identified by Lookout in 2019. This case highlights the FSB’s ongoing surveillance tactics.
- CVE-2024-11477: A critical vulnerability in 7-Zip’s decompression library, CVE-2024-11477, allows attackers to exploit compressed file archives and potentially compromise systems. Users are advised to update to version 24.07 or later to mitigate this risk, and additional mitigations include monitoring decompression processes and implementing application whitelisting.
- CVE-2024-10905: A critical flaw in SailPoint IdentityIQ (versions 8.4, 8.3, 8.2), CVE-2024-10905, enables attackers to bypass authentication, manipulate API endpoints, and execute arbitrary code. Organizations should upgrade to the latest patches and enforce multi-factor authentication (MFA) to reduce exposure to attacks.
- CVE-2024-8785: CVE-2024-8785 is a remote code execution (RCE) vulnerability in Progress WhatsUp Gold (pre-24.0.1) that allows attackers to manipulate Windows registry settings and potentially take control of systems. Administrators should update to version 24.0.1 and restrict network access to port 9643 to mitigate risks.
- CVE-2024-49138: CVE-2024-49138, a zero-day vulnerability in Windows CLFS Driver, allows privilege escalation to SYSTEM level via a heap-based buffer overflow. Microsoft has released patches in the December 2024 Patch Tuesday updates. Immediate patching is critical, as this vulnerability is actively exploited by ransomware groups.
- CVE-2024-43602: A critical RCE vulnerability in Azure CycleCloud, CVE-2024-43602, affects versions 8.0.0 to 8.6.4. Improper authorization allows attackers to remotely execute arbitrary code. Users should update to version 8.6.5 or later and apply least privilege access controls to secure their systems.
- CVE-2024-11680: CVE-2024-11680 is a critical vulnerability in ProjectSend (pre-r1720), which allows unauthenticated attackers to manipulate configurations and execute remote code. Users are urged to update to the patched version immediately to prevent exploitation.
Stay updated with "Cybersecurity News and Trends from Intelliroot." For the latest stories shaping the cybersecurity landscape, follow us on LinkedIn or visit our Cybersecurity News and Trends page.
