May 31 2024
Welcome to Gone Phishing, your daily cybersecurity newsletter that’s blowing up like a vindaloo 💥💥💥
It’s Friday, folks, which can only mean one thing… It’s time for our weekly segment!
It goes by many names. Patch of the Week, Tweak of the week. Okay, that’s it.
Congrats, the cybercriminals are no match… for your patch! 🩹🩹🩹
⚠️ Urgent Update: Critical Security Flaw in TP-Link Archer C5400X Router 🚨
A maximum-severity vulnerability (CVE-2024-5035, CVSS 10.0) in the TP-Link Archer C5400X gaming router has been disclosed, allowing remote code execution via specially crafted requests. 💥 The flaw impacts all firmware versions up to 1_1.1.6 and has been patched in version 1_1.1.7, released on May 24, 2024. 🛠️
Exploit Details 📝
● The flaw resides in the "rftest" binary, which exposes a network listener on TCP ports 8888, 8889, and 8890.
● Attackers can bypass command restrictions by injecting shell meta-characters (e.g., "wl;id;") to gain arbitrary command execution with elevated privileges.
Patch Information 🩹
The new firmware version 1_1.1.7 Build 20240510 mitigates the issue by discarding commands containing special characters.
Security Advice 🛡️
Update your TP-Link Archer C5400X router to the latest firmware immediately to protect against potential exploitation.
This fix is critical to prevent remote unauthenticated attackers from gaining control over your device.
Background 🏞️
The flaw was discovered by German cybersecurity firm ONEKEY, emphasising the importance of securing wireless device configuration APIs.
The disclosure follows recent vulnerabilities in other networking devices, highlighting ongoing security challenges.
Now, on to today’s hottest cybersecurity news stories:
💬 BreachForums is back with a brand new agenda 🆕
🌙 Introducing Moonstone Sleet, N. Korea's latest 🥡
🏧 Brazilian banks hit with AllaKore variant = AllaSenha 👨💻
Just two weeks after a major U.S. law enforcement takedown, the notorious BreachForums is back in action at breachforums[.]st! 🚀 The revival was announced by ShinyHunters, who is now selling a massive 1.3 TB database of 560 million Ticketmaster customers for $500,000. 😲
What's Inside? 📦
The database allegedly contains:
● Full names, addresses, email addresses, phone numbers
● Ticket sales and event info
● Last four digits of credit cards and expiration dates 💳
Sign-Up Required! ⚠️
Visitors now need to sign up for an account to view content. 📝
Law Enforcement Strikes 👮
Earlier, U.S. authorities dismantled BreachForums and seized its domains (.st/.cx/.is/.vc) and Baphomet’s Telegram channel. The FBI is reviewing backend data. 🕵️♂️
Who's Behind It? 👤
It's unclear if the current ShinyHunters is the original hacker. The domain was reportedly reclaimed from NiceNIC. Is it a honeypot? Cybersecurity experts are sceptical. 🤔
A Brief History 📜
BreachForums rose in March 2022 post-RaidForums' shutdown and re-emerged in mid-June 2023 after another takedown. The DoJ and FBI have yet to comment on the latest developments. 🕶️
Stay tuned for more updates on this unfolding cyber drama! 🌐
A new North Korean cyber threat actor, Moonstone Sleet, is targeting software, IT, education, and defence sectors with sophisticated ransomware and malware. 🚀 This group is closely linked to the infamous Lazarus Group.
Deceptive Tactics 🎭
Moonstone Sleet sets up fake companies and job offers, using trojanized tools, malicious games, and custom ransomware. They employ both tried-and-true and unique methods to achieve their goals. 🎭
Fake Jobs and Malicious Tools 🛠️
● Fake job offers and companies lure targets in
● Trojanized tools like modified PuTTY drop malicious payloads
● Malicious npm packages delivered through LinkedIn and freelancing sites 🧑💻
Dangerous Malware 👾
Their attacks involve:
● Custom ransomware FakePenny
● Malicious game DeTankWar with embedded malware loaders 🎮
● Credential theft from the Windows LSASS process 🛡️
Unique Strategies ♟️
Moonstone Sleet creates fake companies (e.g., C.C. Waterfall, StarGlow Ventures) to approach targets, often posing as blockchain or software development firms. Emails often include tracking pixels to gauge interest. 📧
Recent Attacks ⚔️
Recent campaigns include targeting defence companies with ransomware demanding $6.6 million in Bitcoin. Microsoft urges vigilance against supply chain attacks. 💼
Evolving Threat 🐒
Moonstone Sleet’s tactics have evolved from other North Korean threat actors, demonstrating their growing sophistication and ambition. Stay alert and secure! 🚨
Stay ahead of the curve with Presspool.ai! 🚀 Subscribe to their newsletter for the latest buzz in the information technology space, with a special focus on AI. Their slogan says it all: "Actionable marketing insights for the visionary AI executive." 🤓💡 That’s us, alright! 🤵 How about you? Visionary AI executive, much? 👀
And if the newsletter gets your motor running then you can take a butchers at their cool AI marketing product too which is sure to help you make the most of our new artificial overlords and put them to work for your business 🤖👩💻🌐
Rest assured, the process is very straightforward.
You simply:
🆕 Sign Up & Create Campaign
📊 Define your audience, budget, and message to captivate your audience.
🚀 Launch your campaign, as Presspool’s AI matches it with ideal newsletter audiences for optimal reach and conversions. 🎯
🕵️ Finally, you leverage real-time analytics to track performance and refine future strategies. 📈 Elevate your marketing game and stay informed with Presspool.ai! 🌟 Simples! 🦦
Presspool.ai 📰🏊🤖 may just have what you need to succeed. And if the product isn’t for you, the newsletter alone is a gamechanger. And we know newsletters 😉
Brazilian banks are facing a new cyber threat: a custom variant of the AllaKore RAT called AllaSenha. This malware targets banking credentials using Azure cloud for command-and-control. 🏦
Who’s at Risk? ❓
Targets include major banks like Banco do Brasil, Bradesco, Itaú Unibanco, and more. The attack likely starts with phishing messages containing malicious links. 📧
How It Works 🛠️
● LNK File Trick: A malicious shortcut file (NotaFiscal.pdf.lnk) is disguised as a PDF.
● BAT Payload: Launches a Base64-encoded PowerShell command.
● Python and DLL: Downloads Python, runs a script (BPyCode), and loads a DLL in memory. 🐍
Malicious Operations 😈
AllaSenha steals credentials and captures 2FA codes using overlay windows. It can even trick users into scanning QR codes for fraudulent transactions. 😱
Key Findings 🔑
● Cloud C2: Uses Microsoft Azure Functions for flexible infrastructure.
● Portuguese-Speaking Developer: Likely linked to a user named bert1m.
● High Productivity: Latin American threat actors are prolific in cybercrime campaigns.
Wider Impact 🌐
These attacks, while focusing on Latin America, often affect global companies. Malspam campaigns with banking trojans like Casbaneiro are also targeting financial data. 📊
Mobile Threats 📱
Not just Windows – Android banking trojan Anatsa infiltrated the Google Play Store, disguised as productivity apps, stealing banking credentials through overlays. 📲
Stay Vigilant! 👀
Protect your accounts and stay aware of phishing tactics. Cybersecurity measures are crucial to defending against these sophisticated attacks. 🛡️
See you next week, cyber squad 🥂
🗞️ Extra, Extra! Read all about it! 🗞️
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
🛡️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday 📅
💵 Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for 🆓
📈 Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future 👾
Let us know what you think.
So long and thanks for reading all the phish!
