Brief #35: Russian Hack Hits Microsoft, Naz.API Breached

TL;DR

Microsoft Top Executive's Emails Breached by Russian State-Sponsored Hackers

Overview of the Breach: Russian state-sponsored hackers, identified as Midnight Blizzard or Cozy Bear, infiltrated Microsoft's corporate systems, specifically targeting senior leadership and employees in cybersecurity and legal departments. The breach, disclosed by Microsoft, involved a password spray attack on a legacy account, granting access to a small percentage of corporate emails.
Hackers' Objectives and Techniques: The attack, initiated in November 2023, sought to determine what Microsoft knew about the hackers themselves, rather than traditional corporate espionage. This reflects a shift in the motives of state-sponsored cyber actors. Microsoft's investigation revealed the use of a password spray attack, a method involving the application of commonly used passwords across multiple accounts.
Impact and Response: Microsoft's response underscores the evolving challenges in cybersecurity. The company stressed the absence of evidence indicating access to customer data, production systems, source code, or AI systems. Microsoft emphasized accelerating security upgrades, even at the cost of disrupting existing business processes, to fortify against such sophisticated threats.
Regulatory and Global Implications: This incident gains significance in light of new U.S. Securities and Exchange Commission (SEC) regulations requiring prompt disclosure of cyber incidents. Microsoft's disclosure follows these guidelines, highlighting the growing interplay between cybersecurity and regulatory compliance. The attack also illustrates the persistent threat from well-resourced nation-state actors like Midnight Blizzard.

Naz.API Breach Exposes One of the Largest Password Dumps of Over 70 Million Credentials

Scope and Nature of the Breach: The Naz.API dataset is a monumental breach involving over 70 million unique email addresses. Compiled from credential stuffing lists and data stolen by malware, this breach encompasses 319 files totaling 104GB. Notably, one-third of these email addresses were not previously known in data dumps, indicating a significant volume of new data.
Origin and Composition of Data: The dataset's origins lie in stealer logs, which are collections of credentials harvested from compromised machines. This method indicates a high level of organization and intent behind the data theft. The Naz.API breach is unique in its scale and the manner of data collection, including text files and images compiled into archives and uploaded to remote servers for later collection by attackers.
Impact and Authentication Security Insights: The Naz.API data leak underscores the continued vulnerability of online accounts and the importance of robust authentication measures. While many of the passwords may be old, the sheer volume of data makes it a valuable resource for attackers conducting credential stuffing attacks. Cybersecurity experts recommend the use of password managers, multi-factor authentication (MFA), and robust detection mechanisms against brute force attacks.
Response and User Awareness: The dataset's inclusion in the Have I Been Pwned service allows individuals to check if their email addresses have been impacted, promoting greater user awareness. This incident highlights the need for continuous vigilance and proactive measures both by individuals and organizations to protect against the evolving landscape of cyber threats.

Google Chrome Zero-Day Lets Attackers Steal Your Secrets

Details of the Vulnerability: Google has addressed a critical zero-day vulnerability (CVE-2024-0519) within the Chrome V8 JavaScript engine. This high-severity out-of-bounds memory access issue allows attackers to access data beyond the memory buffer, potentially leading to sensitive information access or system crashes. The vulnerability could also be exploited to bypass security mechanisms like ASLR, making further code execution via other vulnerabilities easier.

Nature of the Exploitation: The CVE-2024-0519 has reportedly been actively exploited, although specific details of the incidents remain undisclosed by Google. This vulnerability highlights the ongoing risks associated with browser security and the sophistication of attackers in exploiting such flaws. It's a reminder of the necessity for constant vigilance and regular updates in cybersecurity practices.

Update and Patch Information: Google released a security update for Chrome (version 120.0.6099.234 for Mac, 120.0.6099.224 for Linux, and 120.0.6099.224/225 for Windows), which users are encouraged to install immediately. While Chrome can automatically check and install updates, users are advised to manually verify their browser version due to the severity of the vulnerability.

Related Security Fixes and Implications: Alongside CVE-2024-0519, Google also patched two additional high-risk memory safety issues in the V8 engine - CVE-2024-0517 (out of bounds write) and CVE-2024-0518 (type confusion). These vulnerabilities demonstrate the complexity and multifaceted nature of security threats in widely used software like Chrome and the importance of comprehensive security strategies.

Phemedrone Stealer Malware Exploits Patched Windows SmartScreen Vulnerability

Infection Mechanism and Payload Delivery: Attackers use the CVE-2023-36025 vulnerability in Windows Defender SmartScreen to distribute Phemedrone Stealer malware. The malicious URL files are hosted on Discord or other cloud services, and once executed, they download and execute a control panel item (.cpl) file. This file calls rundll32.exe to execute a malicious DLL, acting as a loader for the next stage hosted on GitHub, which leads to the deployment of the Phemedrone Stealer payload.

Capabilities of Phemedrone Stealer: Phemedrone Stealer is a potent information-stealing malware that targets data contained in the device's memory, user files, browser cookies, passwords, and autofill data. It also targets Discord authentication tokens, Steam and Telegram authentication files, cryptocurrency wallet apps, and captures FileZilla connection details and credentials. The harvested data is compressed and exfiltrated via the Telegram API.

Exploitation of CVE-2023-36025: Despite Microsoft releasing fixes for CVE-2023-36025 in November 2023, threat actors continue to exploit this vulnerability to bypass Windows Defender SmartScreen checks. This exploitation allows attackers to deliver various malware types, including ransomware and information stealers like Phemedrone Stealer, without triggering Windows security prompts when malicious files are opened.

Recommendations for Mitigation: Organizations that have not yet updated their Microsoft Windows installations to fix CVE-2023-36025 are urged to do so immediately to prevent exploitation by Phemedrone Stealer and other malware. Users are advised to be cautious of files from unverified sources, especially those hosted on platforms like Discord, to avoid falling victim to such attacks.

VF Corporation Ransomware Attack Impacts 35.5 Million Customers

Ransomware Attack on Apparel Giant VF Corporation: VF Corporation, the parent company of popular brands such as Vans, The North Face, and Supreme, suffered a ransomware attack in December 2023, impacting 35.5 million customers. The attack led to the theft of personal information, but it's yet to be specified what kind of data was compromised.

Sensitive Information Remains Secure: VF Corp assured that customers' Social Security numbers, bank account information, and payment card details were not compromised as they are not stored in their IT systems. There is also no evidence suggesting that customer passwords were accessed.

Operational Impact and Recovery Efforts: The ransomware attack caused significant operational disruptions for VF Corporation, affecting their ability to fulfill orders and replenish retail store inventories. However, they have substantially restored the impacted IT systems and data, and are now operating with minimal disruption.

Ongoing Investigation and Security Measures: The company continues to investigate the incident and is working through minor operational impacts. They are also taking steps to enhance their cybersecurity measures to prevent future incidents.