News of the Cyber World

[kyonides]

FBI warns that Hive ransomware hackers

are calling victims by phone

Scammers affiliated with a digital extortion outfit known as Hive are using phone calls to dial victims who are infected with a malicious software strain that locks up their files until they agree to pay a hostage fee, according to an August 25 FBI alert. Investigators first observed hackers deploying the malware in June, with attackers leveraging Microsoft’s Remote Desktop Protocol to infect business networks.
In some cases, if victims don’t pay the demanded fee within two to six days, they have reported receiving phone calls from the hacking group. It’s the latest iteration of a personal tactic pioneered by other gangs — Maze, Conti and Ryuk, for instance — in which malware operators are thought to outsource tasks to a call center. Security firms Emsisoft and Coveware reported earlier this year that attackers with non-English accents were phoning more ransomware victims.
In this case, if victims refuse to pay the ransom, hackers threaten to leak stolen files on “HiveLeaks,” a dark-web site. Victims listed on the site include companies in a range of industries, from financial services to manufacturing, with listed revenues between $2 million and more than $100 million.

Hackers exploit WhatsApp modification tool
to snoop on texts, force paid subscriptions

A malicious version of a popular modification or “mod” of the encrypted messaging app WhatsApp is carrying a mobile trojan that can launch advertisements, issue paid subscriptions and intercept text messages, security researchers said Tuesday.
According to Kaspersky, hackers inserted the Triada trojan into a modified version of FMWhatsapp, a WhatsApp mod. Such mods have a following among users who want to customize WhatsApp, such as being able to send larger files or apply custom animated themes.
FMWhatsapp isn’t available on the Google Play store and is only available via third party websites, which means users who desire the extra features the mod offers don’t get the security protections inherent in more officially-vetted apps.
Kaspersky first spotted Triada in 2016, when the company deemed the hacking tool “one of the most advanced mobile Trojans our malware analysts have ever encountered.”
Users grant FMWhatsapp permission to read SMS messages, Kaspersky said, simultaneously granting the trojan access to text messages, too. Hackers inserted Triada into the modified FMWhatsapp along with the advertising software development kit. That’s similar to something that happened with the APKPure app used to download unavailable Android apps.

Microsoft Azure vulnerability exposed thousands of cloud databases

Microsoft is warning customers of its Azure cloud platform about a software vulnerability that exposed data belonging to thousands of clients for roughly two years.
The flaw would have allowed any Azure Cosmos DB user to read, write and delete another customer’s information without authorization, researchers found. Cosmos DB is used by thousands of organizations, including Coca Cola, Exxon Mobil and a number of other Fortune 500 companies. Microsoft has since resolved the issue, the company said.
There was no evidence that hackers or any other outsider exploited the vulnerability to access customer data, according to the company.
Reuters first reported on the vulnerability, which was discovered by Wiz research team.
Microsoft fixed the vulnerability within 48 hours of its disclosure on August 12, but that the vulnerability had been exploitable since mid-2019, according to Wiz researchers. Microsoft notified roughly over 30% of its clients about the data exposure, but researchers warn that the effects were likely more widespread.
...
Microsoft has asked customers to reset keys to their accounts as a precautionary measure, according to an email sent from the company to customers shared by a Wiz researcher.

It's curious to see how often MS apps and services have been targeted by hackers or even their own clients in the last year.