AT&T Suffers Major Breach, APT40 Prompts CISA Advisory, CyberCrime Kingpin Jailed, and more
July 16, 2024 - Issue #3
Have any feedback or ideas? I’d love to hear from you. You can reach me on [email protected].
Story Of The Week
AT&T Breached, Data On “Almost All” Customers Stolen
AT&T is the latest (and possibly largest) company to announce a breach related to an ongoing campaign targeting customers of the cloud provider Snowflake. Despite some reports suggesting that Snowflake itself was breached, Mandiant has clarified that the breaches they investigated were due to threat actors obtaining the login credentials of Snowflake customers, not staff, via infostealers.
Whilst many of us are accustomed to T-Mobile’s bi-weekly data breach announcements, AT&T’s appears to be significantly more severe. The stolen data reportedly includes call and text metadata, rather than just subscriber phone numbers and billing addresses. While there is no indication that recordings of calls or SMS message content were taken, the metadata alone, which details when, where, and to whom a call or text was made, could be leveraged for surveillance and extortion.
Typically, threat actors will indiscriminately infect systems with infostealers, selling harvested login credentials in bulk to a third party broker. These credentials are then listed for sale on the dark-web, where other threat actors can search for them by associated domain, email, IP, and more. In this case, it’s likely that threat actors were searching for Snowflake credentials, and stumbled across several high value customer’s login information in the process.
Update (2024-07-14): according to Wired, the AT&T hacker reports that they were paid $370,000 by AT&T to delete the data, which has been corroborated by security researchers. It’s somewhat strange that the threat actor is live-reporting their activities to the media, as this could impact their likelihood of being paid in the future. But regardless, there’s no way to confirm they actually deleted the data, nor that they hadn’t already sold it on.
Cybercrime Kingpin ‘Tank’ Sentenced To 9 Years Prison After Over A Decade On The Run
Vyacheslav Igorevich Penchukov, known by his online name “Tank”, is a Ukrainian cybercriminal who’s been active since before I even stated studying cybersecurity. He later made a name for himself as part of the Zeus malware gang, which later evolved into JabberZeus, then GameOverZeus. Often referred to as simply “Business Club”, this group was possibly the most organized cybercrime group of its time, perhaps even to date.
The gang’s over a decade long crime spree is hard to summarize in such a short piece, but I’ll try my best here. Their leader, Evgeniy Bogachev (AKA Slavik), was the creator of the infamous Zeus malware, and the first public case study detailing the close ties between Russian cybercriminals and Russian Intelligence [1].
In 2010, the FBI launched a massive operation to apprehend several key members of the group, in coordination with Russian and Ukrainian law enforcement. The operation fell apart when Tank disappeared hours before his impending arrest, despite being actively tailed by operatives from the Ukrainian Security Services (SBU). The FSB then ghosted US and Ukrainian authorities, never following through with any arrests within Russia.
It was later discovered that a corrupt SBU operative tipped off Tank, enabling him to evade capture. Another member, who was residing in the US at the time, was also able to escape, fleeing the country inside a shipping container [2].
While the story of Tank’s arrest and prosecution isn’t one that’s particularly interesting, the backstory of the Zeus crew is near the top of my must-read list for anyone interested in malware, threat intelligence, or just curious about how major cybercrime groups operate.
CISA, ACSC, Release Warning About China-Backed APT40
CISA, in partnership with Australia’s Cyber Security Center, has released an advisory detailing known tools, techniques, and procedures (TTPs) of APT40, as well as several case studies on known intrusions. It’s definitely a must read if you want to get some insight into a major state-sponsored APT.
APT40 (also known as Volt Typhoon) is, in my opinion, one of the more intriguing state-sponsored threat actors. They were behind the mass zero-day exploitation of MS Exchange servers in 2021, as well as a huge SOHO Router Botnet discovered in 2022. This group typically prefers exploitation of edge devices over social engineering attacks. They’ve been known to quickly weaponize public proof-of-concepts for known vulnerabilities, as well as run riot with the occasional zero-day exploit.
In January 2024, the DOJ announced they’d taken down a botnet of SOHO routers, which had been linked to APT40. The threat actors had reportedly been using this botnet to route attack traffic and conceal hacking attempts against US critical infrastructure. APT40 is known to utilize US-based systems to launch attacks, attempting to exploit the USIC’s legal limitations regarding domestic surveillance.
SquareSpace Vulnerability Leads To Mass Domain Hijacking
This comes as fallout from Google’s decision to shut down their domain registrar, selling all their assets (including customers) to SquareSpace. If you were a Google Domains customer, your domain is likely now hosted by SquareSpace, though many are not aware of this.
In order to facilitate seamless migration, it appears SquareSpace pre-registered the emails of Google Domains customers on their platform. All a customer has to do to finalize their account transfer is to register using an email address previously used for their Google Domains account.
Unfortunately, it seems that SquareSpace doesn’t require email verification, leaving customers open to account hijacking. All an attacker needs to do is register an account with an email that matches that of an ex-Google customer who hasn’t yet migrated their account. After completing signup, the attacker will have full control over all the customers domains. Since the administrative email is often listed in the WHOIS record, this can be very trivial to find.
Currently the attacks seem to be mostly cryptocurrency focused, with threat actors hijacking and redirecting Web3 based domains, then trying to phish users for their wallet details.
I can imagine this is pretty disappointing for ex-Google customers, especially those who signed up expecting the strong security and privacy that Google services are known for, only to have their data sold off to the highest bidder without their consent.
One of Generative AI’s few strong suits, generating large quantities of spam, has been getting its fair share of use in political discourse lately. Many state actors utilize “bot farm” to sew political division abroad. Typically, these farms employ human operators to manually post inflammatory political content to social media platforms from scores of fake online personas. These operations seek to cause civil unrest by driving wedges between opposing ideologies. The accounts often play into extremes and start fights with representatives of opposing groups, giving people the impression that the average person on the other side of an issue is dangerous and cannot be reasoned with.
Recently, many of these human operated bot farms have turned to Generative AI in order to maximize the amount of social media users they can annoy at any one time. Combined with several online platform’s illogical and short-sighted decisions to relax moderation and allow users to purchase verified accounts, these new kinds of bots have spread rapidly, often gaining large followings.
The DOJ were able to take out one such bot network after discovering that all the social media accounts were tied to email addresses on a single domain hosted by the farm’s operators. The bot farm was alleged to have been developed by Russian state-owned media agency Russia Today, who when asked for comment responded with “Farming is a beloved pastime for millions of Russians”.
NYTimes Reports OpenAI Was Hacked In 2023, But Breach Was Never Publicly Disclosed
Citing multiple anonymous sources, the New York Times reports that hackers were able to breach one of OpenAI’s internal messaging systems, which was used by employees to discuss company matters. The attackers were able to lift sensitive documents pertaining to OpenAI’s system designs.
Why are we only hearing about this now, in mid-2024? Well, apparently OpenAI decided that since no customer or partner data was breached, the intrusion didn’t warrant disclosure, thus only internal employees were informed. The report goes on to claim that OpenAI believed that the attackers were non state-affiliate, and therefore there was no national security risk, and declined to notify the FBI.
Whilst, there is no requirement to disclose breaches that don’t affect customers and aren’t a national security risk, this one seems a little concerning. The article doesn’t mention how they came to the conclusions that the threat actor was non-state affiliated, or that there was no risk of the hackers passing any lifted information back to a hostile state.
Given that we know for a fact there are several hostile states that determined to advance their AI technology, and are willing to breach foreign company systems to steal schematics, it seems very strange that law enforcement wasn’t involved. It’s giving strong “we investigated ourselves and found no wrongdoing” energy. Considering the risk that both AI and all the sensitive user data it processes pose, I would have expected at least the FBI to be notified.
RockYou2024, Yet Another Overhyped Database Compilations
Being Touted as “The largest data breach ever”, RockYou2024 seems to be yet another low effort compilation of old-data breaches. Typically, what happens is hackers will create credential lists by extracting records from previous public breaches, which then themselves end up getting counted as breaches.
RockYou2024 seems to be largely low quality, with over 1.5 Billion records constituting hex data (typically associated with password hashes which haven’t yet been cracked). This seems to suggest the breach was the result of indiscriminately concatenating data from other breaches, without first determining if the data contained raw or hashed passwords.
1.1 Terabyte Of Data From Disney’s Internal Slack Leaked Online After Breach
The group behind the hack, NullBulge, claim to be a hacktivist group with the goal of protecting the rights of creatives. Their website states they are strongly against promoting cryptocurrency, IP theft, and use of generative AI to undermine creators. However, SentinelOne believe this may be a mask, and that they are simply just another for-profit ransomware group.
The group were able to scrape and leak internal files and messages from Disney’s slack server, including source codes, details of unreleased projects, hiring decisions, and photos of employees pets. It’s currently unclear how the hackers gained access, but some have speculated it was through purchasing an employee’s credentials from an infostealer database.
Some media outlets have been claiming that the group is linked to LockBit, which appears to be based entirely on them having previously deployed ransomware built using the leaked LockBit 3.0 builder. Given that said LockBit builder was publicly leaked and anyone can get their hands on it, I’m not really sure how this logic makes sense.
CVE-2024-38074, CVE-2024-38076, CVE-2024-38077 - Microsoft Remote Desktop Licensing Server RCE
By far the most severe of this month’s Patch Tuesday roundup, these 3 vulnerabilities all have a CVSS score of 9.8 out of 10. I had planned to personally investigate these, but upon finding out I’d need to purchase a license for my licensing server as well as a license for the licensing server’s licensing service for licensing my licenses, I decided that was simply too much licensing and gave up.
My understanding is that these vulnerabilities don’t affect systems running a remote desktop server, but rather the system running the licensing service (only if you have Remote Desktop Licensing enabled). Typically this would be a dedicated licensing server, or a remote desktop session host. In both cases, these systems are likely to be more priveledged that the average RDP endpoint, so definitely one worth addressing swiftly. Currently there’s no public proof-of-concept yet, but several researchers appear to be working on them.
Reported in June, this vulnerability allows an attacker to gain remote code execution on certain systems running PHP via CGI. Affected versions are 8.1.*, before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8.
Public exploit code exists and the vulnerability is currently being mass exploited in the wild.
Affecting EXIM version up to 4.97.1, this bug allows attackers to bypass file extension blocking. Although the vulnerability doesn’t directly enable compromising of any systems, it could be leveraged to send emails with attached filetypes that would typically be restricted (such as high-risk filetypes like exe, scr, and com). A public proof of concept is available, so it’s possible we may see this vulnerability leverage to send malspam.
Unlike the previously patched Outlook vulnerability, this one doesn’t require user authentication. But similar to last time, there seems to be a disconnect between the severity assigned by Microsoft and the severity assigned by the discoverer. Just like last time, Morphisec is claiming the vulnerability should be rated ‘critical’, though Microsoft have only rated it is ‘important’.
Whilst Microsoft have been known to get it wrong from time to time, they’re typically pretty good at ranking vulnerabilities. Given that Morhpisec buried the lead in their last article, neglecting to mention that their “critical zero-click vulnerability” required the attacker to be logged in as the user, I’m leaning towards siding with Microsoft on this one.
I’m not sure what the catch is here, since a remote code execution vulnerability that requires little to no user interaction would typically be rated critical. But, I’m betting Microsoft knows something we don’t. Either way, I’d play on the safe side, as this is more serious than the previous one.
