Breach Roundup: More Fallout From the LockBit Takedown – Source: www.databreachtoday.com

LockBit Takedown Shutters 14,000 Email Accounts

Avast to Pay $16.5 Million to End US FTC Investigation

Russia-Linked Group Targets European Mail Servers

No Indication That AT&T Outage Is a Cyberattack

A Thursday morning network outage at AT&T, the largest U.S. cellular carrier, shows no evidence of being the work of a cyberattacker. As of late morning, the telecom giant said that it had restored three-quarters of its network. AT&T serves 217 million mobile customers, according to its most recent annual report.

“The FBI is in contact with AT&T regarding today’s network outage. Should we learn of any malicious activity we will respond accordingly,” a bureau spokesperson said in an emailed statement.

ABC News reported that the U.S. Cybersecurity and Infrastructure Security Agency in an early morning memo concluded that “there are no indications of malicious activity.”

Sources told CNN the issue appears to stem from a flaw in the peering handoff between networks. An academic told the network that the outage may have been caused in the company’s cloud-based networking system. “The dirty secret of telecom networks these days is they are just a bunch of wires and towers connected to the cloud,” said Lee McKnight, an associate professor at the Syracuse University School of Information Studies.

An astrophysicist took to Twitter to debunk a suggestion that a massive solar flare had caused the interruption. Although there was a large flare, it occurred while North America was in night time. “Flares only cause radio degradation on the *dayside* of the Earth,” said Ryan French.

U.S. Sen. Marco Rubio said on Twitter that he doesn’t know the cause of the outage. “But I do know it will be 100 times worse when #China launches a cyber attack on America on the eve of a #Taiwan invasion And it won’t be just cell service they hit, it will be your power, your water and your bank,” wrote the Florida Republican.

A vulnerability in Apple’s Shortcuts automation application could allow attackers to access sensitive user data, Bitdefender said in a Thursday blog post. Tracked as CVE-2024-23204, the vulnerability allows an attacker to create on unpatched Apple devices a Shortcuts file that can bypass Apple’s security framework and access sensitive data on the target system. Apple patched the flaw on Jan. 22.

Shortcuts is an app designed for macOS and iOS devices that enables users to automate a wide range of actions, from simple tasks such as sending messages to complex operations involving multiple applications. The vulnerability allows attackers to craft a Shortcuts file that bypasses the Apple Transparency, Consent and Control security framework, which ensures that apps obtain user permission before accessing data. Bitdefender researchers said were able to use the Expand URL function to bypass TCC. “The method involves selecting any sensitive data (Photos, Contacts, Files and Clipboard Data) within Shortcuts, importing it, converting it using the base64 encode option, and ultimately forwarding it to the malicious server.”

Bitdefender urged users to ensure they are running the latest macOS, iOS and iPadOS software.

Microsoft on Wednesday unveiled expanded logging capabilities for federal agencies, after a successful pilot involving the Cybersecurity and Infrastructure Security Agency, the Office of Management and Budget and the Office of the National Coordinator for Health Information Technology. The enhanced logging features will be available to all agencies that use Microsoft Purview Audit, without additional cost.

The computing giant in July pledged to expand access to logs at no additional cost after lower-tier customers were unable to detect a Chinese cyberattack due to a paucity of logging data. “Asking organizations to pay more for necessary logging is a recipe for inadequate visibility into investigating cybersecurity incidents,” CISA Executive Assistant Director Eric Goldstein said in a blog post at the time (see: Microsoft Expands Logging Access After Chinese Hack Blowback).

Microsoft’s announcement didn’t earn it universal plaudits. “Microsoft doesn’t deserve any praise for caving to pressure and announcing that it will no longer gouge its customers for additional fees for basic features like security logs,” U.S. Sen. Ron Wyden told CyberScoop. “Like an arsonist selling firefighting services, Microsoft has profited from the vulnerabilities in its own products and built a security business generating tens of billions of dollars a year. There is no clearer example of the need to hold software companies liable for their negligent cybersecurity,” the Oregon Democrat added.

Android banking Trojan Anatsa is a threat to users across Europe through malicious apps distributed through the Google app store, online fraud detection firm ThreatFabric reported.

Company researchers in November detected a resurgence of the Trojan and a push by its operators to move away from targeting victims in the United Kingdom, Germany and Spain by including mobile device users in Slovakia, Slovenia and the Czech Republic.

The Trojan gets around some Android security features by first holding back on delivering malicious code. In one case, developers posted onto Google Play a harmless cleaner app. Like many Trojans, the app requested access to the Android AccessibilityService, an operating system feature meant to allow developers to adapt apps to users with disabilities. Google has cracked down on AccessibilityService abuse by requiring developers to provide a clear explanation for why the app needs access.

Anatsa developers told users the cleaner app needed access to” hibernate draining apps.” Because the app was not malicious, it apparently raised no flags. “However, a week after its release, an update introduced malicious code,” ThreatFabric said.

ThreatFabric said the Trojan’s latest campaign involves five droppers that have been installed more than 100,000 times. “We anticipate the continuation of this campaign, with new droppers appearing in the official store and an expansion into additional targeted regions,” the firm said.

A joint advisory from German domestic intelligence service the Federal Office for the Protection of the Constitution – known as the BfV – and South Korea’s NIS revealed a cyberespionage campaign orchestrated by North Korean state-sponsored threat actors targeting defense sectors worldwide. The alert highlighted an attack against a maritime technology research center made through a third-party web server maintenance firm.

North Korean hackers breached the company and stole secure shell credentials to remotely access the research center’s web server and initiated lateral movement by stealing account credentials of a security manager. They impersonated the manager to email the maintenance firm a request to distribute a patch file containing malicious functions. The genuine security manager was able to block the attempt in time, the advisory says.

Hold on to your conchas – baking giant Grupo Bimbo has suffered a ransomware attack by the Medusa ransomware group. According to various reports, the attack targeted critical systems within the organization, potentially exposing sensitive data.

The ransomware group demanded a payment of $6,500,000 in exchange for returning control over exfiltrated data. Grupo Bimbo began as a bakery in Mexico City in 1945 and has since expanded into a global presence through brands that include Tía Rosa, Pullman, Sara Lee, Thomas’ and Arnold, as well as baked goods sold under the Bimbo brand.

Other Coverage From Last Week

• Russia Announces Arrest of Medibank Hacker Tied to REvil
• ScreenConnect Servers at High Risk as POC Becomes Public
• Wyze Security Incident Exposes Private Cameras
• JetBrains Patches Authentication Bypass Flaw in TeamCity
• Experts Praise White House Port Cybersecurity Initiatives
• Vastaamo Hacker Disappears Amid Ongoing Trial

With reporting from Information Security Media Group’s Akshaya Asokan in southern England; David Perera in Washington, D.C.; Mihir Bagwe in Mumbai, India; and Prajeet Nair in Bengaluru, India.