Lucifer Malware Targeting Windows Machines.

New self-propagating malware, named Lucifer, was discovered recently. Malware targets Windows machines with cryptojacking and DDoS (distributed denial-of-service) attacks.

Malware is trying to find and exploit unpatched vulnerabilities. Some of them were Microsift Windows (CVE-2017-0144, CVE-2017-0145, CVE-2017-8464), Rejetto HTTP File Server (CVE-2014-6287), ThinkPHP RCE (CVE-2018-20062), Apache Struts (CVE-2017-9791), Lavarel Framework (CVE-2019-9081).

After exploiting, attacker connects to the C2 (command-and-control) server and executes arbitrary commands (TCP, UDP, HTTP DoS attack etc.).

Malware is self-propagating. It uses brute-force technique on the open TCP ports or Remote Procedure Call to get in. When in, Lucifer uses Certutil.exe command-line program to propagate itself.

PonyFinal Ransomware Attack.

Microsoft security team is warning about human-operated ransomware attacks. Attacks were reported in US, India and Iran.

In this attacks PonyFinal, a Java-based ransomware, was deployed manually by hackers.

Microsoft said that a target for intrusion is usually system management server where using a brute-force attack PonyFinal get credentials. After getting inside attackers deploys a Visual Basic script that runs a PowerShell reverse shell to steal the local data, after what attackers spread to other local systems and deploy PonyFinal ransomware.

The PonyFinal attack chain by Microsoft:

Microsoft investigates issues caused by Windows 10 update.

Recently released KB4556799 Windows 10 update which brought many important changes to the OS at the same time caused some problems for users, including breaking the internet connection.

Users’ complains on the Feedback Hub show that some users were not even able to install KB4556799, others had problems with graphics and audio.

Windows acknowledged the problem and actively engaged with Customers who were reporting the update problems.

Company is still investigating the problem and did not revealed all details. They did comment one of the problems related to LTE modems: “After installing this update on a Windows 10 device with a wireless wide area network (WWAN) LTE modem, reaching the internet might not be possible. However, the Network Connectivity Status Indicator (NCSI) in the notification area might still indicate that you are connected to the internet.”

Dates for the official update are unknown but Microsoft says mentioned issues will be fixed in upcoming release.

Microsoft 365: New Phishing Campaign.

Microsoft warns that cybercriminals already adapted their phishing campaigns to the new Microsoft 365 and Azure AD interfaces.

Microsoft mentioned in Twitter that “Office 365 ATP data shows that attackers have started to spoof the new Azure AD sign-in page in multiple phishing campaigns”.

Three months ago, Microsoft has updated Azure AD interface to lower bandwidth requirements for sign-in page loading:

Microsoft noticed that hackers already adopted their phishing campaigns. The recent one was an email with PDF attachment that asked users to sign-in for viewing it. Clicking to “Access document” button victims were redirected to a fake “Azure AD sign-in page”:

Microsoft warns users to be careful and pay attention to the new phishing campaigns.

Microsoft May 2020 Patch Tuesday: 111 Vulnerabilities Fixed.

This month Microsoft has patched 111 vulnerabilities across 12 different products, including Windows, Edge, Office, Visual Studio and IE.

16 of 111 were rated as “Critical” and 95 were rated as “Important”.

It’s a third-largest update in Microsoft’s history (115 bugs were patched in March and 113 in April), but in opposite from previous months no actively-exploited vulnerabilities were found in this release.

Here is a list of the most severe flaws:

·      CVE-2020-1071 – Windows Remote Access Common Dialog Elevation of Privilege Vulnerability 

·      CVE-2020-1135 – Windows Graphics Component Elevation of Privilege Vulnerability –

·      CVE-2020-1067 – Windows Remote Code Execution Vulnerability

·      CVE-2020-1023, CVE-2020-1024, and CVE-2020-1102 – Microsoft SharePoint Remote Code Execution Vulnerability

·      CVE-2020-1051, CVE-2020-1174, CVE-2020-1175, and CVE-2020-1176 – Jet Database Engine Remote Code Execution Vulnerability

·      CVE-2020-1064 – MSHTML Engine Remote Code Execution Vulnerability

·      CVE-2020-1096 – Microsoft Edge PDF Remote Code Execution Vulnerability

You can check the full list of fixes here.