Russian Bears, Auto Supplier Hosed, Parse Bug No Game, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 23 June, 2022
Episode 251 - 23 June 2022
Russian Bears- https://threatpost.com/fancy-bear-nuke-threat-lure/180056/
Auto Supplier Hosed -
https://www.reuters.com/technology/japanese-automotive-hose-maker-nichirin-hit-by-ransomware-attack-2022-06-22/
NIMble Trooper- https://thehackernews.com/2022/06/chinese-hackers-distributing-sms-bomber.html
SMA UNIX Root -
https://www.securityweek.com/sma-technologies-patches-critical-security-issue-workload-automation-solution
Parse Bug No Game -
https://portswigger.net/daily-swig/severe-parse-server-bug-impacts-apple-game-center
Hi, I’m Paul Torgersen. It’s Thursday June 23rd, 2022, and from Chicago‘s O’Hare airport, this is a look at the information security news from overnight.
From ThreatPost.com
Russian APT group Fancy Bear is targeting Ukranians with a phishing campaign that uses the threat of nuclear war to exploit the Microsoft Follina vulnerability. The goal is to deliver a .Net stealer that can nab credentials from the Chrome, Firefox and Edge browsers. The group is strongly believed to be working at the behest of Russian Intelligence.
From Reuters.com:
Japanese automotive hose maker Nichirin said that a U.S. subsidiary had been hit by a ransomware attack that has forced it to entirely shut down its computerized production controls. The company has switched to manual production and shipping in order to keep parts flowing to customers. No word on the threat actor or malware strain.
From The HackerNews.com:
A threat cluster out of China with ties to a hacking group called Tropic Trooper has been spotted using a previously undocumented malware coded in Nim language. The novel loader, dubbed Nimbda, is bundled with a Chinese language 'SMS Bomber' tool that is most likely illegally distributed in the Chinese-speaking web. The Nim loader has the same executable icon as the SMS Bomber, so the entire bundle works as a trojanized binary. More details in the article.
From SecurityWeek.com:
A critical vulnerability in the SMA Technologies OpCon UNIX agent results in the same SSH key being deployed with all installations. The installation files also include a corresponding, unencrypted private key named “sma_id_rsa.” An attacker with access to that key can gain SSH access as root on affected systems. The key even remains on the system after the OpCon software has been removed. Details and a link to the advisory in the article.
And last today, from PortSwigger.net
A vulnerability in Parse Server software has led to the discovery of an authentication bypass impacting Apple Game Center. Exploitation of this 8.6 severity bug could result in authentication being bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Attack complexity is considered low and no privileges are required. A fix has been issued, so get your patch on kids.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.