Category: Vulnerability News

In the wake of the devastating Los Angeles wildfires, cybercriminals are exploiting the crisis to scam unsuspecting victims and good Samaritans. As individuals and organizations rally to provide relief and support, scammers are leveraging the panic and goodwill to steal money and sensitive information. A recent investigation by the cybersecurity company Before AI sheds light on these fraudulent tactics and provides valuable insights into how to stay safe.

Fraudulent Domains Targeting Victims

Between January 8th and January 13th, 2025, BforeAI identified 119 suspicious domains registered at the height of the wildfire crisis. These domains were strategically designed with keywords such as “LA fire,” “wildfire,” “relief,” “fund,” and “rebuild,” aiming to capitalize on trending topics in the media. Half of these domains were registered through GoDaddy, a web hosting service recently criticized by the Federal Trade Commission for inadequate cybersecurity measures. Other platforms involved include Namecheap, Register, Ionos, Hostinger, Squarespace, and Tucows.

Scammers have also taken advantage of top-level domains (TLDs) to build credibility. Seventy percent of the fraudulent sites used the “.com” TLD, while others opted for “.fund,” subtly hinting at their malicious intent to steal donations from unsuspecting victims.

Fake GoFundMe Campaigns

A significant number of fake GoFundMe campaigns emerged during the wildfires. These campaigns often tugged at heartstrings by showcasing injured or lost pets purportedly affected by the fires. However, many of these images were stolen from other sources, including previous scam campaigns or unrelated legitimate fundraisers.

One fake campaign, titled “Aid Our Recovery from LA Fire Tragedy,” claimed to support a dog injured by the wildfires. However, the photo used was traced to an unrelated fundraiser for a dog battling cancer.

Scammers also posed as individuals and organizations offering shelter and care for displaced animals. Their fraudulent activities not only misdirected funds away from legitimate causes but also exploited the trust of well-meaning donors.

Merchandise and Cryptocurrency Scams

Beyond fake fundraisers, scammers launched merchandise stores falsely claiming to support wildfire victims. Some even impersonated the Los Angeles Fire Department, selling items supposedly tied to relief efforts.

Additionally, new cryptocurrency schemes surfaced, promising quick financial gains while capitalizing on the wildfire’s media attention. These “pump and dump” schemes targeted victims who had already suffered financial losses, luring them with the promise of rapid returns. Social media platforms amplified these schemes, helping scammers reach broader audiences.

How to Stay Protected

To safeguard yourself and your donations during times of crisis, follow these guidelines:

Verify Domains: Be cautious when visiting websites related to disaster relief. Look for official sites and verify their legitimacy before making any donations.

Research Fundraisers: Always verify GoFundMe campaigns and other fundraisers. Look for credible information about the organizer and cross-check photos and stories.

Avoid Impulse Donations: Take time to research organizations and campaigns. Donate directly to reputable and established charities.

Be Skeptical of Merchandise Claims: Avoid buying merchandise claiming to support relief efforts unless you can verify the seller’s authenticity.

Beware of Cryptocurrency Schemes: Avoid investing in new or unverified cryptocurrency projects, especially those tied to trending disasters.

Report Suspicious Activity: If you come across a suspicious campaign or domain, report it to the appropriate authorities or cybersecurity organizations.

Final Thoughts

The Los Angeles wildfires have left countless individuals and families in need of support. While many are stepping up to help, cybercriminals are exploiting the situation for personal gain. By staying vigilant and informed, you can ensure your contributions make a genuine difference and protect yourself from falling victim to these malicious schemes.

Summit Systems remains committed to raising awareness about cybersecurity threats and empowering individuals and organizations to navigate the digital landscape safely.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information

In a shocking revelation, a recent report by threat intelligence researchers at Zscaler has exposed the alarming prevalence of malicious applications on Google Play, the official app store for Android devices. Over the course of a year, between June 2023 and April 2024, these researchers identified and analyzed numerous malware families, uncovering a staggering number of malicious apps that have been downloaded millions of times.

The Most Common Threats

Malicious app types on Google Play
Source: Zscaler

The report highlights a disturbing trend of malicious apps disguised as legitimate tools, personalization, photography, productivity, and lifestyle applications. Among the most common threats detected were:

• Joker: An info-stealer and SMS message grabber that subscribes victims to premium services.
• Adware: Apps that generate fraudulent ad impressions by consuming internet bandwidth and battery life.
• Facestealer: Facebook account credential stealers that overlay phishing forms on legitimate social media applications.
• Coper: An info-stealer and SMS message interceptor capable of keylogging and displaying phishing pages.
• Loanly Installer, Harly, Anatsa (or Teabot), and other banking trojans targeting various financial institutions worldwide.

Most targeted countries
Source: Zscaler

Google’s Response

While Google has implemented security measures to detect and remove malicious apps, threat actors continue to find ways to bypass these safeguards. One common tactic is “versioning,” where attackers deliver malware through application updates or by loading it from external servers.

In response to Zscaler’s findings, Google has stated that the malicious versions of the identified apps have been removed from Play. They also emphasize the role of Google Play Protect, which is enabled by default on Android devices and can warn users or block apps exhibiting malicious behavior.

User Precautions

To minimize the risk of infection, users are advised to:

• Read reviews: Check for reported problems and suspicious comments.
• Verify permissions: Ensure that the app’s requested permissions align with its intended functionality.
• Be cautious of free apps: While free apps can be beneficial, be wary of those offering excessive features or promises.
• Keep your device updated: Regularly install security patches and updates to protect against known vulnerabilities.

Number of transaction blocks per month
Source: Zscaler

The Ongoing Threat

Despite Google’s efforts, the threat of malicious apps on Google Play remains a significant concern. The continuous emergence of new malware families and sophisticated techniques highlights the need for ongoing vigilance from both users and developers. As the mobile landscape evolves, it is essential to stay informed about the latest threats and take proactive steps to safeguard your devices.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

Cybercriminals backed by North Korea are actively targeting cryptocurrency and DeFi businesses with sophisticated social engineering campaigns that leverage LinkedIn and deploy a previously undocumented macOS backdoor called RustDoor.

Highly Tailored Attacks: Researchers from Jamf Threat Labs recently identified an attack attempt where a crypto user was contacted on LinkedIn by someone claiming to be a recruiter for the legitimate decentralized exchange (DEX) STON.fi. This highlights the growing trend of highly personalized social engineering tactics used by North Korean threat actors, as previously warned by the FBI.

Red Flags and Indicators: These attacks often involve requests to execute code or download applications on company devices, participate in “pre-employment tests” involving unfamiliar scripts or packages, or perform debugging exercises with unknown software.

Evolving Tactics: The latest attack chain observed by Jamf involved sending a booby-trapped Visual Studio project as a supposed coding challenge. This project downloaded two second-stage payloads disguised as “VisualStudioHelper” and “zsh_env,” both of which deployed the RustDoor malware also known as Thiefbucket.

RustDoor: A Stealthy Backdoor: First documented in February 2024, RustDoor is a previously undocumented macOS backdoor written in Objective-C, targeting cryptocurrency firms. Significantly, this is the first time the malware has been linked to North Korean actors. A variant called GateDoor, written in Golang, is known to target Windows machines.

Information Theft and Persistence: The VisualStudioHelper payload functions as an information stealer, harvesting files specified in its configuration. It even attempts to steal the user’s system password by mimicking a request from Visual Studio itself. Both payloads operate as backdoors, communicating with separate command-and-control (C2) servers.

Protecting Yourself: These findings underscore the importance of cybersecurity awareness training for employees in the crypto industry, especially developers. Be cautious of social media connections requesting to run software, and thoroughly vet unfamiliar applications before downloading. North Korean actors are adept at crafting believable personas and conducting in-depth research on their targets.

Staying Vigilant: The cryptocurrency industry remains a lucrative target for cybercriminals. By staying informed about the latest threats and implementing robust security practices, crypto businesses can significantly reduce their risk of falling victim to these attacks.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

Two Cross-Site Scripting Vulnerabilities Threaten Millions of Users

Popular open-source webmail software Roundcube has been found to contain two critical cross-site scripting (XSS) vulnerabilities, CVE-2024-42009 and CVE-2024-42008. These flaws can be exploited by attackers to steal sensitive user data, including emails, contacts, and passwords, as well as send malicious messages on behalf of compromised accounts.

How the Attacks Work

Both vulnerabilities allow attackers to execute malicious JavaScript code in a user’s browser when they view a specially crafted email. While CVE-2024-42009 requires no user interaction beyond opening the email, CVE-2024-42008 necessitates a single click but can be engineered to be virtually undetectable.

Once exploited, attackers can gain persistent access to a victim’s browser, enabling them to steal information continuously or capture passwords as they are entered. Additionally, a third vulnerability, CVE-2024-42010, allows attackers to extract sensitive information through improperly filtered CSS styles within emails.

A History of Roundcube Exploitation

These latest vulnerabilities highlight a recurring pattern of Roundcube being targeted by cybercriminals. Previous attacks have leveraged similar flaws to compromise high-profile targets, including government agencies and think tanks. Notable incidents include:

• June 2023: A spear-phishing campaign targeting Ukrainian state organizations exploited XSS and SQL injection vulnerabilities to steal data from Roundcube databases.
• October 2023: The Winter Vivern APT group used a zero-day XSS vulnerability to target European government entities and a think tank.
• February 2024: CISA mandated that US federal agencies patch a Roundcube XSS flaw actively exploited in the wild.

Mitigating the Risk

To protect against these threats, Roundcube administrators are urged to update their installations to versions 1.6.8 or 1.5.8 as soon as possible. Users who suspect their accounts may have been compromised should change their email passwords and clear their browser’s site data for Roundcube.

While the technical details of these vulnerabilities have been withheld to give users time to patch their systems, the rapid exploitation of similar flaws in the past underscores the urgency of addressing this issue.

Additional Information

• Roundcube is widely used by European government agencies, hosting providers, and academic institutions worldwide.
• The vulnerabilities affect Roundcube versions 1.6.7 and earlier, as well as 1.5.7 and earlier.
• A third vulnerability, CVE-2024-42010, allows information disclosure through CSS manipulation.

By understanding the severity of these vulnerabilities and taking immediate action, organizations can significantly reduce the risk of email account compromise and data theft.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.