WordFly Breach, Now IIS See You, No Knock Nuki, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 27 July, 2022
Episode 274 - 27 July 2022
WordFly Breach- https://www.securityweek.com/mailing-list-provider-wordfly-scrambling-recover-following-ransomware-attack
Now IIS See You -
https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-increasingly-hacked-with-iis-backdoors/
Messaging Threats -
https://threatpost.com/messaging-apps-cybercriminals/180303/
Robin Banks Phishing Service- https://www.bleepingcomputer.com/news/security/new-robin-banks-phishing-service-targets-bofa-citi-and-wells-fargo/
No Knock Nuki -
https://www.securityweek.com/nuki-smart-lock-vulnerabilities-allow-hackers-open-doors
Hi, I’m Paul Torgersen. It’s Wednesday July 27th, 2022 and this is a look at the information security news from overnight.
From SecurityWeek.com:
Mailing list provider WordFly has been offline for more than two weeks after a ransomware attack encrypted data on some of its systems. The attack hit on July 10, and the company hasn’t been able to restore service since. The company confirms data was exfiltrated, but believes it was subsequently deleted. They expect to be down at least another few days before they get systems operational again. No word on the malware or threat actor.
From BleepingComputer.com:
Attackers are increasingly using Internet Information Services, IIS, web server extensions to backdoor unpatched Exchange servers. Being installed in the exact location and using the same structure as legitimate modules, they provide attackers' with a perfect and durable persistence mechanism. Details and a link to the Microsoft report in the article.
From ThreatPost.com:
Threat actors are tapping the multi-feature nature of messaging apps such as Telegram and Discord as a foundation in persistent campaigns that threaten users. Intel 471 identified three key ways in which threat actors are leveraging the apps: storing stolen data, hosting malware payloads, and using bots that perform the dirty work. Details and a link inside.
From BleepingComputer.com:
A new phishing as a service platform has shown up with the name Robin Banks. As you may have guessed, it offers ready-made phishing kits targeting the customers of well-known banks. Companies like Citibank, Bank of America, Capital One, Wells Fargo, etc. Oh, they also offer templates to steal Microsoft, Google, Netflix, and T-Mobile accounts. Pricing from $50 to $200 a month.
And last, from SecurityWeek.com:
Security researchers have documented 11 vulnerabilities impacting Nuki smart lock products, you may not be able to see my air quotes. Nuki Smart Lock and Nuki Bridge, allow users to unlock their doors with their smartphones by simply walking in range. Brilliant. Exploiting the found vulnerabilities could result in a fully compromised device, including the ability to open and close the door without the owner even noticing. After being notified of the flaws in April, Nuki has issued patches this month.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.