{"id":3607,"date":"2021-01-18T08:42:37","date_gmt":"2021-01-18T07:42:37","guid":{"rendered":"https:\/\/xopero.com\/blog\/?p=3607"},"modified":"2024-05-15T16:11:35","modified_gmt":"2024-05-15T14:11:35","slug":"solarleaks-a-new-chapter-in-the-solarwinds-data-breach","status":"publish","type":"post","link":"https:\/\/xopero.com\/blog\/en\/solarleaks-a-new-chapter-in-the-solarwinds-data-breach\/","title":{"rendered":"SolarLeaks – a new chapter in the SolarWinds data breach"},"content":{"rendered":"\n

SolarWinds data breach every week returns like a boomerang – this time with SolarLeaks [.]net website, whose owners claim to be selling the stolen data from Microsoft, Cisco, FireEye, and SolarWinds. And it seems there were the same attackers who abused one of Mimecast\u2019s certificates to access M365 accounts\u2026 And it\u2019s not the end of Microsoft\u2019s problems described today\u2026<\/p>\n\n\n\n

What more? Capcom, game manufacturer and publisher (i.e. Resident Evil, Street Fighter) released a new update for their ransomware attack and data breach investigation. The incident was worse than initially thought…<\/p>\n\n\n\n\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

SolarLeaks site claims to sell data stolen in SolarWinds attacks<\/strong><\/h2>\n\n\n

Yes, there are still rumours about SolarWinds hack and a sophisticated cyberattack that led to a supply chain attack affecting 18,000 customers. On Tuesday, a solarleaks [.]net website was launched that claims to be selling the stolen data from Microsoft, Cisco, FireEye, and SolarWinds. All of these companies are known to have been breached during the supply chain attack.<\/p>\n\n\n\n

The website claims to be selling Microsoft source code and repositories for $600,000. As we mentioned in the last edition of Xopero Security Center<\/a>, Microsoft confirmed that threat actors accessed their source code during their SolarWinds breach. The threat actors also claim to be selling the source code for multiple Cisco products, even more concerning, the company’s internal bug tracker. However, the company states that there is no evidence that attackers stole their source code.<\/p>\n\n\n\n

What about FireEye? The website also claims to be selling the private red team tools, and source code that FireEye disclosed were stolen during their attack for $50,000.<\/p>\n\n\n\n

Finally, the website sells SolarWinds source code and a dump of the customer portal for $250,000.<\/p>\n\n\n\n

Oh, and there is a volume discount! For $1 million, you get all of the leaked data.<\/p>\n\n\n\n

The SolarLeaks actors state that they will be selling the stolen data in batches, and more will be released at a later date. <\/p>\n\n\n\n

When looking at the WHOIS record for solarleaks[.]net, the assigned name servers also taunt researchers with the statement „You Can Get No Info”. It is not confirmed if this site is legitimate and if the site owners have the data they are selling.<\/p>\n\n\n\n

Couple days later the SolarLeaks site was updated to include a new message stating that ProtonMail shutdown their email, and that buyers who want to see a sample of the data should send 100 XMR, or approximately $16,000, to a listed Monero address.<\/p>\n\n\n\n

To make matters worse, a copycat site at SolarLeak[.]net has been created with the same website content, but a different Monero address. <\/p>\n\n\n\n

To be continued. <\/p>\n\n\n\n

Source<\/a><\/p>\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

Hackers abused one of Mimecast\u2019s certificates to access Microsoft 365 accounts. They could be the SolarWinds attackers<\/strong><\/h2>\n\n\n

Mimecast, a company that makes cloud email management software, on Tuesday, 12th, disclosed a security incident, alerting customers that „a sophisticated threat actor” has obtained one of its digital certificates and abused it to gain access to some of its clients’ Microsoft 365 accounts. The company said it learned of the incident from Microsoft after the tech giant detected unauthorized access to some accounts.<\/p>\n\n\n\n

The London-based email software company said the certificate in question was used by several of its products to connect to Microsoft infrastructure – including Mimecast Sync and Recover, Continuity Monitor and IEP products.<\/p>\n\n\n\n

The company said that around 10% of all its customers used the affected products with this particular certificate, however, the „sophisticated threat actor” abused the certificate to gain access to only a handful of these customers’ Microsoft 365 accounts.<\/p>\n\n\n\n

The company is now asking all other customers to „immediately delete the existing connection within their M365 tenant and re-establish a new certificate-based connection using the new certificate [they]’ve made available.”<\/p>\n\n\n\n

An investigation into the incident is ongoing, with the company noting that it will work closely with Microsoft and law enforcement as appropriate. Interesting is that the tools and techniques used in this attack link these operators to those who recently targeted SolarWinds, The Wall Street Journal reports. Mimecast was a SolarWinds customer in the past but no longer uses the Orion software. The company has not determined how attackers got in or whether its earlier use of SolarWinds could have left it vulnerable. <\/p>\n\n\n\n

Source: 1<\/a> | 2<\/a><\/p>\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

Sophisticated hacking campaign uses Windows and Android zero-days<\/strong><\/h2>\n\n\n

The Google Project Zero team together with the Google Threat Analysis Group (TAG), discovered a watering hole attack targeting Windows and Android systems that was carried out by a highly sophisticated actor.<\/p>\n\n\n\n

Threat actors behind the attacks exploited multiple vulnerabilities in Android, Windows, and chained them with Chrome flaws. The attackers exploited both zero-days and n-days exploits for the initial remote code execution to finally take over the victim\u2019s devices<\/p>\n\n\n\n

The attacks employed two exploit servers that were triggering multiple vulnerabilities through different exploit chains in watering hole attacks. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

The experts were able to extract the following code from the exploit servers:<\/p>\n\n\n\n