Microsoft has patched a total of 63 vulnerabilities this Patch Tuesday. Make sure you update as soon as you can.

Another important update round for this month’s Patch Tuesday. Microsoft has patched a total of 63 vulnerabilities in its operating systems. Five of these vulnerabilities qualify as zero-days, with three listed as being actively exploited. Microsoft considers a vulnerability to be a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The zero-days patched in these updates are listed as:

CVE-2023-36025: a Windows SmartScreen security feature bypass vulnerability that would allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. SmartScreen is a built-in Windows component designed to detect and block known malicious websites and files.

It requires user interaction since the user would have to click on a specially crafted Internet Shortcut (.URL) or a hyperlink pointing to an Internet Shortcut file to be compromised by the attacker. Microsoft listed this vulnerability with the remark “Exploitation Detected.”

CVE-2023-36033: a Windows Desktop Window Manager (DWM) Core Library elevation of privilege (EoP) vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. This vulnerability is also listed with the remark “Exploitation Detected.”

CVE-2023-36036: a Windows Cloud Files Mini Filter Driver EoP vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. This vulnerability is also listed with the remark “Exploitation Detected.”

EoP type of vulnerabilities are typically used in attack chains. Once the attacker has gained entrance, the vulnerabilities allow them to increase their permission level.

CVE-2023-36413: a Microsoft Office security feature bypass vulnerability. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. Full exploitation requires that the attacker sends the target a malicious file and convince them to open it. This is a publicly disclosed vulnerability but there are no known cases of exploitation.

CVE-2023-36038: a vulnerability in ASP.NET that could lead to core denial of service. This vulnerability could be exploited if http requests to .NET 8 RC 1 running on IIS InProcess hosting model are cancelled. Threads counts would increase and an OutOfMemoryException is possible. A successful exploitation might result in a total loss of availability. So, basically an attacker would send requests and then cancel them until the program runs out of memory and crashes. Microsoft notes that this vulnerability was publicly disclosed, however no in-the-wild exploitation has been observed, which is not likely to happen either if the denial of service is the best achievable goal for an attacker.

An extra warning for organizations running Microsoft Exchange Server: Prioritize several new Exchange patches, including CVE-2023-36439, which is a vulnerability that enables attackers to install malicious software on an Exchange server.

**Other vendors**

Other organizations have synchronized their periodic updates with Microsoft. Here are few major ones that you may find in your environment.

**Adobe** has released security updates to address vulnerabilities affecting multiple Adobe products:

*   APSB23-52: Adobe ColdFusion
*   APSB23-53: Adobe RoboHelp Server
*   APSB23-54: Adobe Acrobat and Reader
*   APSB23-55: Adobe InDesign
*   APSB23-56: Adobe Photoshop
*   APSB23-57: Adobe Bridge
*   APSB23-58: Adobe FrameMaker Publishing Server
*   APSB23-60: Adobe InCopy
*   APSB23-61: Adobe Animate
*   APSB23-62: Adobe Dimension
*   APSB23-63: Adobe Media Encoder
*   APSB23-64: Adobe Audition
*   APSB23-65: Adobe Premiere Pro
*   APSB23-66: Adobe After Effects

**Android**’s November updates were released by Google.

**SAP** released its November 2023 Patch Day updates.

**SysAid** released security updates for a zero-day vulnerability that is actively being exploited by a ransomware affiliate.

**We don’t just report on vulnerabilities—we identify them, and prioritize action.**

Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using Malwarebytes Vulnerability and Patch Management.

 Update now! Microsoft patches 3 actively exploited zero-days 

We've seen a particular card skimming campaign really pick up pace lately. With hundreds of stores compromised, you may come across it if you shop online this holiday season.

As we head into shopping season, customers aren’t the only ones getting excited. More online shopping means more opportunities for cybercriminals to grab their share using scams and data theft.

One particular threat we’re following closely and expect to increase over the next several weeks is credit card skimming. Online stores are not always as secure as you might think they are, and yet you need to hand over your valuable credit card information in order to buy anything.

When a merchant website is hacked, any purchase made has the potential of being intercepted by bad actors. Often, the malicious code is right underneath the surface and yet completely invisible to shoppers.

One particular skimming campaign we have been following picked up the pace drastically in October after a lull during the summer. With hundreds of stores compromised, you may come across it if you shop online on a regular basis.

**The Kritec campaign**

We first discovered this credit card skimming operation back in March 2023, as it stood out from the rest due to its large volume. The threat actors were also taking the time to customize their skimmer for each victim site with very convincing templates that were even localized in several languages.

The experience was so smooth and seamless that it made it practically impossible for online shoppers to even realize that their credit card information had just been stolen.

**Threat actors ramp up their activity just in time for the holiday season**

In April this skimming campaign reached a peak and then slowed down during the summer. However it came back, increasing to its highest volume in October. We measured this activity based on the number of newly registered domain names attributed to this threat actor.

The infrastructure is located on the IT WEB LTD network (ASN200313) registered in the British Virgin Islands.

**How to shop safely online**

If you are shopping online, and especially via smaller merchants (i.e. not Amazon, Walmart, etc), you absolutely need to be extra careful. Unless you are able to perform a full website audit yourself, you simply can’t be sure that the platform hasn’t been compromised.

Having said that, if the website looks like it hasn’t been maintained in a while (for example it is displaying outdated information, such as ”Copyright 2018′) you probably should stay away from it. Most compromises happen because a website’s content management system (CMS) and its plugins are outdated and vulnerable.

There are tools that can also detect malicious code embedded into websites. Most antivirus products offer some kind of web protection that detects malicious domains and IP addresses. But because threat actors are constantly swapping their infrastructure, it is also a good idea to have some kind of heuristic detection for things like malicious JavaScript snippets.

Malwarebytes Premium offers web protection and is complemented by the Malwarebytes Browser Guard extension for more advanced in-browser detection.

We are also publishing a list of the infrastructure that includes domains we had previously not seen but obtained via retrohunting, so that those can be included in community blocklists ingested by third-party products.

**Indicators of Compromise**

**Kritec domains**

oumymob\[.\]shop  
nujtec\[.\]shop  
lavutele\[.\]yachts  
tochdigital\[.\]pics  
gemdigit\[.\]pics  
vuroselec\[.\]quest  
bereelec\[.\]quest  
psyhomob\[.\]sbs  
antohub\[.\]shop  
kritec\[.\]pics  
daichetmob\[.\]sbs  
smestech\[.\]shop  
interytec\[.\]shop  
ribtech\[.\]shop  
podobadigit\[.\]quest  
yaknatec\[.\]pics  
stacstocuh\[.\]quest  
keistodigit\[.\]pics  
shumtech\[.\]shop  
metsimob\[.\]yachts  
hovarelec\[.\]shop  
vdoxdigit\[.\]pics  
vushtech\[.\]sbs  
tekeiteh\[.\]quest  
tastmob\[.\]yachts  
krasoticmob\[.\]space  
pyatiticdigt\[.\]shop  
frikctictempo\[.\]fun  
secreelec\[.\]shop  
yelyotech\[.\]pics  
statemob\[.\]yachts  
sviisdigit\[.\]quest  
garnimob\[.\]sbs  
povomob\[.\]shop  
dvojnatech\[.\]sbs  
petlelec\[.\]quest  
helotec\[.\]pics  
xiloditg\[.\]yachts  
paunit\[.\]pics  
rithdigit\[.\]cyou  
dayspiselec\[.\]quest  
uznatec\[.\]shop  
nespomob\[.\]sbs  
nebiltech\[.\]shop  
bufelec\[.\]yachts  
ledeehub\[.\]shop  
greentechify\[.\]digital  
ecosustain\[.\]digital  
innovate360\[.\]digital  
wellbeingtech\[.\]digital  
inspireworks\[.\]digital  
avtomob\[.\]sbs  
otkridigit\[.\]quest  
balacdigit\[.\]pics  
schetdigit\[.\]pics  
bantec\[.\]pics  
jantech\[.\]quest  
shotsmob\[.\]sbs  
podbotec\[.\]sbs  
shokomob\[.\]sbs  
resuelec\[.\]yachts  
xorotelec\[.\]quest  
rozkatech\[.\]yachts  
nasnamob\[.\]quest  
ensdigit\[.\]quest  
genlytec\[.\]us  
onitzech\[.\]sbs  
odintech\[.\]sbs  
rebomob\[.\]quest  
flattec\[.\]sbs  
noanotech\[.\]sbs  
fadyit\[.\]pics  
lielecef\[.\]cyou  
inlinedigital\[.\]pics  
fantodelt\[.\]sbs  
volosmob\[.\]pics  
zahidelt\[.\]sbs  
dychtech\[.\]shop  
samopotele\[.\]yachts  
stimob\[.\]pics  
jestmob\[.\]pics  
weitmob\[.\]shop  
poidelt\[.\]sbs  
perstech\[.\]shop  
telehub\[.\]shop  
projectmob\[.\]sbs  
imhoelec\[.\]yachts  
plactech\[.\]quest  
sakwohub\[.\]shop  
volonmob\[.\]sbs  
lehelec\[.\]yachts  
tochelec\[.\]quest  
prijetech\[.\]shop  
supermob\[.\]network  
eluntec\[.\]info  
chutech\[.\]works  
stonworks\[.\]vip  
hapermob\[.\]shop  
seletech\[.\]markets  
calcdigit\[.\]pics  
shellmob\[.\]fun  
valetec\[.\]pw  
votedigit\[.\]shop  
encit\[.\]yachts  
defimob\[.\]bar  
goponl\[.\]online  
yukmob\[.\]store  
tuchtoch\[.\]shop

sasaiso\[.\]cfd  
aifanul\[.\]yachts  
soplelec\[.\]pics  
wudutec\[.\]shop  
vonderdigit\[.\]quest  
mutelec\[.\]quest  
gemstec\[.\]yachts  
genertech\[.\]pw  
genstech\[.\]shop  
effecttec\[.\]shop  
bespitech\[.\]sbs  
otpusmob\[.\]shop  
yedelec\[.\]sbs  
chokdigit\[.\]pics  
poptec\[.\]sbs  
aurelec\[.\]shop  
stramdigital\[.\]yachts  
sotkelec\[.\]yachts  
funkomob\[.\]sbs  
beatmob\[.\]pics  
osobtech\[.\]yachts  
kruktech\[.\]shop  
volosmob\[.\]sbs  
provtec\[.\]shop  
dvanatech\[.\]yachts  
druzit\[.\]quest  
yololive\[.\]sbs  
bachitech\[.\]pics  
kamitac\[.\]shop  
karadigit\[.\]quest  
gachit\[.\]yachts  
yalomob\[.\]pics  
druzit\[.\]quest  
mopedigit\[.\]shop  
macsetech\[.\]online  
strajit\[.\]yachts  
istoretc\[.\]shop  
trepmob\[.\]sbs  
animtech\[.\]quest  
chekeelec\[.\]quest  
kinotec\[.\]pics  
zamlmob\[.\]pics  
leritgo\[.\]sbs  
autotec\[.\]shop  
helinit\[.\]yachts  
shpitech\[.\]quest  
seletmob\[.\]online  
hhfnsfsga\[.\]sbs  
dvanatech\[.\]yachts  
lemodigit\[.\]online  
ttewe\[.\]quest  
efromob\[.\]site  
selentech\[.\]click  
centridig\[.\]store  
timetok\[.\]online  
musatech\[.\]quest  
digitstel\[.\]site  
sintec\[.\]store  
eleconuch\[.\]click  
deletouch\[.\]shop  
topostock\[.\]shop  
dujetech\[.\]yachts  
fletmob\[.\]sbs  
semebit\[.\]online  
kontec\[.\]quest  
moldmob\[.\]site  
lemtok\[.\]store  
domelec\[.\]shop  
hemidigit\[.\]click  
teletoch\[.\]pics  
temtoch\[.\]site  
intescon\[.\]store  
genimmob\[.\]online  
teledomn\[.\]quest  
stemtec\[.\]click  
gemofab\[.\]store  
tenastoc\[.\]click  
kiligob\[.\]site  
pelstec\[.\]online  
vetitec\[.\]quest  
denlog\[.\]shop  
lemnidig\[.\]shop  
fasfad\[.\]site  
lishetoc\[.\]shop  
ruepliz\[.\]click  
stiornec\[.\]store  
daisnetech\[.\]site  
yavipustec\[.\]online  
bednedigit\[.\]quest  
sipletoc\[.\]site  
olinmasot\[.\]click  
verecey\[.\]quest  
oleketec\[.\]store  
etibuz\[.\]shop  
comepetec\[.\]click  
stiildig\[.\]store  
hemogom\[.\]online  
dzelonline\[.\]shop  
tuctec\[.\]site  
obogtec\[.\]quest  
moboed\[.\]icu  
shonowor\[.\]site  
idopos\[.\]shop  
mylase\[.\]click  
henove\[.\]store  
frodetraho\[.\]click  
tromtustec\[.\]quest  
bulkmob\[.\]store

tisimy\[.\]quest  
depeyo\[.\]online  
livepolitical\[.\]sbs  
shareeffectiv\[.\]yachts  
basewhit\[.\]quest  
deliverclos\[.\]online  
changeyellow\[.\]cfd  
writefederal\[.\]click  
dowonderful\[.\]store  
deliverclos\[.\]sbs  
stopfurther\[.\]sbs  
usespecial\[.\]quest  
startculturl\[.\]site  
followmilitry\[.\]cfd  
intesres\[.\]quest  
androton\[.\]online  
begistic\[.\]site  
heptombo\[.\]store  
felestech\[.\]click  
gelimog\[.\]online  
hasekytop\[.\]click  
dekrenof\[.\]quest  
gerelec\[.\]site  
beresor\[.\]store  
lenosmac\[.\]shop  
hustiontec\[.\]store  
teletouch\[.\]click  
pilozol\[.\]quest  
belmrs\[.\]click  
jetomob\[.\]shop  
gelenhan\[.\]online  
lokotec\[.\]quest  
plasmob\[.\]pics  
shumocom\[.\]site  
biposou\[.\]online  
golyter\[.\]shop  
cuvanil\[.\]quest  
trevago\[.\]site  
domog\[.\]shop  
sgolen\[.\]store  
vjevec\[.\]quest  
spilotich\[.\]online  
babtek\[.\]click  
vozvrec\[.\]store  
irlatok\[.\]shop  
vkiten\[.\]click  
golyadik\[.\]site  
oklasdon\[.\]online  
mihayam\[.\]shop  
cutele\[.\]shop  
hoohotic\[.\]click  
pubupu\[.\]quest  
genodigit\[.\]store  
djutech\[.\]online  
voouvdigit\[.\]site  
zizitok\[.\]shop  
ulyatec\[.\]quest  
tuchtok\[.\]site  
justlice\[.\]store  
enisemol\[.\]click  
tululudoc\[.\]online  
nogtech\[.\]site  
mageants\[.\]sbs  
deshvoc\[.\]store  
shumtech\[.\]shop  
metsimob\[.\]yachts  
bolotoc\[.\]store  
nepochtec\[.\]shop  
bibstele\[.\]online  
nechuvelec\[.\]click  
gastdigit\[.\]quest  
arastek\[.\]online  
galeglob\[.\]quest  
boroshtic\[.\]click  
prodovjtec\[.\]shop  
denetok\[.\]site  
kalomob\[.\]store  
avordic\[.\]site  
chasoc\[.\]quest  
jujoc\[.\]online  
helostop\[.\]shop  
zlakovos\[.\]click  
obomob\[.\]site  
miskotec\[.\]store  
shakorot\[.\]site  
nemojmob\[.\]online  
najitel\[.\]quest  
ragutech\[.\]shop  
pershtec\[.\]click  
nadoelec\[.\]space  
odnydigit\[.\]quest  
yamatel\[.\]store  
jezesec\[.\]quest  
samknut\[.\]click  
imperel\[.\]site  
pricetool\[.\]store  
donashhack\[.\]online  
chelotec\[.\]quest  
stelor\[.\]shop  
udamos\[.\]online  
kurkumin\[.\]click  
vedldeno\[.\]store  
oifilon\[.\]site  
igusfil\[.\]shop  
cosmafit\[.\]click  
tanuatech\[.\]quest  
ifilone\[.\]site  
sourite\[.\]online  
becasotec\[.\]site

**Kritec IPs**

195\[.\]242\[.\]110\[.\]102  
195\[.\]242\[.\]110\[.\]103  
195\[.\]242\[.\]110\[.\]112  
195\[.\]242\[.\]110\[.\]130  
195\[.\]242\[.\]110\[.\]131  
195\[.\]242\[.\]110\[.\]134  
195\[.\]242\[.\]110\[.\]135  
195\[.\]242\[.\]110\[.\]136  
195\[.\]242\[.\]110\[.\]137  
195\[.\]242\[.\]110\[.\]139  
195\[.\]242\[.\]110\[.\]143  
195\[.\]242\[.\]110\[.\]158  
195\[.\]242\[.\]110\[.\]162  
195\[.\]242\[.\]110\[.\]166  
195\[.\]242\[.\]110\[.\]168  
195\[.\]242\[.\]110\[.\]171  
195\[.\]242\[.\]110\[.\]172  
195\[.\]242\[.\]110\[.\]174  
195\[.\]242\[.\]110\[.\]179  
195\[.\]242\[.\]110\[.\]181  
195\[.\]242\[.\]110\[.\]182  
195\[.\]242\[.\]110\[.\]185  
195\[.\]242\[.\]110\[.\]186  
195\[.\]242\[.\]110\[.\]187  
195\[.\]242\[.\]110\[.\]188  
195\[.\]242\[.\]110\[.\]189  
195\[.\]242\[.\]110\[.\]190  
195\[.\]242\[.\]110\[.\]191  
195\[.\]242\[.\]110\[.\]196  
195\[.\]242\[.\]110\[.\]197  
195\[.\]242\[.\]110\[.\]205  
195\[.\]242\[.\]110\[.\]206  
195\[.\]242\[.\]110\[.\]231  
195\[.\]242\[.\]110\[.\]232  
195\[.\]242\[.\]110\[.\]235  
195\[.\]242\[.\]110\[.\]237  
195\[.\]242\[.\]110\[.\]24  
195\[.\]242\[.\]110\[.\]242  
195\[.\]242\[.\]110\[.\]25  
195\[.\]242\[.\]110\[.\]250  
195\[.\]242\[.\]110\[.\]251  
195\[.\]242\[.\]110\[.\]28  
195\[.\]242\[.\]110\[.\]3  
195\[.\]242\[.\]110\[.\]30  
195\[.\]242\[.\]110\[.\]32  
195\[.\]242\[.\]110\[.\]33  
195\[.\]242\[.\]110\[.\]34  
195\[.\]242\[.\]110\[.\]37  
195\[.\]242\[.\]110\[.\]40  
195\[.\]242\[.\]110\[.\]41  
195\[.\]242\[.\]110\[.\]46  
195\[.\]242\[.\]110\[.\]58  
195\[.\]242\[.\]110\[.\]59

195\[.\]242\[.\]110\[.\]60  
195\[.\]242\[.\]110\[.\]72  
195\[.\]242\[.\]110\[.\]73  
195\[.\]242\[.\]110\[.\]77  
195\[.\]242\[.\]110\[.\]79  
195\[.\]242\[.\]110\[.\]80  
195\[.\]242\[.\]110\[.\]83  
195\[.\]242\[.\]110\[.\]84  
195\[.\]242\[.\]110\[.\]87  
195\[.\]242\[.\]110\[.\]95  
195\[.\]242\[.\]110\[.\]99  
195\[.\]242\[.\]111\[.\]102  
195\[.\]242\[.\]111\[.\]11  
195\[.\]242\[.\]111\[.\]117  
195\[.\]242\[.\]111\[.\]12  
195\[.\]242\[.\]111\[.\]120  
195\[.\]242\[.\]111\[.\]147  
195\[.\]242\[.\]111\[.\]148  
195\[.\]242\[.\]111\[.\]152  
195\[.\]242\[.\]111\[.\]214  
195\[.\]242\[.\]111\[.\]215  
195\[.\]242\[.\]111\[.\]217  
195\[.\]242\[.\]111\[.\]224  
195\[.\]242\[.\]111\[.\]25  
195\[.\]242\[.\]111\[.\]29  
195\[.\]242\[.\]111\[.\]36  
195\[.\]242\[.\]111\[.\]37  
195\[.\]242\[.\]111\[.\]38  
195\[.\]242\[.\]111\[.\]40  
195\[.\]242\[.\]111\[.\]42  
195\[.\]242\[.\]111\[.\]44  
195\[.\]242\[.\]111\[.\]49  
195\[.\]242\[.\]111\[.\]50  
195\[.\]242\[.\]111\[.\]53  
195\[.\]242\[.\]111\[.\]56  
195\[.\]242\[.\]111\[.\]57  
195\[.\]242\[.\]111\[.\]58  
195\[.\]242\[.\]111\[.\]59  
195\[.\]242\[.\]111\[.\]6  
195\[.\]242\[.\]111\[.\]7  
195\[.\]242\[.\]111\[.\]76  
195\[.\]242\[.\]111\[.\]77  
195\[.\]242\[.\]111\[.\]84  
195\[.\]242\[.\]111\[.\]85  
195\[.\]242\[.\]111\[.\]86  
195\[.\]242\[.\]111\[.\]87  
195\[.\]242\[.\]111\[.\]94  
195\[.\]242\[.\]111\[.\]95  
195\[.\]242\[.\]111\[.\]96  
45\[.\]88\[.\]3\[.\]114  
45\[.\]88\[.\]3\[.\]12  
45\[.\]88\[.\]3\[.\]122  

45\[.\]88\[.\]3\[.\]123  
45\[.\]88\[.\]3\[.\]134  
45\[.\]88\[.\]3\[.\]138  
45\[.\]88\[.\]3\[.\]139  
45\[.\]88\[.\]3\[.\]141  
45\[.\]88\[.\]3\[.\]142  
45\[.\]88\[.\]3\[.\]144  
45\[.\]88\[.\]3\[.\]145  
45\[.\]88\[.\]3\[.\]146  
45\[.\]88\[.\]3\[.\]148  
45\[.\]88\[.\]3\[.\]149  
45\[.\]88\[.\]3\[.\]154  
45\[.\]88\[.\]3\[.\]167  
45\[.\]88\[.\]3\[.\]170  
45\[.\]88\[.\]3\[.\]201  
45\[.\]88\[.\]3\[.\]21  
45\[.\]88\[.\]3\[.\]213  
45\[.\]88\[.\]3\[.\]218  
45\[.\]88\[.\]3\[.\]219  
45\[.\]88\[.\]3\[.\]225  
45\[.\]88\[.\]3\[.\]227  
45\[.\]88\[.\]3\[.\]23  
45\[.\]88\[.\]3\[.\]235  
45\[.\]88\[.\]3\[.\]237  
45\[.\]88\[.\]3\[.\]238  
45\[.\]88\[.\]3\[.\]239  
45\[.\]88\[.\]3\[.\]240  
45\[.\]88\[.\]3\[.\]244  
45\[.\]88\[.\]3\[.\]245  
45\[.\]88\[.\]3\[.\]248  
45\[.\]88\[.\]3\[.\]25  
45\[.\]88\[.\]3\[.\]251  
45\[.\]88\[.\]3\[.\]253  
45\[.\]88\[.\]3\[.\]34  
45\[.\]88\[.\]3\[.\]35  
45\[.\]88\[.\]3\[.\]40  
45\[.\]88\[.\]3\[.\]49  
45\[.\]88\[.\]3\[.\]52  
45\[.\]88\[.\]3\[.\]60  
45\[.\]88\[.\]3\[.\]61  
45\[.\]88\[.\]3\[.\]63  
45\[.\]88\[.\]3\[.\]70  
45\[.\]88\[.\]3\[.\]78  
45\[.\]88\[.\]3\[.\]79  
45\[.\]88\[.\]3\[.\]81  
45\[.\]88\[.\]3\[.\]82  
45\[.\]88\[.\]3\[.\]83  
45\[.\]88\[.\]3\[.\]85  
45\[.\]88\[.\]3\[.\]95  
45\[.\]88\[.\]3\[.\]98

 Credit card skimming on the rise for the holiday shopping season 

The US State of Maine says it has suffered a data breach impacting around 1.3 million people—more or less the the entire population of Maine.

The US State of Maine says it has suffered a data breach impacting around 1.3 million people. According to the census from July 2022, that’s more or less the the entire population of Maine.

The State of Maine says it was compromised via a known vulnerability in secure transfer service MOVEit Transfer. This vulnerability is known to be used by the Cl0p ransomware gang.

The type of stolen data varies from person to person, likely because the data breach affected multiple agencies in the State. More than 50% of the data exposed in the breach came from Maine’s Department of Health and Human Services, while between 10 and 30% came from the state’s Department of Education. The breach also impacted several other departments.

For what we can gather, the cybercriminals may have obtained names, Social Security numbers (SSN), dates of birth, driver’s licenses, state identification numbers, and taxpayer identification numbers. The stolen data may involve certain types of medical information and health insurance for some individuals.

Progress Software, who make MOVEit Transfer, issued a patch for the exploited vulnerability on May 31, 2023. However, the State of Maine says the cybercriminals gained access and started downloading files between May 28 and 29, 2023, before the patch was available.

****Data breach****

The State of Maine is encouraging people to contact Maine’s dedicated call center to find out if their data was involved or if they have questions about this incident. The phone number is (877) 618-3659, with representatives available from Monday to Friday, 9 AM to 9 PM ET.

If your Social Security Number or taxpayer identification number is involved, the call center will provide you with a complimentary credit monitoring code which give you two years of credit monitoring and identity theft protection services.

If you suspect your data has been stolen, it’s worth watching out for people posing as the State of Maine. There’s nothing like a data breach to bring out the scammers, and they will be looking to target people affected by the breach. If someone does contact you, make sure to verifying they are who they say they are using another communication channel. Watch out for phishing emails, too.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your and your family’s personal information by using Malwarebytes Identity Theft Protection.

 State of Maine data breach impacts 1.3 million people 

A list of topics we covered in the week of November 06 to November 12 of 2023

November 9, 2023 - A judge has refused to bring back a class action lawsuit against four car manufacturers because the privacy violation did not meet the WPA standard.

November 9, 2023 - The FBI is investigating a data breach where cybercriminals were able to steal patients’ records from a Las Vegas plastic surgeon's office and then publish them online.

November 9, 2023 - A SysAid vulnerability is actively being exploited by a ransomware affiliate.

November 8, 2023 - Users looking to download a popular PC utility may be tricked in this campaign where a threat actor has registered a website that copies content from a PC and Windows news portal.

November 8, 2023 - Scientists have developed a ChatGPT detector with unprecedented accuracy. Even though it has a limited scope, this could be a big step forward.

 A week in security (November 06 &#8211; November 12) 

The Signal messaging service is testing support for usernames as a replacement for phone numbers to serve as user identities

Messaging service Signal is testing support for usernames as a replacement for phone numbers to serve as user identities.

Signal provides encrypted instant messaging and is popular among people that value their privacy. Compared to more popular services like WhatsApp, Signal offers more layers of privacy protection, customization of settings, and enhanced data security. These layers include hiding metadata, not using a user’s data, allowing call relay, and others.

The current Signal setup requires users to sign up with a phone number and this number will be shared if you want to message other users on the app. But not everyone wants to share their phone number when messaging someone and so Signal is doing something about that.

 On its forums, Signal announced the feature is ready for pre-beta-testing.

> “After rounds of internal testing, we have hit the point where we think the community that powers these forums can help us test even further before public launch.”

So, for now, the announced feature is currently only available for the app’s testers on Android, iOS, and desktop users. Once it’s finally released, you’ll be able to select your username by going to Settings > Profile and Settings > Privacy > Phone Number section.

From a screenshot posted on X, it looks like you’ll be able to invite new contacts by sending them a link or a QR code.

_Screenshot of new options_

It’s also likely you still have to have a phone number to create an account. The new feature just allows you to hide your number behind a username. Phone numbers will still be used as a unique identification and as an anti-spam measure.

We don’t know when the new feature will be generally available, but in an earlier interview, president Meredith Whitaker said she expected the feature’s launch in early 2024. However, this seems unlikely as it requires a major overhaul of the app’s architecture.

**We don’t just report on privacy—we offer you the option to use it.**

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

 Signal is testing usernames so you don’t have to share your phone number 

YouTube doesn't want you to run an ad blocker, but it would like you to watch this ad for one.

After performing local experiments for a few months, YouTube recently expanded its effort to block ad blockers. The move was immediately unpopular with some users, and raised some questions in Europe about whether it was breaking privacy laws.

In addition, there are some still some fundamental issues that have some people concerned. In this blog post, we look at a couple of examples that erode our trust in online ads. In fact, it’s not really an argument about free content, it’s about being able to consume content safely, and it seems as though we aren’t quite there yet.

**Inconsistent and untrustworthy ads**

YouTube has made it quite clear that using an ad blocker goes against its Terms of Service, reminding users that they have a choice between accepting ads or paying for a premium subscription.

Yet, as of November 9 2023, YouTube was still showing an ad for Total Adblock, a browser extension that blocks… ads. It certainly looks confusing and is sending mixed messages.

While there is some irony here, the greater concern is that perhaps YouTube doesn’t have a good handle on its ads and maybe that is why users have resorted to ad blockers in recent years.

It’s not that people want an ad-free experience to purposely hurt content creators. They more likely want a scam-free and malware-free experience but perhaps aren’t in a position to pay for a subscription.

While looking for evidence of scammy ads, it took us less than a minute to come across one of those infamous Quantum AI crypto scams:

The ad used typical click-bait tactics and redirected to a website that was obviously a scam. An unverified advertiser was allowed to serve this ad and expose users to a financial scam where they can lose hundreds or even thousands of dollars.

We have yet to see if YouTube will maintain its stance or take any actions to address those core issues. In the meantime, Malwarebytes continues to protect users from scams and malware, from whichever website they choose to visit. The Malwarebytes Browser Guard extension is the easiest way to block malicious ads and other web threats.

 YouTube shows ads for ad blocker, financial scams 

A judge has refused to bring back a class action lawsuit against four car manufacturers because the privacy violation did not meet the WPA standard.

A federal judge has refused to bring back a class action lawsuit that alleged four car manufacturers had violated Washington state’s privacy laws by using vehicles’ on-board infotainment systems to record customers’ text messages and mobile phone call logs.

The judge ruled that the practice doesn’t meet the threshold for an illegal privacy violation under state law. The plaintiffs had appealed a prior judge’s dismissal.

Car manufacturers Honda, Toyota, Volkswagen, and General Motors were facing five related privacy class action suits. One of those cases, against Ford, had been dismissed on appeal previously.

Infotainment systems in the company’s vehicles began downloading and storing a copy of all text messages on smartphones when they were connected to the system. Once messages have been downloaded, the software makes it impossible for vehicle owners to access their communications and call logs but does provide law enforcement with access, the lawsuit said.

The Seattle-based appellate judge ruled that the interception and recording of mobile phone activity did not meet the Washington Privacy Act’s (WPA) standard that a plaintiff must prove that “his or her business, his or her person, or his or her reputation” has been threatened.

In a recent Lock and Code podcast, we heard from Mozilla researchers that the data points that car companies say they can collect on you include social security number, information about your religion, your marital status, genetic information, disability status, immigration status, and race. And they can sell that data to marketers.

This is alarming. Given the increasing number of sensors being placed in cars every year, this is becoming an increasingly grave problem.

In the same podcast, we also explored the booming revenue stream that car manufacturers are tapping into by not only collecting people’s data, but also packaging it together for targeted advertising.

According to the Mozilla research, popular global brands including BMW, Ford, Toyota, Tesla, Kia, and Subaru:

> “Can collect deeply personal data such as sexual activity, immigration status, race, facial expressions, weight, health and genetic information, and where you drive. Researchers found data is being gathered by sensors, microphones, cameras, and the phones and devices drivers connect to their cars, as well as by car apps, company websites, dealerships, and vehicle telematics.”

In fact, the seasoned Mozilla team said “cars are the worst product category we have ever reviewed for privacy” after finding that all 25 car brands they researched earned the “Privacy Not Included” warning label.

Since that doesn’t give us much of a choice to go for a brand that respects our privacy, I suggest we turn of our phones before we start the car. It’s both safer and better for your privacy.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your and your family’s personal information by using Malwarebytes Identity Theft Protection.

 Judge rules it&#8217;s fine for car makers to intercept your text messages 

At a Senate hearing, a Meta whistleblower has revealed some shocking numbers around children’s experiences of its platforms.

At a Senate hearing, a Meta whistleblower has revealed some shocking numbers around children’s experiences of its platforms.

Arturo Béjar, a former engineering director at Meta, testified before the US Congress on Tuesday. Not only did he share his own daughters’ experience suffering harassment on Instagram, he also shared some statistics.

> “13% of Instagram users under the age of 16 had received unwanted sexual advances on the platform in the previous 7 days.”

His own daughter received unsolicited pictures of male strangers’ privates on the platform. She reported them without ever receiving a response that indicated Meta would take appropriate action.

In a conversation with chief product officer Chris Cox, Béjar learned Meta was already aware of the statistics related to the harm done to teens.

Béjar is not the first Meta whistleblower to voice his concerns about Meta’s unwillingness to put the wellbeing of its users before the bottom line. On October 5, 2021, Frances Haugen told a Senate panel Tuesday that Congress must intervene to solve the “crisis” created by her former employer’s products.

Haugen, a former Facebook product manager for civic misinformation, stated that by design the Facebook algorithm is consistently used to prioritize the company’s own profits over users’ health and safety. As an example she explained how the algorithm, in its drive towards more profitable content, could steer young users from something relatively innocuous such as healthy recipes to content promoting anorexia in a short period of time.

Béjar previously worked as an engineering director at Facebook from 2009 to 2015, gaining recognition for his efforts to combat cyberbullying. Later he worked as a Meta consultant. In this capacity, his team at Meta created “Bad Emotional Experience Feedback” (BEEF) a recurring survey of 238,00 users’ experiences in the previous week.

Other statistics from these surveys raised concerns as well. Of the 13—15 year-olds on Instagram that filled out the survey, 26% said they had witnessed discrimination based on various identities and 21% felt worse about themselves due to others’ posts on Instagram.

Meta on the other hand issued a statement saying it’s working hard to keep minors safe.

> “The issues raised here regarding user perception surveys highlight one part of this effort, and surveys like these have led us to create features like anonymous notifications of potentially hurtful content and comment warnings.”

Meta has rolled out some 30 parental controls to manage who children can talk to or how much time they spend on Facebook and Instagram. In an earlier statement, Meta said it has strict policies and technology to prevent predators from finding or interacting with teenagers on its apps.

> “We’re continuously exploring ways to actively defend against this behavior, and we set up an internal task force to investigate these claims and immediately address them.”

Despite these promises, Béjar’s statements have reinforced in some senators the need for the Kids Online Safety Act (KOSA), to ensure that companies like Meta have a duty of care to the young people that drive their record profits.

KOSA is a bill that was introduced in the United States Senate in February 2022 and reintroduced in May 2023, The bill establishes guidelines meant to protect children on social media platforms. Criticism of the bill mostly points out that it might potentially enable censorship and increased online surveillance.

Nevertheless, this testimony and others may be the cause of dramatic changes to how kids use social media. Reportedly, a group of 42 US attorneys general already announced they are suing Meta Platforms Inc. for harms they say Instagram and Facebook are perpetrating on young people.

Instagram has already been fined €405 million after European Union privacy regulators came to a decision on a long-running complaint related to how the social media platform handles children’s data.

We are pretty confident that these are not the last fines and lawsuits Meta will face, but whether they will help to keep our children safe from predators remains to be seen. We will keep an eye on this.

**We don’t just report on threats—we remove th**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Meta whistleblower says company has long ignored how it sexually endangers children 

The FBI is investigating a data breach where cybercriminals were able to steal patients’ records from a Las Vegas plastic surgeon's office and then publish them online.

The FBI is investigating a data breach where cybercriminals were able to steal patients’ records from a Las Vegas plastic surgeon’s office, and then post the details online which included nude photos.

In February, cybercriminals gained access to Hankins & Sohn’s network, which has offices in both Henderson and Las Vegas. From there, the cybercriminals were able to download patient information.

The practice sent a letter to patients in March and April notifying them of the breach.

> “On or about February 23, 2023, Hankins & Sohn became aware of suspicious activity relating allegations by an unknown actor that data was stolen from our network. We quickly took steps to investigate the validity of the claims and to assess the nature and scope of the activity and what information may have been affected. We are also working with law enforcement to investigate the activity. We learned that files were taken by the unknown actor prior to this date.”

Apparently, the cybercriminals didn’t get what they wanted from Hankins & Sohn and started posting the information online. Several patients and court documents say that the stolen data included sensitive personal information, such as names and Social Security numbers, but also nude photos of patients taken before and after surgery.

They cybercriminals didn’t stop at that. They sent the data, along with the nude photos, to family and friends through patients’ email accounts.

According to 8NewsNow, about a dozen women have since filed a lawsuit against the firm, claiming they did not do enough to protect their private and personal information. None of the documents posted online were encrypted. It was unclear Monday if Hankins & Sohn was storing its data per HIPAA rules. A spokesperson for the office that oversees HIPAA-related investigations declined to comment.

HIPAA is short for Health Insurance Portability and Accountability Act. HIPAA is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.

The victims claim that the Hankins and Sohn failed to implement adequate and reasonable cybersecurity procedures and protocols to protect their Personally Identifiable Information (PII) and Protected health information (PHI).

**Data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
*   Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   Enable two-factor authentication. Where possible, use a FIDO2 2FA device. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify any contacts using a different communication channel.
*   Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your and your family’s personal information by using Malwarebytes Identity Theft Protection.

 Nude “before and after” photos stolen from plastic surgeon, posted online, and sent to victims&#8217; family and friends 

A SysAid vulnerability is actively being exploited by a ransomware affiliate.

Users of SysAid on-premises should take action to deal with a vulnerability. SysAid is a widely used IT service management solution that allows IT teams to manage tasks.

Microsoft discovered an ongoing exploitation of a zero-day vulnerability in the SysAid IT support software in limited attacks by Lace Tempest. Lace Tempest is an initial access broker (IAB) usually associated with the Cl0p ransomware.

Once SysAid were notified by Microsoft on November 2, 2023, they started an investigation which confirmed that it was indeed a zero-day vulnerability. By definition, a zero-day vulnerability is any software vulnerability exploitable by hackers that doesn’t have a patch yet.

The investigation identified a previously unknown path traversal vulnerability leading to code execution within the SysAid on-prem software. Path traversal vulnerabilities allow attackers to read, and possibly write to, restricted files by inputting path traversal sequences like ../ into file or directory paths.

The attackers used the vulnerability to upload a web shell and other payloads into the web root of the SysAid Tomcat web service. Tomcat is an open-source web server and servlet developed by the Apache Software Foundation. A web shell is a malicious script used by an attacker with the intent to escalate and maintain persistent access on an already compromised web application.

The web shell provided the attacker with unauthorized access and control over the affected system. The attackers then used two PowerShell scripts to expand their hold. One to launch the Gracewire malware loader and the other to erase other evidence of the intrusion.

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The CVE assigned to this vulnerability is:

CVE-2023-47246: a path traversal vulnerability that affects all SysAid On-Premises installations running versions before 23.3.36. SysAid Cloud customers are not affected by this vulnerability.

If you are a SysAid customer using a SysAid On-Prem server, you are under advise you to ensure that your SysAid systems are updated to version 23.3.36 or later, which includes the patches for the identified vulnerability.

Organizations using SysAid should apply the patch as soon as possible and look for any signs of exploitation prior to patching (see Indicators of Compromise below). The Lace Tempest group exploited the vulnerability in the SysAid software to deliver a malware loader for the Gracewire malware. Once this foothold is established, it’s usually followed by human-operated activity, including lateral movement, data theft, and ransomware deployment.

You should also review any credentials or other information that would have been available to someone with full access to your SysAid server and check any relevant activity logs for suspicious behavior.

**IOCs**

**File:**

b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d     Malicious loader

**IPs:**

81.19.138.52     GraceWire Loader C2

45.182.189.100 GraceWire Loader C2

179.60.150.34  Cobalt Strike C2

45.155.37.105  Meshagent remote admin tool C2

_Malwarebytes blocks the Cobalt Strike C2 179.60.150.34_

**File Paths:**

C:\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles\\user.exe

C:\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles.war  

C:\\Program Files\\SysAidServer\\tomcat\\webapps\\leave  

**How to avoid ransomware**

*   **Block common forms of entry.** Create a plan for patching vulnerabilities in internet-facing systems quickly; and disable or harden remote access like RDP and VPNs.
*   **Prevent intrusions.** Stop threats early before they can even infiltrate or infect your endpoints. Use endpoint security software that can prevent exploits and malware used to deliver ransomware.
*   **Detect intrusions.** Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
*   **Stop malicious encryption.** Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
*   **Create offsite, offline backups.** Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
*   **Don’t get attacked twice.** Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

Source

Malwarebytes