Mangatoon Mega Breach, Security Companies as Phishing Bait, 0mega Ransomware, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 11 July, 2022
Episode 262 - 11 July 2022
Mangatoon Mega Breach- https://www.bleepingcomputer.com/news/security/mangatoon-data-breach-exposes-data-from-23-million-accounts/
Security Companies as Phishing Bait -
https://www.zdnet.com/article/brazen-crooks-are-now-posing-as-cybersecurity-companies-to-trick-you-into-installing-malware/
La Poste Mobile Attacked -
https://www.infosecurity-magazine.com/news/ransomware-french-telecomes/
Edge Zero Day Patch- https://www.techradar.com/news/microsoft-edge-gets-emergency-patch-for-severe-zero-day-vulnerability
0mega Ransomware -
https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/
Hi, I’m Paul Torgersen. It’s Monday July 11th 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Comic reading platform Mangatoon has suffered a data breach that exposed information belonging to 23 million user accounts. It appears to have been stolen from an unsecured Elasticsearch database. There has been no response whatsoever from the company, so if you want to know if your information was involved you will have to head over to haveibeenpwned (.) com to check.
From ZDNet.com:
Criminals are posing as cybersecurity companies in phishing campaigns which claim that the recipient has been hit by a cyber attack. They are urged to respond in order to protect their network from being further compromised. Of course that response then opens the door to the hackers to actually compromise their network. The article has a link to the research by Crowdstrike, who also happens to be one of the companies being impersonated.
From Infosecurity-Magazine.com:
A ransomware attack, most likely LockBit, has hit French telecoms operator La Poste Mobile. The company took down their public facing website and customer area as a precaution and they remain down a week later. They claim their routers were secure, but employee desktops may have been breached. They are urging customers to be extra alert for targeted phishing or identity theft attacks.
From TechRadar.com
A few days after Google patched a zero day flaw in Chrome, Microsoft has now patched that same flaw in Edge. While both companies are keeping mum on details, we do know it is a heap-based buffer overflow weakness and it has been compromised in the wild. Get your patch on kids.
And last today, from BleepingComputer.com
A new ransomware operation named 0mega, with a zero instead of an O, targets organizations worldwide in double-extortion attacks. No sample has yet been examined, so there is not a lot of data about how the ransomware encrypts files. We do know that it appends the .0mega extension to the encrypted file’s names and creates ransom notes named DECRYPT-FILES.txt. These notes are customized per victim, usually containing the company name and describing the different types of data stolen in the attack. Victims are directed to a Tor payment site with a support chat that they can use to contact the ransomware gang.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.