A daily look at the relevant information security news from overnight - 06 June, 2022

Episode 238 - 06 June 2022

Patched Atlassian- https://www.securityweek.com/atlassian-patches-confluence-zero-day-exploitation-attempts-surge

Yuga Labs phished -
https://www.bleepingcomputer.com/news/security/bored-ape-yacht-club-otherside-nfts-stolen-in-discord-server-hack/

Novartis data sale - https://www.bleepingcomputer.com/news/security/novartis-says-no-sensitive-data-was-compromised-in-cyberattack/

U-Boot baddie -
https://www.securityweek.com/critical-u-boot-vulnerability-allows-rooting-embedded-systems

Reverse Tunnel phishing -
https://www.bleepingcomputer.com/news/security/evasive-phishing-mixes-reverse-tunnels-and-url-shortening-services/

Hi, I’m Paul Torgersen. It’s Monday June 6th, 2022, and this is a look at the information security news from overnight.

From SecurityWeek.com
We talked Friday about the zero-day affecting Atlassian Confluence Server and Data Center. Well, two things have happened since then; Atlassian has issued a patch, and attempts to exploit the vulnerability have gone through the roof. According to a Cloudflare report, they say they have seen evidence suggesting that potentially malicious payloads have been delivered since at least May 26. We may not have seen the full impact of this vulnerability quite yet. And in the meantime, get your patch on kids.

From BleepingComputer.com:
Hackers reportedly stole over $257,000 in Ethereum and thirty-two NFTs after the Yuga Lab's Bored Ape Yacht Club and Otherside Metaverse Discord servers were compromised in a phishing scam. The scam pretended to be an exclusive, limited giveaway for existing NFT holders, which included a link to a webpage that allowed a visitor to mint a free NFT. You can imagine where the link really went. Details in the article.

Also from BleepingComputer.com:
Data extortion group Industrial Spy began selling data allegedly stolen from Novartis on their Tor extortion marketplace for $500,000 in bitcoin. The data is supposed to be related to RNA and DNA-based drug technology, although Novartis says that no sensitive data was compromised. There are 7.7 MB of PDF files for sale, but it is unclear if that is the extent of the data that was taken. Novartis has no comment yet about how and when the data was accessed.

From SecurityWeek.com:
A critical vulnerability in the U-Boot, boot loader could be exploited to write arbitrary data, and ultimately allow an attacker to gain root on Linux-based embedded systems. The open-source boot loader is used in various types of embedded systems, including ChromeOS and Android, and supports multiple architectures. NCC Group says a patch is in the works.

And last today, from BleepingComputer.com
Researchers are seeing an uptick in phishing campaigns utilizing reverse tunnel services along with URL shorteners, which makes them a bear to get shut down. With reverse tunnels, threat actors can host the phishing pages locally on their own computers and then route connections through external services. Often, they refresh those phishing links in less than 24 hours, making it nearly...