Monthly threat updates fromF-Secure
November 2022

Discover the latest
threat updates. Packedwith insights from theexperts at F-Secure.
Delivered every month.
In this inaugural issue of F-Alert, we review the latest
cyber security threats and data breaches fromNovember. Discover Facebook scammers’ new trick.
See how criminals spread a malicious Android app.
And learn how the month's biggest breaches might
affect you and your data.

Monthly threat report from F-Secure | November 2022

2Scammers target Facebook
Malicious Facebook pages use notifications to drive victims tophishing sites

Joel Latto
Threat Advisor
Helsinki, Finland

A new wave of scams utilizes
Facebook’s tagging feature to trick
Page owners into believing they’veviolated Facebook’s terms andconditions. Several variations of theattack exist, but all lead to phishingsites designed to steal Page owner’scredentials.

The scammers make it
personal“After the Post is published on
the malicious Page, victims
receive notification that action
must be taken quickly toprevent their pages
being ‘permanentlydisabled,’” explained
Joel Latto, F-Secure
Threat Advisor.

This tactic creates both confusion
and a sense of urgency. “The sourceof the notification is unclear,” Lattosaid. “And since victims may believe
this is an official notification that
requires quick action, they areless likely to spot the red flags thatsuggest the message isfraudulent.”
Stolen accounts can beused for several malicious
purposes—such as
promoting scams,
running questionableads, impersonating
businesses,
or reselling
accessto othercriminals.

Slipping through Facebook’s
detection
F-Secure observed one scam page
publishing a new Post every couple ofminutes, totaling roughly 47 posts inan hour, with each post tagging 25-30
pages. This resulted in over 1,000
Pages being targeted each hour forseveral days before Facebook shut itdown.
“This type of spamming seems to beable to evade Facebook’s inauthentic
behavior detection systems
surprisingly well,” Latto said.

expert tip
The first line of defense for Page owners is to secure
your personal account with a strong, unique password
and turning 2FA (two-factor authentication) on. You
should also periodically review which apps, agencies
or ex-employees have access to your Page.

“F-Secure observed one scam page
published a new post every coupleof minutes.”Sharkbot reappears
SaroginiManager of ThreatProtection Engineering
TeamThe malicious Android app has been spotted in the Google Play
store and it continues to spread by other means

Kirkkonummi, Finland

expert tip
A reputable mobile security product such as F-Secure
TOTAL will do a regular scanning of your device tomake sure no known malware has been detected. If an
infection is found, uninstall the malicious app and stopusing the device for any financial transactions.

Just when you thought it was safe togo back in the water, two versions of
the Android malware Sharkbot havebeen spotted inside Google Play,again.
Tens of thousands of users appear tohave downloaded the most recent
versions of the malicious software
posing as an antivirus app.

Sharkbot has fierce features
F-Secure has been detecting
Sharkbot since early 2022, says

“Check an app's reviews for fakecomments and overly positive 5-starevaluations.”

Sarogini, who leads F-Secure’s ThreatProtection Engineering team.

continually this year via text andinstant messages.”“Based on our telemetry, victims weremostly from Europe, with the vast
majority of infections found in theUnited Kingdom,” she said.

Be careful which apps you
invite into your device

The fake apps allow criminals to steal
victims’ credentials. They include
a keylogger to track button clicks
and SMS intercept, which reveals all
text messages. In addition, remotecontrol functionality allows criminals
to bypass security features to makefinancial transactions without thedevice owner’s knowledge“While Sharkbot versions dooccasionally appear inside the official
Play store, the malware has spread

Taking time before downloading any
app is a good rule. “Android users
should be very careful when clicking
links leading to the installation of‘Antivirus’ or ‘Cleaner’ apps,” Sarogini
said.
“Check an app’s reviews for fakecomments and overly positive 5-starevaluations. Likewise, look out forvery poor reviews, which could comefrom victims who have experienced
unusual or malicious activities afterinstallation.”

4

Breach reports
Locally

PrivatBank

Gmail Combolist

Discovered: 3/11/2022

Discovered: 10/11/2022

Discovered: 17/11/2022

Affected people:
Nearly 1.9 million users

Affected people:
Nearly 27 million customers

Affected people:
More than 100,000 Gmail users

Breach severity:

Breach severity:

Breach severity:

US Based Fraud Protection
Company
Discovered: 17/11/2022
Affected people:
More than 400,000 consumers
Breach severity:

After Locally.com was breached in
October, private data from the shoppingsite began to be privately shared on theinternet. In addition to names, email
addresses, and passwords, stolen credit
card information is being circulated.
Affected users should contact their banks
and replace this card with a new card
number immediately. Ask your bank tocheck for fraudulent transactions andfile a fraud alert with one of the creditbureaus.

Data belonging to PrivatBank was leakedon a Telegram channel in September.
Names, email addresses, phone numbers,
passport numbers, and usernames fromthe Ukrainian financial company arebeing privately shared on the internet. This
information could easily be used to falsify
documents. Anyone whose information
has been shared as part of this leak could
become the victim of a highly targeted
spear phishing attack that exploits thestolen data. Extreme caution is advised.

This collection of Gmail addresses andpasswords from previously breached sites
was shared on a hacking forum. This data
is likely being used for 'credential stuffing,'a technique where criminals automate thework using lists of stolen credentials bruteforce tools to try to crack into the accounts
on thousands of other websites. All Gmail
users should secure their accounts
with strong unique passwords and use
two-factor authentication for addedprotection.

Want to know if you were affected by any of these breaches?
Check out our F-Secure Identity Theft Checker!
Monthly threat report from F-Secure | November 2022

Information belonging to a U.S.-based
fraud protection software company wasleaked on a hacking forum in Octoberof 2022. The data contains names,emails, phone numbers, and credit cardnumbers. Victims should immediately
report their credit cards as stolen. Given
that the company breached was in thebusiness of preventing fraud, customers
should also expect targeted andconvincing phishing attacks. Any email
regarding fraud protection should beverified by a phone call to the company
that sent it.

5Emotet returns
The massive malware botnet has returned from vacation to spam users
with hundreds of thousands of malicious emails each day

Yik HanResearcherPuchong, Malaysia

The massive malware operation
known behind Emotet has returned
from a four-month vacation andis currently blasting out millions
of emails each week to spread itsmalware.

Change is nothing new for
EmotetF-Secure researchers Yik Han andAmit Tambe have tracked Emotet’s
activity and noted that the malware
has regularly taken breaks andreturned with new functionalitiessince it first appeared as abanking trojan in 2014.
“The grouphas becomea successful

malware-as-a-service offering, which
has been used by a variety of threat
actors leading to a variety of attacks,
including some ransomware attacks,”
said Yik Han.
The threat actors utilizing Emotet
have also continued to evolve theirdelivery methods, using a variety
types of file attachments in spam
campaigns--including malicious
documents with macros, PDFs
with malicious links, and passwordprotected zips.

Consumers pay when Emotet
plays“Constant development makes
Emotet malware a popular choice ofcriminal groups that carry out attacks
against key industries—including
health care, higher education andpublic sector infrastructure,” Yik Han
said. “These attacks often lead to thetheft of huge amounts of consumer
information.”expert tip
A tool like F-Secure's IDENTITY PROTECTION helps
you check if your information has been breached.
Watch out for any unusual activity related to yourdata—such as increased spam, unusual calls, ormisuse of your email to sign up for services.

Criminals often sell stolen data on thedark web—leading to identity theft,fraud, and various scams.

“Constant development makes
Emotet malware a popular choice ofcriminal groups.”

StrelaStealer robs emails
Patricia Dacuno
Senior Researcher

New malware goes after users of two popular email clients andshows how infostealers keep expanding their targets

Helsinki, Finland

expert tip
Information stealers often arrive as fake installers
or cheats for gaming apps. That’s why your family
should only download software from trusted andofficial websites. Also, avoid opening attachments
and clicking links from email messages coming fromunknown senders.

Newly identified malware
StrelaStealer goes after email
credentials by targeting users ofMicrosoft Outlook and MozillaThunderbird. This infostealer was firstspotted targeting Spanish businesses
in early November.

which is free,” said Patricia Dacuno,
Senior Researcher at F-Secure.

Business users of all sizes
targeted“This suggests businesses, perhaps
specific businesses, are the current
target of the threat actors,” she said.

“Outlook is the most popular email
program for large businesses andenterprises, while many smaller
businesses rely on Thunderbird,“Stolen email addresses can makefake messages look more legitimate
to lure unsuspecting users.”

She noted the decoy document
sent as an attachment in the attack
claims to come from a vehicleleasing company that serves mostlycorporate clients.

A new goldmine
By focusing on credentials stored inemail clients, StrelaStealer adds tothe long list of data types infostealers
have targeted.
“Infostealers typically grab datastored in browsers by the autofillfeature,” Dacuno said. “The data theysteal, and then often leak, can include
a variety of personal and financial
details.”
Criminals may follow up the attacks
by stealing money or cryptocurrency,
selling information on the blackmarket, or using stolen information tocarry out additional attacks.

Don’t feed the stealers“To protect your data from being
stolen, avoid using the autofill featureof the browser as much as possible—
especially for sensitive information,such as usernames, passwords,
billing information, or any personalidentification,” Dacuno.

7Huge breach for insurance firm
Medibank customer data has been breached and leaked by a groupsuspected to be associated with notorious ransomware gang REvil

Laura Kankaala
Threat Intelligence
LeadHelsinki, Finland

Criminals have continued to releasehighly sensitive data for patientscovered by Australian insurance
giant Medibank after nearly 10 million
customers had their data exposed
early in November.

The threat actors—which many
experts believe to be associatedwith REvil, a ransomware gang theRussian government claimed to haveshut down in January of this year—
started by dumping masses of dataon their leak site on dark web.

Extortion continues to rampup

This has been followed by a gradualrelease of medical records.

“Private information has been
compromised, but Medibank has
made the right decision by not paying
the ransom and therefore funding
cyber crime,” said Laura Kankaala,
F-Secure’s Threat Intelligence Lead.
“When dealing with ransomware
gangs, there are no guarantees
that paying would actually change
anything."“These records don’t show a patient’s
whole medical history, unlike in thecase of the Finnish psychotherapy
firm Vastaamo where entire casehistories were leaked,” she said.
“However, there are diagnosis
numbers associated with treatments
received.”
This has led to patients from theMedibank leak with a history ofmental health care being placed on adark web list entitled “Psychos.”“Despite the escalation, Medibank
has continued to insist it will not pay,”
she said. “The attackers said that they
are waiting to post more information
soon unless their demands are met."
After leaking some more data on
the weekend before Black Friday,
the attackers' leak site suddenly
went offline without any explanation.
Days later, the site reappeared justas mysteriously, and the situation
continues to evolve.

expert tip
Protect your online identity with strong and uniquepasswords and enable multi-factor authentication forservices that you use. Furthermore, be cautious forphishing attacks and immediately contact the police
in case any extortion attempts are made towards you.

“Private information has been
compromised, but MediBank has
made the right decision.”

About F-Secure
F-Secure makes every digital moment more secure, for everyone.
We deliver brilliantly simple, frictionless security experiences thatmake life easier for the tens of millions of people we protect andour 170 partners.
For more than 30 years, we’ve led the cyber security industry,inspired by a pioneering spirit born out of a shared commitment to
do better by working together.
For more information visit F-Secure today!