Cybersecurity News Byte with Jim Guckin: Recent Episodes
Jim Guckin
A weekly show that covers the important news stories in the Cybersecurity world with commentary by Jim Guckin
This week we talk about [0:36] how PowerSchool’s deleted data came back to haunt North Carolina schools, then [6:09] a massive IoT botnet that turned everyday devices into cybercriminal accomplices, then [11:13] a sneaky backdoor hidden in Magento extensions for over six years, and finally [15:50] how a government-endorsed Signal clone led to a national security headache.
Contents Commvault’s Zero-Day Drama. 2 Harrods Joins the Cyber Hit List 3 The Malware Love Story You Didn’t Swipe Right On. 4 When Your Router Turns Against You. 5 Links Commvault’s Zero-Day Drama Harrods Joins the Cyber Hit List The Malware Love Story You Didn’t Swipe Right On When Your Router Turns Against You Phish,...
Contents Cookie-Bite Attacks: Emerging Threat to Cloud and MFA Security. 2 Lazarus Strikes Before You Update. 3 Hackers Exploit Cloudflare Tunnels to Infiltrate Systems. 4 R00TK1T’s TikTok Takedown. 5 Links Cookie-Bite Attacks: Emerging Threat to Cloud and MFA Security Lazarus Strikes Before You Update Hackers Exploit Cloudflare Tunnels to Infiltrate Systems R00TK1T’s TikTok Takedown
From fake Chrome download pages spreading SpyNote malware to stealthy attacks on Fortinet devices and dangling DNS exploits, cyber criminals are getting creative. Meanwhile, Volt Typhoon shows China’s long game in infiltrating U.S. infrastructure. This episode dives into the hidden threats lurking behind legitimate facades.
From fake toll smishing attacks and job scam malware to tax-themed phishing and compromised npm packages, cybercriminals are pulling out all the psychological stops. This episode exposes how attackers prey on urgency, trust, and tax season chaos to deploy malware like BeaverTail, Tropidoor, and Remcos. Tune in to learn how to spot the tricks before they drain your data—or your crypto wallet.
On my return for 2024, we talk about [00:36] how a Russia backed group hacked Microsoft's top leaders email account, [09:25] VMWare sounds the alarm about their latest critical vCenter vulnerability that's currently being used in attacks, [16:00] How...
This week we talk about [00:36] ownCloud let's it users know it's found 3 critical vulnerabilites in some of it's software, [06:57] A school app based in India was leaking personal student data due to misconfiguration, [12:15] Microsoft takes a...
This week we talk about [00:36] We talk about how some security researchers were able to extract a RSA key from signing errors, [07:27] How a now defunt shadowy hack-for-hire group was behind a bunch of attacks, [15:11] Vulnerabilities in some AL and...
This week we talk about [00:36] The Lace Tempest group seen exploiting a vulnerability in a popular IT Support Software, [06:46] Then we talk about how a company suffered a compromise, paid the attacker and the data was still leaked, [13:38] We talk...
This week we talk about [00:36] A zero-day in a popular webmail client that can be exploited without interaction, then [06:38] How Octo Tempest gang's new addition to social engineering is a little scary, [14:12] The Lockbit gang has claimed to have...
This week we talk about [00:36] a new advertising campaign that is targeting Notepad++ to spread malware, then [00:36] a new cheaper malware avaialbe to cybercriminals that you need to be aware of, [00:36] a IT company's misconfiguration exposes...
This week we talk about [00:36] How the blockchain is being utilized to help the spread of malware, [08:18] How the ToddyCat malware is being improved upon and how it's being utilized for compromising exchange servers, [14:47] How ALPHV has stolen...
This week we talk about [00:36] a new phishing campaign that is using your reservations at hotels to target you from the hotel itself, then [08:20] how a proof on concept code that was released contained malware, [14:23] USDoD a notorious threat actor...
This week we talk about how a new attack, is actually just hackers using the tools that security testers are using against us, Then we talk about how Apple has a new 0-day vulnerability that needs patching, and then to be fair we talk about the new...
Links https://securityaffairs.com/149076/data-breach/burger-king-exposed-sensitive-credentials.html https://lolbas-project.github.io/ https://www.bleepingcomputer.com/news/security/hackers-can-abuse-microsoft-office-executables-to-download-malware/ https://youtu.be/bOa5frisxss https://www.securityweek.com/decommissioned-medical-infusion-pumps-expose-wi-fi-configuration-data https://www.rapid7.com/blog/post/2023/08/02/security-implications-improper-deacquisition-medical-infusion-pumps/ https://www.networkworld.com/article/3694848/your-decommissioned-routers-could-be-a-security-disaster.html https://www.helpnetsecurity.com/2023/04/19/decommissioned-routers-sensitive-corporate-data/ https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-flaw-after-being-called-irresponsible-by-tenable-ceo/ Burger King’s Password Mistake * Burger King + 19 thousand restaurants + revenue of $1.8 billion + French domain site + Subdomain for job postings + Fixed now. * Cybernews research team + June 1 + publicly accessible environment file - .env - Environment variables - used to store sensitive data. * passwords * API credentials * information that should not be written directly in code. - Code * The file shows their production database credentials. + Researchers couldn’t look to see what it had...legally. - Assume job posting information. - Any maybe job hunter’s information + Just having the credentials is part of a breach. - Still need a way to exfil the data. + Google Tag Manager - used to optimize update measurement codes and related code fragments. - Maybe change it to their own, to monitor the site. + Protect yourself. - Ensure proper permissions. - Use a dedicated secret manager. * Another piece you need to learn by safer.
Growing Dangers of LOLBAS * LOLBAS + Living Off the Land Binaries And Scripts (some libraries) - Formally called LOLBins + Binaries (and now scripts/libraries) of a non-malicious nature + local to the operating system + that have been utilized and exploited by malicious actors to camouflage their malicious activity. * LOLBAS Project + 150 Windows-related binaries, libraries, and scripts + Tied to MITRE framework. * Pentera + Security Researcher, Nir Chako + Wanted to find LOLBAS in Microsoft Office. - Found 3 used as downloaders. * exe (not yet) * exe (accepted) * exe (not yet)
Proper Decommissioning of Devices * Rapid7 + Analyzed 13 infusions pumps. - 3 different models * Alaris PC 8015 * the Baxter Sigma Spectrum model 35700BAX2 and associated Wireless Battery Module (WBM), * Hospira Abbott PLUM A+ with MedNet. - No longer manufactured. * devices are still in use within numerous medical organizations worldwide. - Findings * attempted the extraction of sensitive data + devices’ compact flash cards + observing serial communication - removing the flash memory chips from the main circuit boards. + Alaris 8015 - Found * hostnames with domain information * AES keys for encryption * service set identifiers (SSIDs) * clear text Wi-Fi Pre Shared Keys (PSK) passphrase * credentials for Microsoft Active Directory authentication * Wi-Fi configuration settings. - While there is no documentation regarding the data purge process for the Alaris 8015 decommissioning found online, Alaris did publish security service bulletins that are available for organizations having support contracts with Becton, Dickinson and Company (BD). + Baxter Sigma Spectrum 35700BAX2 devices and associated Wireless Battery Module (WBM) - Wi-Fi configuration data * including the Wi-Fi Protected Access (WPA) passphrase converted to a 64-character hex key (PSK). - provide documentation detailing the steps that should be taken to reset wireless configurations and remove any other information from both the device and the WBM. + The Hospira Abbott PLUM A+ with MedNet - Found * WiFi configuration information - no single procedure could be located that detailed the needed steps for removing all critical data such as PHI, and Wi-Fi configuration data in preparation of decommissioning. + Tools - Easy to get - $250-$1500 + April 2023 - Routers on secondhand market * 22% contained customer data. * 33% exposed data allowing third-party connections to the network. * 44% had credentials for connecting to other networks as a trusted party. * 89% itemized connection details for specific applications * 89% contained router-to-router authentication keys. * 100% contained one or more of IPsec or VPN credentials, or hashed root passwords. * 100% had sufficient data to reliably identify the former owner/operator.
Microsoft fixes flaw after being called irresponsible by Tenable CEO * Power Platform Custom Connectors feature + Microsoft fixed a security flaw. + let unauthenticated attackers access cross-tenant applications and Azure customers' sensitive data. * Root Cause + stemmed from inadequate access control measures for Azure Function hosts launched by connectors within the Power Platform - use custom C# code integrated into a Microsoft-managed Azure Function featuring an HTTP trigger. + custom connectors usually happen via authenticated APIs, the API endpoints facilitated requests to the Azure Function without enforcing authentication. - opportunity for attackers to exploit unsecured Azure Function hosts and intercept OAuth client IDs and secrets. + Tenable v Microsoft - It’s not an issue of information disclosure. * This is about being able to access and interact with the unsecured Function hosts. + From there trigger behaviors that could have further impact * Tenable, pointed out because of the nature of the service, the impact would vary for each individual connector. + be difficult to quantify without exhaustive testing. * Tenable very quickly discovered authentication secrets to a customer who was a bank with permission. - PoC * Tenable also shared proof of concept exploit code and information on the steps required to find vulnerable connector hostnames and how to craft the POST requests to interact with the unsecured API endpoints. - Microsoft blows off Tenable. * Microsoft initially stated that the researcher was the only one who exploited the issue. * After further analysis in July, Microsoft determined that there were some Azure Functions in a "soft delete" state that had not been properly mitigated. + Finally resolved the issue for all customers on August 2nd - after an initial fix deployed by Redmond on June 7th was tagged by Tenable as incomplete. + Microsoft addressed it after a five-month period - but not before the CEO of Tenable voiced vehement criticism against the initial response. Calling it "grossly irresponsible" and "blatantly negligent." In a lInkedIN post - "Did Microsoft quickly fix the issue that could effectively lead to the breach of multiple customers' networks and services? Of course not. They took more than 90 days to implement a partial fix – and only for new applications loaded in the service," - "That means that as of today, the bank I referenced above is still vulnerable, more than 120 days since we reported the issue, as are all of the other organizations that had launched the service prior to the fix.
Links
https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/
https://www.infosecurity-magazine.com/news/education-sector-highest/
https://www.bleepingcomputer.com/news/security/breachforums-database-and-private-chats-for-sale-in-hacker-data-breach
A Novel Exploit for the "search-ms" Protocol * Trellix + Advanced Research Center + blog post July 26 + uncovered a novel attack technique leveraging the “search-ms” URI protocol handler. - emerged as a potent initial attack vector, it is important that security teams anticipate a potential increase in attacks using this method: it offers threat actors a convenient way to deliver malicious payloads while evading traditional security defenses. * search-ms + Windows users conduct search operations via a URI. - Uniform Resource Identifier + it is a benign operation (usually) - combined with another vulnerability such as within Windows documents, attackers can potentially use it as a part of a broader phishing or malware campaign. * Attack + Observed utilization in Phishing campaigns. - Usually, phishing language - Pretends to be an attachment in the email. * HTML or PDF * Shows with a trusted logo. + Adobe, Microsoft, Etc. * Link is really a link to another site. + threat actors create malicious Microsoft Word documents. - that exploit vulnerabilities in Microsoft Office and Windows + triggering the search-ms protocol handler to open a remote Windows Search window. + Window lists executables hosted on a remote SMB share. - disguised as something innocent like "Critical Updates. - unwittingly install malware onto their system - gives the user the illusion of trust. - user is more likely to open the file, assuming it is from their own system. * Remediation + proposed is to remove the search-ms protocol handler from the Windows Registry. Doing so will prevent the malicious documents from triggering the "search-ms" command, thus protecting the user from this attack vector.
What is Nitrogen Malvertising * Malware using Advertising Campaigns + New campaign - Exploiting Google Search and Bing Ads + Targets Technology and Non-Profits in North America + Pay-per-click. - Not new - As they are paid, they appear prominently on the page. * Mostly over the actual site - popular tactic among threat actors * Campaign + Buy ads pretending to be popular brands. - AnyDesk, Cisco AnyConnect, TreeSize Free, and WinSCP + Taken to a compromised WordPress page. - Made to look like a legitimate site. + Download the file. - Run and Infected * Nitrogen Malware + When installer is running - Side loads a NitrogenInstaller.DLL file. * Has a legitimate installer application. * Along with malicious phyton - Python package uses Dynamic Link Library (DLL) preloading. * execute the malicious NitrogenStager file. + connects to the command-and-control (C2) servers. - drop both a Meterpreter shell and Cobalt Strike Beacons - uncommon export forwarding and DLL preloading techniques to mask their malicious activity and hinder analysis.
Education Sector Has Highest Share of Ransomware Victims * Sophos + The State of Ransomware in Education 2023 + 400 IT and cybersecurity leaders globally - split evenly across schools and higher education institutions. * Results + 79% of higher education institutions were compromised by ransomware in 2022. - up from 64% on 2021 + 80% of “lower” education institutions were compromised by ransomware in the past year. - Was 56% in 2021 + Exploits and compromised credentials accounted. - 77% of ransomware attacks against higher education organizations - 65% of attacks against lower education organizations + compromised credentials. - Higer Ed 37% - Lower Ed 36% - 29% average * Glaring Problems + The lack of adoption of multi-factor authentication (MFA) technology in the education sector makes them even more at risk of this method of compromise. + High ransom payments - Higer Education – 56% - Lower Education – 47% + Not great on backups - 63% * 70% average
BreachForums database and private chats for sale * Breach Forums + large hacking and data leak forum - notorious * hosting * leaking * selling data stolen + Clear web Was seized by multiple international agencies. + Site administrator Connor Brian Fitzpatrick was arrested. + Baphomet (other side admin) shut down. - Opened a clone site. + Redirected to sized domain banner page. * HaveIBeenPwned + July 26 - Visitors can check if their information was exposed in a data breach of the Breached cybercrime forum. + November 2022 - "BreachForums" was itself, breached. * Breached Breach Forum + 212k records - Usernames - IP - email addresses - private messages between site members * potentially revealing information on past attacks, identities, and other useful information. - Passwords - Payment information * payments made to purchase forum ranks (membership levels with extra benefits) and credits (a form of currency used on the forum) * These payments were processed through CoinBase Commerce or Sellix, with the Coinbase transactions including links to order confirmations containing sensitive information, such as cryptocurrency addresses and Coinbase payment IDs. * This cryptocurrency data can be useful to blockchain analytics companies, who can use the cryptocurrency addresses to link threat actors to criminal activity. + stored as argon2 hashes. * Tables Turned + database is currently being sold. - they shared the database with Have I Been Pwned to prove its authenticity to potential buyers. - The seller said that only they, Baphomet, and Pompompurin have possession of the database. - Selling to only one person for $100,000 - $150,000 and that it contains a snapshot of the entire database taken on November 29th, 2022. + Previous Breached admin Baphomet has also confirmed the authenticity of the database, warning that its sale is part of a "continued campaign attempting to destroy the community. - Baphomet said, “Judging by the 212k users, this is likely an older database months before the closing of BFv1, seeing that my last backup of the forum has 336k users."
Links
Risks of Illegal Software Downloads * HotRat + Automatic Script - Utilizes the icon for cracked software. - This runs the HotRat RAT * Remote Access Trojan * Variant of AsyncRaT + Available on GitHub * Victims + Download software from - Torrent - Cracked site. + Popular Software - Adobe * Illustrator, Master Collection, Photoshop - Microsoft * Office, Windows - Video games * Battlefield 3 * Age of Empires IV * Red Alert 2 * The Sims 4 - Premium software * IObit Driver Booster * VMware Workstation * Revo Uninstaller Pro * Attack Path + AutoHot Key (needs Admin) - Removes User Access Control * Requiring operations to run without permission. - Uninstalls Avira AV - Modify’ s Windows Defender + Creates Scheduled task. - Using PowerShell * Runs the new task as a misspelled administrator. - Every 2 hours - Runs a VBS loader. * Visual Basic Scripting language - Adds RegAsm.exe to Windows Defender exclusion list. + .NET extractor - unpack malicious files. * like the HotRAT payload - detect the most frequently used antivirus software. * attempt to deactivate them using IObit Unlocker + Once the coast is safe - Deploy HotRAT - Using PowerShell and 2 png files * Image files
Hacking and a business * Coveware + 2032 Second Quarter - Ransomware payments fell. * Down to 34% + Chart shows - 85% in Q1 2019 * cyber extortion opportunity cost curve + takes five different examples of extortion strategies. - characteristics - economics + Chart - monetary impact felt by the victim of the attack. * Business disruption is the largest driver. - Effort threat actor must exert to conduct the attack. * total expected profit + multiplying the probability that an attack will result in a ransom being paid. + multiplied by the actual amount of the ransom that may be paid. + Examples - Example 1 * Malicious actor uses leaked data. * Steal files from user. * Sole proprietor * Low Impact Target, Low cost to malicious actor + Only need a little money to be cost effective. - Example 2 * $500,000 to acquire a 0-day vulnerability. * 4 weeks of manual reconnaissance work and lateral movement * Unknown target impact, but high cost + Need a big payout to make it profitable. + Types of Attacks on Chart - Phantom * mass orchestrated social engineering attempts * easy to automate. * Low Effort, Low Payout + $1k-$5k * Formula + No Business Impact + No or low chance of payout. + The payout amounts low. + Low medium cost to actor - ‘spray’ attacks * same tactics of phantom incidents * data is deleted. + no exfiltration of data * Formula + Zero/Low Business Impact + low chance of payout + The payout amount is low. + Low Zero cost to actor - NAS (Network Attached Storage) encryption attack. * Formula + Low/Medium Business Impact + medium chance of payout + Payout amounts is low. + Low/Medium cost to actor * scanning and deployment of payloads tend to be automated. + scale the costs of impacting lots of NAS devices. - Data exfiltration attacks * Formula + Low/Medium/High Business Impact + Low/medium chance of payout + The payout amounts are medium/high. + Medium cost to actor * No encryption only exfiltration * extorts the victim over its public release. * probability of a ransom being paid is less than 50% * ransom demand on attacks is relatively high. - Encryption ransomware * Formula + High Business Impact + higher chance of payout + The payout amounts high. + High cost to actor * MOST amount of threat actor work/costs + skillfully navigate the victim’s network * acquire access to a victim company’s network. + Initial Access Broker
Sophos impersonated by new SophosEncrypt ransomware * Malware Hunter Team + Found ransomware encryptor. - Thought was a Sophos red team exercise. - It was not. * Sophos X-Ops team tweeted that they did not create the encryptor and that they are investigating its launch. + One person submitted to ID Ransomware service. - Live and active threat * SophosEncrypt + Written in Rust + Uses C:\Users\Dubinin\ path. + When run it prompts for an affiliate token. - Available to owner via the panel - verify if the token is valid. * connect to 179.43.154.137:21119. + Cobalt Strike C2 servers + asks for more information. - contact email, jabber address, and a 32-character password, which Gillespie says is used as part of the encryption algorithm. - Encrypt on or all files. + AES-256 encryption + File encrypted with info as file name. - entered token. - the entered email - .sophos extension + Creates the information.hta - Which will open when completed - Contact info from set up loaded in here. + change the Windows desktop wallpaper. - boldly displaying the 'Sophos' brand
FortiGuard Labs Discovers .ZIP Domains Fueling Phishing Attacks * FortiGuard Labs Global Threat Landscape Report 2022 + July 17, 2023 + phishing the primary attack method to acquire initial access in a network breach. * TLD + Top Level Domains - .COM - .ORG - .NET - .GOV - Etc. * gTLD + generic TLD + .CAT + .TRAVEL + .MOBI + .BIZ * .ZIP domain is the latest tactic. + creating confusion - particularly among non-techno-savvy users + user would consider it a file extension and download it without hesitation. * Defense + FortiGuard Labs - block .ZIP domains at the firewall level - use web filters and browser extensions to assess the authenticity of a website. - double-check URLs before clicking. - update antivirus programs, operating systems, and web browsers to patch the latest security flaws.
Links https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/ https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02 https://thehackernews.com/2023/07/wormgpt-new-ai-tool-allows.html https://therecord.media/genesis-market-sold-despite-fbi-operation https://therecord.media/genesis-market-takedown-cybercrime
SwingVPN Update - https://www.hackread.com/google-removes-swing-vpn-android-ddos-botnet/
JumpCloud Update:
https://www.bleepingcomputer.com/news/security/jumpcloud-discloses-breach-by-state-backed-apt-hacking-group https://jumpcloud.com/support/july-2023-iocs AVrecon infects 70,000 routers * Lumen + Black Lotus Labs + Identified the RAT - Remote Access Trojan + Impacts SOHO routers - Small Office/Home Office - Been active for 2+ years - Built a botnet of 70,000 devices * In 20 countries - Warning * CISA issued a advisory about misconfigured network equipment * Binding Operational Directive 23-02 + June 13th * Applies to Government…but you should pay attention to it. - Attack * Originally targeting Netgear * Switched to SOHO * Attacks + Used devices for… - Password sprays - Fraud - Proxying + Reconned the environment - Fed it back to C2 server - C2, passed it off to Second Stage Servers * ~15 - Target other ARM based devices - Written in C * You know for ease of porting to new architecture. - Protection * Check for password guessing. * Regularly reboot and update SOHO routers - Thoughts * Work from Home * No perimeter anymore
WormGPT for clever phishing * SlashNext + new generative AI cybercrime tool - WormGPT + Advertised on dark web/telegram + way for adversaries to launch sophisticated phishing and business email compromise attacks. * Why? + GPT models have protections built in - Or being built - No boundaries in this version - OpenAI ChatGPT and Google Bard are increasingly taking steps to combat the abuse of large language models + This is designed for hackers by hackers and trained by hackers + Automation, as in business is everything. - create highly convincing fake emails * personalized to the recipient - thus increasing the chances of success for the attack + if English is not a first language…this makes it hard to easily identify phishing emails
Genesis Market sold despite FBI disruption * Genesis Market + cyber fraud platform * Announcement + Thursday July 13th + Deposit was made - Ownership transferred next month. + Comes from GenesisStore - Previous posts associated with the site + If you had an account - Not carried over * Was not part of the sale - New owner to create new accounts * Sort through the trust worthiness of users - What they got * All developments * Complete database + except for some details of the client base * Source codes, scripts * Server infrastructure. - FBI * Seized some of their domains + 3 months ago + Clear web * Sanctioned the platform. * 120 people were arrested. * Identified and located backend servers + 59,000 user accounts * Darkweb + Still mirrored not seized. + Sister sites up - Russian Market - 2easy Shop.
Story Updates, not update updates * Swing VPN + Ep 62 – June 26 + Recap - June 4th, 2023, cybersecurity researcher “Lecromee” - dangerous DDoS botnet, posing significant risks. + Update - com was contacted by Google on June 22, confirming the veracity of the claims. - Limestone Software Solutions * Hotspot for Swing VPN - JumpCloud * Ep63 – July 10 * ReCap + Cyber Incident without much communication + Asked users to reset their API keys. * Update + Confirmed breach. - state-backed hacking group breached its systems. + Target particular customers
released indicators of compromise (IOCs)
This weeks show, we talk about a security researches discovery about Swing VPN, then the US Military is warning it's staff beware of unexpected smart watches, followed by the latest Mirai botnet campaign targeting IoT devices and finish the episode off with how a self propregrating malware found it's way to a healthcare network.
[00:36] Popular Swing VPN Android App as DDoS Botnet [08:44] US Military warns of unexpected smart watches [13:46] Latest Mirai Campaign Leveraging Multiple IoT Exploits [19:09] Self-Propagating Malware Inadvertently Affects Networked Storage Devices
Links
https://www.hackread.com/diicot-hackers-ssh-servers-brute-force-malware/https://www.securityweek.com/barracuda-zero-day-attacks-attributed-to-chinese-cyberespionage-group/https://www.welivesecurity.com/2023/06/15/android-gravityrat-goes-after-whatsapp-backups/https://cyware.com/news/third-bug-in-moveit-transfer-found-d35a9335https://www.helpnetsecurity.com/2023/06/19/cve-2023-35708/https://www.bleepingcomputer.com/news/security/moveit-transfer-customers-warned-of-new-flaw-as-poc-info-surfaces/https://cyberscoop.com/energy-department-cl0p-moveit-cisa/
New Threat Group Targets SSH Servers * Cado Labs Researchers + Diicot - emerging Romanian threat actor - AKA Mexals - extensive technical knowledge - active since 2020 * new campaign + Cayosin botnet - Mirai-based botnet agent + target routers running the Linux-based OS OpenWRT + targets are the internet exposed SSH servers with password authentication enabled. + username and password list is pretty restrictive - including only default or easy-to-guess credentials. * Tactics + Shell Script Compiler - make loader scripts difficult to analyze. + UPX (unpacker) - Ultimate Packer for Executables - modified header with the byte sequence 0x59545399. - UPX header prevents unpacking through the standard command. * Making to harder to detect * upx dex utility created by Akamai’s Larry Cashdollar, and the sequence can be identified by detection tools. - Discord * For C2 + supports HTTP POST requests to a webhook URL. * Snowflake timestamps in the links + allowing for data exfiltration and viewing campaign statistics + creation dates within a given channel.
Barracuda Zero-Day Attacks * Barracuda Network + Founded 2003 + security, networking, and storage products based on network appliances and cloud services. * Attacks + CVE-2023-2868 - Barracuda Email Security Gateway (ESG) * module designed for the initial screening of email attachments. + the targeted entity an email containing a specially crafted TAR file as an attachment. - likely crafted the body and subject of the message to appear as generic spam. * flagged by spam filters. * dissuade security analysts from performing a full investigation. + Discovered by Barracuda + May 18 + Engaged Mandiant (owned by Google Cloud) + Exploited since at least October 2022 + execute a reverse shell, after which they downloaded custom backdoor malware. - SeaSpy, SaltWater and SeaSide - C&C communications, downloading and executing files, executing commands, and providing proxying capabilities. * Attribution + UNC4841 + high confidence - on behalf of Chinese government * Protection + Barracuda urged customers to immediately replace compromised appliances. - Hinting that the patch may not fully protect devices. - attackers started modifying their malware and deploying additional persistence mechanisms.
GravityRAT goes after WhatsApp backups. * ESET researchers + updated version of Android GravityRAT spyware + distributed as the messaging apps BingeChat (on going) and Chatico (no longer active) * GravityRAT + Used since 2015 + RAT = Remote Access Tool + used in targeted attacks against India. + Windows, Android, and macOS versions + exfiltrate WhatsApp backups and receive commands to delete files. + provide legitimate chat functionality. * Attack + bingechat[.]net - login required. - registration closed. * possibly only open as needed (or another factor) + made available in the Google Play store.
Third MOVEit Bug Discovered * Story * First Bug + CVE-2023-34362 + Utilized by Cl0p cyber extortion gang. * Second Bug + CVE-2023-35036 + Huntress researchers partnering with Progress. - Code review * Third Bug + CVE-2023-35708 + No evidence to be exploited yet. + escalated privileges and unauthorized access + crafted payload to a MOVEit Transfer application endpoint result in modification and disclosure of MOVEit database content * Cl0p ransomware group + The Cl0p ransomware gang has claimed responsibility for launching multiple attacks involving the first MOVEit Transfer vulnerability. + According to a representative from the group, it began exploiting the vulnerability on May 27. + Following the deadline of June 14, the Cl0p ransomware group publicly disclosed the names of over two dozen organizations affected by the attacks. - Victims * The list includes + multinational oil and gas company Shell + several banks + media companies + universities + two entities of the US Department of Energy - Oak Ridge Associated Universities - contractor at Oak Ridge National Laboratory + the Oregon Department of Transportation - “CLOP did state that government data will be deleted and not retained or shared. * To avoid being a target of any governemtn - Rewards for Justice program * US State Department + offered a considerable monetary reward for individuals who “have info linking CL0P Ransomware Gang or any other malicious cyber actors targeting U.S. critical infrastructure to a foreign government.” * Protect Yourself + A patch for the latest vulnerability is currently being tested and will be released soon. + MOVEit Transfer customers are advised to disable HTTP and HTTPs traffic until patched. + temporary measure, modifying firewall rules to block traffic on ports 80 and 443. - web UI login will be unavailable.
file transfers can still be conducted using SFTP and FTP/s protocols
I talk about the [00:36] new easily exploitable Microsoft Visual Studio bug, [08:38] A new report that puts CyberSecurity awareness center stage, [19:15] A new “Picture in Picture” technique used in a new deceptive phishing attack, and [24:24] a security company releasing a PoC for Windows Win32k bug exploited in attacks, patch now!
Links https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html https://thehackernews.com/2023/06/camaro-dragon-strikes-with-new-tinynote.html https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks/ https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34362 New Backdoor Malware for Intelligence Gathering * Camaro Dragon + Chinese nation-state group + another backdoor application - intelligence-gathering + overlaps with a threat actor. - Mustang Panda * state-sponsored group * from China * known to be active since at least 2012. - TinyNote * Go-based malware. * functions as a first-stage payload + basic machine enumeration + command execution via PowerShell or Goroutines. * multiple persistency tasks + establishing redundant methods - retain access to the compromised host. + distributed using names related to foreign affairs. - PDF_ Contacts List Of Invitated Deplomatic Members + target Southeast and East Asian embassies. + specifically bypass an Indonesian antivirus solution called Smadav
New Ransomware Exhibit Striking Similarities with an older name * Trend Micro + Researchers have discovered a new ransomware family. - BlackSuit * targets Windows and Linux users - similarities it shares with the notorious Royal ransomware. + Royal ransomware - first observed in early 2022 - Dev-0569 * gang that operates Royal - highly sophisticated and quickly evolving malware strain. - November 2022 * 43 new victims + demanding between $250,000 and $2 million per compromise * financial gain + extortion - large enterprise + comparisons to other ransomware gangs - Conti and Ryuk - indicating that they may have splintered away. + Rather than selling Royal as a ransomware-as-a-service (RaaS) - purchases direct access to corporate networks from underground Initial Access Brokers (IABs) - manages the attack campaigns internally. - employs double extortion tactics. * extorting victims for deleting stolen data * threatening to make it public. + in addition to ransom demands for the decryption of infected files. * BlackSuit + Windows 32-bit version + ESXi 64-bit version + appends the file extension .blacksuit to encrypted files. + leaves a ransom note. - information about the attack - a unique ID for the victim - TOR Chat site link for communication - data leak site to post leaked data in case a victim does not pay the ransom. * only one victim currently
- Similarities
- BlackSuit supports the use of several command-line arguments.
- like those used by Royal.
- includes some additional arguments do not present in Royal.
- Both malwares use comparative intermittent encryption techniques, including OpenSSL’s AES encryption algorithm and similar formulas and numbers when comparing file size.
- When comparing the source code used in the 64-bit samples of the two malwares, there is a 98% similarity in used functions, 98.9% in BinDiff-based jump statements, and 99.5% in blocks.
- Similarly, a comparison of the code used in 32-bit samples exhibits 99.3% resemblance in basic blocks, 93.2% in used functions, and 98.4% in jumps based on BinDiff.
- BlackSuit supports the use of several command-line arguments.
Discord Admins hit with malicious Bookmark. * Discord Communities Hit + Focused on Crypto discord communities. + Administrators Tricked - running malicious JavaScript code * disguised as a Web browser bookmark. - contacted by a “reporter” for interview. * Crypto Focused new outlet * Sent a link to the news orgs “official discord.” + complete a verification step to validate their identity. - involves dragging a button from the phony crypto news Discord server to the bookmarks bar in one’s Web browser. * How does this verify? - instructed to go back to discord.com and then click the new bookmark to complete the verification process. + Bookmark - snippet of JavaScript * grabs the user’s Discord token. * sends it to the scammer’s website. + They take the token and use it. + after a little bit * Attack + Now as Admin - change the server’s access controls. - remove all core team members from the server. - posts an announcement. * an exclusive “airdrop,” “NFT mint event” or some other potential money-making opportunity for the Discord members. - Have access if Admin doesn’t log out and back in, or else change their credentials. + Discord members click the link provided. - asked to connect their crypto wallet to the scammer’s site. - asks for unlimited spending approvals. - drains the balance of any valuable accounts.
MOVEit Transfer zero-day mass-exploited in data theft attacks. * MOVEit Transfer + file transfer software + developed by Ipswitch. - subsidiary of US-based Progress Software Corporation + securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads. + offered as an on-premises solution managed by the customer. + cloud SaaS platform managed by the developer. * CVE-2023-34362 + Version Impacted
o Affected Version o Fixed Version o Documentation
o MOVEit Transfer 2023.0.0 o MOVEit Transfer 2023.0.1 o MOVEit 2023 Upgrade Documentation
o MOVEit Transfer 2022.1.x o MOVEit Transfer 2022.1.5 o MOVEit 2022 Upgrade Documentation
o MOVEit Transfer 2022.0.x o MOVEit Transfer 2022.0.4
o MOVEit Transfer 2021.1.x o MOVEit Transfer 2021.1.4 o MOVEit 2021 Upgrade Documentation
o MOVEit Transfer 2021.0.x o MOVEit Transfer 2021.0.6 * Danger + SQL injection vulnerability - could allow an unauthenticated attacker to gain access to MOVEit database. - an attacker may be able to infer information about the structure and contents of the database. - Execute SQL statements that alter or delete database elements. * perform mass downloading of data. - exploitation of unpatched systems can occur via HTTP or HTTPS. + Who/How Long - Not attributed to any group - Not sure how long + Fix? - developers warn admins to block external traffic to ports 80 and 443 on the MOVEit Transfer server. * prevent external access to the web UI. * prevent some MOVEit Automation tasks from working. * block APIs * prevent the Outlook MOVEit Transfer plugin from working. - check the 'c:\MOVEit Transfer\wwwroot\' folder for unexpected files, including backups or large file downloads. * indicators that the threat actors have stolen data. * in the process of doing so. - Until a patch is released for your version * it is strongly advised that organizations shut down any MOVEit Transfers * perform a thorough investigation for compromise before applying the patch.
Links
https://www.cybersecuritydive.com/news/summer-holiday-weekends-cyber/651434/
https://www.netwrix.com/download/documents/Netwrix_Hybrid_Security_Trends_Report_2023_Enterprise_Sector.pdf - Copy URL if you don’t trust the link…I get it
https://www.prnewswire.com/news-releases/netwrix-report-enterprises-suffer-more-ransomware-and-other-malware-attacks-than-smaller-organizations-301831669.html
Hot Pixel Technical Paper: https://arxiv.org/abs/2305.12784
https://www.bleepingcomputer.com/news/security/hot-pixels-attack-checks-cpu-temp-power-changes-to-steal-data/
https://www.cadosecurity.com/updates-to-legion-a-cloud-credential-harvester-and-smtp-hijacker/
https://cyware.com/news/enhanced-legion-credential-harvester-targets-ssh-servers-and-aws-credentials-77e34efc
Entering the Summer Caution Seaso* Memorial Day Weekend * Start of the Summer Vacation Season * pattern has emerged in recent years * summer of 2021 + largest ransomware attacks in recent U.S. history were all launched during major holiday weekends - Colonial Pipeline compromise began around the Mother’s Day weekend in 2021 - meatpacker JBS was hit by REvil ransomware over the Memorial Day weekend in 2021 - Kaseya, a Florida-based IT monitoring firm, was hit by a major ransomware attack at the start of the Independence Day holiday in 2021 * Summer of 2022 + Second-largest school system in the country, Los Angeles Unified School District, was hit by a ransomware attack over Labor Day weekend in 2022 + increased wave of Microsoft 365 logins from a suspicious origin country and communications from a network to a dangerous IP address * Why + longer to understand the scope of the intrusion - more difficult to stop - takes longer to recover from + employees are often away from their normal home offices or workstations and can be susceptible to social engineering or phishing attacks - employees not as focused * What you can do + Dust off your incident response plans and playbooks to identify the points of triage during the holidays and when to escalate to the broader team. + Ensure recent external and internal vulnerability assessment reports are reviewed and there are no “gaping holes” that allow easy access to your network. + Confirm, and don’t assume, that backup systems are running as designed and that a snapshot is taken before the holiday weekend. + Educate non-security employees about the risk of cyberattacks during holiday weekends.20
Size doesn’t matter when it comes to cyberattacks* Netwrix Report + Last 12 months Cyber Attacks - 65% of organizations in the enterprise sector - 68% of organizations in all sectors * Attacks + Common - Phishing - Ransomware - user account compromise. + Ransomware - 48% Enterprises * 21% in cloud - 37% all sizes + Bigger Fish (Enterprises) - Enterprises are targets because they pay more. * Just like any other business maximizes profit. - Entrpise has more tools to catch. + Financial - Enterprise $50,000 estimated over SMB. * OnPrem vs Cloud
Security IncidentsCloudOn-PremPhishing58%74%Ransomware/Malware19%37%User Account Compromise27%31%Accidental Data Leakage20%24%Targeted Infrastructure Attack30%19%Data Theft (insider)14%18%Admin Account Compromise12%17%Supply Chain Compromise17%16%Data Theft (Hacker)15%16%Hot Pixels: checks CPU temp, power changes to steal data* Group of Researchers + Georgia Tech + University of Michigan + Ruhr University Bochum * Hot Pixels + data-dependent computation times on modern system-on-a-chip (SoCs) + graphics processing units (GPUs) - extract information from visited web pages on Chrome and Safari * even if with the latest side-channel countermeasures enabled. + modern processors struggle to balance power consumption requirements and heat dissipation limitations. - distinct behavior patterns that point to specific instructions and operations. - detectable through internal sensor measurements * accessible through software + analyzing frequency, power, and temperature - Passively cooled processors could leak information via power and frequency. - Actively cooled chips leak data through temperature and power readings. * Attack + use an iframe element in an attacker-controlled page. - The iframe's contents contain sensitive info about the victim are invisible * but can be computed by applying an SVG filter on top of it * measuring the rendering times. * What to do? + The researchers disclosed their findings to Apple, Nvidia, AMD, Qualcomm, Intel, and Google, in March. - All vendors acknowledged the issues and are working to mitigate them. + only work well on devices that quickly reach a stable state of power usage, like smartphones, although the data leak throughput is generally small. + vendors and stakeholders already discuss solutions to the reported problems, like restricting the use of SVG filters on iframes on the HTML standard.
Enhanced Legion Credential Harvester Targets SSH Servers and AWS Credentials* Legion + a Python-based credential harvester - discovered last month + some additional feature updates to target cloud services. - updated variant targets the credentials associated with Laravel web applications and SSH Servers. * Exploiting cloud services + Cado Labs researchers - the malware steals the credentials from misconfigured web servers running PHP frameworks such as Laravel. * it scans for the environment variable files (.env) on the default paths where these files reside on the infected machine. * updated variant includes several new paths to search for environment files, such as /lib/.env and /cron/.env. + Environment file is publicly accessible due to any misconfiguration - malware saves the environment files. + attempts to retrieve credentials for three specific services - DynamoDB - Amazon CloudWatch - AWS Owl. + Previous variants - Already capable of stealing credentials from * SMTP services + email providers * Payment platforms * Databases * Server management systems * Attack on SSH servers + Legion is equipped with the ability to target SSH servers. - It uses the Paramiko library * to parse the list of exfiltrated database credentials * obtain available pairs of usernames and passwords. - Credentials are then used to log in to the host via SSH. * Preventive measures + Legion uses server misconfigurations as the main intrusion tactic. - a regular audit of the digital resources exposed to the internet * can help avoid such risks. - Avoid using default paths and variable names * Especially when storing the secrets in environment files.
ContentsCybersecurity firm Dragos discloses security incident and extortion attempt.DarkBERT.BrutePrint, vulnerability to Brute Force Fingerprint Locks.Voice Cloning-as-a-Service.Linkshttps://www.bleepingcomputer.com/news/security/cybersecurity-firm-dragos-discloses-cybersecurity-incident-extortion-attempt/https://www.dragos.com/blog/deconstructing-a-cybersecurity-event/https://www.helpnetsecurity.com/2023/05/19/cti-dark-webhttps://www.bleepingcomputer.com/news/security/android-phones-are-vulnerable-to-fingerprint-brute-force-attacks/https://www.infosecurity-magazine.com/news/experts-warn-of-voice/Cybersecurity firm Dragos discloses security incident and extortion attempt* Dragos + Industrial cybersecurity company + May 10th Announced victim of a cyber incident * Incident + known cybercriminal group attempted and failed at an extortion scheme against Dragos + No Dragos systems were breached, including anything related to the Dragos Platform + group gained access by compromising the personal email address of a new sales employee prior to their start date, and subsequently used their personal information to impersonate the Dragos employee and accomplish initial steps in the employee onboarding process. + attackers downloaded "general use data" and accessed 25 intel reports that were usually only available to customers. + 16 hours they had access to the employee's account - threat actors failed to also access multiple Dragos systems * messaging * IT helpdesk * Financial * request for proposal (RFP) * employee recognition * marketing systems + due to role-based access control (RBAC) rules. * prevented from accomplishing lateral movement, escalating privileges, establishing persistent access, or making any changes to the infrastructure * sent an extortion email to Dragos executives 11 hours into the attack + read 5 hours later because it was sent outside business hours. * Remediation + Five minutes after reading the extortion message - disabled the compromised user account - revoked all active sessions - blocked the cybercriminals' infrastructure + Extortion - publicly disclose the incident in messages sent via public contacts and personal emails belonging to Dragos executives, senior employees, and their family members.
DarkBERT* Korea Advanced Institute of Science and Technology (KAIST) + data intelligence company S2W * Leverage Natural Language Processing (NLP) + deal with the threat landscape * DarkBERT + extensive pretraining on texts in English - approximately 6.1 million pages found on the dark web * researchers filtered out meaningless and irrelevant pages - efficacy was then compared to two popular NLP models * BERT, a masked-language model introduced by Google in 2018 * RoBERTa, an AI approach developed by Facebook in 2019. - Use Case * Ransomware leak site detection + The three language models were tasked with identifying and classifying such sites, and DarkBERT outperformed the rest, “demonstrating [its advantages] in understanding the language of underground hacking forums on the dark web.” * Noteworthy thread detection + “Due to the difficulty of the task itself, the overall performance of DarkBERT for real-world noteworthy thread detection is not as good compared to those of the previous evaluations and tasks,” the researchers found. + the performance of DarkBERT over other language models shown here is significant and displays its potential in dark web domain tasks. By adding more training samples and incorporating additional features like author information, we believe that detection performance can be further improved. * Threat keyword inference + Researchers used the fill-mask function to identify keywords linked to (in this case) threats and drug sales on the dark web. + DarkBERT’s results in this particular tests were better than those of other tested variants. * Researchers found that DarkBERT outperforms other pretrained language models in all the tasks is has been presented with + “shows promise in its applicability on future research in the dark web + though more work and fine-tuning is required to make it more widely applicable.
BrutePrint, vulnerability to Brute Force Fingerprint Locks* Tencent Labs and Zhejiang University + Researchers presented a new attack called 'BrutePrint,' which brute-forces fingerprints on modern smartphones + Allow the bypass user authentication and take control of the device. * Attack + Brute-force attacks rely on many trial-and-error attempts to crack a code, key, or password and gain unauthorized access to a system * overcome existing safeguards on smartphones + attempt limits and liveness detection + zero-day vulnerabilities - Cancel-After-Match-Fail (CAMF) - Match-After-Lock (MAL). + fingerprint sensors' Serial Peripheral Interface (SPI) were inadequately protected - allowing for a man-in-the-middle (MITM) attack to hijack fingerprint images. - BrutePrint and SPI MITM attacks were tested against ten popular smartphone models * unlimited attempts on all Android and HarmonyOS (Huawei) devices * ten additional attempts on iOS devices. - How it Works * attacker needs physical access to the target device * access to a fingerprint database + can be acquired from academic datasets or biometric data leaks * necessary equipment + costing around $15. * fingerprint matches use a reference threshold instead of a specific value + manipulate the False Acceptance Rate (FAR) to increase the acceptance threshold and create matches more easily * CAMF injects a checksum error in the fingerprint data to stop the authentication process at a pre-mature point. + allows the attackers to try out fingerprints on the target device while its protection systems won't register failed attempts, hence giving them infinite tries. * The MAL flaw enables the attackers to infer authentication results of the fingerprint images they try on the target device, even if the latter is in "lockout mode."
Voice Cloning-as-a-Service* voice cloning-as-a-service (VCaaS) + surging threat actor interest + streamline deepfake-based fraud. * Recorded Future + “I Have No Mouth and I Must Do Crime” - Threat intelligence analysis of chatter on the cybercrime underground. + Deepfake audio technology can mimic the voice of a target - spread mis- and disinformation and enhance the effectiveness of social engineering in business email compromise (BEC)-style attacks + out-of-the-box voice cloning platforms are available on the dark web - Some are free to use with a registered account while others cost little more than $5 per month - call-back scams and voice phishing are frequently mentioned in the context of such tools.
ContentsCar location data of 2 million customers exposed for ten years.Millions of mobile phones come pre-infected with malware.Phishing Campaign Distributes SmokeLoader via Fake Invoice.Crooks are Using Malicious QR Codes to Steal Your Money.Linkshttps://www.bleepingcomputer.com/news/security/toyota-car-location-data-of-2-million-customers-exposed-for-ten-yearshttps://www.theregister.com/2023/05/11/bh_asia_mobile_phones/https://cyware.com/news/phishing-campaign-distributes-smokeloader-via-fake-invoice-b155d82bhttps://cyware.com/news/beware-crooks-are-using-malicious-qr-codes-to-steal-your-money-b0bab8b3Car location data of 2 million customers exposed for ten years* Toyota Motor Corporation + Japan + disclosed a data breach - car-location information + 2,150,000 customers + ten years - between November 6, 2013, and April 17, 2023. + security notice published in the company's Japanese newsroom * Breach + a database misconfiguration - allowed anyone to access its contents without a password + Toyota Connected Corporation + Exposure - T-Connect G-Link - G-Link Lite - G-BOOK * between January 2, 2012, and April 17, 2023. - T-Connect is Toyota's in-car smart service * voice assistance * customer service support * car status and management * on-road emergency help - Data * in-vehicle GPS navigation terminal ID number * the chassis number + also known as chassis number * vehicle location information with time data. + Oops * possibility of video recordings taken outside the vehicle having been exposed in this incident + between November 14, 2016, and April 4, 2023, which is nearly seven years * Fix + implemented measures to block access from the outside * Bright Side + no evidence that the data was misused + unauthorized users could have accessed the historical data + possibly the real-time location of 2.15 million Toyota cars - do not constitute personally identifiable information * attacker would need to know the VIN of their target's carvehicle identification number + also known as chassis number * Other Incidents + October 2022 - Data Breach - T-Connect customer database access key on a public GitHub repository
Millions of mobile phones come pre-infected with malware* Trend Micro researchers + Black Hat Asia - a growing problem for regular users and enterprises + manufacturing outsourced to an original equipment manufacturer (OEM) - someone in the manufacturing pipeline to infect products with malicious code as they ship out + firmware started to come with an undesirable feature – silent plugins - found over 80 different plugins, although many of those were not widely distributed + Impact - cheap Android * mobile devices * smartwatches * TVs - turns the devices into proxies which are used to steal and sell SMS messages, take over social media and online messaging accounts, and used as monetization opportunities via adverts and click fraud. - objective of the malware is to steal info or make money from information collected or delivered. - proxy plugins, allow the criminal to rent out devices for up to around five minutes at a time. For example, those renting the control of the device could acquire data on keystrokes, geographical location, IP address and more. - The user of the proxy will be able to use someone else’s phone for a period of 1200 seconds as an exit node
Phishing Campaign Distributes SmokeLoader via Fake Invoice* An ongoing phishing campaign has been identified by CERT-UA, in which attackers are abusing compromised email accounts to send phishing emails containing invoice lures. The main target of the attack is the computers used by financial accountants. The attackers aim to gain remote access to banking systems by using the SmokeLoader malware. * A financially motivated campaign * The alert warns that the attackers are using spam emails with the subject “bill/payments” with a ZIP archive attached. * The attacks have been linked to the financially motivated UAC-0006 group, which has been active since at least 2013. * The attackers attempt to steal authentication-related information, such as credentials, keys, or certificates, and then, create unauthorized financial transactions into accounts controlled by them. * The attached ZIP archive is a polyglot file, meaning that it is a single file that can be interpreted as multiple file formats. It consists of a decoy document and a JavaScript file. * Digging deeper into the polyglot file * The polyglot file, named pax_2023_AB1058..js, uses PowerShell to download and run further payloads. Specifically, it downloads an executable file called portable.exe, which, when run, launches the SmokeLoader malware. * The compilation date of the file and the date of registration of the domain involved indicate that the campaign started in April 2023. * Once running, SmokeLoader injects malicious code into currently running processes and proceeds with downloads of other payloads. * What to do? * The CERT-UA has suggested that Javascript loaders, which are typically used at the initial stage of the attack, can be blocked by restricting the launch of Windows Script Host (wscript.exe) on the PC. Additionally, they have provided relevant indicators of compromise (IoCs), which can be used to restrict the SmokeLoader-related file on the other side of the security fence.
Crooks are Using Malicious QR Codes to Steal Your Money* Smartphone users need to be careful about scanning QR codes displayed in public places, including shops, restaurants, and parking areas. In this modern digital world where people are increasingly relying on QR codes to make payments, cybercriminals are abusing it as a lucrative source to steal funds from them. Here’s a glance at some recent examples. * Fake survey via QR code * Scammers put up a fake QR code on the glass door of a bubble tea shop. It would urge visitors to fill out the survey for a "free cup of milk tea." * To complete the survey, a bogus third-party app was downloaded onto the user's device to complete the 'survey. * This enabled the scammers to siphon out $20,000 from the bank account of the victim. * Parking ticket QR code scam * In another incident, scammers were found leaving fake parking tickets on drivers’ windshields. * It tricked car owners into believing that the tickets were issued by San Francisco’s government, who end up paying amounts to scammers. * Scanning the code would redirect victims to a phishing link impersonating the San Francisco Municipal Transportation Agency (SFMTA) website, prompting them to enter their credit card details. * Cybercriminals monetizing through QR code scams is also a concerning factor as this can enable them to purchase more sophisticated tools or get their hands on stolen user records put on sale to expand their attack scope. That’s not all! Cybercriminals have also been experimenting with QR codes to pilfer credentials from victims. * Harvesting credentials via QR codes * Earlier this year, FortiGuard Labs shared details of a campaign wherein threat actors were using multiple QR codes to target Chinese-speaking users. * These codes were dispatched in a Word document attached to an email spoofing the Chinese Ministry of Finance. * Threat actors with stolen credentials can abuse them to gain direct access to victims’ accounts. They can also use it to perform identity theft. * Stay safe * Follow the FBI’s advisory to avoid falling victim to such scams. Users must also take caution by checking the URL of the code before entering their financial and personal information. As a general rule, they must check the authenticity of the address link by typing the website name directly into the browse
Contents
New Tactics for Extorting Payments.
RTM Group Launches its Linux Ransomware.
Hackers are breaking into AT&T email accounts to steal cryptocurrency.
New macOS Info-stealer called Atomic.
Links
https://cyware.com/news/coercion-in-the-age-of-ransomware-new-tactics-for-extorting-payments-0c31dba6
https://cyware.com/news/rtm-group-launches-its-linux-ransomware-eea307ae
https://techcrunch.com/2023/04/26/hackers-are-breaking-into-att-email-accounts-to-steal-cryptocurrency/https://cyware.com/news/atomic-new-macos-info-stealer-in-town-34496257
New Tactics for Extorting Payments* Story + GuidePoint Security published its GRIT Ransomware Report for Q1 2023, which provides insight into the ransomware threat landscape. Here are some shocking ransomware statistics for the quarter. * Serving numbers + GRIT monitored 849 ransomware victims that were publicly disclosed and claimed by 29 distinct threat groups. + According to the report, there has been a 27% rise in publicly disclosed ransomware victims as compared to Q1 2022 and a 25% rise as compared to Q2 2022. + The manufacturing and technology sectors continue to be the most impacted by ransomware. However, the legal industry observed a 65% surge in publicly posted victims from Q4 2022 to Q1 2023, with 70% of these attacks being attributed to the most active "double-extortion" ransomware groups such as LockBit, AlphV, Royal, and BlackBasta. + In the education sector, there was a 17% rise in publicly disclosed victims during the same period, with Vice Society being responsible for 27% of all attacks in the education industry. + U.S.-based organizations constituted the majority of ransomware victims, accounting for 46% (395 out of 851) of all observed victims, followed by the U.K (7.7%) and Germany (4.4%). * Coercion tactics + The researchers noticed a rise in the adoption of innovative coercive strategies by several prominent ransomware groups that employ the double extortion modus operandi. Medusa and AlphV were observed leaking sensitive information to pressure victims into paying up. + At the beginning of 2023, the LockBit ransomware group released chat logs of a negotiation with one of its victims, Royal Mail, which the group claimed had failed. + Although this method is not entirely new, it is probably intended to deter aggressive negotiation tactics and bolster the effectiveness of shaming strategies employed by the ransomware operators. + Other coercive measures adopted by ransomware groups include launching DDoS attacks and selectively leaking data to the public to garner media attention and harm the reputation of targeted organizations. * The bottom line + The uptick in reported ransomware victims during Q1 2023 is indicative of the persistent and industry-agnostic nature of ransomware as a global threat. The researchers anticipate that ransomware activity is not likely to go down in the long term.
RTM Group Launches its Linux Ransomware* Story + RTM group (aka Read The Manual gang), the provider of RTM Locker RaaS, has developed a new ransomware binary designed to target Linux-based machines. The ransomware is capable of infecting Linux, ESXi, and NAS hosts. It seems to be inspired by the leaked source code of Babuk ransomware. * The RTM Locker + According to Uptycs, this Linux variant of RTM Locker is specifically aimed at ESXi hosts, as it includes two related commands. + It uses asymmetric and symmetric encryption, which makes it impossible to decrypt files without a private key. + The initial infection vector is at present not known. However, after successful encryption, victims are told to contact the support team within 48 hours via Tox or risk getting their data published. + The ransomware group leverages affiliates for the very purpose. * Babuk connection? + Several similarities have been observed between the Babuk ransomware and RTM Locker. Both malware use the same random number generation method and asymmetric encryption. However, what makes them different is the asymmetric encryption. Babuk uses sosemanuk for asymmetric encryption, while RTM Locker uses ChaCha20. * Additional technical details + RTM Locker targets ESXi hosts by aborting all virtual machines running on a compromised host before the encryption process starts. + It is statically stripped and compiled, allowing the binary to target more systems while making reverse engineering more challenging. The encryption uses pthreads to speed up execution. + For encryption, it uses Elliptic-curve Diffie–Hellman (ECDH) for both asymmetric encryption (via Curve25519 algorithm) and symmetric encryption (via Chacha20 algorithm). + The gang intentionally avoids high-profile targets such as law enforcement, critical infrastructure, and hospitals. * Conclusion + RTM Locker is already a challenge to reverse engineer and shares similarities with the leaked code of Babuk ransomware. Further, this Linux ransomware strain targets NAS/ESXi hosts. The experts suggest using the YARA tool or a third-party tool to scan dubious processes to stay protected. Additionally, deploy a security solution that comes with advanced detection capabilities.
Hackers are breaking into AT&T email accounts to steal cryptocurrency* unknown hackers are breaking into the accounts of people who have AT&T email addresses, and using that access to then hack into the victim’s cryptocurrency exchange’s accounts and steal their crypto, TechCrunch has learned. * At the beginning of the month, an anonymous source told TechCrunch that a gang of cybercriminals have found a way to hack into the email addresses of anyone who has an att.net, sbcglobal.net, bellsouth.net and other AT&T email addresses. * According to the tipster, the hackers are able to do that because they have access to a part of AT&T’s internal network, which allows them to create mail keys for any user. Mail keys are unique credentials that AT&T email users can use to log into their accounts using email apps such as Thunderbird or Outlook, but without having to use their passwords. * With a target’s mail key, the hackers can use an email app to log into the target’s account and start resetting passwords for more lucrative services, such as cryptocurrency exchanges. At that point it’s game over for the victim, as the hackers can then reset the victim’s Coinbase or Gemini account password via email. * The tipster provided a list of alleged victims. Two of the victims replied, confirming they have been hacked. * AT&T spokesperson Jim Kimberly said that the company “identified the unauthorized creation of secure mail keys, which can be used in some cases to access an email account without needing a password.” * “We have updated our security controls to prevent this activity. As a precaution, we also proactively required a password reset on some email accounts,” the spokesperson said, forcing the account owners to reset their passwords. * AT&T declined to say how many people have been hit in this wave of hacks. “This process wiped out any secure mail keys that had been created,” the spokesperson added. * One victim told TechCrunch that hackers stole $134,000 from his Coinbase account. The second victim said that “it has been happening repeatedly since November 2022 — probably 10 times at this point. I notice it has been done when my Outlook client fails to ‘connect’ and I quickly login to my [AT&T] site and delete their key and create a new one.” * “Very frustrating because it is obvious that the ‘hackers’ have direct access to the database or files containing these customer Outlook keys, and the hackers don’t need to know the user’s AT&T website login to access and change these outlook login keys,” the victim added. * Also, several people with AT&T and other related email addresses said on Reddit that they have been hacked. * “Hello, my email was compromised back in March of this year and I have done everything I can to reset password, security questions, etc but occasionally I’m still getting emails that a secure mail key has been created on my account without my knowledge,” one user wrote. “They would even delete the email notification so I don’t see it but I recently changed to another email for profile updates so they don’t have access. This sounds like someone still has access to my account but how?” * Another person wrote: “I’ve had the same issue for months and just started again, password wasn’t changed but account locked out and a Mail Key keeps being created somehow.” * The tipster claims that the hackers can “reset any” AT&T email account, and that they have made between $15 and $20 million in stolen crypto. (TechCrunch could not independently verify the tipster’s claim.) * TechCrunch has seen a screenshot apparently coming from a Telegram group chat, where one of the hackers claims that the gang “have the entire AT&T employee database,” which allows them to access an internal AT&T portal for employees called OPUS. * “Only thing we are missing is a certificate, which is the last key to accessing the [AT&T] VPN servers,” the hacker wrote in the Telegram channel, according to the screenshot. * The tipster said that the gang now has access to AT&T’s internal VPN. * Kimberly, the AT&T’s spokesperson, denied that the hackers had any access to internal company systems. “There was no intrusion into any system for this exploit. The bad actors used an API access.”
New macOS Info-stealer called Atomic* Story + A new info-stealer malware has been discovered, designed to steal a plethora of sensitive information, including local files, cookies, financial details, and passwords stored in browsers of macOS. Named Atomic macOS Stealer (aka AMOS, or simply Atomic), it is being actively enhanced with new features by its developer, and the latest update was released on April 25. + Atomic - expensive yet efficient + According to the Cyble research team, Atomic is available on a private Telegram channel for a subscription of an amount of $1,000 per month. + The buyer receives a DMG installer file, a cryptocurrency checker, the brute-forcing tool MetaMask, and a web panel to manage attack campaigns. + The malicious DMG file is designed to evade detection and is flagged as malware on just one (out of 59) AV engines on VirusTotal. + When this DMG file is executed by the victim, it displays a password prompt masquerading as a macOS system notification, urging the user to enter the system password. + After obtaining the system password, it attempts to steal the passwords stored in the default password manager utility Keychain. This includes passwords for WiFi, credit card details, web logins, and other sensitive information. + Key capabilities + Atomic is designed with several data-theft capabilities, allowing its operators to target multiple browsers and crypto wallets, among others. + It scans the system for the installed software to steal details from them. Targeted applications include cryptocurrency wallets (Binance, Electrum, Atomic, and Exodus) and web browsers (Google Chrome, Microsoft Edge, Firefox, Opera, Yandex, and Vivaldi). + It further targets more than 50 cryptocurrency wallet extensions, including Coinbase, Yoroi, BinanceChain, Jaxx Liberty, and Guarda. + In addition, it attempts to steal system information, including Model name, RAM size, count of cores, serial number, UUID number, and more. + Ending notes + Atomic is another example of the fact that an increasing number of cyber threats are looming over macOS. In the past week, researchers have already revealed two more threats, the RustBucket Malware and a new LockBit variant, showing interest in Apple’s primary OS powering Mac devices. Thus, it is high time for Mac users to realize the ever-increasing threat and tighten up their security posture.
Contents
Phishing Scams Targeting Microsoft Teams. 2
LockBit Ransomware Group looking at Apple. 3
employee sent confidential data of 256,000 consumers to personal email 4
ChatGPT-Themed Scam Attacks Are on the Rise. 5
Links
https://cyberwarzone.com/new-captcha-protected-phishing-attack-targets-access-to-payroll-files/
https://cyware.com/news/lockbit-eyes-macos-test-version-of-macos-encryptor-revealed-53a7e8c3
https://edition.cnn.com/2023/04/20/business/cfpb-confidential-data/index.html
https://unit42.paloaltonetworks.com/chatgpt-scam-attacks-increasing
Phishing Scams Targeting Microsoft Teams* Live Scam + Targets people who need to access payroll files. - Through teams + Uses a captcha checkbox. - To stop security tool scanning * Attack + directs to a realilist payroll page pretending to be hosted by teams on office 365 + Pushes victim to a captcha page + Directs to cloned Microsoft login page - No matter what it tells you “InValid” credentials * Protect yourself. + Phishing defense + IOC - https[://]azaleastays[.]com/devr365web2023/ - https[://]payroll-microsoft365-access-panel-2023[.]softr[.]app/ - https[://]recaptcha-104cff-index-gateway[.]webflow[.]io/
LockBit Ransomware Group looking at Apple* Lately, several major ransomware groups, including ESXiArgs, Royal, Black Basta, Hive, RedAlert, and GwisinLocker have migrated their focus from Windows to Linux or VMware ESXi. However, in what appears to be a new trend, researchers have now observed the migration of LockBit from Windows and Linux platforms to macOS. * What has been observed? + Researchers from MalwareHunterTeam have observed samples of LockBit encryptor targeting macOS, calling this the first major ransomware operation to do so. + One specific encryptor sample, named locker_Apple_M1_64, targets the macOS machines running on the Apple M1 Silicon chipset. + This encryptor sample is believed to be developed in December 2022, when this sample was uploaded to the VirusTotal, in a ZIP archive file, comprising several other variants of LockBit. + In addition to the macOS variant, the ZIP archive consists of previously unknown LockBit encryptors targeting FreeBSD, ARM, MIPS, and SPARC. * Possibly a test build + The identified samples bear several clues which indicate that the Apple M1 encryptor is an unplanned version, and not prepared with the aim to be used in the wild. + Several strings in the code refer to VMware ESXi that does not support the Apple M1 architecture. + In the list of extensions and filenames to be excluded, there are 65 entries, all of them being Windows-OS filenames (msstyles) and extensions (.exe), hinting that the code from the Windows variant has been copied as is. + This macOS encryptor, further, has a buffer-overflow bug and crashes as soon as it is run. * Based on the above factors, it is believed that the developer had put together the macOS variant using code from other variants just for testing. * Ending notes + Experts from Apple, along with several security agencies, have confirmed that this specific encryptor is not a threat to macOS users. However, LockBit is considered one of the most sophisticated threats and is known for its out-of-the-box tactics. Therefore, this discovery of the macOS variant cannot be taken lightly. MacOS users are suggested to tighten up their security posture with frequent backups and use strong passwords.
employee sent confidential data of 256,000 consumers to personal email* Consumer Financial Protection Bureau + An employee sent confidential data to personal email. - Hundred of thousands of accounts + Approximately 14 emails included consumer PII - personally identifiable information + two spreadsheets that listed names and transaction-specific account numbers - about 256,000 consumer accounts at one institution. - “The numbers are used internally by the institution, are not the consumers’ bank account numbers, and cannot be used to gain access to a consumer’s account,” the CFPB said. - identified that the information includes PII regarding customers of 7 institutions and that it is still working to “identify the sensitivity of the PII and assess the risk of harm to consumers.” + employee who sent the emails - no longer works at the agency - access to the company network has been revoked - there’s no evidence to suggest that the confidential records were sent beyond their personal email * asked to delete the emails and provide proof, they have not yet cooperated
ChatGPT-Themed Scam Attacks Are on the Rise* Unit 42 + Palo Alto’s Security Team * Report + Between November 2022 through early April 2023 - 910% increase in monthly registrations for domains related to ChatGPT - 17,818% growth of related squatting domains from DNS Security logs - 118 daily detections of ChatGPT-related malicious URLs captured from the traffic seen in our Advanced URL Filtering system * Scam + various methods scammers use to entice users into downloading malware or sharing sensitive information - OpenAI for crypto frauds - Elon Musk’s name to attract victims - domain chatgptforchrome[.]com hosts an introduction page for the ChatGPT Chrome Extension. It uses the information and video from the official OpenAI extension.
Linkshttps://www.axios.com/2023/04/10/what-we-know-pentagon-document-leakhttps://securityaffairs.com/144866/cyber-crime/ncr-blackcat-alphv-ransomware.htmlhttps://cyberwarzone.com/beware-of-movie365-and-similar-sites-offering-free-movies-online/https://thehackernews.com/2023/04/vice-society-ransomware-using-stealthy.htmlPentagon Document Leak* Documents + Various social media sites - Twitter - Telegram + Documents leaking at least since January. - Discord - 4Chan + Leaker - Jack Teixeira * 21 y/o * North Dighton, Massachusetts. * Massachusetts Air National Guard - Arrest * in connection to “unauthorized removal, retention and transmission of classified national defense information” - Discord Members * suspicious of law enforcement and the U.S. intelligence community * prone to ranting about “government overreach," - Leak * photos of crumpled pieces of paper + laid on top of magazines. - or surrounded by household objects. + leaked documents numbers roughly 100 pages, + The documents illustrate U.S. efforts to spy on Ukraine's government and military leaders. - lays out the U.S.' extensive knowledge of Russian government intelligence. * could hurt U.S. spy efforts if Russia figures out where the information is coming from. - DLP?
NCR was the victim of BlackCat ransomware gang.* NCR Corporation + software, consulting and technology company providing several professional services and electronic products. + manufactures self-service kiosks, point-of-sale terminals, automated teller machines, check processing systems, and barcode scanners. * Outage + Wednesday + DFW05 datacenter + outage on its Aloha point of sale platform - restaurant point-of-sale and management software + notified law enforcement and engaged third-party cybersecurity experts. - investigate the incident and determine the scope of the attack. + restaurants impacted are still able to serve their customers - impacted a specific functionality. + BlackCat/ALPHV - AKA UNC4466 - Since November 2021 - added NCR to the list of victims on its Tor data leak site - Dominic Alivieri, CyberSecurity researcher published a chat message related to the negotiation between NCR and the ransomware gang. - removed the name of NCR from its leak site * probably because of an ongoing negotiation.
Free Movie Sites are a bad idea* Movies 365 + promise access to the latest movies * How they work + designed to lure users + make money by hosting forms and advertisements - possible malware + collecting personal information from users - survey or enter their email address or phone number - sold to third-party advertisers + Don’t just don’t
Vice Society Ransomware Using Stealthy PowerShell Exfiltration* Vice Society + Microsoft Tracks as DEV-0832 + extortion-focused + May 2021 * New Tool + bespoke PowerShell - avoids detection * living off the land binaries and scripts + no need to bring in external tools * automate exfil - ps1 * identifying mounted drives * recursively searching through each of the root directories * focus on files over 10 KB * file extensions and in directories that meet its include list * Excludes + system files, backups, and folders pointing to web browsers + security solutions from Symantec, ESET, and Sophos * Utilizes multi-processing and queuing + ensures it does not consume too many system resources
Linkshttps://www.bleepingcomputer.com/news/security/fake-ransomware-gang-targets-us-orgs-with-empty-data-leak-threats/https://www.bleepingcomputer.com/news/security/dish-slapped-with-multiple-lawsuits-after-ransomware-cyber-attack/https://www.bankinfosecurity.com/north-korean-lazarus-group-linked-to-3cx-supply-chain-hack-a-21597https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/https://www.hackread.com/ukrainian-hacktivists-russian-military-wives/Impersonating Ransomware Gangs for Extorsion* Not a new scam + Being observed since 2019 + In the end a social engineering scam * Midnight + Targeting US companies in US - Since March 16th + Impersonating Ransomware Gangs - Post exploit * targeted organizations that had previously been victims of a ransomware attack. - Data Extortion - Claim to be the gang who did it - Threaten DDoS * low-level DDoS * threaten of larger ones + unless the extortionists got paid. * Example #1 + employee of a holding company in the industry of petroleum additives - claimed to be the Silent Ransom Group (SRG) * AKA Luna Moth * splinter of the Conti syndicate + focused on stealing data and extorting the victim * . + subject line the name of another threat actor - Surtr ransomware group * December 2021 * encrypt company networks - Example #2 * authors of the data breach * stole 600GB of “essential data” from the servers. * Sent to senior financial planner + Who left more than 6 months prior * Kroll corporate investigation and risk consulting firm + March 23 + increased number of reports for emails received under the Silent Ransom Group name + “This method is cheap and easily conducted by low-skilled attackers. Much like 419 wirefraud scams, the scam relies on social engineering to extort victims by placing pressure on the victim to pay before a deadline. We expect this trend to continue indefinitely due to its cost effectiveness and ability to continue to generate revenue for cybercriminals” – Kroll
DISH slapped with multiple lawsuits after ransomware cyber attack. Dish Networks + DISH, an acronym for Digital Sky H*ighway + American Television Satellite provider - Own * Sling TV * Boost Mobile - Being Sued * multiple class action lawsuits + 6 law firms - On behalf of shareholders - recover losses faced by DISH investors who were adversely affected. + ransomware incident that was behind the company's multi-day "network outage." + overstated its operational efficiency. - deficient cybersecurity and IT infrastructure + “Attempted to conceal the fact that it maintained "deficient" cybersecurity and IT infrastructure while overstating its operational efficiency.” + Unable to properly secure customer data - Leaving it vulnerable + Cyber Attack - February 24th - offline with its websites and apps ceasing to function for days. * dubbed a "network outage. * also hit Boost Mobile - February 28th * SEC Filing * Confirmed it had been hit in ransomware. * Stock feel .79 cents to 11.41 share - Continues * March Still working to get systems back online. * March bills were sent out paper version.
Lazarus Group Linked to 3CX Supply Chain Hack* 3CX + Communications tool - macOS and Windows + VoIP application + compromised - compromised by attackers. - March 22nd, 2023 - CVE-2023-29059 - Self-Hosted - Windows * 12.407 * 12.416 - macOS * 11.1213 * 12.402 * 12.416 - Good Version * 12.422 - Volexity * Sophos agreed in Attribution. * Crowdstrike + identified the threat actor as Labyrinth Chollima - another name for Lazarus + analysis of the tools used in the attack. - Attribution to the Lazarus group + Reasoning - shellcode sequence * only used in the ICONIC loader and the APPLEJEUS malware * already linked to Lazarus - Lazarus * North Korean Backed * 2009 Founded * Financial Sectors * Quickly adapting techniques
Ukrainian Hacktivists Trick Russian Military Wives for Personal Info* Cyber Resistance + aka the Ukrainian Cyber Alliance * Trick + Social engineered wives of soldiers - To hack soldiers email accounts + The Con - Target: Colonel Sergey Valeriyevich Artoshchenko * bombing of a civilian-packed theatre in Mariupol in March 2022. - Convinced his wife to do a photoshoot. * Wearing husband’s uniform jacket * For a pin-up calendar + To increase the moral of Russian army * Hacktivists posed as an officer from her husband’s regiment. + Had her reach out to 12 other military wives. * wives took photos wearing the uniforms of their husbands. + provided Ukrainian hackers with enough information to track down the personal details of their husbands. + COVID-19 vaccination records to locate his current home, duty station, and other details. * hacked into the Russian Ministry of Defense website portal to hack email and get details on his salary. * got almost all key personal details, such as the colonel’s date of birth, address, and phone numbers. + publish his photo and images of his official documents and residence. * Wife + hacked and shared her private data, including her phone number, passport number, birth date, and email. + near nude and nude photos - published 2 photos in lingerie. + find and isolate various detailed lists of pilots, performance evaluation records of officers, bulletins, memos, theoretical and practical calculations, etc.
Linkshttps://blog.avast.com/shein-instagram-scamhttps://www.theverge.com/2023/3/24/23654996/linus-tech-tips-channel-hack-session-token-elon-musk-crypto-scamhttps://www.dexerto.com/entertainment/linus-tech-tips-youtube-channel-hacked-crypto-elon-musk-scam-2094461/https://cyberscoop.com/breachforums-arrest-cybercrime-underground/https://www.malwarebytes.com/blog/news/2023/03/beware-fake-irs-tax-email-delivers-emotet-malware?&web_view=trueInstagram scam uses fake SHEIN gift cards as lure* Old Scam + Based off a tried-and-true method * Avast Researchers + targeting Instagram users from various countries including the UK, Australia, France, Spain, and Poland * Scam + comment from a random account on a user’s post - congratulates the victim saying they’re one of the 2023 lucky ones selected to receive a SHEIN gift card. - offers the user a link to their Instagram profile, and at the end, they mention a long list of Instagram users that will be notified about the mention to be lured as victims to this scam. - The scammers Instagram has a link to use for the giftcard - Victim is given 3 questions and timer. - No matter how the answer their answered are checked - The victim is presented with nine closed boxes to choose from. * it doesn’t matter which ones are chosen. + the first one will always be a failure. + second one will always be a winner + the victim is asked for a small amount of money: * After entering their personal details + the victim is asked for their credit card details + The goal here is to hide the real Terms and Conditions. + The victim is expecting a gift card valued in several hundreds of euros or dollars. - It seems that they have to pay a small amount of money to receive it, but what's really happening is that they're subscribing to a service - In Australia, for example, the victim is charged AUD $2 plus AUD $69 every two weeks. - In France, the amount charged is €2 plus €33 every two weeks. For some countries, the money that will be charged isn't even disclosed. And of course, none of them will receive the gift card.
Linus Tech Tips Hacked* Linus + a Canadian YouTuber. - Linus Tech Tips - TechLinked - Techquickie + Creating and hosting YouTube channels - Most known for Linus Tech Tips (LTT). + channels have a combined subscriber base of over 26 million. * Attack + bypassed things like password and two-factor protections + targeted the session tokens - that keep you logged in to websites. + Malware - Linus Media Group’s team member downloaded a PDF * “what appeared to be a sponsorship offer from a potential partner” - included malware * accessed “all user data from both their installed browsers” + including session tokens + Access without needing to enter security credentials. * Damage + Over a decade of videos were deleted + streamed two videos featuring Elon Musk talking about cryptocurrency - One is named “OpenAI ChatGPT-4: The Game-Changing AI Technology” * Stream went down after around 35 minutes of broadcasting. - other is called “LinusTechTips & Elon Musk Special Crypto Giveaway”. * Taken down after around 20 minutes of broadcasting. - both livestreams appear to be identical * In the chat, a link to a presumably malicious “Crypto Giveaway” is present. + Appears to be a phishing attempt - get cryptocurrency wallet details
Another one bites the dust* Breach Forums + Taken down * History + Darkweb + March 16, 2022 came online + Replaced RaidForums that was taken down a month prior + First post was a simple “Welcome” + administered by “pompompurin” + hosted Hacked Data of 1 billions globally - according to FBI - 7 million robinhood customers - 23 TB of Shanghai National Police Data - 60,000 records from DC Health Link Insurance Exchange * Congress - Breached was initially met with “skepticism from the cybercrime underground,” but “persisted and became the largest English-speaking data broker forum anywhere across the deep or darkweb.” + News - FBI arrested a 20-year-old named Conor Fitzpatrick * Admitted to being Pompompurin * Claimed to earn $1,000/day selling information * Peekskill, New York * accused of just one crime: conspiracy to commit access device fraud. * appeared in a federal court in New York on March 16 and was released on a $300,000 bond + If he’s convicted he faces a maximum penalty of five years in prison * FBI and the U.S. Department of Health and Human Services Office of Inspector general + conducted a disruption operation that caused BreachForums to go offline. * FallOut + hackers looking to sell data have to find a new venue - may need to rebuild reputation + Researchers who track illicit activity by cross-referencing posts and monikers across sites will have to find new ways in, too. + BreachForums team build new, or a whole new forum and even some temporarily looking to Telegram channels already popping up
Fake IRS tax email delivers Emotet malware* MalwareBytes + Director of Threat Intelligence, Jerome Segura * W-9 Email Danger + form you fill in to confirm certain personal details with the IRS. Name, address, and Tax Identification Number + used as a lure for people to download emotet malware + “IRS Tax Forms W-9” which appears to have been sent from “IRS Online Center”. The email, which contains an attachment - Let me know if you would like a hard copy mailed as well.Respectifully [SIC]Barbara LaCostaInspectorDepartment of Treasure - Attachment W-9 Forms.zip * 709KB in size * Opened contains W-9 form.doc + 548 MB size * Opened will display + This document is protectedPreviewing is not available for protected documents. You have to press “enable editing” and “enable content” buttons to preview this document. * Macros run then Emotet is installed.
Linkshttps://www.bleepingcomputer.com/news/security/google-pixel-flaw-allowed-recovery-of-redacted-cropped-images/https://heimdalsecurity.com/blog/microsoft-outlook-vulnerability/https://www.bleepingcomputer.com/news/security/emotet-malware-now-distributed-in-microsoft-onenote-files-to-evade-defenses/https://cyware.com/news/hackers-use-ai-generated-youtube-videos-to-spread-info-stealers-8eefc3f6Google Pixel flaw allowed recovery of redacted, cropped images.* Google Pixel's built-in image editor, Markup tool, had a vulnerability called "Acropalypse" * The vulnerability allowed partially recovered edited or redacted images, even cropped or masked, for the past five years. * The vulnerability was discovered by security researchers Simon Aarons and David Buchanan and reported on Twitter. * The vulnerability was fixed by Google in an update released on March 13, 2023, tracking it as CVE-2023-21036. * Unfortunately, any images shared in the past five years are vulnerable to the Acropalypse attack, and nothing can be done to remediate this. * The vulnerability could expose sensitive information that the image creator redacted using Pixel's Markup tool before sharing the media with others or posting it online. * This applies to posting on platforms that do not compress user-uploaded media, so the sensitive data, if it exists, remains intact. * The issue impacts all Pixel models running Android 9 Pie and later until the February 2023 security update. * Acropalypse could impact non-Pixel smartphones using third-party Android distributions that use the Markup tool for screenshot/image editing. * A similar issue with reversible cropping was recently discovered on Google Docs.
Actively Exploited Microsoft Outlook Vulnerability Imperils Microsoft 365 Apps* Story + The cyber-research community has raised concerns over a vulnerability that puts the Microsoft 365 suite at risk. + The vulnerability, earmarked CVE-2023-23397, allows an unauthenticated threat actor to obtain the user’s credentials by passing along a crafted email package. + The bug affects several applications from the Microsoft 365 Apps Enterprise stack, including MS Office 2019, 2016, 2013, and LTSC. + The vulnerability itself does not require user interaction and has a high 'wormability' factor. + The method involves the involuntary disclosure of the victim’s Net-NTLM v.2 hash, which results in the threat actor declining their identity with the stolen credentials via an ancillary Windows service. + The vulnerability has a CVSS 3.1.9.8 score of 9.1 (i.e., Critical). + Microsoft has released an official fix for the vulnerability. + More than 70% of Heimdal® customers have already deployed Microsoft’s official fix for CVE-2023-23397, and more than 92% of customers that have enabled the Patch & Asset Management automatic patching feature have deployed the official fix during the same timeframe. * Remediation + Disable WebClient Service. - This workaround will help you block any type of WebDAV attack attempt. However, bear in mind that this can severely impact both users and applications. To disable the WebClient service, please follow the steps below. + Bypass NTLM - The safest route to mitigate the Microsoft Outlook vulnerability is to prevent apps or users to leverage the NTLM authentication mechanism. To perform this action, you can add your users and administrators under the Protected Users Security Group. Refer to Microsoft’s documentation for additional information. + Block NTML Messaging for Remote File Shares - Another method to prevent this type of Pass-the-Hash attack without disabling NTML or WebClient would be to block all types of NTML Communication to and from remote file shares. This can be done by blocking the TCP 445/SMB outbound port in your firewall.
Emotet malware now distributed in Microsoft OneNote files to evade defenses* Story + Emotet malware historically distributed through Microsoft Word and Excel attachments that contain malicious macros. + Emotet malware steals email contacts and content, downloads other payloads, and conducts cyberattacks against the company. + Emotet botnet had stopped for three months and restarted with a flawed campaign that continued to use Word and Excel documents with macros. + Emotet now distributes malware using malicious Microsoft OneNote attachments, which are distributed in reply-chain emails that impersonate guides, how-tos, invoices, job references, and more. + Microsoft OneNote allows you to create documents that contain design elements that overlay an embedded document, and Emotet threat actors have hidden a malicious VBScript file called 'click.wsf' underneath the "View" button. + If the user clicks on the OK button, the embedded click.wsf VBScript file will be executed and download the Emotet malware as a DLL and store it in the Temp folder. + Emotet will steal email, contacts, and await further commands from the command and control server. + Emotet commonly leads to Cobalt Strike or other malware being installed. * Remediation + Microsoft will be adding improved protections in OneNote against phishing documents, but there is no specific timeline for when this will be available to everyone. + Windows admins can configure group policies to protect against malicious Microsoft OneNote files. - Admins can use these group policies to either block embedded files in Microsoft OneNote altogether or allow you to specify specific file extensions that should be blocked from running.
Hackers Use AI-Generated YouTube Videos to Spread Info-steals* Hackers are using AI-generated YouTube videos to distribute info-stealing malware such as Raccoon, RedLine, and Vidar. The videos lure users by pretending to be tutorials on how to download free or cracked versions of software, such as Adobe Photoshop, Premiere Pro, Autodesk 3ds Max, and AutoCAD, which are only available to paid users. * What’s happening? + CloudSEK researchers observed a 200–300% month-on-month increase in such videos containing links to stealer malware in the description section. + Hackers often obfuscate such links either using URL shorteners such as bit[.]ly and cutt[.]ly, or file hosting platforms such as Discord, GitHub, Google Drive, MediaFire, and Telegram's Telegra[.]ph. + Some links directly download the malicious zip file as well. + To make the videos appear at the top of the results, threat actors employ SEO poisoning techniques. * Hijacking top accounts + Hackers leverage previous data leaks and social engineering to take over popular legitimate YouTube accounts to reach a large audience in a short time span. + They feature AI-generated personas in videos, share screen recordings, and audio walkthroughs that come off as trustworthy to users and mislead them into downloading the cracked software. + Moreover, to evade YouTube's algorithm and review process, threat actors use region-specific tags, write fake comments with automated processes to add legitimacy, and continuously upload videos to keep up with takedowns. * Conclusion + This is a worrying trend, given that YouTube has more than 2.6 billion active monthly users, and not everyone on the platform is well-versed in ways to protect themselves from such tricks. Organizations are recommended to conduct awareness campaigns and implement adaptive threat monitoring to address constantly changing threats. Users are suggested to enable multi-factor authentication and refrain from installing files from unverified sources.
Linkshttps://thehackernews.com/2023/03/batloader-malware-uses-google-ads-to.htmlhttps://www.bleepingcomputer.com/news/security/fbi-warns-of-cryptocurrency-theft-via-play-to-earn-games/https://securityaffairs.com/143282/hacking/akamai-mitigates-900gbps-ddos.htmlhttps://thehackernews.com/2023/03/xenomorph-android-banking-trojan.html?&web_view=trueBatloader uses Google Ads* What is Batloader? + Loader file + Utilized to distribute malware - information stealers - banking malware - Cobalt Strike - ransomware + eSentire - Google Ads - Spoof legitimate software/services * Adobe * OpenAPI's ChatGPT * Spotify * Tableau * Zoom - lookalike websites * host Windows installer + masquerading as legitimate apps * execute Python scripts + contain the BATLOADER payload * Upgrades + allow the malware to establish persitant access to enterprise networks.
Crypto: Pay to Earn Scam* "play-to-earn" + mobile and online games + custom-created gaming apps - promise huge financial rewards directly proportional to investments + established trust with beforehand in lengthy online conversations. + Tell then players earn cryptocurrency rewards in exchange for some activity, such as growing 'crops' - buy cryptocurrency and create a crypto wallet. - the purported rewards are higher the more funds the victim stores in this wallet + tempt victims with fake rewards to entice them to deposit more and more funds - drain their wallets once the victim stops making deposits - May tell them fees/taxes can get them their money back * It wont - Defense * Gamers are advised to stay vigilant + be cautious of unsolicited messages or invitations to games promising unrealistic financial rewards. * if something seems too good to be true, it probably is. * If you wish to participate in cryptocurrency-based gaming + create a unique wallet - isolates your primary cryptocurrency holdings should you unknowingly grant illicit actors access to your gaming wallet. + Use a third-party blockchain explorer to independently check the balances of the addresses in your gaming wallet. + Periodically use a third-party token allowance checker to help you see which sites or apps you have inadvertently permitted to access funds in your wallet and revoke those permissions. + FBI urges all victims to report incidents via the Internet Crime Complaint Center to help put a stop to these scams.
Akamai has mitigated the largest DDoS...So Far* Akamai + February 23, 2023, at 10:22 UTC + attack traffic peaked at 900.1 gigabits per second + 2 million packets per second. + launched against a Prolexic customer in Asia-Pacific (APAC). + The overall attack lasted only a few minutes. - intense and short-lived * attack traffic bursting during the peak minute of the attack. - redirecting the malicious traffic through its scrubbing network + Mitigation - 48% scrubbing centers in the APAC region - 6% one center in Hong Kong - all its 26 centers were loaded + Previous Record - 8 Mpps (Million Packets Per Second) - Europe in September 2022 - appeared to originate from the same threat actor * behind another record-breaking attack that Akamai blocked in July and that hit the same customer. - Microsoft * January Azure DDoS protection * 47 Tbps attack that targeted one of its customers * 340 million packets per second (pps).
Xenomorph Android Banking Trojan Returns* Xenomorph + February 2022 + 56 European banks through dropper apps * Xenomorph 3rd generation + Hadoken Security Group - Threat actor behind it. + updated version comes with new features that allow it to perform financial fraud in a seamless manner. + designed to target more than 400 banking and financial institutions - including several cryptocurrency wallets. + perform fraud through overlay attacks. + capabilities to automatically complete fraudulent transactions on infected devices - a technique called Automated Transfer System (ATS). - banks moving away from SMS for two-factor authentication (2FA) * ATS module that allows it to launch the app and extract the authenticator codes. - cookie-stealing functions, enabling the threat actors to perform account takeover attacks. + Play Protect - Play Protect (com.great.calm) - Play Protect (meritoriousness.mollah.presser) + Advertising - Zombinder * an APK binding service advertised on the dark web since March 2022 * wherein the malware is delivered via trojanized versions of legitimate apps. * The offering has since been shut down.
Linkshttps://www.helpnetsecurity.com/2023/03/06/financial-services-apps-vulnerabilities/?web_view=truehttps://www.helpnetsecurity.com/2023/03/06/cve-2023-21716-poc/?web_view=truehttps://www.bankinfosecurity.com/phishing-campaign-targets-job-seekers-employers-a-21371?&web_view=truehttps://www.helpnetsecurity.com/2023/03/03/known-exploitable-vulnerabilities/?web_view=truePopular fintech apps expose exploitable secrets* The Approov Mobile Threat Lab + downloaded, decoded and scanned the top 200 financial services apps - S., U.K., France and Germany - the Google Play Store + investigating a total of 650 unique apps. * Findings + 92% of the apps leaked valuable, exploitable secrets + 23% of the apps leaked extremely sensitive secrets. + Breakdown - 5 No Secrets Exposed - 48 Low value secrets - 444 medium value secrets - 150 High value secrets + two critical runtime attack surfaces that could be used to steal API keys at runtime + 5% of the apps had good defenses against runtime attacks + 4% were well protected against Man-in-the-Middle (MitM) attacks + hardcoding sensitive data in mobile apps is widespread - problem since secrets can easily be extracted + None of the 650 apps “ticked all the boxes” in terms of the three attack surfaces investigated. All failed in at least one category. + Only four apps had runtime protection against channel MitM attacks and “man-in-the-device.” All were payment and transfer apps and none were in the U.S. + In general, apps deployed in Europe were better protected than apps available only in the U.S., for immediate secret exposure and runtime protections. This may be due to stricter privacy rules in Europe and more focus on security. + Crypto apps were more likely to leak sensitive secrets as 36% immediately offered highly sensitive secrets when scanned. + Only 18% of personal finance apps leaked sensitive information, possibly because they are less dependent on sensitive APIs. + For Man-in-the-Device attacks, traditional banks are twice as likely to be well protected over other sectors reflecting the use of packers and protectors to protect against run-time manipulation.
Microsoft Word RCE PoC is public* CVE-2023-21716 + security researcher Joshua J. Drake in November 2022 + heap corruption vulnerability in Microsoft Word’s RTF parser - allows attackers to achieve remote code execution with the privileges of the victim + attackers can simply send a booby-trapped RTF file to the victim(s) via email. * Fixes + Microsoft confirmed the Preview Pane as an attack vector + patching vulnerable products is preferred - Configuring Microsoft Outlook to read all standard mail in plain text format - Using Microsoft Office File Block policy to prevent Office from opening RTF documents from unknown or untrusted sources.
Phishing Campaign Targets Job Seekers, Employers* Threat actors are exploiting the ongoing economic downturn + using job-themed phishing and malware campaigns + target job seekers and employers - steal sensitive information and hack company recruiters. + The phishing campaigns - target job seekers * sending emails that pretending to be from a recruitment agency * asking them to provide personal information or login credentials. - "These emails look legitimate but are designed to steal sensitive information such as passwords or financial information. The malware can then be used to steal sensitive information or to gain unauthorized access to the job seeker's device and the information stored on it," + The malware campaigns - attempts to drop prominent malware * AgentTesla * Emotet * Cryxos Trojans * Nemucod - Trellix researchers * observed that attackers are posing as job seekers to target employers. * The attackers send specially crafted emails delivering malware through attachments * URLs that are disguised as applicant resumes or identification documents. * cybercriminals take advantage of the high volume of job applications that employers receive, * goal of these attacks is to gain unauthorized access to sensitive information, steal personal data and disrupt the operation of the organization. * Attackers also are using fake or stolen documents such as Social Security numbers and driver's licenses + to make emails look legitimate and increase the credibility of the email * Typosquatting + creating typosquatting domains of popular job websites to target job seekers + Typosquatting is a social engineering attack in which attackers use misspelled domains for malicious purposes. + "These domains are like the legitimate websites, but with slight variations such as misspelled words or different extensions," Kapur says. + The domains trick job seekers into thinking they are applying for a job through a legitimate website, when in fact they are providing their sensitive information to cybercriminals. + researchers have observed an increase in registration of new typosquatted domains for jobs-related domains - LinkedIn - Indeed + Some of the examples of typosquatting domains observed by Trellix are indeed-id.com, indeed-7.com, indeed-a.com, indeed.ch, indedd.com, linkhedin.com, linkegin.com and linkednn.com.
Old Vulnerabilities haunt organizations* Tenable + Cyber Security Company * Report + 29 billion records were exposed. - 257 Terabytes of data + 3% of all data breaches identified were caused by unsecured databases. - 800 million records. + 1,335 data breach incidents - between November 2021 and October 2022. + Top 5 Vulnerabilities 2022 - #1) Large Pool of frequent vulnerabilities * Some far back as 207 * flaws in following applications + Microsoft Exchange + Zoho ManageEngine + Virtual private network - Fortinet - Citrix - Pulse Secure. + #2) Log4Shell - CVE-2021-44228 + #3) Follina - CVE-2022-30190 + #4) Atlassian Confluence Server and Data Center - CVE-2022-26134 + #5) Proxy Shell - CVE-2021-34473 + four of the first five zero-day vulnerabilities exploited in the wild in 2022 were disclosed to the public on the same day the vendor released patches and actionable mitigation guidance. * Attack Group Tactics + Ransomware #1 - LockBit 10% of attacks - Hive 7.5% - Vice Society 6.3% - BloackCat/ALPHV 5.1%
Linkshttps://www.bleepingcomputer.com/news/security/hardbit-ransomware-wants-insurance-details-to-set-the-perfect-price/https://www.malwarebytes.com/blog/news/2023/02/linkedin-slinks-abused-to-phish-email-and-payment-detailshttps://www.helpnetsecurity.com/2023/02/27/destructive-wiper-malware/Ransomware Ransom at the right price* HardBit + October 2022 - First seen + version 2.0 (November 2022) - Current version * According to Varonis - modifying the Registry to disable Windows Defender's real-time behavioral monitoring - stops 86 processes - establish persistence by adding itself to the "Startup" folder - deletes the Volume Shadow copies + Interesting - instead of writing encrypted data to file copies and deleting the originals - opens the files and overwrites their content with encrypted data. - Harder to recover - faster + No data leak site - Threateded to leak it + negotiate a ransom payment - initially no ransom amount set - 48 hours to contact attacker * Encrypted peer to peer networek - covered by the victim's insurance company - convince the victim * not to work with intermediaries + drives up the cost * disclose all insurance details * adjust their demands insurer cover all costs * contractually limited not to disclose insurance details to the attackers
Fake Amazon Prime email abuses LinkedIn's URL shortener* Prime based Phishing Email + a LinkedIn shortened link + email claims to have been sent from “Prime” - subject "New Membership Statement : Renewal Prime Membership statement was ended - Your renewal scheduled on February 21, 2023 + includes an Update Now button. - Used LinkedIN shorted link + Phishing Website - asks for an email or phone number tied to an Amazon account * enter a Gmail address leads to a page asking for the Gmail password * Microsoft address, and you'll be directed to a Microsoft password request page. - Once In * “Security Checkup”, the site asks for + Mother’s maiden name + Phone number + Date of birth + Address + City + State/province/region + Zip / postal code + Cardholder name + Card number + Security code + Expiration date
Wiper malware goes global* FortiGuard Labs + early 2022 + parallel with the Russia-Ukraine war + Rise in use - 2022 2nd half * 53% increase in use - Even if developed by a nation state * Hackers are using it against everyone
ChatGPT* AI Driven text * Phishing Attempts + Fake official ChatGPT website - malicious links * Lumma Stealer, Aurora Stealer, and clipper malware. - Unofficial ChatGPT social media page * content, such as videos and other unrelated posts to build credibility and posts featuring typosquatting domains, masquerading as the official website of ChatGPT - Malware * Close…but not there yet
Links
https://thehackernews.com/2023/02/fortinet-issues-patches-for-40-flaws.html
https://blog.twitter.com/en_us/topics/product/2023/an-update-on-two-factor-authentication-using-sms-on-twitter
https://www.bleepingcomputer.com/news/security/coinbase-cyberattack-targeted-employees-with-fake-sms-alert/
Fortinet Patches 40 Flaws* Fortinet released updates. + Addresses 40 vulnerabilities. - 2 – Critical - 15 – High - 22 – Medium - 1 – Low + internally discovered and reported * CVE-2022-39952 + CVSS 9.8/10 + in the FortiNAC network access control solution - arbitrary code execution - unauthenticated attacker to write to the system. + Impacted Versions - FortiNAC version 9.4.0 - FortiNAC version 9.2.0 through 9.2.5 - FortiNAC version 9.1.0 through 9.1.7 - FortiNAC 8.8 all versions - FortiNAC 8.7 all versions - FortiNAC 8.6 all versions - FortiNAC 8.5 all versions, and - FortiNAC 8.3 all versions + Horizon2.ai - Plans to release PoC code soon. * CVE-2021-42756 + CVSS 9.3/10 + unauthenticated remote attacker to allow code execution. - via specifically crafted HTTP requests + Impacted Versions - FortiWeb versions 6.4 all versions - FortiWeb versions 6.3.16 and below - FortiWeb versions 6.2.6 and below - FortiWeb versions 6.1.2 and below - FortiWeb versions 6.0.7 and below, and - FortiWeb versions 5.x all versions + fixes available in versions FortiWeb 6.0.8, 6.1.3, 6.2.7, 6.3.17, and 7.0.0
Twitter MMS MFA Disaster* 20 March 2023 + Twitter will make text message MFA Blue only. + Paid + After date, disabled automatically. * Other Methods Still Free + Authentication App + Security Key * Cost + MMS services cost to send text messages
Coinbase cyberattack targeted employees with fake SMS alert Coinbase + cryptocurrency exchange + attacker obtained some contact information belonging to multiple Coinbase employees + customer funds and data remained unaffected. * Attack + Sunday, February 5 + SMS alerts urging them to login to company accounts. - most employees ignored the messages. - one fell for it and went to the phishing page. + After entering their credentials - thanked and prompted to disregard the message. * Phase 2 + log into Coinbase's internal systems using the stolen credential. - MFA WIN! + 20 minutes later called the employee claiming to be from the Coinbase IT team. - directed the victim to log into their workstation and follow some instructions. * CSIRT + detected the unusual activity within 10 minutes. + contacted the victim to inquire about unusual recent activities from their account. + employee realized what happened and stopped talking with attacker. * Defense + Any web traffic from the company's technology assets to specific addresses, including sso-.com, -sso.com, login.-sso.com, dashboard-.com, and -dashboard.com. + Any downloads or attempted downloads of specific remote desktop viewers, including AnyDesk (anydesk dot com) and ISL Online (islonline[.]com) + Any attempts to access the organization from a third-party VPN provider, specifically Mullvad VPN + Incoming phone calls/text messages from specific providers, including Google Voice, Skype, Vonage/Nexmo, and Bandwidth + Any unexpected attempts to install specific browser extensions, including EditThisCookie
Spain Orders Extradition of Alleged British Hacker to US* Spain’s National Court + agreed to the extradition to the U.S. of a British citizen. - who allegedly took part in computer attacks. * July 2020 hacking of 130 Twitter accounts of public figures + Joseph Biden + Barack Obama + Bill Gates + requirements had been met for handing over Joseph James O’Connor to U.S. authorities. - 14 charges * revelation of secrets * membership of a criminal gang * illegal access to computer systems * internet fraud * money laundering and extortion. * Joseph James O’Connor + Age 23 + Liverpool, England + arrested in the southern Spanish coastal town of Estepona in July 2021. * SnapChat + hacking the Snapchat account of an unidentified public figure - allegedly tried to extort. * with the threat of publishing nude photographs * Swatting + prank calls to emergency services aimed at getting large numbers of police to be sent to different locations.
Contents
TA866 Threat Group Selectively Targets U.S. and German Organizations. 2
4,000 Women’s Health Patient Data Breach. 3
Pepsi Bottling Ventures suffers data breach after malware attack. 4
How not to handle an incident: DMS vendors silence over XSS zero-days. 5
Links
https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me
https://www.fosters.com/story/news/local/2023/02/10/garrison-womens-health-dover-nh-patient-medical-records-lost/69894288007/?&web_view=true
https://portswigger.net/daily-swig/radio-silence-from-dms-vendor-quartet-over-xss-zero-days?&web_view=true
https://www.bleepingcomputer.com/news/security/pepsi-bottling-ventures-suffers-data-breach-after-malware-attack/?&web_view=true
TA866 Threat Group Selectively Targets U.S. and German Organizations* Attack + The attack begins with a phishing email sent to the potential victim that likely uses thread hijacking and contains PDF documents laden with malicious URLs, Microsoft Publisher (.pub) attachments with malicious macros, or URLs pointing to malicious .pub files. + When the URL is clicked or the macro inside the document is executed, the victim system gets compromised and the attack chain gets initiated. + It downloads custom malware called Screenshotter and WasabiSeed on the victim’s machine. - The malware steals screenshots and Active Directory domain-related information from the victim's machine and sends them to the attacker. - After manually scanning these details, the attacker also downloaded AHK Bot and Rhadamanthys Stealer in some cases. * Look Out for + TA866 is believed to be working in the time zone UTC+2 or UCT+3, + use of the Russian language for variable names and comments in malware code hint towards its Russian origin. + The threat actor indulges in a multi-step attack chain that involves manual intervention.
4,000 Women’s Health Patient Data Breach* Wentworth-Douglass Hospital. + Garrison Women’s Health + New Hampshire + Feb 10th * 4,158 Data Destroyed + Not able to recover. + No evidence was shown. + Lost Data - Medical and/or treatment information (such as visits, procedures, tests, medical record number, diagnosis, medical history, genetic information, and various types of assessments, imaging, and results. - Coding claims and insurance/payment information for services. - Scheduling information for upcoming appointments. * Global Network Systems + Hosting Provider + aware of the issue on Dec. 12 + April 29, 2022, and Dec. 12, 2022, was subject to unauthorized third-party activity that rendered the information inaccessible - NO BACKUP!?
Pepsi Bottling Ventures suffers data breach after malware attack* Pepsi Bottling Ventures LLC + largest bottler of Pepsi-Cola beverages in the United States + manufacturing, selling, and distributing popular brands. + operates 18 bottling facilities across North and South Carolina, Virginia, Maryland, and Delaware. * Breach + occurred on December 23, 2022 + discovered January 10th, 2023 - 18 days later + The last known date of unauthorized IT system access was January 19, 2023. - 9 more days + installed malware, and downloaded certain information contained on the accessed IT systems. * Accessed Data + Full name + Home address + Financial account information (including passwords, PINs, and access numbers) + State and Federal government-issued ID numbers and driver's license numbers + ID cards + Social Security Numbers (SSNs) + Passport information + Digital signatures + Information related to benefits and employment (health insurance claims and medical history) * Remediation + Monitoring + Fixed Security measures + reset all company passwords. + informed the law enforcement authorities.
How not to handle an incident: DMS vendors silence over XSS zero-days* Tod Beardsley, director of research at Rapid7 + Blog article listing major vulnerabilities. - ONLYOFFICE, OpenKM, LogicalDOC, and Mayan * CVE-2022-47412 + ONLYOFFICE + impact versions from 0 through 12.1.0.1760 + stored cross-site scripting (XSS) - exploited if an attacker can ensure a malicious document is saved in the DMS for indexing. * Allowing + steal session cookies to create new, privileged accounts or perform a browser session hook and secure access to stored documents. * CVE-2022-47413 and CVE-2022-47414 + OpenKM + DMS version 6.3.12 + Vulnerabilities - XSS bug that requires a victim to save a malicious document. - attacker to have authenticated access to the OpenKM console. If they meet this condition, a stored XSS security flaw can be reached in the document ‘note’ function. * CVE-2022-47416 + LogicalDOC + XSS in an in-app chat system - Only Enterprise Version * CVE-2022-47415, CVE-2022-47417, and CVE-2022-47418 + LogicalDOC - LogicalDOC Community Edition and Enterprise, versions 8.7.3 and 8.8.2, respectively * Rapid7 + Contacted vendors and got no response
Links
https://en.yna.co.kr/view/AEN20230203008600325
https://www.websiteplanet.com/news/8twelve-leak-report/
LG Uplus' data breach impacted 290,000 users* LG Uplus Corp + Friday updated impacted users to 290,000 - 110,000 reported on Jan 10 * Leaked Data + Names + birth dates + phone numbers + does not include financial information * Working with: + Seoul Metropolitan Police Agency + Personal Information Protection Commission + Korea Internet & Security Agency
Mortgage Financial Technologies Company Exposed Hundreds of Thousands of Records Online* Jeremiah Fowler together and Website Planet research team + Found open and non-password protected database - Contained 717,814 records * Personally Identifiable Information (PII) of thousands of Canadian citizens + data contained “mortgage leads” - home mortgage loan * Names * phone numbers + Work + Home + Cell * email addresses * physical addresses - Employee Data + Individuals - who want to buy a house - Refinance - obtain an equity line of credit - purchase an investment property. * 8Twelve Financial Technologies Inc + “8Twelve streamlines the home financing process by providing its partners a one-stop financing solution for all their mortgage needs. 8Twelve’s proprietary technology platform INFIN8 identifies the best possible mortgage from Canada’s largest marketplace of bank, alternative, and private mortgage products”. + Canadian Based + Team sent responsible disclosure notification + restricted public access within hours of our discovery.
India’s Largest Truck Brokerage Company Leaking 140GB of Data* FR8 + Anurag Sen working with Italian cyber security firm FlashStart - discovered the server on Shodan + exposed more than 140 gigabytes of data, which is available to the public without any password or security authentication + Researchers contacted them - Public email bouncing back * Data + sensitive information - customer records - Invoices - payment details * Users across India. + other personal information - Names - Addresses - contact numbers * both customers and employees.
CyberSec Professionals' Inability to prevent bad things from happening* Study - Exabeam + 83% of organizations experienced more than one data breach in 2022 + 97% of respondents feel confident that they are well-equipped with the tools and processes needed to prevent and identify intrusions or breaches + 46% of all respondents operate more than one cloud or on-premises SIEM platform - 64% of those who have one platform are very confident they can detect cyberattacks based on adversary behavior alone - 59% of those with two or more platforms are very confident. + 4% of U.S. security professionals report not using a SIEM platform - 81% were confident. + 17% of all respondents can see 81–100% of their network * Prevention + 65% still prioritize prevention over detection, investigation, and response as their most important security goal. + Just 33% said detection was the highest priority. + 71% spend 21-50% of their security budgets on prevention. + 59% invest the same percentage on threat detection, investigation, and response * Staff + 43% of respondents cited being unable to prevent bad things from happening as the worst part of their job + Lacking full visibility due to security product integration issues (41%) + An inability to centralise and understand the full scope of an event or incident (39%) + Being unable to manage the volume of detection alerts, with too many false positives (29%) + Not feeling confident that they’ve resolved all problems on the network (29%) * Credential Compromise + 90% of security professionals are battling compromised credential cases + Just 11% can scope the overall impact of detected malicious behaviours in less than one hour. + 52% report they can analyse it in one to four hours. + 34% take five to 24 hours to identify high-priority anomalies.
Contents
Old Vulnerability Used to Attack VMware. 2
Nevada Ransomware Group. 3
Data breach at Vice Media involved SSNs, and financial info. 4
Next LockBit Color. 5
Links
https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
https://enes.dev/
https://resecurity.com/blog/article/nevada-ransomware-waiting-for-the-next-dark-web-jackpot
https://therecord.media/data-breach-at-vice-media-involved-ssns-financial-info/?web_view=true
https://cyware.com/news/ransomware-landscape-2022-kela-report-ae18463b
Times
00:36
05:38
11:00
16:19
Old Vulnerability Used to Attack VMware* OVHcloud + French cloud provider + published a report linking this massive wave of attacks targeting VMware ESXi servers + first day of attacks, approximately 120 ESXi servers were encrypted. - Weekend 2,400 VMware ESXi devices worldwide + VMware - Confirmed the attacks * NOT ZER0 DAY - advises admins * install the latest updates for ESXi servers * disable the OpenSLP service + disabled by default since 2021. * CVE-2021-21974 (8.8/10) High + security flaw is caused by a heap overflow issue in the OpenSLP service - can be exploited by unauthenticated threat actors - low-complexity attacks + Impacted Versions - ESXi versions 7.x prior to ESXi70U1c-17325551 - ESXi versions 6.7.x prior to ESXi670-202102401-SG - ESXi versions 6.5.x prior to ESXi650-202102101-SG + Patched Feb 23 2021 + Attacks focus on ESXi hypervisors in version 6.x and prior to 6.7 * Ransomwhere ransom payment tracking service + reporting only four ransom payments for a total of $88,000. + lack of ransom payments - VMware ESXi recovery guide * security researcher Enes Sonmez * rebuild machines and recover data…FREE - Defense * Well…update * disable the vulnerable Service Location Protocol (SLP) service * OpenSLP port (427) monitor
Nevada Ransomware Group* The Nevada Ransomware has appealing partner conditions + initial commission rate of 85% * The actors behind the ransomware have the ability to escalate their attack beyond the initial point + by performing post-exploitation activities for maximum damage. * both Windows and Linux/ESXi versions of the Nevada Ransomware + constantly updated. * On February 1, the developers behind the project improved the functionality of the ransomware + distributed new versions for their affiliates supporting Windows and Linux/ ESXi. * not only develop ransomware but also obtain unauthorized access for additional exploitation. * team that specializes in post-exploitation + working to escalate the initial point of compromise into a full network intrusion. * In the Windows version, files are encrypted "by stripes," + which tout as a significant advantage speed * Written in Rust + the locker can be executed through a console with pre-defined flags - including encrypting selected files and directories - self-deleting - deleting shadow copies - loading hidden drives - self-mode encryption - finding and encrypting network shares.
Data breach at Vice Media involved SSNs, financial info* Vice Media + filings on January 26 * cyberattack on its network + alerted in March 2022 + hired a cybersecurity firm - investigate the incident - into an internal Vice e-mail account + Social Security numbers were involved in the breach - which affected 1,724 people. + delayed reporting - effort to figure out what personal information was involved - find up-to-date addresses for all victims - no comment on why this took a year + Victims are being offered 12 months of credit and identity monitoring services + identity restoration services through Equifax - plan includes $1 million in identity theft insurance.
Next LockBit Color* LockBit ransomware group + Most active threat in 2022 - More victims than any other group + LockBit Red + LockBit Black (LockBit 3.0) - derived from BlackMatter’s source code. + LockBit Green - significant overlap (89%) with Conti ransomware v3 - modified their ESXI ransomware variant. - ransom note is identical to the one used by the LockBit Black * ransom note filename has been changed to !!!-Restore-My-Files-!!!.txt. - uses random extensions rather than the standard .lockbit extension + Hacker Buy In - ex-Conti members will prefer LockBit Green - familiarity to Conti will mean less learning cur
Bullet points of key topics + chapter markers[00:36] New CrySIS/Linkshttps://cyware.com/news/new-crysisdharma-ransomware-variants-budding-like-mushrooms-c7fc5e9chttps://www.rollingstone.com/politics/politics-news/no-fly-list-leaked-unsecured-airline-server-1234665941/https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/https://www.bleepingcomputer.com/news/security/riot-games-hacked-delays-game-patches-after-security-breach/https://www.bleepingcomputer.com/news/security/mailchimp-discloses-new-breach-after-employees-got-hacked/New CrySIS/Dharma Ransomware Variants* Dharma ransomware + February 2016 - ESET Researchers - Named it Crysis * Spotted in Russia, Japan, North and South Korea and Brazil - November 2016 * V2 and V3 master decryption keys for Crysis were released online + BleepingComputer Forum - file containing the actual master decryption keys and information on how to utilize them - Suspected member of the development team. + January 2017 - CrySIS RaaS was relaunched as Dharma + March 2017 - Master Key released * BleepingComputer - 2019 * Phobos + Was similar in design to Dharma (a little too similar) * Now that leaked code is being used by several attackers * New Variants appearing frequently. - Attack * abuse exposed RDP servers * phishing techniques + installation files for genuine software * Post-encryption, the ransomware executes the Microsoft HTML Application (MSHTA) to display a file, Info[.]hta, that contains the ransom details. * a separate file named info[.]txt is dropped. It includes a shortened set of instructions to reach the attacker - What’s Different * set the console to codepage 1251, which has the ability to use Cyrillic languages * delete the shadow copies * copy of the ransomware is copied to the host’s startup folder * file extensions are made to the attacker
No Fly List Uncovered* maia arson crimew + Swiss Hacker/Hacktivist + Searching Shodan found it * Unsecured Server + Airline: CommuteAir + csv - appeared to have more than 1.5 million entries in total - names as well as birth dates - aliases + contained the identities of hundreds of thousands of individuals from the U.S. government’s Terrorist Screening Database and “No Fly List.” + private information on almost 1,000 CommuteAir employees. + The server also held the passport numbers, addresses, and phone numbers of roughly 900 company employees. User credentials to more than 40 Amazon S3 buckets and servers run by CommuteAir * TSA + “aware of a potential cybersecurity incident with CommuteAir, and we are investigating in coordination with our federal partners.” * CommuteAir + regional airline based out of Ohio + the exposed infrastructure, (development server), was used for testing purposes. - taken offline + confirmed the legitimacy of the data - 4 years earlier + “The server contained data from a 2019 version of the federal no-fly list that included first and last names and dates of birth. “In addition, certain CommuteAir employee and flight information was accessible. We have submitted notification to the Cybersecurity and Infrastructure Security Agency and we are continuing with a full investigation.”
Riot Games Hacked* Riot Games + video game developer and publisher + League of Legends and Valorant + Delay game patches * Hacked + development environment was compromised last week. - Twitter thread on Friday night + "Earlier this week, systems in our development environment were compromised via a social engineering attack.” + breach directly impacted its ability to publish patches for its games
MailChimp discloses new breach* MailChimp + gained access to employee credentials + support tool access to 133 accounts - social engineering attack on Mailchimp employees and contractors. + first detected on January 11th - detected the unauthorized person accessing their support tools. - no credit card or password information was compromised + January 12 - notified the primary contacts for all affected accounts + WooCommerce eCommerce plugin for WordPress - Extremely Popular - One of the customers impacted - emailed customers warning them that the MailChimp breach exposed their names, store URLs, addresses, and email addresses. + Not the First time - April 2022 * Trezor hardware wallet owners + Email fake data breach + Download fake Trenzor Suite to steal recovery seeds * that the mailing list used in this phishing campaign was a Trezor mailing list stolen in a breach on MailChimp * employees falling for a social engineering attack that allowed threat actors to access 319 MailChimp accounts and export the data from 102 customers. - August 2022 * Okta phishing attack * threat actors accessed 214 MailChimp accounts + focused on cryptocurrency-related customers. - included Edge Wallet, Cointelegraph, NFT creators, Ethereum FESP, and Messari and Decrypt.
Links
https://www.bankinfosecurity.com/medical-imaging-firm-faces-2-class-actions-in-2022-breach-a-20930
https://www.bitdefender.com/blog/hotforsecurity/hackers-disrupt-24-hours-of-le-mans-virtual-esports-event/
https://www.bleepingcomputer.com/news/security/poc-exploits-released-for-critical-bugs-in-popular-wordpress-plugins
Medical Imaging Firm Faces 2 Class Actions
- Shields Health Care Group
- prominent Massachusetts-based medical imaging services provider
- 40 locations in New England
- Including outpatient testing facilities and in hospitals
- Most locations in Massachusetts
- touts itself as the "official" provider of MRIs and related medical imaging services to several professional sports teams.
- New England Patriots
- the Boston Celtics
- the Boston Bruins.
- 40 locations in New England
- facing proposed class action lawsuits in federal and state court
- 2022 Breach
- 2 million people were impacted.
- Federal
- Consolidation of 7 class action lawsuits
- Everyone except Massachusetts
- State
- Everyone from Massachusetts
- Claims
- including negligence
- recklessness in failing to protect sensitive information.
- breach of contract
- invasion of privacy
- violations of various state laws.
- failed to notify affected individuals in a timely manner
- HIPAA
- breach affecting 500 or more.
- 60 days report
- 60 days notify people.
- breach affecting 500 or more.
- HIPAA
- 2022 Breach
- prominent Massachusetts-based medical imaging services provider
- Report
- Ranks top 5 largest US health breaches.
- U.S. Department of Health and Human Services' HIPAA Breach Reporting Tool
- reported the incident as a business associate.
- a hacking incident involving a network server and affecting 2 million individuals.
- Breach
- According to Shields notification
- March 28, 2022, it detected suspicious activity.
- "an unknown actor" had gained access to certain Shields systems for the two-week period last year between March 7 and March 21.
Hackers disrupt virtual esports event* 24 Hours of Le Mans Virtual" competition + the biggest esports event in endurance racing + real-world FIA drivers compete alongside leading esports players. + $250,000 total prizes + 5 Rounds - Ends with 24-hour finale. * What happened? + Max Verstappen - Who was the Formula 1 World Champion + Leading the race by over a minute + Thrown out and disconnected. + When returned was in 17th? - Tried to regain his lead. + Quit when he was in 14th. + Raged online after + Several other drivers reportedly experienced similar problems + Earlier in the race, the Le Mans Virtual organizers had confirmed that it had suffered a "suspected security breach" * eSports + big business + multi-million-dollar sponsorship deals + gambling
Security Things to Remember as People Return to Work* Things to keep top of mind. + Employee education of information systems and protocols + Know your inventory. - Both Data and Physical + Delete redundant data. + Early detection systems - XDR and EDR + Data back-ups + Zero Trust, Least Privileged or Limiting access. + External Security Audits + Mutli-Factor Authentication + Update all systems before letting on network + Op Sec
PoC for critical bugs in popular WordPress plugins* WordPress + 3 popular plugins - 10 of thousands of active installations - Paid Memberships Pro * membership and subscriptions management tool - Easy Digital Downloads * e-commerce solution for selling digital files - Survey Marker * surveys and market research + High-severity or critical SQL injection vulnerabilities + PoC exploit now public. * SQL Injection + security flaw + allows attackers to input data into form fields or via URLs. - that modify database queries to return different data or modify a database. - This can be gain access to a site, delete data, inject malicious scripts, etc. * Joshua Martinelle + Tenable security researcher + reported them responsibly to WordPress on December 19, 2022 - With PoC code + disclosed technical details about each vulnerability with proof-of-concept exploits using the SLEEP function to demonstrate how the flaws work * Plugin Authors + Plugins have been updated to address. + All problems fixed (as long as you updated) * CVE + Paid Memberships Pro - CVE-2023-23488 (9.8) - affects all versions of the plugin older than 2.9.8. Paid Memberships Pro fixed the vulnerability on December 27, 2022, with the release of version 2.9.8. + Easy Digital Downloads - CVE-2023-23489 (9.8) - impacts all versions below 3.1.0.4, released on January 5, 2023. + Survey Marker - CVE-2023-23490 (8.8) - Attacker needs to be authenticated. - update on December 21, 2022, with version 3.1.2.
Links
https://www.scmagazine.com/news/data-security/hackers-went-after-personally-identifiable-information-the-most-study-says?&web_view=true
https://www.imperva.com/resources/whitepapers/More-Lessons-Learned-from-Analyzing-100-Data-Breaches_WP.pdf
https://cyware.com/news/flipper-zero-phishing-attacks-eye-infosec-community-b40c8ac5
https://hackernoon.com/cloud-phishing-new-tricks-and-the-crown-jewel
https://www.bankinfosecurity.com/blogs/do-ransomware-victims-pay-for-data-deletion-guarantees-p-3342
Hackers go after PII the most* Imperva + Cyber Security Software Company + California * Report + 100 breaches + 1 Year - July 2021 to July 2022 * PII Target + 42.7% - Other types - credit card info - passwords - source code + Why? - most valuable * can compile more PII from the dark web + harder to prevent fraud + full-on identity theft * Tactics + 27.1% of data breaches were caused by hackers + unsecured databases and social engineering at 14.6% + Ransomware followed as the fourth most common cause of a breach at 10.4% + third parties caused 7.2% of breaches * top four industries + Finance + professional services + healthcare + public administration
InfoSec Community Target in Phishing Campaign* Flipper Zero + multi-functional portable cybersecurity tool - RFID emulation - radio communications - digital access key cloning - NFC - Bluetooth - Infrared + Production issues - People have a hard time getting it - Supply chain shortages - Huge demand * Attack + creating fake shops and faking to sell it. + A security researcher spotted the phishing campaigns, including two fake Flipper Zero stores and three fake Twitter accounts + One of the fake Twitter accounts has the same handle as the official Flipper Zero account. However, it was spotted using a capital “I” in the name that looks just like an “l” on Twitter. - This fake Twitter account responds to people regarding availability and other accounts' tweets to make it look genuine. + The aim behind attacks is to take buyers to the phishing checkout page, where they are urged to enter their full names, shipping addresses, and email addresses. - The victims are given a choice to pay using Ethereum/Bitcoin and told that the order will be processed within 15 minutes.
Harder to Detect Phishing Technique* Phishing from SaaS to SaaS + They distribution of a phony invoice, protected document, or PDF housed on trusted cloud services - the user must either download it or activate it using cloud services. - These phishing emails are challenging to identify during scanning because their contents and URLs all seem legitimate. - Utilize cloud services like: * Office365 * Box * DropBox * OneDrive * SharePoint - Forces the user to login. + 2nd Phase - second stage establishes a new Office 365 account on a rogue device in the victim’s name. Once established on the new computer, the victim’s user account (and or this case, its Azure Ad) is used to send internal phishing attacks (disguised as the victim) within the company or to customers using the legitimate email account. + BYOD (Bring-Your-Own-Device) - Helps leverage this attack * QR Method + malware links via QR codes embedded in emails - Not detected by security software
Ransomware Victims Pay for Data Deletion* Ransomware Attack + pay for a decryptor! - you'll be able to unlock the encrypted data. + Pay some more, name disappears. - your name gets deleted from the list of victims on a ransomware group's site. + Pay even more for deletion. - They promise that whatever data they've stolen - or already leaked - will be immediately deleted. * Psychological Goal + Organizations need is to protect stolen data and salvage their reputation. * Allan Liska + a principal intelligence analyst at Recorded Future - "They're not going to delete your data. I mean, just flat out, they're going to pretend to delete your data," - "We've seen that time and time and time again, and I think organizations are fully aware of that. So then the question becomes: 'Will they pay for the illusion that the data has been removed? * Don’t pay
Contents
Cisco Warns of Many Old Vulnerabilities Being Exploited in Attacks.
Glupteba botnet is back after Google disrupted it.
85% of attacks now use encrypted channels.
InfraGard Hacked/Hacker Halts Sale of FBI’s High-Profile InfraGard Database.
Links
https://www.securityweek.com/cisco-warns-many-old-vulnerabilities-being-exploited-attacks
Cisco Warns of Many Old Vulnerabilities Being Exploited in Attacks* Cisco Last Week + added exploitation warnings to more than 20 advisories detailing security defects in Cisco IOS, NX-OS, and HyperFlex software + carry severity ratings of ‘critical’ or ‘high’ + been addressed 4-5 years ago. - execute arbitrary code (RCE) - denial-of-service (DoS) condition - execute arbitrary commands. * CVSS score of 9.8. + CVE-2017-12240 + CVE-2018-0171 + CVE-2018-0125 + CVE-2021-1497 + CVE-2018-0147 * 15 advisories that deal with high severity. * US Cybersecurity and Infrastructure Security Agency (CISA + added these vulnerabilities to its Known Exploited Vulnerabilities Catalog - months ago
Glupteba botnet is back after Google disrupted it* Glupteba + blockchain-enabled botnet + Active since 3022 + Composed of more than 1 million Windows PC - Dec 2021 + stealing users’ credentials and data + mining cryptocurrencies + abusing victims’ machine resources + setting up proxies to funnel other people’s internet traffic through infected machines and routers. + spread via cracked or pirated software and pay-per-install (PPI) schemes. * December 2021 + Google announced it has taken down the infrastructure + sued Russian nationals Dmitry Starovikov and Alexander Filippov for creating and operating the botnet. * I’m Back + Nozomi Networks + surge in the number of infections worldwide - increase of malicious bitcoin addresses - increase in TOR hidden service being used as C2 servers - at least five different merchants and exchanges were used to fund the Glupteba addresses since 2019 - identified 15 Glupteba bitcoin addresses. - used passive DNS records to uncover Glupteba domains and hosts. - analyzed the latest set of TLS certificates used by the bot to figure out the infrastructure.
85% of attacks now use encrypted channels* Zscaler + manufacturing, education and healthcare being the most commonly targeted. + U.S., India and Japan seeing the biggest increases in attacks. + Encrypted Channels being used to hide traffic. - Variety of attacks - malware continues to be the most prevalent. + Malicious scripts and payloads made up nearly 90% of the encrypted attack tactics blocked in 2022. - Includes ransomware. * 80% up this year * defenses become more complex. + attackers have also continued to evolve their techniques. + malware variants that are harder to spot + bypass reputation-based technologies
InfraGard Hacked/Hacker Halts Sale of FBI’s High-Profile InfraGard Database* Dec 14th, 2022 + BreachForums + USDoD Alias Hacker + claimed to obtain the entire database of InfraGard. - FBI’s program for protecting U.S. critical infrastructure. * Launched in 1996 * partnership with the private sector * 80,000-member database * business leaders, government officials, and IT professionals as its members + Information Obtained - Full names - Email addresses - Employment details - Industry of employment - Social media USERIDs. + Hacker used contact email address and the impersonated CEO's real mobile number. - a simple software script was leveraged to access the database information + selling the entire database for $50,000 * Conscience? + Hackread.com - Confirm the hacker backed off - Hacker updated their post yesterday stating that the stolen InfraGard database would ‘no longer be posted for sale * it would ‘cause more harm to everyone’ than benefiting the hacker themself. * they did not want to ‘‘cause any more trouble.’’ - hacker also stated that all the email addresses present in the database were emailed to Troy Hunt so that he could add them to his website Have I Been Pwned
Linkshttps://www.wired.com/story/sequoia-hr-data-breachhttps://www.bleepingcomputer.com/news/security/us-health-dept-warns-of-royal-ransomware-targeting-healthcarehttps://www.bleepingcomputer.com/news/security/hackers-earn-989-750-for-63-zero-days-exploited-at-pwn2own-toronto/https://www.bleepingcomputer.com/news/security/cisco-discloses-high-severity-ip-phone-zero-day-with-exploit-code/ Sequoia Discloses a Data Breach
- Sequoia
- “professional employer organization,” or PEO
- Human Resources
- Payroll
- Benefits Management
- popular with US startups
- more than 500 venture-backed companies.
- Early December
- detected unauthorized access to a cloud storage repository.
- Sequoia One customers sensitive and personal data
- Names
- Addresses
- dates of birth
- gender
- marital status
- employment status
- Social Security numbers
- work email addresses
- wage data related to benefits.
- ID cards
- Covid-19 test results.
- vaccine cards
- Incident
-
- September 22 and October 6
- ‘read only,’ access
- forensic review by Dell Secureworks
- did not see evidence of a data extortion attempt.
- did not find any compromised computers or servers
- did not see evidence of ongoing unauthorized access to the company's system
- No use of the data so far/
Health Dept warns of Royal Ransomware
- Health Sector Cybersecurity Coordination Center (HC3)
- U.S. Department of Health and Human Services (HHS)
- Thursday
- Warning for healthcare organizations
- ongoing attacks
- Royal Ransomware
- Sept 2022 increasing malicious activities
- new operation, the Royal ransomware gang
- behind multiple attacks against U.S. healthcare orgs
- without affiliates
- made up of experienced threat actors who worked for other groups.
- First spotted Jan 2022
- Initially used encryptors from other gangs like BlackCat,
- Quickly designed their own
- Zeon which generated Conti-like ransom notes
- mid-September, the ransomware gang rebranded again to "Royal" and uses a new encryptor that generates ransom notes with the same name.
- Techniques
- uses social engineering
- trick corporate victims into installing remote access software
- phishing attacks where the attackers impersonate software providers and food delivery services.
- infecting their targets and encrypting systems
- ransom payments ranging from $250,000 to $2 million
- hacked Twitter accounts
- tweet information on compromised targets to journalists
- the attack covered by news outlets
- put additional pressure on their victims
- Page Break
Hackers earn $989,750 for 63 zero-days exploited at Pwn2Own Toronto
- Pwn2Own Toronto 2022
- December 6th - 8th
- Hacking Competition
- Targeted devices
- Mobile phones
- Home Automation Hubs
- Printers
- Wireless Routers
- NAS
- Smart Speakers
- All fully updated.
- Default configuration
- Companies
- Canon
- HP
- Mikrotik
- NETGEAR
- Sonos
- TP-Link
- Lexmark
- Synology
- Ubiquiti
- Western Digital
- HP.
- competitors earning $989,750
- 63 zero-day exploits
- 66 entries
- 36 teams
- 14+ countries
- No teams signed up for
- iPhone 13
- Google Pixel 6
- hacked a fully patched Samsung Galaxy S22 four times
- STAR Labs Team first to exploit 0day
- improper input validation attack on their third attempt
- earning $50,000 and 5 Master of Pwn points
- Sec Researchers with Interrupt Labs and Pentest Limilted
- 2nd and 3rd days demoed a 0day in just 55 seconds.
Page Break Cisco discloses high-severity IP phone zero-day
- Thursday
- Product Security Incident Response Team (PSIRT)
- high-severity zero-day vulnerability
- latest generation of its IP phones
- exposing them to remote code execution and denial of service (DoS) attacks
- Proof on Concept Code
- vulnerability has been publicly discussed.
- PSIRT added that it is not yet aware of any attempts to exploit
- has not released security updates to address this bug before disclosure
- patch will be available in January 2023.
- CVE-2022-20968
- caused by insufficient input validation
- received Cisco Discovery Protocol packets
- unauthenticated
- adjacent attackers can exploit to trigger a stack overflow.
- Cisco IP phones running 7800 and 8800 Series firmware version 14.2 and earlier.
- provides mitigation advice for admins who want to secure vulnerable devices in their environment from potential attacks.
- disabling the Cisco Discovery Protocol on affected IP Phone 7800 and 8800 Series devices that also support Link Layer Discovery Protocol (LLDP) for neighbor discovery.
- not a trivial change and will require diligence on behalf of the enterprise
How not to handle vulnerabilites, HHS warns use of pixel tracking tech without BAA violates HIPAA, Trustcor dropped as root certificate authority, Hyundai app bugs allowed hackers to remotely unlock, start cars
Tis the Season for Cyber Security, 487 Million WhatsApp Users Numbers for Sale, Hospitality company confirms Data Breach, SocGholish finds success through novel email techniques
Links
https://thehackernews.com/2022/11/researchers-discover-hundreds-of-amazon.html
https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots
https://www.darkreading.com/attacks-breaches/researchers-alarm-batloader-malware-dropper
https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
https://www.securityweek.com/samba-patches-vulnerability-can-lead-dos-remote-code-execution?&web_view=true
https://www.samba.org/samba/security/CVE-2022-42898.html
https://cyware.com/news/rapperbot-targets-game-servers-with-modified-brute-force-and-ddos-attacks-4294e924
Amazon RDS Instances Leaking Users' Personal Data * Mitiga + A cloud incident response company + Released a shocking report + 810 Instances Found - Sept 21 – Oct 20, 2022 - 250 exposed for over 30 days * Amazon RDS + Relational Database Service + Web service + Setting up relational services in AWS + Different engines supported - MariaDB - MySQL - Oracle - PostgreSQL * Hundreds of Amazon’s RDS + Exposing PII - Names - email addresses - phone numbers - dates of birth - marital status - car rental information - company logins. * Danger + Reconnaissance + Ransomware + Extortion + Phishing * How does this happen? + RDS snapshots - Public feature that allows creations of “backups” of the database environment - Can be accessed by ALL AWS accounts * Stay Safe + Sharing a snapshot of your DB should not have PII included + RDS snapshots are not publicly accessible + encrypt snapshots where applicable
Dangerous BatLoader Malware Dropper * new malware loader + Infecting systems over the last few months + VMware Carbon Black researchers tracking + Dubbed “BatLoader” * Batloader + batch and PowerShell scripts - To get initial access + Determines if it’s on a business or personal computer - Personal * Fraud * Infostealing * banking-based payloads + Ursnif - Buisness/Organization * intrusion tools + Cobalt Strike + Syncro + distribute a variety of malware tools - a banking Trojan - an information stealer - the Cobalt Strike post-exploit toolkit + Resemblence - Conti * IP Address * Atera + Remote Management Tool - Zloader * Banking trojan * SEO Poisioning * Windows Installer + Initial foothhold * Powershell * Batch Scripts * VMware Report + Carbon Black MDR team - In 90 days - 43 successful infections - Unsuccessful numerous attempts * victim downloaded file but didn't execute it - Victims * 9 Business Services * 7 Financial Services * 5 Manufactoring * ESentire + Threat hunting team + Luring victims to fake pages - Download pages for popular software * LogMeIn * Zoom * TeamViewer * Anydesk - Used ads to get to the top of search results + Detected attack - Fake LogMeIn - Downloaded a windows installer * Profiled the system * Get second stage payload
Samba Vulnerability Can Lead to DoS or RCE * Server Message Block (SMB) + Open-Source Project + Linux and Unix systems * CVE-2022-42898 (CVSS 6.4 out of 10) + Multiple Samba releases + 32-bit systems impacted; 64-bit systems are not vulnerable. + file servers are only impacted if in a non-AD domain + in the Service for User to Proxy (S4U2proxy) handler + affected libraries provide act as an authentication mechanism - by means of tickets that can contain Privilege Attribute Certificates (PACs). - Heimdal and MIT Kerberos libraries + can be triggered by sending a specially crafted request to the KDC server. - Key Distribution Center (KDC) - most vulnerable is the KDC, as it will parse an - attacker-controlled PAC in the S4U2Proxy handler. + suffer from an integer multiplication overflow when calculating how many bytes to allocate for a buffer for the parsed PAC. + Successful exploitation of this bug could lead to a denial-of-service (DoS) condition or possibly remote code execution (RCE). * Remediation + Samba 4.15.12, 4.16.7, and 4.17.3 have been released with patches for this security defect. + Heimdal 7.7.1 also addresses this bug.
RapperBot Targets Game Servers with Modified Brute-Force and DDoS Attacks * RapperBot + IoT botnet + Targets Devices with Architecture - ARM - MIPS - PowerPC - SH4 - SPARC - Checks and halts its self-propagation if the device is running on Intel chipsets. * new capabilities + New Version in early October + perform Telnet brute force - self-propagation + DoS - UDP floods * targeting game servers running + Grand Theft Auto San Andreas: Multi Player (SA:MP) * generic UDP/TCP flood * TCP SYN/ACK flood * GRE IP/Ethernet flood + it downloads and executes the payload - using software already installed on the compromised device * curl * wget * ftpget, * tftp. - If these are not present, * it fetches its own downloader * Downloads the primary payload. + SSH brute-forcing campaign, - Previously retrieved the list of hard-coded plaintext credentials from a C2 server * to gain root access to IoT devices * now these credentials embedded into the malware binary. - successful break-in are reported back to the C2 server
Bullet points of key topics + chapter markers
[00:36] Companies who pay ransomware become targets [10:50] Yanluowang Group Hacked [19:55] Hackers Are Publishing Stolen Abortion Records on the Dark Web [25:06] Fake financial regulators
Bullet points of key topics + chapter markers
[00:36] Hack of IT firm may include health records [09:03] FBI: Hacktivist DDoS attacks had minor impact on critical orgs [15:05] AstraZeneca password lapse exposed patient data [21:26] Hijacker replaces crypto addresses with lookalikes
Links
https://www.bleepingcomputer.com/news/security/new-azov-data-wiper-tries-to-frame-researchers-and-bleepingcomputer
https://thehackernews.com/2022/10/google-issues-urgent-chrome-update-to.html
https://cyware.com/news/new-linkedin-phishing-campaign-bypasses-google-protection-de6f6752
https://thehackernews.com/2022/10/researchers-uncover-stealthy-techniques.html?&web_view=true
Data Wiper Frame Security Researchers
-
Azov Ransomware
-
New data wiper
-
Distributed through the following application types:
-
Pirated software
- Key Generators
-
Adware Bundles
-
Named For
-
Ukrainian Azov Regiment
-
a controversial military force that allegedly associated with neo-Nazi ideology in the past
-
Its goal is to frame security researchers
-
Falsely claims to have been:
-
Hasherazade
- Lawrence Abrams
- Bleeping Computer
- MalwareHunter Team
- Michael Gillespie
-
Vitali Kremez
-
Points to their twitter accounts
-
No way to contact the actors
-
No recovery of files
-
RESTORE_FILES.txt
-
Device is encrypted in protest of seizure of Crimea
-
Though Ukrainian organizations hit by this wiper
-
Western Countries aren’t helping Ukraine enough
- Wants US Citizens to revolt against Biden administrator
- Wants Germany to do the same
-
Ends with hashtag #TaiwanIsChina
-
Smokeloader
-
Malware Botnet
-
Threat actors can buy installs of their malware
-
Azov recently seen utilizing this servcie
-
Sometimes paired with STOP ransomware
-
Which double encrypts the data
-
IOCs
-
Random named file in %Temp%
-
Wiper will copy C:\Windows\System32\msiexec.exe to C:\ProgramData\rdpclient.exe
-
It then patches the file with Azov
-
Can also be configured to start with the following key
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Bandera" = "C:\ProgramData\rdpclient.exe"
-
Scans the computer and encrypts all files except
-
Ini
- Dll
-
Exe
-
Appends the .azov to encrypted files
- Every folder it places the RESTORE_FILES.txt
Chrome Urgent Update
-
Thursday
-
Emergency fix
-
Actively exploited zero-day
-
Update to version
-
107.0.5304.87 (Mac and Linux)
-
107.0.5304.87/88 (Windows)
-
CVE-2022-3723
-
Originally reported October 25, 2022
-
cold fusion flaw
-
V8 JavaScript engine
-
Found by Avast
-
Jan Vojtěšek, Milánek
-
Przemek Gmerek
-
Third cold fusion vulnerability in V8 this year
-
CVE-2022-1096
-
CVE-2022-1364
-
7th Zero Day Fix for Chrome this year
-
CVE-2022-0609 - Use-after-free in Animation
- CVE-2022-1096 - Type confusion in V8
- CVE-2022-1364 - Type confusion in V8
- CVE-2022-2294 - Heap buffer overflow in WebRTC
- CVE-2022-2856 - Insufficient validation of untrusted input in Intents
-
CVE-2022-3075 - Insufficient data validation in Mojo
-
Chromium Browsers
-
Edge
- Brave
- Opera
- Vivaldi
- Patch as soon as a fix is available.
LinkedIN Phishing Campaign Bypass Protections
-
Armorblox
-
Spotted a credential phishing campaign
-
Target 500 mailboxes from a travel organization
-
LinkedIN
-
3rd most impersonated brand
-
Preceded by DHL and Microsoft
-
Sept used LinkedIN smart links to redirector to Slovakia Postal Service
-
Evaded security controls
-
Phishing Message
-
Titled “We noticed some unusual activity”
-
Pretended to be from Linkedin
-
Misspelled Linkedin
-
Domain created on March 6
-
Bypass Security
-
Passes DMARC and SFP
Cranefly’s Stealthy Techniques
-
CraneFly
-
AKA UNC3524
- May 2022
- Focus on bulk email collection
- Companies that deal with mergers and acquisitions
-
Possibly for intel
-
Undocumented Malware
-
New Backdoor program Danfaun
-
Dropped via Geppei (dropper application)
-
Used to install the backdoor and other tools
- Uses the IIS logs for commands that mimic harmless web access requests to a compromised server
-
malicious encoded .ashx files
-
arbitrary folder determined by the command parameter and they run as backdoors
-
Can be used with or instead of reGeorge
-
QUIETEXIT
-
Groups key malware
-
Backdoor application for network appliances
-
No Antivirus or Endpoint Detection
-
Let's them operate undetected for a long time
-
Unsure
-
Symantec has been watching infected machines for 18 months
-
No current exfil of data.
Links https://www.bleepingcomputer.com/news/security/hackers-exploiting-unpatched-rce-bug-in-zimbra-collaboration-suite/?&web_view=true https://thehackernews.com/2022/10/new-report-uncovers-emotets-delivery.html https://thehackernews.com/2022/10/hackers-exploiting-unpatched-rce-flaw.html https://gizmodo.com/toyota-warns-customers-they-may-get-scam-emails-after-d-1849630698 https://www.bleepingcomputer.com/news/security/city-of-tucson-discloses-data-breach-affecting-over-123-000-people/ Emotet’s Current Tactics * Emotet + June 2014 - Appeared as a banking trojan + 2016 - All-purpose malware loaded including ransomware + Jan 2021 - Infrastructure taken down by law enforcement + Currently - Being run by Mummy Spider (TA542) + Tactic - It’s been around because it’s versatile - Uses different attack vectors - Can hide for long periods of time. - Relies on emails with compromised attachments + Currently - VMware said 3 different attacks observed * Excel macro * Excel Macro with Powershell * Visual Basic Application with Powershell * Some used mshta.exe to launch malicious HTA file * ¼ of attacks come in excel documents - LOLBins * Popular tactic + MSHTA and Powershell + Signed by Microsoft + Trusted by Windows * March and June 2022 + Utilizing the Epoch 5 command and control + New plugins - designed to capture credit card data from the Google Chrome browser - a spreader module that uses the SMB protocol for lateral movement - spamming module - account info stealer for Outlook and Thunderbird
Zimbra’s Unpatched RCE Flaw * Active Exploit (CVE-2022-41352) + CVSS 9.8 + Allows malicious actor to upload files and other actions + Part of Zimbra’s antivirus engine + Sept 2022 - No, fix yet - Urge to install the pax utility and restart + If the pax package is not installed, Amavis will fall back to using cpio - will allow an unauthenticated attacker to create and overwrite files on the Zimbra server * including the Zimbra webroot - Versions * 8.15 and 9.0 * Linux Version + Oracle Linux 8 + Red Hat Enterprise Linux 8 + Rocky Linux 8 + CentOS 8 + Exception - Ubuntu * Pax is already installed by default - Tactic * email an archive file (CPIO or TAR) to a susceptible server + which is then inspected by Amavis using the cpio file archiver utility to extract its contents. + cpio has no mode where it can be securely used on untrusted files + an attacker can write to any path on the filesystem that the Zimbra user can access
Toyota Customers prepare for Phishing * Toyota + Customer information leaked - 296,000 pieces of customer information leaked - Toyota Smartphone App + Warned Customers - Risk of Pishing/Spam and emails + Leak - Customers who signed up starting July 2017 * Using emails - Email addresses and customer numbers - No sensitive information * name, Phone Numbers of Credit Cards * Though can be tied together with other leaks online - No current reports of it being used + Contractor - Third-party * Uploaded source code with the data accidentally to a public server * No detected access at this time * Dec 2017 until Sept 2022
City of Tucson discloses data breach * City of Tucson + Data Breach + Personal Information - 123,000 people - names and Social Security numbers, driver's license or state identification number, and passport number + Attack - May 17 and May 31 * May 29 City learned of the malicious activity of user account - Aug 4 * Learned that documents may have been copied - Sept 12 * Review of information concluded and determined the information - Sept 23 * Notification of residents - The attacker breached city’s network - Exfil a large number of files with sensitive information + No detected so far - No use of this information has been detected - 12 months of free access to Experian credit monitoring
Links https://www.cyberscoop.com/patreon-security-team-layoffs/ https://www.pcmag.com/news/patreon-lays-off-its-entire-security-team https://www.linkedin.com/feed/update/urn:li:activity:6973709234702032896/ https://www.engadget.com/uber-investigating-cybersecurity-incident-051250020.html https://www.engadget.com/uber-hack-no-evidence-sensitive-user-data-stolen-193949399.html https://www.bleepingcomputer.com/news/security/uber-hacked-internal-systems-breached-and-vulnerability-reports-stolen/ https://www.esquire.com/entertainment/a41292914/gta-6-leak-videos-rockstar-hacker/ https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser https://www.komando.com/social-media/tiktok-recording-keystrokes/853391/ Patreon Lays Off Its Entire Security Team * September 11th (some confirmation by company on 9/13) + Initial story from Cyberscoop - several former employees have confirmed the layoffs, which occurred the previous week, and that Patreon doesn't seem to be worried about no longer having a security team. - Update numbers confirmed by the company say that it was only five: * Patreon told CyberScoop: “As part of a strategic shift of a portion of our security program, we have parted ways with five employees. The changes made this week will have no impact on our ability to continue providing a secure and safe platform for our creators and patrons - Patreon's Senior VP of Engineering * aid the company isn't "scaling back investing in our security programs" and would be "expanding our investment in security as we continue to grow." - Spokesperson * "more investments mean outside partnerships, engineering expertise we've added in recent months to our infrastructure and payments teams, and the fact that we are hiring heavily in engineering and product development right now." - Emily Metcalfe * One of the members let go said + “So for better or worse, I and the rest of the Patreon Security Team are no longer with the company. As a result I'm looking for a new Security or Privacy Engineering role and would appreciate any connections, advice, or job opportunities from folks in my network. #OpenToWork” + Previously employed Google, Raytheon and the MITRE company * Company Security Teams + Many outsource IT Security (MSSP) + Some IT fills that gap + Many have nothing but wishes + Though not many at Patreon’s level * Is this something to trust? + “As a matter of policy, we can’t share the exact number of Patreon employees working on security but can confirm a majority of Patreon’s internal engineers working on security were not laid off,” * Why? + Even if false companies usually can’t see the outward benefit of security teams. + Kind of like insurance - You don’t really understand what you pay for until something happens?
Uber Hacked * September 16th tweet from Uber_comms + “We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.” + hacker didn't access public-facing systems or user accounts + codebase also remains untouched + did compromise Uber's bug bounty program, any vulnerability reports involved have been "remediated." + contained the hack by limiting compromised accounts, temporarily disabling tools and resetting access to services. + They are utilizing extra monitoring for unusual activity + "no evidence" the perpetrator accessed sensitive user data, such as trip histories * Attribution + Uber said the perpetrator was affiliated with Lapsus$ - they have been targeted tech firms like Microsoft, Samsung and T-Mobile - They will also appear again in our news segments + Tactic - Uber believer it took advantage of a contractor’s computer * Likely bought the contractor's login details on the dark web + after they'd been exposed through a malware-infected computer * Two-factor authentication initially prevented the hacker from getting in + Attacker just kept requesting it for over an hour - MFA Fatigue attacks are when a threat actor has access to corporate login credentials but is blocked from access to the account by multi-factor authentication. They then issue repeated MFA requests to the target until the victims become tired of seeing them and finally accept the notification. + Attacker reported they used whatsapp to pretend to be IT and told them to accept it. + contractor accepted an authentication request * One in added machine as trusted + they logged into the Internal network through the corporate VPN and began scanning the company's Intranet for sensitive information * hacker says they found a PowerShell script containing admin credentials for the company's Thycotic privileged access management (PAM) platform, which was used to access the login secrets for the company's other internal services. * an Uber employee said the threat actor had access to all of the company's private vulnerability submissions on HackerOne * attacker downloaded all vulnerability reports before they lost access to Uber's bug bounty program. + likely includes vulnerability reports that have not been fixed, presenting a severe security risk to Uber.
Rockstar Hacked * Story still unfolding + 18 year old hacker (teapotuberhacker) + allegedly breached Rockstar Games' Slack messages, stealing over 90 videos of GTA6 videos - Not announced yet - Highly Anticipated + Posting the videos to GTAForums - fans got a look at the yet-unshared footage * revealing plot details, location, game mechanics, characters, and just about everything a video game developer would want to keep under wraps - hacker claimed responsibility for a similar security breach to the ride-sharing company Uber just a week prior. - hacker is also reportedly blackmailing Rockstar Games over GTA V and GTA VI's source code * all of the information needed to run the game * anyone could produce a pirated and even modified version of the game. * leak could even hurt future sales of GTA VI * accidentally reveal trade secrets from the game?
TikTok can record what you type * TikTok, like many apps has a built in browser + Some people assume it’s their browser + Having this ability is not out of the ordinary, as it lets you browse and get to the content quickly. + Many other apps use this…and you may not even know. * Researcher Felix Krause + tested seven apps - TikTok - Facebook - Facebook Messenger - Instagram - Snapchat - Amazon - Robinhood + few tracks online activity + only TikTok seemed to monitor keystrokes + Krause explains, this kind of browser tracking is a deliberate action. - “This was an active choice the company made. This is a non-trivial engineering task. This does not happen by mistake or randomly,” + TikTok confirmed to Forbes - the features exist * but allegedly only uses them for “debugging, troubleshooting and performance monitoring. - Protection * Not to use the app * never click on links inside an app you’re using + copy the URL from the link and paste it into your browser + or if you are forced to, open app and then open in browser
Bullet points of key topics + chapter markers [00:36] Magecart’s New JavaScript Skimmer Targets Magento Websites [06:59] Hackers adopt Sliver toolkit as a Cobalt Strike alternative [14:53] Google Chrome emergency update fixes new zero-day used in attacks [23:13] Was TikTok Breached?
Links
https://thehackernews.com/2022/08/hackers-breach-lastpass-developer.html
https://www.bleepingcomputer.com/news/security/nelnet-servicing-breach-exposes-data-of-25m-student-loan-accounts/?&web_view=true
https://www.bleepingcomputer.com/news/security/windows-malware-delays-coinminer-install-by-a-month-to-evade-detection/
https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/?&web_view=true
LastPass Developer System Breached * On Thursday (August 25) email was sent out to LastPass Customers + Confirmed that a security incident occurred - Theft of some source code and technical information + No customer data or encrypted passwords were accessed + The breach occurred two weeks prior - compromised developer account * Customers are safe according to LastPass blog post about this + No action needs to be taken + No vault compromised + No Master Password compromised * Security Hygiene might have said this + Assume the developer system had either anonymized or fake data + Developer account/actual accounts * Mitigation Techniques not shared + Not surprised
Nelnet Servicing breach exposes data of 2.5M student loan accounts * Oklahoma Student Loan Authority (OSLA) and EdFinancial + Data for 2,501,324 million individuals with student loans + hackers breached the systems of technology services provider Nelnet Servicing * Shared Technology + Technology services from Nelnet Servicing - a web portal - give students access to taking out or accessing their loans + EdFinancial states that not all its clients are hosted by Nelnet Servicing - so not all students that took a loan through them are impacted. * Attack + Sometime in June - Stopped on July 22 + Compromised a network through a vulnerability. + August 17th investigation released - Determined certain student loan account registration might have been accessed + The exposed information includes the following: - Full name - Physical address - Email address - Phone number - Social Security Number + no financial account numbers or any form of payment information were exposed * Nelnet Servicing has informed OSLA and EdFinancial + who is notifying their customers. + EdFinancial and OSLA offer impacted individuals free access to a 24-month identity theft protection
Malware delays coinminer install to evade detection * malware campaign + disguised as Google Translate or MP3 downloader + install cryptocurrency mining malware + 11 different countries + distributed through legitimate free software sites + appears clean of malware - provides advertised functionality * CheckPoint + Created by developer named Nitrokod + purposely delays the installation - up to a month to evade detection + rank high in Google Search results - users trust + Google Translate applet was also uploaded on Softpedia - 112,000 downloads * How it works + user receives a password-protected RAR - evades AV detection - contains an executable + the software is installed on the user's system - along with two registry keys + On the 5th day - ‘Wgets’ a dropper from another encrypted RAR - clears all system logs using PowerShell commands + On the 20th day - next encrypted RAR from “intelserviceupdate[.]com. - checks for the presence of antivirus software - processes that might belong to virtual machines - adds a firewall rule and an exclusion to Windows Defender + Finale Step - loads the last dropper * another RAR file + containing the XMRig mining malware * ".sys" file that has its settings. - Determines laptop or desktop - Connects to C2 server * nvidiacenter[.]com * sends a full host system report + via HTTP POST * C2 responds + When to activate + How much CPU to use + C2 check in times + Updated commands
LockBit ransomware gang tries triple-extortion tactic * LockBit ransomware group + Attacked Entrust on June 18 + The company confirmed data had been stolen + Entrust didn’t pay pay - LockBit said it would publish the data on August + Entrust Strikes back - August 19th came and went - DDoS * Believed to be connected to Entrust * Gangs leak site + LockBitSupp - the public-facing figure of the LockBit ransomware - announced that they have a larger infrastructure - “I am looking for dudosers [DDoSers] in the team, most likely now we will attack targets and provide triple extortion, encryption + date leak + dudos, because I have felt the power of dudos and how it invigorates and makes life more interesting,” LockBitSupp wrote in a post on a hacker forum. + Triple Extortion - looking to add DDoS as an extortion tactic - on top of encrypting data and leaking it + Torrents - Share over torrent 300GB of data stolen from Entrust - they would share the Entrust data leak privately with anyone that contacts them before making it available over torrent * LockBit has kept its promise and released this weekend a torrent called “entrust.com” with 343GB of files. * LockBit made sure that the s data is available from multiple sources + they also shared the torrent over at least two file storage services,
Bullet points of key topics + chapter markers [01:31] iPhone Users Update Now to Patch 2 Zero-Days [08:30] Lazarus Group Targets Engineers with Malware [15:44] Hackers Stole from Bitcoin ATMs using Zero-Day [23:25] TA558 Group Targets Hospitality, Hotel and Travel
Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32894 https://threatpost.com/iphone-users-urged-to-update-to-patch-2-zero-days-under-attack/180448/ https://www.forbes.com/sites/kateoflahertyuk/2022/08/19/ios-1561-update-now-warning-issued-to-all-iphone-users/?sh=2a0eccf767a9 https://threatpost.com/apt-lazarus-macos-malware/180426/ https://en.wikipedia.org/wiki/Lazarus_Group https://twitter.com/ESETresearch/status/1559553324998955010 https://threatpost.com/apt-lazarus-macos-malware/180426/ https://thehackernews.com/2022/08/hackers-stole-crypto-from-bitcoin-atms.html Show Notes: iPhone Users Update Now to Patch 2 Zero-Days * Apple is urging macOS, iPhone and iPad users immediately to install respective updates + includes fixes for two zero-days under active attack + vulnerabilities that allow attackers to execute arbitrary code - This can ultimately lead to the full take over of the devices. + Patches - devices running iOS 15.6.1 * Ipads and iphones - macOS Monterey 12.5.1 + CVE-2022-32894 (No CVSS score yet) - One is a kernel bug - Impacts both iOS and macOS - out-of-bounds write issue * Was addressed with improved bounds checking in patches * allows an application to execute arbitrary code with kernel privileges * Apple said “may have been exploited” - CVE-2022-32893 (no CVSS score yet) * WebKit bug + out-of-bounds write issue + addressed with improved bounds checking * allows a maliciously crafted web content to processes code that can lead to code execution * also reported to be under actively exploited * WebKit is the browser engine that powers Safari + Also is an engine that all third-party browsers that work on iOS utilize * Not much known + Apples discloser + Credited to anonymous researcher * Pegasus Fears + nation-state APTs barraged targets with spyware - created by Israeli company NSO Group
Lazarus Group Targets Engineers with Malware * Lazarus + North Korean APT + targeting academics, journalists and professionals in various industries—particularly the defense industry–to gather intelligence and financial backing * targeting engineers + fake job posting - spread macOS malware + macOS malware - identified by researchers at ESET Research Labs - Mac executable - Targets both Apple and Intel chip systems + Operation In(ter)ception - Disguised as a job description * For Coinbase - claiming to seek an engineering manager for product security - researchers discovered uploaded to VirusTotal from Brazil - drops three files * decoy PDF document + pdf + http[://]FinderFontsUpdater[.]app + downloader safarifontagent * like a sample discovered by ESET in May + included a signed executable - disguised as a job description - compiled for both Apple and Intel - dropped a PDF decoy + unlike - recent malware is signed July 21 - something new or a variant of the previous malware + Not only Apple - Windows version - dropping the same decoy - spotted Aug. 4 * Malwarebytes threat intelligence researcher Jazi - connects to a different command and control infrastructure * https:[//]concrecapital[.]com/%user%[.]jpg
Hackers Stole from Bitcoin ATMs using Zero-Day * Bitcoin ATM manufactured by General Bytes + Confirmed that they were a victim of a cyberattack - exploited a previously unknown flaw in the software * steal cryptocurrency from its users - Currently unknown how many servers were impacted or Crypto stolen + Tactic - Threat Actor unknown * Scanned and identified CAS + Ports 7777 or 443 * create an admin user remotely + CAS = Crypto Application Server - Self-hosted product by General Bytes - Allow customers manage Bitcoin ATM machines from a central location + CAS administrative interface - via a URL call on the page that is used for the default installation on the server * creating the first administration user - vulnerability has been present since version December 2020 - modified the crypto settings of two-way machines with their wallet settings * Two-way ATMs started to forward coins to the attacker's wallet when customers sent coins to [the] ATM - Zero Day Flaw * has been mitigated + server patch releases, 20220531.38 and 20220725.22 * company was doing security audits + flaw was never identified * Days after it announced “Help Ukraine” feature on ATMs
TA558 Group Targets Hospitality, Hotel and Travel * Proofpoint tracking group + TA558 + Running since April 2018 + Considered a small crime threat actor - group has used consistent tactics, techniques, and procedures - attempted to install a variety of malware * Loda RAT * Vjw0rm * Revenge RAT - Increased Threat * higher tempo in 2022 * geared towards Portuguese and Spanish speakers in Latin America * to a lesser extent in Western Europe and North America. - Phishing Campaigns * sending malicious spam messages + reservation-themed lures + weaponized URL and Documents + install trojan - recon - data theft - distribution of other malware + in past used macros to deploy - currently pivoting away * in favor of URLs and ISO files to achieve initial infection * most likely due to Microsoft blocking macros announcement - 51 campaigns * 27 of them are said to have incorporated URLs pointing to ISO files and ZIP archives
Bullet points of key topics + chapter markers [00:36] Voicemail Scam Steals Microsoft Credentials [11:35] ToddyCat APT Targets Microsoft Exchange Servers [19:24] Mitel VoIP Bug Exploited in Ransomware Attacks [27:21] FancyBear Uses Nuke Threat to Exploit 1-Click Bug
Links:https://threatpost.com/voicemail-phishing-scam-steals-microsoft-credentials/180005/
https://threatpost.com/elusive-toddycat-apt-targets-microsoft-exchange-servers/180031/
https://itsecuritywire.com/quick-bytes/elusive-toddycat-apt-targets-microsoft-exchange-servers/
https://threatpost.com/mitel-voip-bug-exploited/180079/
https://threatpost.com/fancy-bear-nuke-threat-lure/180056/
Show Notes:
Voicemail Scam Steals Microsoft Credentials
* Attack detected since May
+ targeting a number of key vertical markets in the U.S
- software security, the military, security solution providers, healthcare and pharmaceutical, and the manufacturing supply chain
+ impersonates the organization and Microsoft to lift Office365 and Outlook log-in details.
- still effective but less often used lure to steal credentials
* by sending emails notifying potential victims that they have a voicemail message
* if it isn’t broke, don’t fix it
- Both the emails and the credential-stealing page appear to be coming from legitimate entities
+ How the Attack Works
- one part of the campaign that does set it apart from similar attacks
* more research and effort as the attacks are customized for each target
- victims with an email that informs them that they have a new voicemail in a message that appears to be coming from the targeted organization
* They use an address in the “From” field that mimics the targeted organization’s name as well as logo branding on the mail itself to appear legitimate.
- The messages include an HTML attachment that (red flag)
* when opened redirects the user to a credential-phishing site that also appears to be the real deal by mimicking Microsoft’s own log-in page.
- Attackers use a consistent format for the URLs used in the redirect process
* They include the name of the targeted organization
* the email address of the targeted individual
+ company.theirdomain[.]com/
ToddyCat APT Targets Microsoft Exchange Servers * ToddyCat + An advanced persistent threat (APT) group - relatively new APT - little information about this actor + behind a series of attacks targeting Microsoft Exchange servers of high-profile government and military installations in Asia and Europe. * The campaigns + First Wave: December 2020 and February 2021 + the limited number of servers in Taiwan and Vietnam. + The first wave of attacks exclusively targeted Microsoft Exchange Servers - were compromised with Samurai * Sophisticated passive backdoor that usually works on ports 80 and 443 * was a part of a multi-stage infection chain initiated by the infamous China Chopper and relies on web shells to drop exploits on the selected exchange server in Taiwan and Vietnam - Second Wave: February 2021 and May 2021 * began abusing the ProxyLogon vulnerability to target organizations in multiple countries * added: Iran, India, Malaysia, Slovakia, Russia and the United Kingdom. * Now utilize two passive backdoors within the Exchange Server environment + Samurai and Ninja - Samurai backdoor lays the path to launch another malicious program called Ninja - used by the APT to take complete control of the victim’s hardware * possibly gives them lateral access to network * arbitrary C# code execution and is used with multiple modules that allow the attacker to administrate the remote system and move laterally inside the targeted network - Third Wave: After May 2021, * added military and government organizations + based in Indonesia, Uzbekistan and Kyrgyzstan. * expanded to desktop systems while previously the scope was limited to Microsoft Exchange Servers only. - Attack Sequence * deployment of the China Chopper web shell + allows the dropper to execute and install the components and create multiple registry keys. + forces “svchost” to load a malicious library “iiswmi.dll” + performs its action to invoke the third stage where a “.Net loader” executes and opens the Samurai backdoor. - is hard to detect during the reverse engineering process as it “switch cases to jump between instructions, thus flattening the control flow” and uses obfuscation techniques. + advanced tool Ninja was implemented by Samurai to coordinate and collaborate multiple operators to work simultaneously on the same machine. - allowing an attacker to “control remote systems, avoid detection and penetrate deep inside a targeted network”. + Ninja shares similarities with the other post-exploitation toolkit like Cobalt strike in terms of capabilities and features. - control the HTTP indicators and camouflage malicious traffic in HTTP requests that appear legitimate by modifying HTTP header and URL paths + That’s Not All - China-based hackers are targeting victims of the ToddyCat APT gang within the same time frame. * Chinese-language hackers use an Exchange backdoor called FunnyDream. + researchers observed the same targets compromised by both APTs in three different countries. + in all the cases there was a proximity in the staging locations and in one case they used the same directory * Security researchers do not have any concrete proof that shows the linkage between the two malware families.
Mitel VoIP Bug Exploited in Ransomware Attacks * Ransomware groups are using a novel remote code execution exploit to gain initial access to victim’s environments. + abusing unpatched versions of a Linux-based Mitel VoIP (Voice over Internet Protocol) application + using it as a springboard plant malware on targeted systems. * The critical remote code execution (RCE) flaw, tracked as CVE-2022-29499, + was first report by Crowdstrike in April as a zero-day vulnerability and is now patched. + Mitel released a security advisory on April 19, 2022, for MiVoice Connect versions 19.2 SP3 and earlier. While no official patch has been released yet. + Mitel MiVoice appliances SA 100, SA 400 and Virtual SA * Mitel + Popular known for providing business phone systems and unified communication as a service (UCaaS) * Bug Exploited to Plant Ransomware + The exploit involves two GET requests. The first one targets a “get_url” parameter of a PHP file and the second one originates from the device itself. - “This first request was necessary because the actual vulnerable URL was restricted from receiving requests from external IP addresses,” the researcher explained. - The second request executes the command injection by performing an HTTP GET request to the attacker-controlled infrastructure and runs the stored command on the attacker’s server. + According to the researchers, the adversary uses the flaw to create an SSL-enabled reverse shell via the “mkfifo” command and “openssl_client” to send outbound requests from the compromised network. The “mkfifo” command is used to create a special file specified by the file parameter and can be opened by multiple processes for reading or writing purposes. + Once the reverse shell was established, the attacker created a web shell named “pdf_import.php”. - The original content of the web shell was not recovered but the researchers identifies a log file that includes a POST request to the same IP address that the exploit originated from. + The adversary also downloaded a tunneling tool called “Chisel” onto VoIP appliances to pivot further into the network without getting detected. + Researchers also identified anti-forensic techniques performed by the threat actors to conceal the activity. + “Although the threat actor deleted all files from the VoIP device’s filesystem, CrowdStrike was able to recover forensic data from the device. This included the initial undocumented exploit used to compromise the device, the tools subsequently downloaded by the threat actor to the device, and even evidence of specific anti-forensic measures taken by the threat actor,” said Bennett. * Vulnerable Mitel Devices on Shodan + security researcher Kevin Beaumont shared a string to search for vulnerable Mitel devices on the Shodan search engine in a Twitter thread. + According to Kevin, there are approximately 21,000 publicly accessible Mitel appliances worldwide, the majority of which are located in the United States, seconded by the United Kingdom. * Mitel Mitigation Recommendations + recommends that organizations tighten defense mechanisms by performing threat modeling and identifying malicious activity. + segregating the critical assets and perimeter devices to restrict the access control in case perimeter devices are compromised. + Timely patching is critical to protect perimeter devices. However, when threat actors exploit an undocumented vulnerability, timely patching becomes irrelevant
Fancy Bear Uses Nuke Threat to Exploit 1-Click Bug * Fancy Bear + Russia-linked APT (aka APT28, Strontium and Sofacy) + The group is believed to be operating on the behest of Russian intelligence to gather info that would be useful to the agency. + linked in attacks targeting elections in the United States and Europe, as well as hacks against sporting and anti-doping agencies related to the 2020 Olympic Games. * Attack + pairing a known Microsoft flaw with a malicious document to load malware - that nabs credentials from Chrome, Firefox and Edge browsers. + phishing campaign that uses the specter of nuclear war to exploit a known one-click Microsoft flaw + The attacks by the are tied the Russian and Ukraine war, according to researchers at Malwarebytes Threat Intelligence * Follina (CVE-2022-30190) + first flagged Follina in April, but only in May was it officially identified as a zero-day, one-click exploit. Follina is associated with the Microsoft Support Diagnostic Tool (MSDT) and uses the ms-msdt protocol to load malicious code from Word or other Office documents when they’re opened. + The bug is dangerous for a number of reasons–not the least of which is its wide attack surface, as it basically affects anyone using Microsoft Office on all currently supported versions of Windows. If successfully exploited, attackers can gain user rights to effectively take over a system and install programs, view, change or delete data, or create new accounts. + Microsoft recently patched Follina in its June Patch Tuesday release but it remains under active exploit by threat actors, including known APTs. * On June 20, Malwarebytes researchers first observed the weaponized document + which downloads and executes a .Net stealer first reported by Google. + Google’s Threat Analysis Group (TAG) said Fancy Bear already has used this stealer to target users in the Ukraine. + The Computer Emergency Response Team of Ukraine (CERT-UA) also independently discovered the malicious document used by Fancy Bear in the recent phishing campaign, according to Malwarebytes. * Bear on the Loose + CERT-UA identified Fancy Bear as one of the numerous APTs pummeling Ukraine with cyber-attacks - in parallel with the invasion by Russian troops that began in late February.
- The threat of Nuclear Attack
- campaign targets users with emails carrying a malicious RTF file called “Nuclear Terrorism A Very Real Threat”
- in an attempt to prey on victims’ fears that the invasion of Ukraine will escalate into a nuclear conflict
- The content of the document is an article from the international affairs group Atlantic Council that explores the possibility that Putin will use nuclear weapons in the war in Ukraine.
- The malicious file uses a remote template embedded in the Document.xml.rels file to retrieve a remote HTML file
- http://kitten-268[.]frge[.]io/article[.]html.
- The HTML file then uses a JavaScript call to window.location.href to load and execute an encoded PowerShell script using the ms-msdt MSProtocol URI scheme
- The PowerShell loads the final payload–a variant of the .Net stealer previously identified by Google in other Fancy Bear campaigns in the Ukraine.
- While the oldest variant of the stealer used a fake error message pop-up to distract users from what it was doing, the variant used in the nuclear-themed campaign does not
- The recently seen variant is “almost identical” to the earlier one, “with just a few minor refactors and some additional sleep commands
- The stealer’s main purpose is to steal data
- including website credentials such as username, password and URL–from several popular browsers, including Google Chrome, Microsoft Edge and Firefox.
- The malware then uses the IMAP email protocol to exfiltrate data to its command-and-control server in the same way the earlier variant did but this time to a different domain
- the old variant of this stealer
- connected to mail[.]sartoc.com
- 208.77.68
- new variant
- uses the same method
- different domain
- specialityllc[.]com.
- both are located in Dubai.
- the websites most likely have nothing to do with FuzzyBear
- simply taking advantage of abandoned or vulnerable sites
- the websites most likely have nothing to do with FuzzyBear
- connected to mail[.]sartoc.com
- the old variant of this stealer
- campaign targets users with emails carrying a malicious RTF file called “Nuclear Terrorism A Very Real Threat”
Bullet points of key topics + chapter markers[00:28] Flaws Found in Siemens' Industrial Network Management System[07:12] Researchers Uncover 'Hermit' Android Spyware[15:21] Facebook Messenger Scam Duped Millions[21:01] Linux Malware Deemed ‘Nearly Impossible’ to Detect
Linkshttps://thehackernews.com/2022/06/over-dozen-flaws-found-in-siemens.htmlhttps://thehackernews.com/2022/06/researchers-uncover-hermit-android.htmlhttps://threatpost.com/acebook-messenger-scam/179977/https://threatpost.com/linux-malware-impossible-detect/179944/
Flaws Found in Siemens' Industrial Network Management System * Cybersecurity researchers have disclosed details about 15 security flaws in Siemens SINEC network management system (NMS) + SINEC is in a powerful central position within the network topology because it requires access to the credentials and cryptographic keys - Because it manages devices on the network + could be chained by an attacker to achieve remote code execution + pose several risks to Siemens devices on the network - denial-of-service attacks - credential leaks - remote code execution * with System Privileges * tracked from CVE-2021-33722 through CVE-2021-33736 + addressed in version V1.0 SP2 Update 1 - October 12, 2021. * Key one CVE-2021-33723 (CVSS score: 8.8) + which allows for privilege escalation to an administrator account - combined with CVE-2021-33722 (CVSS score: 7.2) * a path traversal flaw - to execute arbitrary code remotely * notable CVE-2021-33729, CVSS score: 8.8 + a case of SQL injection + that could be exploited by an authenticated attacker to execute arbitrary commands in the local database. * attacker's perspective + they have legitimate credentials and network tools they can abuse to carry out malicious activity, access to, and control + give the ability to do reconnaissance, lateral movement, and privilege escalation
Researchers Uncover 'Hermit' Android Spyware * An enterprise-grade surveillanceware dubbed Hermit + has seen increased use by entities operating from within Kazakhstan, Syria, and Italy over - since 2019, new research has revealed. - target both Android and iOS + engineered to abuse its permissions to accessibility services and other core components of the operating system (i.e., contacts, camera, calendar, clipboard, etc.) for most of its malicious activities. * Hermit is modular + capabilities that allow it to - exploit a rooted device - record audio - make and redirect phone calls - collect data * call logs * contacts * photos * device location * SMS messages * distributed via SMS messages + trick users into installing apps - from Samsung, Vivo, and Oppo - which, when opened loads a website from the impersonated company while stealthily working in the background.
Facebook Messenger Scam Duped Millions * phishing messages sent via Facebook Messenger + estimated to have tricked 10 million Facebook users and counting. + a scam that cons users into handing over their account credentials. * still active + push victims to a fake Facebook login page + where victims are enticed to submit their Facebook credentials. + the campaign began last year and ramped up in September. * Researchers PIXM Security + tied to a single person located in Colombia. - a single individual is because each message links back to code “signed” with a reference to a personal website. - Researchers state the individual went so far as to respond to researcher inquiries. * claimed to make $150 for every thousand visits * PIXM put this threat actor’s projected revenue at $59M from Q4 2021 to the present. + able to access the hacker’s own pages for tracking the campaigns. The data indicated that nearly 2.8 million people fell for the scam in 2021 and 8.5 million have so far this year. * How the Scam Worked + centers around a fake Facebook login page. - copies Facebook’s user interface closely. + victim enters their credentials and clicks “Log In,” - those credentials are sent to the attacker’s server. * the threat actor would login to that account and send the link to the user’s Friends via Facebook Messenger.” + victims are redirected to pages with advertisements - which also included surveys * generate referral revenue for the attacker * The Scam Bypassed Security + managed to circumvent the social media platform’s security checks by utilizing a technique that Facebook didn’t catch + victim clicks on a malicious link in Messenger - the browser initiates a chain of redirects. - The first redirect points to a legitimate “app deployment” service. - Then they will be redirected to the actual phishing page. - To Facebook, it’s a link generated using a legitimate service that Facebook could not outright block without blocking legitimate apps and links as well. * Even if Facebook caught on to and blocked any one of these illegitimate domains, it was trivial to spin up a new link using the same service, with a new unique ID.
Linux Malware Deemed ‘Nearly Impossible’ to Detect * Symbiote + new Linux malware that’s “nearly impossible to detect” + target the financial sector in Latin America + can harvest credentials + gives attackers remote access + rootkit functionality * Researchers from The BlackBerry Research and Intelligence Team + the earliest detection of which is from November 2021 * “What makes Symbiote different + it needs to infect other running processes to inflict damage + Instead of being a standalone executable file that is run to infect a machine, it is a shared object (SO) library that is loaded into all running processes using LD_PRELOAD (T1574.006), and parasitically infects the machine + Once it has infected all the running processes - a threat actor can engage in various nefarious activities, including rootkit functionality, the ability to harvest credentials, and remote access capability - the malware also provides a backdoor for the threat actor to log in as any user on the machine with a hardcoded password, and to execute commands with the highest privileges * Evasive Maneuvers + It’s also highly evasive to such a degree that it’s likely to fly under the radar - it is loaded by the linker via the LD_PRELOAD directive * allows it to be loaded before any other shared objects * being loaded first allows it to hijack the imports from the other library files loaded for the application, * this way, it hides its presence on the machine by hooking libc and libpcap functions + making it extremely difficult to know if it’s even being used by threat actors at all + it hides itself and any other malware used by the threat actor + Performing live forensics on an infected machine may not turn anything up since all the file, processes, and network artifacts are hidden by the malware.” * Unusual DNS requests + maybe one way to detect if the malware is present on a system + antivirus or other security tools aimed at endpoint detection and response won’t pick up * Objectives + key objectives are to capture credentials and to facilitate backdoor access to infected machines + For credential harvesting - if an ssh or SCP process is calling * the function, it captures the credentials, which are first encrypted with RC4 using an embedded key and then written to a file + Attackers not only steal the credentials locally for access but also exfiltrate them by hex encoding and chunking up the data to be sent via DNS address record requests to a domain name that they control * Malicious actors gain remote access to an infected machine + the malware hooks a few Linux Pluggable Authentication Module (PAM) functions, which allows it to authenticate to the machine with any service that uses PAM - including remote services such as Secure Shell (SSH) - When a service tries to use PAM to authenticate a user, the malware checks the provided password against a hardcoded password, - If the password provided is a match, the hooked function returns a success response.” - Once the threat actor has accomplished authentication, Symbiote allows for an attacker to gain root privileges by scanning the environment for the variable HTTP_SETTHIS variable is set with content, the malware changes the effective user and group ID to the root user, and then clears the variable before executing the content via the system command
Bullet points of key topics + chapter markers[00:36] HelloXD Ransomware Installing Backdoor on Targeted Windows and Linux Systems[07:20] Iranian Hackers Spotted Using a new DNS Hijacking Malware in Recent Attacks[13:10] Chinese Hackers Distribute Backdoored Wallets for iOS and Android Users[19:57] New Botnets Target Critical Vulnerability in Confluence Servers
Linkshttps://unit42.paloaltonetworks.com/helloxd-ransomware/https://thehackernews.com/2022/06/hello-xd-ransomware-installing-backdoor.htmlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoorhttps://thehackernews.com/2022/06/iranian-hackers-spotted-using-new-dns.htmlhttps://thehackernews.com/2022/06/chinese-hackers-distribute-backdoored.html?&web_view=truehttps://cyware.com/news/new-botnets-target-critical-vulnerability-in-confluence-servers-9b210f41https://cyware.com/research-and-analysis/patch-now-atlassian-confluence-vulnerability-cve-2021-26084-advisory-e7bahttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134
HelloXD Ransomware Installing Backdoor on Targeted Windows and Linux Systems * HelloXD + surfaced in the wild on November 30, 2021 + deploys a backdoor for persistence + impacting Windows and Linux systems + code based off of Babuk * Double Extortion Group + demand cryptocurrency payments by exfiltrating a victim's sensitive data in addition to encrypting it and threatening to publicize the information. + doesn’t have an active leak site + negotiations through TOX chat and onion-based messenger instances * MicroBackdoor + open-source malware + used for command-and-control + developer says - "really minimalistic thing with all of the basic features in less than 5,000 lines of code." + Capabilities - browse the file system - upload and download files - execute commands - erase evidence + researchers suspected that the deployed - to monitor the progress of the ransomware. * Palo Alto Networks Unit 42 + linked to a likely Russian developer - online aliases x4k, L4ckyguy, unKn0wn, unk0w, _unkn0wn, and x4km * CyberWar Angle + different variants of the implant were adopted by the Belarusian threat actor dubbed Ghostwriter - against Ukrainian state organizations in March 2022
Iranian Hackers Spotted Using a new DNS Hijacking Malware in Recent Attacks * Lyceum + AKA: Hexane, Spirlin, or Siamesekitten + Iranian state-sponsored threat actor + known for targeting the Middle East and Africa + new custom .NET-based backdoor - DNS Backdoor * customized version of the open-source tool 'DIG.net * DNS Attack + DNS Hijacking - Redirection Attack - attacker-controlled DNS server - manipulates the response of DNS queries - resolves them as per their malicious requirements. * Attack + macro-laced Microsoft Document - "news-spot[.]live * Pretends to be a real news site - Report about Iran’s Drone Strikes + Upon accepting Macro - drops the implant to the Windows Startup folder * to establish persistence - ensure it automatically runs every time the system is restarted. - Point DNS traffic to their malicious domain server * cyberclub[.]one * command-and-control (C2) communications to evade detection - It can upload and download files to and from the remote server - execute malicious system commands
Chinese Hackers Distribute Backdoored Wallets for iOS and Android Users * SeaFlower + a technically sophisticated threat actor + discovered in March 2022 + “hint[s] to a strong relationship with a Chinese-speaking entity yet to be uncovered” - based on the macOS usernames - source code comments in the backdoor code - its abuse of Alibaba's Content Delivery Network (CDN) * targeting Android and iOS users + mimics official cryptocurrency wallet websites - distribute backdoored apps - to drain victims' funds. * By exfil the seed phrase * Targeted Apps Include + Coinbase Wallet + MetaMask + TokenPocket + imToken * Attack Vector + setting up cloned websites + leverages SEO poisoning techniques + act as a conduit to download trojanized versions of the wallet apps - virtually unchanged from their original counterparts except for the addition of new code designed to exfiltrate the seed phrase to a remote domain + target iOS users by means of provisioning profiles that enable the apps to be sideloaded onto the devices.
New Botnets Target Critical Vulnerability in Confluence Servers * the exploitation of the flaw CVE-2021-26084 (9.8/10) + Confluence Server and Data Center + unauthorized attackers to: - create new admin accounts, run commands, and take over the server remotely to backdoor publicly exposed servers. * Last week zero-day (CVE-2022-26134) + Atlassian Confluence by Volexity + Remote Code Execution Vulnerability + Just one day after being disclosed publicly, the flaw was actively abused and Atlassian released security updates. Further, advised patching installations to prevent ongoing attacks. + CISA ordered federal agencies to restrict all internet traffic to Confluence servers on their networks. * Botnets + Kinsing, Hezb, and Dark[.]IoT - targeting exposed Linux servers * deliver backdoors and crypto miners.
Bullet points of key topics + chapter markers
[00:36] State-Backed Hackers Exploit 'Follina' to Target Entities in Europe and U.S
[06:06] Global Law Enforcement Operation Shuts Down FluBot
[11:16] SideWinder APT Launched More than 1,000 Attacks in Two Years
[17:50] Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones
Links
https://thehackernews.com/2022/06/state-backed-hackers-exploit-microsoft.html https://blog.0patch.com/2022/06/free-micropatches-for-follina-microsoft.html https://cyware.com/news/global-law-enforcement-operation-shuts-down-flubot-6dedb412 https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-Shabab-SideWinderUncoilsToStrike.pdf https://cyware.com/news/sidewinder-launched-more-than-1000-attacks-in-two-years-1244cd6e https://thehackernews.com/2022/06/flubot-android-spyware-taken-down-by.html https://thehackernews.com/2022/06/critical-unisoc-chip-vulnerability.html https://threatpost.com/follina-exploited-by-state-sponsored-hackers/179890/
State-Backed Hackers Exploit 'Follina' to Target Entities in Europe and U.S * Talked about this on May 31, 2022, Show + “Follina” - Word's external link to load the HTML and then uses the 'ms-msdt' scheme to execute PowerShell code + CVE-2022-30190 - CVSS score: 7.8) * a suspected state-aligned threat actor + target government entities in Europe and the U.S + New Phishing campaign not linked to previous ATP actors - Nation-State thought because of the sophisticated recon capabilities - Proofpoint said * “The extensive reconnaissance conducted by the second PowerShell script demonstrates an actor interested in a large variety of software on a target's computer. This, coupled with the tight targeting of European government and local U.S. governments, led us to suspect this campaign has a state-aligned nexus” * Proofpoint + blocked attempts at exploiting the remote code execution flaw + No less than 1,000 phishing messages containing a lure document were sent to the targets * Attack + masqueraded as a salary increase + RTF Document + payload downloaded from 45[.]76[.]53[.]253 - Runs a PowerShell that downloads 2nd PowerShell * seller-notification[.]live - checks for virtualization - steals information from local browsers, mail clients, and file services - conducts machine recon - zips it for exfil * 45[.]77[.]156[.]179 * No Fix Yet + 0patch has released an unofficial fix - Link in show notes - "It doesn't matter which version of Office you have installed, or if you have Office installed at all: the vulnerability could also be exploited through other attack vectors," 0patch said
Global Law Enforcement Operation Shuts Down FluBot * Europol + Takedown of FluBot - the fastest growing Android malware operation * Due to using a contact list of compromised devices to send SMS - infamous for stealing banking and cryptocurrency account credentials + law enforcement operations across 11 countries - Sweden, Australia, the Netherlands, Belgium, Hungary, Ireland, Spain, Switzerland, Finland, and the U.S - Dutch Police claimed to have disconnected 10,000 victims from the FluBot network and stopped over 6.5 million spam SMS from reaching potential victims. - pinpointing the bot’s most critical infrastructure - Spanish police arrested four suspects who were then considered the main members of the FluBot operation + its infrastructure is under the control of law enforcement - Making a comeback unlikely
SideWinder APT Launched More than 1,000 Attacks in Two Years * Aggressive APT group + launched more than 1,000 attacks - Since April 2020 * targeted multiple industries + scientific and defense organizations + departments of foreign affairs + IT industry + legal firms + aviation. * large C2 infrastructure comprising more than 400 domains and subdomains + host malicious payloads and manage them + The first stage domains are used to host the first stage malware that spread via spear-phishing. - They further receive information gathered by first-stage malware domains and host second-stage payloads. + To evade detection, the group uses obfuscation routines, multi-layer malware, encryption with unique keys for each malicious file, splitting infrastructure strings into different malware components, and memory-resident malware. + C2 domains used in the final stage of the attacks and URLs used for C2 communications are split into two parts: - The Installer module includes the first part of the URL, which is a C2 server domain name in encrypted form. - The second half of the URL is encrypted inside the second stage HTA module.
Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones * A critical security flaw has been uncovered in UNISOC's smartphone chipset + potentially weaponized to disrupt a smartphone's radio communications - through a malformed packet. * Check Point + The vulnerability is in the modem firmware, not in the Android OS itself. * UNISOC + semiconductor company based in Shanghai + 4th largest mobile processor manufacturer + 10% of all shipments in 2021 * CVE 2022-20210 (CVSS 9.4/10) + Patch Available + a case of buffer overflow - the component that handles Non-Access Stratum (NAS) messages - in the modem firmware - causes a Denial of Service + Mitigation - recommended that users update their Android devices to Security update for June 2022. * Not the First Time + CVE-2022-27250, CVSS score: 9.8 + malicious actors to take control over user data and device functionality
Ransomware demands acts of kindness to get your files back, Microsoft Office zero-day leaves researchers scrambling, Attackers Can Use Electromagnetic Signals to Control Touchscreens Remotely, Experts Warn of the rise in ChromeLoader Malware Hijacking Users' Browsers
Bullet points of key topics + chapter markers[00:36] Ransomware demands acts of kindness to get your files back[09:05] Microsoft Office zero-day leaves researchers scrambling[13:46] Attackers Can Use Electromagnetic Signals to Control Touchscreens Remotely[18:32] Experts Warn of the rise in ChromeLoader Malware Hijacking Users' Browsers
Links
Links
https://www.tripwire.com/state-of-security/security-data-protection/ransomware-demands-acts-of-kindness-to-get-your-files-back/
https://www.cybersecuritydive.com/news/microsoft-office-zero-day/624604/
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://thehackernews.com/2022/05/attackers-can-use-electromagnetic.html
https://thehackernews.com/2022/05/experts-warn-of-rise-in-chromeloader.html
NOTES
Ransomware demands acts of kindness to get your files back * GoodWill ransomware + security firm CloudSEK + isn’t interested in extorting money + to do something good for the world * Usual Tactic + encrypts the usual file types - documents - databases - photographs - videos + Does not charge money for decryption key - Wants you do do something good * provide some video proof * Lock Screen + Our Aim The word “GoodWill” means to show kindness Story:- Team GoodWill is not hungry of Money and Wealth but kindness. We want to make every person on the planet to be kind and wants to give them a hard lesson to always help poor and needy people. So, all our victims need to be gentle and kind to get their files back. We know that you are very excited for the play. Take Deep breath and look all around for those who need help? You! No way, the only way to help yourself is to help others hope you understand * multi-page ransom note + three acts of goodwill - The first request is for you to donate new clothes and blankets to the homeless. Victims are told to make a video of them giving assistance to people sleeping rough, and to post it on their Facebook, Instagram, and WhatsApp to encourage others to help those in need. - The second requested act involves taking five poor children (under the age of 13) to Dominos, Pizza Hut, or KFC, and allowing them to order any food that they wish. * “Take some Selfies of them full of smiles and happy faces, Make a beautiful video story on this whole event and again post it on your Facebook and Instagram Stories with a photo frame and caption provided by us. Take a screenshot of your posts, snap of the restaurant’s bill and send an email to us with a valid post link, later our team will verify the whole case and promotes you for the next activity. Help those less fortunate than you, for it is real human existence.” - The final requested act of goodwill involves providing financial assistance to those who need urgent medical assistance, but cannot afford to pay for it themselves * Visit the nearest hospital in your area and observe the crowd around you inside the hospital premises. You will see that there will be some people who need a certain amount of money urgently for their medical treatment, but they are unable to arrange it due to any reason. You have to go near them and talk to them that they have been supported by you and they do not need to worry now, Finally Provide them maximum part of the required amount. Again, Take some Selfies of them full of smiles and happy faces, Record Audio while whole conversation between you and them and send it to us. * if you provide convincing evidence that you have done the good acts + they will provide a decryption tool - with key and video tutorial
Microsoft Office zero day leaves researchers scrambling * Dubbed “Follina” + Was discover on May 27th by Nao_Sec + CVE-2022-30190 + all versions of Office 365 files when using an .RTF file * The attack can exploit the vector using Microsoft Office documents to open a Microsoft Diagnostics Tool (MSDT) file handler + After using phishing or social engineering to get users to open an attached file, an attacker could gain persistent access, move laterally and escalate user privileges to access inside of a system. + used the external link in Word to load HTML and then executed a PowerShell code using “ms-msdt,” * Microsoft issued guidance on the vulnerability + can install programs, view, change or delete data or create new accounts in the context allowed by the user’s rights + No known patch so far + suggested disabling MSDT URL + Customers with Microsoft Defender Antivirus should turn on cloud-delivered protection and automatic-sample submission, Microsoft said. They use artificial intelligence and machine learning to identify and stop new and unknown threats, according to the company.
Attackers Can Use Electromagnetic Signals to Control Touchscreens Remotely * Called “GhostTouch” + Researchers have demonstrated + what they call the "first active contactless attack against capacitive touchscreens." + "uses electromagnetic interference (EMI) to inject fake touchpoints into a touchscreen without the need to physically touch it," * The idea is to take advantage of the electromagnetic signals to execute basic touch events + Like taps and swipes - into targeted locations of the touchscreen + works from a distance of up to 40mm * relies on the fact that capacitive touchscreens are sensitive to EMI * The attack involves an electrostatic gun + to generate a strong pulse signal that's then sent to an antenna to transmit + uses the electromagnetic field on the phone's touchscreen, + causes the electrodes - which act as antennas themselves - to pick up the EMI and treat it as a touch + by tweaking the signal and the antenna to induce a variety of touch behaviors, such as press and hold and swipe to select * "In places like a cafe, library, meeting room, or conference lobbies, people might place their smartphone face-down on the table," the researchers said. "An attacker may embed the attacking equipment under the table and launch attacks remotely." * Tested nine different smartphone models have been found vulnerable to GhostTouch, + Galaxy A10s + Huawei P30 Lite + Honor View 10 + Galaxy S20 FE 5G + Nexus 5X + Redmi Note 9S + Nokia 7.2 + Redmi 8 + iPhone SE (2020) * Defense + researchers recommend adding electromagnetic shielding to block EMI + prompting users to enter the phone's PIN or verify their faces or fingerprints prior to executing high-risk actions.
Experts warn of the rise in ChromeLoader Malware Hijacking Users' Browsers * ChromeLoader + is a rogue Chrome browser extension - typically distributed in the form of ISO files via pay-per-install sites - baited social media posts that advertise QR codes to cracked video games and pirated movies. - the purpose is to get revenue via unsolicited advertisements and search engine hijacking - detected a macOS version of the malware that works against both Chrome and Safari browsers + The malvertising threat is witnessing a new surge in activity since its emergence earlier this year. + pervasive and persistent browser hijacker that modifies its victims' browser settings and redirects user traffic to advertisement websites * primarily functions + hijacking user search queries to Google, Yahoo, and Bing and redirecting traffic to an advertising site + uses PowerShell to inject itself into the browser and get the extension added. * Trick up it sleeve + is its ability to redirect victims away from the Chrome extensions page ("chrome://extensions") should they attempt to remove the add-on.
Malware Campaign Targets InfoSec Community, Vulnerabilities found in Bluetooth gives hackers access to numerous devices, Hackers Gain Fileless Persistence SQL Servers Using a Built-in Utility, Bank refuses to pay ransom to hackers, sends spicy pics instead
Bullet points of key topics + chapter markers[00:36] Malware Campaign Targets InfoSec Community[06:41] Vulnerabilities found in Bluetooth gives hackers access to numerous devices[12:40] Hackers Gain Fileless Persistence SQL Servers Using a Built-in Utility[16:33] Bank refuses to pay ransom to hackers, sends spicy pics instead
LINKS:
https://twitter.com/haxor31337/status/1527182890869530624?s=20&t=DXYztU2EQgqQlS9PRFMDzg
https://blog.cyble.com/2022/05/20/malware-campaign-targets-infosec-community-threat-actor-uses-fake-proof-of-concept-to-deliver-cobalt-strike-beacon/
https://thehackernews.com/2022/05/hackers-gain-fileless-persistence-on.html
https://grahamcluley.com/bank-refuses-to-pay-ransom-to-hackers-sends-dick-pics-instead/
https://www.bleepingcomputer.com/news/security/national-bank-hit-by-ransomware-trolls-hackers-with-dick-pics/
https://www.techrepublic.com/article/vulnerabilities-found-in-bluetooth-low-energy-gives-hackers-access-to-numerous-devices/
US college forced to close after cyberattack, Conti Ransomware Attack Spurs State of Emergency in Costa Rica, $7 to rent DCRat to backdoor your network, ‘Nerbian’ Trojan Uses Advanced Anti-Detection Tricks
Bullet points of key topics + chapter markers[00:36] US college forced to close after cyberattack[06:39] Conti Ransomware Attack Spurs State of Emergency in Costa Rica[12:19] 7 to rent DCRat to backdoor your network[18:55] ‘Nerbian’ Trojan Uses Advanced Anti-Detection Tricks
Links
https://www.nbcnews.com/tech/security/ransomware-attack-covid-combine-shutter-illinois-college-rcna24905
https://www.tweaktown.com/news/86082/us-college-forced-to-close-after-cyberattack-posts-goodbye-note/index.html
https://threatpost.com/conti-ransomware-attack-emergency-costa-rica/179560/
https://www.theregister.com/2022/05/09/budgetfriendly_dcrat_malware/
https://threatpost.com/conti-ransomware-attack-emergency-costa-rica/179560/
https://threatpost.com/nerbian-rat-advanced-trick/179600/
NOTES
US college forced to close after cyberattack * Lincoln College + a liberal-arts school from rural Illinois + predominantly Black institution + is closed on May 13th 2022 + 157 years in operations + 1 -2 punch on its finances - COVID-19 - Ransomware Attack + survived multiple disasters - including a major fire in 1912 - the Spanish flu - the Great Depression - Both World Wars - 2008 global financial crisis * December ransomware attack + Straw that broke the institution + one of more than 1,000 other schools hit by ransomware last year + blocked the college from accessing data used in its student recruitment and retention and fundraising efforts
Conti Ransomware Attack Spurs State of Emergency in Costa Rica * President Rodrigo Chaves + declared a state of national cybersecurity emergency last week + following a financially motivated Conti ransomware attack against his administration + the state of emergency was one of his first decrees as president + Other agencies impacted - the Ministry of Labor and Social Security - the Ministry of Science, Innovation, Technology and Telecommunications - the National Meteorological Institute - the entire scope of the damage is not known. + Attributed to Conti - demanded a ransom of $10 million - So, they wouldn’t release stolen information from the Ministry of Finance - Russian-speaking ransomware group - most ruthless gangs * take-no-prisoners approach * double extortion + which attackers threaten to expose stolen data or use it for future attacks if victims don’t pay by a deadline * targeting organizations for which attacks could have life-threatening consequences, such as hospitals, emergency number dispatch carriers, emergency medical services and law-enforcement agencies. + Costa Rica so far has declined to pay - Conti updating its data-leak site on Monday with 97 percent of the 672 GB of data that the group claims contains information stolen from Costa Rican government agencies
$7 to rent DCRat to backdoor your network * How much does a RAT Cost + Remote Access Trojan * budget-friendly RAT + under active development + selling on underground Russian forums - $7 for a two-month subscription * backdoor Windows malware + DCRat or DarkCrystal RAT + Originally released in 2018 + redesigned and relaunched 2019 + loan programmer works to improve it daily. - The administrator tool and the backdoor/client are regularly updated with bug fixes and new features; the same applies to officially released plugins * modular architecture and plugin framework + espionage + data theft + distributed denial of service attacks + dynamic code execution - several different languages + Three Components - A client executable written in .NET that can steal data - A single PHP page that interfaces with the RAT's backend command-and-control (C2) server - An administration tool * DCRat administrator tool + written in JPHP - which is rare, because it produces very large, slow executables - It also has a kill switch, that, if flipped, renders all instances of the administrator tool unusable. + once the subscription validation checks are completed - the malware subscriber can use the administrator tool to communicate with the command-and-control server - configure builds of the client executable - submit bug reports to the DCRat author. * entire bundle + along with plugins + plugin development framework + other tools + hosted on crystalfiles[.]ru - they were located at dcrat[.]ru * Updates are announced via a Telegram channel + which has about 3,000 subscribers. * Pricing + 500 RUB (about $7 at time of writing) for two-month license + 2200 RUB ($31) for a year + 4200 RUB ($60) for a lifetime license * Both the product's low price, plus the author's use of JPHP indicate "a novice malware author who hasn't yet figured out an appropriate pricing structure
‘Nerbian’ Trojan Uses Advanced Anti-Detection Tricks * newly discovered remote access trojan (RAT) is spreading + via malicious email campaigns using COVID-19 lures - includes numerous features to evade analysis + The emails claimed to be World Health Organization (WHO) - important information regarding COVID-19, * throwback to similar phishing campaigns that circulated in 2020 in the early days of the pandemic. + Use email like: who.inter.svc@gmail[.]com and announce@who-international[.]com, - use as their subject line WHO or World Health Organization. - include safety measures related to COVID-19 as well as attachments * that also include “covid19” in their names + Word documents containing malicious macros. - macros are enabled * the document reveals information relating to COVID-19 safety, specifically about self-isolation and caring for individuals with COVID-19. * Macros-enablement also spurs the document to execute an embedded macro that drops a file that performs a PowerShell process to drop the Nerbian RAT dropper in a 64-bit executable file called UpdateUAV.exe written in Go * Dubbed Nerbian RAT + Written in the OS-agnostic Go programming language + utilizes significant anti-analysis and anti-reversing capabilities + Name is based on a named function in the malware code - Appears to be derived from “Nerbia,” - a fictional place from the novel Don Quixote * first observed the RAT + being distributed in a low-volume email campaign beginning on April 26 - messages sent to multiple industries * mainly located in Italy, Spain and the United Kingdom * Go + becoming an increasingly popular language used by threat actors + likely due to its lower barrier to entry and ease of use * Nerbian Complexity + leverages multiple anti-analysis components spread across several stages - including multiple open-source libraries + the malware shows sophistication - working in three distinct phases - starts with the malicious document spread via phishing - then moves on to the UpdateUAV.exe dropper * The dropper performs various environment scans + anti-reversing + anti-VM checks + then executing the Nerbian RAT. * the RAT itself is executed via an encrypted configuration file + uses extreme caution to ensure data to command-and-control (C&C) is encrypted - senda it over Secure Sockets Layer (SSL) * to evade inspection by network-scanning tools + other RAT things - keylogging * stores keystrokes in encrypted file - screen capture * works across all OS platforms. * Extreme Vetting + dropper performs an extensive vetting of the compromised host + will stop execution if it encounters any conditions it doesn’t like - the size of the hard disk on the system is less than a certain size * i.e., 100GB - the name of the hard disk, according to WMI * contains “virtual,” “vbox” or “vmware;” - MAC address queried returns certain OUI values - several reverse engineering/debugging/ memory analysis/memory tampering programsare encountered in the process list * DumpIt.exe * RAMMap.exe or RAMMap64.exe * vmmap.exe
if the amount of time elapsed execution specific functions is deemed “excessive”—which would suggest debugging–by a time measurement function present in the dropper.
Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability, USB-based Wormable Malware Targets Windows Installer, Attackers Use Event Logs to Hide Fileless Malware, Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk
Bullet points of key topics + chapter markers[00:32] Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability[04:11] USB-based Wormable Malware Targets Windows Installer[10:25] Attackers Use Event Logs to Hide Fileless Malware[17:26] Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk
LINKS
https://thehackernews.com/2022/05/researchers-develop-rce-exploit-for.html
https://threatpost.com/usb-malware-targets-windows-installer/179521/
https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/
https://threatpost.com/dns-bug-millions-routers-iot-risk/179478/
NOTES
Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability * CVE-2022-1388 (CVSS score: 9.8) + relates to an iControl REST authentication bypass + successfully exploited - leads to an opportunity for remote code execution - allowing an attacker to gain initial access and take control of an affected system. * deploying cryptocurrency miners * dropping web shells * impacted versions of BIG-IP products + 16.1.0 - 16.1.2 + 15.1.0 - 15.1.5 + 14.1.0 - 14.1.4 + 13.1.0 - 13.1.4 - Danger * 12.1.0 - 12.1.6 * 11.6.1 - 11.6.5 + will not receive security updates + should consider upgrading to a newer version or apply the workarounds - Block iControl REST access through the self IP address - Block iControl REST access through the management interface, and - Modify the BIG-IP httpd configuration * Security researcher Kevin Beaumont has warned of active exploitation attempts detected in the wild, while simultaneously alerting the availability of a public proof-of-concept (PoC) for the code execution flaw.
USB-based Wormable Malware Targets Windows Installer * Wormable malware dubbed Raspberry Robin + active since September + but most activity seen since January + uses USB drives to get onto Windows machines - then uses Microsoft Standard Installer - legitimate processes to install malicious files * Attack + The worm appears as a shortcut LNK file masquerading as a legitimate folder on the infected USB device + The worm updates the UserAssist registry entry and records the execution of a ROT13-ciphered value referencing an LNK file when deciphered - Example: researchers observed the value q:\CSNB.yax being deciphered to d:\recovery.lnk + It uses cmd.exe to read and execute a file stored on the infected external drive + cmd.exe typically launches explorer.exe and msiexec.exe - extensively uses mixed-case letters in its commands,” most likely to avoid detection + msiexec.exe , to attempt external network communication to a malicious domain for command and control purposes - launch a legitimate Windows utility, fodhelper.exe, which in turn spawns rundll32.exe to execute a malicious command - elevated administrative privileges without requiring a User Account Control prompt + Once the worm spreads via a USB drive to someone’s machine - msiexec.exe to call out to its infrastructure * often comprised of QNAP devices * uses HTTP requests that contain a victim’s user and device names * use TOR exit nodes as additional command and control (C&C) infrastructure - Eventually installs malicious dynamic link library (DLL) files found on the infected USB. + Researchers have not yet figured out how or where Raspberry Robin infects external drives + They also don’t know why Raspberry Robin installs a malicious DLL - believe it may be to attempt to establish persistence on an infected system * though there is not enough evidence to make this conclusive + Unknown Threat Actor Group
Attackers Use Event Logs to Hide Fileless Malware * malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines + technique involves injecting shellcode directly into Windows event logs - allows adversaries to use the Windows event logs as a cover for malicious late stage trojans + attackers use - a series of injection tools and anti-detection techniques to deliver the malware payload. - At least two commercial products - plus several types of last-stage RAT and anti-detection wrappers - advanced tactics + the most innovative part of this campaign * First seen in February + Activity has been increasing during the last month. + Unattributed currently + New code not seen before * Attack Method + drive targets to a legitimate website - enticing the target to download a compressed .RAR file * boobytrapped with Cobalt Strike and SilentBreak + vehicle for delivering shellcode + separate anti-detection AES decryptors * the digital certificate for the Cobalt Strike module varies. + 15 different stagers from wrappers to last stagers were signed + Next leverage Cobalt Strike and SilentBreak - to “inject code into any process” - can inject additional modules into Windows system processes or trusted applications - Next layer of the infection chain decrypts, maps into memory, and launches the code * The ability to inject malware into the system’s memory classifies it as fileless * leaving behind no artifacts on the local hard drive, making it easy to sidestep traditional signature-based security and forensics tools - technique, where attackers hide their activities in a computer’s random-access memory and use native Windows tools such as PowerShell and Windows Management Instrumentation (WMI), isn’t new. * What is: is how the encrypted shellcode containing the malicious payload is embedded into Windows event logs. To avoid detection, the code “is divided into 8 KB blocks and saved in the binary part of event logs - drops wer.dll * is a loader * wouldn’t do any harm without the shellcode hidden in Windows event logs - The dropper searches the event logs for records * with category 0x4142 (“AB” in ASCII) and having the Key Management Service as a source. * If none is found, the 8KB chunks of shellcode are written into the information logging messages + Next, a launcher is dropped - into the Windows Tasks directory - a separate thread combines all the aforementioned 8KB pieces into a complete shellcode and runs it - Dropper modules also patch Windows native API functions * related to event tracing (ETW) and anti-malware scan interface (AMSI), to make the infection process stealthier.
Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk * An unpatched Domain Name System (DNS) bug + Created in a popular standard C library + allow attackers to mount DNS poisoning attacks against millions of IoT devices and routers to potentially take control of them + all versions of uClibc and uClibc-ng, popular C standard libraries found in numerous IoT products + flaw is caused by the predictability of transaction IDs included in the DNS requests generated by the library - may allow attackers to perform DNS poisoning attacks against the target device * DNS poisoning attack + AKA DNS spoofing and DNS cache poisoning + deceives a DNS client into accepting a forged response + forces a program to perform network communications with an arbitrarily defined endpoint instead of the legitimate one * Numerous Affected Devices + Linksys, Netgear and Axis, + Linux distributions such as Embedded Gentoo - use uClibe + uClibc-ng - fork specifically designed for OpenWRT - common OS for routers deployed throughout various critical infrastructure sectors * successful DNS poisoning attack + they also can perform a subsequent man-in-the-middle attack + they can re-route network communications to a server under their control * The attacker could then steal and/or manipulate information transmitted by users and perform other attacks against those devices to completely compromise them