Author Archives: Shane Schick

Malspam Campaign Impersonates UK Businesses to Target Victims With Banking Trojan

Security researchers discovered a malspam campaign targeting British computer users with the Ursnif/Gozi/ISFB Trojan.

According to My Online Security, the campaign lures victims with phony messages supposedly coming from one of the United Kingdom’s largest banks and other companies. Details of the attack first surfaced on Twitter, as security experts posted examples of malicious emails that used social engineering to dupe recipients into downloading the banking Trojan.

One message that purported to come from Lloyds Bank, for example, was designed to look like a fraud alert and came with a PDF attachment. Targets who clicked on a link to a Google Doc within the PDF wound up launching a VBS file containing the malware binary.

Malicious Emails Are More Than Just Their Name

Beyond simply imitating well-known organizations, attackers behind the malspam campaign are also playing on the psychology of those who might be worried about their personal finances. The subject line for one message, for instance, reads, “Do you recognize each transaction listed above?”

As one security researcher pointed out, most people do not think to click on the area of the message that would reveal the sender’s domain. Instead, they just see the organization’s name, such as Lloyds Bank, and assume it’s genuine.

This seemingly small mistake can have serious consequences. The Ursnif/Gozi/ISFB Trojan, which has been active for several years, is designed to steal banking credentials as well as usernames and passwords for PayPal and other online services.

Learn From Other Malspam Campaigns to Defend Your Organization

Cybercriminals have an obvious interest in email as a platform to distribute banking Trojans and other threats because of how often people use email every day. This also means, however, there are some good case studies readily available that show how malspam campaigns work and how to ensure you don’t become a victim.

A recent analysis from IBM X-Force researchers, for example, showed how the Necurs botnet was able to use highly sophisticated techniques to tailor large quantities of spam to local languages across multiple countries. Besides investing in a threat intelligence platform, it’s always a good idea to remind employees not to open unsolicited email messages — and, even if they’re from familiar names, to make sure they’re legitimate.

Source: My Online Security

The post Malspam Campaign Impersonates UK Businesses to Target Victims With Banking Trojan appeared first on Security Intelligence.

Magecart Group’s Use of Credit Card-Skimming JavaScript Attack on the Rise

An online retailer was hit by a JavaScript attack from a group associated with Magecart, a collective of cybercriminals that specializes in skimming credit card numbers from compromised websites, according to malware researchers at BroadAnalysis.

BroadAnalysis did not reveal the name of the online retailer in question, but posted a series of screenshots that showed the network traffic, index page and four different sniffer scripts used in the attacks. These included an exfil script, a loading script and a base64 string that linked the compromised site and stolen payment credentials back to the threat actor’s site.

The JavaScript attack is typical of Magecart, which has been linked to similar attacks aimed at e-commerce platforms such as Magento and OpenCart.

Skimming at Sotheby’s and Others

The discovery of the four different credit card skimmers comes less than a month after the auction house Sotheby’s sent a statement to several IT security publications about a similar Magecart attack against its Sotheby’s Home website (formerly Viyet) discovered in early October. The firm warned that the JavaScript attack may have been running and stealing customer payment data since March 2017.

Another security research report, meanwhile, suggested that a Magecart group has evolved its use of skimming tools to not only steal customer credit card data, but also website administrator credentials. This involves adding other keywords into the skimmer code to look for admin logins and passwords as well as the payment forms on e-commerce sites. Researchers discovered the technique in the analysis of a skimming campaign against an optical retailer’s e-commerce site.

How to Protect Your Organization From a JavaScript Attack

Although Magecart attacks can happen at any time, retailers should be particularly vigilant about this sort of JavaScript attack as more consumers turn to online purchases during the busy holiday shopping season.

Defending against this kind of threat starts with applying common best practices, such as limiting access and privileges for critical systems and hardening underlying web servers. Beyond that, organizations should also deploy change monitoring and detection technologies that can alert security teams of unusual activity, such as a change in their e-commerce web pages.

Sources: BroadAnalysis, SC Magazine, RiskIQ

The post Magecart Group’s Use of Credit Card-Skimming JavaScript Attack on the Rise appeared first on Security Intelligence.

SNAKEMACKEREL Group Uses Brexit-Themed Spear Phishing Attack to Target Government Agencies

Analysts discovered a new campaign from the SNAKEMACKEREL group that uses fake Brexit-related documents to infiltrate major government agencies and steal information.

Researchers with Accenture noted that SNAKEMACKEREL, which is also known by several other names including Sofacy, is an espionage-motivated collective of cybercriminals with a history of launching malware attacks on public sector organizations across North America and the European Union.

In the recent campaign, victims were lured in with a spear phishing attack to open documents containing the malicious macros, which then activated a form of malware that has multiple names, including Zebrocy and Zekapab. Agencies targeted in the campaign included the U.K. Defence Science and Technology Laboratory, the U.K Foreign and Commonwealth Office, and the Organisation for the Prohibition of Chemical Weapons.

How SNAKEMACKEREL Capitalizes on Current Events

The files containing the malware were sent the same day U.K. Prime Minister Theresa May signed the draft agreement that would signal the country’s departure as a member of the European Union, a decision colloquially known as Brexit. When victims received the fake documents, however, they saw a series of jumbled text that suggests they were created with an earlier version of Microsoft Word. This tricked victims into clicking on the macros containing the malware.

Components within the macro include an executable binary similar in nature to code used in attacks attributed to Sofacy earlier this year. Once Zekapab has infected a victim’s system, it sends HTTP POST requests to deliver information it has collected back to threat actors, while another component can spread the malware even further across a network.

Researchers said SNAKEMACKEREL has also been used to target organizations outside of the U.K., including the North Atlantic Treaty Organization (NATO), the International Olympic Committee and defense contractors, among others.

Avoid the Threat of Spear Phishing Attack Campaigns

According to IBM experts, the spear phishing attack is a favorite technique among cyberthreat groups because it tends to work at least 10 percent of the time. That’s why security training not only has to be in place for all employees, but potentially automated in such a way that laggards can be identified and their use of critical IT systems can be improved.

If that doesn’t suffice, identity and access management (IAM) solutions can help raise the alarm when suspicious-looking documents, such as those sent by SNAKEMACKEREL, make their way into staff inboxes.

Source: Accenture

The post SNAKEMACKEREL Group Uses Brexit-Themed Spear Phishing Attack to Target Government Agencies appeared first on Security Intelligence.

KingMiner Maxes Out Windows Server CPUs in Widespread Cryptomining Campaign

Researchers spotted a new cryptomining threat conducting brute-force attacks using 100 percent of Internet Information Services IIS/Structured Query Language (SQL) Microsoft Windows servers’ compute resources.

The malware, called KingMiner, is designed not to steal information but to harvest cryptocurrencies such as Monero, which require considerable processing power to crunch through the mathematical calculations behind them, according to researchers at Check Point.

KingMiner was first discovered this past June, but it has since spawned a new variant with even stronger cryptomining features that is now active in the wild.

Cryptomining Campaign Drains CPUs

Once it identifies its target, KingMiner attempts to guess the system’s password, then downloads and executes a Windows scriptlet file. In some cases, the malware is already active on the system, in which case the new version kills off its predecessor. Israel, Norway, Mexico and India are among the locations where the cryptomining campaign has successfully infected Windows machines, according to the researchers.

KingMiner uses a file called XMRig to mine Monero. Although it was designed to use up only 75 percent of a victim’s machine, in practice, it drains the entire capacity of the central processing unit (CPU) due to coding errors.

The cybercriminals behind KingMiner also take pains to avoid detection. By avoiding any public mining pools with its cryptocurrency wallet and turning off the application programming interface (API), for instance, it’s difficult to know how much Monero it has harvested so far. Emulation attempts, meanwhile, are bypassed through an XML file that has been disguised as a ZIP file within the payload. Additional evasion techniques include exporting functions and adding content to the executable’s dynamic link library (DLL) files.

How to Keep Cryptomining Malware at Bay

The researchers noted that KingMiner is likely to continue its evolution based on placeholders they found in the code for future updates and versions.

Cybercriminals are increasingly interested in mining cryptocurrency it requires less social engineering and malware can run quietly in the background. Eliminating threats such as KingMiner depends on widespread adoption of security information and event management (SIEM) technology and improved network endpoint protection.

Source: Check Point

The post KingMiner Maxes Out Windows Server CPUs in Widespread Cryptomining Campaign appeared first on Security Intelligence.

FakeSpy And XLoader Mobile Malware May Come From Yanbian Gang

A pair of mobile malware threats, XLoader and FakeSpy, that posed as apps from a Japanese home delivery company may be operated by or affiliated with the same group of cybercriminals, according to recent reports.

Nearly 385,000 people around the world have been affected by XLoader and FakeSpy, which are designed to steal personal information such as financial data and install other apps, according to Trend Micro. The majority of victims are based in Japan and South Korea, and data compiled up to October shows that the number of infections from the two mobile malware threats have increased dramatically since August.

The researchers attributed both XLoader and FakeSpy to a cybercriminal collective known as the Yanbian Gang.

Signs of a Possible Mobile Malware Connection

One sign that FakeSpy and XLoader might originate from the same source is a set of about 126 domains that they share as part of their deployment procedures. A closer look at the two threats revealed marked resemblances in their code, and they also attempt to hide the origins of their command-and-control (C&C) servers in similar ways.

Both threats imitated legitimate apps of a Japanese home delivery firm to dupe users into installing the mobile malware on their devices, and the domains in question were registered with phone numbers from the same Chinese province where researchers believe the Yanbian Gang is based.

That said, the report acknowledged that the two mobile malware threats may simply have been developed and deployed in similar ways, and nothing has been definitively proven yet.

How to Stay Ahead of the Threat

No matter who is behind FakeSpy and XLoader, there’s no question they follow in the footsteps of similar mobile malware campaigns that use phishing techniques to lure their victims.

In response to such threats, IBM X-Force and IBM Research in Tokyo developed an advanced approach called ahead-of-threat detection, which brings together disparate data sources to identify potentially dangerous phishing domains before cybercriminals can use them in their social engineering schemes. With ahead-of-threat detection, chief information security officers (CISOs) and their teams can build more effective blacklists and keep the likes of XLoader and FakeSpy at bay.

Source: Trend Micro

The post FakeSpy And XLoader Mobile Malware May Come From Yanbian Gang appeared first on Security Intelligence.

Marriott Data Breach Impacts Personal Information of up to 500 Million Guests

Marriott disclosed a breach of its Starwood reservation database that potentially affects an estimated 500 million guests.

Details of the Marriott data breach, which goes back to 2014, have been reported to law enforcement and regulatory authorities, according to the company. Marriott said it received an initial alert on Sept. 8 that an unauthorized third party had attempted to access the Starwood database. Further investigation revealed that an unknown entity copied and encrypted guest information and also attempted to steal the database. The public first learned of the data breach when it was disclosed on Nov. 30.

What Personal Information Was Stolen?

Although the company stated that it had not finished decrypting the copied information at the time of disclosure, it confirmed that the personally identifiable information (PII) of approximately 327 million people might have been comprised. The data includes payment card numbers and expiration dates, though it is not yet known if the two keys needed to decrypt the Advanced Encryption Standard (AES-128) protocol used to protect this information were also stolen.

In addition to payment card information, threat actors also accessed the 327 million customers’ names, passport numbers, Starwood Preferred Guest account information, dates of birth, genders and email addresses. For the remaining guests, the information was limited to names and mailing or email addresses.

The Marriott incident is one of the largest in history, and could be one of the first opportunities for European Union regulators to flex their General Data Protection Regulation (GDPR) muscles. The GDPR was enacted in late May, promising severe fines for violations of data privacy and disclosure.

Response to the Marriott Data Breach

Since the Marriott data breach was disclosed, two class-action lawsuits seeking damages for the exposure of personal information have been filed. Multiple news outlets, including The New York Times, have reported that the Federal Bureau of Investigation (FBI) is tracking the situation, and investigations have been launched by attorneys general in several states.

Customers affected by the Marriott data breach can access a dedicated website and call center with any questions. The company is also offering guests a free year of the WebWatcher monitoring software to help identify any misuse of personal information.

Of course, Marriott is far from alone in dealing with large data breaches. According to Ponemon’s “2018 Cost of a Data Breach Study,” the number of mega breaches — those involving more than 1 million records — has nearly doubled from 2013 to 2017.

Sources: Marriott, ZDNet, The New York Times

The post Marriott Data Breach Impacts Personal Information of up to 500 Million Guests appeared first on Security Intelligence.

OceanLotus Watering Hole Campaign Compromises 21 High-Profile Southeast Asian Websites

A watering hole campaign that has been active in Southeast Asia since September has compromised at least 21 websites, including those of government agencies and major media outlets.

Researchers attributed the attack to a group of cybercriminals known as OceanLotus, which has been targeting foreign governments for approximately six years. Users who visited the compromised websites were redirected to a page controlled by the attackers. While those in charge of the domains have since been informed about the watering hole attack, some continue to be injected with malware scripts.

A Wider Watering Hole Than Usual

The traditional watering hole campaign strategy has focused on luring specific individuals by compromising URLs they’re known to use regularly, but the latest OceanLotus attack includes sites such as a popular Vietnamese newspaper, suggesting that a large number of people could be affected.

Over the course of a multiphase attack, OceanLotus installs a piece of malicious Java code on a site that creates a connection with a victim’s system, and then additional scripts to deliver a possible payload. While the full extent of the watering hole campaign isn’t clear, researchers speculated that the compromised websites could be used to conduct phishing schemes and steal confidential data.

Like many other cybercriminal organizations, OceanLotus is focused on improving the sophistication of its attacks. The researchers noted, for example, that the group used an RSA 1024-bit public key to prevent the decryption of information sent from its server and client devices. OceanLotus also purchased dozens of domains and servers, which it used to run the first and second stages of the attacks and make the URLs look legitimate.

How To Strike A Better Threat Management Balance

Compared with more obvious tactics, such as phishing emails with malicious links or ransomware attachments, a watering hole campaign can easily fly under the radar of organizations that haven’t experienced a website compromise before. For that reason, many companies affected by the likes of OceanLotus find themselves responding reactively rather than proactively addressing the associated risks ahead of time.

IBM experts suggest adopting a threat management framework that begins with generating insights about potential attacks, implementing safeguards necessary to prevent them, monitoring continuously to detect anomalies and responding as necessary.

Source: WeLiveSecurity

The post OceanLotus Watering Hole Campaign Compromises 21 High-Profile Southeast Asian Websites appeared first on Security Intelligence.

WordPress Exploit in GDPR Plugin Puts 100,000 Websites at Risk

More than 100,000 websites were affected by a vulnerability in a WordPress plugin that was designed to help site owners comply with the General Data Protection Regulation (GDPR).

Researchers from Wordfence also reported evidence of attacks in which malicious third parties installed their own administrator accounts on various sites. Though the full scope of how cybercriminals might use this access is unknown, it could enable them to install malware and hijack sites to use in phishing schemes.

The plugin, called WP GDPR Compliance, was initially removed from a plugin repository after the WordPress exploit was discovered. A patched version has since been made available.

WordPress Exploit Enables Attackers to Hijack Websites

WP GDPR Compliance was created to address some requirements in the legislation around requests for data access and how data is deleted from WordPress-hosted sites. A bug in the system that registers new users, however, enables threat actors to create their own accounts. This gives them full privileges to control what happens on the site and lets them cover their tracks by disabling the same feature and locking out legitimate site owners.

A second use of the WordPress exploit involves manipulating WP-Cron, the plugin’s task scheduler, which enables attackers to create other entry points through which to take control of a site.

This WordPress exploit affects WP GDPR Compliance versions up to and including 1.4.2. The patched version, 1.4.3, is now available within the WordPress plugin repository.

How Can Site Owners Protect Their Accounts?

Along with theme directories, plugins are a highly popular avenue for attack on WordPress sites. According to IBM X-Force, for example, directory references to “plugins” were found in close to 40 percent of the WordPress URLs where malware or other files had been discovered.

The risks associated with the WP GDPR Compliance plugin reinforce the importance of proactive patching. However, security experts also suggest proactively scanning such sites for potential anomalies, which could include changes in files or, in this case, new admin accounts.

Sources: WordFence, WeLiveSecurity

The post WordPress Exploit in GDPR Plugin Puts 100,000 Websites at Risk appeared first on Security Intelligence.

Canadian University Shuts Down Network in Response to Cryptocurrency Mining Attack

St. Francis Xavier University had to take its critical IT systems offline after it discovered a scheme to mine cryptocurrency using its network resources.

On Nov. 9, the school’s IT team identified an automated attack launched by unknown threat actors in an effort to steal computing power to mine cryptocurrency, otherwise known as cryptojacking.

After consulting with security specialists, the university, which is based in Nova Scotia, made the decision to disable all network systems. Representatives of the school announced plans to reinstate the offline servers across its network in stages to reduce potential security risks.

Why Did the University Shut Down Its Network?

So far, the university has reported no evidence that the personal information of students, faculty or other parties has been leaked or stolen as part of the attack. To be safe, however, administrators reset the passwords for all university accounts across campus. The IT team said it would continue to look for anomalous behavior over the next month.

The university’s swift response affected basic access to network resources such as Wi-Fi and educational software application Moodle. Meanwhile, student payment cards and debit transactions were temporarily inoperable. The school said it plans to publish a list of which services have been restored and which are still in the queue, such as its MesAmis reporting system and Banner database. The researchers did not explain exactly how the malware was installed on the system.

How to Keep Cryptocurrency Mining Threats at Bay

The St. Francis Xavier University incident is an increasingly rare example of cryptojackers focusing on bitcoin. According to security experts, general-purpose computers are not ideal for bitcoin given the sophisticated nature of its algorithm. Instead, attacks more often exploit IT resources to mine for newer cryptocurrencies such as Monero and Ethereum.

Regardless of what’s being mined, organizations that invest in security information and event management (SIEM) are better positioned to identify cryptojacking before it’s too late to remediate the threat without halting the entire network.

Sources: St. Francis Xavier, ZDNet

The post Canadian University Shuts Down Network in Response to Cryptocurrency Mining Attack appeared first on Security Intelligence.

Ransomware-as-a-Service Program Offers Affiliates Up to 75 Percent of Revenue to Spread Infection

A ransomware-as-a-service program called FilesLocker is offering affiliates commissions of up to 75 percent on all revenue stolen from victims if they can drive enough traffic.

Details about FilesLocker were first posted on Twitter, but a subsequent investigation traced it to Chinese cybercrime forum on TOR, an anonymous online network. Written in C# and available in both Chinese and English, some of the features promoted in the forum include strong encryption, the ability to clear shadow volume copies and customization capabilities.

While FilesLocker is relatively unsophisticated in design, according to security researchers, it encrypts victims’ files through a private key, which is encrypted by an embedded public key. By scanning common system folders such as Documents and Pictures, the ransomware-as-a-service offering encrypts files with a .locked extension and then displays a note demanding 0.18 bitcoin as payment to a specific email address, along with an automatically generated victim ID for tracking purposes.

How Affiliates Qualify For FilesLocker Spoils

The developer behind FilesLocker stipulated that any interested affiliates should have a proven track record in distributing ransomware through phishing schemes or other methods, with a minimum of 10 infections a day. He or she also warned against uploading the program to any service that helps organizations automate the process of scanning for viruses and other security threats. While those who do particularly well can earn three-quarters of what’s gathered from victims, the program includes a base revenue share of 60 percent.

The practice of spreading ransomware through affiliates is becoming more common among cybercriminals. Back in August, for example, cybercriminals pitched a similar ransomware-as-a-service threat dubbed Princess Evolution to potential partners for the same 60 percent revenue share.

Containing Threats Like FilesLocker

While it’s common and natural to panic upon seeing a ransom note pop up on the screen, security leaders should train users to report such incidents as quickly as possible so they can minimize the potential spread of ransomware-as-a-service programs.

IBM Security’s “Ransomware Response Guide” advised security professionals to immediately disconnect any machine infected with ransomware from the corporate network, as well as any access to Wi-Fi or other services that could link back to the attacker.

Isolating a system can give the security team enough time to conduct a proper route cause analysis (RCA) to identify how the ransomware is being distributed, which may mean closing off email or other communication channels for at-risk employees. Since malware developers are starting to work as a team, their potential victims need to do the same.

Sources: BleepingComputer, Malware Hunter, Virus Total

The post Ransomware-as-a-Service Program Offers Affiliates Up to 75 Percent of Revenue to Spread Infection appeared first on Security Intelligence.

Threat Actors Combine Windows Utilities in Malware Campaign Targeting Users in Brazil

Cybercriminals are impersonating the Brazilian postal service in a malware campaign that combines legitimate Windows files such as Windows Management Instrumentation (WMI) and CertUtil to steal banking data.

Investigators tracked the threat to a series of email messages telling victims they’d missed a package that was to be delivered to their location. The emails contain a bogus tracking code and an embedded link to download a ZIP file.

At this point, a LNK file points to cmd.exe, which makes use of WMI, a command line utility, to execute scripts from the attackers’ command-and-control (C&C) server. At the same time, the threat actors use a copy of CertUtil that is created and stored in a temporary folder with a different name to cover their tracks.

The victim’s machine must use Portuguese as its main language for the scripts to execute, suggesting that the group behind the attack may intend to target users outside of Brazil.

Malware Campaign Evades Detection Using Windows Components

The researchers noted that while this is not the first time threat actors have leveraged components such as WMI and CertUtil, the fact that these two files were combined suggests that the group behind this campaign is experienced in evading detection.

Although WMI and CertUtil were not designed for cybercriminal purposes, this incident shows that they can be subverted, making it even more difficult for IT security teams to recognize malicious activity until it’s too late.

Adopt a Layered Approach to Data Protection

To contend with threat actors who endeavor to hide their malicious activity from security tools, organizations should adopt a layered approach to data protection. According to IBM’s “2018 Cost of a Data Breach Study,” in fact, there is a clear correlation between investing in such a strategy and successfully recovering from cyberattacks. Organizations that fully deploy security automation, for instance, experience a net total cost difference of $1.55 million compared to companies that don’t.

Source: TrendMicro

The post Threat Actors Combine Windows Utilities in Malware Campaign Targeting Users in Brazil appeared first on Security Intelligence.