Category Archives: Brute-Force Attack

Brute-Force Attack Wave Uses Legacy Protocols, Credential Dumps to Compromise Cloud Accounts

A massive brute-force attack campaign used both legacy protocols and credential dumps to compromise cloud user accounts.

In a six-month study, Proofpoint observed a wave of brute-force attacks that originated mainly from Nigeria but also China, the U.S., Brazil and South Africa. These malicious operations abused various legacy protocols in the process; the vast majority leveraged IMAP, a legacy authentication protocol that bypasses multifactor authentication (MFA). Concurrently, the campaigns referred to several credential dumps to obtain username-password variations.

The attacks relied on compromised network devices such as routers and servers to conduct IMAP-based password-spraying attacks. These brute-force attempts were successful 44 percent of the time, according to Proofpoint. In those cases, the malefactors used the compromised credentials to steal access to users’ cloud application accounts. They then abused that access to send out phishing attacks to move laterally throughout the network and/or prey upon users employed at other organizations.

Not the First Brute-Force Attack Campaign to Involve IMAP

IMAP has been involved in similar operations in the past. Back in 2017, for instance, security researcher Stephen Atty discovered what appeared to be a slow-moving botnet sending out POP3/IMAP attempts at a slow rate so as to not raise any red flags with monitoring software. More than a year later, Roger Comply reported in Paranoid Penguin that he had observed another botnet using what he called the “drip” approach in its login attempts against targeted IMAP servers.

How to Strengthen Your Organization’s Email Defenses

Security professionals can help strengthen their organization’s email security posture by taking a layered approach to email defenses. This strategy should begin with the deployment of an external solution capable of scanning email for threats. They should also seek budget to create an email security awareness program to train the entire workforce to recognize, avoid and report phishing attacks.

The post Brute-Force Attack Wave Uses Legacy Protocols, Credential Dumps to Compromise Cloud Accounts appeared first on Security Intelligence.

New Golang Brute-Forcer Targeting E-Commerce Sites to Steal Personal and Payment Data

Researchers discovered new Trojan malware written in Golang that’s targeting e-commerce websites with brute-force attacks.

Malwarebytes Labs recently analyzed a newly infected Magento website and found that attackers had injected malicious code into the site’s homepage so that it referenced an external piece of JavaScript. This code used a POST request to exfiltrate victims’ data to googletagmanager[.]eu when they entered their address and payment details.

In their investigation, Malwarebytes researchers found a connection between the compromised e-commerce website and a two-stage payload. The first stage consisted of a Delphi downloader detected as Trojan.Wallyshack. This threat collected basic information about the infected machine, transmitted the data to its command-and-control (C&C) server and ran Trojan.StealthWorker.GO, the second payload that communicated with the infected site. Written in Golang version 1.9, this malware sample contained several functions with the name “Brut” that it used for brute-forcing.

Connections to MageCart and the Rise of Golang Threats

While analyzing the infected website, Malwarebytes observed how this wasn’t the first time that googletagmanager[.]eu has surfaced in an attack campaign. In fact, researchers traced the domain back to criminal activities involving MageCart. This threat actor has affected more than 800 organizations by compromising their e-commerce websites and stealing customers’ payment card details, as noted by RiskIQ.

At the same time, this brute-forcer comes amid a rise of Golang-based digital threats. In January 2019, for example, Malwarebytes Labs detected Trojan.CryptoStealer.Go, an information stealer written in this budding programming language. Just a month before, researchers at Palo Alto Networks’ Unit 42 came across a Golang variant of Zebrocy, an attack tool used by the Sofacy threat group.

How Security Teams Can Defend Against Brute-Forcers

Security professionals can help defend against brute-force attacks by shielding their network perimeter against outside intrusion with firewalls and identity-based security such as identity and access management (IAM). Additionally, security teams should implement consistent software patching so they can close off known vulnerabilities.

The post New Golang Brute-Forcer Targeting E-Commerce Sites to Steal Personal and Payment Data appeared first on Security Intelligence.