Category Archives: Endpoint Management

Malvertising Campaign Delivers Vidar Information Stealer and GandCrab Ransomware

Researchers have spotted a malvertising campaign that is delivering two payloads to victims: the Vidar information stealer and GandCrab ransomware.

Near the end of 2018, Malwarebytes Labs began tracking a malvertising campaign delivering a variety of payloads. Researchers analyzed the infection chain and traced it to the Fallout exploit kit. They observed this package downloading what they thought was the Arkei stealer, but a closer look revealed the malware to be Vidar, a customizable stealer of passwords, credit card details and digital wallet credentials.

At that point, Malwarebytes analysts looked into Vidar’s command-and-control (C&C) server, discovering that the attacks were retrieving GandCrab ransomware from that location. This sequence of events enables threat actors to first steal victims’ personal and financial information before extorting them for the return of their encrypted data.

A Busy Few Months for the Fallout Exploit Kit

The Fallout exploit kit has been busy over the past few months. In September 2018, FireEye observed the exploit kit targeting users in Japan, Korea, the Middle East, Southern Europe and other countries in the Asia-Pacific region. In that campaign, Fallout infected victims with GandCrab ransomware.

This package of exploits didn’t waste time in diversifying its payloads. Researchers at McAfee observed Fallout exposing users to Kraken ransomware in October 2018. That same month, Palo Alto Networks detected a campaign in which the exploit kit delivered Azorult malware, another threat capable of stealing important information.

How to Block GandCrab and Other Malvertising Payloads

As it continues to evolve, the Fallout exploit kit will likely begin delivering even more payloads. Security professionals should therefore help protect their organizations by consistently leveraging the four steps of vulnerability assessment to keep software up-to-date. Organizations should also help defend against ransomware like GandCrab by using an endpoint management solution to monitor their IT assets for suspicious activity.

The post Malvertising Campaign Delivers Vidar Information Stealer and GandCrab Ransomware appeared first on Security Intelligence.

Pre-Installed Malware Targets Critical System Apps on Mobile Devices

Several new types of pre-installed malware are targeting critical system apps on mobile devices, making them difficult to remove.

Researchers at Malwarebytes came across two instances of pre-installed malware targeting applications in /system/priv-app/, where critical apps such as settings and system UI reside. The first infection occurred on a THL T9 Pro device. The malware repeatedly installed variants of Android/Trojan.HiddenAds, which is known for displaying lock screen advertisements that take up the device’s entire screen. In this particular case, the infection wrapped itself up in the critical system Android app System UI.

The second infection occurred on a UTOK Q55. In that case, the threat came hardcoded in the device’s Settings app. It fit the “monitor” category of potentially unwanted programs (PUP), which are capable of collecting and reporting users’ information.

The Pre-Installed Malware Problem Persists

These two instances of pre-installed malware aren’t the first detected by Malwarebytes. In March 2017, researchers at the security software provider observed mobile devices manufactured by BLU being shipped out with Android/Adware.YeMobi. Then in December of that year, the researchers found an auto-installer known as FWUpgradeProvider pre-installed on devices bought from legitimate phone carriers in the U.K. and elsewhere.

Other security firms have detected pre-installed malware more recently. For instance, Check Point discovered RottenSys disguised as a system Wi-Fi service; the threat targeted nearly 5 million users for fraudulent ad revenues as of March 2018. A few months later, Avast Threat Labs found adware known as Cosiloon pre-installed on hundreds of Android device models.

How to Protect Mobile Devices From Pre-Installed Malware

Security professionals can protect mobile devices from pre-installed malware and other threats by using a unified endpoint management (UEM) solution to monitor how these devices report to the corporate IT environment. They should also use behavioral analysis to help defend mobile devices against zero-day threats.

The post Pre-Installed Malware Targets Critical System Apps on Mobile Devices appeared first on Security Intelligence.