Cyware Weekly Threat Intelligence, April 06 - April 10, 2020

The Good

As the COVID-19 pandemic has forced a massive adoption of remote working, numerous organizations now need to secure their extended threat environment. To aid organizations in this transition, Microsoft this week released new security guidance detailing the various attack vectors and tactics used by threat actors to leverage the pandemic to target employees working from home. On the other hand, the Canadian Internet Registration Authority (CIRA) launched a country-wide Domain Name System (DNS) filtering service to protect critical infrastructure and organizations from malware and phishing threats.

• Microsoft published new threat intel and security guidance for individuals and organizations in the wake of rising incidents of phishing and social engineering attacks that have hit every country during the coronavirus pandemic.

• Canadian Internet Registration Authority (CIRA) launched a country-wide DNS filtering service to block malware and phishing threats, with early access given to healthcare workers, small businesses, and educational institutions.

• The Commonwealth Scientific and Industrial Research Organisation (CSIRO), an Australian federal agency, announced the creation of the seL4 Foundation, a not-for-profit organization, to accelerate the development of the seL4 microkernel and related technologies. The seL4 project is designed to be the world’s first operating system (OS) kernel that is mathematically proved secure.

• Google released a free software security book, titled 'Building Secure and Reliable Systems', that provides first-hand lessons in avoiding and responding to failures caused by attackers or small internal changes. The book provides valuable insights into how security teams can improve their site reliability engineering (SRE) practices.

• Nominet, a UK-based domain name registrar, blocked 600 coronavirus-themed websites that were found scamming the public by selling fake vaccines, protective equipment, and fraud remedies.

The Bad

The week saw a number of significant data leaks and other noteworthy incidents. The email marketing firm, Maropost, exposed an unsecured database containing 95 million records with information on its numerous clients. Meanwhile, researchers also reported a massive BGP hijacking attack by the Russian state-owned telecom provider that redirected the web traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers. The affected companies included the likes of Google, Amazon, Facebook, Akamai, and Cloudflare.

• An unsecured database owned by the email delivery and marketing firm, Maropost, exposed about 95 million email records and email logs. The leaked email logs contained relevant metadata, such as the exact date and time the emails were sent. The database, which is hosted on the Google cloud server, was taken offline on April 1, 2020.
• Bisq Bitcoin exchange temporarily disabled trading after the discovery of a critical vulnerability in its platform. The firm plans to release v1.3.0 soon to fix the issue. Until then, users are asked not to send any funds to and from Bisq.
• Hammersmith Medicines Research Ltd. (HMR) suffered an attack from Maze ransomware. The incident had occurred on March 14, 2020, following which the ransomware operators had stolen the data hosted on HMR’s network. The attackers had eventually released the data on their ‘News’ site on March 21 when the research company denied paying the ransom. The stolen records contained the personal information for volunteers whose surnames began with D, G, I, J.
• Researchers at Microsoft noted that cybercriminals have adopted COVID-19 phishing lures to target individuals and organizations across 241 nations and territories. The tech giant also detected a massive campaign using 2,300 different webpages attached to phishing emails disguised as COVID-19 financial compensation information. The spoofed pages were designed to capture users’ Office 365 credentials.
• The data of more than 600,000 Email.it users was put up for sale on the dark web forum. The incident came to light on April 5, 2020, when the hackers - going by the name of NN - went on Twitter to promote a website that was used to sell the company’s data. They claimed that the actual intrusion took place more than two years ago, in January 2018. The selling price of the data varies between 0.5 and 3 bitcoin.
• Berkine, a subsidiary of a US-based firm, previously known as Anadarko Petroleum Corp., was hit by the Maze ransomware. The attackers have managed to steal an entire database containing over 500 MB of confidential documents related to budgets, organizational strategies, and production quantities.
• The traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers, was redirected by Rostelecom in a BGP hijacking attack last week. The attack lasted for about an hour and affected over 8,800 internet traffic routes. The impacted companies included Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Hetzner, and Linode.
• The US Small Business Administration (SBA) revealed that the personally identifiable information (PII) for some of the financial relief loan applicants may have been exposed to other applicants online. The incident occurred due to a security flaw in the loan application site. The issue was immediately resolved and the application portal was relaunched to avoid exposure of sensitive data.
• Microsoft shared details of an Emotet attack on an organization named Fabrikam (a placeholder name given by Microsoft in its case study). The attack relied on a phishing message that was opened by an internal employee. This unleashed the malware, which later infected the organization’s systems and halted core services by saturating the CPU usage on Windows devices.
• A new attack campaign linked to the DarkHotel APT group targeted more than 200 Sangfor SSL VPN servers by exploiting a zero-day vulnerability. 174 of these servers were located on the networks of government agencies in Beijing and Shanghai, and the networks of Chinese diplomatic missions operating abroad. This included countries like Italy, Pakistan, Indonesia, Thailand, the UAE, Israel, Malaysia, Iran, Ethiopia, and India.
• The personal information of around 45,000 Iranian individuals, totaling to 8.17 GB, was put up for sale on the dark web for an amount of $200 in BTC. The stolen data appeared to have come from several sites including Niazpardaz[.]ir, an online advertising platform, and Arzi24[.]com, a website owned by Farhad Exchange. Security researchers also found another trove of leaked data for sale, including 52,000 ID cards along with selfies of their respective owners.
• IBM X-Force researchers discovered a SMiShing campaign designed to unlock the phone for resale on the black market. The phishing campaign was found to be operating over 600 phishing domains designed to steal iCloud credentials from Apple users. The attackers behind the campaign were found focusing on cybersecurity and tech conferences to steal iPhones belonging to influential company executives, only to later target them with the SMShing campaign to extract their credentials and private data.
• Two school districts in the US state of California suffered cybersecurity breaches due to security issues plaguing the video conferencing platform, Zoom. In one incident, the school administrators mistakenly posted hundreds of meeting access codes and passwords on a publicly accessible webpage.
• In an internal memo sent to all its personnel, NASA warned of an exponential increase in malware attacks and a doubling of targeted phishing attacks as employees started working from home during the COVID-19 pandemic.
• Security researchers at BlackBerry reported that state-linked Chinese APT groups have targeted US firms for over a decade to steal intellectual property and other sensitive business data. The hackers especially targeted the Linux-based backend servers as they lacked adequate security compared to other key infrastructure.

New Threats

Despite a lockdown across many countries, hackers continue to evolve their malicious exploits and attack techniques. This week, researchers came across two new advanced botnets, namely Dark Nexus and DDG. While Dark Nexus is capable of performing DDoS attacks on various IoT devices, DDG is a sophisticated cryptomining botnet that is capable of functioning independently of its C2 servers, using its proprietary P2P protocol. A new ‘Mouse-Over’ attack technique affecting Microsoft PowerPoint was also discovered this week. The technique can allow attackers to bypass security restrictions and manipulate user files on targeted devices.

• Researchers detected a new ransomware called L4NC34 that appends .crypt extension after encrypting files on a victim’s machine. Later, it drops a ransom note which is actually located within a PHP file. The ransomware demands a ransom of $10 in bitcoin to decrypt the files. Since the ransomware uses the base64 algorithm to encrypt files, researchers have managed to retrieve a decryption key by decoding the algorithm.
• A new campaign that spreads the notorious Ursnif trojan was observed recently. The trojan is delivered via document files, titled ‘info_03_24.doc’. These documents leverage malicious Visual Basic for Applications (VBA) macro code that is used to call the main routine. The campaign is executed in three different stages to evade detection by antivirus software.
• The cryptomining botnet called DDG was updated by its authors to adopt a proprietary peer-to-peer (P2P) mechanism. The botnet, first reported by Netlab 360 researchers in January 2018, has undergone 16 different updates over the past three months to become a highly sophisticated and seemingly unstoppable threat, according to the researchers. The botnet can fully function using its P2P protocol as a failsafe, even if its C2 servers are taken down.
• Researchers demonstrated a new attack technique that leverages weaknesses in a PowerPoint’s Open XML Slide Show (PPSX) files to install malware. Termed as ‘Mouse-Over’ attack, the method allows threat actors to bypass restrictions in PowerPoint and manipulate users’ files.
• Researchers found that 3D printing technology can be used to bypass most fingerprint scanners used by mobile devices from Apple, Samsung, and Microsoft. The technology has also been successfully tested on laptops and smart padlocks.
• Researchers came across a new botnet named Dark Nexus, that shares similarities with Qbot and Mirai botnets. The botnet is capable of performing DDoS attacks and launching credential stuffing attacks against a broad range of IoT devices, video recorders, and thermal cameras. There are three different versions of the Dark Nexus botnet which has been around for three months.
• FIN6 APT group and the operators of the Trickbot malware paired up together to target several organizations with Anchor backdoor malware. The attack campaign, which has been active for the past six months, is initiated through malspam. Most of the enterprises that include Point of Sale (PoS) systems have fallen victim to the campaign.
• xHelper trojan, which has been around since March 2019, reportedly infected at least 55,000 devices across the globe. The malicious payload connects with the C2 server of attackers after scanning and sending device information, including OS firmware version, manufacturer name, and model. Later, it fetches another payload, the Triada trojan, which uses a set of exploits to obtain device root privileges.
• The government of Colombia sanctioned CoronApp-Colombia app was found containing serious vulnerabilities. The app has over 100,000 users and their details are exposed due to the underlying security flaws. The exposed data includes passport numbers, passwords, and self-disclosed health information of users.
• Over 350,000 of all Microsoft Exchange servers were found to be still affected by the CVE-2020-0688 post-auth remote code execution vulnerability. The flaw is present in the Exchange Control Panel (ECP) component and can allow attackers to take over Microsoft Exchange servers using previously stolen valid email credentials.
• Unpatched flaws existing in the authentication mechanisms of PayPal and Venmo websites could allow attackers to reset passwords via text messages and take control of a victim’s cellphone number. The flaws were detected earlier this year and affected several other major companies like Amazon, Blizzard, Adobe, eBay, Snapchat, and Yahoo. While some of these companies have plugged the security hole, others are yet to do it.
• Researchers observed a new bitcoin-mining campaign, targeting misconfigured open Docker Daemon API ports. It has been found that thousands of attempts are being made every day to compromise such containers as part of the campaign. The purpose of these attacks is to deploy Kinsing malware in the final stage of the infection to run cryptominers.
• Threat actors compromised legitimate installers of the video conferencing app, Zoom, to distribute a Coinminer dubbed Trojan.Win32.MOOZ.THCCABO. The compromised installers are available for download from fraudulent websites. The Coinminer is capable of collecting system information such as Graphics Processing Unit (GPU), operating system version, video controllers and processors, and more.
• Researchers uncovered thousands of Android apps containing hidden backdoors and blacklists. This discovery was made using a tool named INPUTSCOPE. The research involved more than 150,000 applications, out of which 30,000 were pre-installed apps extracted from Samsung smartphones’ firmware. Nearly 12,706 apps were found containing some sort of backdoors and some 4,028 apps included blacklist secrets.
• Ten critical vulnerabilities found in HP Support Assistant could expose Windows computers to remote code execution attacks. This can allow attackers to elevate privileges or to delete arbitrary files. The flaws include five local privilege escalation flaws, two arbitrary file deletion vulnerabilities, and three remote code execution vulnerabilities. HP has patched some of these vulnerabilities, while the remaining are yet to be patched.
• Several vulnerabilities found in B&R Automation software could allow attackers to launch attacks inside operational technology networks. The security holes are related to Automation Studio’s update service and are tracked as privilege escalation flaws, incomplete encryption & validation issues, and path traversal flaws.