About Cheryl Biswas

Writer, reader, techie, Trekkie. InfoSec and political analyst. Keeping our world safe one byte at a time.

FIN7 Spear Phishing, Carbanak and the SEC

FinSec is a thing. It’s rather become my thing, when I delve deeper and find the connections and patterns that emerge. This week, FireEye published a post on a campaign known as FIN7. They identified a spear phishing campaign in late February that targeted people who were filing with the US SEC. FIN7 is described as a

“financially motivated instrusion set that selectively targets victims and uses spear phishing to distribute its malware.”

Sectors identified as targets are in the US but have a global spread and include:

  • Financial services
  • Transportation
  • Retail
  • Education
  • IT services
  • Electronics

Often they target retail and hospitality through POS malware.  Here’s the play by play:

  • Malicious documents drop a VBS script and install a PowerShell backdoor. No question that PowerShell is now the tool of choice for attackers. Set up your IDS to look for signs.
  • The backdoor is a new malware family dubbed POWERSOURCE. It’s based on a tool that is publicly available, DNT_TXT_Pwnage.  What they’ve done is modify it especially in terms of obfuscation. If you can’t find it …
  • FIN7 uses DNS TXT records for the Command and Control. And this DNS TXT – it’s been trending because of how hard it makes detection and hunting for threats around command and control
  • But wait! There’s a second backdoor, installed by POWERSOURCE. This second stage PowerShell backdoor is known as TEXTMATE. It’s fileless malware – yes, that’s a thing now too – that stays memory resident, so you can’t find it easily, and lets the attacker play hide and seek better.
  • There have been instances of a Cobalt Strike Beacon payload.
  • That same domain hosting the Cobalt Strike Beacon also hosted – get ready for it – a CARBANAK backdoor sample that was recently compiled. We know how pervasive CARBANAK is, and that it has recently made a major pivot into the hospitality sector. And, as it happens, something that FIN7 has used in past.

While FireEye says they have not yet determined the objective of FIN7 in this current campaign, I think it’s safe to say they are in it for the money.

Sources: https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html

New Apache Struts 0Day Exploit

(March 8, 2017) Cisco Talos group has identified attacks against a 0Day vulnerability in Apache Struts, which is a popular Java app framework. An advisory was issued Monday, stating the problem exists in the Jakarta Multipart parser. An attacker could perform a RCE attack with a malicious contenttype value. Users were advised to upgrade or switch to a different implementation of the parser. Numerous attacks appeared to be taking advantage of a publicly released proof of concept to run assorted commands. Struts was previously compromised by Chinese hackers in 2014, who exploited known vulnerabilities to install a backdoor. Message here: keep patches current.

Source: http://www.csoonline.com/article/3178744/security/cisco-and-apache-issue-warnings-over-zero-day-flaw-being-targeted-in-the-wild.html#tk.twt_cso

It’s Baaack – The Return of CryptoLocker

Since last week I’ve been following some fascinating reports about the return of this ransomware behemoth. There are increasing accounts about the resurgence of CryptoLocker ransomware.  As we have learned with Lazarus Group and Shamoon, just because it’s dormant doesn’t mean it’s dead.

Attacks have been steadily climbing since January. And what is interesting is how attackers are leveraging the Certified Electronic Email in Italy to spread the joy. This service is used by people who want the assurance they are getting a high level of security. The attack vehicle was a carefully crafted email featuring a digital signature to appear very trustworthy. Attackers utilized Italy’s Certified Electronic Email which legally is like a registered letter, to deliver invoices hiding spam. And it worked. This parallels the similar rise in Dridex in Switzerland reported mid February, again leveraging trusted email providers. As we know, phishing works. “Trust” works. Put the two together … …Attacks were predominantly in Europe, the staging ground for Russian cybercriminals before they launch their malware on America.  Attacks are now heavy in the Netherlands, and have landed on American shores as confirmed by Microsoft’s Malware Protection Center.

Sources: https://www.scmagazine.com/cryptolocker-bursts-onto-scene-again-targeting-europe-and-us/article/641731/

https://www.bleepingcomputer.com/news/security/crypt0l0cker-ransomware-is-back-with-campaigns-targeting-europe/

Shamoon Update: Ransomware and New Wiper Malware Discovered

Wiper malware is rare – just a handful of occurrences have been documented. However, in the latest appearance of Shamoon, a new ransomware component was uncovered in addition to the disk wiping capability. Because you can’t have too much of a bad thing it would seem.  The ransomware component hasn’t been deployed but is ready for use. The Shamoon 2.0 dropper is a worm that infects computers in Windows domains, leveraging hardcoded previously stolen usernames and passwords. Kaspersky has released a full report on it.

Kaspersky has now identified another wiper malware in the wild. Dubbed “StoneDrill”, it has targeted organizations in Saudi Arabia, but it also went after a petrochemical organization in Europe. At this stage, it seems StoneDrill is similar to the APT group NewsBeef or Charming Kitten, who was linked to the latest Shamoon endeavours. Kaspersky notes “Particularly interesting is the heavy use of anti-emulation techniques in the malware, which prevents the automated analysis by emulators or sandboxes.” far more so than Shamoon.  It also uses VBS scripts to run self-delete scripts but Shamoon did not rely on any external scripts. Also, the disk wiper module in StoneDrill does not get written to disk like Shamoon does. Instead, it is injected directly into the user’s browser process memory, no drivers required.

 

Source: https://threatpost.com/destructive-stonedrill-wiper-malware-on-the-loose/124090/

https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

The ABC’s of APTs: Shamoon

sham35Welcome to the grey zone where politics and cyber meet. APTs or advanced persistent threats, are one of my favourite acronyms (but then you know how I am intrigued by Stuxnet and cartels), and essentially are how nation states get their digital digs at each other. Usually the intention is to get information, because knowledge is power. Cyberespionage can give a competing nation a real competitive advantage in the world economy, among other things. But sometimes, there is a need to control more, and that is where weaponizing code takes on a whole new nasty.

The keyword here is “persistence.”  First, attackers must find their way into the networks of the target. Usually, they employ targeted spear phishing, painstakingly staking out the right victim to receive that loaded email.  The investment of time and money at this point is essential, so as not to tip anyone off. And the emails are crafted so carefully, picking up on points tailored to that recipient so that they will open it, and launch the attachment that will create an entry point for the attacker. There is a reason why phishing is at the heart of so many breaches.

Now, imagine a video game, where you must progressively meet the challenges of each level to go higher. That is the attacker moving through the network, acquiring credentials to gain access to the crown jewels. The strategy is to find someone lower level, then work your way up. Hence, persistence, because this is an investment of both time and patience. Expect the key executives or decision makers to be well-guarded, with access and authorization controls in place. Not the case for someone lower on the food chain. All an attacker needs is to gain access. As proven repeatedly, once in, they can take all the time they need to find what they want. Case in point: the attack on the Ukraine power grid in December 2016.  The attackers were in that system for over nine months, collecting what they needed, notably credentials for the Virtual Private Network, that enabled them to jump the security gap onto the restricted side. As Stuxnet taught us, there is no such thing as air-gapped security.

shamoonattackgraphic

We know the Russians hacked the US; we know China hacked the US and Canada; and yes, the US has hacked someone too. These are the games nations play. The trick, of course, is not to get caught before you have the prize. And when you do get caught?  Well, as we’ve seen play out, nothing really bad happens. Just expect that your victim will be in your systems. Unless information isn’t the endgame and control is. Then, be prepared for something to go bump in the night.

Shamoon is devastating wiper malware that took out a massive swath of Saudi Aramco when it first debuted in 2012.  Linked to Iran, and an ongoing feud in the region between key players, it was a targeted attack against the oil giant, damaging or destroying 35,000 computers. Sec Def at the time, Leon Panetta, described it as “probably the most destructive cyber attack on a business.”

Wiper malware was used against business targets in  December 2014 destroying the systems in a Vegas casino, The Sands, after owner Sheldon Adelson advocated using nuclear weapons against Iran. The US “publicly cited Iran as the culprit”.   Then Disstrack was used again in December 2015, in the attack that brought Sony to its knees.  These aren’t gangs using cybercrime for monetary gain. These are the equivalent of acts of war, given the level of damage done.

Fast forward to late 2016. Two major attacks happened in Saudi: November 17 taking out systems at the airport and other Saudi government agencies, and then again on November 29. Then, on January 23 there was another attack. The malware used was almost identical to the original Shamoon, aka Disstrack.  Except there were a few key enhancements.  According to Andrew Plato, CEO of Anitian Enterprise Security

 “What is really worrisome about this is it’s just outright destructive. It isn’t really trying to steal anything. It’s the closest things we’re going to get to a cyber bomb”.

The new version, dubbed Shamoon 2, spread through the local network using legitimate counts belonging to users and administrators, with complex passwords likely obtained from an earlier attack. Remember what I said about persistence?  This new version, however went on to attack VDIs, or Virtual Desktops, which previously could have offered some protection because of their ability to load snapshots of systems that were wiped. Now Shamoon had migrated from just Windows-based systems to Linux in the attacks on VDIs.

cyberwar1-1024x482

Now, I don’t want to be alarmist and spread FUD everywhere. Yes, this is serious and destructive. Like Stuxnet, it broke things. And that’s the differentiator. So far, the line hasn’t been crossed where breaking things was deliberately done to harm people. Because as Archer would say: You want cyberwar? Because that’s how you get cyberwar.

While the expectation is that Iran is once again behind the attacks, Symantec has revealed there are multiple parties involved. More than one entity, so collaboration and cooperation.  The report is that an entity known as Greenbug may have assisted in getting the credentials needed for access.  Palo Alto reported on a campaign known as Magic Hound which targeted energy, technology and government with ties or locations in Saudi.  There were links between Magic Hound and two other actors with Iranian ties: Charming Kitten and Rocket Kitten. Finally, putting all this together was the group Timberworm or Cobalt Gypsy.  Per Symantec, Timberworm was behind the January 23 attacks.

Here’s the play by play. First, Timberworm used spear phishing emails with weaponized documents (we warned you about those Office Macros!) to gain initial access into the network. Once there, they used custom malware, along with leveraging existing sysadmin tools to avoid detection, and help them achieve persistent remote access. Quick FYI: custom malware is a hallmark of major organized cybercrime groups or nation state attacks because it costs a lot of time and money to craft, and the stakes are going to be very high.

Apparently Greenbug and Timberworm have been active, penetrating organizations beyond Saudi. Note that Shamoon, however, was only used against the Saudi target. Timberworm is a large operation, as is Greenbug, with targets in a range of areas. We know who they are now, what they can do, and that they have a shared interest. What we don’t know: the endgame. I’m waiting for that other shoe to drop.

http://www.zerohedge.com/news/2016-12-01/another-false-flag-destructive-iranian-hackers-allegedly-wreak-havoc-saudi-computer-

http://www.securityweek.com/shamoon-2-variant-targets-virtualization-products

http://www.securityweek.com/multiple-groups-cooperated-shamoon-attacks-Symantec

http://www.archersecuritygroup.com/second-wave-bomb-malware-hits-saudi-arabia/

Necurs Botnet + DDoS

https://www.linkedin.com/hp/update/6240979895925768192

Just adding this here as a heads up to keep watch over. Necurs has built itself out as a lucrative vehicle to deliver Locky ransomware and Dridex banking malware, along with an effective Spam campaign. 

What is interesting is that DDoS destroys the bots in the army, which would not serve the interests of those running Necurs. We know that cybercrime really is an ideal model of business efficiency. 

Nonetheless, we need to keep watch over Necurs, and be aware of all its capabilities. Cuz pivots happen. Fast. And this year my prediction is we are going to see banking malware do what ransomware did last year.

Ransomware Updates

We’ve got some new stuff out there. First, for those who torrent, be careful. If you torrent on a Mac, be very careful.  For the second time, ransomware has been designed for the Mac OS.In this case, “Patcher” is poor quality, shoddy code, to the extent that if the victim pays the ransom, they don’t get their files back because that code doesn’t work. It’s getting dropped via fake Adobe Premier Pro and Microsoft Office for Mac.

Second, if Google is telling you “Hoefler test not found”, don’t think you need to install that font. It’s a ploy on certain compromised websites to drop Spora ransomware. And very few AV or anti-malware programs can detect this one.

spora.JPG But, if you play it safe and do as Google says, click Discard and don’t download.  You’ll avoid ransomware.

If you want to know more, I’ve got a Ransomware page.

And saved the best for last. This amazing map from F-Secure shows the timeline of ransomware.  You can see the explosion that took place in 2016.

ransomware-tube-map

https://www.f-secure.com/documents/996508/1030743/cyber-security-report-2017