Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam

The U.S. Department of Justice (DoJ) has charged two arrested Chinese nationals for allegedly orchestrating a pig butchering scam that laundered at least $73 million from victims through shell companies.

The individuals, Daren Li, 41, and Yicheng Zhang, 38, were arrested in Atlanta and Los Angeles on April 12 and May 16, respectively.

The foreign nationals have been "charged for leading a scheme to launder funds to the tune of at least $73 million tied to an international crypto investment scam," Deputy Attorney General Lisa Monaco said.

Prosecutors have accused Li, Zhang, and their co-conspirators of managing an international syndicate that laundered the funds obtained via cryptocurrency investment scams.

As part of the fraudulent operation, victims are said to have been tricked into transferring millions of dollars to U.S. bank accounts that were opened in the name of various shell companies.

"A network of money launderers then facilitated the transfer of those funds to other domestic and international bank accounts and cryptocurrency platforms in a manner designed to conceal the source, nature, ownership, and control of the funds," the DoJ said.

The funds are believed to have been laundered through U.S. financial institutions to bank accounts in the Bahamas, and then subsequently converted to USDT or Tether and sent to cryptocurrency wallets, including one controlled by Li.

In particular, Li and Zhang oversaw the lower-level co-conspirators who moved the proceeds overseas to bank accounts at Deltec Bank in the Bahamas. At least one of the bank accounts was operated with the financial assistance of Li, with Zhang also directly receiving victim funds, according to the unsealed indictment.

Both of them have been charged with conspiracy to commit money laundering and six substantive counts of international money laundering. If convicted, they face up to 20 years in prison on each count.

Pig butchering scams often involve fraudsters approaching lonely, rich targets using messaging apps, dating services, and social media platforms to build trust and persuade them to invest in different schemes that claim to offer better returns, only for their money to be transferred to wallets under their control.

In December 2023, the U.S. government announced charges against four nationals for their alleged participation in an illicit scheme that earned them more than $80 million via cryptocurrency investment scams.

Then last month, Google filed a lawsuit in the U.S. against two app developers based in Shenzhen and Hong Kong, respectively, for flooding the Play Store with bogus crypto apps to pull off cryptocurrency theft using similar tactics.

Countries like Burma, Cambodia, Laos, Malaysia, Myanmar, and the Philippines have also emerged as a hotbed for romance scams, often luring unsuspecting people with promises of lucrative jobs to transport them to so-called "scam factories," where they are coerced into participating in the operation.

A recent report published by BBC News detailed how a 24-year-old Sri Lankan who was recruited for a data entry job but was taken to Myawaddy, a town in southeastern Myanmar, and forcibly detained in a camp run by "Chinese-speaking gangmasters."

What's more, the individual, identified as Ravi (name changed), was tortured for refusing to take part, his clothes stripped off his clothes, and given electric shocks to his legs.

"I spent 16 days in a cell for not obeying them," he was quoted as saying to the British broadcaster. "They only gave me water mixed with cigarette butts and ash to drink."

In another instance, a 21-year-old from the Indian state of Maharashtra was trafficked to Myanmar along with five other Indian men and two Filipino women in August 2022, but was eventually let go after paying a ransom.

INTERPOL has described the situation as human trafficking-fuelled fraud on an industrial scale, with the U.S. Department of State denouncing China-based organized crime syndicates for posing as labor brokers to recruit people with English proficiency from Africa and Asia.

Two Brothers Arrested for Stealing $25M in Novel Crypto Heist

The development comes as the DoJ unsealed an indictment against Anton Peraire-Bueno, 24, of Boston, and James Pepaire-Bueno, 28, of New York, with conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering. Each of them faces a maximum penalty of 20 years in prison for each count.

"The charges in the indictment arise from an alleged novel scheme by the defendants to exploit the very integrity of the Ethereum blockchain to fraudulently obtain approximately $25 million worth of cryptocurrency within approximately 12 seconds," the DoJ said.

The brothers, who studied at the Massachusetts Institute of Technology (MIT), allegedly leveraged their skill sets to pull off the novel scheme in early April 2023 that involved a "first-of-its-kind manipulation" of the protocols underpinning the Ethereum blockchain.

This allowed the defendants to fraudulently gain access to pending transactions, alter the movement of the electronic currency, and ultimately route $25 million in cryptocurrency from victims to their accounts through a series of transactions designed to obscure the ownership of the stolen funds.

"Anton Peraire-Bueno and James Pepaire-Bueno manipulated and tampered with the process and protocols by which transactions are validated and added to the Ethereum blockchain," the DoJ said, adding they "meticulously planned" the attack over several months.

Simultaneously, they also took steps to cover up the tracks by concealing their identities and hiding their ill-gotten gains by setting up front companies, private cryptocurrency addresses, and foreign cryptocurrency exchanges. The MEV-Boost vulnerability exploited to compromise the integrity of the Ethereum blockchain has since been patched.

"The Peraire-Bueno brothers stole $25 million in Ethereum cryptocurrency through a technologically sophisticated, cutting-edge scheme they plotted for months and executed in seconds," Monaco said. "As cryptocurrency markets continue to evolve, the Department will continue to root out fraud, support victims, and restore confidence to these markets."

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/5Xw0hrF
via IFTTT

Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide

May 19, 2024NewsroomBanking Troja / Email Security

The threat actors behind the Windows-based Grandoreiro banking trojan have returned in a global campaign since March 2024 following a law enforcement takedown in January.

The large-scale phishing attacks, likely facilitated by other cybercriminals via a malware-as-a-service (MaaS) model, target over 1,500 banks across the world, spanning more than 60 countries in Central and South America, Africa, Europe, and the Indo-Pacific, IBM X-Force said.

While Grandoreiro is known primarily for its focus in Latin America, Spain, and Portugal, the expansion is likely a shift in strategy after attempts to shut down its infrastructure by Brazilian authorities.

Going hand-in-hand with the broader targeting footprint are significant improvements to the malware itself, which indicates active development.

"Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails," security researchers Golo Mühr and Melissa Frydrych said.

The attacks commence with phishing emails that instruct recipients to click on a link to view an invoice or make a payment depending on the nature of the lure and the government entity impersonated in the messages.

Users who end up clicking on the link are redirected to an image of a PDF icon, ultimately leading to the download of a ZIP archive with the Grandoreiro loader executable.

The custom loader is artificially inflated to more than 100 MB to bypass anti-malware scanning software. It's also responsible for ensuring that the compromised host is not in a sandboxed environment, gathering basic victim data to a command-and-control (C2) server, and downloading and executing the main banking trojan.

It's worth pointing out that the verification step is also done to skip systems geolocated to Russia, Czechia, Poland, and the Netherlands, as well as Windows 7 machines based in the U.S. with no antivirus installed.

The trojan component begins its execution by establishing persistence via the Windows Registry, after which it employs a reworked DGA to establish connections with a C2 server to receive further instructions.

Grandoreiro supports a variety of commands that allow the threat actors to remotely commandeer the system, carry out file operations, and enable special modes, including a new module that gathers Microsoft Outlook data and abuses the victim's email account to blast spam messages to other targets.

"In order to interact with the local Outlook client, Grandoreiro uses the Outlook Security Manager tool, a software used to develop Outlook add-ins," the researchers said. "The main reason behind this is that the Outlook Object Model Guard triggers security alerts if it detects access on protected objects."

"By using the local Outlook client for spamming, Grandoreiro can spread through infected victim inboxes via email, which likely contributes to the large amount of spam volume observed from Grandoreiro."

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/Is7Bwn3
via IFTTT

Transatlantic Cable podcast episode 347 | Kaspersky official blog

Episode 347 of the Transatlantic Cable podcast begins with news that Dell have been hit by a data breach, however details on the breach are scarce. Following that the team discuss another data breach, this time affecting Europol.

To wrap up the team discuss two stories, the first around Spanish police pulling data on suspects from sources such as Proton mail and Apple. The final story is around Securelist’s latest APT report, looking at Q1 2024.

If you liked what you heard, please consider subscribing.

• Dell Discloses Data Breach As Hacker Sells 49 Million Customer Data
• Europol Hacked? IntelBroker Claims Major Law Enforcement Breach
• Encrypted services Apple, Proton and Wire helped Spanish police identify activist
• APT trends report Q1 2024

from Kaspersky official blog https://ift.tt/BunTySU
via IFTTT

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

May 17, 2024NewsroomCryptojacking / Malware

The cryptojacking group known as Kinsing has demonstrated its ability to continuously evolve and adapt, proving to be a persistent threat by swiftly integrating newly disclosed vulnerabilities to exploit arsenal and expand its botnet.

The findings come from cloud security firm Aqua, which described the threat actor as actively orchestrating illicit cryptocurrency mining campaigns since 2019.

Kinsing (aka H2Miner), a name given to both the malware and the adversary behind it, has consistently expanded its toolkit with new exploits to enroll infected systems in a crypto-mining botnet. It was first documented by TrustedSec in January 2020.

In recent years, campaigns involving the Golang-based malware have weaponized various flaws in Apache ActiveMQ, Apache Log4j, Apache NiFi, Atlassian Confluence, Citrix, Liferay Portal, Linux, Openfire, Oracle WebLogic Server, and SaltStack to breach vulnerable systems.

Other methods have also involved exploited misconfigured Docker, PostgreSQL, and Redis instances to obtain initial access, after which the endpoints are marshaled into a botnet for crypto-mining, but not before disabling security services and removing rival miners already installed on the hosts.

Subsequent analysis by CyberArk in 2021 unearthed commonalities between Kinsing and another malware called NSPPS, concluding that both the strains "represent the same family."

Kinsing's attack infrastructure falls into three primary categories: Initial servers used for scanning and exploiting vulnerabilities, download servers responsible for staging payloads and scripts, and command-and-control (C2) servers that maintain contact with compromised servers.

The IP addresses used for C2 servers resolve to Russia, while those that are used to download the scripts and binaries span countries like Luxembourg, Russia, the Netherlands, and Ukraine.

"Kinsing targets various operating systems with different tools," Aqua said. "For instance, Kinsing often uses shell and Bash scripts to exploit Linux servers."

"We've also seen that Kinsing is targeting Openfire on Windows servers using a PowerShell script. When running on Unix, it's usually looking to download a binary that runs on x86 or ARM."

Another notable aspect of the threat actor's campaigns is that 91% of the targeted applications are open-source, with the group mainly singling runtime applications (67%), databases (9%), and cloud infrastructure (8).

Credit: Forescout

An extensive analysis of the artifacts has further revealed three distinct categories of programs -

• Type I and Type II scripts, which are deployed post initial access and are used to download next-stage attack components, eliminate competition, and evade defenses by disabling firewall, terminating security tools like SELinux, AppArmor, and Aliyun Aegis, and deploying a rootkit to hide the malicious processes

• Auxiliary scripts, which are designed to accomplish initial access by exploiting a vulnerability, disable specific security components associated with Alibaba Cloud and Tencent Cloud services from a Linux system, open a reverse shell to a server under the attacker's control, and facilitate the retrieval of miner payloads

• Binaries, which act as a second-stage payload, including the core Kinsing malware and the crypto-miner to miner Monero

The malware, for its part, is engineered to keep tabs on the mining process and share its process identifier (PID) with the C2 server, perform connectivity checks, and send execution results, among others.

"Kinsing targets Linux and Windows systems, often by exploiting vulnerabilities in web applications or misconfigurations such as Docker API and Kubernetes to run cryptominers," Aqua said. "To prevent potential threats like Kinsing, proactive measures such as hardening workloads pre-deployment are crucial."

The disclosure comes as botnet malware families are increasingly finding ways to broaden their reach and recruit machines into a network for carrying out malicious activities.

This is best exemplified by P2PInfect, a Rust malware that has been found to exploit poorly-secured Redis servers to deliver variants compiled for MIPS and ARM architectures.

"The main payload is capable of performing various operations, including propagating and delivering other modules with filenames that speak for themselves like miner and winminer," Nozomi Networks, which discovered samples targeting ARM earlier this year, said.

"As its name suggests, the malware is capable of performing Peer-to-Peer (P2P) communications without relying on a single Command and Control server (C&C) to propagate attackers' commands."

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/BSXTy6Q
via IFTTT

CrowdStrike Collaborates with NVIDIA to Redefine Cybersecurity for the Generative AI Era

Your business is in a race against modern adversaries — and legacy approaches to security simply do not work in blocking their evolving attacks. Fragmented point products are too slow and complex to deliver the threat detection and prevention capabilities required to stop today’s adversaries — whose breakout time is now measured in minutes — with precision and speed.

As technologies change, threat actors are constantly refining their techniques to exploit them. CrowdStrike is committed to driving innovation for our customers, with a relentless focus on building and delivering advanced technologies to help organizations defend against faster and more sophisticated threats.

CrowdStrike is collaborating with NVIDIA in this mission to accelerate the use of state-of-the-art analytics and AI in cybersecurity to help security teams combat modern cyberattacks, including AI-powered threats. The combined power of the AI-native CrowdStrike Falcon® XDR platform and NVIDIA’s cutting-edge computing and generative AI software, including NVIDIA NIM, delivers the future of cybersecurity with community-wide, AI-assisted protection with the organizational speed and automation required to stop breaches.

“Cybersecurity is a data problem; and AI is a data solution,” said Bartley Richardson, NVIDIA’s Director of Cybersecurity Engineering and AI Infrastructure. “Together, NVIDIA and CrowdStrike are helping enterprises deliver security for the generative AI era.”

AI: The Great Equalizer

Advancements in generative AI present a double-edged sword in the realm of cybersecurity. AI-powered technologies create an opportunity for adversaries to develop and streamline their attacks, and become faster and stealthier in doing so.

Having said that, AI is the great equalizer for security teams. This collaboration between AI leaders empowers organizations to stay one step ahead of adversaries with advanced threat detection and response capabilities. By coupling the power of CrowdStrike’s petabyte-scale security data with NVIDIA’s accelerated computing infrastructure and software, including new NVIDIA NIM inference microservices, organizations are empowered with custom and secure generative AI model creation to protect today’s businesses.

Figure 1. Use Case: Detect anomalous IPs with Falcon data in Morpheus

Driving Security with AI: Combating the Data Problem

CrowdStrike creates the richest and highest fidelity security telemetry, on the order of petabytes daily, from the AI-native Falcon platform. Embedded in the Falcon platform is a virtuous data cycle where cybersecurity’s very best threat intelligence data is collected at the source, preventative and generative models are built and trained, and CrowdStrike customers are protected with community immunity. This collaboration helps Falcon users take advantage of AI-powered solutions to stop the breach, faster than ever.

Figure 2. Training with Morpheus with easy-to-use Falcon Fusion workflow automation

Figure 3. Query Falcon data logs for context-based decisions on potential ML solutions

 

Joint customers can meet and exceed necessary security requirements — all while increasing their adoption of AI technologies for business acceleration and value creation. With our integration, CrowdStrike can leverage NVIDIA accelerated computing, including the NVIDIA Morpheus cybersecurity AI framework and NVIDIA NIM, to bring custom LLM-powered applications to the enterprise for advanced threat detection. These AI-powered applications can process petabytes of logs to help meet customer needs such as:

• Improving threat hunting: Quickly and accurately detect anomalous behavior indicating potential threats, and search petabytes of logs within the Falcon platform to find and defend against threats.
• Identifying supply chain attacks: Detect supply chain attack patterns with AI models using high-fidelity security telemetry across cloud, identities and endpoints.
• Protecting against vulnerabilities: Identify high-risk CVEs in seconds to determine whether a software package includes vulnerable or exploitable components.

Figure 4. Model evaluation and prediction with test data

The Road Ahead

The development work undertaken by both CrowdStrike and NVIDIA underscores the importance of advancing AI technology and its adoption within cybersecurity. With our strategic collaboration, customers benefit from having the best underlying security data to operationalize their selection of AI architectures with confidence to prevent threats and stop breaches.

At NVIDIA’s GTC conference this year, we highlighted the bright future ahead for security professionals using the combined power of Falcon data with NVIDIA’s advanced GPU-optimized AI pipelines and software. This enables customers to turn their enterprise data into powerful insights and actions to solve business-specific use cases with confidence.

By continuing to pioneer innovative approaches and delivering cutting-edge cybersecurity solutions for the future, we forge a path toward a safer world, ensuring our customers remain secure in the face of evolving cyber threats.

Additional Resources

• Read the press release.
• Read the Nvidia blog on NVIDIA NIM and Morpheus.
• Read the CrowdStrike blog on the use of AI in cybersecurity.
• Get a full-featured free trial of CrowdStrike Falcon® Prevent and see how true next-gen AV performs against today’s most sophisticated threats.

from Cybersecurity Blog | CrowdStrike https://ift.tt/tG62cSg
via IFTTT

The Good, the Bad and the Ugly in Cybersecurity – Week 20

The Good | International Law Enforcement Charge Crypto Criminals & Take Down a New Iteration of BreachForums

In the past week, law enforcement agencies took down cryptocurrency thieves responsible for a multi-million dollar theft from the Ethereum blockchain, and seized a second iteration of the notorious hacking platform, BreachForums.

The DoJ has unsealed an indictment charging Anton Peraire-Bueno (24) and James Pepaire-Bueno (28) with conspiracy to commit wire fraud and conspiracy to commit wire fraud and money laundering. The brothers allegedly manipulated the blockchain in 12-seconds to pilfer $25 million worth of cryptocurrency in a first-of-its-kind attack.

This was done by tampering with the transaction validation processes on the blockchain, altering pending transactions, and rejecting requests by victims to return the stolen funds. Prior to the attack on the blockchain, the brothers focused on performing reconnaissance on their victims, learning their identities and trading behaviors. If found guilty, each of the brothers face a maximum sentence of 20 years in prison for each count.

A little over a year has passed since the arrest of Conor Brian Fitzpatrick “Pompompurin”, owner and administrator of BreachForums. This week, the FBI have seized the hacking forum for a second time. Working with international law enforcement partners, the FBI have shut down a Telegram channel belonging to Fitzpatrick’s successor, “Baphomet”, along with the second iteration of the BreachForums website. Authorities are currently investigating the site’s backend data and have issued a call for new information.

Source: FBI

This iteration of BreachForum, run from June 2023 to May 2024, operated as a clearnet marketplace where cybercriminals could buy, sell, and trade illicit contraband such as hacking tools, compromised databases, stolen access devices, and various illegal services. As forums and dark markets continue to rise and fall multiple times, organizations are reminded to keep their defenses up to safeguard their sensitive data.

The Bad | North Korean APT Kimsuky Abuses Facebook Messenger in Latest Social Engineering Campaigns

Threat actors have found a new way to abuse social media to carry out their cyberattacks. In their latest string of attacks, a DPRK-linked APT known as Kimsuky used fake Facebook accounts to deliver malware via Messenger. Security researchers noted that the campaign leveraged the identity of a real individual in order to specifically target activists within North Korean human rights groups and anti-North Korean sectors.

Unlike traditional spear phishing attacks, this campaign employs Facebook Messenger to lure victims into opening private documents shared by the fake persona. The documents are hosted on OneDrive and pretend to be related to a trilateral summit involving Japan, South Korea, and the U.S. Their use of MSC files, an uncommon file type to carry out the attack, points to Kimsuky’s attempts to avoid detection.

Once opened by the victim, the MSC file triggers a connection to a server controlled by the attackers, displaying a decoy document while executing background commands for persistence and data collection. All of the gathered data is finally exfiltrated to the command and control (C2) server to further harvest IP addresses, User-Agent strings, and HTTP request timestamps, before delivering the payloads.

Source: Genians (Kimsuky’s Facebook-based ReconShark attack)

Kimsuky’s latest exploits call back to activity from last spring, such as ReconShark, which also targeted specific individuals through spear phishing emails, a file reconnaissance and data exfiltration campaign using RandomQuery malware, and a social engineering campaign stealing Google ad subscription credentials of a reputable news service focusing on North Korea. The DPRK-linked APTs continued commitment to developing their social engineering attacks highlights the need for organizations to remain vigilant, collaborate with their security partners, and invest in solutions including advanced detection capabilities.

The Ugly | New Lunar Toolset Deployed by GRU-Linked Actors Target European Government Agencies

Reports have surfaced this week detailing cyber intrusions of various European foreign affairs ministries. The campaign leverages two previously unknown backdoors, both of which have been active since at least 2020.

Researchers have dubbed the backdoors “LunarWeb” and “LunarMail”, and attribute the campaign with medium confidence to Turla, an APT connected to the Russian Federal Security Service (FSB). Turla (aka Krypton, UNC4210, or Secret Blizzard) has been known to target high profile entities including governments and diplomatic organizations in Europe, Central Asia, and the Middle East.

Initial infection occurs through spear phishing emails carrying Microsoft Word files with malicious macro code to install the LunarMail backdoor. This VBA macro then ensures persistence on the infected system by creating an Outlook add-in that is activated when the email is launched. Researchers also noted the potential abuse of Zabbix, an open-source solution for network and application monitoring, to deploy the LunarWeb payload.

Once active, Lunar backdoors enable direct communication with the C2 server, allowing for lateral movement within the network using stolen credentials and compromised domain controllers. These backdoors are tailored for long-term surveillance, data theft, and maintaining control over compromised systems, particularly in high-value sectors. A complete list of IoCs can be found here.

Source: ESET (The two observed Lunar toolset compromise chains)

Recent findings state that Russian-sponsored threats currently pose the greatest amount of risk to election infrastructure. Their goals also include amplifying GRU-linked interests and retaliating against perceived adversaries. In February, SentinelLabs uncovered a Russia-aligned influence operation network dubbed Doppelgänger employing disinformation tactics to influence public opinions within Germany. As major elections are around the corner for both the U.S. and EU members, malicious activities from nation-backed actors are expected to climb, making socio-economic and geopolitical terrains even more complex to navigate.

from SentinelOne https://ift.tt/RosnpD1
via IFTTT

New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs

A new report from XM Cyber has found – among other insights - a dramatic gap between where most organizations focus their security efforts, and where the most serious threats actually reside.

The new report, Navigating the Paths of Risk: The State of Exposure Management in 2024, is based on hundreds of thousands of attack path assessments conducted by the XM Cyber platform during 2023. These assessments uncovered over 40 million exposures that affected millions of business-critical assets. Anonymized data regarding these exposures was then provided to the Cyentia Institute for independent analysis. To read the full report, check it out here.

• Key findings on the types of exposures putting organizations at greatest risk of breach.
• The state of attack paths between on-prem and cloud networks.
• Top attack techniques seen in 2023.
• How to focus on what matters most, and remediate high-impact exposure risks to your critical assets.

The findings shine a critical light on the continuing over-emphasis on remediating CVEs in cybersecurity programs. In fact, XM Cyber found that CVE-based vulnerabilities account for less than 1% of the average organizations' On-prem exposure landscape. Even when factoring in high-impact exposures that present a risk of compromise to business-critical assets, these CVEs still represent only a small percentage (11%) of the exposure risk profile.

Where does the lion's share of risk actually lie? Let's dig deeper into the results:

CVEs: Not Necessarily Exposures

When analyzing the On-premises infrastructure, of the vast majority of organizations (86%) the XM Cyber report found, not surprisingly, that remote code executable vulnerabilities accounted (as mentioned above) for less than 1% of all exposures and only 11% of critical exposures.

The research found that identity and credential misconfigurations represent a staggering 80% of security exposures across organizations, with a third of these exposures putting critical assets at direct risk of breach - a gaping attack vector actively being exploited by adversaries.

Thus, the report makes it clear that while patching vulnerabilities is important, it's not enough. More prevalent threats like attackers poisoning shared folders with malicious code (taint shared content) and using common local credentials on multiple devices expose a much larger share of critical assets (24%) compared to CVEs.

Thus, security programs need to extend far beyond patching CVEs. Good cyber hygiene practices and a focus on mitigating choke points and exposures like weak credential management are crucial.

Don't Sweat Dead Ends, Hunt High-Impact Choke Points

Traditional security tries to fix every vulnerability, but XM Cyber's report shows that 74% of exposures are actually dead ends for attackers - offering them minimal onward or lateral movement. This makes these vulnerabilities, exposures, and misconfiguration less critical to your remediation efforts, allowing more time to focus on the real issues that present a validated threat to critical assets.

The remaining 26% of exposure discovered in the report would allow adversaries to propagate their attacks onward toward critical assets. The XM Cyber Attack Graph Analysis(™) identifies the key intersections where multiple attack paths toward critical assets converge as "choke points". The report highlights that only 2% of exposures reside on "choke points". Giving security teams a far smaller subset of high-impact exposures to focus their remediation efforts on. These "choke points" - are highlighted in yellow & red on the graph below. They are especially dangerous because compromising just one can expose a significant portion of critical assets. In fact, the report found that 20% of choke points expose 10% or more of critical assets. Thus, identifying attack paths and homing in on high-risk choke points can give defenders a bigger bang for their buck - reducing risk much more efficiently. To learn more about choke points, check out this article.

Finding and Categorizing Exposures: Focus on Critical Assets

Where are exposures and how do attackers exploit them? Traditionally, the attack surface is seen as everything in the IT environment. However, the report shows that effective security requires understanding where valuable assets reside and how they are exposed.

For example, the report analyzes the distribution of potential attack points across environments – finding that not all entities are vulnerable (see the graph below). A more critical metric is exposure to critical assets. Cloud environments hold the most critical asset exposures, followed by Active Directory (AD) and IT/Network devices.

It's worth drilling down into the extreme vulnerability of organizational AD. Active Directory remains the cornerstone of organizational identity management – yet the report found that 80% of all security exposures identified stem from Active Directory misconfigurations or weaknesses. Even more concerning, one-third of all critical asset vulnerabilities can be traced back to identity and credential problems within Active Directory.

What's the takeaway here? Security teams are often organized by critical asset categories. While this might be sufficient for managing the overall number of entities, it can miss the bigger picture. Critical exposures, though fewer, pose a much higher risk and require dedicated focus. (To help keep you on track with addressing AD security issues, we recommend this handy AD best practices security checklist.)

Different Needs for Different Industries

The report also analyzes differing cybersecurity risks across industries. Industries with a greater number of entities (potential attack points) tend to have more vulnerabilities. Healthcare, for example, has 5 times the exposure of Energy and Utilities.

However, the key risk metric is the proportion of exposures that threaten critical assets. Here, the picture flips. Transportation and Energy have a much higher percentage of critical exposures, despite having fewer overall vulnerabilities. This means they hold a higher concentration of critical assets that attackers might target.

The takeaway is that different industries require different security approaches. Financial firms have more digital assets but a lower critical exposure rate compared to Energy. Understanding the industry-specific attack surface and the threats it faces is crucial for an effective cybersecurity strategy.

The Bottom Line

A final key finding demonstrates that exposure management can't be a one-time or annual project. It's an ever-changing, continuous process to drive improvements. Yet today's over-focus on patching vulnerabilities (CVEs) leads to neglect of more prevalent threats.

Today's security ecosystem and threat landscape are not yesterday's. It's time for a cybersecurity paradigm shift. Instead of patching every vulnerability, organizations need to prioritize the high-impact exposures that offer attackers significant onward and lateral movement within a breached network – with a special focus on the 2% of exposures that reside on "choke points" where remediating key weakness in your environment will have the most positive reduction in your overall risk posture.

The time has come to move beyond a check-the-box mentality and focus on real-world attack vectors.

Note: This article was expertly written by Dale Fairbrother, Senior Product Marketing Manager at XM Cyber.

The State of Exposure Management report's findings are based on data from the XM Cyber Continuous Exposure Management Platform that was analyzed independently by the Cyentia Institute. Grab your free report here.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/oCZc5By
via IFTTT

China-Linked Hackers Adopt Two-Stage Infection Tactic to Deploy Deuterbear RAT

Cybersecurity researchers have shed more light on a remote access trojan (RAT) known as Deuterbear used by the China-linked BlackTech hacking group as part of a cyber espionage campaign targeting the Asia-Pacific region this year.

"Deuterbear, while similar to Waterbear in many ways, shows advancements in capabilities such as including support for shellcode plugins, avoiding handshakes for RAT operation, and using HTTPS for C&C communication," Trend Micro researchers Pierre Lee and Cyris Tseng said in a new analysis.

"Comparing the two malware variants, Deuterbear uses a shellcode format, possesses anti-memory scanning, and shares a traffic key with its downloader unlike Waterbear."

BlackTech, active since at least 2007, is also tracked by the broader cybersecurity community under the monikers Circuit Panda, Earth Hundun, HUAPI, Manga Taurus, Palmerworm, Red Djinn, and Temp.Overboard.

Cyber attacks orchestrated by the group have long involved the deployment of a malware called Waterbear (aka DBGPRINT) for nearly 15 years, although campaigns observed since October 2022 have also utilized an updated version called Deuterbear.

Waterbear is delivered by means of a patched legitimate executable, which leverages DLL side-loading to launch a loader that then decrypts and executes a downloader, which contacts a command-and-control (C&C) server to retrieve the RAT module.

Interestingly, the RAT module is fetched twice from the attacker-controlled infrastructure, the first of which is just used to load the Waterbear plugin that subsequently launches a different version of the Waterbear downloader to retrieve the RAT module from another C&C server.

Put differently, the first Waterbear RAT serves as a downloader while the second Waterbear RAT functions as a backdoor, harvesting sensitive information from the compromised host through a set of 60 commands.

The infection pathway for Deuterbear is a lot similar to that of Waterbear in that it also implements two stages to install the RAT backdoor component, but also tweaks it to some extent.

The first stage, in this case, employs the loader to launch a downloader, which connects to the C&C server to fetch Deuterbear RAT in order to establish persistence by means of a second-stage loader via DLL side-loading.

This loader is ultimately responsible for executing a downloader, which again downloads the Deuterbear RAT from a C&C server for information theft.

"In most of the infected systems, only the second stage Deuterbear is available," the researchers said. "All components of the first stage Deuterbear are totally removed after the 'persistence installation' is completed."

"This strategy effectively protects their tracks and prevents the malware from easily being analyzed by threat researchers, particularly in simulated environments rather than real victim systems."

Deuterbear RAT is also a more streamlined version of its predecessor, retaining only a subset of the commands in favor of a plugin-based approach to incorporate more functionality.

"Waterbear has gone through continuous evolution, eventually giving rise to the emergence of a new malware, Deuterbear," Trend Micro said. "Interestingly, both Waterbear and Deuterbear continue to evolve independently, rather than one simply replacing the other."

Targeted Campaign Delivers SugarGh0st RAT

The disclosure comes as Proofpoint detailed an "extremely targeted" cyber campaign targeting organizations in the U.S. that are involved in artificial intelligence efforts, including academia, private industry, and government, to deliver a malware called SugarGh0st RAT.

The enterprise security company is tracking the emerging activity cluster under the name UNK_SweetSpecter.

"SugarGh0st RAT is a remote access trojan, and is a customized variant of Gh0st RAT, an older commodity trojan typically used by Chinese-speaking threat actors," the company said. "SugarGh0st RAT has been historically used to target users in Central and East Asia."

SugarGh0st RAT was first documented late last year by Cisco Talos in connection with a campaign targeting the Uzbekistan Ministry of Foreign Affairs and South Korean users since August 2023. The intrusions were attributed to a suspected Chinese-speaking threat actor.

The attack chains entail sending AI-themed phishing messages containing a ZIP archive that, in turn, packs a Windows shortcut file to deploy a JavaScript dropper responsible for launching the SugarGh0st payload.

"The May 2024 campaign appeared to target less than 10 individuals, all of whom appear to have a direct connection to a single leading U.S.-based artificial intelligence organization according to open source research," the company said.

The end goal of the attacks is not clear, although it's suspected that it may be an attempt to steal non-public information about generative artificial intelligence (GenAI).

What's more, the targeting of U.S. entities also coincides with news reports that the U.S. government is looking to curtail China's access to GenAI tools from companies like OpenAI, Google DeepMind, and Anthropic, offering potential motives.

Earlier this year, the U.S. Department of Justice (DoJ) also indicted a former Google software engineer for stealing proprietary information from the company and attempting to use it at two AI-affiliated technology companies in China, including one that he founded around May 2023.

"It is possible that if Chinese entities are restricted from accessing technologies underpinning AI development, then Chinese-aligned cyber actors may target those with access to that information to further Chinese development goals," the company said.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/EwdRZMi
via IFTTT

Two-stage Dropbox spear phishing | Kaspersky official blog

Phishers are increasingly using sophisticated targeted attacks. In addition to leveraging a variety of legitimate online services, they employ social engineering to trick the victim into following a link. We recently uncovered another in a series of unconventional multi-stage phishing schemes that merits at least a warning to employees who handle financial documents.

The first email

The attack begins with an email to the victim that appears to be from a real auditing firm. In it, the sender says that they tried to send an audited financial statement, but it was too large to email, so it had to be uploaded to Dropbox. Note that the email is sent from a real address on the company’s mail server (the attackers most likely hijacked the mailbox).

The first email from an “auditing firm” is intended to soften up the victim

From the perspective of any mail security system, this email is perfectly legitimate – indistinguishable from normal business correspondence. It contains no links, comes from a legitimate company address, and merely informs the recipient of a failed attempt to send an audit via email. This message is bound to get the attention of the accountant reading it. It contains a disclaimer that the content is confidential and intended solely for the recipient, and the company in whose name it was sent has a large online presence. All in all, it looks pretty convincing.

The only small red flag is the information that the report had to be resent using Dropbox Application Secured Upload. There is no such thing. A file uploaded to Dropbox can be password-protected, but nothing more. The real purpose of this phrase is presumably to prepare the recipient for the fact that some form of authentication will be required to download the report.

The second email

Next comes a notification directly from Dropbox itself. It states that the auditor from the previous email has shared a file called “audited financial statements” and asked that it be reviewed, signed, and returned for processing.

A perfectly normal Dropbox notification stating that a file has been shared with the recipient

There is nothing suspicious about this email either. It contains a link to a perfectly legitimate online data storage service (which is why they use Dropbox). If the notification had arrived without any accompanying message, it would most likely have been ignored. However, the recipient has been primed, so they are more likely to go to the Dropbox website and try to view the document.

Dropbox file

When the victim clicks the link, they see a blurred document and a window opens on top of it requesting authentication using office credentials. Here, however, seeing is not believing, for both the blurred background and the window with a button are in fact parts of a single image inserted into a PDF file.

PDF file uploaded to Dropbox that mimics an authentication request

The victim doesn’t even need to click the VIEW DOCUMENT button – the entire surface of the image is essentially one big button. The link underneath it leads (via an intermediate site with a redirect) to a script that launches a form to enter login credentials – just what the attackers want.

All company employees need to be aware that work passwords should only be entered on sites that clearly belong to their company. Neither Dropbox nor external auditors should know your work password and therefore cannot verify its authenticity.

How to stay safe

As attackers come up with ever more sophisticated schemes to steal corporate credentials, we recommend implementing solutions that provide information security on multiple levels. First, use corporate mail server protection, and second, install a security solution with reliable anti-phishing technologies on all internet-facing work devices.

from Kaspersky official blog https://ift.tt/UCh6pB0
via IFTTT

Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks

May 17, 2024NewsroomLinux / Malware

The Kimsuky (aka Springtail) advanced persistent threat (APT) group, which is linked to North Korea's Reconnaissance General Bureau (RGB), has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations.

The backdoor, codenamed Gomir, is "structurally almost identical to GoBear, with extensive sharing of code between malware variants," the Symantec Threat Hunter Team, part of Broadcom, said in a new report. "Any functionality from GoBear that is operating system-dependent is either missing or reimplemented in Gomir."

GoBear was first documented by South Korean security firm S2W in early February 2024 in connection with a campaign that delivered malware called Troll Stealer (aka TrollAgent), which overlaps with known Kimsuky malware families like AppleSeed and AlphaSeed.

A subsequent analysis by the AhnLab Security Intelligence Center (ASEC) revealed that the malware is distributed via trojanized security programs downloaded from an unspecified South Korean construction-related association's website.

This includes nProtect Online Security, NX_PRNMAN, TrustPKI, UbiReport, and WIZVERA VeraPort, the last of which was previously subjected to a software supply chain attack by the Lazarus Group in 2020.

Symantec said that it also observed the Troll Stealer malware being delivered via rogue installers for Wizvera VeraPort, although the exact distribution mechanism by which the installation packages get delivered is presently unknown.

"GoBear also contains similar function names to an older Springtail backdoor known as BetaSeed, which was written in C++, suggesting that both threats have a common origin," the company noted.

The malware, which supports capabilities to execute commands received from a remote server, is also said to be propagated through droppers that masquerade as a fake installer for an app for a Korean transport organization.

Its Linux counterpart, Gomir, supports as many as 17 commands, allowing its operators to perform file operations, start a reverse proxy, pause command-and-control (C2) communications for a specified time duration, run shell commands, and terminate its own process.

"This latest Springtail campaign provides further evidence that software installation packages and updates are now among the most favored infection vectors for North Korean espionage actors," Symantec said.

"The software targeted appears to have been carefully chosen to maximize the chances of infecting its intended South Korean-based targets."

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/TasZNJv
via IFTTT

CISA Warns of Actively Exploited D-Link Router Vulnerabilities - Patch Now

May 17, 2024NewsroomVulnerability / Network Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting D-Link routers to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The list of vulnerabilities is as follows -

• CVE-2014-100005 - A cross-site request forgery (CSRF) vulnerability impacting D-Link DIR-600 routers that allows an attacker to change router configurations by hijacking an existing administrator session

• CVE-2021-40655 - An information disclosure vulnerability impacting D-Link DIR-605 routers that allows attackers to obtain a username and password by forging an HTTP POST request to the /getcfg.php page

There are currently no details on how these shortcomings are exploited in the wild, but federal agencies have been urged to apply vendor-provided mitigations by June 6, 2024.

It's worth noting that CVE-2014-100005 affects legacy D-Link products that have reached end-of-life (EoL) status, necessitating that organizations still using them retire and replace the devices.

The development comes as the SSD Secure Disclosure team revealed unpatched security issues in DIR-X4860 routers that could enable remote unauthenticated attackers to access the HNAP port in order to obtain elevated permissions and run commands as root.

"By combining an authentication bypass with command execution the device can be completely compromised," it said, adding the issues impact routers running firmware version DIRX4860A1_FWV1.04B03.

SSD Secure Disclosure has also made available a proof-of-concept (PoC) exploit, which employs a specially crafted HNAP login request to the router's management interface to get around authentication protections and achieve code execution by taking advantage of a command injection vulnerability.

D-Link has since acknowledged the issue in a bulletin of its own, stating a fix is "Pending Release / Under Development." It described the issue as a case of LAN-side unauthenticated command execution flaw.

Ivanti Patches Multiple Flaws in Endpoint Manager Mobile (EPMM)

Cybersecurity researchers have also released a PoC exploit for a new vulnerability in Ivanti EPMM (CVE-2024-22026, CVSS score: 6.7) that could permit an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.

"This vulnerability allows a local attacker to gain root access to the system by exploiting the software update process with a malicious RPM package from a remote URL," Redline Cyber Security's Bryan Smith said.

The problem stems from a case of inadequate validation in the EPMM command-line interface's installation command, which can fetch an arbitrary RPM package from a user-provided URL without verifying its authenticity.

CVE-2024-22026 impacts all versions of EPMM before 12.1.0.0. Also patched by Ivanti are two other SQL injection flaws (CVE-2023-46806 and CVE-2023-46807, CVSS scores: 6.7) that could allow an authenticated user with appropriate privilege to access or modify data in the underlying database.

While there is no evidence that these flaws have been exploited, users are advised to update to the latest version to mitigate potential threats.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/58y2Hjd
via IFTTT

North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign

May 16, 2024NewsroomMalware / Cyber Espionage

The North Korea-linked Kimsuky hacking group has been attributed to a new social engineering attack that employs fictitious Facebook accounts to targets via Messenger and ultimately delivers malware.

"The threat actor created a Facebook account with a fake identity disguised as a public official working in the North Korean human rights field," South Korean cybersecurity company Genians said in a report published last week.

The multi-stage attack campaign, which impersonates a legitimate individual, is designed to target activists in the North Korean human rights and anti-North Korea sectors, it noted.

The approach is a departure from the typical email-based spear-phishing strategy in that it leverages the social media platform to approach targets through Facebook Messenger and trick them into opening seemingly private documents written by the persona.

The decoy documents, hosted on OneDrive, is a Microsoft Common Console document that masquerades as an essay or content related to a trilateral summit between Japan, South Korea, and the U.S. -- "My_Essay(prof).msc" or "NZZ_Interview_Kohei Yamamoto.msc" -- with the latter uploaded to the VirusTotal platform on April 5, 2024, from Japan.

This raises the possibility that the campaign may be oriented toward targeting specific people in Japan and South Korea.

The use of MSC files to pull off the attack is a sign that Kimsuky is utilizing uncommon document types to fly under the radar. In a further attempt to increase the likelihood of success of the infection, the file is disguised as an innocuous Word file using the word processor's icon.

Should a victim launch the MSC file and consent to opening it using Microsoft Management Console (MMC), they are displayed a console screen containing a Word document that, when launched, activates the attack sequence.

This involves running a command to establish a connection with an adversary-controlled server ("brandwizer.co[.]in") to display a document hosted on Google Drive ("Essay on Resolution of Korean Forced Labor Claims.docx"), while additional instructions are executed in the background to set up persistence as well as collect battery and process information.

The gathered information is then exfiltrated to the command-and-control (C2) server, which is also capable of harvesting IP addresses, User-Agent strings, and timestamp information from the HTTP requests, and delivering relevant payloads as necessary.

Genians said that some of the tactics, techniques, and procedures (TTPs) adopted in the campaign overlap with prior Kimsuky activity disseminating malware such as ReconShark, which was detailed by SentinelOne in May 2023.

"In the first quarter of this year, spear phishing attacks were the most common method of APT attacks reported in South Korea," the company noted. "Although not commonly reported, covert attacks via social media are also occurring."

"Due to their one-on-one, personalized nature, they are not easily detected by security monitoring and are rarely reported externally, even if the victim is aware of them. Therefore, it is very important to detect these personalized threats at an early stage."

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/fsLFwSX
via IFTTT

Global Accessibility Awareness Day – A chance to broaden our perspectives

Claire Labry is a Release Engineer at HashiCorp and is currently the co-chair of Inclusive Access Alliance, a disability-led ERG. When she is not busy helping teams release their products and promoting inclusivity and accessibility in the workplace, you can find her outside — deep in the garden tending to her self-proclaimed backyard farm, with her small herd of three dogs trailing behind.

The genesis of Global Accessibility Awareness Day (GAAD) started with a blog post, a challenge to raise readers’ awareness of the lack of accessibility in the tech space.

In his 2011 post, Joe Devon mentions JAWS (job access with speech). As a disabled person myself, I didn’t know what JAWS was well into my master’s degree program at the University of Texas, confirming Devon’s statement that, “Relatively, there isn’t a lot of great information about accessibility out there. You really have to seek it out.”

It wasn’t until Dr. Gene I. Brooks, who is blind, walked into my Texas graduate school classroom that I realized how little I knew about the disability community other than the part of it that I inhabit. When Dr. Brooks mentioned JAWS, my mind immediately started playing the famous theme from the 1975 shark movie, only then learning that JAWS also refers to a computer screen reader program that lets blind folks read the screen via either text-to-speech output or a refreshable Braille display.

Assumptions become reality

One of the most impactful things Dr. Brooks taught me is that if you never interact with people with disabilities, your assumptions become reality. Before meeting Dr. Brooks, I didn’t know how to interact with a blind person. For example, I wasn’t sure how to ask for his signature on some papers, but when I did so, he cheerily asked me to lay down a credit card on the signature line so that he could find the right place to sign.

My point is that if even as a disabled person I understood so little about the disability world, I’m likely not the only one. The disability community is not a monolith. Each type of disability creates its own challenges and special needs when it comes to accessing technology. That’s why Global Accessibility Awareness Day is so critical. Its goal is to help us all be more aware of the obstacles faced by members of the disabled community and to work together with them to develop and improve those technologies that could benefit their lives.

I am emphasizing the word with because we shouldn’t create things for a particular disabled community without their input. No matter how great the technology may be, that approach is inherently exclusionary. Only the disabled person lives their experience, so their insights are irreplaceable in developing those technologies.

Nothing about us, without us

The motto “Nothing about us without us” originated with the South African disability rights movement in the 1990s. Since then, it has become a call to action for activists around the world organizing to empower persons with disabilities to take control of decisions affecting their lives. Stigma and stereotypes, including the belief that persons with disabilities are incapable of contributing to society, continue to present significant barriers to persons with disabilities exercising their rights and participating in the world around them. In addition to the development of assistive technologies, the slogan also applies to the ability to access technology.

GAAD reminds us to analyze our assumptions, challenge them, and meet people with disabilities with an open mind. By encouraging everyone to become aware of the challenges faced by disabled persons and to work with us to learn about and improve the technologies we rely on, and create opportunities for equitable access, we open an untapped pool of talented people with remarkable abilities who are willing and able to change the world.

Accessibility at HashiCorp

HashiCorp is committed to digital accessibility for people with disabilities. We are continually improving our products’ user experience for everyone, and striving to apply relevant accessibility standards and regulations as appropriate. Here is the HashiCorp accessibility statement. In addition, HashiCorp has Helios, an open source, accessibility-focused design system that powers all of our products in a beautiful, thoughtful way. You can learn more about Helios at the project’s homepage and in this blog post: Introducing Helios, HashiCorp’s new design system.

from HashiCorp Blog https://ift.tt/OHfkajc
via IFTTT

Welcome the New 2024 Citrix Technology Advocates (CTAs)!

At Citrix, building the industry’s most capable end-to-end solution for secure app delivery isn’t enough on its own. Product is one thing, but it also takes people. An ecosystem of great, technical champions to help spread the word about how Citrix solves real-world IT challenges across industries, allows admins to do more while spending less, and perhaps most importantly, deliver a phenomenal end user experience that fuels productivity. These accredited individuals are known as Citrix Technology Advocates or CTAs and can be anyone within the world of Citrix – customers, partners, or employees. They openly share original and existing content through blogs, events, webinars, social media, and other channels.

Who am I? Many of you may know me from one of my previous roles at Citrix through the years. I’m a 16+ year veteran who recently took over the responsibility of the CTA and CTP Programs (among other responsibilities). I’ve published dozens of technical articles and blogs, created countless videos, presented at in-person and virtual events, and helped to spread the word of “why Citrix?” anyway I knew how. I know first-hand the time and dedication it takes to advocate our technology stack and I’m humbled to lead this passionate group of individuals. I will do everything possible to help empower the group to do what they do best – evangelizing the industry’s leading secure app delivery platform – Citrix.

Each year we open up applications to consider new CTA candidates. The response this year was very strong and I’d like to personally thank everyone who applied. I’m super excited to welcome the 9 individuals below into the CTA Program for 2024. These individuals were chosen based on their technical evangelism of Citrix solutions, alignment to program goals, and peer feedback from current program members. Congratulations to you all! Please take a moment to reach out to these individuals on social media to celebrate their induction and recognition. 

Alexander Kafedzhiev

Amir Trujillo

Andrew Scott

Balint Oberrauch

Brian Leffler Kruse

Daniel Madsen

Hanessa Milaszewski

Jeff Riechers

Steven Gallagher

• United Kingdom
• Principal Product Marketing Manager at Citrix
• Technologies: Apps and Desktops, Cloud, APIs, Analytics
• Industries: Finance, Education, Manufacturing, Government, Healthcare, Energy, Retail, Security
• https://www.linkedin.com/in/gallaghersteven/ 
• https://www.citrix.com/blogs/author/stevengal/ 

Current CTAs

Individuals below are renewed within the CTA Program for the 2024 calendar year. Thank you all for your amazing evangelism and advocacy of Citrix technologies!

Aavisek Choudhury, Alain Assaf, Amal K Abraham, Andy McCullough, Ben Splittgerber, Björn Müller, Bram Wolfs, Carl Behrent, Chris Jeucken, David J. Sharp, David Salvatore, Deniz Pekdas, Dennis Mohrmann, Dennis Span, Gavin Strong, Gerjon Kunst, Greg Tiber, Jake Walsh, James O’Regan, Jan Hendrik Meier, Jane Cassell, Jani Anttila, Jani Kohonen, Javier Lopez Santacruz, Jeremy Saunders, Johannes Norz, John Billekens, Johnny Ma, Jon Bucud, Jonathan Pitre, Jonathan Rullan, Kapil Kumar Singh, Kev Howell, Kris Davis, Lyndon-Jon Martin, Mani Kumar, Marco Hofmann, Marco Klose, Matthew Allen, Micheál O’Dea, Owen Reynolds, Preston Gallwas, Ray Davis, Ronnie Hamilton, Ruud Hund, Silvio Balduzzi, Sjoerd van den Nieuwenhof, Steve Elgan, Steve Noel, Steven Lemonier, Steven Wright, Stuart Donnelson, Tiffanny Renrick, Timco Hazelaar, Uddave Jajoo, Wendy Gay, 

For a full list of all current awardees, please visit the CTA awardees page. More information about the program is available on the CTA Program page. If you think you have what it takes to join the CTA Program, look for the 2025 Class application blog coming later this year.

from Citrix Blogs https://ift.tt/mZ4SdNz
via IFTTT

Payload Trends in Malicious OneNote Samples

This post is also available in: 日本語 (Japanese)

Executive Summary

In this post, we look at the types of embedded payloads that attackers leverage to abuse Microsoft OneNote files. Our analysis of roughly 6,000 malicious OneNote samples from WildFire reveals that these samples have a phishing-like theme where attackers use one or more images to lure people into clicking or interacting with OneNote files. The interaction then executes an embedded malicious payload.

Since macros have been disabled by default in Office, attackers have turned to leveraging other Microsoft products for embedding malicious payloads. As a result, malicious OneNote files have grown in popularity. The OneNote desktop app is included by default in Windows in Office 2019 and Microsoft 365, which can load malicious OneNote files if someone accidentally opens one.

We find that attackers have the freedom to embed either text-based malicious scripts or binary files inside OneNote. This offers them more flexibility compared to traditional macros in documents.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

Table of Contents

Background
Methodology
Payload Types and Average Size Distribution
Presence of Images in Malicious OneNote Samples
Analysis of an Embedded EXE Payload
Conclusion
Indicators of Compromise
Additional Resources

Background

Microsoft OneNote is a digital note-taking application that is part of the Microsoft Office suite. A OneNote file is essentially a digital notebook where people can store various types of information.

Additionally, Microsoft OneNote allows people to embed external files, enabling them to store files such as videos, images or even scripts and executables. However, Microsoft has started blocking embedded objects with certain extensions that are considered dangerous within OneNote files running on Microsoft 365 on Windows.

However, attackers often abuse the ability to embed objects by planting malicious payloads. Malicious OneNote samples typically disguise themselves as legitimate notes, often including an image and a button.

Attackers use images to draw people’s attention, and they rely on unsuspecting people clicking buttons to launch malicious payloads. This technique is popular for payload delivery as it leverages people’s trust in legitimate note-taking applications.

Figures 1, 2 and 3 show three different varieties of malicious OneNote samples with different types of embedded images and buttons. By hovering over the fake button, we can see the location and type of the payload planted in the OneNote file.

In Figure 1, the malicious OneNote sample asks the target to click on the view button to see the “protected” document. Upon doing so, a malicious VBScript file executes.

Figure 1. OneNote sample with embedded malicious VBS.

Similarly, Figures 2 and 3 show malicious OneNote documents with fake buttons that entice victims to execute an embedded EXE payload and an Office 97-2003 payload, respectively.

Figure 2. OneNote sample with embedded malicious EXE file.

Figure 3. OneNote sample with embedded malicious Office 97-2003 file.

Methodology

As mentioned above, attackers mostly abuse OneNote files for malicious payload delivery. To do so, they tend to embed a few specific payload types such as the following:

• JavaScript
• VBScript
• PowerShell
• HTML application (HTA)

Despite the different file types, these payloads often show similar behaviors and aim to achieve the same malicious objectives. However, we won't delve into the entire attack and infection chain, as we have covered this in a previous article on malicious OneNote attachments.

The telltale sign of a malicious OneNote file is the presence of embedded objects. While benign OneNote files can also contain embedded objects, malicious OneNote files almost invariably include them.

According to Microsoft, files embedded in OneNote start with a specific globally unique identifier (GUID) tag:

• {BDE316E7-2665-4511-A4C4-8D4D0B7A9EAC}

This GUID indicates the presence of a FileDataStoreObject object. The GUID is then followed by the size of the embedded file.

The actual embedded file follows 20 bytes after the aforementioned GUID tag and will be as long as the defined size. For example, in Figure 4 below:

• Box 1 represents the embedded object GUID tag
• Box 2 indicates the size of the embedded object
• Box 3 represents the actual embedded object

Figure 4. Identification of embedded objects in a OneNote file.

Payload Types and Average Size Distribution

As illustrated in Figure 5, attackers predominantly use the following seven file types for their OneNote payloads:

• PowerShell
• VBScript
• Batch
• HTA
• Office 97-2003
• EXE
• JavaScript (this file type is the most commonly used)

Figure 5. Distribution of payload types embedded in malicious OneNote files.

We also extracted and noted the size of each payload type, as shown in Figure 6.

Figure 6. Average sizes of payloads found in malicious OneNote samples grouped by payload type.

While larger binary embedded payloads such as EXE and Office 97-2003 are more capable, attackers tend to use them less often (as shown in Figure 5) because they increase the overall size of the OneNote sample. Attackers tend to prefer a smaller overall file size, as smaller-sized malware is easier to include in common malware delivery mechanisms such as email attachments, thus raising less suspicion.

As illustrated in Figure 6 above, embedded malicious EXE and Office 97-2003 file payloads tend to be larger, and embedded malicious HTA and JavaScript files tend to be smaller.

Presence of Images in Malicious OneNote Samples

Attackers creating malicious OneNote lures use images that look like buttons to trick people into launching harmful payloads. We mapped out the number of images in each malicious OneNote sample with the payload type, and then calculated the median number of images.

In analyzing the 6,000 samples in our dataset, we found that all but three (99.9%) of the malicious OneNote samples contained at least one image. Since almost all of the samples contain at least one image, we can confirm our hypothesis that OneNote samples are primarily used as phishing vehicles.

Figure 7 shows that the median number of images per payload type is two. For instance, attackers could use both a fake button and an attention-grabbing image like a fake “secure” document banner to make their phishing campaign more believable (such as in Figure 3).

Figure 7. Median image count for different payload types embedded in OneNote malware grouped by payload type.

The chart above demonstrates that two to three images typically accompany payloads in malicious OneNote samples, some used to make the document more believable and some serving as fake buttons.

Analysis of an Embedded EXE Payload

While our previous research examined OneNote samples that carry the more common and popular payload types, such as PowerShell or HTA, EXE payloads have gotten less attention. In this section, we will analyze a OneNote sample with an embedded EXE payload.

The payload below is extracted from a OneNote sample with the following SHA256 hash:

• d48bcca19522af9e11d5ce8890fe0b8daa01f93c95e6a338528892e152a4f63c

The payload itself has the following SHA256 hash:

• 92d057720eab41e9c6bb684e834da632ff3d79b1d42e027e761d21967291ca50

Figure 8 shows our analysis of the EXE payload in IDA Pro. We found a handful of code blocks, which often signal that we might be dealing with shellcode.

Our assumption was confirmed by the existence of GS:60, which points to the Process Environment Block (PEB) and the rotate right (ROR) instruction. This indicates that the malware is using dynamic address resolution for functions and hashing for function identification.

Figure 8. EXE payload opened in IDA.

To get an understanding of the objective of the shellcode and identify the libraries it was dynamically loading, we opened it in the x64dbg debugger. We then put a breakpoint at the function that repeatedly calls the loc_140004021 function block in a loop, as shown in Figure 9.

Figure 9. Breakpoint set to identify the functions that are being dynamically loaded.

The combination of the WSAStringToAddressA function (shown in Figure 10) and WSASocketW functions (shown in Figure 11) makes it clear that the shellcode is attempting to send or receive data by establishing a network socket.

Figure 10. Function name WSAStringToAddressA recorded in the RSI register.

Figure 11. Function name WSASpclertW recorded in the RSI register.

Since reverse TCP shells are the most common type of shellcode used for connecting back to the attacker's machine, we set up breakpoints in ws2_32.dll (shown in Figure 12) to determine whether the connect function is called. And if so, we could extract the arguments passed down to it. These arguments often have the IP address and port number to which the payload attempts to connect.

Figure 12. Breakpoint set at function connect in ws2_32.dll.

As expected, the shellcode stopped at the connect function call. Upon dumping the values of the RDX register, we were able to identify the contents of the sockaddr_in struct, as shown in Figure 13.

Figure 13. Content of sockaddr_in struct dump.

As shown in Figure 14, we then wrote a Python script to unpack the content of the sockaddr_in structure identified above.

Figure 14. Python script unpacking content of sockaddr_in struct.

Executing the above Python script gave us the output shown in Figure 15, indicating the attacker is connecting to a local machine on port 4444, potentially to an attacker-controlled machine.

Figure 15. IP address and port the payload is connecting to.

Conclusion

We conclude that OneNote as an attack vector is more versatile than we initially thought. It can carry executable payloads, in addition to script-based downloaders. Also, like many other file types, attackers can use it for lateral movement.

When embedding malicious payloads inside OneNote files, attackers mainly leverage JavaScript, PowerShell, Batch and VBScript. However, attackers occasionally use binary payloads such as executables or even Office 97-2003 files to achieve their objectives.

Organizations can consider blocking embedded payloads with dangerous extensions within OneNote files to protect their users against such attacks. More broadly, we recommend people limit their exposure by checking the embedded payload filenames and extensions in OneNote files by hovering over any buttons or images before clicking them.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

Indicators of Compromise

The following are links to our Github repository containing file hashes for the OneNote files and payloads discovered during our research for this article.

Additional Resources

 

Get updates from
Palo Alto
Networks!

Sign up to receive the latest news, cyber threat intelligence and research from us

from Unit 42 https://ift.tt/T1vNhFR
via IFTTT