Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label FortiGuard. Show all posts
ThirdEye infostealer
FortiGuard FortiGuard Lab Fortinet Infostealer malware Open System information ThirdEye ThirdEye infostealer

ThirdEye: New Infostealer is Targeting Open System Information


FortiGuard Labs recently noted some suspicious-looking files during their cursory review. An investigation of the issue revealed the files were in fact malicious. This infostealer has been labeled as the “ThirdEye”.

While not particularly sophisticated, this malware is made to take different pieces of data from infected devices that can be used as a foundation for more attacks.

The ThirdEye 

The investigation on the infostealer began when the FortiGuard Lab researchers noticed an archive file named “Табель учета рабочего времени.zip” (English trans. “time sheet”). The zip file included two files immediately identified as “up to no good.”

Both files contain a double extension (.exe followed by a different document-related extension). One of the files is "CMK равила oормлени олнин листов.pdf.exe," which is an executable rather than a document and is labeled "QMS Rules for issuing sick leave" in English. f6e6d44137cb5fcee20bcde0a162768dadbb84a09cc680732d9e23ccd2e79494 is the file's SHA2 hash value.

The ThirdEye info stealer has comparatively simpler functionality. It contains a variety of system information based on compromised machines, like BIOS and hardware data. Additionally, it lists ongoing processes, folders and files, and network data. All of this information is gathered by the malware once it has been run, and it then sends it to its command-and-control (C2) server, which is located at (hxxp://shlalala[.]ru/general/ch3ckState). As compared to other infostealers, this one does nothing else.

An interesting string sequence unique to the ThirdEye infostealer family is the “3rd_eye”, which it decrypts and combines with another hash value to identify itself to the C2.

The second file in the archive is the “Табель учета рабочего времени.xls.exe”, which has the same name as its parent file. This file is a variant of the ThirdEye infostealer, created to achieve the same functions as f6e6d44137cb5fcee20bcde0a162768dadbb84a09cc680732d9e23ccd2e79494.

While there is no substantial evidence that could confirm that the ThirdEye infostealer was used in attacks, the malware however is created to steal valuable information from compromised machines, in order to have a better understanding of potential targets, and narrowing them down further. Moreover, there are speculations that the info stealer’s victims will be subject to future cyberattacks.

Since ThirdEye is not yet under the ‘severe’ radar, the FortiGuard investigation found that the threat actors involved have put efforts into strengthening the infostealer, such as recent samples collecting more system information compared to older variants, and it is anticipated to improve further.

Read more »
Training program
Cyber defense Cyber Security Cybersecurity awareness cybersecurity solutions FortiGuard Fortinet Training program

Cybersecurity Defense: Employee Cybersecurity Awareness Now a Priority


Fortinet’s FortiGuard Labs, in their recent reports, discovered that ransomware threats are still at the top of the list in terms of cyber threat, with the cases only growing on a global level. Likewise, Fortinet discovered that in 2022, 84% of firms faced one or more breaches.

The research by Fortinet reveals that more than 90% of the cybersecurity experts agree that the surging frequency of cyberattacks can be reduced if organizations focus on increasing their employees’ cybersecurity awareness.

The report emphasizes the critical role of employees in serving as an organization's first line of defense in defending their firm from cybercrime as it becomes more common for businesses to confront cyber threat incidents.

Lack of Cybersecurity Awareness Among Employees

The report further revealed that among all the organizations surveyed, 81% of them confirmed to have experienced at least one cyber incident, be it malware, phishing or password breach over the course of last year. Most of the attacks were primarily targeted at organization’s employees, who apparently has access to the firm’s systems. This emphasizes how a company's employees could either be its weakest link or one of its strongest defenses.

Nearly 85% of the organization leaders claims that their organization has adequate security awareness and training program provided to its employees. However, 50% believed that their employees, regardless of the training programs still lack a proper cybersecurity knowledge.

This variation shows that the existing training programs may not be as successful as they could be, leading to inconsistent use of appropriate cyber hygiene measures by staff, or that instruction may not be effectively reinforced.

Board of Directors Prioritizing Cybersecurity 

Given the fact that many of these cyber-attacks are targeted to users, it is likely that boards already recognize—or will do so soon—that employee cybersecurity awareness is an essential component of the "defense equation". 93% of businesses said their board of directors often questions them about their cyber security and strategy.

John Maddison, EVP of Products and CMO at Fortinet says, “Our 2023 Security Awareness and Training Global Research Brief underscores the crucial role employees play in preventing cyberattacks. It also highlights the critical need for organizations to prioritize security awareness and training services to ensure employees serve as the first line of defense.”

One of the best solutions to avoid cybersecurity incidents an organization can adopt is by conducting better training program, setting the groundwork for a culture of cybersecurity that is ready and strong. This way, employees would attain a better cyber-risk awareness and further encourage them to defend their organization whenever the situation calls.

Organizations are aware that they require sophisticated cybersecurity solutions and that technological certifications help their IT employees' cybersecurity skills. Employee awareness may not have gotten the full attention it deserves up to this point, but it may become crucial in the years to come in the fight against cybercrime.  

Read more »
Windows
Botnet Cyber Security Endpoint FortiGuard IoT devices Protocol Windows

Several Security Breaches Exploited by Zerobot Botnet

 

FortiGuard Labs discovered a special botnet named Zerobot that was seen in the field spreading by exploiting nearly twenty security flaws in IoT devices or other programs.

Prior to downloading a script for further propagation, Zerobot targets multiple vulnerabilities to obtain access to a device. Zerobot targets several different architectures, such as i386, amd64, arm, mips, mips64, mipsle, ppc64, ppc64le, riscv64, and s390x. Zero is the filename used to save the bot.

On November 18, 2022, the malware made its first public appearance, mostly affecting Windows and Linux-powered computers.

Prior to November 24, the first one was simply equipped with the most fundamental features. The newest version now has a 'selfRepo' module that allows it to replicate itself or infect more endpoints using various protocols or security holes.

The bot connects the remote command-and-control (C2) server after infecting the machine and waits for further instructions. There are 21 exploits in Zerobot.This includes flaws affecting,  Spring Framework, D-Link DNS-320 NAS, Hikvision cameras, FLIR AX8 thermal imaging cameras, Zyxel firewalls, TOTOLINK routers, and F5 BIG-IP.

"The botnet includes a variety of modules, including assaults for various protocols, self-replication, and self-propagation. This also uses the WebSocket protocol to connect with its command-and-control server." Researcher Cara Lin from Fortinet FortiGuard Labs remarked.

The Go programming language was used to create the new botnet  Zerobot. The WebSocket protocol is used for communication. Users should be alert to this new danger, update any compromised systems connected to their network, and aggressively deploy updates as soon as they become available.




Read more »
TrickBot
Botnet FortiGuard malware Ransomware attack Security Researchers TrickBot

Diavol Ransomware is Linked to Wizard Spider Cybercrime Group

 

The cybercrime group behind the Trickbot botnet, Wizard Spider, has been linked to a new ransomware strain dubbed Diavol, according to FortiGuard Labs security analysts. In early June 2021, Diavol and Conti ransomware payloads were delivered on several systems in a ransomware attack prevented by the company's EDR technology. 

Wizard Spider is a financially motivated criminal group based in Russia that manages the Trickbot botnet, which is used to distribute second-stage malware to infected devices and networks. Because it spreads over corporate networks, Trickbot is especially hazardous to companies. If it gains administrative access to a domain controller, it will also steal the Active Directory database, allowing the organization to harvest even more network credentials.

From the use of asynchronous I/O operations for file encryption queuing to the use of nearly identical command-line options for the same functionality, the two ransomware groups' samples are cut from the same fabric (i.e., logging, drives and network shares encryption, network scanning). Despite the similarities, the researchers were unable to establish a clear relationship between Diavol ransomware and the Trickbot gang, due to some substantial variances that made attribution with high confidence impossible. For example, unlike Conti, Diavol ransomware has no built-in checks to prevent payloads from operating on Russian targets' systems. There's also no proof of data exfiltration capabilities before encryption, which is a classic ransomware extortion method. 

The encryption mechanism used by Diavol ransomware is based on user-mode Asynchronous Procedure Calls (APCs) and an asymmetric encryption algorithm. This distinguishes it from other ransomware families, which frequently employ symmetric methods to accelerate the encryption process. Diavol doesn't employ any obfuscation techniques, such as packing or anti-disassembly, but it nonetheless manages to obfuscate its essential routines by putting them in bitmap images.

When the ransomware executes on a compromised PC, it takes the code from the PE resource section of the pictures and inserts it into a buffer with execution permissions. Before the Diavol ransomware is finished, it will change the background of each encrypted Windows device to a black wallpaper with the following message: "All your files are encrypted! For more information see README-FOR-DECRYPT.txt."

"Currently, the source of the intrusion is unknown," Fortinet says. "The parameters used by the attackers, along with the errors in the hardcoded configuration, hint to the fact that Diavol is a new tool in the arsenal of its operators which they are not yet fully accustomed to."
Read more »
FortiGuard
Cyber Security cybercriminals FortiGuard

“Netbounce” Threat Actor Tries to Evade Detection

 

On the 12th of February, FortiGuard Labs got a solicitation through email from an individual representing an organization called Packity Networks asking to whitelist their software. The sender guaranteed it to be a false-positive that causes a critical effect on their business. At that point, the file at the link was named malevolent only by Fortinet and Dr.Web sandbox. 

Despite the fact that, from the start, the solicitation appeared to be innocent, and basically no other security vendor had flagged the file, FortiGuard said it generally investigates such demands thoroughly before complying. The investigation prompted the disclosure of another group called "Netbounce" and it uncovered their malware delivery infrastructure. What made this stand apart among others is their one-of-a-kind set of tools and techniques. FortiGuard was able to discover a few variations created in-house by this group, each serving a different purpose. 

The background checks directed by FortiGuard on Secured Network Stack and Packity Networks Inc. yielded no outcomes; there were no enrolled organizations or official references to these elements, nor could they discover any employee profiles online. However, based on a Twitter account, Packity appears to have had some online presence other than their site for at least two years, and they found reviews for the software.

Despite the fact that the executables were signed with the same certificate, FortiGuard saw that the certificate was issued with an unrelated email address, session123@me.com. The certificate was issued on September 2nd, 2020, so they looked for more seasoned certificates utilized by Packity and tracked down an older installer. Looking at the more seasoned signature affirmed that the contact data is indeed unrelated to the organization. In spite of the fact that it might appear to be odd that an alternate email was utilized, the new certificate was issued precisely when the previous certificate expired, on September 3rd, 2020, which may indicate it's not vindictive. 

The signature with the new certificate doesn't have a timestamp countersignature. This is highly uncommon when signing code, and the "official" setup file from the site has a timestamp. Along these lines, FortiGuard's suspicions were still not resolved.
Read more »
Subscribe to: Posts (Atom)