Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Infected Devices. Show all posts
Windows
DDOS Attacks Infected Devices Linux malware Safety Security Windows

This New Chaos Malware Infects Windows & Linux Devices for DDoS Attacks

 

Lumen Technologies' threat intelligence team, Black Lotus Labs, has issued a warning about Chaos, a new variant of the Kaiji distributed denial-of-service (DDoS) botnet that targets enterprises and large organisations. 

The Golang-based Kaiji malware is presumed to be of Chinese origin and emerged in early 2020, targeting Linux systems and internet of things (IoT) devices via SSH brute force attacks. By mid-2020, the threat had expanded to include Docker servers. The recently discovered Chaos malware, like Kaiji, is written in Go and uses SSH brute force attacks to infect new devices. 

Additionally, it targets known vulnerabilities and infects with stolen SSH keys. The threat is compatible with multiple architectures, including ARM, Intel (i386), MIPS, and PowerPC, and it can run on both Linux and Windows, according to Black Lotus.

Chaos establishes persistence and connects to an embedded command and control (C&C) server after infecting a device. Following that, it receives staging commands, such as starting propagation via known CVEs or SSH or starting IP spoofing. The malware first creates a mutex on infected Windows systems by binding to a UDP port that it hides from the analysis. If the binding fails, the malware's process terminates.

After the initial set of staging instructions, Black Lotus Labs observed numerous additional commands being sent to bots. These commands would result in new propagation attempts, additional compromise of the infected device, DDoS attacks, or crypto-mining.

Chaos can also build a reverse shell on the target device by using an open-source script designed to run on Linux-native bash shells, allowing the attackers to upload, download, or modify files. From mid-June to mid-July, Black Lotus Labs observed hundreds of unique IP addresses representing Chaos-infected devices, followed by an increase in new staging C&C servers in August and September. The majority of infections occur in Europe, North and South America, and Asia-Pacific (but not Australia or New Zealand).

In September, the botnet was spotted launching DDoS attacks against the domains or IP addresses of over 20 organisations. The entities targeted are from various industries, including entertainment, finance, gaming, media, and hosting. It was also seen targeting DDoS-as-a-Service providers and a cryptocurrency mining exchange.

 Black Lotus Labs concluded, “Not only does it target enterprise and large organizations but also devices and systems that aren’t routinely monitored as part of an enterprise security model, such as SOHO routers and FreeBSD OS. And with a significant evolution from its predecessor, Chaos is achieving rapid growth since the first documented evidence of it in the wild.”
Read more »
Users
Android Devices Infected Devices malware Spyware Tools Users

7-year Android Malware Campaign Targeted Uyghurs: Report

 

A long-running surveillance and espionage campaign targeting one of China's largest ethnic minority groups has been revealed by researchers. Palo Alto Networks discovered the "Scarlet Mimic" group in 2016, which was initially spotted targeting Uyghur and Tibetan rights activists. 

Although the Chinese government has long oppressed and spied on these and other minority groups in the country, no direct attribution of this group's activities to Beijing is currently available. Check Point explained in a new report this week that Scarlet Mimic's mobile malware dates back to 2015. 

“The malware is relatively unsophisticated from a technical standpoint. However, its capabilities allow the attackers to easily steal sensitive data from the infected devices, even perform calls or send an SMS and track their location in real-time,” said Check Point.

“This makes it a powerful and dangerous surveillance tool. This tool also allows audio recording of incoming and outgoing calls, as well as surround recording.”

It has since identified 20 variants of the MobileOrder Android spyware, the most recent of which was discovered in mid-August of this year.

“The malware is relatively unsophisticated from a technical standpoint. However, its capabilities allow the attackers to easily steal sensitive data from the infected devices, even perform calls or send an SMS and track their location in real-time,” said Check Point.

“This makes it a powerful and dangerous surveillance tool. This tool also allows audio recording of incoming and outgoing calls, as well as surround recording.”

The malware is thought to be hidden in applications with Uyghur-language titles and disguised as PDF documents, photos, or audio. According to Check Point, it is spread through social engineering rather than being made available on the Google Play Store.

“When the victim opens the decoy content, the malware begins to perform extensive surveillance actions in the background. These include stealing sensitive data such as the device information, SMS messages, the device location, and files stored on the device,” the report continued.

“The malware is also capable of actively executing commands to run a remote shell, take photos, perform calls, manipulate the SMS, call logs and local files, and record the surround sound.”

Check Point advised anyone who might be a victim of this campaign to install anti-malware software on their device, use a VPN, and avoid clicking on suspicious links.

"Scarlet Mimic seems to be a politically motivated group. In the past, there have been reports from other researchers that it could be linked to China,” the vendor concluded.

“If true, it would make these surveillance operations part of a much wider issue, as this minority group has reportedly been on the receiving end of attacks for many years.”

This week, Beijing is on the defensive at the United Nations after a long-awaited report from the UN Human Rights Office confirmed evidence of serious human rights violations against Uyghur and other ethnic minority groups in Xinjiang.
Read more »
Infected Devices
Android Android devices Botnet Cyber Attacks DDOS Attack Infected Devices

Turkish National Charged for DDoS Attack on U.S. Company

 

Authorities in the United States charged a Turkish national for launching distributed denial-of-service (DDoS) assaults against a Chicago-based multinational hospitality company using a now-defunct malware botnet. 

Izzet Mert Ozek, 32, is accused of launching attacks against the Chicago multinational in August 2017 using WireX, a botnet developed using Android malware. 

According to authorities, Ozek's attacks caused infected Android devices to transmit massive volumes of online traffic to the company's public website and online booking service, leading servers to crash. As per the news release from the US Department of Justice, the charges were announced on September 29 in the Northern District of Illinois. 

The press release stated, “In August 2017, IZZET MERT OZEK used the WireX botnet, which consisted of compromised Google Android devices, to direct large amounts of network traffic to the hospitality company’s website, preventing legitimate users from completing hotel bookings, according to an indictment returned Tuesday in U.S. District Court in Chicago. The hospitality company, which managed luxury hotels and resorts, was headquartered in Chicago and the servers for its website were located in northern Illinois.” 

“The indictment charges Ozek, 32, with one count of intentionally causing damage to a protected computer. Ozek is believed to be residing in Turkey, and a warrant for his arrest will be issued.” 

The official statement and indictment do not specify whether Ozek developed the WireX botnet himself or bought it from a third party. The botnet, which was created just a month before in July 2017, soon grew to gigantic size of more than 120,000 bots after its creator attacked Android smartphones with fraudulent Android apps. 

Months after the disastrous Mirai malware attacks at the end of 2016, the cyber-security industry responded quickly to eliminate the emerging danger while it was still in its early phases. 

A coalition of security firms, including Akamai, Cloudflare, Flashpoint, Google, Dyn, RiskIQ, and Team Cymr, launched an investigation weeks after the attack on the Chicago multinational company to track WireX’s bots and backend infrastructure and then seize and take down its command and control systems.
Read more »
Source Code
Botnet C&C Check Point Dark Web Infected Devices malware Source Code

Phorpiex Malware has Shut Down their Botnet and Put its Source Code for Sale

 

The Phorpiex malware's creators have shut down their botnet and are selling the source code on a dark web cybercrime forum. The ad states that none of the malware's two original authors are participating in maintaining the botnet, which is why they opted to sell its source code. It was posted on 27th August by an individual previously associated with the botnet's operation. 

Phorpiex, a long-running botnet notorious for extortion schemes and old-school worms delivered via removable USB drives and instant messaging programmes, has been broadening its architecture in recent years in order to become more durable and deliver more deadly payloads. 

These operations had extended to encompass bitcoin mining, which had previously included extortion and spamming. Researchers have noticed an upsurge in data exfiltration and ransomware delivery since 2018, with the bot installer releasing malware such as Avaddon, Knot, BitRansomware (DSoftCrypt/ReadMe), Nemty, GandCrab, and Pony, among others. 

“As I no longer work and my friend has left the biz, I’m here to offer Trik (name from coder) / Phorpiex (name fomr AV firms) source for sell [sic],” the individual said on Friday in a forum post spotted by British security firm Cyjax. 

The ad's legitimacy was confirmed by Alexey Bukhteyev, a malware reverse engineer for security firm Check Point. “The description of the malware is very similar to what we saw in the code,” Bukhteyev said. The malware's command and control (C&C) servers have been inactive for approximately two months, according to the researcher, who previously researched the Phorpiex virus in 2019. 

The last command the bot received from the Phorpiex C&C servers was on July 6, 2021, according to Bukhteyev, who has been running a phoney Phorpiex bot in order to spy on its operations. The command was a self-explanatory "SelfDeletion" instruction. The botnet appears to have vanished from open-source reports since then. 

"As we know, the source code is private and hasn’t been sold before. Therefore, this [forum ad] looks really believable,” Bukhteyev said. “However, we can be totally sure if we buy it. The binaries are quite straightforward, and we can easily confirm that the source code is for this bot indeed, if we get it."

Even if the botnet C&C servers are down, Bukhteyev warns that if someone buys the code, they can set up new ones and hijack all the already infected systems.
Read more »
Russian Hackers
Infected Devices malware Russian Hackers

Cisco Warns Of a Suspected Russian Plan to Attack Ukraine



Cisco CEO Chuck Robbins.

The U.S. government said on Wednesday that it would look to wrestle a huge number of infected routers and storage gadgets from the control of the so-called hackers against whom the security researchers had cautioned that they were intending to utilize the "botnet" to attack Ukraine.

A federal judge in Pennsylvania gave the FBI, consent to seize an internet domain that experts charge a Russian hacking group known as Sofacy was utilizing to control the infected gadgets.

The order enables them to guide the gadgets to effectively communicate with a FBI-controlled server, which will be further utilized to query location to pass on to experts around the world who can remove the malware from the infected hardware.

 “This operation is the first step in the disruption of a botnet that provides the Sofacy actors with an array of capabilities that could be used for a variety of malicious purposes, including intelligence gathering, theft of valuable information, destructive or disruptive attacks, and the misattribution of such activities,” Assistant Attorney General for National Security John Demers said in a statement.

. The U.S. government declared the takedown exertion after Cisco System Inc (CSCO.O) at an opportune time on Wednesday discharged a report regarding the hacking campaign that it said focused solely on gadgets from Linksys, MikroTik, Netgear Inc (NTGR.O), TP-Connection and QNAP.

The majority of infections from the VPN Filter malware were in Ukraine, which led Cisco to believe that Russia was planning an attack on that nation. Cisco even imparted the technical details to the United States and Ukraine governments and in addition to the rivals who offer security software, equipment and services.




Cisco Systems Inc43.57
CSCO.ONASDAQ
+0.00(+0.00%)

CSCO.O
  • CSCO.O
  • NTGR.O



Ukraine's SBU state security service reacted to the report by saying that it demonstrated that Russia was preparing a large-scale cyber-attack before the Champions Leagues soccer last, due to be held in Kiev on Saturday. Cyber security firms, governments and corporate security teams closely monitor occasions and events in Ukraine, where a portion of the world's most expensive and ruinous cyber-attacks have been propelled.

In addition to this, Russia has denied assertions by countries including Ukraine and Western cyber security firms that it is behind a massive worldwide hacking program that has included endeavors to target and harm Ukraine's economy and meddling in the 2016 U.S. presidential election.

Read more »
Subscribe to: Posts (Atom)