Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Infostealer Malware. Show all posts
US Defense
CyberCrime Cyberhackers Cybersecurity CyberThreat FBI HoneyWell Infostealer Malware Lockheed malware Software US Defense

US Defense Industry Targeted in Infostealer Malware Campaign

 


Several major defence contractors, such as Lockheed Martin, Boeing, and Honeywell, as well as the United States Army, and Navy, and several major defence contractors have been recently revealed to be infected with the Infostealer malware, according to Hudson Rock's recent report. This alarming discovery emphasizes the increasing threats critical national security institutions face due to cybersecurity threats. The report shows that U.S. military agencies have been significantly impacted by these infections. 

The U.S. Army has reported infections among 71 employees, while the U.S. Navy has reported infections among 30 employees, and an additional 551 users have been infected. It has also been reported that the Federal Bureau of Investigation (FBI) has been affected, with 24 employees and 26 users affected. This raises concerns about the possible risk of exposure to sensitive law enforcement and intelligence data, as well. 

Further, the report highlights the extent to which cybersecurity breaches have occurred within the defence contracting industry as a whole. One of the most prominent defence contractors in the country, Lockheed Martin, reported that 55 employees and 96 users had been infected with the virus. Boeing, another major player in the defence industry, reported that 66 employees and 114 users had been infected with the virus. 

Honeywell seems to have the most severe case, as there have been a substantial number of infected employees and 472 infected users. One of the most concerning revelations of the report was the ease at which cybercriminals can steal data. Several illicit cyber marketplaces are offering sensitive data such as login credentials, classified access points, and other sensitive data for purchase for as little as $10, according to an investigation conducted by the FBI.

These findings raise serious national security concerns, as they suggest that adversarial entities could exploit these vulnerabilities and gain unauthorized access to critical defence and intelligence networks that are critical to the nation's security. Infostealer malware is becoming increasingly common in the military and defence sectors, which highlights the urgent need to strengthen cybersecurity measures. This report serves as a stark reminder of how cyber threats are evolving and the need to take proactive measures to safeguard sensitive information from governmental agencies and defence companies. 

Several users affiliated with six major defence contractors are infected with Infostealer malware: Lockheed Martin, BAE Systems, Boeing, Honeywell, L3 Harris, and Leidos. As a result of these companies' efforts, advanced military technology, such as warships, fighter jets, and other critical defence systems, is being developed and manufactured. 

The government's contract with Lockheed Martin will award it $5 billion alone in 2024, which shows that Lockheed Martin is a key player in the defence industry in the United States. Malware infections have exposed corporate credentials in various ways, raising concerns regarding the security of corporate data in general. The firm discovered that 472 third-party corporate credentials were compromised, including those linked to essential enterprise applications such as Cisco, SAP Integrations, and Microsoft systems used by defence contractors. 

Cybercriminals are increasingly targeting supply chain vendors as businesses, government agencies, and organizations become more interconnected as a result of cybercrime. In light of this growing vulnerability, it is clear that an adversary could have access to stolen credentials to breach the supply chain of a defence contractor if they intended to do so. Honeywell's infrastructure was one of the most vulnerable places in the world, which revealed significant security vulnerabilities. According to researchers, Honeywell's internal systems, including the company's intranet, Active Directory Federation Services login, and Identity and Access Management system, had been compromised for several reasons. 

Honeywell employees and employees connected to the company were identified as infected three times over the past decade. An especially concerning case occurred when a single compromised employee was found to have 56 corporate credentials to Honeywell's internal systems, as well as 45 additional credentials from third parties. 

In light of this level of access, unauthorized access to sensitive systems can be scaled up, highlighting the need for strengthened cybersecurity measures, which have become increasingly important in the defence sector due to the growing number of cyber threats. The threat of exploitation of sensitive military and corporate data becomes more sophisticated as time passes, so users must prioritize the protection of these data to prevent further exploitation. 

Having Infostealer malware present within a defence organization raises serious security concerns since each infected employee represents one possible weak point in critical operations within the military and intelligence communities. There is no doubt that these individuals could range from engineers building advanced military artificial intelligence systems to procurement officers who handle classified contracts to defence analysts who have access to mission-critical data. 

As a result of compromised credentials, not only can their login information be exposed, but their entire digital footprint can also be compromised. Several factors could have contributed to further security breaches, such as browsing history, autofill data, internal documents, and session cookies that allow users access to sensitive applications. According to cybersecurity experts, such thefts of data pose a serious national security threat, and they warn against them. 

It is believed by Thomas Richards, a principal consultant at Black Duck, that adversaries could exploit the stolen credentials to gain unauthorized access to highly secure networks so that they could move laterally within the system and compromise additional personnel and infrastructure, allowing them to reach further into the network. If such a breach occurs, affected users should reset their passwords immediately. A comprehensive forensic investigation should be conducted to assess the extent of the compromise and determine whether unauthorized access to classified information has occurred. 

Information stealer computers can be infected by a wide range of sources, making them an extremely persistent and widespread threat to the computer community. A phishing attack, a drive-by download from a compromised website, and even applications that look legitimate, such as an unsuspicious meeting program, are the most frequent sources of these infections. Further, there is a growing awareness that cybercriminals are spreading malware via misleading Google Adwords, YouTube video descriptions, and even pirated software in addition to malicious Google Adwords. According to a recent study, millions of computers have been infected with infostealer malware, emphasizing the urgent need to enhance security measures across critical industries. 

A spokesperson for Hudson Rock, Alon Gal, says that Infostealer malware has infected employees at major U.S. defence contractors as well as the U.S. Army and Navy, as well as government agencies like the FBI and GAO. The threat of cybercriminals targeting individual computers for as little as $10 poses a serious threat to investigative and cybersecurity personnel, and they can be found online for as little as $10. By downloading modified game content, pirated software, or infected documents, employees inadvertently download malware, which is far more effective than using force to gain entry into networks. 

Infostealer malware exploits human error as opposed to forcing entry into networks. Upon entering the system, this malware extracts sensitive information silently, such as VPN credentials, authentication session cookies, e-mail login information, and access to internal development tools, as well as putting not only individual users at risk but also entire defence networks at risk. As well as identifying infections, cybersecurity experts emphasize the importance of addressing how these threats penetrate in users' system. 

Roger Grimes, a cybersecurity expert at KnowBe4, argues that Infostealers are secondary problems—what matters is their initial access, whether it be social engineering, unpatched software, or outdated firmware. Organizations that fail to address these entry points risk much more than a theft of credentials, which is why proactive cybersecurity defences are essential for national security protection.
Read more »
Malware Attack
Cyber Attacks fake ads fake websites Google Google Ads Infostealer Malware Mallicious URLs Malware Attack

Cybercriminals Use Google Ads and URL Cloaking to Spread Malware

 

Cybercriminals are increasingly using Google ads and sophisticated cloaking techniques to push malware onto unsuspecting users. The latest example involves a fake Homebrew website that tricked users into downloading an infostealer designed to steal sensitive data, including login credentials and banking details. Security researcher Ryan Chenkie first noticed the malicious Google ad, which displayed the correct Homebrew URL, “brew.sh,” making it appear legitimate. 

However, once users clicked on the ad, they were redirected to a fraudulent clone hosted at “brewe.sh.” The deception was so convincing that even experienced users might not have spotted the trick before engaging with the site. The technique used in this campaign, known as URL cloaking, allows cybercriminals to manipulate how links appear in ads. According to Google, these attackers create thousands of accounts and use advanced text manipulation to bypass detection by both automated systems and human reviewers. This makes it difficult to catch fraudulent ads before they reach users. 

While Google has since removed the ad and is ramping up its security efforts, the issue highlights ongoing vulnerabilities in online advertising. The malware behind this attack, identified by security researcher JAMESWT as AmosStealer (also known as Atomic), is specifically designed for macOS systems. Developed in Swift, it is capable of running on both Intel and Apple Silicon devices. AmosStealer is a subscription-based malware service, sold to cybercriminals for $1,000 per month. 

Once installed, it can extract browser history, login credentials, bank account details, cryptocurrency wallet information, and other sensitive data. What makes this attack particularly alarming is its target audience. Homebrew is a package manager used primarily by macOS and Linux users, who are generally more tech-savvy than the average internet user. This suggests that cybercriminals are refining their tactics to deceive even experienced users. By leveraging Google’s ad platform to lend credibility to their fake sites, these attackers can reach a broader audience and increase their success rate.  

To protect against such malware campaigns, users should take extra precautions. Checking an ad’s displayed URL is no longer sufficient — verifying the website address after the page loads is crucial. Even a minor change in spelling, such as replacing a single letter, can indicate a fraudulent site. Another effective defense is avoiding Google ads altogether. Legitimate websites always appear in organic search results below the ads, so skipping the top links can help users avoid potential scams. 

Instead of clicking on ads, users should manually search for the company or product name to locate the official website. For those looking to minimize risks from malicious ads, alternative search engines like DuckDuckGo or Qwant offer more privacy-focused browsing experiences with stricter ad filtering. As cybercriminals continue to evolve their tactics, adopting safer browsing habits and remaining vigilant online is essential to avoiding security threats.
Read more »
Python NodeStealer
browser credential theft Credit Card Theft Cybersecurity Threats Facebook Ads Manager Infostealer Malware malvertising campaigns malware Python NodeStealer

Upgraded Python NodeStealer Now Targets Facebook Ads Manager and Steals More Sensitive Data

 

Python NodeStealer, a notorious infostealer previously known for targeting Facebook Business accounts, has now been enhanced with new, dangerous capabilities that allow it to infiltrate Facebook Ads Manager accounts. This upgrade not only boosts its ability to steal more data but also paves the way for even more malicious campaigns.

In an extensive analysis by cybersecurity experts at Netskope Threat Labs, it was revealed that the infostealer is now capable of stealing credit card information in addition to previously targeted browser credentials. 

The new attack vector involves copying the “Web Data” from browsers, a SQLite database containing sensitive data like autofill details and saved payment methods.

“With these, the infostealer can now collect the victim’s credit card information which includes the cardholder’s name, card expiration date, and card number,” the researchers pointed out. To access this information, NodeStealer uses Python’s SQLite3 library to run specific queries on the stolen database, looking for credit card-related data.

The new version of Python NodeStealer also abuses Windows Restart Manager, a tool typically used to manage reboots after software updates. In this case, however, the tool is leveraged to bypass locked database files that contain valuable data. By extracting browser database files into a temporary folder, NodeStealer circumvents file locks, and exfiltrates the data via a Telegram bot.

Most likely developed by a Vietnamese cybercriminal group, Python NodeStealer’s primary targets are Facebook Business and Ads Manager accounts, which are then exploited in malvertising campaigns. Since Facebook’s stringent vetting process for ad purchases typically prevents unauthorized ads, cybercriminals now resort to stealing verified accounts to run their malicious ads instead.
Read more »
Spear Phishing
Business Security Consumer Data Cyber Attacks Infostealer Infostealer Malware Malvertising Malware Campaign Spear Phishing

Marko Polo Infostealer Campaigns Target Thousands Across Platforms

 

The cybercriminal group “Marko Polo” is behind a major malware operation, running 30 infostealer campaigns targeting a wide array of victims. Using techniques such as spear-phishing, malvertising, and brand impersonation, the group spreads over 50 malware payloads, including AMOS, Stealc, and Rhadamanthys, across different sectors like gaming, cryptocurrency, and software. 

According to Recorded Future’s Insikt Group, Marko Polo’s campaigns have compromised thousands of devices globally, posing a significant threat to consumer privacy and business security, with potential financial losses in the millions. The group primarily uses spear-phishing tactics via direct messages on social media, targeting high-value individuals like cryptocurrency influencers, gamers, and software developers. 

They impersonate popular brands such as Fortnite, Zoom, and RuneScape, creating fake job offers and project collaborations to deceive victims into downloading malware. In addition to these impersonations, Marko Polo even fabricates its own brand names like VDeck, Wasper, and SpectraRoom to lure unsuspecting users. The Marko Polo operation is highly versatile, capable of infecting both Windows and macOS platforms. On Windows, they use a tool called “HijackLoader” to deliver malware like Stealc, designed to extract data from browsers, and Rhadamanthys, which targets a wide array of applications and data types. 

Rhadamanthys has also added advanced features, such as a cryptocurrency clipper to redirect payments to the attackers’ wallets, and the ability to evade Windows Defender. When it comes to macOS, the group deploys Atomic (AMOS), an infostealer launched in 2023, which they rent out to cybercriminals for $1,000 per month. AMOS is highly effective at extracting sensitive data stored on macOS systems, such as Apple Keychain passwords, MetaMask seeds, WiFi credentials, credit card details, and other encrypted information. 

The Marko Polo campaign’s widespread nature highlights the dangers of information-stealing malware, and users need to be vigilant against unsolicited links and downloads from unknown sources. One of the most effective ways to protect against such malware is to download software exclusively from official websites and ensure your antivirus software is up-to-date. This ensures the detection of malicious payloads before they can compromise your system. 

Information-stealing malware campaigns are becoming increasingly common, with Marko Polo’s operation serving as a stark reminder of the sophisticated tactics cybercriminals employ today. These stolen credentials often enable hackers to breach corporate networks, engage in data theft, and disrupt business operations. Therefore, cybersecurity awareness and strong preventive measures are crucial for protecting against such malicious activities.
Read more »
Security
Cybersecurity Threats Fickle Stealer Infostealer Malware Safety Security

New Infostealer 'Fickle Stealer' Targets Sensitive Data Using Multiple Distribution Methods

 

Security experts are raising alarms about a new infostealer named Fickle Stealer, which is being disseminated through various techniques across the internet. Fickle Stealer engages in typical malicious activities, such as stealing sensitive files, system information, browser-stored files, and cryptocurrency wallet details. However, what sets Fickle Stealer apart is its construction using the Rust programming language.

"Beyond targeting popular applications, this stealer searches for sensitive files in the parent directories of common installation paths to ensure thorough data collection," stated security researcher Pei Han Liao. "It also fetches a target list from the server, adding flexibility to Fickle Stealer's operations."

According to cybersecurity researchers from Fortinet FortiGuard Labs, Fickle Stealer employs four distinct distribution methods: a VBA dropper, a VBA downloader, a link downloader, and an executable downloader. Some of these methods utilize a PowerShell script that bypasses User Account Control (UAC) mechanisms. This script also transmits system information, such as the device's location (country and city), IP address, operating system version, computer name, and username, to a Telegram bot.

Infostealers are among the most prevalent and disruptive forms of malware, second only to ransomware. They enable cybercriminals to access sensitive services, including banking accounts, social media profiles, and corporate platforms. With access to cryptocurrency wallet data, hackers can transfer funds to their own wallets, effectively stealing any available money. Furthermore, infostealers allow criminals to access email inboxes, leading to phishing attacks, impersonation, identity theft, and potentially ransomware attacks on corporate IT systems.

Securing devices against infostealers involves the same precautions as defending against other types of malware. Users should avoid downloading and running suspicious files and thoroughly verify email attachments before opening them. By adhering to these practices, individuals and organizations can better protect their sensitive data from cyber threats.
Read more »
Session Hijacking Defense
Authentication Cookies cybersecurity solutions Data Protection Measures Infostealer Malware malware Multi-Factor Authentication (MFA) Passkey Security Prevention Session Hijacking Defense

Overcoming the Escalating Challenge Posed by Session Hijacking

 

Businesses are increasingly adopting security measures, from passkeys to multifactor authentication (MFA), to safeguard sensitive information and bolster their cybersecurity. However, it's crucial for security teams to acknowledge that these measures may not provide comprehensive protection for user data.

As enterprises implement new defenses to secure their networks, cybercriminals are simultaneously evolving their tactics to bypass these barriers. They are employing techniques like session hijacking and account takeover to circumvent passkeys and MFA, gaining unauthorized access to corporate systems. This is exacerbated by the fact that these tactics are largely facilitated by malware, which poses a significant challenge to security efforts.

Malware operates swiftly and discreetly, pilfering substantial amounts of accurate authentication data, including personally identifiable information (PII) such as login credentials, financial details, and authentication cookies. Some malware is even beginning to target local key vaults, like those managed by password managers, many of which have implemented passkey solutions. Last year, there were over 4 billion attempted malware attacks, making it the preferred method for cyberattacks. Moreover, SpyCloud's "2023 Annual Identity Exposure Report" revealed that more than 22 million unique devices fell victim to malware, with the stolen data finding its way to criminal networks for use in various attacks.

While malware-exfiltrated data, encompassing business application logins and cookies for crucial systems, is becoming increasingly valuable to criminals, security teams lack the necessary visibility to effectively counter these exposures. Those who comprehend how malware operates and how cybercriminals employ stolen data are better equipped to confront this threat.

Session hijacking commences when infostealer malware, often distributed through phishing emails or malicious websites, exfiltrates device and identity data. When a user logs into a site or application, a temporary authentication token (cookie) is stored in the browser. 

Criminals can import this along with additional details to replicate the user's device and location, gaining access to an authenticated session. This technique is highly effective, even against robust authentication methods, allowing criminals to bypass authentication entirely. This grants them undetected access to sensitive information, enabling further data theft or privilege escalation for targeted attacks like ransomware.

Criminals recognize the potential of session hijacking and have developed tools like EvilProxy and Emotet to target authentication cookies. In the face of a threat that undermines key defenses, corporations must consider innovative approaches to combat cybercrime.

Overcoming the challenge of session hijacking is formidable but not insurmountable. The primary hurdle in defending against infostealer malware-fueled attacks is the malware's ability to avoid detection. 

Newer forms of malware can swiftly siphon data and self-erase, making it challenging for security teams to even detect an attack. Furthermore, infostealer malware can infect personal and contractor devices beyond the usual scope of the security team's oversight, making it exceedingly difficult to identify all instances of exposure.

Fortunately, both of these concerns can be addressed through heightened threat awareness and visibility. Organizations must educate users on infostealers, how to avoid inadvertently downloading them onto devices accessing the corporate network or critical applications, and how to routinely clear cookies from their browsers.

In cases where malware manages to slip through defenses, understanding precisely what information was stolen is crucial. This allows teams to identify compromised user credentials and authentication cookies that require remediation. Simply wiping the infected device is insufficient, as stolen data can be exploited long after the initial infection is resolved. Organizations must pinpoint compromised data and take proactive steps, such as session invalidation and password resets, to sever potential entry points.

Ultimately, a comprehensive malware remediation process hinges on knowing what data was siphoned by infostealer malware. IT teams should prioritize solutions that offer enhanced visibility to address security gaps caused by malware. Armed with this knowledge, teams can take measures to safeguard all exposed assets, including authentication data, preserving the company's reputation and financial well-being.
Read more »
Subscribe to: Posts (Atom)