Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label threat analysis. Show all posts

Researchers Successfully Sinkhole PlugX Malware Server, Recording 2.5 Million Unique IPs

 

Researchers successfully seized control of a command and control (C2) server linked to a variant of the PlugX malware, effectively halting its malicious operations. Over the span of six months, more than 2.5 million connections were logged from diverse IP addresses worldwide.

Beginning in September 2023, cybersecurity firm Sekoia took action upon identifying the unique IP address associated with the C2 server. Their efforts resulted in the logging of over 2.4 million unique IP addresses from 170 countries, allowing for comprehensive analysis of the malware's spread and the development of effective countermeasures.

The acquisition of the C2 server's IP address, at the cost of $7, was facilitated by Sekoia's researchers. Following this, they gained shell access to the server and set up a mimicry of the original C2 server's behavior. This enabled the capture of HTTP requests from infected hosts and provided insights into the malware's activities.

The sinkhole operation revealed a daily influx of between 90,000 to 100,000 requests from infected systems, originating from various locations worldwide. Notably, certain countries accounted for a significant portion of the infections, with Nigeria, India, China, and the United States among the most affected.

Despite the challenges posed by the malware's lack of unique identifiers and its ability to spread through various means, Sekoia's researchers identified potential strategic interests, particularly in regions associated with China's Belt and Road Initiative.

To address the widespread infection, Sekoia proposed two strategies for disinfection, urging national cybersecurity teams and law enforcement agencies to collaborate. One approach involves sending self-delete commands supported by PlugX, while the other entails the development and deployment of custom payloads to eradicate the malware from infected systems and USB drives.

While the sinkhole operation effectively neutralized the botnet controlled by PlugX, Sekoia warned of the possibility of its revival by malicious actors with access to the C2 server.

PlugX, initially linked to state-sponsored Chinese operations, has evolved into a widely used tool by various threat actors since its emergence in 2008. Its extensive capabilities and recent wormable features pose significant security risks, necessitating collaborative efforts to mitigate its impact.

Security Researchers Establish Connections Between 3AM Ransomware and Conti, Royal Cybercriminal Groups

 

Security researchers examining the operations of the recently surfaced 3AM ransomware group have unveiled strong connections with notorious entities like the Conti syndicate and the Royal ransomware gang.

The 3AM ransomware, also known as ThreeAM, has adopted a novel extortion strategy: publicly revealing data leaks to victims' social media followers and utilizing bots to respond to influential accounts on X (formerly Twitter), directing them to the compromised data.

Initially observed by Symantec's Threat Hunter Team in mid-September, 3AM gained attention after threat actors shifted from deploying LockBit malware. According to French cybersecurity firm Intrinsec, ThreeAM is likely affiliated with the Royal ransomware group, now rebranded as Blacksuit, consisting of former members of Team 2 within the Conti syndicate.

As Intrinsec delved into their investigation, they found substantial overlap in communication channels, infrastructure, and tactics between 3AM and the Conti syndicate. Notably, an IP address listed by Symantec as a network indicator of compromise led researchers to a PowerShell script for dropping Cobalt Strike on VirusTotal.

Further investigation uncovered a SOCKS4 proxy on TCP port 8000, a TLS certificate associated with an RDP service, and HTML content from 3AM's data leak site indexed by the Shodan platform. The servers involved were traced back to the Lithuanian hosting company, Cherry Servers, known for hosting malware despite having a low fraud risk.

Intrinsec's findings aligned with a report from Bridewell, connecting the IP subnet to the ALPHV/BlackCat ransomware operation. This group, not part of the Conti syndicate but allied, was identified as having ties to IcedID malware used in Conti attacks.

In addition to technical details, Intrinsec uncovered 3AM's experiment with a new extortion technique. The gang set up a Twitter account in August, using it to reply to tweets from victims and high-profile accounts, linking to the data leak site on the Tor network. Intrinsec suspected the use of a Twitter bot for a name-and-shame campaign, noting an unusually high volume of automated replies.

Despite 3AM's perceived lack of sophistication compared to Royal, the researchers cautioned against underestimating its potential for deploying numerous attacks. The article concludes with a broader context on the Conti syndicate, its dissolution, and the emergence of affiliated groups like Royal ransomware.