DarkSide Ransomware Variant Targets Disk Partitions

A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.

Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.

The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of “widespread wormlike activity.”

At the time they found it, researchers believed this ransomware was “seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files,” they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.

This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is “basically a goldmine of network information.”

The DarkSide ransomware is “efficient and well-constructed,” the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.

Read the full Fortinet blog post for more information.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

The Experts Guide to Ransomware Response

More Webcasts

White Papers

Hidden Costs of Endpoint Security

Tech Insights: Detecting and Preventing Insider Data Leaks

More White Papers

Reports

Improving Security by Moving Beyond VPN

Assessing Cybersecurity Risk in Today’s Enterprises

More Reports

The post DarkSide Ransomware Variant Targets Disk Partitions appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/darkside-ransomware-variant-targets-disk-partitions/?utm_source=rss&utm_medium=rss&utm_campaign=darkside-ransomware-variant-targets-disk-partitions

Magecart Goes Server-Side in Latest Tactics Changeup

The latest Magecart iteration is finding success with a new PHP web shell skimmer.
Read More

The post Magecart Goes Server-Side in Latest Tactics Changeup appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/magecart-goes-server-side-in-latest-tactics-changeup/?utm_source=rss&utm_medium=rss&utm_campaign=magecart-goes-server-side-in-latest-tactics-changeup

47% of Criminals Buying Exploits Target Microsoft Products

Researchers examine English- and Russian-language underground exploits to track how exploits are advertised and sold.

RSA CONFERENCE 2021 – Microsoft products accounted for 47% of the CVEs that cybercriminals request across underground forums, according to researchers who conducted a yearlong study into the exploit market.

The research spanned more than 600 English and Russian language forums, said Mayra Rosario Fuentes, senior threat researcher at Trend Micro, who presented some of the findings in her RSA Conference talk “Tales from the Underground: The Vulnerability Weaponization Lifecycle.” Researchers sought to learn which exploits were sold and requested, the types of sellers and buyers involved in transactions, and how their findings compared with their detection systems’.

Researchers scoured advertisements for the sales of exploits from January 2019 through December 2020. They learned Microsoft’s tools and services made up 47% of all requested CVEs on underground forums. Internet-connected products made up only 5%, “but with increased bandwidth of connected devices with the new 5G entering the market, IoT devices will become more vulnerable to cyberattack,” noted Fuentes in her talk.

More than half (52%) of exploits requested were less than two years old. Buyers were willing to pay an average of $2,000 (USD) for requested exploits; however, some offered up to $10,000 for zero-day exploits targeting Microsoft products.

Fuentes shared some examples of these exploit requests. One forum post requested help regarding an exploit for CVE-2019-1151, a Microsoft Graphics remote code execution (RCE) vulnerability that exists when the Windows font library improperly handles specially crafted embedded fonts. Another offered $2,000 for help in exploiting an RCE flaw in the Apache Web server.

When researching forum posts advertising exploits, researchers found 61% targeted Microsoft products. The highest percentage (31%) were for Microsoft Office, 15% were for Microsoft Windows, 10% were for Internet Explorer, and 5% were for Microsoft Remote Desktop Protocol. Fuentes noted exploits for Office and Adobe were most common in English language forums.

A comparison of cybercriminals’ wish lists and sold exploits revealed parallels between the two categories, Fuentes pointed out.

“We noticed what was requested was very similar to what the market was offering,” she said. “Cybercriminals may have seen the requested items from users before deciding what items to offer on the market.”

Microsoft Word and Excel exploits “dominated” in both categories, Fuentes continued, digging into the broader Office category. Word and Excel made up 46% of exploits on criminals’ wish lists and 52% of exploits advertised on underground forums.

The Life Cycle of Underground Exploits
Fuentes discussed how exploits are developed and sold, starting from the beginning. An exploit may first be developed by an attacker, who sells it and it’s then used in the wild. From there, it is usually disclosed publicly and patched by the vendor. This may end the exploit’s life cycle, or it will continue to be offered for sale on Dark Web forums.

There are multiple types of sellers, she noted. An experienced seller with at least five years of experience might sell a couple of zero-day or one-day exploits per year with prices ranging from $10,000 to $500,000. Some sellers are disgruntled with bug bounty programs due to long response times or payouts lower than expected – Fuentes noted most people were happy with bug bounty experiences, but those who weren’t may sell exploits on underground forums.

Other “bounty sellers” may have cashed in on the maximum amount of bounty submissions for the year, or they may offer to buy exploits they can use to cash in on bug bounty programs. There are some who find exploits that other people developed and sell them as their own.

Some sellers advertise “exploit builder” subscription services ranging from $60 for one month, to $120 for three months, to $200 for six months. The packages include a range of different types of exploits, along with “free updates” and “full support” for criminal buyers, she noted.

While zero-days may fetch a higher price, many exploits sold on the underground targeted older systems. Researchers found 22% of exploits sold were more than three years old, and 48% of those requested were older than three years. The oldest vulnerability discovered was from 1999, Fuentes said, adding the average time to patch an Internet-facing system is 71 days.

Older vulnerabilities requested included CVE-2014-0133 in Red Hat and CVE-2015-6639 in Qualcomm. Those sold included Microsoft CVE-2017-11882, a 17-year-old memory corruption issue in Microsoft Office, along with Office vulnerability CVE-2012-0158 and CVE-2016-5195, a Linux kernel vulnerability dubbed Dirty Cow that sold for $3,000 on the underground, she said.

“The longevity of a valuable exploit is longer than most expect,” Fuentes said. “Patching yesterday’s vulnerability can be just as important as today’s critical one.”

Trend Micro will release a report with the full findings in a few weeks, she noted.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

The Experts Guide to Ransomware Response

Multi-Cloud Data Management for Modern Applications

More Webcasts

White Papers

The Definitive Buyer’s Guide for Managed Threat Detection and Response Services

Tech Insights: Detecting and Preventing Insider Data Leaks

More White Papers

Reports

Improving Security by Moving Beyond VPN

Assessing Cybersecurity Risk in Today’s Enterprises

More Reports

The post 47% of Criminals Buying Exploits Target Microsoft Products appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/47-of-criminals-buying-exploits-target-microsoft-products/?utm_source=rss&utm_medium=rss&utm_campaign=47-of-criminals-buying-exploits-target-microsoft-products

DDoS Attacks Up 31% in Q1 2021: Report

If pace continues, DDoS attack activity could surpass last year’s 10-million attack threshold.

Researchers recorded approximately 2.9 million DDoS attacks in the first quarter of 2021, marking a 31% increase from the same period in 2020.

Netscout’s Atlas Security Engineering & Response Team (ASERT) anticipated last year that the high DDoS numbers recorded in 2020 would extend into 2021. Now researchers report all three months of the first quarter surpassed the 900,000-attack mark. If this activity holds, they say, DDoS attack activity is set to exceed the 10-million attack threshold recorded last year.

This activity is unusual, the researchers say, as January and February are typically the slowest months for DDoS attacks. In 2021 they observed 972,000 attacks in January alone, beating last May’s record for the highest number of attacks seen in one month.

They note the size of DDoS attacks has “remained relatively flat.” with no large terabit attacks spotted. However, attackers seek new ways to make their attacks faster and harder to mitigate. Most (42%) DDoS attacks last five to 10 minutes; those spanning less than five minutes dropped from 24% to 19% of all DDoS attacks. Those with a longer duration stayed the same.

Healthcare organizations were hit with about 7,000 DDoS attacks in the third quarter of 2020, 10,000 in the fourth quarter, and 8,400 in the first quarter of this year, marking a 53% increase from the first quarter of 2020. Researchers also report a 41% increase in attacks targeting educational services over the past three quarters, with 45,000 in the first quarter of 2021 alone.

Read Netscout’s blog post for more details.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Multi-Cloud Data Management for Modern Applications

More Webcasts

White Papers

Hidden Costs of Endpoint Security

Tech Insights: Detecting and Preventing Insider Data Leaks

More White Papers

Reports

Accelerate Threat Resolutions with DNS

Assessing Cybersecurity Risk in Today’s Enterprises

More Reports

The post DDoS Attacks Up 31% in Q1 2021: Report appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/ddos-attacks-up-31-in-q1-2021-report/?utm_source=rss&utm_medium=rss&utm_campaign=ddos-attacks-up-31-in-q1-2021-report

Culture Matters – Put People At The Heart Of Security – Jinan Budge – RSA21

Whether the human element means creating a toxic-free environment for your people, navigating the maze of organizational politics and detractors, building the human firewall, or marketing security: people and culture are central to security. We will discuss some tips to help listeners focus their people vision and approach team, organizational and security culture change strategically.

The post Culture Matters – Put People At The Heart Of Security – Jinan Budge – RSA21 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/culture-matters-put-people-at-the-heart-of-security-jinan-budge-rsa21/?utm_source=rss&utm_medium=rss&utm_campaign=culture-matters-put-people-at-the-heart-of-security-jinan-budge-rsa21

A Guided Threat Hunting Example with LogRhythm CloudAI

Threat hunting is a great way to uncover cyberattacks or malicious activity within your environment, which would otherwise have gone undetected. This post outlines a guided example of a threat hunting process where we will be looking for evidence of…

The post A Guided Threat Hunting Example with LogRhythm CloudAI appeared first on LogRhythm.

The post A Guided Threat Hunting Example with LogRhythm CloudAI appeared first on Security Boulevard.

Read More

The post A Guided Threat Hunting Example with LogRhythm CloudAI appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/a-guided-threat-hunting-example-with-logrhythm-cloudai/?utm_source=rss&utm_medium=rss&utm_campaign=a-guided-threat-hunting-example-with-logrhythm-cloudai

Object Injection Vulnerability Affects WordPress Versions 3.7 to 5.7.1

If you haven’t updated your WordPress website since October 2013, this wouldn’t affect you, but we strongly hope that is not the case! There’s a new object injection vulnerability which affects WordPress versions 3.7 to 5.7.1. Be sure to get updated to 5.7.2 as soon as possible!

According to WPScan, the new object injection vulnerability is due to versions of PHPMailer library between 6.1.8 and 6.4.0. The original CVE can be found here.

Continue reading Object Injection Vulnerability Affects WordPress Versions 3.7 to 5.7.1 at Sucuri Blog.

The post Object Injection Vulnerability Affects WordPress Versions 3.7 to 5.7.1 appeared first on Security Boulevard.

Read More

The post Object Injection Vulnerability Affects WordPress Versions 3.7 to 5.7.1 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/object-injection-vulnerability-affects-wordpress-versions-3-7-to-5-7-1/?utm_source=rss&utm_medium=rss&utm_campaign=object-injection-vulnerability-affects-wordpress-versions-3-7-to-5-7-1

How to Defend Against Ransomware-as-a-Service Groups That Attack Active Directory

Concern about the Colonial Pipeline ransomware attack by DarkSide has expanded beyond the cybersecurity industry and into the consciousness of the everyday consumer—an indicator of the extensive implications the attack has on the global economy. In response, the Biden administration issued an executive order and held a press conference, and the hacker community moved to …

The post How to Defend Against Ransomware-as-a-Service Groups That Attack Active Directory appeared first on Semperis.

The post How to Defend Against Ransomware-as-a-Service Groups That Attack Active Directory appeared first on Security Boulevard.

Read More

The post How to Defend Against Ransomware-as-a-Service Groups That Attack Active Directory appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/how-to-defend-against-ransomware-as-a-service-groups-that-attack-active-directory/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-defend-against-ransomware-as-a-service-groups-that-attack-active-directory

API Security – Sandy Carielli – RSA21

We are seeing API related breaches almost weekly – Experian, John Deere, Peleton, Starbucks, etc. Why are we seeing so many of these, and how do we need to change our thinking to improve API security? What makes this difficult?

The post API Security – Sandy Carielli – RSA21 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/api-security-sandy-carielli-rsa21/?utm_source=rss&utm_medium=rss&utm_campaign=api-security-sandy-carielli-rsa21

Rapid7 Is the Latest Victim of a Software Supply Chain Breach

An unknown number of Rapid 7 customers — and Rapid7 itself — have become the latest victims of security incidents affecting trusted third-party software supply chain partners.

On Friday, Rapid7 disclosed that attackers had accessed some of its source code repositories via a third-party Bash Uploader from Codecov that the security vendor was using in its development environment.

The attackers had previously compromised the uploader and modified it so code and associated data from Rapid7 and other Codecov customer environments would be uploaded to an attacker-controlled server — in addition to Codecov’s own systems as intended.

Many companies use Codecov’s software to verify how effectively they are testing software in development for security and other issues. Codecov’s Bash Uploader script is used to upload certain data — containing credentials, tokens, or keys — from customer CI environments to its own servers.

In January 2021, an attacker gained access to the Bash Uploader by taking advantage of an error in Codecov’s Docker image creation process. According to Codecov, the configuration error allowed the attacker to extract a credential for modifying the Bash Uploader script. Codecov did not discover the modification until four months later, in April 2021.

During that period, the attacker used the modified Bash Uploader to access and export data from Codecov customer continuous integration (CI) environments to a remote server. Codecov described the compromised Bash Uploader as giving attackers the ability to potentially extract a range of information from CI environments, including credentials as well as any services, data stores, and application code associated with these credentials.

Rapid7 said that when it learned of the incident at Codecov, it initiated an internal response process to understand how the company might have been affected. The investigation showed that attackers had used the compromised Bash Uploader to access “a small subset” of source code related to tooling for the company’s managed detection and response (MDR) service.

“Those repositories contained some internal credentials, which have all been rotated, and alert-related data for a subset of our MDR customers,” Rapid7 said Friday.

Rapid7 described the use of Codecov’s Bash Uploader as being limited to a single CI server set up for its MDR service. As a result, no production environments or other corporate systems were accessed or modified the security vendor said. The small — but undisclosed — number of Rapid7 customers that may have been affected in the attack have all been notified and advised of mitigation measures, Rapid7 said.

Growing List
Rapid7 and its customers are the latest in a growing list of victims of software supply chain incidents in recent months. The most notable example remains the one that SolarWinds disclosed last December, which affected some 18,000 organizations worldwide. In that incident, a nation-state actor gained access to SolarWinds’ development environment and planted a backdoor in software that was later sent out as automatic updates of the company’s Orion network management technology. In another incident, an attacker compromised a near-obsolete file transfer technology from Accellion and used it to exfiltrate data from several large organizations.

Concerns over such incidents appear to have prompted President Biden to make software supply chain security a major focus of a new executive order on cybersecurity that he issued last week.

“Rapid7 is the latest in a string of companies to be severely impacted by security supply chain-related attacks,” says Kevin Dunne, president of Pathlock. “Security vendors are often high-value targets, as they have deep, trusted access to networks that can provide an effective Trojan horse for bad actors.”

Though the impact to Rapid7 customers seems minimal, they need to remain on high alert, Dunne says. He advocates they work closely with Rapid7’s incident response and support teams to make any necessary updates. “In the meantime,” he adds, “they should monitor activity on their network, applications, and devices to highlight any suspicious behavior coming from Rapid7’s software and mitigate any potential threats.”

Setu Kulkarni, vice president of strategy at Whitehat Security, says that based on current information, that impact on Rapid7’s customers appears minimal. Even so, it is curious that the company would keep MDR-related data in a code repo on a non-production server in the first place. “If it were, did it pass the security controls for data at rest?” Kulkarni asks. “Broadly, [the incident] does highlight why customer-related data should not be stored in code repos and, if anything, dummy anonymized data should be used for testing.”

The post Rapid7 Is the Latest Victim of a Software Supply Chain Breach appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/rapid7-is-the-latest-victim-of-a-software-supply-chain-breach/?utm_source=rss&utm_medium=rss&utm_campaign=rapid7-is-the-latest-victim-of-a-software-supply-chain-breach

RSAC 2021: What Will SolarWinds’ CEO Reveal?

In a keynote conversation with Forrester analyst Laura Koetzle, Sudhakar Ramakrishna will get candid about the historic breach.

(Image: MiaStendal via Adobe Stock)

Since the news broke in December, the name SolarWinds has become both a buzzword and cautionary tale everyone in the security industry continues to talk about it. It is to 2021 what Equifax was to 2017. So it’s no surprise that a keynote discussion that places SolarWinds CEO Sudhakar Ramakrishna in the hot seat is one of the most highly anticipated items on this week’s RSA Conference 2021 agenda.

In what is promised to be a candid discussion between Forrester analyst Laura Koetzle and Ramakrishna, the session, titled “SolarWinds: What Really Happened?,” will offer a view of the attack’s details: the what, how, and who of what went down – and what industry professionals might learn from the breach.

Dark Reading spoke to Koetzle in advance about what she’s anticipating to come out of the session and her view of the headline-making attack.

Dark Reading: Sudhakar Ramakrishna will be speaking with you about the results of a long investigation, his perspective around the attack, and specific learnings from the incident. For starters, what are you hoping attendees will gain from the session?
Koetzle: When RSA Conference asked me to interview Sudhakar for the keynote session, I agreed quite quickly. And then the next day I realized that much would depend on how candid Sudhakar was willing to be – and how open his legal and communications team were willing to let him be. Happily, Sudhakar and his team wanted to be as transparent as possible about the incident and everything that followed from it, which I’m hoping the members of the security community will both appreciate and emulate.

Our discussion should let attendees see the choices and pressures that SolarWinds faced from the inside so that they’re better prepared when they’re faced with a breach themselves. I’m also hoping that attendees will learn from the things that SolarWinds did well and from the things that they would do differently in hindsight.

Dark Reading: As an experienced security analyst who has been following high-profile incidents like SolarWinds for many years, how do you think the organization handled the fallout in the immediate days following the news? One of the headlines was about how a password issue was the result of an intern’s mistake. Some criticized that as a misstep. What is your take?
Koetzle: The “intern posts password in cleartext on GitHub” incident is tailor-made for finger-wagging headlines, and it also became a hot-button issue when Sudhakar and former SolarWinds CEO Kevin Thompson testified at a congressional hearing. Sudhakar and I will discuss this in our interview, because, one, the credentials the intern posted weren’t used in the breach, and some of the reporting at the time seemed to indicate that they had been, and, two, Sudhakar acknowledges that he and his colleagues didn’t handle that situation optimally.

Dark Reading: And with a new CEO at the helm, how do you think they continue to handle things now? Are there any takeaways from what you are observing that are helpful for other companies that may deal with a breach in the future?
Koetzle: As attendees will hear during the interview, Sudhakar was announced as the incoming CEO of SolarWinds on Dec. 9, 2020. That’s the day after FireEye announced it had been the victim of an attack but before anyone at SolarWinds knew about the compromise to SolarWinds Orion. Sudhakar didn’t take over as CEO until Jan. 4, 2021, when SolarWinds was about three weeks into its response to the breach. So Sudhakar walked into a high-profile incident response.

I was surprised and pleased by how candid Sudhakar and SolarWinds were willing to be for our interview, and the same goes for their response itself. They’ve released new information as they learned it throughout their response to help their customers and the security community, rather than repeating “No comment” until they felt like they had everything buttoned up. That transparency is something I’d encourage attendees and other companies responding to breaches to emulate.

Dark Reading: We are heading into this talk with the Colonial Pipeline attack now fresh in our minds. The last six months have brought us several attacks that have major implications on US national security and infrastructure. In Washington, lawmakers are discussing legislative fixes, and the Biden administration is talking about a new information-sharing system among private companies and the US government. What are your thoughts on some of what is being proposed?
Koetzle: Suffice it to say that more cybersecurity legislation and regulation is long overdue, so I welcome the attention to it. The Biden administration had been signaling its intent to prioritize spending to address cybersecurity risk in its first several weeks in office. I’m happy that they’re emphasizing the “unsexy but necessary” bits of information security practice, such as making sure that government agencies actually implement the best practices for identifying and managing risks that its own experts recommend; according to the GAO, none of the 23 agencies they’d reviewed had implemented those practices as of March 2021.

And as one of the members of the Forrester security research team who was present at the creation of the zero-trust approach back in 2009, I’m thrilled to see the US federal government is mandating the use of zero trust – because it works. I’m also happy to see that President Biden’s executive order requires that products provide a software bill of materials (SBOM), following the approach that the National Telecommunications and Information Administration (NTIA) at the US Department of Commerce has been coordinating with the software industry. Widespread implementation of SBOM will mean that companies and security professionals can know what’s really in the software products they buy and use.

Dark Reading: Now that we are six months out from when the news of SolarWinds first broke, what is your take on the lessons security and software vendors can learn from this breach?
Koetzle: I’ve already mentioned that I was impressed by SolarWinds’ commitment to transparency and its willingness to share what it has learned in its investigation; that’s a practice I’d suggest we all emulate. But for security and software vendors specifically, if you’ve succumbed to the temptation of producing opportunistic marketing – I’ve seen some egregious “Want to avoid a breach like SolarWinds had? Buy our software!” pitches, which I immediately toss in the virtual trash bin – please stop now. Most security professionals know that we’re all going to be the victims of an incident sometime. Today it’s SolarWinds, but tomorrow it could be you.

Dark Reading: Moving forward, what do you suggest CISOs and security managers focus on to establish or improve product security initiatives?
Koetzle: Many CISOs and other security professionals are accustomed to working in internal, enterprise security environments, and working on the security of the products that your company sells requires a different mindset. Strong product security requires working with product teams in the very early stages of development, which is more chaos than many security professionals are accustomed to.

If you’re working on product security, you’ll need to be comfortable with lots of uncertainty and to create risk management processes that accept high levels of risk at the early stages and encourage developers to reduce risk – and improve security – as they improve the product they’re building. “Minimum viable security” isn’t a phrase traditional security professionals use very often, but that’s the right way to think about the acceptable security level for a minimum viable product.

More details on the keynote discussion between Koetzle and Ramakrishna can be found here.

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts
More Webcasts

White Papers

Hidden Costs of Endpoint Security

Tech Insights: Detecting and Preventing Insider Data Leaks

More White Papers

Reports

Accelerate Threat Resolutions with DNS

Assessing Cybersecurity Risk in Today’s Enterprises

More Reports

The post RSAC 2021: What Will SolarWinds’ CEO Reveal? appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/rsac-2021-what-will-solarwinds-ceo-reveal-2/?utm_source=rss&utm_medium=rss&utm_campaign=rsac-2021-what-will-solarwinds-ceo-reveal-2

What Does the New Cybersecurity Executive Order Mean for Cloud Security?

The Biden administration issued a big, eye-catching cybersecurity executive order late last Wednesday outlining a plan to “to make bold changes and significant investments in …

The post What Does the New Cybersecurity Executive Order Mean for Cloud Security? appeared first on Cyral.

The post What Does the New Cybersecurity Executive Order Mean for Cloud Security? appeared first on Security Boulevard.

Read More

The post What Does the New Cybersecurity Executive Order Mean for Cloud Security? appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/what-does-the-new-cybersecurity-executive-order-mean-for-cloud-security/?utm_source=rss&utm_medium=rss&utm_campaign=what-does-the-new-cybersecurity-executive-order-mean-for-cloud-security

SANS.edu Releases First Research Journal https://www.sans.edu/cyber-research, (Mon, May 17th)

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post SANS.edu Releases First Research Journal https://www.sans.edu/cyber-research, (Mon, May 17th) appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/sans-edu-releases-first-research-journal-https-www-sans-edu-cyber-research-mon-may-17th/?utm_source=rss&utm_medium=rss&utm_campaign=sans-edu-releases-first-research-journal-https-www-sans-edu-cyber-research-mon-may-17th

A “Great Equalizer”, Until It Isn’t: Regional Security in a Global Pandemic – Allie Mellen – RSA21

In security, regions can impact available technical capabilities, manpower, and other resources. This has been felt more than ever in African countries given the dramatic shift to remote work during the pandemic. Allie’s talk with Kerissa Varma dissects and compares regional responses to COVID from security teams in 17 different countries in Africa, North America, Asia, and the Middle East.

Segment Resources:

https://www.rsaconference.com/usa/agenda/full-agenda#q=allie%20mellen&sort=%40eventstart%20ascending

The post A “Great Equalizer”, Until It Isn’t: Regional Security in a Global Pandemic – Allie Mellen – RSA21 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/a-great-equalizer-until-it-isnt-regional-security-in-a-global-pandemic-allie-mellen-rsa21/?utm_source=rss&utm_medium=rss&utm_campaign=a-great-equalizer-until-it-isnt-regional-security-in-a-global-pandemic-allie-mellen-rsa21

What a Year It’s Been: RSA 2021 Embraces ‘Resilience’

Keynoters from Cisco, Netflix and RSA highlighted lessons from the last year, and cybersecurity’s new mandate in the post-pandemic world: Bounce back stronger.
Read More

The post What a Year It’s Been: RSA 2021 Embraces ‘Resilience’ appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/what-a-year-its-been-rsa-2021-embraces-resilience/?utm_source=rss&utm_medium=rss&utm_campaign=what-a-year-its-been-rsa-2021-embraces-resilience

What’s new in the 2021 ‘Open Source Security and Risk Analysis’ report

As the use of open source has grown, so has the number of vulnerabilities. Uncover the latest findings from the 2021 OSSRA report.

The post What’s new in the 2021 ‘Open Source Security and Risk Analysis’ report appeared first on Software Integrity Blog.

The post What’s new in the 2021 ‘Open Source Security and Risk Analysis’ report appeared first on Security Boulevard.

Read More

The post What’s new in the 2021 ‘Open Source Security and Risk Analysis’ report appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/whats-new-in-the-2021-open-source-security-and-risk-analysis-report/?utm_source=rss&utm_medium=rss&utm_campaign=whats-new-in-the-2021-open-source-security-and-risk-analysis-report

Web App and API Security Needs to Be Modernized: Here’s How – Sean Leach – RSA21

The truth is, most web app and API security tools were designed for a very different era. A time before developers and security practitioners worked together, before applications were globally distributed and API-based. But attackers are developers too, and they aren’t bogged down by the limitations of legacy solutions. It’s never been more clear that it’s time for a change. Sean will outline new rules for web application and API security that respect the way modern applications are built.

https://www.fastly.com/blog/the-new-rules-for-web-application-and-api-security

This segment is sponsored by Fastly.

Visit https://securityweekly.com/fastly to learn more about them!

The post Web App and API Security Needs to Be Modernized: Here’s How – Sean Leach – RSA21 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/web-app-and-api-security-needs-to-be-modernized-heres-how-sean-leach-rsa21/?utm_source=rss&utm_medium=rss&utm_campaign=web-app-and-api-security-needs-to-be-modernized-heres-how-sean-leach-rsa21

Extending Visibility and Security to Network and Unmanaged Devices

Download the PDF > Today we are excited to announce a major new extension to the Eclypsium device integrity platform, which lets organizations easily extend visibility and security beyond their traditional endpoints to all the network and unmanaged devices that can impact the security of their enterprise. Now available in beta, the new extension addresses […]

The post Extending Visibility and Security to Network and Unmanaged Devices appeared first on Security Boulevard.

Read More

The post Extending Visibility and Security to Network and Unmanaged Devices appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/extending-visibility-and-security-to-network-and-unmanaged-devices/?utm_source=rss&utm_medium=rss&utm_campaign=extending-visibility-and-security-to-network-and-unmanaged-devices

Bizarro banking Trojan expands its attacks to Europe

Bizarro is yet another banking Trojan family originating from Brazil that is now found in other regions of the world. We have seen users being targeted in Spain, Portugal, France and Italy. Attempts have now been made to steal credentials from customers of 70 banks from different European and South American countries. Following in the footsteps of Tetrade, Bizarro is using affiliates or recruiting money mules to operationalize their attacks, cashing out or simply to helping with transfers. In this article we analyse the technical features of the Trojan’s components, giving a detailed overview of obfuscation techniques, the infection process and subsequent functions, as well as the social engineering tactics used by the cybercriminals to convince their victims to give away their personal online banking details.

Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app. The group behind Bizzaro uses servers hosted on Azure and Amazon (AWS) and compromised WordPress servers to store the malware and collect telemetry.

Bizarreland

Bizarro is distributed via MSI packages downloaded by victims from links in spam emails. Once launched, Bizarro downloads a ZIP archive from a compromised website. While writing this article, we saw hacked WordPress, Amazon and Azure servers used for storing archives. The MSI installer has two embedded links – which one is chosen depends on the victim’s processor architecture.

Typical malicious message sent by Bizarro operators

The downloaded ZIP archive contains the following files:

A malicious DLL written in Delphi;
A legitimate executable that is an AutoHotkey script runner (in some samples AutoIt is used instead of AutoHotkey);
A small script that calls an exported function from the malicious DLL.

The DLL exports a function that contains the malicious code. The malware developers have used obfuscation to complicate code analysis. The code of the exported functions have been removed by the protector. The bytes that belong to the exported functions are restored by the DLL entry point function at runtime. This entry point function is heavily obfuscated. The tricks used to complicate analysis consist of constant unfolding and junk code insertion. As for the malware developers, they are constantly improving the protection of the binaries. In earlier versions of Bizarro, only the entry point function was protected, while in more recent samples the protector is also used to obscure calls of the imported API functions.

When Bizarro starts, it first kills all the browser processes to terminate any existing sessions with online banking websites. When a user restarts the browsers, they will be forced to re-enter the bank account credentials, which will be captured by the malware. Another step Bizarro takes in order to get as many credentials as possible is to disable autocomplete in a browser.

Bizarro gathers the following information about the system on which it is running:

Computer name;
Operating system version;
Default browser name;
Installed antivirus software name.

Bizarro uses the ‘Mozilla/4.0 (compatible;MSIE 6.0; Windows NT 5.0′ user agent while sending the POST request. This user agent has typos: there should be a space symbol after the compatible; substring and the closing bracket is missing. Our research shows that this mistake has not been fixed in the latest versions. After that, Bizarro creates an empty file in the %userprofile% directory, thus marking the system as infected. The name of the file is the name of the script runner (AutoIt or AutoHotKey) with the .jkl extension appended to it.

Having sent the data to the telemetry server, Bizarro initializes the screen capturing module. It loads the magnification.dll library and gets the address of the deprecated MagSetImageScalingCallback API function. With its help, the Trojan can capture the screen of a user and also constantly monitor the system clipboard, looking for a Bitcoin wallet address. If it finds one, it is replaced with a wallet belonging to the malware developers.

The backdoor is the core component of Bizarro: it contains more than 100 commands and allows the attackers to steal online banking account credentials. Most of the commands are used to display fake pop-up messages to users. The core component of the backdoor doesn’t start until Bizarro detects a connection to one of the hardcoded online banking systems. The malware does this by enumerating all the windows, collecting their names. Whitespace characters, letters with accents (such as ñ or á) and non-letter symbols such as dashes are removed from the window name strings. If a window name matches one of the hardcoded strings, the backdoor continues starting up.

The first thing the backdoor does is remove the DNS cache by executing the ipconfig /flushdns command. This is done in order to prevent connecting to a blocked IP. After that, the malware resolves the domain name to an IP address, creates a socket and binds it to the resolved address. If the connection was successful, it creates the %userprofile%bizarro.txt file.

The Backdoor and its C2

The commands that Bizarro receives from its C2 can be divided into the following categories:

Commands that allow the C2 operators to get data about the victim and manage the connection status

The <|PT|> command sends the environment information to the C2: Bizarro’s version, OS name, computer name, Bizarro’s unique identifier, installed antivirus software and the codename used for the bank that has been accessed. The codenames are bank names written in leetspeak.

Commands that allow attackers to control the files located on the victim’s hard drive

The <|DownloadFile|> command downloads files to the victim’s computer, while the <|UploadFile|> command allows attackers to fetch files from the client machine. The <|Folder|> and <|File|> commands allow the attackers to search for folders and files which have a given mask.

Commands that allow attackers to control the user’s mouse and keyboard

The <|SuaykRJ|> command performs a left mouse button click at the designated location. The <|SuaykJI|> command performs a double click at the given location, while the <|IXjzwtR|> command performs a right mouse button click. The <|ztUjzwtR|> command moves the mouse to a designated location. The syntax of these three commands is <|command name|>x coordinate<|>y coordinate<<|.

Bizarro can also manipulate the user’s keyboard (what the user actually types) with the help of the carmena command.

Commands that allow the attackers to control the backdoor operation, shut down, restart or destroy the operating system and limit the functionality of Windows

The LkingWajuGhkzwu command shuts the backdoor down, while the vkbAlcvtlY command drops a BAT file in the working directory. The batch script is responsible for deleting the malware from disk.

Commands that log keystrokes

Bizarro supports two commands that are responsible for keylogging. The COZUMEL command starts the logging process, while the COZUMARIA command stops it.

Commands that perform social engineering attacks

These commands display various messages that trick users into giving attackers access to the bank account. The type of messages displayed vary from simple message boxes to well-designed windows with bank logs on them.

We will first describe commands that show Windows message boxes. The dkxqdpdv command displays an error message with the text: “Los datos ingresados son incorrectos, por favor intente nuevamente.” (English: “The data entered is incorrect, please try again.”)

Bizarro shows a message telling the user to enter the requested data again

The vanessa command displays an error message which tells the user to enter confirmation information. To further convince the user that all operations are legitimate, the malware displays the RUT (Rol Único Tributario, a Chilean ID number) and the value that was supplied earlier. The message has the following text:

Error message asking the user to enter a confirmation code

The LMAimwc command displays another error message. This time it tells the user that their computer needs to be restarted in order to finish a security-related operation. Bizarro displays the following text:

Error message telling the user that the operating system will be restarted

The most interesting messages that Bizarro displays are those that try to mimic online banking systems. To display such messages, Bizarro needs to download a JPEG image that contains the bank logo and instructions the victim needs to follow. These images are stored in the user profile directory in an encrypted form. Before an image is used in a message, it is decrypted with a multi-byte XOR algorithm. As the messages are downloaded from the C2 server, they can be found only on the victims’ machines.

The first type of custom messages that Bizarro may show are messages that freeze the victim’s machine, thus allowing the attackers to gain some time. When a command to display a message like this is received, the taskbar is hidden, the screen is greyed out and the message itself is displayed. While the message is shown, the user is unable to close it or open Task Manager. The message itself tells the user either that the system is compromised and thus needs to be updated or that security and browser performance components are being installed. This type of message also contains a progress bar that changes over time.

The images below show what these messages look like on the screens of victims, with messages written in Spanish:

Bizarro blocking a bank login page and telling the user that security updates are being installed

The following two messages try to convince the victim that their system is compromised. In most of them, Bizarro tells the user not to worry about any transactions that occur during the “security update” as they are only confirming the identity of the client. This makes clients feel more confident about approving all the transactions requested by the attackers.

Messages telling the user that their system is compromised

Bizarro also tries to lure victims into sending two-factor authentication codes to the attackers. Another interesting feature we have seen entails an attempt to convince the victim to install a malicious app on their smartphone. It uses the following windows to determine the type of mobile operating system:

Bizarro asks the user to choose the operating system of their smartphone

If the victim chooses Android, the C2 server will send a link with a malicious application to the client. The client will make a QR code out of it with the help of the Google Charts API. It sends a request with the following arguments:

http://chart.apis.google.com/chart?chs=<QR code width>x<QR code height>&cht=qr&chld=<error correction level>&chl=<link to the application>

The obtained QR code is then shown in a window with the following text:

Bizarro asking the user to scan the QR code

Attack scenario

With the help of the commands that the Bizarro developers have included in the Trojan, adversaries may stage an attack with the following scenario:

Infection scheme used by Bizarro

According to the list of supported banks, the threat actor behind Bizarro is targeting clients of various banks from Europe and South America. Based on our telemetry, we’ve seen victims of Bizarro in different countries, including Brazil, Argentina, Chile, Germany, Spain, Portugal, France and Italy. These statistics again prove the fact that Bizarro’s operators have expanded their interest from Brazil to other countries in South America and Europe.

Distribution of Bizarro detections in the last 12 months

Conclusion

We’ve recently seen several banking Trojans from South America (such as Guildma, Javali, Melcoz, Grandoreiro and Amavaldo) expanding their operations to other regions, mainly Europe. Bizarro is yet another example of this. The threat actors behind this campaign are adopting various technical methods to complicate malware analysis and detection, as well as social engineering tricks that can help convince victims to provide personal data related to their online banking accounts.

Kaspersky products detect this family as Trojan-Banker.Win32.Bizarro or Trojan-Banker.Win64.Bizarro. All the details, IoCs, MITRE ATT&CK Framework data, Yara rules and hashes relating to this threat are available to users of our Financial Threat Intel services. To learn more about threat hunting and malware analysis from Kaspersky’s GReAT experts, check out http://xtraining.kaspersky.com

Indicators of compromise

Reference MD5 hashes

e6c337d504b2d7d80d706899d964ab45
daf028ddae0edbd3d7946bb26cf05fbf
5184776f72962859b704f7cc370460ea
73472698fe41df730682977c8e751a3e
7a1ce2f8f714367f92a31da1519a3de3
0403d605e6418cbdf8e946736d1497ad
d6e4236aaade8c90366966d59e735568
a083d5ff976347f1cd5ba1d9e3a7a4b3
b0d0990beefa11c9a78c701e2aa46f87
38003677bfaa1c6729f7fa00da5c9109

The post Bizarro banking Trojan expands its attacks to Europe appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/bizarro-banking-trojan-expands-its-attacks-to-europe/?utm_source=rss&utm_medium=rss&utm_campaign=bizarro-banking-trojan-expands-its-attacks-to-europe

2021 Verizon Data Breach Investigations Report Is Out

The Verizon Data Breach Investigations report is probably one of the most widely read reports in cyber security.  Verizon released their 2021 edition of the report on May 13, 2021.

The post 2021 Verizon Data Breach Investigations Report Is Out appeared first on K2io.

The post 2021 Verizon Data Breach Investigations Report Is Out appeared first on Security Boulevard.

Read More

The post 2021 Verizon Data Breach Investigations Report Is Out appeared first on Malware Devil.

https://malwaredevil.com/2021/05/17/2021-verizon-data-breach-investigations-report-is-out/?utm_source=rss&utm_medium=rss&utm_campaign=2021-verizon-data-breach-investigations-report-is-out