By Deeba Ahmed
The researchers believe that the SmugX attack is an extension of a previously discovered campaign linked to Mustang Panda.
This is a post from HackRead.com Read the original post: SmugX: Chinese Hackers Targeting Embassies in Europe

**The attack method of the SmugX campaign includes attackers using HTML smuggling to target victims.**

Check Point Research’s (CPR) cyber threat intelligence researchers have discovered a disturbing attack trend. According to CPR’s report published on July 3, 2023, Chinese threat actors have become increasingly interested in targeting European governments, embassies, and foreign local policy-making entities. Eastern Europe is among their preferred targets, with prime targets being Slovakia, the Czech Republic, and Hungary.

This newly discovered campaign is dubbed SmugX. Researchers claim that this campaign has been active since December 2022, but they believe that it is an extension of a previously discovered campaign linked to Mustang Panda and RedDelta. Interestingly, both groups are Chinese.

As far as the attack method is concerned, research revealed that in SmugX, attackers are using HTML smuggling to target European embassies. In this method, the modular PlugX malware implant is smuggled (hidden) inside HTML documents.

Hackers use this technique to trick web security systems and evade antivirus mechanisms or security defences. HTML smuggling exploits HTML features to conceal malicious data documents from automated content filters, including them as JavaScript blobs that reassemble on the targeted device.

It is worth noting that PluxX is a commonly used tool for HTML smuggling. Multiple Chinese threat actors have used this malware previously, such as the group that targeted the Vatican in 2020 or the one that targeted the Indonesian Intelligence Service in 2021. The malware was also used to target users in Mongolia, Ghana, Papua New Guinea, Nigeria, and Zimbabwe in a USB drive-based campaign.

CPR researchers agree that SmugX’s primary objective is to obtain sensitive data on the foreign policies of the targeted countries. This analysis is based on the lure samples posted to the malware repository on VirusTotal. The filenames of these samples were self-explanatory.

Researchers wrote that the names strongly suggested that the attackers wanted to target diplomats and government entities, whereas the content contained mainly diplomatic-related content related to China. The attack utilizes several .docx and .pdf files containing diplomatic content.

CPR researchers obtained a letter from the Serbian embassy in Budapest, a document revealing the Swedish Presidency of the Council of the European Union’s priorities, and an invitation from the Hungarian foreign ministry for a diplomatic conference.

The researchers also discovered an article about the two Chinese human rights lawyers who had received a ten-year sentence. Here are the titles of these documents:

*   202305 Indicative Planning RELEX
*   Draft Prague Process Action Plan\_SOM\_EN
*   2262\_3\_PrepCom\_Proposal\_next\_meeting\_26\_April
*   Comments FRANCE – EU-CELAC Summit – 4th May
*   China jails two human rights lawyers for Subversion

One of the phishing documents (left) – Targeted countries (right)

“While none of the techniques observed in this campaign is new or unique, the combination of the different tactics, and the variety of infection chains resulting in low detection rates, enabled the threat actors to stay under the radar for quite a while,” CPR researchers noted.

CPR is still investigating and monitoring SmugX activities and will share new details soon. Please continue to visit this platform for the latest updates on SmugX.

**RELATED ARTICLES**

1.  Killnet Hits European Parliament Website with DDoS Attack
2.  Research sector hit in new phishing attack using Google Drive
3.  Fake WHO Emails on COVID-19 Drop Nerbian RAT Across Europe
4.  European Spyware Vendor Offering Android & iOS Device Exploits
5.  Zimbra email platform flaw exploited to steal European govt emails

SmugX: Chinese Hackers Targeting Embassies in Europe

By Waqas
Anonymous Sudan group took to Telegram to claim that it had stolen 30 million accounts belonging to Microsoft customers.
This is a post from HackRead.com Read the original post: Microsoft rubbishes Anonymous Sudan’s claim of Stealing 30M accounts

**Anonymous Sudan, which Microsoft tracks as Storm-1359, is offering the full database of Microsoft customer accounts for $50,000.**

Microsoft has hit back at the hacktivists claiming to have infiltrated the tech giant’s servers and stolen the credentials of 30 million customer accounts. Reportedly, the Russian Killnet\-affiliated hacktivist group, Anonymous Sudan, recently boasted about breaching Microsoft’s security and accessing millions of accounts belonging to its customers. The hacktivists posted details of the security breach on their Telegram channel, which read:

“We announce that we have successfully hacked Microsoft and have access to a large database containing more than 30 million Microsoft accounts, emails, and passwords … We will begin selling this database, so if you’re interested, contact us at our bot to negotiate.”

Anonymous Sudan on Telegram (Image source: Hackread.com)

The gang, which Microsoft tracks as Storm-1359, is offering the full database of Microsoft customer accounts for $50,000. The hacktivists also provided 100 email password combinations as a small sample to prove their claims. However, in its statement, Microsoft denied these claims.

“At this time, our analysis of the data shows that this is not a legitimate claim and an aggregation of data. We have seen no evidence that our customer data has been accessed or compromised.”

Previously, Anonymous Sudan has been involved in DDoS attacks targeting Western organizations. In February 2023, the group targeted Swedish organizations with a series of DDoS attacks in response to a Quran-burning incident in Stockholm.

However, cybersecurity experts claim that the attack was actually a false-flag campaign by Russia to encourage hatred between Sweden and Muslim countries. More recently, Anonymous Sudan disrupted the official website of SAS (Scandinavian Airlines) website and took down the Microsoft 365 software suite, including Outlook and Teams.

The gang has previously attacked Microsoft as well. In a statement released in mid-June, Microsoft confirmed that Anonymous Sudan had launched Layer 7 DDoS attacks against the software vendor. The attack was detected in early June 2023 when the company noticed an unusual rise in traffic against some of its services.

As a result, the services became temporarily unavailable. Microsoft noted that the hacktivists had accessed botnets and tools to launch DDoS attacks from cloud services and open proxy infrastructures.

This is a developing story. At the moment, there is no clarity on whether Anonymous Sudan breached Microsoft’s security since the data sample it has provided is yet to be verified. We will keep updating our readers with the latest on this incident.

1.  Russian Killnet Hackers Claim Data Theft of FBI Agents
2.  Killnet Hits European Parliament Website with DDoS Attack
3.  Yandex Source Code Online Leaked, Company Denies Hack
4.  Microsoft Discloses DDoS Attack Impact with Limited Details
5.  Twitter Denies Any Hack Attack in 200M Account Leak Scare

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Microsoft rubbishes Anonymous Sudan’s claim of Stealing 30M accounts

By Waqas
The arrests took place in Singapore over complaints from unsuspecting victims.
This is a post from HackRead.com Read the original post: Teen among suspects arrested in Android banking malware scheme

Singapore authorities have conducted a successful operation, resulting in the arrest of 13 individuals suspected of involvement in banking-related malware scams. Among those apprehended were a 16-year-old teenager and a group of 10 men and two women aged between 19 and 35.

Preliminary findings suggest that seven men, two women aged 19 to 27, and a 16-year-old facilitated the scam by providing their bank accounts, Internet banking credentials, and Singpass credentials to perpetrators for monetary gain. Three other men aged 20 and 35 are believed to have withdrawn funds from the accounts of some of the “money mules” and handed the money over to unknown individuals.

The number of victims is yet unknown. For your information, Singpass, which stands for Singapore Personal Access, is a digital identity that enables all Singapore citizens and residents to conveniently access businesses and government agencies and businesses.

Suspects and seized sim cards (Screenshot: SPF)

**Modus Operandi and Scam Techniques**

In a press release, the Singapore Police Force (SPF) revealed that since January 2023, they have received a rising number of reports involving malware used to compromise Android mobile devices, leading to unauthorized transactions from victims’ bank accounts. Remarkably, victims did not share their Internet banking credentials, One-Time Passwords (OTPs), or Singpass credentials with anyone.

The scam unfolded when victims responded to various advertisements on social media platforms for services such as cleaning, pet grooming, and the sale of food items like seafood and groceries. Subsequently, scammers instructed victims to download an Android Package Kit (APK) from unofficial app-store platforms to facilitate their purchases. However, these APKs contained malware that infected the victims’ mobile devices.

Once infected, scammers contacted victims via phone calls or text messages and convinced them to enable accessibility services on their Android phones. Enabling these services weakened the phones’ security and granted full control to the scammers. Keystrokes were logged, banking credentials were stolen, and scammers remotely accessed banking apps to add “money mules” as payees, increase payment limits, and transfer funds to them.

The scammers also deleted text messages and email notifications related to the fraudulent transfers to cover their tracks.

The act of benefiting from criminal conduct carries severe penalties under Section 54(5)(a) of the Corruption, Drug Trafficking, and Other Serious Crimes (Confiscation of Benefits) Act 1992. Offenders face imprisonment of up to 10 years, a fine of up to S$500,000, or both.

1.  Teen Charged in DraftKings Data Breach
2.  UK Teen Arrested Amid Uber and GTA 6 Hacking Saga
3.  Dark Web Hitman Paid with BTC to Murder Teen Victim
4.  Teen “Hackers” on Discord Selling Malware for Quick Cash
5.  Teen arrested for 8 DDoS attacks that disrupted school’s classes
6.  Data breach: SingHealth users affected including Singapore’s PM

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Teen among suspects arrested in Android banking malware scheme

The threat actors behind the DDoSia attack tool have come up with a new version that incorporates a new mechanism to retrieve the list of targets to be bombarded with junk HTTP requests in an attempt to bring them down.
The updated variant, written in Golang, "implements an additional security mechanism to conceal the list of targets, which is transmitted from the [command-and-control] to the

The threat actors behind the **DDoSia** attack tool have come up with a new version that incorporates a new mechanism to retrieve the list of targets to be bombarded with junk HTTP requests in an attempt to bring them down.

The updated variant, written in Golang, "implements an additional security mechanism to conceal the list of targets, which is transmitted from the \[command-and-control\] to the users," cybersecurity company Sekoia said in a technical write-up.

DDoSia is attributed to a pro-Russian hacker group called NoName(057)16. Launched in 2022 and a successor of the Bobik botnet, the attack tool is designed for staging distributed denial-of-service (DDoS) attacks against targets primarily located in Europe as well as Australia, Canada, and Japan.

Lithuania, Ukraine, Poland, Italy, Czechia, Denmark, Latvia, France, the U.K., and Switzerland have emerged as the most targeted countries over a period ranging from May 8 to June 26, 2023. A total of 486 different websites were impacted.

Python and Go-based implementations of DDoSia have been unearthed to date, making it a cross-platform program capable of being used across Windows, Linux, and macOS systems.

"DDoSia is a multi-threaded application that conducts denial-of-service attacks against target sites by repeatedly issuing network requests," SentinelOne explained in an analysis published in January 2023. "DDoSia issues requests as instructed by a configuration file that the malware receives from a C2 server when started."

DDoSia is distributed through a fully-automated process on Telegram that allows individuals to register for the crowdsourced initiative in exchange for a cryptocurrency payment and a ZIP archive containing the attack toolkit.

What's noteworthy about the new version is the use of encryption to mask the list of targets to be attacked, indicating that the tool is being actively maintained by the operators.

"NoName057(16) is making efforts to make their malware compatible with multiple operating systems, almost certainly reflecting their intent to make their malware available to a large number of users, resulting in the targeting of a broader set of victims," Sekoia said.

The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of targeted denial-of-service (DoS) and DDoS attacks against multiple organizations in multiple sectors.

"These attacks can cost an organization time and money and may impose reputational costs while resources and services are inaccessible," the agency said in a bulletin.

Although CISA did not provide any additional specifics, the warning overlaps with claims by Anonymous Sudan on its Telegram channel that it had taken down the websites of the Department of Commerce, Social Security Administration (SSA), and the Treasury Department's Electronic Federal Tax Payment System (EFTPS).

Anonymous Sudan attracted attention last month for carrying Layer 7 DDoS attacks against various Microsoft services, including OneDrive, Outlook, and Azure web portals. The tech giant is tracking the cluster under the name Storm-1359.

The hacking crew has asserted it's conducting cyber strikes out of Africa on behalf of oppressed Muslims across the world. But cybersecurity researchers believe it to be a pro-Kremlin operation with no ties to Sudan and a member of the KillNet hacktivist collective.

In an analysis released on June 19, 2023, Australian cybersecurity vendor CyberCX characterized the entity as a "smokescreen for Russian interests." The company's website has since become inaccessible, greeting visitors with a "403 Forbidden" message. The threat actor claimed responsibility for the cyber attack.

"The reason for the attack: stop spreading rumors about us, and you must tell the truth and stop the investigations that we call the investigations of a dog," Anonymous Sudan said in a message posted on June 22, 2023.

Anonymous Sudan, in a Bloomberg report last week, further denied it was connected to Russia but acknowledged they share similar interests, and that it goes after "everything that is hostile to Islam."

CISA's latest advisory has also not gone unnoticed, for the group posted a response on June 30, 2023, stating: "A small Sudanese group with limited capabilities forced 'the most powerful government' in the world to publish articles and tweets about our attacks."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

DDoSia Attack Tool Evolves with Encryption, Targeting Multiple Sectors

By Waqas
The phone scam specifically focused on exploiting vulnerable individuals residing in Poland and Germany.
This is a post from HackRead.com Read the original post: Police Bust International Phone Scam Gang Targeting Elderly

**The alleged ringleader of the phone scam gang, which preyed on elderly individuals through fraudulent phone calls, has also been arrested.**

A major international law enforcement operation has resulted in the apprehension of multiple suspects, including the alleged ringleader of an organized crime group that preyed on elderly individuals through fraudulent phone calls, as confirmed by Europol.

The National Crime Agency (NCA) of the United Kingdom arrested the suspected head of the criminal network near London, while authorities in Poland and Germany carried out simultaneous raids across several locations in Europe. During the raids, law enforcement officers seized mobile phones, electronic devices, gold bars, coins, jewellery, and $160,000 in cash.

Throughout the investigation, approximately 70 individuals have been taken into custody. The modus operandi of the scam included fraudsters calling elderly victims, posing as police officers or officials authorities, and informing them that their relative was involved in a fatal accident.

The phone would then be handed to another individual who would create a sense of urgency and panic by screaming for help. This tactic aimed to coerce the victim into complying with the fraudster’s demands to hand over money, purportedly to prevent the detention of their fake relative.

Another part of the scam involved physically sending a person to the victim’s residence to collect the money. Typically, these individuals were unwitting trapped as part of squaring scams recruited through online job platforms, according to Europol.

In total, Europol estimated that hundreds of elderly individuals fell victim to this criminal gang, resulting in losses of up to $5 million ($5.4 million). According to Europol, the dismantling of the group may have prevented additional losses of approximately $1.4 million ($1.5 million).

Europol warned that these scams can deceive victims into losing substantial amounts of money while inflicting severe emotional distress and eroding trust in legitimate authorities.

The shutdown of this highly sophisticated scam is not unexpected, considering the rigorous crackdown by British authorities on cybercriminals and scammers. In November 2022, the UK’s largest bank call scam, iSpoof, was dismantled when its infrastructure was seized. Subsequently, in May 2023, the mastermind behind the operation was apprehended in London and sentenced to 13 years in prison.

1.  Europol Busts Crypto Fraud Call Centers
2.  Europol nabs 106 criminals involved in SIM swapping
3.  Europol busts VPNLab VPN used by ransomware gang
4.  NCA infiltrates cybercrime market with fake DDoS sites
5.  Europol arrests 6 over malware counter anti-virus platform

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Police Bust International Phone Scam Gang Targeting Elderly

Israel's cyber head points finger at Iran-backed MuddyWater APT group as the perpetrator of a recent attack against a university.

Israel earlier this year aided the United Arab Emirates (UAE) in helping repel a major distributed denial-of-service (DDoS) attack.

Speaking at last week's Cyber Week in Tel Aviv, UAE head of cybersecurity Mohamed Al Kuwaiti said that attacks "continuously come and go" and praised the Abraham Accords, which were ratified in 2020 to strengthen Middle East relations. "Thank God for the partnership, with the relationship that we have; it helped us elevate as well as to prepare an early warning system," he said.

According to Jewish Press, Gaby Portnoy, director general of the Israel National Cyber Directorate, joined Al Kuwaiti onstage at the conference, as did national cyber representatives from Bahrain, Morocco, and the US.

Al Kuwaiti noted that "cybersecurity is an important aspect for us all" and that many of Israel's startups are "helping us as a matter of fact to build up that cyber dome or to extend that cyber dome to defend against cyberattacks," a report by All Israel said.

The DDoS attack declaration by Al Kuwaiti came in the same week as a formal announcement was made to increase intelligence sharing between the UAE and Israel with the so-called Crystal Ball project, a partnership between Israel and the UAE's cyber teams and backed by private industry. Crystal Ball is intended to detect and repel hackers via collaboration and knowledge sharing around national-level cyberthreats.

"It is a well-known fact that criminal gangs are working together to victimize individuals and companies, any improvements in international cooperation between nation-states to tackle these threats is a welcome move," says Brian Honan, CEO of BH Consulting.

**No Clarity in MuddyWater?**

At CyberWeek, Portnoy reportedly mentioned cyberattacks the group MuddyWater initiated against Israel. He said the MuddyWater group has ties to Iran's Islamic Revolutionary Guard Corps (IRGC), and blamed it for a cyberattack against the Technion Institute of Technology in Haifa. Technion was forced to disconnect its systems to prevent security damage and lose data.

According to a new blog from Deep Instinct's Simon Kenin, a custom-made command and control server was detected in the attack against Technion, and MuddyWater have been using that server since 2021.

"The group doesn't just work against Israel, but rather also hacks civilian targets in many other countries, including Turkey, Saudi Arabia, Egypt, Morocco, India, Bahrain, Oman, Kuwait, and others," Portnoy said.

The MuddyWater group has previously been linked to spear phishing campaigns against employees of Middle East telecom operators, as well as with cyber surveillance activities.

Israel Aided UAE in Defending Against DDoS Attack

As cybercrime amidst the Russia-Ukraine war continues to escalate, the DDoSia project, launched by a known hacktivist group, has exploded in its number of members and quality of tools used for attacks.

After being launched by Russian hacktivist group "NoName057(16)" in the summer of 2022 and quickly gaining a substantial number of members and active users, the crowdsourced DDoS project known as "DDoSia" has grown exponentially, by 2,400%.

The platform now has 10,000 active members compared with the 400 it had when it first launched. It also has 45,000 subscribers on its primary Telegram channel, compared with just 13,000 last summer. With this growth comes more individuals helping conduct attacks on Western organizations, and better tools to deploy these attacks, such as introducing binaries for all major OS platforms.

Through data collected by Sekoia, analysts found that the targets of these DDoS attacks between May 8 and June 26 of this year were, for the most part, Lithuanian, Ukrainian, and Polish (39%). This is presumably due to the fact that these countries have made public declarations against Russia during the Russia-Ukraine war. During this time frame, the hacktivist group targeted 486 websites, including Ukrainian education and government sites, and French banking websites.

"NoName057(16) is making efforts to make their malware compatible with multiple operating systems, almost certainly reflecting their intent to make their malware available to a large number of users, resulting in the targeting of a broader set of victims," Sekoia analysts stated in a blog post. "\[We\] assess that strengthening the security of their software is part of NoName057(16)'s efforts to continuously develop their capabilities, almost certainly driven by their active community as well as the increasing scrutiny of their activities from the CTI community."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Russian Hacktivist Platform 'DDoSia' Grows Exponentially

Apple's emergency patch, AI-generated art and more security headlines from the past week.

Thursday, June 29, 2023 14:06

Welcome to this week’s edition of the Threat Source newsletter.

AI-generated art is causing drama across the internet over the past few months, from Marvel TV show opening credits scenes to predatory YouTubers who claim YOU can make millions by having AI tools create children’s books for you.

There are all sorts of ethical and legal implications that AI-generated art has that I don’t have the space here to cover, but I did think it was worth noting that these tools are already being used in cyber attacks and online scams.

These tools can create extremely convincing deepfake art that could lead to the spread of misinformation or disinformation, especially concerning major news events and political figures. I’ve written about this in the newsletter before.

There are also dozens of apps that promise to create convincing AI art or portraits of people serving another malicious purpose. As McAfee pointed out in this blog post, some Android apps offered to “zhuzh up” users’ profile pictures with AI filters but were actually trojanized apps with hidden information stealers. And at the end of the day, they were all using the same basic filters. Many of these apps could also be stealing and re-using the pictures users submitted to these apps (remember the saga of the app that showed what it would be like when you got old?).

I have more to get to this week, so I’m not going to go much deeper into the subject, but as always, be vigilant of apps’ privacy policies and do a quick background check on their creators before downloading something hoping to create a Skrull version of yourself.

I’m also excited to show off this new video featuring a behind-the-scenes interview with Talos.

This video from Cisco Secure shines a spotlight on the evolution and future of ransomware. Watch it below or over on Cisco.com here to find out how our threat hunters identify new and evolving threats in the wild, and how their research and intelligence help organizations build strong defenses.

**The one big thing**

Apple released an emergency patch last week for all its operating systems for two zero-click vulnerabilities that could allow an attacker to completely take over a targeted device. The two vulnerabilities, identified as CVE-2023-32434 and CVE-2023-32435, were used to reportedly compromise phones in Russia. The issues were part of the so-called Triangulation spyware discovered on iPhones of employees of Kaspersky, a Russia-based cybersecurity company, but the malware was removed from phones after a device reboot.

**Why do I care?**

The chances of being targeted by the Triangulation spyware is slim-to-none based on what the security community knows to this point, but either way, the existence of a zero-day vulnerability in iOS is always big news. Apple encouraged users to upgrade to iOS 16.5.1 and iPadOS 16.5.1 for users of those devices. The company also said that CVE-2023-32434 "may have been actively exploited against versions of iOS released before iOS 15.7."

**So now what?**

All Apple users should update these affected products as soon as possible. The U.S. Cybersecurity and Infrastructure Security Agency also released an advisory telling “users and administrators to review \[Apple’s\] advisories and apply the necessary updates.”

**Top security headlines of the week**

The self-identifying hacktivist group “Anonymous Sudan” is **more active than initially thought.** While researchers are still unsure as to the group’s connections to any nation-states, the group says it’s advocating on behalf of Sudan. It first came onto the scene earlier this month, taking credit for a distributed denial-of-service attack against Microsoft that affected Outlook. Now, researchers are saying their activities actually started prior to that with attacks targeting Israel, Sweden and other nations earlier this year. Microsoft confirmed last week that a Layer 7 DDoS attack was responsible for outages affecting Azure, Outlook and OneDrive, saying that, “these attacks likely rely on access to multiple virtual private servers (VPS) in conjunction with rented cloud infrastructure, open proxies, and DDoS tools” and that there is “no evidence that customer data has been accessed or compromised." (Bloomberg, Bleeping Computer)

**The list of companies affected by the MOVEit breach continues to grow.** Clop, the threat actor behind the attacks, added Schneider Electric and Siemens Energy — two major electric corporations — to its leak site this week. The University of California Los Angeles (UCLA) also confirmed it discovered on June 1 that it was the target of the campaign, though it quickly engaged the college’s incident response team and patched the issue. Since the attack went public, Clop’s leak site mainly called out seven U.S. state and local governments, including the nation’s largest public-employee pension fund — the California Public Employees’ Retirement System. And the New York City public school system was also affected, with more than 45,000 students having their personal data stolen, including sensitive information like Social Security numbers. (The Record by Recorded Future, CyberScoop)

**The FBI seized the domain belonging to the infamous hacking site BreachForums,** three months after arresting its creator. Users of BreachForums were known for sharing and selling stolen personal data from a variety of websites and companies. BreachForums was quiet for several weeks after the admin, known as “Pompompurin,” was arrested. However, the site’s newest admin decided to launch the site on new servers earlier this month. In addition to the usual display of the law enforcement agencies’ logos who were involved in the takedown, BreachForums’ homepage now also displays an image of the avatar Pompompurin used in handcuffs. (TechCrunch, Infosecurity Magazine)

**Can’t get enough Talos?**

*   Service overview: Talos Incident Response purple team
*   Vulnerability Spotlight: Use-after-free condition in Google Chrome WebGL
*   Video: How Talos’ open-source tools can assist anyone looking to improve their security resilience
*   Talos Takes Ep. #144: What we know so far about the MOVEit zero-day making the rounds

**Upcoming events where you can find Talos**

**BlackHat** **(Aug. 5 - 10)**

Las Vegas, Nevada

**Grace Hopper Celebration (Sept. 26 - 29)**

Orlando, Florida

> _Caitlin Huey, Susan Paskey and Alexis Merritt present a "Level Up Lab" titled "Don’t Fail Knowledge Checks: Accelerating Incident Response with Threat Intelligence." Participate in several fast-paced activities that emphasize the importance of threat intelligence in security incident investigations. Attendees will act as incident responders investigating a simulated incident that unfolds throughout this session. Periodic checkpoints will include discussions that highlight how incident response and threat intelligence complement each other during an active security investigation._

**Most prevalent malware files from Talos telemetry over the past week**

**SHA 256:** 5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1  
**MD5:** 3e10a74a7613d1cae4b9749d7ec93515  
**Typical Filename:** IMG001.exe  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Coinminer::1201

**SHA 256:** 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa  
**MD5:** df11b3105df8d7c70e7b501e210e3cc3  
**Typical Filename:** DOC001.exe  
**Claimed Product:** N/A  
**Detection Name:** Win.Worm.Coinminer::1201

**SHA 256:** a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91  
**MD5:** 7bdbd180c081fa63ca94f9c22c457376  
**Typical Filename:** c0dwjdi6a.dll  
**Claimed Product:** N/A  
**Detection Name:** Trojan.GenericKD.33515991

**SHA 256:** e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c  
**MD5:** a087b2e6ec57b08c0d0750c60f96a74c  
**Typical Filename:** AAct.exe  
**Claimed Product:** N/A  
**Detection Name:** PUA.Win.Tool.Kmsauto::1201

**SHA 256:** 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725  
**MD5:** d47fa115154927113b05bd3c8a308201  
**Typical Filename:** mssqlsrv.exe  
**Claimed Product:** N/A  
**Detection Name:** Trojan.GenericKD.65065311

New video provides a behind-the-scenes look at Talos ransomware hunters

Categories: News
Tags: IoT

Tags:  Linux

Tags:  OpenSSH

Tags:  trojan

Tags:  botnet

Tags:  IRC

Tags:  attack

Tags:  compromise

Poorly configured Linux and Internet of Things (IoT) devices are at risk of compromise from a cryptojacking campaign.



(Read more...)




The post OpenSSH trojan campaign targets Linux systems and IoT devices appeared first on Malwarebytes Labs.

Poorly configured Linux and Internet of Things (IoT) devices are at risk of compromise from a cryptojacking campaign, according to researchers at Microsoft. The attacks, which involve brute forcing a way into a system, are designed to profit from mining in illicit fashion for cryptocurrency.

Once the attackers have broken into their target system, a patched version of OpenSHH, a remote login tool, is downloaded from a remote server. When the rogue version of this tool is deployed, it looks to backdoor hijacked systems and swipe credentials to ensure it lingers on the system for as long as it possibly can.

As Microsoft explains:

> Utilizing an established criminal infrastructure that has incorporated the use of a Southeast Asian financial institution’s subdomain as a command and control (C2) server, the threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal device resources for mining operations. The backdoor also installs a patched version of OpenSSH on affected devices, allowing threat actors to hijack SSH credentials, move laterally within the network, and conceal malicious SSH connections. The complexity and scope of this attack are indicative of the efforts attackers make to evade detection.

A backdoor on the system checks to see if the hijacked device is a honeypot—a fake system set up by researchers or someone else to make an attacker think that they’ve compromised a genuine system when in reality everything the attacker does is being logged.

If it determines the system is a honeypot, it exits. If it determines that the system is the real thing, it begins a process of data exfiltration to a chosen email address. The data that is taken includes:

*   Operating system version
*   Network configuration
*   The contents of /etc/passwd and /etc/shadow

Open source rootkits are installed in systems which support them, used to further hide malicious files and processes taking place under the hood. Activity records are removed from various places on the system to mask any malicious presence, and additional tools are installed to clean up other logs which could reveal evidence of sign-ins.

Years ago you’d occasionally see adware programs try to remove rivals from a PC, in order to take all of the ad revenue for its creator. Here, we have something similar happening with the cryptomining tools being used in this attack. It identifies mining processes by name and/or files, and then terminates the processes or blocks them outright. As a general point of order here, you don't really want lots of rival programs fighting it out in your systems. It could easily lead to unstable performance. Even worse if the programs doing the fighting aren't supposed to be there in the first place. They won't be playing by any theoretical rules, and so you simply can't predict what they'll do to gain the upper hand.

Meanwhile, the patched version of OpenSSH is designed to look like the legitimate version and so may prove hard to detect. That’s not all, however. There’s botnet activity too. A portion of the install makes use of an open-source IRC bot with Distributed Denial of Service (DDoS) features.

Microsoft claims to have traced this particular campaign to a member of a hacking forum who offers several tools for sale in what may be a dedicated malware as a service operation. The operating system giant has some specific advice for those who may be worried about this attack impacting their business:

*   Harden internet-facing devices against attacks
*   Ensure secure configurations for devices: Change the default password to a strong one, and block SSH from external access.
*   Maintain device health with updates: Make sure devices are up to date with the latest firmware and patches.
*   Use least-privileges access: Use a secure virtual private network (VPN) service for remote access and restrict remote access to the device.
*   When possible, update OpenSSH to the latest version.

Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

OpenSSH trojan campaign targets Linux systems and IoT devices

By Deeba Ahmed
According to Microsoft, the new campaign is ongoing and uses a backdoor to install a patched version of OpenSSH to hijack targeted devices.
This is a post from HackRead.com Read the original post: Patched OpenSSH Exploited for IoT, Linux Cryptomining

Apart from cryptomining, the campaign also involves hijacking SSH credentials, hiding malicious SSH connections, and more.

Microsoft researchers have discovered a new cryptojacking campaign that leverages custom and open-source tools to target IoT (Internet of Things) devices and Linux-based systems for cryptomining (aka cryptocurrency mining).

Attackers use a backdoor that can deploy a wide range of “tools and components,” such as rootkits and IRC bots, to steal device resources. This backdoor installs a patched version of OpenSSH to hijack impacted device systems and install a cryptominer.

Once this is done, the attackers can perform a range of activities, such as moving laterally in the network, hijacking SSH credentials, and hiding malicious SSH connections, apart from cryptomining.

The attackers need to hijack SSH credentials, for which they look for misconfigured Linux hosts. These hosts are brute-forced to gain initial access. When the target device is compromised, the first step is to disable the shell history.

The next step is to extract a trojanized OpenSSH package, “openssh-8.0p1.tgz,” from a remote server. It contains “benign OpenSSH source code and other malicious files,” such as backdoor binaries for arm4I, arm5I, x86, i568, i686, a shell script inst.sh, and an archive containing the shell script vars.sh, which has all the files needed for the backdoor to operate. After payload installation, the inst.sh script runs a backdoor binary matching the device’s architecture.

The backdoor is a shell script compiled using the Shell Script Compiler. It allows threat actors to distribute payloads and conduct post-exploitation attacks, such as stealing and sending device information, as well as clearing Apache, nginx, httpd, and system logs to hide their malicious activities and remain undetected.

To retain SSH access, the backdoor modifies two public keys in the system’s authorized key configuration files for all users. Additionally, this backdoor can install the logtamper open-source utility for clearing the wtmp and utmp logs that record user sign-in sessions and system event data.

In this campaign, as Microsoft’s Threat Intel team stated in its blog post, attackers use cryptojacking to install a cryptominer. In cryptojacking, computer resources are illegally drained to generate revenue. Almost all devices, tools, services, and IT infrastructure, including IoTs, are vulnerable to cryptojacking. Before launching the miner, all competing cryptomining processes are eliminated.

Additionally, the backdoor runs a modified version of a Kaiten malware-based DDoS client called ZiggyStarTux that executes bash commands received from the attacker’s C2 server. The C2 communications are established via an unidentified Southeast Asian financial institute’s subdomain to hide the malicious traffic.

The backdoor determines if the device is a honeypot by testing access to the virtual filesystem /proc. If it cannot access it, the backdoor exits. If it can access /proc, it extracts device data, such as OS version and network configuration, etc., and emails it to a hardcoded address (dotsysadminprotonmailcom) or the attacker’s address. The open-source rootkits it can compile/download/install include Reptile and Diamorphine, both available on GitHub.

Microsoft urges users to improve the security of internet-exposed devices by ensuring secure configurations, using strong passwords, and regularly updating firmware. A VPN should be preferred for remote access, and users should always use the latest version of OpenSSH.

1.  Why IoT Security in Healthcare is Crucial
2.  Illegal cryptomining farm using thousands of PS4s seized
3.  CoinStomp cryptomining malware targeting cloud services
4.  BotenaGo botnet malware targeting millions of IoT devices
5.  Malware hits Hive OS cryptomining users; steals wallet funds

Tag

#ddos