Feed aggregator

APT Gang Branches Out to Medical Espionage in Community Health Breach

Threatpost for B2B - Tue, 08/19/2014 - 09:29
The Community Health Systems data breach has been tied to a Chinese APT gang that has branched out to medical espionage, stealing patient data in an effort to target intelligence on medical device development.

Pro-Syrian Malware Increasing in Number, Complexity

Threatpost for B2B - Mon, 08/18/2014 - 14:48
Malware deployed against activists in Syria is increasing as the groups deploying these remote access tools become more sophisticated and utilize more complex tactics.

Microsoft Yet to Deliver Fix for Faulty Patch Tuesday Update

Threatpost for B2B - Mon, 08/18/2014 - 14:07
Microsoft said it is still working on a fix for a broken patch released last Patch Tuesday that is causing Blue Screens of Death and system crashes.

Siemens Patches DoS Vulnerability in SIMATIC S7 PLC

Threatpost for B2B - Mon, 08/18/2014 - 13:15
Siemens released an update for its SIMATIC S7-1500 CPU last week, patching a denial of service vulnerability in the programmable logic controller.

New Attack Binds Malware in Parallel to Software Downloads

Threatpost for B2B - Mon, 08/18/2014 - 11:21
Open source software distribution systems that lack security processes and integrity checks are prone to a new attack that binds malware to a download without modifying the original application.

ZeroLocker won't come to your rescue

Secure List feed for B2B - Mon, 08/18/2014 - 10:16

In recent times we've been seeing a lot of file-encrypting ransomware activity.

One of the new ones we've seen pop up in the last couple weeks is called ZeroLocker. There's indication the C&C configuration contains some errors which would prevent successful decryption. This is why we urge people not to pay up even more so than normal.

So far we've observed a limited amount of detections through our Kaspersky Security Network. The actors behind ZeroLocker are initially asking $300 worth of BTC for decrypting the files. This goes up to $500 and $1000 as time passes:

ZeroLocker adds a .encrypt extension to all files it encrypts. Unlike most other ransomware ZeroLocker encrypts virtually all files on the system, rather than using a set of pre-defined filetypes to encrypt. It doesn't encrypt files larger than 20MB in size, or files located in directories containing the words "Windows", "WINDOWS", "Program Files", "ZeroLocker" or "Desktop". The malware gets executed at boot from C:\ZeroLocker\ZeroRescue.exe.

Though there's a Bitcoin wallet hardcoded inside the binary the malware tries to fetch a new wallet address from the C&C. This is most likely done to make it more difficult to trace how successful the operation is and where the money goes.

We've gathered several Bitcoin wallet addresses and at the time of writing none had any transactions associated with them. As the C&C server is providing the Bitcoin wallet information it's possible the attackers are able to use a unique wallet for each victim.

The malware generates one random 160-bit AES key to encrypt all the files with. Due to the way the key is generated the key space is somewhat limited, though still large enough to make general brute forcing unfeasible. After encryption the malware runs the cipher.exe utility to remove all unused data from the drive, making file recovery much harder. The encryption key, together with a CRC32 of the computer's MAC address, and the associated Bitcoin wallet is sent to the server.

Interestingly enough, the encryption key along with the other information is sent through a GET request, rather than a POST. This results in a 404 on the server. This could mean that the server is not storing this information. That means victims who pay up may likely not see their files restored.

Several other URLs that the malware tries to get result in 404s as well, which indicates this particular operation may still be in its infancy. When those errors are fixed we may see ZeroLocker deployed on a larger scale. These operations rely on people paying up. Don't do it. Make sure you have backups instead.

We detect current ZeroLocker samples as Trojan-Ransom.MSIL.Agent.uh.

The Syrian Malware House of Cards

Secure List feed for B2B - Mon, 08/18/2014 - 03:00

 Our full Report

Introduction

The geopolitical conflicts in the Middle East have deepened in the last few years. Syria is no exception, with the crisis there taking many forms, and the cyberspace conflict is intensifying as sides try to tilt the struggle in their favor by exploiting cyber intelligence and using distortion.

The Global Research & Analysis Team (GReAT) at Kaspersky Lab has discovered new malware attacks in Syria, using some techniques to hide and operate malware, in addition to proficient social engineering tricks to deliver malware by tricking and tempting victims to open and launch malicious files. The malware files were found on activist sites and social networking forums, some other files were also reported by local organizations like CyberArabs and Technicians for Freedom.

The full report detailing the attacks and related activities can be found here.

A glance at what was discovered

The number of attacks and malicious files being distributed is constantly increasing as the attackers become more organized and proficient. The samples are all based on Remote Administration Trojan Tools (RATs)
The number of malicious files found: 110
The number of domains linked to the attacks: 20
The number of IP addresses linked to the attacks: 47

The National Security Program - what the malware attacks look like

Masquerading as a reportedly "Government leaked program" that has the names of all wanted people in Syria, the National Security Program conceals a full featured RAT client to steal all sorts of information under one of its buttons.

برنامج الأمن الوطني.exe (The national security program)

Using shockingly disturbing videos to distribute malware

A disturbing video showing injured victims of recent bombings was used on YouTube to appeal to people's fear and prompt them to download a malicious application available on a public file sharing website. After initial analysis, the file named "فضائح.exe" (Scandals.exe) proved to be heavily obfuscated with the commercial utility "MaxToCode" for .NET in order to avoid early detection by antivirus solutions.

Did you install your "Ammazon" Security Suite?

If you thought the era of fake antiviruses was over, here comes this newly developed Syrian sample to challenge your beliefs. With the innocent title of "Ammazon Internet Security", this malicious application tries to mimic a security scanner, even including a quite thorough graphical user interface and some interactive functionality.

Your "Ammazon" is now secure, what about the rest of your network?

Total Network Monitor (which is a legitimate application) is inside another sample found, being used with embedded malware for spying purposes. Offering security applications to protect against surveillance is one of the many techniques used by malware writing groups to get users desperate for privacy to execute these dubious programs.

Instant messaging, instant infection

It's also the case with other samples, where social engineering does all the heavy work. Instant messaging applications for desktop operating systems have been used in the past to spread malware and it seems Syrian malware authors have jumped on the bandwagon.

Beware of Chemical Attacks

Another of the attacks using social engineering tricks, the sample named Kimawi.exe (Arabic for Chemicals) with a JPG icon, is a RAT file bound to the image Kimawi.jpg. The picture is a previously leaked paper supposedly from the regime in Syria warning military units to prepare for Chemical Attacks. The file is being sent by email to selected victims.

FAQ What is new?

The threat actors are becoming more organized, the number of attacks is increasing and the samples being used are becoming more sophisticated, while also relying extensively on powerful social engineering tricks that many people fall for.

Where are the victims and the attackers?

The victims infected when accessing the hacked forums and social networking sites tend to be ordinary users or activistshey were, or specific targets if they receive the malware via email, Skype, or messages on social networking sites.

The victims are also located outside Syria. We have seen victims of Syrian-based malware in:

  1. Turkey
  2. Saudi Arabia
  3. Lebanon
  4. Palestine
  5. United Arab Emirates
  6. Israel
  7. Morocco
  8. France
  9. United States

The attackers' command and control centers were tracked to IP addresses in Syria, Russia, Lebanon, the US and Brazil.

How many have fallen victim?

We believe the number of victims exceeds 10,000, with some of the files being downloaded more than 2000 times.

The attackers' malware samples and variations have increased dramatically from only a few in Q1 2013 to around 40 in Q2 2014.

What is the impact on victims?

Remote Administration Trojans tools are used to fully compromise the system on victim devices. RATs are capable of stealing user credentials in addition to activating camera and microphone functionalities...

Are users protected?

Kaspersky detects and blocks all the samples that have been found. They are detected as follows:

  • Trojan.MSIL.Zapchast
  • Backdoor.Win32.Bifrose
  • Backdoor.Win32.Fynloski
  • Backdoor.Win32.Xtreme

More details and analysis of the attacks and malware samples can be found in the full report here.

 

Further reading

If you'd like to read more on the subject, CitizenLab and EFF have published several other good analyses of related malware and attacks:

Supermarkets Nationwide Affected by Albertsons, SUPERVALU Data Breach

Threatpost for B2B - Fri, 08/15/2014 - 12:27
Albertsons and SUPERVALUE, the second and third largest grocery store chains in the U.S., yesterday announced that customer payment information was exposed a month-long data breach earlier this summer.

Cridex Malware Takes Lesson From GameOver Zeus

Threatpost for B2B - Fri, 08/15/2014 - 09:05
Researchers have now identified a new variant of the Cridex malware that has adopted some of the techniques that made GOZ so successful in its day.

Google Fixes 12 Vulnerabilities in Chrome 36

Threatpost for B2B - Fri, 08/15/2014 - 08:23
Google patched its Chrome browser this week, fixing 12 vulnerabilities including both a serious information disclosure bug and a use-after-free vulnerability that could let users obtain potentially sensitive information and execute arbitrary code.

Gameover Zeus Botnet Rebuilds

Threatpost for B2B - Thu, 08/14/2014 - 15:58
Research from Arbor Networks points to a rejuvenated GameOver Zeus botnet that has grown more than 1,800 percent, confirming it has been rebuilt from scratch.

Easy Pickings at DEF CON Router Hacking Contest

Threatpost for B2B - Thu, 08/14/2014 - 13:10
Fifteen zero day vulnerabilities were exploited during the SOHOpelessly Broken router hacking contest at DEF CON.

Google Adds Warnings About Deceptive Software to Safe Browsing Service

Threatpost for B2B - Thu, 08/14/2014 - 12:18
The Google Safe Browsing service has become an integral part of most of the major browsers, integrating malware alerts, warnings about malicious Web sites and suspicious content. The company has been expanding the capabilities of the service steadily over the last few years, and now Google is adding warnings about deceptive software to the service. […]
Syndicate content