Home Blog Page 121

Agent Tesla RAT Upgrades Itself with New Delivery and Evasion Techniques

WhisperGate malware campaign, Flagpro malware, MosaicLoader Malware, drinik

Malware is often on the lookout for newer ways to sneak and evade security. One such malware is Agent Tesla. It is an information stealer and Remote Access Trojan (RAT) active since 2014. It remained as one of the most widespread threats to Windows users. Cybercriminals often leverage Agent Tesla malware to steal user login credentials and other sensitive information from victims via screenshots, keyboard logging techniques, and clipboard capture.

Research published by cybersecurity firm Sophos details the latest evasion techniques of how the Agent Tesla operators disable endpoint protection before they install the malware and payloads.

Agent Tesla’s New Capabilities

Sophos stated that threat actors behind Agent Tesla are using a multi-stage process where a .NET downloader takes large chunks of malware from legitimate third-party websites like pastebin and hastebin. The attackers then join, decode, and decrypt the chunks to form the loader that carries the malicious payload.

In addition, the malware alters the code in Microsoft’s Anti-Malware Software Interface (AMSI) to disable endpoint security protection and install the malware without being blocked. AMSI service enables applications and services to integrate with installed security products.

Sean Gallagher, senior threat researcher at Sophos, said, “Agent Tesla malware has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners. The most widespread delivery method for Agent Tesla is malicious spam.”

Remediation Measures

  • Install an intelligent, security solution that can screen, detect, and block suspicious emails and their attachments before they reach users.
  • Implement the recognized authentication standards to verify emails as what they claim to be.
  • Educate employees to spot the warning signs of suspicious emails and what to do if they encounter one.
  • Advise users to double-check the emails that come from the address and the person they claim to be.
  • Advise users to never open attachments or click on links in emails from unknown senders.

“Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them,” Gallagher added.

Airtel Data Leak: Close to 2.5 Mn Indian Users Likely Affected

India, cybercriminals, Airtel, Bharti Airtel, Airtel data leak, data leak, data breach, Aadhar, Aadhar data leak, identity theft, India Today, India Today Tech, data on sale,

India has been tiptoeing on finalizing its Personal Data Protection (PDP) Bill for a long time now. A month ago, it made 89 amendments and added one new clause to this long-standing bill, which has been debated in the parliament since its introduction in 2019. However, this needs to speed up, now more than ever, for the bill to become an Act/law. We are saying this because cybercriminals are polishing their ways of getting away, and the end-users are suffering, which is quite evident from the latest instance where a likely data leak has hit Indian telco giant Airtel, exposing the personally identifiable (PII) of millions of users. If this were to happen in the EU, the said company would face steep fines, as per the GDPR.

Airtel Data Leak

According to a report from a national publication house, India Today, nearly 2.5 million (25 lakh) subscribers of Airtel (registered under Bharti Airtel Ltd.) have likely fallen prey to a data leak that included their PII data. Airtel is India’s largest telecom service provider. Security researcher Rajshekhar Rajaharia made the discovery of this alleged data leak public through a tweet.

Reports suggest that the leaked information included the following:

  • Telephone number
  • Address
  • City
  • Aadhaar card number
  • Gender details

Related News:

Zhenhua Data Leak: Is China Spying and Collecting Data on Indians?

Was Airtel Aware?

Rajaharia shared another tweet where he revealed that Airtel’s security teams knew about the alleged leak and were in constant contact with the cybercriminals going by the name “Red Rabbit Team.”

According to the email trail presented in the video, the cybercriminals first reached out to the Airtel security team on December 12, 2020. They asked for a payout of $3,500 worth of Bitcoins in exchange for the leaked data. However, Airtel’s security team kept pushing them to allow extra time for negotiation. Eventually, out of infuriation, the Red Rabbit team posted the leaked data on the open web, which included a sample data set of 2.5 million subscribers as proof.

Rajaharia noted that the website containing the sample data set was taken down a few days ago and contained data majorly of Airtel’s subscribers in the Jammu and Kashmir region. However, if the leaked data was just a subset of the original data set, it could well mean that this is one of the biggest data leaks in India because Airtel has a subscriber base of nearly 327 million in the country.

An Earlier Instance

Around a year or two back, Airtel had accepted a security flaw in its mobile app’s API that allowed potential threat actors to fetch sensitive user information of any Airtel subscriber. Although Airtel quoted,  “We’ve fixed it,” could this have led to the current data leak situation?

Related News:

Airtel Accepts Security Flaw, Says, “We’ve Fixed it”

Ransomware – A Pandemic Plaguing the Digital World

ransomware

The world faced a growing spate of ransomware attacks in 2020. While malware was planted on systems throughout the year, it was detected only at the end of the year. According to a recent report,  more than 500 successful ransomware attacks were officially reported in over 45 countries in the past year (H2 2019 to H1 2020). The financial damages accounted for over $1 billion ($1,005,186,000) and a future forecast predicts this number to rise 20 times to $20 billion by 2021. Experts believe this number could double-up or even rise fivefold if all attacks are reported.

Ransomware operators targeted health care institutes, banks, government agencies, and universities. Unsettled employees — many of whom were working from home — and a distributed and depleted workforce, meant an increased likelihood of an incident happening, and it did.

The cover story in the February issue of CISO MAG includes a list of the top ransomware attacks and related incidents that sent aftershocks through the business world in 2020. It also compares the different generations of ransomware, to show how this threat became more deadly over the years. Our editors dug deep to discover some scary facts and they write about what the next generation of ransomware could do, and how it would come knocking at your doors (networks).

Our editors also spoke to industry experts and curated their opinions and insights, to validate our beliefs.

We discovered new trends and changing attack vectors. For instance, attackers are now going after NAS devices, because these are backup repositories. Attention CISOs! Even your backups will be encrypted and locked. Another trend is ransomware-as-a-service. The bad guys are keeping up with trends and now offering services on the dark web.

Experts that we spoke to are already talking about new security measures like hardware-based encryption (Intel and Cybereason) and off-line storage (remember DLT magnetic tape storage?).

But the industry is not taking all this lying down. Efforts are on to fight ransomware and you can expect more news on this front in 2021. The Institute for Security and Technology launched the Ransomware Task Force in partnership with experts from multiple domains like the industry, government, law enforcement, nonprofits, cybersecurity insurance, and international organizations.

Read more about all this (and other stories about Ransomware) in our February issue.

Subscribe and download CISO MAG here.

 

 

 

 

 

Ransomware Operators Exploit 2 CVEs in VMWare ESXi

ransomware, ryuk ransomware, cox media

Ransomware gangs are evolving every day. The latest trend suggests that they are after the backup servers or machines that contain backed up data. Why? Because once these are compromised, their victims have no option but to pay the ransom. With a purview of this trend, ransomware operators are said to be exploiting two previously known vulnerabilities in VMWare ESXi logged under CVE-2019-5544 and CVE-2020-3992 to target their victims’ virtual hard disks.

The Two VMWare ESXi Vulnerabilities

In October 2020, a Reddit user reported a ransomware attack that encrypted nearly 200 virtual machines (VMs) at the datastore level in which a ransom note was found at the root of the datastores. The user further stated that since the VMWare ESXi management was not segregated from the VMs, and hence the attackers successfully encrypted the VMs.

Related News:

VMware Adds New Edge to its SASE Capabilities

Fast forward to January 2020. Another Reddit user found astounding evidence of Brazil’s Superior Justice Tribunal (SJT) being hit by a similar ransomware attack encrypting nearly 1,000 VMs with the exact ransom note. The sophistication of the attack was such that the attackers even went after disk backups. However, some old school tape backups remained untouched and saved the day for many.

On analyzing these attacks, researchers observed that in both the instances, the attackers used CVE-2019-5544 and CVE-2020-3992 vulnerabilities in VMware ESXi. ESXi is a solution that allows multiple virtual machines to share the same hard drive storage.

Dissecting the ESXi Ransomware Attack

The chronology of the ESXi ransomware attack:

  1. The attackers sent phishing emails to the target organization’s employees/users, of which three unknowingly fell prey by clicking and installing a Trojan.
  2. The attackers then escalated the privileges using CVE-2020-1472. The workstations had anti-virus protection, which at the time did not have this Trojan’s signature (it was released a few days later).
  3. The attackers gained access to hosts that had access to ESXi’s management subnet, as they already had Active Directory (AD) admin privileges.
  4. Without having to compromise vCenter, they were able to run arbitrary code on the ESXi hosts using CVE-2019-5544  or CVE-2020-3992.
  5. This led to the creation of an executable file (written in Python language) on ESXi hosts, which encrypted all the VMs.

Kaspersky, which named it as RansomEXX Trojan, gave a proof-of-concept of how this Trojan works. Click here for more info.

Remedial Measures

Researchers have found the following MD5 signatures in the attacks carried out, which all security teams need to note:

MD5 (svc-new/svc-new) = 4bb2f87100fca40bfbb102e48ef43e65MD5 (notepad.exe) = 80cfb7904e934182d512daa4fe0abbfbSHA1 (svc-new/svc-new) = 3bf79cc3ed82edd6bfe1950b7612a20853e28b0SHA1 (notepad.exe) = 9df15f471083698b818575c381e49c914dee69de

P.S.: svc-new/svc-new, a python script, was found inside the ESXi hosts, and the notepad.exe was found on the encrypted Windows servers.

But what if we told you that this ransomware can be avoided in the first place. Here are some suggestions:

  • Disable the VMware CIM Server (It is enabled by default).
  • Apply least privileges on your Active Directory administration.
  • Segregate Admin and Domain admin accounts on Active Directory.
  • Establish a Group Policy Object (GPO) set to log out users on inactivity instead of disconnecting them on remote desktop servers.
  • Keep and monitor audit trails of Domain Admin accounts.
  • Review backup routines. Have a master backup if possible and make sure they are segregated from regular backup. Even better, maintain an offsite read-only backup to make sure recovery is possible.
  • Constitute an isolated network for ESXi/vCenter, which needs to have its access audited, using a jump server.
  • Maintain IP access controls vCenter and ESXi.
  • Remove vCenter Active Directory integration and maintain distinct passwords.
  • Disable SSH on all ESXi hosts as a precautionary measure.
  • Implement usage of canary files monitored by a SIEM.
  • Use 2FA wherever possible, especially on admin accounts and high-priority accounts.
  • Patch Windows Servers, workstations, ESXi servers, backup servers, vCenter frequently. Review failed patch reports and report immediately to the said service provider to assure all functions are up to date.

Related News:

VMware Adds New Edge to its SASE Capabilities

Microsoft Rolls Out Application Guard for Office

Hackers Target Office 365 Users with SurveyMonkey Phishing Campaign

Microsoft has released Application Guard for Office, a defensive technology that detains untrusted Office documents from accessing trusted resources on a user’s device. The new defensive service prevents malware or malicious files from penetrating a device’s operating system or application software, keeping the user’s perimeter secure from emerging cyberattacks. The Application Guard for Office will apply to MS Word, MS Excel, PowerPoint for Microsoft 365, and Windows 10 Enterprise.

Hardware Requirements to Install Application Guard for Office

  • CPU: 64-bit, 4 cores (physical or virtual), virtualization extensions (Intel VT-x OR AMD-V), Core i5 equivalent or higher recommended
  • Physical memory: 8-GB RAM
  • Hard disk: 10 GB of free space on the system drive (SSD recommended)

Software Requirements

  • Windows OS: Windows 10 Enterprise edition, Client Build version 2004 (20H1) build 19041 or later.
  • Office application: Office Current Channel Build version 2011 16.0.13530.10000 or later.
  • Update package: Windows 10 cumulative monthly security update KB4571756.

How to Enable Application Guard for Office?

  1. Download and install Windows 10 cumulative monthly security updates KB4571756.
  2. Select Microsoft Defender Application Guard under Windows Features and select OK. Enabling the Application Guard feature will prompt a system reboot. You can choose to reboot now or after step 3.
Image Courtesy: Microsoft Support

3. Search for Microsoft Defender Application Guard in Managed Mode, a group policy in Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard. Turn on this policy by setting the value under Options as 2 or 3, and then selecting OK or Apply.

4. Restart the system.

Application Guard for Office restricts untrusted documents to reach corporate resources, users’ intranets, identity, and arbitrary files on the computer. Microsoft said, “If a user tries to access a feature that has a dependency on such access — for example, inserting a picture from a local file on disk — the access will fail and produce a prompt like the following example. To enable an untrusted document to access trusted resources, users must remove Application Guard protection from the document.”

Related Story: Microsoft to Launch Enforcement Mode to Address Critical “Zerologon” Flaw

TeamTNT Spreads Malware with New Detection Evasion Tool “Libprocesshider”

Zero Trust, cybersecurity

Security experts at AT&T Alien Labs uncovered a new detection evasion tool leveraged by threat actor group TeamTNT. Dubbed “Libprocesshider,” the new tool is copied from open-source repositories. It helps cybercriminals hide their malware and malicious process from process information programs like “ps” and “lsof,” acting as a defense evasion technique. The purpose of Libprocesshider is to hide the TeamTNT bot from process viewer tools and remove malware traces by deleting the bash history.

“The tool implements the function readdir(), which is being used by processes such as `ps` to read the /proc directory to find running processes and to modify the return value in case there is a match between the processes found and the process needed to hide. The new tool arrives within a base64 encoded script hidden in the TeamTNT cryptominer binary or ircbot,” AT&T said.

Libprocesshider’s Capabilities

  • Modify the network DNS configuration
  • Set persistence through systemd
  • Drop and activate the new tool as a service
  • Download the latest IRC bot configuration
  • Clear evidence of activities to complicate potential defender actions

How Libprocesshider Penetrates?

  • First, Libprocesshider is dropped as a hidden tar file on disk.
  • The script decompresses it and writes it to ‘/usr/local/lib/systemhealt.so’ and adds it to preload via ‘/etc/ld.so.preload.’
  • This is then used by the system to preload the file before other system libraries, allowing the attacker to override common scanning operations.

“Through the use of Libprocesshider, TeamTNT once again expands their capabilities based on the available open-source tools. While the new functionality of Libprocesshider is to evade detection and other basic functions, it acts as an indicator to consider when hunting for malicious activity on the host level,” AT&T added.

Decoding the SolarWinds Hack

decoding the SolarWinds hack, CISO MAG interview

After Thanksgiving, the working class, especially the IT workforce, CISOs and CIOs, would have loved to sit back and sip on hot chocolate during the holiday season. After all, the COVID-19 pandemic stretched their resources beyond imagination as they worked around the clock to secure remote workforce and support business continuity plans. But this was a distant dream! There was a ticking time bomb waiting to explode, and when it did, forget hot chocolate, the cybersecurity industry found itself in a hot mess with SolarWinds.

The SolarWinds attack was discovered in mid-December last year and has since been in the news showcasing the extent of damages it has caused. The gravity of the situation seemed low at the beginning, with tech companies like Microsoft and FireEye claiming they had devised a “Killswitch” for the hack. But soon, the can of worms was opened when the White House issued an official statement accepting that multiple Federal Agencies were targeted in the hack. The situation got messier when Microsoft and Malwarebytes issued statements of compromise on how their source code was accessed in the attack.

Questions were left unanswered. So, we decided to bring you definitive answers to your what, when, why, and how of the SolarWinds hack. In a fireside chat with Mihir Bagwe,Tech Writer at CISO MAG, Pushkar Tiwari, Director Development at Symantec Enterprise Division of Broadcom Inc., unfolds the entire episode. Tiwari has closely followed and analyzed the modus operandi of the hack.

He has been leading Data Loss Prevention (DLP) and Cloud Access Security Broker (CASB) solutions in his current role and has more than 15 years of experience in cybersecurity and enterprise software.

Edited excerpts from the interview follow:

PrevNext

1. The Biggest Hack?

decoding the SolarWinds hack

A.

The hack has impacted more than 18,000 customers of SolarWinds across the globe. This includes a lot of Fortune 500 customers and U.S. federal agencies. It was a stunningly large and sophisticated operation that gave attackers access to a vast trove of the U.S. government emails. It can be considered as the biggest cyber raid against the U.S. government in years.

Another important characteristic of this attack was it stayed undetected for six to nine months. This gave an ample amount of time to attackers with privileged access to important and sensitive networks.

2. The Cause and Difference

decoding the SolarWinds hack

A.

SolarWinds breach is a classic supply chain attack. Attackers used Sunspot malware to get access to the company’s software development pipeline and injected the Sunburst backdoor into the SolarWinds Orion Platform DLL. The backdoor comprised of around 4,000 lines of code that allowed the threat actor behind the attack to operate unfettered with elevated access in a highly-sensitive network.

The software update, which contained this backdoor, was made available to SolarWinds customers using their Orion platform. More than 18,000 customers downloaded this update from the authenticated source of SolarWinds. Once the software gets updated in the customer’s environment, the backdoor stays dormant for about 14 days and then starts communicating with the command-and-control server.

SolarWinds network management and security solutions are expected to run with elevated privilege in customers’ environments to provide the desired network management capabilities. This enabled the backdoor code as well to run with elevated privilege and provided unrestricted access to the network.

The backdoor was receiving the instructions on actions to be performed on the network from the command-and-control center and the backdoor was sending sensitive information to this server.

This attack is unlike other prior attacks like Equifax or the Sony data breach. In those hacks, attackers exploited the vulnerabilities in the software or got access to privileged credentials. This kind of attack only impacts very few customers.

3. The Late Detection

decoding the SolarWinds hack

A.

This attack was conducted by highly sophisticated attackers. They managed to get access to the SolarWinds deployment pipeline in September 2019 and employed various techniques to stay undetected in their environment. The backdoor initialization had very few lines of code and was nicely blended with the existing code of the Orion platform. They made sure that these lines of code do not lead to build failure or introduce any error to their existing code path.

Backdoor code had specific checks to not trigger in SolarWinds test environment so that it does not get detected during their quality control process. It also ensured to remove any security products by meddling with registry keys, or it would not run if the security product were running.

Communication with the command-and-control server was also done in a very discrete way and leveraged DNS response like A Record and CNAME in a non-standard way and interpreted them to perform malware actions.

These different sets of strategies were meticulously executed and kept Sunburst undetected in SolarWinds and their customers’ environment for a longer time.

4. The Vulnerability Exploited

decoding the SolarWinds hack

A.It was a typical software supply chain attack. Threat actors deployed Sunspot malware, which monitors the processes involved in compiling and building Orion product code — and in modifying one of the source files to include initialization code for the Sunburst backdoor. It appears that a significant amount of investment was made to ensure that the code was properly inserted and that the presence of malware remained undetected in their build environment.

5. The Worst Affected

decoding the SolarWinds hack

A.

The overall client list includes a lot of big names from the private sector as well as U.S. government federal agencies like the U.S. Military, the Department of Homeland Security, the Treasury Department, and the Department of Commerce.  Its list of private sector customers is also huge and includes different business verticals like security, technology, telecommunications, and aviation.

This attack has impacted businesses of multiple sectors, and a lot of organizations are still evaluating the impact. Organizations will not reveal the true extent of damage done.

6. The Attackers Involved

decoding the SolarWinds hack

A.

As per the U.S. government’s investigations, Russia was most likely behind this attack. The Federal Bureau of Investigation (FBI), the Cyber Security and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA) released a joint statement stating that a task force has been created to investigate the extent of the attacks and concluded that an advanced persistent threat (APT) actor is likely Russian in origin.

As per Kaspersky’s research, there are some links between the SolarWinds attacks and the Russian Turla (aka Waterbug) espionage group. There are several similarities between the Sunburst backdoor and older malware known as Kazaur.

The clear motivations are yet to be known but based on state actors involved, the most likely motivations could be intelligence gathering.

There is some news that the website named SolarLeaks reported being selling data stolen in the SolarWinds attacks.

7. Were You Hacked?

decoding the SolarWinds hack

A.

To know if your organization is affected by the hack, a detailed assessment needs to be done for the software inventory and needs to be ensured that SolarWinds code is not used in the environment directly or indirectly.  If any machine is running the SolarWinds code, it needs to be immediately quarantined and carefully assessed to check if the machine is infected.

A thorough evaluation is needed to seek out any indication of a compromised network. If there are any signs of an attack, all instances of SolarWinds Orion must be disconnected from the network immediately. Also, all traffic to and from SolarWinds Orion needs to be blocked, and compromised accounts must be identified and removed.

After all, compromised accounts and prior instances of SolarWinds have been updated or removed, all credentials used by or stored in SolarWinds Orion must be reset.

8. Prevention in Future

decoding the SolarWinds hack

A.

The SolarWinds attack is an eye-opener for all of us. It has demonstrated build systems are very critical production systems, and they should get their due attention. Build systems should have a similar or higher level of security requirements than production environments. Build systems need to have stricter security audits.

This attack exposes that no industry standard specifically covers the security of vendors’ software development process. As part of the vendor’s selection process, their software build and development process should also be reviewed.

About the Interviewer
CISO MAG Writer - Mihir Bagwe
Mihir Bagwe is a Tech Writer and part of the editorial team at CISO MAG. He writes news features, technical blogs, and conducts interviews on latest cybersecurity tech and trends.

 

Other Interviews from the Author:
Other Posts from the Author:

Cybercriminals Play Spy Game with NoxPlayer Users in Asia

battle of galaxy game

The online media and entertainment industry has been recently bombarded by multiple cyberattacks. So much so that the gaming industry has itself reported nearly 10 billion cyberattacks in only the last two years. However, the latest findings from ESET researchers suggest that threat actors are now turning towards espionage campaigns,  unlike others. But what is their modus operandi?

NoxPlayer – The New Spy Games Version

NoxPlayer, which is a product from BigNox, emulates Android games on Windows and macOS desktops. Thus, it is generally used by gamers for testing and playing mobile games on their computers. ESET researchers found striking evidence that one of the company’s official API (api.bignox.com) and file-hosting servers (res06.bignox.com) was compromised by unknown threat actors in September last year.

Related News:

Gaming Industry Suffered 10 Billion Cyberattacks in Two Years

However, unlike recent cyberattacks, where threat actors installed malware or ransomware to exfiltrate data and demand hefty ransoms, they only installed three malware for spying on their victims. What made things more unusual was the fact that attackers did not target all users either. They only targeted five users, which included targets from Hong Kong, Sri Lanka, and Taiwan. It meant it was a sophisticated and highly targeted espionage campaign.

On further analysis of the three malware deployed during this supply chain attack, the research team could draw parallels with another supply chain attack against the Myanmar presidential office in 2018 and Hong Kong University in 2020. The same malware strains were used in those attacks too.

In order to help users determine whether they installed the malware-ridden update of NoxPlayer and what remedies could be applied, ESET released a detailed report, which can be viewed here.

Related News:

Level-Up! Five Security Precautions for Online Gamers

1...120121122...410Page 121 of 410