Brad Hawkins, Author at Safernet

Ryuk Ransomware Continues Assault in Spain as Ministry of Labor and Social Economy is Brought Offline

Post On: 19 June, 2021 By : Brad Hawkins

Ryuk Ransomware is continuing its attacks against state and private enterprises in Spain after the Spanish Ministry of Labor and Social Economy (MITES) was forced offline last Wednesday. Presently, they are working to restore services. MITES is a ministerial department with an annual budget of almost €39 million, charged with coordinating and supervising Spain’s employment, social economy, and corporate social responsibility policies.

“The Ministry of Labor and Social Economy has been affected by a computer attack,” MITES’ media office said after the attack. “The technical managers of the Ministry and the National Cryptological Center are working together to determine the origin and restore normality as soon as possible.”

The Ministry website remained online after the Ryuk Ransomware attack, however both the communications and multimedia offices were down.

Spain has suffered from a spree of Ryuk Ransomware attacks since March this year, when the Spanish Servicio Público de Empleo Estatal (SEPE), which is a part of MITES, was compromised by Ryuk.

The incident impacted more than 700 agency offices across Spain after hackers encrypted the agency’s network systems. According to an announcement made on the agency’s website at the time, the ransomware also spread beyond SEPE’s workstations and reached the agency’s remote working staff’s laptops. As a direct result of the ransomware attack that hit SEPE’s network, hundreds of thousands of appointments made through the agency were delayed throughout Spain.

Ransomware attacks have been common in Spain, with a leading Spanish managed service provider (MSP), and Cadena SER (Sociedad Española de Radiodifusión), Spain’s largest radio station, hit by ransomware in November 2019.

Ryuk Ransomware Analysis

Note: This Analysis of Ryuk Ransomware was carried out be independent researcher Abdallah Elshinbary.

The dropper first checks the windows MajorVersion and if it’s equal to 5 (windows 2000 | windows XP | Windows Server 2003), it drops the ransomware executable at C:\Documents and Settings\Default User\ , otherwise it drops it at C:\users\Public.

The name of the dropped executable is five randomly generated characters.

f the creation of this file failed, Ryuk drops the executable at the same directory of the dropper with replacing the last character of its name with the letter ‘V’ (If the dropper name is ryuk.exe, the dropped executable will be ryuV.exe).

Next we can see a call to IsWow64Process() and if it returns true (which means Ryuk is running at a 64 bit system), it writes the 64 bit binary to the dropped executable, else it writes the 32 bit binary. The 2 binary files are stored at the .data section.

The last step is a call to ShellExecuteW() to execute the second stage executable with passing it one argument which is the dropper path (This is used later to delete the dropper).

Before the dropper exits, it passes its path to the second stage executable as a command line argument which in turn deletes the dropper.

Ryuk uses the very well know registry key to achieve persistence, It creates a new value under the name “HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos” and its data is set to the executable path which in my case is “C:\users\Public\BPWPc.exe”.

Ryuk has a long list of predefined services and processes to kill using net stop and taskkill /IM respectively. During this process, Ryuk Ransomware will try to kill off many antivirus services.

Ryuk drops a batch script at C:\Users\Public\window.bat which deletes all shadow copies and possible backups, then the script deletes itself.

Ryuk uses a multi threading approach for the encryption process, it creates a new thread for each file it encrypts which makes it very fast.

It starts enumerating files using FindFirstFileW() and FindNextFileW() then it passes each file name to a new encryption thread. Each encryption thread starts by generating a random 256 AES encryption key using CryptGenKey(), Ryuk utilizes the WindowsCrypto API for the encryption. Then it goes into the typical encryption loop, the files are encrypted in chunks with a chunk size of 1000000 bytes.

Finally Ryuk write a metadata block of size 274 bytes at the end of the file. The first 6 bytes are the keyword HERMES. After that, The AES key is encrypted with an RSA public key before it’s written to the end of the file and then exported using CryptExportKey(), This function generates 12 bytes of Blob information + 256 bytes (the encrypted key).

The RSA public key is embedded in the executable, it’s imported using CryptImportKey() and passed to every encryption thread.

The Malware enumerates network shares using WNetOpenEnumW() and WNetEnumResourceA() respectively. For each network resource found, the resource’s name will be appended to a list separated by a semicolon. This list will be used later to encrypt these network shares with the same encryption process above.

Protection

Malware is an ever-present threat for governments, businesses, and homes. It is important to also have the tools necessary for protection against threats at any level. One of these tools is SaferNet.

SaferNet is the perfect solution to the cybersecurity issues that individuals, families, and businesses face today. It not only connects every device using a secure, 24/7 always on, military grade VPN, but it also stops outside cyberthreats, malware and viruses as well. On SaferNet, all users are protected anywhere in the world, all the time, on any cellular or Wi-Fi network. In addition to SaferNet’s VPN and cyber protection, it also offers a range of employee or parental/family internet controls including internet filtering, monitoring, scheduling, and blocking access to websites or even entire website categories

Typically, a business or family would need 3 separate services for a VPN, Malware Protection, and Internet Controls; SaferNet offers all 3 features in one service. SaferNet truly is an endpoint security presence that can be implemented in minutes around the world, on phones, laptops, tablets, and computers at an economical price point that caters to all sizes of businesses and families. SaferNet guarantees a smooth setup and installation process that takes only minutes, and an easily accessible control hub for you to monitor all your employee’s or family members devices; including activity, time spent online, and threats blocked.

Identity Theft Fears Grow as Audi and Volkswagen Suffer Data Breach Affecting 3.3 Million Customers

Post On: 19 June, 2021 By : Brad Hawkins

Identity theft concerns are growing as Audi and Volkswagen have suffered a data breach affecting 3.3 million customers. The breach occurred when a vendor exposed unsecured data on the internet. Volkswagen Group of America, Inc. (VWGoA) is the North American subsidiary of the German Volkswagen Group. It is responsible for US and Canadian operations for Volkswagen, Audi, Bentley, Bugatti, Lamborghini, and VW Credit, Inc. According to data breach notifications filed with the California and Maine Attorney General’s office, VWGoA disclosed that a vendor left unsecured data exposed on the Internet between August 2019 and May 2021.

In March, VWGoA was notified by the vendor a threat actor had accessed the exposed data and possibly obtained customer information for Audi and Volkswagen.

VWGoA states that the breach involved 3.3 million customers, with over 97% of those affected relating to Audi customers and interested buyers.

With regards to what data has been exposed – It varies per customer. For some it could simply be contact information, but for many others the data contains social security numbers and loan numbers.

“The data included some or all of the following contact information about you: first and last name, personal or business mailing address, email address, or phone number. In some instances, the data also included information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color, and trim packages,” explains the VWGoA data breach notification first reported by TechCrunch.

“The data also included more sensitive information relating to eligibility for a purchase, loan, or lease. More than 95% of the sensitive data included was driver’s license numbers. There were also a very small number of dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers.”

SSNs, TINs, and other information found the bedrock of the illegal identity theft market.

For those whose sensitive information was leaked, Volkswagen is providing free credit protection and monitoring services. This include $1 million of insurance against identity theft.

VWGoA began notifying affected customers and prospective customers yesterday via mail and warn that customers should be on the lookout for suspicious emails, calls, or texts.

As the Audi and Volkswagen data was unsecured for a long time, there is no telling how many people had gained unauthorised access.

The Dangers of Identity Theft

Identity Theft can be absolutely devastating for an individual. Usually, in the world of malware, we know certain things can be harmed. Our devices may need to be replaced, we may lose access to accounts for a few days or even forever, we may even need to pay a ransom for access to our data. The point is, with most types of Malware, we can eventually rebuild, though it may take longer than we anticipate. The fallout from identity theft is much longer.

Once your stolen information is used once, it can take anywhere from a few days to six months for that one incident. But your information is out there for a very, very long time. This means you could end up dealing with identity theft for many years, even decades.

Identity Theft has been around for a very long time and predates our modern technology by thousands of years. There have always been individuals that try to impersonate others for their own gain, financial or otherwise. However, the internet’s birth and wide adoption have led to new attack vectors, dwarfing any possible past attempts.

Now more than ever do we have data tied into our personal identity. Email addresses, banking numbers, phone numbers, social security numbers, home addresses – All of these and more form a picture of us as lines in a database.

And when this information falls into the wrong hands, it can do a lot of damage. Bank accounts can be drained, and your credit rating can get rattled; you can end up with medical bills or even a criminal record. The list of potential mishaps that can arise from identity theft is endless.

To hackers, identity theft represents a lucrative stream of income, and they can very easily cover their tracks. After they have seized personal information, they sell it on the dark web. This information can be sold over time, repeatedly, meaning that if you notice your identity has been stolen and used, it can be used in several instances over a long period of years.

There are some guidelines from the US government in discovering if you are a victim of identity theft if it is not immediately obvious:

You stop receiving your regular bills and credit card statements.
You receive statements for accounts you never opened.
Debt collectors start calling you day and night about debts you’ve never heard of.
The IRS alleges you failed to report income for a company you never worked for.
You see withdrawals/charges on your bank or credit card statement that you didn’t make.
You try to file your taxes only to discover that someone else beat you to it.
You try to file your taxes and find someone claimed your child as a dependent already.
Your credit report includes lines of credit you never opened.
Your credit score fluctuates wildly and for no apparent reason.
The most obvious sign—you receive a notification that you’ve been the victim of a data breach.
If you are unsure, it is always best to check with the authorities on the US government’s identity theft website.

Protection

In some cases, a victim cannot be faulted for identity theft. For example, those affected by the data breach handed their information over to companies in good faith in the story above. Unfortunately, these companies, or more specifically the vendor, failed in protecting this information. However, many other times, business owners and families are singled out and targeted in their offices and homes.

For times like these, it is critical that you have the right tools to protect yourself. One of these tools is SaferNet.

Ragnar Locker Ransomware Strikes Computer Memory and Storage Company ADATA

Post On: 19 June, 2021 By : Brad Hawkins

Ragnar Locker Ransomware has struck against Taiwan-based memory and storage manufacturer ADATA, who were forced to take their systems offline after the attack. The attack occurred in May, and ADATA is still dealing with the fallout. ADATA is a publicly listed Taiwanese memory and storage manufacturer, founded in May 2001 by Simon Chen. Its main product line consists of DRAM modules, USB Flash drives, hard disk drives, solid-state drives, memory cards, and mobile accessories. ADATA is also expanding into new areas, including robotics and electric powertrain systems.

In addition to its main ADATA brand, the company also sells PC gaming hardware and accessories under its XPG (“Xtreme Performance Gear”) brand. In 2017 ADATA was the second-largest DRAM module manufacturer in the world and had a market capitalization of US$680 million. In recent years ADATA has extended its business to Europe and the Americas while competing strongly with Samsung in Asia.

The Ragnar Locker Ransomware infection as initially reported by BleepingComputer in June.

The Taiwanese memory manufacturer took down all impacted systems after detecting the attack and notified all relevant international authorities of the incident to help track down the attackers.

“ADATA was hit by a ransomware attack on May 23rd, 2021,” the company stated in an email.

ADATA’s business operations are no longer disrupted according to the memory maker, with affected devices being restored and services closing regular performance.

“The company successfully suspended the affected systems as soon as the attack was detected, and all following necessary efforts have been made to recover and upgrade the related IT security systems,” ADATA added.

“Gladly things are being moved toward the normal track, and business operations are not disrupted for corresponding contingency practices are effective.

“We are determined to devote ourselves making the system protected than ever, and yes, this will be our endless practice while the company is moving forward to its future growth and achievements.”

ADATA did not confirm what strain of ransomware hit them, but the attack has confirmed and claimed by the Ragnar Locker Ransomware gang afterward.

Ragnar Locker Ransomware claimed they stole 1.5TB of sensitive data from ADATA’s network before deploying the ransomware payloads.

At present, the gang has only posted screenshots of the files they took. They are threatening to leak the files fully if the ransom isn’t paid. According to the screenshots already posted by Ragnar Locker Ransomware on their dark web leak site, the attackers could collect and exfiltrate proprietary business information, confidential files, schematics, financial data, Gitlab and SVN source code, legal documents, employee info, NDAs, and work folders.

Ragnar Locker Ransomware activity was first picked up on in December 2019.

On compromised enterprise endpoints, Ragnar Locker operators terminate remote management software (such as ConnectWise and Kaseya) used by managed service providers (MSPs) to manage clients’ systems remotely.

This allows the attackers to evade detection and ensure that admins logged in remotely do not block the payload deployment process.

The FBI warned private industry partners of increased Ragnar Locker Ransomware activity after an April 2020 attack that impacted the network of multinational energy giant Energias de Portugal (EDP).

Demands from Ragnar Locker Ransomware since its inception range from $200,000 to $600,000.

Ragnar Locker Ransomware Analysis

Note: This analysis was carried out by the Infosec Institute.

Ransomware in this line often disables some services as a way to bypass security protections and also database and backup systems to increase the impact of the attack. Also, database and mail services are stopped so that their data can be encrypted during the infection process.

One of the particularities that spotlight Ragnar Locker is that it is targeting specifically remote management software often used by managed service providers (MSPs), such as the popular ConnectWise and Kaseya software.

This data encryption malware infects computers based on their language settings. When first started, Ragnar Locker checks the configured Windows language preferences. This piece of malware terminates the process if the setting is configured as one of the former USSR countries.

After that, Ragnar Locker will begin the encryption process. When encrypting files, it will skip files in the following folders, file names and extensions.

Ragnar Locker adds the hardcoded extension “.ragnar_” appended to the end of the file name and “” is replaced by a generated and unique ID. All the available files inside physical drives are encrypted and, in the end, the notepad.exe process is opened and showing the ransom note file created on the victim’s system directory.

This ransomware is not equipped with a mechanism to detect whether the computer has already been compromised. A particularity is that if the malware reaches the same device more than once, it will encrypt the device over and over again. This can be seen below where Ragnar Locker Ransomware encrypts the files three times in a row.

SaferNet – Creating A Safer Internet

Post On: 20 May, 2021 By : Brad Hawkins

The Internet and Digital World are inseparable from our own lives. All users of the internet – individuals, families, and businesses – are interconnected by a global tool that allows for the free exchange of data like never before in history. However, behind this wonderful tool is a dark underbelly rife with cybercrime. This leads the denizens of the Internet to search for expensive and complex services to keep themselves safe. At SaferNet, we recognize that cybersecurity doesn’t need to be this costly or complex – We make cybersecurity simple. Visit www.safernetvpn.com today to learn more.

Darkside Ransomware Takes Colonial Pipeline Offline

Post On: 20 May, 2021 By : Brad Hawkins

It would be hard to blame someone for believing the Microsoft Exchange exploits would be the worst cyberattack of 2021, but the Darkside Ransomware attack on the Colonial Pipeline is shaping up to be a far greater threat. Colonial Pipeline, which supplies 45% of the East Coast’s fuel, revealed a ransomware outbreak on the company’s systems, which forced the suspension of operations and some IT systems on Friday last. The attack took place on May 7th, and at the time of writing, systems for the pipeline are still offline.

Often Ransomware attacks take place on private enterprises, as ransomware is usually a for-profit vehicle. However, the Darkside ransomware attack has hit major critical infrastructure, which means the attack is much more serious in nature.

Colonial Pipeline says that a system restart plan is being “developed” and some small lateral lines are back in service. However, it may be days before full functions are restored, and in the meantime, gasoline futures are rising and there is concern that some parts of the US may experience fuel shortages. Gasoline futures jumped to their highest level in three years due to the cyberattack.

The USDOT Federal Motor Carrier Safety Administration (FMCSA) agency has issued a Regional Emergency Declaration to try and push back against the supply disruption through temporary exemptions for fuel transport on the road and the permissible hours that drivers are allowed to work for.

The FBI has confirmed that the attack is indeed the Darkside ransomware strain. “The FBI confirms that the Darkside ransomware is responsible for the compromise of the Colonial Pipeline networks,” the law enforcement agency says. “We continue to work with the company and our government partners on the investigation.”

However it is unclear exactly who is behind the attack. Darkside Ransomware was created by the Darkside gang, who sell it as Ransomware-as-a-service (RaaS), and use it themselves. While one could hazard a guess and say it was the gang themselves, this is unlikely given their MO and the fact that they have denied it.

Darkside first appeared in the summer of 2020 and targetting private enterprise. Unusually for a hacking organization, they made public pledges not to attack critical infrastructure, healthcare, and government agencies. This is well and good, but given that the gang sells their malware, they cannot guarantee it won’t be used for aims that don’t align with their own.

Days after the attack, The DarkSide ransomware gang issued a press statement stating that their organization is ‘apolitical’ and is not associated with any government.

Darkside Ransomware Gang Press Release

Promising extra checks on their customers is a hopeful statement, but in the shadowy world of hackers, it doesn’t mean much. It isn’t the first time Darkside has tried to gain good press, as last year they donated tens of thousands of dollars to charities, which they earned from Darkside Ransomware attacks.

As part of their contract with customers, they earned 20-30% of the ransoms taken from targets.

While the true identity of those who deployed the darkside ransomware is unclear, it is highly likely to be from Russia or an ex-Soviet state. If it was political in nature, it may well be Cozy Bear or Fancy Bear, two state-sponsored group’s operating within Russias’ GRU intelligence service. This of course brings about the question – Why didn’t they use their own ransomware? This is also unclear, but it could be an obfuscation technique.

As well as Russia, the culprits may be Lazarus Group, Pyongyang’s hacking organisation.

Spokespeople from Colonial Pipeline have not yet confirmed how Darkside Ransomware infiltrated their systems. Jon Niccolls from Checkpoint believes the attackers likely gained access to Colonial’s computer system through the administrative side of the business.

“Some of the biggest attacks we’ve seen all started with an email,” Niccolls said “An employee may have been tricked into downloading some malware, for example We’ve also seen recent examples of hackers getting in using weaknesses or compromise of a third-party software. Hackers will use any chance they get to gain a foothold in a network.”

Experts said that gasoline prices are unlikely to be affected if the pipeline is back to normal in the next few days but that the incident — the worst cyberattack to date on critical US infrastructure — should serve as a wake-up call to companies about the vulnerabilities they face.

Darkside Ransomware Analysis

This analysis of Darkside was carried out largely by researchers at Cybereason.

According to Hack Forums, the DarkSide team recently made an announcement that DarkSide 2.0 has been released. According to the group, it is equipped with the fastest encryption speed on the market, and even includes Windows and Linux versions.

The team is very active on hack forums and keeps its customers updated with news related to darkside ransomware. In an effort to grow and expand their operations, the group has started an affiliates program for potential users.

Like many other ransomware variants, DarkSide follows the double extortion trend, which means the threat actors not only encrypt the user’s data, but first exfiltrate the data and threaten to make it public if the ransom demand is not paid. This technique effectively renders the strategy of backing up data as a precaution against a ransomware attack moot.

DarkSide is observed being used against targets in English-speaking countries, and appears to avoid targets in countries associated with former Soviet Bloc nations. The ransom demand ranges between US$200,000 to $2,000,000, and according to their website, the group has published stolen data from more than 40 victims, which is estimated to be just a fraction of the overall number of victims.

Unlike many ransomware variants such as Maze, which was employed to successfully attack suburban Washington schools, the group behind DarkSide appears to have a code of conduct that prohibits attacks against hospitals, hospices, schools, universities, non-profit organizations, and government agencies

Rules for those purchasing Darkside Ransomware

After gaining an initial foothold in the network, the attackers start to collect information about the environment and the company. If it turns out that the potential target is on the attacker’s list of prohibited organizations to attack (ie: hospitals, hospices, schools, universities, non-profit organizations, or government agencies), they don’t move forward with the attack.

If not on the prohibited list, the attackers continue to carry out the operation. The attackers begins to collect files, credentials and other sensitive information, and exfilitrate it. Following this, the attackers use PowerShell to download the DarkSide binary as “update.exe” using the “DownloadFile” command, abusing Certutil.exe and Bitsadmin.exe in the process.

In addition to downloading the DarkSide binary into the C:\Windows and temporary directories, the attacker also creates a shared folder on the infected machine and uses PowerShell to download a copy of the malware there.

After successfully gaining a foothold on one machine in the environment, the attacker begins to move laterally in the environment, with the main goal of conquering the Domain Controller (DC).

Once the attackers make it to the DC, they start to collect other sensitive information and files, including dumping the SAM hive that stores targets’ passwords

In addition to collecting data from the DC, the attackers use PowerShell to download the DarkSide binary from the shared folder created on the previously infected host.

When the DarkSide ransomware first executes on the infected host, it checks the language on the system, using GetSystemDefaultUILanguage() and GetUserDefaultLangID() functions to avoid systems located in the former Soviet Bloc countries from being encrypted.

Darkside Ransomware checking if the installed language is Russian

DarkSide then proceeds to stop the all services related to security and backup solutions. It then creates a connection to its C2 (command and control) server. After uninstalling the Volume Shadow Copy Service (VSS), DarkSide then deletes the shadow copies by launching an obfuscated PowerShell script that uses WMI to delete them.

The malware then enumerates the running processes and terminates different processes to unlock their files so it can both steal related information stored in the files and encrypt them.

DarkSide creates a unique User_ID string for the victim, and adds it to the encrypted files extension as follows:
<File_name>.{userid}. In addition, the malware also changes the icons for the encrypted files and changes the background of the desktop to all black, with the text “All your files have been encrypted!”

Finally, it leaves the Ransomware note:

Protection

While Darkside as an organisation may have intentions that some would consider ‘harmless’, it is very clear that their ransomware product is unchecked and can be used on anybody. It is critical that business owners have the right tools to keep their company’s safe in the face of ever-evolving cyberthreats like Darkside Ransomware.

Flubot Spyware spreading to Android Devices Through Delivery Scam

Post On: 20 May, 2021 By : Brad Hawkins

Android users across the UK and EU are being warned of a new Spyware scam spreading to devices. The attack vector is via text and delivers a Spyware strain named Flubot. The malware is delivered to targets through SMS texts and prompts them to install a “missed package delivery” app. If the target follows the link, they are taken to a delivery website and asked to download the delivery company’s app. The app, of course, is the Flubot spyware. Upon installation, Flubot is immediately dangerous and sets about gaining permissions, stealing banking information and credentials, lifting passwords stored on the device, and extracting away various pieces of personal information.

Flubot connects to a hacker’s command-and-control center (C&C), where it relays all data back to. The spyware sends text messages to everyone in the users’ contact list with the same initial link, aiming to propagate virally.

The U.K.’s National Cyber Security Centre (NCSC) has issued security guidance about how to identify and remove FluBot malware, while network providers, including Three and Vodafone, have also issued warnings to users over the text message attacks.

So far, most of the phishing texts are branded to look like they are being sent from DHL, the NCSC said, but warned, “the scam could change to abuse other company brands.”

The NCSC claims Flubot is damaging enough that the only solution for removal is a factory reset.

The text a target receives. Though this example shows DHL, other courier companies have been reported.

The attack has been reported to have several variations. The most obvious is changing the supposed courier company that sends the text. In another case, the text purports to be from Amazon and includes an almost legitimate-looking link. However, the link swaps out an ‘o’ for a zero within.

Telecom carriers Vodafone UK, Three UK and EE have all confirmed the scam is traversing their networks, which collectively have more than 58 million subscribers across the country.

Anyone who receives what they believe to be a scam text is advised not to click on any links and forward the text to “7726” a “free spam-reporting line” established to combat fraud in the U.K. Finally, delete the message and block the sender.

The fraudulent site where the target is asked to download spyware

If a user has already clicked on the link, the NCSC warned not to enter any password or other personal information. To remove the malware from the infected device, “Perform a factory reset as soon as possible,” the NSCS guidance reads. “The process for doing this will vary based on the device manufacturer…Note that if you don’t have backups enabled, you will lose data.”

The NCSC added that if a user has entered their personal information, it’s critical to change those passwords immediately to prevent further compromise.

The flubot spyware was initially spotted in the UK, followed by Hungary and other EU states. It is believed that the campaign will eventually hit American shores.

Flubot Spyware Analysis

The analysis of flubot spyware has been carried out by Prodaft.

FluBot uses a common Android malware packer that loads the decrypted DEX in runtime. Without any hooks, analysts can access the dropped DEX in the ‘app_DynamicOptDex‘folder. Only string obfuscation is present in the decrypted DEX.

Flubot spyware has a number of commands, most of which are self-explanatory.

Other than targeted apps, FluBot can trigger on-demand credit card phishing if it gets the “CARD_BLOCK” command from the server. FluBot blocks all incoming notifications when the BLOCK command is received from the server. FluBot malware is able make USSD calls to the codes sent from the C&C server.

FluBot is also able to set itself as the default SMS application by abusing accessibility permissions, thus allowing the malware to send SMS messages on demand.

Once it has infected the victim’s device, FluBot sends all phonebook (contact list) numbers to the C&C server. FluBot uses a domain generation algorithm (DGA) to obtain the address of the C&C server. The DGA creates 2000 domains according to the current year and month. Domains consist of 15 characters with “com,” “ru,” and “cn” TLDs.

The C&C panel contains the tabs “Bots,” “Stats,” “Commands,” “Inject List,” “All Logs,” and “Inject Logs.” The threat actor is able to manage every infected device with the following list of commands in the commands tab.

The C&C panel also contains detailed statistics of the infected victims. At the time of analysis, FluBot had already infected more than 60,000 devices.

The statistics page of the panel also contains details about the device manufacturers, Android version, device language, and telecommunication operator name. When FluBot
successfully obtains the banking credentials, they are sent to the C&C and stored with in a log format.

Each log entry for the infected device may contain the SMS messages, banking credentials, device contacts, and application webview text logs, all of which can be used for extracting any kind of text-based credentials from every application that uses webview panes.

Protection

Given that the flubot spyware can only be cleaned from a phone by way of factory reset, it is extremely important users have protection against threats like it. There are a number of tools that can protect devices, and one of these tools is SaferNet.

Mount Locker Ransomware Update Sees Aggressive Change of Tactics

Post On: 20 May, 2021 By : Brad Hawkins

The Mount Locker Ransomware has been exploring new attack vectors and methods in its latest campaigns, according to researchers at GuidePoint. Mount Locker is a relatively new ransomware strain, causing a splash in the Ransomware-as-a-Service (RaaS) scene in 2020. The group behind the virus has been active in its development and released a major update in November that broadened its targeting capabilities, such as searching for extensions used by TurboTax to encrypt. Additionally, it added extra evasive improvements. Since November, Mount Locker ransomware attacks have escalated. As of 2021, another major improvement has been added, which signals “an aggressive shift in Mount Locker’s tactics,” according to an analysis by researchers.

Like many ransomware gangs, the operators lock up files and steal data and threaten to leak it if the ransom isn’t paid in a double-extortion gambit. They’re also known for demanding multimillion-dollar ransoms and stealing vast amounts of data (up to 400 GB).

GuidePoint noted that many tools within Mount Locker Ransomware are legitimate but are clearly being used to nefarious ends. These include the use of AdFind and Bloodhound for Active Directory and user reconnaissance; FTP for file exfiltration; and the pen-testing tool CobaltStrike for lateral movement and the delivery and execution of encryption, potentially through psExec.

“After the environment is mapped, backup systems are identified and neutralized, and data is harvested, systems are encrypted with target-specific ransomware delivered via the established command-and-control channels (C2),” said Drew Schmitt, a senior threat intelligence analyst for GuidePoint, in the analysis. “These payloads include executables, extensions, and unique victim IDs for payment.”

More recent attacks have taken fresh approaches, mostly by using batch scripts. Batch scripts can be designed to disable detection and prevention tools.

“[This] indicates that Mount Locker Ransomware is increasing its capabilities and is becoming a more dangerous threat,” according to Schmitt. “These scripts were not just blanket steps to disable a large swath of tools, they were customized and targeted to the victim’s environment.”

Another change in tactics for the group involves using multiple CobaltStrike servers with unique domains. It’s an added step that helps with detection evasion, but Schmitt noted that it’s not often seen because it requires much more management to put into practice effectively.

The majority of Mount Locker Ransomware attacks have been against the biotech industry. Researchers believe that this may indicate that there may be a larger campaign afoot that aggressively targets healthcare-adjacent industries.

“Biotech companies, in particular, are a prime target for ransomware because of their position in an industry flush not only with cash but also with highly sensitive IP,” Schmitt explained. “Additionally, connections to other research organizations increase the potential to damage the victim’s reputation in the industry and put business dealings at risk.”

Healthcare providers and healthcare supply manufacturers have been the long-suffering victim of ransomware. Due to the time-sensitive nature of their work, they stand to lose more than other potential targets. Researchers noted, “attackers view them as more likely to pay the requested ransom quickly.”

As well as the new attack vectors, Mount Locker Ransomware is seemingly undergoing a name change, to Astro Locker. This is likely more than an aesthetic choice and could mean the group is rebranding entirely in order to step up their game. Schmitt pointed out that “the verbiage and victims listed on both variants’ shaming sites share significant overlap.” He added, “this could signal a shift in the group’s overall tactics and an effort to fully rebrand as a more insidious threat.”

Organizations can look for signs of Mount Locker ransomware or AstroLocker within their environments, such as CobaltStrike stagers and beacons; and, they should monitor for the staging and exfiltration of files via FTP.

“While these would always be cause for alarm…an updated, more aggressive Mount Locker Ransomware and the dramatic increase in attacks attributable to the group make these indicators of compromise particularly alarming,” Schmitt concluded.

Mount Locker Ransomware Analysis

This analysis was carried out by independent ransomware researcher Zawadi Done.

For encryption, Mount Locker ransomware uses Chacha20 to encrypt files and RSA-2048 to encrypt the encryption key. But before the encryption procedure runs, Mount Locker ransomware performs a few tasks that increase the effectiveness of the ransomware.

Both files are packed with a packer written in Visual Basic. The packer checks if the process is being debugged using IsDebuggerPresent if not it continues to unpack the executable into a created segment. Using x64dbg and PE-bear I dumped the full executable from memory and modified the image base and section headers.

The serial number of the used drive is retrieved and used as mutex value. Every time an encrypted file is opened the recovery manual of the ransomware is also opened.

To run a Powershell script it will create a file in the temporary folder C:\Users\IEUser\AppData\Local\Temp\.tmp and write a Powershell script to the file shown belown.

The Powersehll script is then executed by calling:

powershell.exe -windowstyle hidden -c $mypid=’972′[System.IO.File] :: ReadAllText (‘C:\Users\IEUser\AppData\Local \Temp\~1399171.tmp’)|iex”)

This results in the shadow copies being deleted and a list of services and processes being stopped.

Using the API calls CryptAcquireContextW, CryptImportKey, CryptEncrypt an embedded RSA-2048 key is imported and used to encrypt 32 bytes generated by the instruction rdtsc. The plaintext and ciphertext of the bytes will later be used to encrypt other values. The ransomware will search for all types of drives and it skips the following file extensions and directories.

Using CreateFileW and CreateFileMappingW it creates a filehandle and a handle to the file in memory. Instead of using MoveFileW to change the file name, it uses the SetFileInformationByHandle to change the extension of the file.

Using Chacha20 file_32_bytes will be encrypted with 32_bytes as key and the first 12 bytes of 32_bytes as the nonce. Let’s call the ciphertext encrypted_32_bytes. Then it writes file_encrypted_32_bytes and encrypted_32_bytes to the end of the file that will be encrypted.

Using MapViewOfFile the file is mapped in memory with as length the files size or 0x4000000 bytes. This buffer will then be encrypted with Chacha20 using file_32_bytes as key and the first 12 bytes of file_32_bytes as the nonce. After the buffer is encrypted it calls MapViewOfFile to store the buffer to the file on disk.

The encryption procedure is described in the diagram below.

After the files are encrypted, mount locker ransomware will delete itself.

The Mount Locker ransomware drops a ransom note in every folder that it encrypts with the name RecoveryManual.html. This note includes a ClientId which can be used to contact the threat actor on their own “support” portal. This ClientId is based on the computer name XOR’ed by a hardcoded value.

Protection

With threats like Mount Locker Ransomware evolving and expanding everyday, it is important individuals and business owners have adequate protection tools to keep their devices safe. One of these tools is SaferNet.

ToxicEye RAT Abuses Telegram For Command & Control

Post On: 20 May, 2021 By : Brad Hawkins

Hackers are leveraging controls from the popular messaging app Telegram to make use of a Remote-Access-Trojan (RAT). Dubbed ToxicEye RAT, it can give a hacker access to control a victim’s device via a Telegram bot even if the app is not installed on the victim’s devices. ToxicEye can take over file systems, load other malware such as ransomware, and steal data from the device, according to a new report by Check Point. Researchers have tracked more than 130 attacks in the last 90 days that used ToxicEye RAT. Hackers use the messaging service to communicate with their own server and return data to it.

Telegram, the cloud-based IM platform has enjoyed a surge in popularity this year because of controversial changes to its rival, WhatsApp’s privacy settings. Telegram was the most downloaded app worldwide for January 2021 with more than 63 million installs and has surpassed 500 million monthly active users. This popularity also extends to the cyber-criminal community. Malware authors are increasingly using Telegram as a ready-made command and control (C&C) system for their malicious products because it offers several advantages compared to conventional web-based malware administration.

“We believe attackers are leveraging the fact that Telegram is used and allowed in almost all organizations, utilizing this system to perform cyber attacks, which can bypass security restrictions,” researchers said.

According to researchers, there are a couple of reasons why Telegram is being used for malware like ToxicEye RAT:

Telegram is a legitimate, easy-to-use and stable service that isn’t blocked by enterprise anti-virus engines, nor by network management tools
Attackers can remain anonymous as the registration process requires only a mobile number
The unique communications features of Telegram mean attackers can easily exfiltrate data from victims’ PCs, or transfer new malicious files to infected machines
Telegram also enables attackers to use their mobile devices to access infected computers from almost any location globally.

The first use of Telegram as an attack vector was by the Masad info-stealer in 2017. The criminals behind Masad realized that using a popular IM service as an integral part of their attacks gave them a number of operational benefits. Since Masad became available on hacking forums, dozens of new types of malware that use Telegram for C&C and exploit Telegram’s features for malicious activity, have been found as ‘off-the-shelf’ weapons in hacking tool repositories in GitHub.

ToxicEye RAT Infection Chain and Functionality

The analysis of the infection chain and functionality was carried out by Check Point.

In the first steps of ToxicEye RAT, the hacker will create a Telegram account and a Telegram ‘bot’. A Telegram bot account is a special remote account with which users can interact by Telegram chat or by adding them to Telegram groups, or by sending requests directly from the input field by typing the bot’s Telegram username and a query.

The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file. Any victim infected with this malicious payload can be attacked via the Telegram bot, which connects the user’s device back to the attacker’s C&C via Telegram.

In addition, ToxicEye RAT can be downloaded and run by opening a malicious document seen in the phishing emails called solution.doc and by pressing on “enable content.”

ToxicEye RAT Infection Chain

Code snippet example from open source telegram RAT repositories

RATs created using Telegram have many shared modules. However, some of the more dangerous like ToxicEye RAT have several key capabilities that distinguish them from the rest:

Data stealing features – the RAT can locate and steal passwords, computer information, browser history and cookies.
File system control – Deleting and transferring files, or killing PC processes and taking over the PC’s task manager.
I/O hijacking – the RAT can deploy a keylogger, or record audio and video of the victim’s surroundings via the PC’s microphone and camera, or hijack the contents of the clipboard.
Ransomware features – the ability to encrypt and decrypt victim’s files.

A functionality snippet example from chosen Telegram Rat project

After installing the executable file, the attacker can hijack the computer through the bot

The developers who publish these tools disguise their true purpose by defining them as “Remote Administration Tool” or “for educational purpose only”, although some of their characteristics are often found in malicious Trojans.

Given that Telegram can be used to distribute malicious files or as a C&C channel for remotely controlled malware, researchers expect that ToxicEye RAT will be one of many.

Protection & Mitigation

There are several steps for protection and mitigation if you feel you may be infected with ToxicEye RAT:

Search for a file called C:\Users\ToxicEye\rat.exe – if this file exists on your PC, you have been infected and must immediately contact your helpdesk and erase this file from your system.
Monitor the traffic generated from PCs in your organization to a Telegram C&C – if such traffic is detected, and Telegram is not installed as an enterprise solution, this is a possible indicator of compromise
Beware of attachments containing usernames – malicious emails often use your username in their subject line or in the file name of the attachment on it. These indicate suspicious emails: delete such emails, and never open the attachment nor reply to the sender.
Undisclosed or unlisted recipient(s) – if the email recipient(s) has no names, or the names are unlisted or undisclosed – this is a good indication this email is malicious and / or a phishing email.
Always note the language in the email – Social engineering techniques are designed to take advantage of human nature. This includes the fact that people are more likely to make mistakes when they’re in a hurry and are inclined to follow the orders of people in positions of authority. Phishing attacks commonly use these techniques to convince their targets to ignore their potential suspicions about an email and click on a link or open an attachment.
Deploy an automated anti-phishing solution – Minimizing the risk of phishing attacks to the organization requires tools that can spot decoy emails containing attacks like ToxicEye RAT better than the human eye. One of these tools is SaferNet.

Hackers Breach Codecov supply-chain, Exposing Hundreds of Networks

Post On: 19 May, 2021 By : Brad Hawkins

Hackers have breached popular code analysis platform Codecov, modifying the Bash Uploader script and exposing sensitive information in customers’ continuous integration (CI) environment. The attack went unnoticed for some time; Codecov noticed the breach in April, yet the modifications were made in early January. Codecov provides tools that help developers measure how much of the source code executes during testing, a process known as code coverage, which indicates the potential for undetected bugs being present in the code. It has a customer base of more than 29,000 enterprises, including Alibaba, Amazon, Atlassian, Washington Post, GoDaddy, Royal Bank of Canada, and Procter & Gamble.

The Bash Uploader script is used by Codecov customers to send code reports to the server. It detects specific settings, collects reports, and uploads.

Hackers focused on this data in their attack campaign, effectively changing the address to where the data was sent – To a server outside Codecov. Due to the data collected by the hackers, Codecov announced that the threat actors could be in possession of any of the following:

Any credentials, tokens, or keys that our customers were passing through their CI runner that would be accessible when the Bash Uploader script was executed
Any services, datastores, and application code that could be accessed with these credentials, tokens, or keys
The git remote information (URL of the origin repository) of repositories using the Bash Uploaders to upload coverage to Codecov in CI

Because of this potential risk, affected users are strongly recommended to re-roll all credentials, tokens, or keys present in the environment variables in the CI processes that relied on Bash Uploader.

Customers using a local version of the script should check if the hackers code added at line 525 exists. If the code below is present, they should replace bash files with Codecov’s latest version of the script.

Offending code, from BleepingComputer‘s report

Regarding the attack, Codev said, “Based upon the forensic investigation results to date, it appears that there was periodic, unauthorized access to a Google Cloud Storage (GCS) key beginning January 31, 2021, which allowed a malicious third-party to alter a version of our bash uploader script to potentially export information subject to continuous integration (CI) to a third-party server. Codecov secured and remediated the script April 1, 2021”

Immediately after learning of the compromise, the company took steps to mitigate the incident, which included the following:

rotating all relevant internal credentials, including the key used to facilitate the modification of the Bash Uploader
auditing where and how the key was accessible
setting up monitoring and auditing tools to ensure that this kind of unintended change cannot occur to the Bash Uploader again
working with the hosting provider of the third-party server to ensure the malicious webserver was properly decommissioned

Hackers Draw Attention of US Federal Investigators

By mid-April, the scale of the attack had grown so much that it had gotten the attention of US Federal Investigators, and comparisons were made to the SolarWinds breach last year. CodeCov have around 29,000 customers, making the attack potentially catastrophic.

According to federal investigators, Codecov hackers deployed automation to use the collected customer credentials to tap into hundreds of client networks, thereby expanding the scope of this system breach beyond just Codecov’s systems.

Codecov’s git, showing Amazon and Alibaba interactions

“The hackers put extra effort into using Codecov to get inside other makers of software development programs, as well as companies that themselves provide many customers with technology services, including IBM,” a federal investigator anonymously told Reuters.

By abusing the customer credentials collected via the Bash Uploader script, hackers could potentially gain credentials for thousands of other restricted systems, according to the investigator.

Some Codecov customers such as IBM stated they have not been breached by the hackers, but have declined to comment further.

An Atlassion spokesperson said, “We are aware of the claims and we are investigating them. At this moment, we have not found any evidence that we have been impacted nor have identified signs of a compromise.”

Hewlett Packard Enterprise claimed their investigation was continuing, “HPE has a dedicated team of professionals investigating this matter, and customers should rest assured we will keep them informed of any impacts and necessary remedies as soon as we know more”

The Federal Bureau of Investigation and the U.S. Department of Homeland Security have not commented on the investigation at this time.

The Codecov is yet another supply-chain attack we’ve seen recently. In the last 12 months, these kinds of attacks have become increasingly common, allowing hackers to breach a multitude of enterprises through one weakest link.

Protection

With many supply-chain attacks occurring, it is important that businesses and families have the best possible tools to keep themselves protected. One of these tools is SaferNet.

Apple Likely To Meet REvil Ransomware Demands As Gang Escalates Global Attacks

Post On: 19 May, 2021 By : Brad Hawkins

The gang behind the REvil Ransomware malware strain, Sodin, continue their global attacks into 2021 after demanding Apple pay a $50 Million ransom by May 1st. Despite initially being declined by Apple, the ransomware gang put the squeeze on the tech giant, leaking details of new products just hours before one of Apple’s yearly product unveilings.

The original attack was launched against Quanta, a Global Fortune 500 manufacturer of electronics, which claims Apple among its customers. The Taiwanese-based company was contracted to assemble Apple products, including Apple Watch, Apple Macbook Air and Pro, and ThinkPad, from an Apple-provided set of design schematics.

The REvil Ransomware gang breach Quanta’s servers, steal files, and hold them to ransom. According to a statement posted on the criminals’ dark web site – which they call the “Happy Blog” – Quanta refused to pay the ransom, leading the hackers to begin threatening the company’s customers, as well as leaking a set of blueprints for some products to turn up the pressure, adding more would be leaked every day the ransom went unpaid.

REvil decided to start leaking the ripped off files just hours before Apple’s Spring Loaded event on Tuesday, including schematics for some new iMacs it debuted there.

“In order not to wait for the upcoming Apple presentations, today we, the REvil group, will provide data on the upcoming releases of the company so beloved by many,” according to REvil’s blog post, the report said. “Tim Cook can say thank you Quanta. From our side, a lot of time has been devoted to solving this problem.”

The REvil Ransomware gang has demanded a $50 Million ransom by May 1st. Sodin aren’t particularly known to mess about with ransoms – In the past, they have been strict with deadlines.

“The REvil ransomware gang doesn’t make false promises,” observed Ivan Pittaluga, CTO of enterprise security firm ArcServe said, “They’re notoriously known for leaking data if their demands aren’t met.”

REvil are believed to have made at least $100 Million in 2020, and 2021 looks like it will strengthen their finances even more.

REvil Ransomware Analysis

Deployments of REvil first were observed a few years ago, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725. It is highly configurable, and it can be customized to behave differently depending on the host. This makes it a highly attractive RaaS client. Some of its features include:

Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.
Whitelists files, folders and extensions from encryption.
Kills specific processes and services prior to encryption.
Encrypts files on local and network storage.
Customizes the name and body of the ransom note, and the contents of the background image.
Exfiltrates encrypted information on the infected host to remote controllers.
REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers.

REvil was first advertised on Russian-language cybercrime forums. The main actor associated with advertising and promoting REvil ransomware is called Unknown aka UNKN. The RaaS is operated as an affiliate service, where affiliates spread the malware by acquiring victims and the REvil operators maintain the malware and payment infrastructure. Affiliates receive 60% to 70% of the ransom payment.

Unkown has acknowledged that his Ransomware is based on the now-retired GrandCrab Ransomware, saying, “We used to be affiliates of the GandCrab affiliate program. We bought the source code and started our own business. We developed custom features for our purposes”

REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host. If the configuration instructs a sample to execute this exploit, it will allocate executable memory, decrypt the exploit code in the newly allocated region and invoke it.

Protection

REvil and other Ransomware clients are some of the most common and deadly cybersecurity threats out there today. Families and businesses should be aware of these threats, and equip the right tools to tackle them. One of these tools is SaferNet.