Brad Hawkins, Author at Safernet

White Rabbit Ransomware Linked To FIN8 Hackers

Post On: 3 March, 2022 By : Brad Hawkins

White Rabbit Ransomware appeared in the cybersecurity wild, and a recent suggests the strain may be a side-project of the FIN8 hacking group.

FIN8 is a financially motivated actor who has been spotted targeting financial organizations for several years, primarily by deploying POS malware that can steal credit card details.

White Rabbit Ransomware was first reported on by ransomware expert Michael Gillespie on Twitter.

Trend Micro investigated a sample of White Rabbit Ransomware which was discovered after an attack on a US bank in December 2021.

The White Rabbit Ransomware payload is tiny compared its peers at just 100KB. It requires a password to be entered on the command line for decryption.

Password-protected payloads have been previously seen by other strains, such as Egregor, MegaCortex, and SamSam.

When the correct password is entered, White Rabbit Ransomware will scan all folders on the device and encrypt targeted files, creating ransom notes for each file it encrypts.

While encrypting a device, removable and network drives are also targeted, with Windows system folders excluded from encryption to prevent rendering the operating system unusable.

The ransom note informs the victim that their files had been exfiltrated and threatens to publish and/or sell the stolen data if the demands are not met.

The deadline for the victim to pay a ransom is set to four days, after which the actors threaten to send the stolen data to data protection authorities, leading to data breach GDPR penalties.

The evidence of the stolen files is uploaded to services such as ‘paste[.]com’ and ‘file[.]io,’ while the victim is offered a live chat communication channel with the actors on a Tor negotiation site.

The Tor site includes a ‘Main page,’ used to display proof of stolen data, and a Chat section where the victim can communicate with the threat actors and negotiate a ransom demand.

As noted in the Trend Micro report, evidence that connects FIN8 and ‘White Rabbit’ is found in the ransomware’s deployment stage.

The connection between White Rabbit Ransomware and FIN8 has also been confirmed by researchers at Lodestone.

“Lodestone identified a number of TTPs suggesting that White Rabbit, if operating independently of FIN8, has a close relationship with the more established threat group or is mimicking them.”

For now, White Rabbit has limited itself to only targeting a few entities but is considered an emerging threat that could turn into a severe menace to companies in the future.

Protection Against White Rabbit Ransomware

SaferNet is the perfect solution to the cybersecurity issues that individuals, families, and businesses face today. It not only connects every device using a secure, 24/7 always on, military grade VPN, but it also stops outside cyberthreats, malware and viruses as well. On SaferNet, all users are protected anywhere in the world, all the time, on any cellular or Wi-Fi network. In addition to SaferNet’s VPN and cyber protection, it also offers a range of employee or parental/family internet controls including internet filtering, monitoring, scheduling, and blocking access to websites or even entire website categories

Typically, a business or family would need 3 separate services for a VPN, Malware Protection, and Internet Controls; SaferNet offers all 3 features in one service. SaferNet truly is an endpoint security presence that can be implemented in minutes around the world, on phones, laptops, tablets, and computers at an economical price point that caters to all sizes of businesses and families. SaferNet guarantees a smooth setup and installation process that takes only minutes, and an easily accessible control hub for you to monitor all your employee’s or family members devices; including activity, time spent online, and threats blocked.

NHS Warn Of More Attacks Using Log4j Vulnerabilities

Post On: 13 January, 2022 By : Brad Hawkins

The National Health Service (NHS) in the UK has issued an alert warning of an unknown gang of hackers targeting VMware Horizon deployments with Log4j vulnerabilities.

Log4Shell is in an exploit within Apache Log4j 2.14, and is classed as vulnerability CVE-2021-44228. The Log4j vulnerabilities have seen high activity since December 2021.

Apache has addressed the Log4j vulnerabilities, and version 2.17.1 is now considered adequately secure

Apache addressed the above and four more vulnerabilities via subsequent security updates, and Log4j version 2.17.1 is now considered adequately secure.

According to the NHS notice, the threat actor is leveraging the exploit to achieve remote code execution on vulnerable VMware Horizon deployments on public infrastructure.

“The attack likely consists of a reconnaissance phase, where the attacker uses the Java Naming and Directory InterfaceTM (JNDI) via Log4Shell payloads to call back to malicious infrastructure,” explains the alert.

“Once a weakness has been identified, the attack then uses the Lightweight Directory Access Protocol (LDAP) to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service.”

“The web shell can then be used by an attacker to carry out a number of malicious activities such as deploying additional malicious software, data exfiltration, or deployment of ransomware.”

The actor is taking advantage of the presence of the Apache Tomcat service embedded within VMware Horizon, which is vulnerable to Log4Shell.

The exploitation begins with the simple and widely used payload and spawns the following PowerShell command from Tomcat.

This command invokes a win32 service to get a list of ‘VMBlastSG’ service names, retrieve paths, modify ‘absg-worker.js’ to drop a listener, and then restart the service to activate the implant.

The listener is then responsible for executing arbitrary commands received via HTTP/HTTPS as header objects with a hardcoded string.

At this point, the actor has established persistent and stable communication with the C2 server and can perform data exfiltration, command execution, or deploy ransomware.

VMware Horizon is not the only VMware product targeted by threat actors using the Log4j vulnerabilities.

The Conti ransomware operation is also using Log4j vulnerabilities to spread laterally to vulnerable VMware vCenter servers to more easily encrypt virtual machines.

VMware released a security update for Horizon and other products last month, fixing CVE-2021-44228 and CVE-2021-45046 with versions 2111, 7.13.1, and 7.10.3

As such, all VMware Horizon admins are urged to apply the security updates as soon as possible.

NHS’s report also highlights the following three signs of active exploitation on vulnerable systems:

Evidence of ws_TomcatService.exe spawning abnormal processes
Any powershell.exe processes containing ‘VMBlastSG’ in the command line
File modifications to ‘…\VMware\VMware View\Server\appblastgateway\lib\absg-worker.js’ – This file is generally overwritten during upgrades and not modified

Protection Against Log4j Vulnerabilities

Google Docs Commenting Feature Used For Spear Phishing Attacks

Post On: 12 January, 2022 By : Brad Hawkins

A new spear phishing attack vector emerged in December 2021, which saw hackers abusing the commenting feature of Google Docs to send emails that appear trustworthy.

Google Docs is widely used by employees collaborating or remotely working, so recipients of said emails are familiar with these notifications.

Googles’ own security systems are being tricked into sending emails, it is very unlikely for email security to flag the incoming Google emails.

It is believed the spear phishing attacks have been on-going since at least October of last year. Google has taken steps to mitigate the issue, but are not fully covered yet.

The spear phishing campaign has become more popular in recent weeks amongst hackers, and is being monitored by threat analysts at Avanan, who have shared their report with other researchers.

According to Avanan, hackers use their Google account to create a Google Document and then comment it to mention the target with an @.

Google then sends a notification email to the target’s inbox, informing them that another user has commented on a document and mentioned them.

The comment on the email can carry malicious links that lead to malware dropping web pages or phishing sites, so there are clearly no checking/filtering mechanisms in place.

Secondly, the threat actor’s email isn’t shown in the notification, and the recipient only sees a name. This makes impersonation very easy, and simultaneously raises the chances of success for the actors.

The same technique works on Google Slide comments too, and Avanan reports having seen actors leveraging it on various elements of the Google Workspace service.

To make things worse, attackers don’t have to share the document with their targets since mentioning them is enough to send malicious notifications.

According to Avanan, the threat actors behind these attacks appear to favor Outlook users, but the target demographic is not limited to them.

This ongoing spear-phishing campaign uses over 100 Google accounts and has already hit 500 inboxes across 30 organizations.

The only way to mitigate the risk of this and similar campaigns is to:

Confirm that the sender email matches your colleague’s (or claimed person)
Avoid clicking on links that arrive via email and are embedded on comments
Deploy additional security measures that apply stricter file-sharing rules on Google Workspace
Use an internet security solution from a trustworthy vendor that features phishing URL protection

Protection Against Spear Phishing

Purple Fox Malware Deployed Via Telegram Installers

Post On: 12 January, 2022 By : Brad Hawkins

Purple Fox Malware is making the rounds by using a malicious Telegram For Desktop installer, which is further used to install additional malware payloads on infected devices.

The malicious installer is compiled in a script named “Telegram Desktop.exe” that drops two files – the malicious downloader and an actual Telegram installer.

The legitimate installer is not executed, and instead, a downloader is run (TextInputh.exe).

When TextInputh.exe is executed, it will create a new folder (“1640618495”) under “C:\Users\Public\Videos\” and connect to the C2 to download a 7z utility and a RAR archive (1.rar).

The files contain the Purple Fox Malware payload, as well as configuration files. It also unpacks everything into the ProgramData folder.

As detailed in an analysis by Minerva Labs, TextInputh.exe performs the following actions onto the compromised machine:

Copies 360.tct with “360.dll” name, rundll3222.exe, and svchost.txt to the ProgramData folder
Executes ojbk.exe with the “ojbk.exe -a” command line
Deletes 1.rar and 7zz.exe and exits the process

Next, a registry key is created for persistence, a DLL (rundll3222.dll) disables UAC, the payload (scvhost.txt) is executed, and the following five additional files are dropped onto the infected system:

Calldriver.exe
Driver.sys
dll.dll
kill.bat
speedmem2.hg

The purpose of these extra files is to collectively block the initiation of 360 AV processes and prevent the detection of Purple Fox Malware on the compromised machine.

The next step for the malware is to gather basic system information, check if any security tools are running on it, and finally send all that to a hardcoded C2 address.

Once this reconnaissance process is completed, Purple Fox Malware is downloaded from the C2 in the form of an .msi file that contains encrypted shellcode for both 32 and 64-bit systems.

Upon execution of Purple Fox Malware, the infected machine will be restarted for the new registry settings to take effect, most importantly, the disabled User Account Control (UAC).

To achieve this, the dll.dll file sets the following three registry keys to 0:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop

Disabling bypassing UAC is vital because it gives any program that runs on the infected system, including viruses and malware, administrator privileges.

In general, UAC prevents the unauthorized installation of apps or the changing of system settings, so it should stay active on Windows at all times.

Disabling it permits Purple Fox Malware to perform malicious functions such as file search and exfiltration, process killing, deletion of data, downloading and running code, and even worming to other Windows systems.

At this time, it is unknown how Purple Fox Malware is being distributed but similar malware campaigns impersonating legitimate software were distributed via YouTube videos, forum spam, and shady software sites.

Protection Against Purple Fox Malware

Joker Malware Hits 500000 Downloads On Google Play

Post On: 12 January, 2022 By : Brad Hawkins

Joker Malware, the bane of Google Play, has resurfaced on the app store disguised as an application called Color Message. The app was downloaded more than 500,000 times before Google removed it.

Users are advised to delete Color Message immediately, researchers at Pradeo Security warned.

Joker Malware is a persistent threat that’s been active on Google Play since 2017. The virus is known to hide itself in what seems to be legitimate applications such as games, messengers, photo editors, translators, and wallpapers, many of them aimed at children.

When installed, Joker Malware subscribes the victim to unwanted, paid services that are controlled by hackers. This type of billing fraud is known as ‘fleeceware’.

The victim is often in the dark until they see their mobile bill.

Color Message purported to offer the ability to jazz up messaging with a range of fun emojis and screen overlays.

Joker Malware apps are most often found outside the Google Play store, but the threat actors behind often find ways to get around Google’s protection and into the store. One of the ways this is achieved is by using lightweight development and constant code tinkering.

“By using as little code as possible and thoroughly hiding it, Joker generates a very discreet footprint that can be tricky to detect,” according to Pradeo.

The most recent version of the malware also takes advantage of a legitimate developer tool called Flutter to evade both device-based security and app-store protections, Zimperium recently found.

Flutter is an open-source app development kit designed by Google that allows developers to craft native apps for mobile, web and desktop from a single codebase. The use of Flutter to code mobile applications is a common approach, and one that traditional scanners see as benign, researchers said.

“Due to the commonality of Flutter, even malicious application code will look legitimate and clean, whereas many scanners are looking for disjointed code with errors or improper assemblies,” explained Zimperium researchers in an analysis published in July.

Due to techniques like these, there are often large-scale infestations of Joker Malware on Google Play. Last July, SaferNet reported on one such onslaught of malware onto the Play store.

Joker Malware Analysis

Note: This analysis of Joker Malware was carried out by CSIS Techblog.

In most of the apps the developers have inserted the Joker Malware initialization component into one or another advertisement framework. The little package of malicious code typically consists of:

Target country checking via MCC
Minimum C&C communication — just enough to report the infection and receive the encrypted configuration
DEX decryption & loading
A notification listener — when a new SMS message arrives, this listener captures it and sends out a broadcast for the Core (second stage) component to pick up.

Often, an app would contain a so-called “Splash” screen — an activity, which displays the app’s logo, while performing various initialization processes in the background. Some of the Joker apps use such activity for initialization as well.

The Joker Malware employs custom string obfuscation schemes for all of the configuration/payload/communication parsing procedures. The code listing below displays an example of an obfuscated MCC code list, (DEFAULT_COUNTRY_ISO) separated by the underscore symbol.

After the initialization is done, the malware will download an obfuscated and AES-encrypted configuration from the payload distribution C&C server. Joker Malware composes the AES key for the configuration string decryption using yet another string scheme, which would concatenate the app’s package name with MCC code string and shuffle the symbols around in a specific way.

The configuration string above contains the necessary information about the second stage code — the core component of the Joker. Being split by a 3-symbol delimiter, the configuration string above contains (ordered):

1. The URL for the Joker Core DEX file — this file is obfuscated
2. The de-obfuscation “keys” — indexes of the obfuscated read buffer
3. The initialization class name — the class, which implements the initialization method
4. The initialization method name — which method to call upon loading
5. The C&C URL
6. The campaign tag

The Loader downloads the DEX and starts the de-obfuscation routine. The said routine reads the DEX file in a buffer 128 bytes at a time. The de-obfuscation “keys” are the positional indexes for this buffer. For each iteration, the routine reads the bytes of the obfuscated buffer only between these positions and writes them into a file, producing a valid DEX file in the end.

This Joker malware kit stands out as a small and silent one. It is using as little Java code as possible and thus generates as little footprint as possible. After all of the Loader’s MCC checks and payload loading — the Core component begins its work.

It is designed in a job-scheduler fashion, meaning that it periodically requests new commands from the C&C server. When found, it executes them in strict order and then reports the results, depending on the type of the given task. The below figure is an example of a command (truncated).

When Joker Malware receives such a message, it proceeds to open the offer URL, injects the JavaScript commands one by one and waits for an authorization SMS (if any). When the SMS message arrives, the malware extracts the necessary authorization code using case-specific regular expressions. At other times, it simply sends a SMS message to a premium number, with a specific code from the offer page.

Whenever the Joker malware extracts a code from a SMS message — it also reports it to the C&C after the job is complete. Hypothetically, the botnet operator can craft a job, which would result in all incoming SMS messages being stolen.

The final important thing worth mentioning about the Joker Malware is the phone book contact list theft. The core component collects all numbers in the contact list and sends them over to the C&C in an encrypted form:

A total of 12 unique builds of the second stage payload were observed among the 24 infected apps. The version names come from the payload URLs and data inside the sample’s configuration class:

Protection

Flagpro Malware Linked To Chinese State-Sponsored Hackers

Post On: 12 January, 2022 By : Brad Hawkins

Flagpro Malware is being used against Japanese companies by cyber-espionage hacker group BlackTech. BlackTech uses Flagpro Malware in the initial stage of an attack to conduct network reconnaissance. Using Flagpro Malware in this way, BlackTech aim to evaluate the target’s environment and download additional malware to the network.

The attack vector starts with a phishing email written specifically for the target organization, pretending to be from a trustworthy source.

The email carries a password-protected ZIP or RAR attachment that contains a Microsoft Excel file (.XLSM) laced with a malicious macro. Running this code creates an executable in the startup directory, the Flagpro Malware.

On its first execution, Flagpro Malware connects to the C2 server via HTTP and sends system ID details obtained by running hardcoded OS commands.

In response, the C2 can send back additional commands or a second-stage payload that Flagpro can execute.

The communication between the two is encoded with Base64, and there’s also a configurable time delay between connections to avoid creating a pattern of identifiable operations.

According to a report by NTT Security, Flagpro Malware has been deployed against Japanese firms for more than a year, since at least October 2020. The most recent sample the researchers could retrieve is from July 2021.

The targeted entities are from various sectors, including defense technologies, media, and communications.

NTT researchers noticed a new version of Flagpro Malware, which can automatically close dialogs relevant to establishing external connections that could reveal its presence to the victim.

“In the implementation of Flagpro v1.0, if a dialog titled “Windows セキュリティ” is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog,” explains the NTT Security report.

“This handling also works when the dialog is written in Chinese or English. It indicates the targets are in Japan, Taiwan, and English-speaking countries.”

BlackTech were first spotted in 2017, and are believed to be State-Sponsored Hackers operating from China.

Its typical targets are in Taiwan, although it occasionally attacked companies in Japan and Hong Kong to steal technology.

In February 2021, a Unit 42 report connected BlackTech to WaterBear; another cyber-espionage group believed to be backed by the Chinese government.

As an APT, BlackTech possesses the knowledge and sophistication to adjust its tools to new reports like this one, so Flagpro Malware will likely now be modified for stealthier deployment.

As the NTT report concludes: “Recently, they (BlackTech) have started using other new malware called “SelfMake Loader” and “Spider RAT”. It means that they are actively developing new malware.”

Protection Against Flagpro Malware

Hackers Abusing Server Module To Steal Microsoft Exchange Credentials

Post On: 12 January, 2022 By : Brad Hawkins

Hackers are using an Internet Information Services (IIS) webserver module dubbed “Owowa,” on Exchange Outlook servers with the aim of stealing credentials and enabling remote code execution.

“Owowa is a C#-developed .NET v4.0 assembly that is intended to be loaded as a module within an IIS web server that also exposes Exchange’s Outlook Web Access (OWA),” Kaspersky researchers Paul Rascagneres and Pierre Delcher said. “When loaded this way, Owowa will steal credentials that are entered by any user in the OWA login page, and will allow a remote operator to run commands on the underlying server.”

The idea that a rogue IIS module can be fashioned as a backdoor is not new. In August 2021, Slovak cybersecurity company ESET’s study of the IIS landscape revealed as many as 14 malware families that were developed as native IIS modules in an attempt to intercept HTTP traffic and remotely commandeer the compromised computers.

As a persistent component on the compromised system, Owawa is engineered to capture the credentials of users who are successfully authenticated on the OWA authentication web page. Exploitation can then be achieved by sending “seemingly innocuous requests” to the exposed web services by entering specifically crafted commands within the username and password fields in the OWA authentication page of a compromised server.

Specifically, if the OWA username is “jFuLIXpzRdateYHoVwMlfc,” Owawa responds back with the encrypted credentials. If the username, on the other hand, is “dEUM3jZXaDiob8BrqSy2PQO1”, the PowerShell command typed in the OWA password field is executed, the results of which are sent back to the attacker.

The Russian security firm said it detected a cluster of targets with compromised servers located in Malaysia, Mongolia, Indonesia, and the Philippines that primarily belong to government organizations, with the exception of one server that’s attached to a government-owned transportation company. That said, additional organizations in Europe are believed to have been victimized by the actor as well.

Although no links have been unearthed between the Owowa operators and other publicly documented hacking groups, a username “S3crt” (read “secret”) that was found embedded in the source code of the identified samples has yielded additional malware executables that are likely the work of the same developer. Chief among them are a number of binaries designed to execute an embedded shellcode, load next-stage malware retrieved from a remote server, and trigger the execution of Cobalt Strike payloads.

Kaspersky’s Global Research and Analysis Team (GReAT) also said it identified an account with the same username on Keybase, where the individual has shared offensive tools such as Cobalt Strike and Core Impact, in addition to demonstrating an interest in the latter on RAIDForums.

“IIS modules are not a common format for backdoors, especially when compared to typical web application threats like web shells and can therefore easily be missed during standard file monitoring efforts,” Rascagneres and Delcher said. “The malicious module […] represents an effective option for attackers to gain a strong foothold in targeted networks by persisting inside an Exchange server.”

Protection Against Hackers

There are several tools internet users should use to increase their online protection. One of these tools is SaferNet.

Cuban ransomware has breached 49 US infrastructure organizations

Post On: 12 January, 2022 By : Brad Hawkins

The Federal Bureau of Investigation (FBI) has disclosed that a Cuban ransomware gang has breached 49 organizations from US critical infrastructure sectors.

“The FBI has identified, as of early November 2021 that Cuba ransomware actors have compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors,” the federal law enforcement agency said.

The FBI also added that this ransomware group had made over $40 million since it started targeting US companies.

The Federal Bureau of Investigation (FBI) has revealed that the Cuba ransomware gang has compromised the networks of at least 49 organizations from US critical infrastructure sectors.

The FBI also added that this ransomware group had made over $40 million since it started targeting US companies.

Cuba ransomware is delivered on victims’ networks through the Hancitor malware downloader, which allows the ransomware gang to gain easier access to previously compromised corporate networks.

Hancitor (Chancitor) is known for delivering information stealers, Remote Access Trojans (RATs), and other types of ransomware.

Zscaler spotted it distributing the Vawtrak information-stealing trojan. Since then, it switched to password-stealers, including Pony and Ficker, and, more recently, Cobalt Strike.

For initial compromise of their victims’ systems, Hancitor uses phishing emails and stolen credentials, exploits Microsoft Exchange vulnerabilities, or break-in via Remote Desktop Protocol (RDP) tools.

Once in using the access provided by Hancitor, Cuba ransomware operators will use legitimate Windows services (e.g., PowerShell, PsExec, and various other unspecified services) to deploy their ransomware payloads remotely and encrypt files using the “.cuba” extension.

In the flash alert, the FBI also asked systems admins and security professionals who detect Cuba ransomware activity within their enterprise networks to share any related information they have with their local FBI Cyber Squad.

Useful information that can be shared to help identify the attackers behind this ransomware gang includes “boundary logs showing communication to and from foreign IP addresses, Bitcoin wallet information, the decryptor file, and/or a benign sample of an encrypted file.”

Protection Against Ransomware

There are several tools internet users should use to increase their online protection. One of these tools is SaferNet.

Northern Europe Faces Flurry Of Flubot Banking Trojan Attacks

Post On: 12 January, 2022 By : Brad Hawkins

The Flubot banking trojan is actively attacking countries in Northern Europe, spreading via Android phones that are sending millions of malicious text messages. The attacks are mostly occurring in Finland.

Last week, the National Cyber Security Centre (NCSC-FI) at the Finnish Transport and Communications Agency disclosed a “severe” alert about rising Flubot malware infections.

Once Flubot is deployed on a phone, it goes about gaining permissions, stealing banking information and credentials, lifting passwords stored on the device and extracting away various pieces of personal information. It also self-replicates by sending out additional text messages from the infected host. Just like the regular flu, flubot uses a similar logic to become “viral”

“An Android malware called Flubot is being spread by SMS. According to our current estimate, tens of thousands of messages have been sent to people in Finland during one day. We expect the amount to increase in the coming days and weeks,” said Aino-Maria Väyrynen, information security adviser at the NCSC-FI, in the alert.

As Väyrynen predicted, the campaign did grow in numbers. An article published by Bloomberg on Tuesday quoted Väyrynen as saying the daily messages were now in the millions.

The country’s biggest telecom companies told the news outlet that they’ve intercepted hundreds of thousands of messages. Teemu Makela, CISO at Elisa Oyj, called the attack “extremely exceptional and very worrying.”

The NCSC-FI’s advisory said that the malware is targeting “everyone using an Android device and a mobile subscription,” while iPhones and other devices “are directed to other fraudulent material on the website.”

The malicious texts tell targets they’ve received a voicemail or a message from their mobile operator, however the containing link is malicious.

The link won’t install flubot right away – instead, targets are prompted to grant voicemail permissions, which is actually a front for malware installation. Once installed, Flubot goes about its business.

There are telltale red flags: The messages “are often written without Scandinavian letters (å, ä and ö) and may contain the characters +, /, &, % and @ in random and illogical places in the text,” the advisory explained.

Finnish authorities shared examples of the messages, as well as the malware’s installation request, both of which are shown below.

This is the second campaign in which Flubot recorded heavy infections across Finland. It first appeared in June 2021, and persisted into August. The ploy of the earlier campaign involved trying to trick the user into clicking a link concerning a missed package delivery.

That time, thanks to cooperation between the authorities and telecoms, the NCSC-FI said that the country managed to eliminate Flubot “almost completely.”

Atti Turnun, frad manager with Telia, spoke to Bloomberg and stated that this time the infection is far worse. The new wave shows that the Flubot operators have mutated their malware to hook its tentacles into victims regardless of the control measures put in place to eradicate the summer Flubot campaign, the security center said.

Hank Schless, senior manager of security solutions at Lookout, spoke to reporters with Threatpost and said that Finland’s plight is an example of “the problems that the malware-as-a-service (MaaS) market creates for consumers and enterprises alike.”

This market has made malware and phishing kits “incredibly accessible for even the least skilled threat actors,” he said. “Usually, for a very small price, someone can go online and find one of these kits fully built and ready to be used. Once they acquire the kit, all the attacker needs to do is host it on a web domain then build a delivery mechanism. Most frequently, this mechanism is some form of message targeting mobile users because of the number of ways you can deliver a message to these devices via SMS, email, social media platforms, third party messaging apps, gaming and even dating apps.”

The only difference between Finland’s earlier Flubot campaign and this one are the different social-engineering hooks, he noted – a sign of how “socially engineered phishing attacks can continue to be effective over time.”

Phishing has become “the most concerning issue for every enterprise,” Schless observed. “Threat actors not only use it to steal login credentials, but deliver malware to devices and infrastructure as well. Lookout data shows that threat actors heavily target users through mobile channels such as SMS, social media platforms, third party messaging apps, gaming and even dating apps.”

“Once the attacker has those compromised credentials, they’re free to log in to any corporate app and move laterally through the infrastructure,” Schless continued. “This could lead to them exfiltrating or encrypting data for an eventual ransomware attack.”

Schless concluded by stating that intelligence was “king” when it came to protecting against any attacks, but especially ones like Flubot.

“Solutions backed by datasets with enough threat telemetry are the only way to detect and protect against these attacks before they can even reach the end user,” he said. “Since these campaigns typically run for a short amount of time, traditional security solutions will be too slow on the uptake. Pushing automated coverage against attacks like this as the malicious page when it’s being built, is the only way to mitigate the gap in protection.”

NCSC-FI offered some solutions on what to do in the case of a flubot infection on your device. The chief most solution is to perform a factory reset.

However, in the case that Flubot banking trojan has deeply infected a users device and attacked banking apps, the NCSC-FI said the following:

If you used a banking application or handled credit card information on the infected device, contact your bank.
Report any financial losses to the police.
Reset your passwords on any services you have used with the device. The malware may have stolen your password if you have logged in after you installed the malware.
Contact your operator, because your subscription may have been used to send text messages subject to a charge. The currently active malware for Android devices spread by sending text messages from infected devices.

Protection Against Flubot

There are several tools internet users should use to increase their online protection. One of these tools is SaferNet.

IKEA Battles On-Going Phishing Attack

Post On: 12 January, 2022 By : Brad Hawkins

IKEA has been caught in the middle of a destructive phishing campaign, where hackers are targeting employees in internal phishing attacks which make use of stolen reply-chain emails. A reply-chain email attack is when threat actors steal legitimate corporate email and then reply to them with links to malicious documents that install malware on recipients’ devices.

Because reply-chain emails are legitimate emails from a company, recipients’ are far more likely to trust the email sender, and be more likely to open any attached malicious documents. It is by far the most effective method of phishing.

Internal emails, seen by reporters at BleepingComputer, show that IKEA is warning employees of an ongoing reply-chain phishing cyber-attack targeting internal mailboxes. These emails are also being sent from other compromised IKEA organizations and business partners.

“There is an ongoing cyber-attack that is targeting Inter IKEA mailboxes. Other IKEA organisations, suppliers, and business partners are compromised by the same attack and are further spreading malicious emails to persons in Inter IKEA,” explained an internal email sent to IKEA employees.

“This means that the attack can come via email from someone that you work with, from any external organisation, and as a reply to an already ongoing conversations. It is therefore difficult to detect, for which we ask you to be extra cautious.”

The IT teams with IKEA warn employees that the phishing emails contain links with seven digits at the end and share an example email, as shown below. In addition, employees are told not to open the emails, regardless of who sent them and to report them to the IT department immediately.

Recipients are also told to tell the sender of the emails via Microsoft Teams chat to report the emails.

“Our email filters can identify some of the malicious emails and quarantine them. Due to that, the email could be a reply to an ongoing conversation, it’s easy to think that the email filter made a mistake and release the email from quarantine. We are therefore until further notice disabling the possibility for everyone to release emails from quarantine,” IKEA communicated to employees.

From the URLs which were redacted above, reporters have been able to identify the nature of the phishing attacks targeting IKEA.

Visiting these URLs, a browser will be redirected to a download called ‘charts.zip’ that contains a malicious Excel document. This attachment tells recipients to click the ‘Enable Content’ or ‘Enable Editing’ buttons to properly view it, as shown below.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

When the buttons on the document are clicked, malicious macros will force a download of files named ‘besta.ocx,’ ‘bestb.ocx,’ and ‘bestc.ocx’ from a remote site and save them to the C:\Datop folder.

These OCX files are renamed DLLs and are executed using the regsvr32.exe command to install the malware payload.

Campaigns using this method have been seen installing the Qbot trojan (aka QakBot and Quakbot) and possibly Emotet.

The Qbot and Emotet trojans both lead to further network compromise and ultimately the deployment of ransomware on a breached network.

Due to the severity of these infections and the likely compromise of their Microsoft Exchange servers, IKEA is treating this security incident as a significant cyberattack that could potentially lead to a far more disruptive attack.

Protection Against Phishing

There are several tools internet users should use to increase their online protection. One of these tools is SaferNet.