Author: Brad Hawkins

Pegasus Spyware is being used in a new extortion scam that seeks to blackmail iOS users. The data collected by Pegasus Spyware is used to scare victims into paying so that the data is not released. A month ago, Amnesty International disclosed that Pegasus spyware was installed on fully updated iPhones through a zero-day zero-click iMessage vulnerability.

A zero-click vulnerability is a hack that is performed without any interaction by the user. These are extremely dangerous and high-priority issues for teams once they are discovered.

Amnesty believes that Pegasus Spyware is used by governments to monitor the communication of politicians, journalists, human rights activists, and business executives worldwide.

This week, a threat actor has been emailing iOS users informing them their devices was compromised with a ‘zero-click’ vulnerability to install the Pegasus spyware software.

The scammer explains that Pegasus Spyware has been used to monitor the victim’s activities and that they have created videos of them during “the most private moments” of their lives.

The email warns that if a 0.035 bitcoin (approximately $1,600) payment is not paid, the threat actors will send the videos to the recipient’s family, friends, and business associates.

The full text of the email is as follows:

You can read the full text of this email below:

“Hi there
Hello, I’m going to share important information with you.

Have you heard about Pegasus? You have become a collateral victim. It’s very important that you read the information below.

Your phone was penetrated with a “zero-click” attack, meaning you didn’t even need to click on a malicious link for your phone to be infected. Pegasus is a malware that infects iPhones and Android devices and enables operators of the tool to extract messages, photos and emails, record calls and secretly activate cameras or microphones, and read the contents of encrypted messaging apps such as WhatsApp, Facebook, Telegram and Signal.

Basically, it can spy on every aspect of your life. That’s precisely what it did. I am a blackhat hacker and do this for a living. Unfortunately you are my victim. Please read on.

As you understand, I have used the malware capabilities to spy on you and harvested datas of your private life. My only goal is to make money and I have perfect leverage for this.

As you can imagine in your worst dream, I have videos of you exposed during the most private moments of your life, when you are not expecting it.

I personally have no interest in them, but there are public websites that have perverts loving that content.
As I said, I only do this to make money and not trying to destroy your life. But if necessary, I will publish the videos. If this is not enough for you, I will make sure your contacts, friends, business associates and everybody you know see those videos as well.

Here is the deal. I will delete the files after I receive 0.035 Bitcoin (about 1600 US Dollars). You need to send that amount here [Wallet Address]

I will also clear your device from malware, and you keep living your life. Otherwise, sh*t will happen. The fee is non negotiable, to be transferred within 2 business days.

Obviously do not try to ask for any help from anybody unless you want your privacy to be violated. I will monitor your every move until I get paid. If you keep your end of the agreement, you won’t hear from me ever again.

Take care.”

Fortunately, there are currently no payments to the wallet address contained in the email. It is possible that other emails may have different addresses which have been paid.

While it is most likely this truly is a scam – That is to say, that the targets don’t have Pegasus Spyware installed – these types of activities have proven lucrative. Similar scams have generated thousands of dollars for the hackers behind them.

Though these types of emails can elicit fear in people, it is always best to mark them as scams and delete the email, as they are rarely truthful.

Pegasus Spyware Analysis

Note: This Analysis was carried out by LookOut.

The attack is very simple in its delivery and silent in delivering its payload. The attack starts when the attacker sends a website URL (through SMS, email, social media, or any other message) to an identified target. The user only has to take one action–click on the link. Once the user clicks the link, the software silently carries out a series of exploits against the victim’s device to remotely jailbreak it so that the espionage software packages can be installed.

The user’s only indication that anything happened will be that the browser closes after the link is clicked. The espionage software contains malicious code, processes, and apps that are used to spy, collect data, and report back what the user does on the device. Pegasus spyware can access and exfiltrate messages, calls, emails, logs, and more from apps including, but not limited to:

LockBit Ransomware has breached Bangkok Air, according to a press release by the aviation company last Thursday. The following day, the LockBit Ransomware gang released a countdown clock, threatening to release stolen data unless ransom demands are met. The gang claims to have 103GB worth of files from Bangkok Air, and is promising to release them on Tuesday.

Dark Web intelligence firm, DarkTracer, tweeted a screenshot of a countdown from the LockBit Ransomware gang. At the time of the tweet, the clock showed four and a half days left.

“LockBit ransomware gang has announced Bangkok Airways on the victim list,” DarkTracer tweeted. “It announced that 103GB of compressed files will be released.”

A day before the announcement by the LockBit Ransomware gang, Bangkok Airways publicly acknowledged that it had been blasted with a cyberattack a week ago, on Monday, Aug. 23. It’s still investigating the incident “as a matter of urgency,” the company said in a press release and is working on beefing up its defenses.

“Upon such discovery, the company immediately took action to investigate and contain the event, with the assistance of a cybersecurity team. Currently, the company is investigating, as a matter of urgency, to verify the compromised data and the affected passengers as well as taking relevant measures to strengthen its IT system.” the company said in their press release.

The personal data includes:

• Passenger name
• Family name
• Nationality
• Gender
• Phone number
• Email address
• Other contact information
• Passport information
• Historical travel information
• Partial credit-card information
• Special meal information

The LockBit Ransomware gang allegedly did not succeed in accessing Bangkok Airway’s operational or aeronautical security systems, the company said. The company apologized, saying that “Bangkok Airways Public Company Limited takes the protection of passenger’s data very seriously and the airline is deeply sorry for the worry and inconvenience that this malicious incident has caused.”

Bangkok Air has notified the proper authorities, including the Royal Thai police.

LockBit Ransomware Analysis

NOTE: This analysis of Lockbit Ransomware was carried out by McAfee

The file found in the investigation of Lockbit Ransomware was a dropper renamed as a .png file. When first opening the .png files we were expecting a real image file, with perhaps some steganography inside, but what we saw instead was the header of a portable executable, so no steganography pictures this time. The PE was compiled in Microsoft Visual C# v7.0 / Basic .NET, .NET executable -> Microsoft.

Entropy-wise is tidy too, not showing any stray sections or big spikes in the graph. This behavior indicates that the writer of the Lockbit Ransomware did not use obfuscation.

This file is a .NET launcher. Examining the Main() function in the code shows that an array containing a particularly long AES encrypted base64 string (in the variable named ‘exeBuffer’) carries the executable for the actual ransomware.

This encrypted string is decrypted using the key ENCRYPTION29942. The first 32 bytes of the long ExeBuffer string are used as the salt in the encryption scheme, where ENCRYPTION29942 is the passphrase.

The script checks for the existence of vbc.exe on its designated host. Usually, this binary is a digitally signed executable from Microsoft; however, in this case, the malware uses it for process hollowing.

By statically analyzing the file we can spot the usage of:

• NtUnmapViewOfSection
• LockBit Ransomware uses this API in order to unmap the original code in execution
• NtWriteVirtualMemory
• The malware writes the base address of the injected image into the PEB via NtWriteVirtualMemory
• VirtualAllocEx
• To allocate the space before injecting the malicious code
• The VBC utility is the visual basic compiler for Windows and LockBit Ransomware uses it to compile and execute the code on the fly directly in execution. If the vbc utility does not exist on the system, the malware downloads the original vbc.exe file from the same malicious URL as seen before. After executing vbc.exe, the malware replaces the objects in memory with the code for deploying the ransomware (as deduced from the exeBuffer).

The list of services LockBit Ransomware tries to stop are:

• DefWatch (Symantec Antivirus)
• ccEvtMgr (Norton AntiVirus Event Manager)
• ccSetMgr (Common Client Settings Manager Service of Symantec)
• SavRoam (Symantec Antivirus)
• sqlserv
• sqlagent
• sqladhlp
• Culserver
• RTVscan (Symantec Antivirus Program)
• sqlbrowser
• SQLADHLP
• QBIDPService (QuickBooksby Intuit.)
• QuickBoooks.FCS (QuickBooksby Intuit.)
• QBCFMonitorService (QuickBooksby Intuit.)
• sqlwriter
• msmdsrv (Microsoft SQL Server Analysis or Microsoft SQL Server)
• tomcat6 (Apache Tomcat)
• zhundongfangyu (this belongs to the 360 security product from Qihoo company)
• vmware-usbarbitator64
• vmware-converter
• dbsrv12 (Creates, modifies, and deletes SQL Anywhere services.)
• dbeng8 (Sybase’s Adaptive Server Anywhere version 8 database program)
• wrapper (Java Service?)

If one of these services is found by the malware querying the status of it, with the function “QueryServiceStatusEx”, LockBit will get all the depending modules when correct and safe and it will stop the service with the function “ControlService”.

The ransom note is rather compact because the author hardcoded the content right in the code without using any obfuscation or encryption. The text file containing the ransom note is created in every directory after encryption and called Restore-My-Files.txt.

2021 has proven to be another record-breaking year for Ransomware attacks, which have increased 288% in the last year. To add to this, the FBI has released a joint statement with CISA, urging organizations not to let down their defenses against ransomware attacks during weekends or holidays, especially with regards to the upcoming Labor Day weekend.

The agencies said they “observed an increase in highly impactful ransomware attacks occurring on holidays and weekends—when offices are normally closed—in the United States, as recently as the Fourth of July holiday in 2021.”

Though both agencies did not disclose any information regarding potential ransomware attacks within upcoming holidays, they gave examples of recent attacks which occurred on such days – Colonial Pipeline, JBS, and Kaseya.

JBS, the world’s largest beef producer, shelled out $11 Million to the now-defunct REvil Ransomware gang after a Memorial Day hack.

Colonial Pipeline paid $4.4 Million to the Darkside Ransomware gang, in what was possibly the most storied Ransomware incident of the year. The attack occurred on Memorial Day.

On the fourth of July weekend, REvil Ransomware pulled off one of their largest – and final – attacks, striking dozens of Kaseya customers which affected 1500 businesses.

As shared by the two agencies:

• In May 2021, leading into Mother’s Day weekend, malicious cyber actors deployed DarkSide ransomware against the IT network of a U.S.-based critical infrastructure entity in the Energy Sector, resulting in a week-long suspension of operations. After DarkSide actors gained access to the victim’s network, they deployed ransomware to encrypt victim data and—as a secondary form of extortion—exfiltrated the data before threatening to publish it to further pressure victims into paying the ransom demand.
• In May 2021, over the Memorial Day weekend, a critical infrastructure entity in the Food and Agricultural Sector suffered a Sodinokibi/REvil ransomware attack affecting US and Australian meat production facilities, resulting in a complete production stoppage.
• In July 2021, during the Fourth of July holiday weekend, Sodinokibi/REvil ransomware actors attacked a U.S.-based critical infrastructure entity in the IT Sector and implementations of their remote monitoring and management tool, affecting hundreds of organizations—including multiple managed service providers and their customers.

Soaring Ransomware Attacks

Holidays are the least of worries when it comes to Ransomware attacks, which soared by 288% between the first and second quarters of 2021, according to new data from NCC Group.

Analyzing incidents dealt with by its own Research Intelligence and Fusion Team (RIFT) throughout 2021, the firm claimed nearly a quarter (22%) of data leaks in the second quarter came from the Conti group.

Avaddon Ransomware was the runner-up, at 17% of incidents.

Nearly half (49%) of victims were based in the US, which continues to be a hotspot for ransomware attacks. 7% were in France, and 4% in Germany.

Christo Butcher, lead for for threat intelligence at NCC Group, stated that no organization in any sector is safe from ransomware today.

“We’ve seen targets range from IT companies and suppliers to financial institutions and critical national infrastructure providers, with ransomware-as-a-service increasingly being sold by ransomware gangs in a subscription model,” he added.

“It’s therefore crucial for organizations to be proactive about their resilience. This should include proactive remediation of security issues, and operating a least-privilege model, which means that if a user’s account is compromised, the attacker will only be able to access and/or destroy a limited amount of information.”

Braktooth is the name given to a new set of security vulnerabilities that affect Bluetooth devices and can enable a hacker to execute arbitrary code or crash devices via denial-of-service (DoS) attacks.

Braktooth (referring to the Norwegian word “Brak” which translates to “crash”) contains 16 weaknesses which span across 13 Bluetooth chipsets from 11 vendors such as Intel, Qualcomm, Zhuhai Jieli Technology, and Texas Instruments, covering an estimated 1,400 or more commercial products, including laptops, smartphones, programmable logic controllers, and IoT devices.

Braktooth was discovered by cybersecurity researchers from SSET (Automated Systems SEcuriTy) at the Singapore University of Technology and Design (SUTD).

“All the vulnerabilities […] can be triggered without any previous pairing or authentication,” the researchers noted. “The impact of our discovered vulnerabilities is categorized into (I) crashes and (II) deadlocks. Crashes generally trigger a fatal assertion, segmentation faults due to a buffer or heap overflow within the SoC firmware. Deadlocks, in contrast, lead the target device to a condition in which no further BT communication is possible.”

Of the 16 vulnerabilities, the most severe is CVE-2021-28139, which affects the ESP32 SoC used in many Bluetooth-based appliances ranging from consumer electronics to industrial equipment. Due to a lack of an out-of-bounds check in the library, an attacker can inject malicious code on vulnerable devices.

Other Braktooth vulnerabilities can result in Bluetooth functionality getting entirely disabled, or cause a DOS condition in laptops and smartphones employing Intel AX200 SoCs. “This vulnerability allows an attacker to forcibly disconnect slave BT devices currently connected to AX200 under Windows or Linux Laptops,” the researchers said. “Similarly, Android phones such as Pocophone F1 and Oppo Reno 5G experience BT disruptions.”

Bluetooth speakers, headphones, and audio modules can be sent into a bricked-state byBraktooth, where the user will be unable to turn them back on. The Braktooth attacks can be carried out using a readily available Bluetooth packet sniffer that costs less than $15.

A handful of companies including Espressif and Infineon have released firmware patches to protect vulnerable devices, while Intel, Qualcomm, and others are still investigating and a patch is in the works. Texas Instruments doesn’t intend to release a fix unless “demanded by customers.”

Braktooth Vulnerability Analysis

Note: This analysis was carried out by ASSET.

The attacker only requires (1) a cheap ESP32 development kit (ESP-WROVER-KIT [31]) with a custom (non-compliant) LMP firmware and (2) a PC to run the PoC tool. The PoC tool communicates with the ESP32 board via serial port (/dev/ttyUSB1) and launches the attacks according to the specified target BDAddress () and exploit name parameter ().

Below are the devices used for evaluation of Braktooth. The sample code is provided by vendor to test the development board. This is not applicable (N.A) on products running a fixed application.

Below is a summary of new vulnerabilities and other anomalies found (Vx: Vulnerability, Ax: Non-compliance) which make upBraktooth.

A summary of Braktooth appears in Table 2. In each row, we use the prefix V to identify a security vulnerability and A to indicate an anomalous behaviour (i.e., faulty target responses) that deviates from the Core Specifications [27]. Moreover, Table 2 outlines the respective CVEs, affected devices, protocol layers, and the violated compliance. In summary, we discovered 16 new security vulnerabilities belonging toBraktooth. For all the discovered vulnerabilities, we have followed a responsible disclosure process.

The impact of our discovered vulnerabilities is categorized into (I) crashes and (II) deadlocks. Crashes generally trigger a fatal assertion, segmentation faults due to a buffer or heap overflow within the SoC firmware. Deadlocks, in contrast, lead the target device to a condition in which no further BT communication is possible.

This may happen due to the paging scan being forcibly disabled (V16), state machine corruption on V6 or entirely disabling BT functionality via arbitrary code execution (ACE) on V1. Our results affect popular BT vendors (i.e, Intel, Qualcomm, Cypress, Texas Instruments) and relatively less known (i.e., Bluetrum, Jieli Technology, Harman), which are still employed in many consumers products such as BT speakers, keyboards, toys, etc.

V1 affects ESP32, which is used in many products ranging from consumer electronics to industrial equipment such as programmable logic controllers (PLCs). Hence, the impact is significant, as the attacker only requires knowledge of the target BDAddress to launch the attack. Indeed, all the vulnerabilities V1-V16 can be triggered without any previous pairing or authentication. Moreover, the impact of V1-V16 reaches beyond the devices listed in Table 2, since any other BT product employing an affected SoC is also vulnerable.

Multiple Link Manager Protocol (LMP) flooding attacks (e.g., V4, V12) and V15 were detected across SoCs from different BT vendors. Since the affected vendors are majors in their fields (i.e., Intel & Qualcomm), it indicates that there is a lack of flexible tools for over-the-air testing even in 2021. Besides, the Core Specifications only allows a limited “LMP test mode” [27] that restricts the SoC to operate with few LMP procedures.

The most critical vulnerability ofBraktooth (V1 in Table 2 – 8.1) affects ESP32 SoC [30], which is used in many Wi-Fi and Bluetooth IoT appliances such as Industry Automation, Smart Home, Fitness, etc. The attack is illustrated in Figure 3. A lack of out-of-bounds check in ESP32 BT Library [9] allows the reception of a mutated LMP_feature_response_ext. This results in the injection of eight bytes of arbitrary data outside the bounds of Extended Feature Page Table (“E. Features Table” in Figure 3).

An attacker, which knows the firmware layout of a target device, can write a known function address (JMP Addr.) to the offset pointed by Features Page (“Feat. Page” in the LMP_feature_response_ext packet) field. It turns out that the BT Library stores some callback pointers within the out-of-bounds Features Page offset and such a callback is eventually invoked during the BT connection.

While exploiting this vulnerability, we forced ESP32 into erasing its NVRAM data (normally written during product manufacturing) by setting JMP Addr. to the address of nvs_flash_erase. Such erase function is always included in ESP32 SDK [7] and therefore, it is present in any ESP32 firmware. Similarly, disabling BT or BLE can be done via esp_bt_controller_disable and Wi-Fi via disable_wifi_agc.

Additionally, general-purpose input/output (GPIO) can be controlled if the attacker knows addresses to functions controlling actuators attached to ESP32. As expected, this has serious implications if such aBraktooth attack is applied to Bluetooth-enabled Smart Home products.

The servers for the notorious ransomware strain REvil Ransomware have suddenly switched back online following a 2 month absence. The REvil Ransomware gang is one of the most profilic cybercriminal gangs, and operates from Russian. The gang is accused of leading a flurry of attacks in the past few years, with attacks in the last 12 months soaring. One of the most notable attacks this year was against meat supplier JBS, who paid a $11 million ransom to the gang.

On July 2nd, the REvil ransomware gang, aka Sodinokibi, used a zero-day vulnerability in the Kaseya VSA remote management software to encrypt approximately 60 managed service providers (MSPs) and over 1,500 of their business customers. The gang demanded $5 million from MSPs in exchange for the decrypter, and $70 million for a master decrypter for all Kaseya victims.

Later that week, the gang faced increasing pressure from law enforcement as US President Joe Biden held a summit with Russian Prime Minister Vladimir Putin, who agreed to tackle ransomware gangs within Russian borders.

Shortly after the summit, the REvil Ransomware gang dissapeared, and their servers and infrastructure were shut down. At the time, it left victims who wanted to negotiate with no clear path to do so.

Soon, Kaseya recieved the master decrypter from a “trusted third party”, which enable victims to decrypt all affected devices. It is still unknown who supplied this, though it is believed that Russian intelligence received the decryption key from the threat actors and passed it along to the FBI as a gesture of goodwill.

While the cybersecurity community were in good spirits following the apparent downfall of REvil Ransomware, both the Tor payment/negotiation site and REvil’s Tor ‘Happy Blog’ data leak site suddenly came back online this week.

The most recent victim on the blog was added on July 8th, 2021, just five days before REvil’s mysterious disappearance.

The Tor negotiation site is not yet fully operational, though shows a login screen which does not allow victims to log in.

The gang’s decoder is still offline at this time.

It is unclear what’s next for REvil Ransomware, but it seems that celebrations this summer were premature.

REvil Ransomware Analysis

REvil Ransomware is a Ransomware-as-a-Service (RaaS), meaning it can be sold on a subscription basis and is usable by just about anybody. In 2020, it extorted large amounts of money for corporations and individuals. According to researchers, it is the most widespread ransomware strain. Groups using have a knack for shaking down businesses that don’t meet their demands, often through threats or leaking dating.

REvil Ransomware, also known as Sodinokibi, first appeared in April 2019 and rose to prominence after another RaaS gang called GandCrab shut down its service. REvil was first advertised on Russian-language cybercrime forums. The main actor associated with advertising and promoting REvil ransomware is called Unknown aka UNKN.  In the early days of REvil, researchers and security firms identified it as a strain of GandCrab, or at least established multiple links between the two. An alleged member of the group, using the handle Unknown, confirmed in an interview that the ransomware was not a new creation and that it was built on top of an older codebase that the group acquired.

The group behind REvil Ransomware and other groups selling RaaS often do so on a commission basis. Usually, this means a cut of between 20% and 30% of the money earned through infecting victims with ransomware.

In 2020, the IBM Security X-Force Incident Response reported that 1 in 3 Ransomware infections were caused by REvil Ransomware.

In February 2021, the REvil ransomware operation posted a job notice where they were looking to recruit people to perform DDoS attacks and use VOIP calls to contact victims and their partners.

In March, a security researcher known as 3xp0rt discovered that REvil has announced that they were introducing new tactics that affiliates can use to exert even more pressure on victims.

These new tactics include a free service where the threat actors, or affiliated partners, will perform voice-scrambled VOIP calls to the media and victim’s business partners with information about the attack. The ransomware gang is likely assuming that warning businesses that their data may have been exposed in an attack on of their partners, will create further pressure for the victim to pay.

REvil Ransomware is also providing a paid service that allows affiliates to perform Layer 3 and Layer 7 DDoS attacks against a company for maximum pressure. A Layer 3 attack is commonly used to take down the company’s Internet connection. In contrast, threat actors would use a Layer 7 attack to take down a publicly accessible application, such as a web server.

It is highly configurable, and it can be customized to behave differently depending on the host. This makes it a highly attractive RaaS client. Some of its features include:

• Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.
• Whitelists files, folders and extensions from encryption.
• Kills specific processes and services prior to encryption.
• Encrypts files on local and network storage.
• Customizes the name and body of the ransom note, and the contents of the background image.
• Exfiltrates encrypted information on the infected host to remote controllers.
• REvil Ransomware uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers.

REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host. If the configuration instructs a sample to execute this exploit, it will allocate executable memory, decrypt the exploit code in the newly allocated region and invoke it.