Internet threat news

DoppelPaymer the Doppelganger Ransomware

A new week, a new ransomware variant seems to be an ongoing trend in the digital realm. This week continues the trend with news emerging of the discovery of a new ransomware variant, called DoppelPaymer. The new ransomware has been seen to be infecting victims since mid-June with the ransom asked sometimes topping hundreds of thousands of USD. According at security firm CrowdStrike the ransomware has seen at least eight variants which have extended the malware’s capabilities with each successive variant, the first of these dates back to April of this year.

DoppelPaymer takes its name from another ransomware BitPaymer, from which the early copies much of the latter’s code. Despite the similarities in the source code between the two pieces of malware, there are significant differences between the two. CrowdStrike noted that,

“There are obvious similarities between the tactics, techniques, and procedures (TTPs) used by DoppelPaymer and prior TTPs of BitPaymer, such as the use of TOR for ransom payment and the .locked extension. However, the code overlaps suggest that DoppelPaymer is a more recent fork of the latest version of BitPaymer. For example, in the latest version of BitPaymer, the code for RC4 string obfuscation reverses the bytes prior to encryption, and includes a helper function that provides support for multiple forms of symmetric encryption (i.e., RC4, 128-bit AES, and 256-bit AES)…”

Android Malware Agent Smith Infesting Mobile Devices

A new Android malware has been discovered. What makes this piece of malicious code interesting is its capability to replace legitimate apps with ad infested ones on the victim’s device. The malware, called Agent Smith by security firm Check Point, has infected over 25 million devices. The malware version of Agent Smith is far more dangerous to the everyday user then the fictional character from the Matrix films. The vast majority of these being on the Asian sub-continent with the vast majority of infections been detected in India with 15.2 million infections. Both Pakistan and Bangladesh have also experienced large numbers of infections, with those being 2.5 million and 1.7 million respectively. It has also been revealed that victims can remain infected for an average of two months.

In an article recently published by security firm Check Point, details of the malware have been released to the public along with a technical analysis of the malware. According to researchers, the malware was discovered earlier this year. Since its discovery researchers have tracked down the location of the malware’s operators, with their location being the city of Guangzhou, China. The operators appear to have set up a legitimate company as a front for distributing and profiting from Agent Smith. The legitimate company advertises itself as a business that helps Chinese Android app developers publish and promote their apps on overseas platforms. However, Check Point discovered that the company was posting ads for job positions that would be consistent with the requirements of operating Agent Smith and its associated infrastructure. Further, these positions would have very little to do with the job requirements needed for the legitimate side of the company.

Astaroth Living off the Land

Depending on what circles you associate yourself with the name Astaroth has different meanings. From a character in the popular game Soulcalibur to a Great Duke of Hell according to Christian demonology. The InfoSec has its own identity placed on the name, that being an info-stealing Trojan. In a new campaign, the Microsoft Security Team warns, Asteroth is being distributed in a new campaign using “living off the land” techniques to avoid detection by anti-virus software packages. “Living off the land” tactics involve the attacker exploiting legitimate operating system tools to execute pieces of code, which are not written to disk but reside in memory, which means that the tactic also employs fileless malware execution, meaning a user does not need to actively download the malware in the form by clicking on a malicious link or attachment. Another factor which makes “living off the land” tactics a considerable threat to face is that the system tools exploited are often tools admins use for monitoring systems so they are whitelisted meaning that detection is further hampered as now researchers have to look at tools originally deemed safe.

Sodinokibi Ransomware Exploiting Windows Zero-Day

With the malware developers behind GandCrab supposedly retiring something had to fill the void left in the market created by their departure. It would seem a contender has stepped up to the plate and that contenders name is Sodinokibi, also referred to as Sodin or REvil. This new ransomware has been on researchers’ radars since the beginning of 2019 but a comprehensive analysis of the ransomware has proven difficult given that the operators continually change tactics which only leave morsels of information with which to go on.

Researcher’s at Kaspersky Labs have discovered a new campaign seen distributing Sodinokibi, called Sodin by the security firm, which exploits a Windows zero-day vulnerability rather than the tried and tested distribution methods such as spam email campaigns prompting users to download the malicious program. In an article published by Orkhan Mamedov, Artur Pakulov, and Fedor Sinitsyn it was noticed that the malware has been distributed via CVE-2018-8453 Windows zero-day in a campaign which is geographically focused in Asia, targeting Hong Kong, South Korea, and Taiwan. The vulnerability when exploited allows for the escalation of privileges when the Win32k component fails to properly handle objects in memory. The flaw has already received a patch which was released in October 2018. Previously the vulnerability was seen exploited by a state-sponsored hacking group called FruityArmor. In that instance, it was used to distribute a payload designed to remain undetected and persistent on a target’s machine which further allowed the attacker persistent access to the machine.

Malware Loader Passes Through “Heaven’s Gate”

According to a blog article published by security researcher’s based at Cisco Talos, a new malware loader has been seen in the wild specifically designed to hide in plain sight and allow the payload to evade detection by anti-malware solutions by injecting into the memory of compromised computers before the payload is dropped. This discovery represents the danger posed by hackers who create custom loaders to deliver a wide range of malware strains to suit their purposes. The loader is known to exploit the infamous “Heaven’s Gate” technique to avoid detection.

The Heaven’s Gate technique was first seen in 2009 allows 32-bit malware running on 64-bit systems to hide API calls by switching to a 64-bit environment. This effectively helps the loader evade detection as many anti-virus products struggle to detect such techniques. To further evade detection the loader further hides the payload within the packed and obfuscated loader which will unpack it and inject it a legitimate RegAsm.exe process using the process-hollowing technique. Process-hollowing involves the creating of a process on a machine which runs in a suspended state, which means it is not mapped on the machine’s memory further making it difficult for anti-virus packages to detect something is wrong. The technique is similar to process injection, in that execution of the malicious code is masked under a legitimate process to evade detection. In this instance the RegAsm.exe will be created by the malware loader in a suspended state and, subsequently, its memory will be unmapped and replaced with the malicious payload. This means that the payload is never written to the compromised machine's disk making it that much harder for the computer's defences to react to the intrusion.

New Malvertising Campaign Distributes Exploit Kit and Ransomware

Researchers at Malwarebytes have discovered a new and large malvertising campaign which targets users of the popular YouTube to MP3 conversion website Onlinevideoconverter. According to SimilarWeb the conversion website is visited by over 200 million users a month, making it clear why it has been targeted by hackers distributing malware via a malvertising campaign. Such campaigns had fallen out of favor in recent months according to researchers at Malwarebytes with detections of such campaigns steadily decreasing. The latest campaign is a clear indication that the tactic is still a viable one for hackers to use.

Malvertising involves the malicious use of advertising to spread malware. One of the main methods in distributing malware this way is by hiding and then subsequently executing malicious code within relatively safe online advertisements. These ads can lead a victim to unreliable content or directly infect a victim's computer with malware, which may damage a system, access sensitive information or even control the computer through remote access. Malvertising is often used in conjunction with what has been termed by researchers as drive-by downloads and can be defined as the unintentional downloading of malware without the need for the user to click on a download link. The malware can be downloaded merely by clicking on an ad which is deemed safe by the user.

EA Rushes to Fix Cloud Flaws

EA, undoubtedly one of the world’s major players in the games industry in terms of both releases and sales, is not immune to security issues, like with any company reliant on the Internet. The company has a reputation for generating bad press, whether from business practices or unfulfilled promises relating to games. However, when a company in conjunction with security firms finds and fixes a security flaw that would potentially affect millions of customers negatively a certain amount of positive acknowledgment should be given. In this instance, the flaws which were discovered by security firms Check Point and CyberInt consisted of a chain of vulnerabilities which if exploited, could result in the attacker taking over millions of user accounts.

In both a blog post and a press release, researchers detail exactly the flaw and the possible ramifications if exploited. The chain of vulnerabilities discovered by the researchers exploits EA Games' use of authentication tokens in conjunction with the oAuth Single Sign-On (SSO) and trust authentication mechanism that is built into the login process. When exploited a threat actor would be able to hijack a player’s session resulting in compromise and at worst complete account takeover. Further, if exploited correctly a complete account takeover would give the threat actor access to a wealth of information including credit card details. These details could then be used to fraudulently by in-game currency on behalf of the compromised user which could be used by the threat actor. Most worryingly, if the flaw was exploited in the wild before it was patched would require no information been handed over to the threat actor by the user.

GandCrab v5.2 Decryptor Released

We have followed the exploits of the GandCrab operators with keen interest on this platform. We covered how Bitdefender and Europol worked together to develop and release a decryptor for GandCrab versions 1 (GDCB extension), 4 (KRAB extension), and 5 (random 10-character extension), however, none existed for version 5.2. We also covered how the operators of GandCrab were offering their ransomware as a service which resulted in the ransomware seen to be distributed via a sextortion scam. Well, we have seen a mix of good news and bad news in combatting the ransomware, today's latest news is will definitely be considered good by the general public. On June 17, Bogdan Botezatu, a security researcher with Bitdefender announced via Twitter that a decryptor for v5.2 had been released as a free tool to the public and could be used by any victim suffering from such an infection.

Malware Hidden in Medical Imagery

The healthcare sector has come under increasing fire over recent years. This fire was caused by numerous cybersecurity incidents, from breaches to malware infections affecting critical service delivery. Now the US Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) has issued an alert warning that files using the Digital Imaging and Communications in Medicine (DICOM) standard can be abused to hide malware. The DICOM standard is used in virtually all hospitals around the world, including by imaging equipment (CT, MR, ultrasound), imaging information systems (HIS, RIS, PACS), and peripheral equipment (workstations and 3D printers). The vulnerability in DICOM type files was discovered by Cylera’s Markel Picado Ortiz, who has described the flaw as a “fundamental design flaw.”

According to the NCCIC successful exploitation of this design flaw, which has been publically announced and has been given a CVE designation of CVE-2019-11687, could allow an attacker to embed executable code into image files used by medical imaging devices. Further, malicious code embedded within such image files which results in a Windows executable will not interfere with the readability and functionality of the DICOM imagery. This could potentially make the detection of malware harder and promote malware persistence on infected devices.

European Internet Traffic Rerouted to Chinese ISP

On Thursday, June 6, 2019, for approximately two hours a large amount of European Internet traffic was rerouted through the infrastructure of China Telecom, China's third-largest telco and internet service provider (ISP). According to experts, the traffic was rerouted following a BGP route leak at Swiss data center colocation company Safe Host. It has been estimated that over 70,000 routes from its internal routing table had been leaked and subsequently rerouted to the Chinese ISP. This is the second time the ISP has been caught hijacking traffic from Western countries.

A BGP route leak has been defined by the Internet Engineering Task Force (IETF) as “the propagation of routing announcement(s) beyond their intended scope. That is, an announcement from an Autonomous System (AS) of a learned BGP route to another AS is in violation of the intended policies of the receiver, the sender, and/or one of the ASes along the preceding AS path.” That is a mouthful of technical terms that sounds like a foreign language to even InfoSec researchers. In summary, the Border Gateway Patrol (BGP) is used to reroute traffic at the ISP level. It has been known to be problematic with leaks occurring frequently. However, there are safeguards and safety procedures that providers usually set up to prevent BGP route leaks from influencing each other's networks. However, instead of ignoring the BGP leak, China Telecom re-announced Safe Host's routes as its own, and by doing so, interposed itself as one of the shortest ways to reach Safe Host's network and other nearby European communication companies and ISPs.

How Hackers Profit from Stolen Medical Information

It is almost a weekly occurrence that a company announces they have suffered a data breach. Oven the numbers, in the millions, are difficult for us to wrap our heads around. Besides this, the cost to the individual affected by such a breach can be hidden within the sheer scope of these large numbers. When financial data is stolen such as credit card numbers and other account information, hackers can either use the data to clone cards and make fraudulent purchases. Or they can sell the data on Dark Web platforms so others may do the same or commit identity theft. What of personal information relating to an individual’s healthcare and medical history?

In 2018, this publication covered the data breach affecting SingHealth where 1.5 million patients’ medical records were leaked including the president of Singapore. Earlier this year we also covered who might be responsible for the breach and subsequent leak of information. This all begs the question as to why do hackers want this information. Medical data can include any and all data relating to past and present health conditions, pharmacy prescriptions, hospital records, insurance details, and online medical account credentials. Unlike with financial data, it would appear on the surface that other than for blackmail purposes there is little that can be done with such information.

A new report published by Carbon Black examines how hackers use medical information for their own gain. Hackers are actively selling such information on Dark Web marketplaces. Such information is demanding high prices and is clearly in demand. The most expensive offering on these marketplaces is information relating to providing information which can be used to forge a medical background, an alarming prospect given the harm which could be done when someone who has not qualified, poses as a medical professional. Such information can be used in the real world to forge insurance documents, medical diplomas, doctor licenses, and DEA licenses. Such information has been seen going for 500 USD per listing.

BlackSquid Emerges from the Deep

When the developers behind Coinhive announced that they would be shutting down the service of allowing websites to mine cryptocurrency rather than advertising, the rise of cryptominers was predicted by some to end. The development of Coinhive opened a Pandora’s Box and drove the abuse and development of other cryptominers, malware designed to hijack CPU resources to mine cryptocurrency, it was unlikely that Coinhive’s demise would signal the death of the malware variant. This statement seems proven by the emergence of a new crypto miner, labeled BlackSquid by researchers at TrendMicro, the malware is designed to infect web servers, network drives, and removable drives to turn them into Monero mining rigs. According to a report published by TrendMicro the malware uses several vulnerabilities to break into systems and help evade detection.

HiddenWasp Targeting Linux

Over the years there have been numerous examples of distributed denial of service (DDoS) designed to be executed on Linux machines and servers. With the advent of the Internet of Things, the number of devices available to be controlled by attackers has skyrocketed and along with it numerous versions of botnets. Cryptominers have also come to be a common foe for Linux admins. It is rare to see Linux based malware in other forms be they trojans or backdoors. According to researchers based at security firm Intezer have discovered a previously undetected malware strain targeting Linux systems. In a report published by the researcher, Ignacio Sanmillan, the malware employs advanced evasion techniques with the use of rootkits to leverage trojan-based payloads.

The malware called HiddenWasp seems to base most of its code on the recently-discovered Linux malware strain Winniti, a hacking tool alleged developed by state-sponsored Chinese hackers.

Bitcoin Scam Leads to Ransomware Infections

According to security researcher going by the pseudonym Frost, a bunch of websites is pushing a download which promises users the ability to earn up to 30 USD in Bitcoin daily. The program, called Bitcoin Collector, is nowhere near what it is advertised to be, rather it is a scam which will infect systems with ransomware and an information harvesting trojan. This is most certainly not what the user, now victim, had in mind when downloading the program they hoped would earn them a nice daily sum. Bitcoin is currently enjoying a surge in value with at the time of writing 1 BTC is 8,730 USD. This surge in recent value has been attributed to a variety of factors including accumulation of the cryptocurrency and unspent coin been at record highs. Regardless of the reasons, it will still mean that Bitcoin and other cryptocurrencies including Ethereum and Monero are still worth stealing and been exploited to lure unsuspecting victims.

Part of the scam incorporates a referral program which allows users to earn Ethereum for referring a set number of new users. The FAQ on one of the websites states that by referring 1,000 visits using your referral link you will earn 3 Ethereum. That is approximately worth 750 USD currently. This, however, is not the crux of the scam. Rather it is the download provided on the website which promises daily earnings of Bitcoins. These earnings are supposedly given free and are automatically paid out. If a potential victim clicks on the offer they are redirected to another website controlled by those behind Bitcoin Collector. Here the potential victim is offered a download which will download and install the money-making application. To further sell the legitimacy of the scam the scammers have even gone so far as to link a Virus Total detection page in an attempt to prove that it is not malicious.


Page 10 of 35

<< Start < Prev 1 2 3 4 5 6 7 8 9 10 Next > End >>
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

Virus and malware removal

This page provides information on how to avoid infections by malware or viruses and is useful if your system suffers from common spyware and malware attacks.

Learn about malware removal