Internet threat news

On Monday 28, 2019, news began emerging on Twitter that the Kudankulam Nuclear Power Plant (KNPP) might have been infected with a dangerous strain of malware. Pukhraj Singh, a former security analyst for India's National Technical Research Organization (NTRO) and researcher closely following the matter, concluded that a recent VirusTotal upload was linked to a malware infection at the KNPP. Initially, the KNPP denied that they had suffered a security incident. Matters were not helped by the station experiencing a shutdown of one of the reactors leading to the public to conclude incorrectly that malware incident was related to the shutdown.

Initially, the power plant responded saying the incident amounted to “false information”, however, in a separate statement released on October 30, the power plant admitted they had indeed suffered a cybersecurity incident. While the power plant stuck its head in the sand numerous researchers were analyzing the sample uploaded to VirusTotal. Several researchers that the malware used was DTrack a custom trojan developed and deployed by the Lazarus Group. For those needing a reminder, Lazarus is probably North Korea’s top state-sponsored hacking group responsible for the theft of millions of dollars.

While not one of the Republic of South Africa’s capitals, Johannesburg is the country’s largest city in terms of size, populace, and GDP contribution. The city now has another less pleasant feather in its cap, the city has now experienced a novel method of cyber-attack. On October 24, the City announced that it had suffered a cybersecurity incident. Taking to Twitter, city officials announced that the municipal authority, City of Joburg, had suffered a security breach, as a result, many of the municipality’s e-services had been taken offline and residents were unable to access certain services with officials stating,

“The incident is currently being investigated by City of Joburg cybersecurity experts, who have taken immediate and appropriate action to reinforce security measures to mitigate any potential impacts. As a result of several customer-facing systems — including the city’s website, e-services and billing systems — have been shut down as a precaution.”

For many, the advent of home speakers like Amazon’s Alexa and Google Home were must-have tech devices. Their simplicity centered round voice activation technology was hailed in some corners. In other more skeptical corners, privacy concerns dominate the debate. For security researchers searching for vulnerabilities and flaws were just part of their daily job. In 2018, some of these flaws were brought to the public’s attention with both Amazon and Google looking to solve the problems. Now, researchers working with SR Labs have published their findings detailing how the popular home speaker devices can be used for phishing and eavesdropping by threat actors.

Both of the phishing and eavesdropping attack vectors discovered center around the backends provided by the tech giants for developers to develop apps. The backend provided allows developers to create apps that allow the hardware to respond to certain commands. Often these commands are customizable so developers can create unique apps serving numerous needs. What researchers discovered is that by adding the Unicode symbol U+D801, dot, space which is represented as “�” graphically, can be inserted into certain locations within the backend which induce long periods of silence despite the speaker still being active.

Before the Czech security firm Avast acquired Piriform, the company which developed and maintained the popular registry cleaner CCleaner, the popular product had been compromised. The compromise occurred in 2017 before Avast acquired the popular product, with later analysis revealing that the infamous APT group sometimes called Deputy Dog but often referred to simply as APT 17 was behind the attack, deploying their Floxif malware via CCleaner downloads. Avast’s handling of the incident was seen by many as what should be the textbook response to such incidents.

Now, Avast gets a second chance to show that their response wasn’t a fluke and being open and honest regarding business compromises is the best approach despite the PR nightmare that inevitably ensues. In a blog post published it was revealed that the security firm was forced to counter another attack targeting the registry cleaner. According to the security firm suspicious activity was detected on September 23. Working in collaboration with the Czech intelligence agency, Security Information Service (BIS), it was discovered that the attackers gained access to the company via a compromised internal VPN owned by the company. Again, the attackers looked to target CCleaner and spread malware through compromised downloads of the registry cleaner.

The US Department of Justice (DoJ) announced that through the cooperation of US, South Korean, and other law enforcement agencies across the globe, they have managed to take down a Dark Web child pornography website along with the arrest of the individual running the site. Further, the DoJ rescued several minors who were actively being abused by contributors to the website. According to the announcement the officials managed to seize approximately eight terabytes of material involving the exploitation of minors as well as further arresting more than 300 people worldwide involved with the website in one form or the other.

If you have installed a program called JMT Trader to facilitate cryptocurrency trades you got far more than you bargained for. Last week the MalwarehunterTeam discovered a scam developed to distribute malware to both Mac and Windows machines. The scammer created a fake company to distribute a free cryptocurrency trading platform called JMT Trader. Once installed the trading platform would further install a backdoor trojan onto the machine.

Central to the scam is the website created by the attacker. It looks like any professionally done website, hoping to trick people who landed on it into downloading the free program the “company” offers. To further trick users and give the fake company some more legitimacy, the attackers also created a Twitter account, but have done little to maintain it or make it appear active. The last tweet on the account dates back to June 2019. If the user is looking to download the trading platform they are redirected to a GitHub repository where both Mac and Windows executables can be downloaded. The repository also contains the source code to the platform for those wishing to compile the code for Linux. At this stage, nothing appears to suggest any malware or malicious intent on the behalf of the attacker.

In a warning issued by the Federal Bureau of Investigation’s (FBI) cyber division private industries have been warned about attack able to bypass multi-factor authentication (MFA). According to the law enforcement agency, this is done through a combination of social engineering and SIM Swapping tools elaborated upon at a developer conference in June 2019. The warning specifically warns private industries and individuals about attacks using SIM swapping, vulnerabilities in online pages handling MFA operations, and the use of transparent proxies like Muraen and NecroBrowser. These tools when used in conjunction correctly can bypass soft forms of MFA, with the first being able to intercept login credentials and the later storing the data and hijacking the session cookie to log into now compromised accounts.

Since the first Magecart style attacks were detected in 2010 there have been over 2 million detections since then. These attacks continue to rise presenting a greater danger to online shopper unaware their credit card information can be stolen from their favorite eCommerce websites. Rather than Magecart representing one group or one specific piece of malware it has come to represent a unique attack tactic. Numerous groups are currently deploying Magecart style attacks in varying degrees of skill, some more advanced than others. The most infamous Magecart attack involved the breach of British Airways were the credit card data of nearly 400,000 customers were compromised.

A Magecart involves a hacker targeting the shopping cart systems found on eCommerce websites. The process of stealing the credit card data is known by as skimming and is done by the hacker injecting code, sometimes as little as 22 lines, into the cart's code. The code, often written in JavaScript is loaded when a customer attempts to checkout. The code then copies the credit card data entered by the customers and sent to the hacker’s command and control server.

Exposed databases are becoming an increasing problem for the public. In a recent report published by Comparitech, along with Bob Diachenko, an exposed server exposed the personally identifiable information (PII) of over 20 million Russian nationals. PII is most commonly seen as any data that could lead to the identifying of the individual, credit card information, identity number, medical records, and social security numbers are all examples of PII. The sensitive information was exposed from 2009 to 2016 and formed part of an Amazon Web Services (AWS) Elasticsearch cluster. The cluster in question was not protected by any form of encryption or password protection.

Within the cluster, devoid of any form of security, researchers discovered multiple databases. It was two of these databases that would have been of particular interest to any hacker and in turn the researchers. The two databases contained PII and tax information belonging to individuals. This information could be used in targeted phishing attacks or identity theft campaigns.

For some time numerous nation-state actors have realized the power of effective disinformation campaigns. APT groups like Fancy Bear have long realized that including a disinformation campaign along with other operations can influence political events. The Democratic National Committee, along with the US Presidential Campaign incidents can be seen as a benchmark other nation-state actors would look to copy. However, it is not only nation-state actors who have seen potential value in disinformation campaigns, now hackers and other cyber-criminal organizations have begun advertising their skills in conducting such a campaign.

Disinformation campaigns typically involves the abuse of social media platforms to disseminate fake news articles designed to further the attacker’s goal. According to research published by Recorded Future researchers discovered hackers offering disinformation services on Dark Web forums. According to the researchers two separate hackers were seen advertising and conducting such campaigns in exchange for a fee.

Researchers have discovered a malware campaign targeting computers throughout Asia which looks to replace Windows Narrator with a malicious version. The malicious version, in turn, grants the attacker not only remote access but almost unfettered persistence. Windows Narrator forms part of Microsoft’s Ease of Access suite which is built into Windows 10 and operates as a screen reader. Narrator is designed to improve the accessibility of machines running Windows 10 so those with low-level vision can use the machine relatively unhindered. The software also replaces the mouse to receive voice commands and is compatible with braille displays.

Researchers working for BlackBerry Cylance discovered the campaign and noticed that the campaign targets predominantly systems belonging to technology companies based in Southeast Asia. In a report published by Cylance, it was noted that the attackers use a modified and open source piece of software which grants remote access. Called PCShare by its developers it is currently available via GitHub. The tool is heavily modified and customized for the campaign at hand, featuring a tailored command-and-control (C2) servers, encryption, and proxy bypass functionality. At the same time, all code not deemed useful to the attacker’s goals is removed from the source code.

ATMs have long been viewed by hackers as instant jackpot machines compromised to spit out sums of money when malicious code is executed. They are not only machines which contain relatively large sums of cash but they also are a treasure trove of information begging to be stolen. Researchers based at Kaspersky Labs have discovered a new malware variant that is seemingly designed to go after the information rather than the cash, at least temporarily, as the information, data from bank cards inserted into the machine can be used later in a variety of ways for financial gain.

In a report published by Kaspersky Labs the malware, named ATMDtrack, had been seen targeting Indian ATMs and Bank since September 2018 with the latest activity associated been tracked to September 2019. In the newer attacks, researchers discovered a newer improved version of ATMDtrack, which they have subsequently called Dtrack, focusses more on spying and data theft rather than the stealing of data from bank cards. Dtrack is seen as more potent due to its increased features which include a Remote Access Trojan (RAT) that, when executed, would grant access to the infected computer to the attacker. The latest campaigns employing Dtrack have been seen targeting Indian research centers as well as banks.

A new hacking group has emerged from the shadows, dubbed Tortoiseshell by researchers, the group has been seen targeting IT companies. The reason behind it, it appears the group is laying the foundation for a supply chain attack. Such attacks can be a nightmare for organizations as they often target less secure elements of the organization, whether it be a third-party supplier or an in house system not properly secured which could grant access to the entire network.

According to a report published by Symantec the new group uses a combination of custom tools and off the shelf malware to conduct its operations. The group has been active since the middle of 2018 and in that time has targeted at least 11 IT providers. Most of the targeted IT providers reside in Saudi Arabia. According to the researchers, it appears that the hacker group aimed to gain domain level access, this would grant the group access to an organization’s entire network. It appears that the group managed to pull this off on two separate occasions.

Widely regarded as one of the most dangerous botnets in recent history Emotet activity stopped in May 2019. Researchers noticed that Emotet activity started picking up again in August. In less than a month, researchers have detected a new spam email campaign been distributed by the botnet. Malicious emails have been sent from the Emotet botnet have been seen spotted targeting those residing in Germany, the United Kingdom, Poland, and Italy. Further, emails have been seen sent to US individuals, businesses, and government organizations.

By June 2019 all activity on Emotet servers had ceased. On August 22, 2019, the command and control servers starting receiving requests and acting upon those requests. Researchers noticed that those behind the botnet have been actively preparing for a new spam email campaign.