Threat Update: Sea Turtle DNS Hijackers are Back and Other News

Sea Turtle Update: DNS Hijacking Actors Are Back At It

DNS hijacking attacks are on the rise. The relatively low security barriers due to antiquity of the DNS system makes this an attractive attack vector for threat actors. Cisco Talos has identified new activity from the threat actors behind the April 2019 Sea Turtle attacks, newly compromised DNS name servers, and has also uncovered evidence that the Sea Turtle actors are behind the compromise of the ccTLD of the country of Greece.

Recommendations

• Enact multi-factor authentication for DNS record management. This will make it more difficult for an attacker to compromise your DNS records, even if they have login credentials.
• Consider using a registry lock service on domain names. This will prevent changes to the DNS records of your organization without out-of-band confirmation by the registry.
• Consider enabling the Cyber Attack Chatter rule to monitor chatter related to your organization and DNS-related attacks.

Details

After an initial research post on the threat actors behind the Sea Turtle DNS hijacking campaign in April 2019, Cisco Talos has identified a new DNS hijacking campaign conducted by the same actors. The actors behind this attack have compromised additional domain name servers in order to direct DNS requests to an attacker-controler server, rather than the legitimate server of a compromised domain. This technique is essentially a man-in-the-middle attack, and allows the attackers to harvest credentials used in login attempts to the attacker-controlled server. This technique has been observed in both Sea Turtle campaigns, and has been used to target government and critical infrastructure organizations in the Middle East and North Africa, including an airport.

Additionally, there is evidence that these actors have compromised the top level domain of the country of Greece. The ccTLD announced the compromise April 19, 2019, and Talos has identified that the actors behind the Sea Turtle attacks compromised and maintained access to the network of this ccTLD. This indicated that the actors had access to the TLD, and could be behind the compromise.

Breaking News - 07.10.2019

Zoom Releases Emergency Update for Vulnerabilities in MacOS Client

Zoom has reversed its stance on patching two vulnerabilities disclosed Monday. The video conferencing company has elected to release an emergency patch to prevent would-be attackers from accessing a victim's web camera feed via CVE-2019-13450. The company has also elected to remove the web server it installs (and leaves, even after uninstalling the client) on a user's machine. This patch can be downloaded here.

See the full report here: https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch-vulnerability-emergency-fix-web-server-remove

Astaroth Malware Campaigns on the Rise

Attacks leveraging the fileless Astaroth malware have been on the rise, reports Microsoft in a new advisory. This malware leverages tools that exist on the victim machine in order to masquerade as normal activity, and evade detection.

See the full report here: https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/

New Android Malware Family: Agent Smith

Researchers at Check Point have identified a new kind of mobile malware, dubbed Agent Smith. This malware targets Android devices, and displays fradulent ads to the user. This malware is currently targeting users in India and other parts of Asia.

See the full report here: https://research.checkpoint.com/agent-smith-a-new-species-of-mobile-malware/