New Anubis Campaign Unearthed with Over 17,000 Samples

A new Anubis campaign, targeting banking applications on Android mobile devices, has been identified by researchers at Trend Micro. The banking applications targeted are based all over the world - from Australia to India to Turkey to the USA and more. Over 17,000 samples have been seen to be associated with this campaign. This malware includes functionality to conduct espionage as well as gather banking credentials, as it has capability to record device audio, send and receive text messages, open URLs, and more.

Recommendations

• Blacklist network infrastructure associated with this campaign
• Enable multifactor authentication on mobile devices whenever possible
• Regularly update mobile devices and applications
• Consider enabling the Cyber Chatter rule in order to monitor this threat

Details

A research team at Trend Micro has identified over 17,000 samples related to a new Anubis campaign. Anubis is a family of Android malware. Although Anubis began as a cyberespionage tool, it has also been seen used as a banking trojan. In this most recent campaign, it is being utilized for information theft. This malware includes functionality for recording audio on an infected mobile device, sending, receiving, and deleting SMS text messages, locking the screen, opening specific URLs, configuring administrator settings on the device, and more.

In particular, this Anubis campaign was seen to be targeting a number of different banking applications. It is able to hijack the Android activity of a targeted banking app, in order to monitor activity within the app. In total, 188 banking applications were seen to be targeted - with locations in Australia, Turkey, Germany, France, Italy, Spain, India, and the USA. Additionally, this campaign used social media accounts, specifically Twitter, in order to send command and control instructions.

For further details, please see Trend Micro's research blog here.

IOCs

Publicly available hashes

9046270d735579bcedb6bb7c0a2ad21f9b5ef9432e46e733b36de964aecd3abc
6079af3bab8bb0ba445cd0dd896d8c8d7845da3757755b4ef3af584d227e0490
1acca6953081cfc12d5cbeda1990b93b3298b1adc3c6ffad624e454f5854736f
f767baadda60c618d7e14461831e7371a54cdf152b1fd5eb52a8aa4bb7300227

Domains

hxxp://demo[.]website[.]com/
hxxp://ktosdelaetskrintotpidor[.]com
hxxp://marksteylor[.]us/
hxxp://sositehuypidarasi[.]com
hxxps://blackleaf[.]top
hxxps://firstdoxed[.]space
hxxps://lskbfidsbvkjsfgakfjsdffsdfupdate[.]net
hxxps://lskbfidsbvkjsfgakfjsdffsdfupdate[.]net/o1o/a16[.]php
hxxps://ndudetto[.]top
hxxps://playclints1[.]space
hxxps://sositehuypidarasi[.]com
hxxps://t[.]me/newpaparoni
hxxps://t[.]me/thethe123
hxxps://t[.]me/unite11

Sea Turtle Update: DNS Hijacking Actors Are Back At It

DNS hijacking attacks are on the rise. The relatively low security barriers due to antiquity of the DNS system makes this an attractive attack vector for threat actors. Cisco Talos has identified new activity from the threat actors behind the April 2019 Sea Turtle attacks, newly compromised DNS name servers, and has also uncovered evidence that the Sea Turtle actors are behind the compromise of the ccTLD of the country of Greece.

Recommendations

• Enact multi-factor authentication for DNS record management. This will make it more difficult for an attacker to compromise your DNS records, even if they have login credentials.
• Consider using a registry lock service on domain names. This will prevent changes to the DNS records of your organization without out-of-band confirmation by the registry.
• Consider enabling the Cyber Attack Chatter rule to monitor chatter related to your organization and DNS-related attacks.

Details

After an initial research post on the threat actors behind the Sea Turtle DNS hijacking campaign in April 2019, Cisco Talos has identified a new DNS hijacking campaign conducted by the same actors. The actors behind this attack have compromised additional domain name servers in order to direct DNS requests to an attacker-controler server, rather than the legitimate server of a compromised domain. This technique is essentially a man-in-the-middle attack, and allows the attackers to harvest credentials used in login attempts to the attacker-controlled server. This technique has been observed in both Sea Turtle campaigns, and has been used to target government and critical infrastructure organizations in the Middle East and North Africa, including an airport.

Additionally, there is evidence that these actors have compromised the top level domain of the country of Greece. The ccTLD announced the compromise April 19, 2019, and Talos has identified that the actors behind the Sea Turtle attacks compromised and maintained access to the network of this ccTLD. This indicated that the actors had access to the TLD, and could be behind the compromise.

Breach Disclosure: Zhenai

The 2011 breach of Zhenai, a popular dating website in China, was disclosed today. Databases containing over 5 million records related to login credentials were leaked. This includes usernames and passwords in plain text.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

A 2011 breach in popular Chinese dating site Zhenai was disclosed today. In December 2011, the Chinese Software Developer Network, or CSDN, was compromised, which ultimately lead to the leak of databases related to a number of different Chinese websites. Zhenai is one of these, with over 5 million records leaked. These records include plain text usernames and passwords.

Breaking News

Zoom Releases Emergency Update for Vulnerabilities in MacOS Client

Zoom has reversed its stance on patching two vulnerabilities disclosed Monday. The video conferencing company has elected to release an emergency patch to prevent would-be attackers from accessing a victim's web camera feed via CVE-2019-13450. The company has also elected to remove the web server it installs (and leaves, even after uninstalling the client) on a user's machine. This patch can be downloaded here.

See the full report here: https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch-vulnerability-emergency-fix-web-server-remove

Astaroth Malware Campaigns on the Rise

Attacks leveraging the fileless Astaroth malware have been on the rise, reports Microsoft in a new advisory. This malware leverages tools that exist on the victim machine in order to masquerade as normal activity, and evade detection.

See the full report here: https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/

New Android Malware Family: Agent Smith

Researchers at Check Point have identified a new kind of mobile malware, dubbed Agent Smith. This malware targets Android devices, and displays fradulent ads to the user. This malware is currently targeting users in India and other parts of Asia.

See the full report here: https://research.checkpoint.com/agent-smith-a-new-species-of-mobile-malware/