Threat Intelligence Bulletin: 09/20/2019 - 09/26/2019

Alpha Team Research: Anatomy of an Instagram Phishing Page

In this post, Alpha Team will outline the anatomy of an interesting phishing page that was presented in a news story. Phishing and account takeover are common attacks issued against users of this social network due to the low technical requirements to execute them, as well as the payoff of selling accounts to the highest bidder, especially if the victim account is verified or has an "OG" username (an attractive username). The linked story does a good job of presenting details of the scam at a high level, but Alpha Team found the phishing page and uncovered potential infrastructure behind it and has found potentially 56 other pages on different domains using the same kit.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover
• Always verify the sender of suspicious or unexpected emails
• Never download attachments from unknown senders or suspicious email
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

The blog post went into detail about the attack. A victim receives a phishing email with a "call to action" threatening the victim to verify credentials before their Instagram account is banned for copyright infringement. Call to actions are a common theme in most phishing , malware and BEC emails as it preys on the victim's sense of urgency to respond to the e-mail. Once visited, the victim is presented with a web page:

• Courtesy of SophosNews

The call to action is presented directly to the victim, and the next page includes a login form for username, password and date of birth entries. Once entered, the victim is redirected to legitimate Instagram website, and their credentials are compromised. Although the news story redacts the URL, Alpha Team used its domain data sources to find the website located at:

https[://]instagram.copyrightinfringementappeal[.]celalx.cf/form/2957140528103/

By viewing the network transactions when loading the page, as well as the inspection source, one can see how the phishing kit works, as well as find any unique artifacts that can help identify the kit in the future. For example,vy-MhgbfL4v.html was a unique page name listed in the HTML, with the full element being listed below:

c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/vy-MhgbfL4v.html

Pivoting on this page in our private data sources as well as public data sources yielded a number of potential kits, listed below:

http://help.instagram.com.fromfacebook.ml
http://instagramhelpsupport.org/11581030/support/confirm/iamliamneesoniwillfindyouandiwillkillyou
http://instagramhelpsupport.org/11581030/support/confirm/insertscammedaccounthere
http://www.help.instagram.com.fromfacebook.ml
http://www.instagram.com.center-help.tk
https://account-netflix.cf/confirmation.com/
https://center-instagramhelp.tk
https://copyright-helpinstagramcenter.ml
https://copyright-instagramagency-helpmedia.ml
https://copyright-instagramsupport.ml
https://copyrightinstagramsupportcenter.cf
https://helpinstagramcopyright.tk
https://instagram-secure.stats10.com
https://instagram.copyrightinfringementappeal.celalx.cf/form/2957140528103/
https://instagram.stats10.com
https://instagramcopyright-infrigement.tk
https://instagramhelpcenter-verifybadge.ml
https://teaminstagrams.cf
https://www.abbccomunicacao.com.br/lucianohuck/
https://www.center-instagramhelp.tk
https://www.facebook.pro.tc
https://www.instagram-copyrigthservices.com
https://www.instagram-help-accounts.com
https://www.instagram-shortener.gq
https://www.instagram-violationreview.ml/confirm/
https://www.instagram.com.copyright.appeal.cf
https://www.instagram.com.fromfacebook.ml
https://www.instagram.com.infocopyright.cf
https://www.instagram.helpingservices.tk
https://www.instagramforcopyright.kallicho.ml
https://www.instagramsupportcopyright.cf
https://www.netflixfirsati.cf
https://www.web-instagrams.com

There are variants in this list of Instagram, Facebook as well as a list of risky, potentially phishing style words like "copyright", "helpcenter", "confirmation" and "violation".

Alpha Team Research: Cazanova Haxor Update

As previously reported, ZeroFOX has been tracking a phishing kit author going by the moniker Cazanova Haxor. One of these kits, dubbed Adrenaline, targets Paypal customers. ZeroFOX Alpha Team has obtained a copy of this phishing kit.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Phishing kits often spoof financial organizations because the credentials associated with these types of organizations are the most valuable. If an attacker can obtain PayPal credentials, these credentials can be used to transfer money from victims to attacker-controlled accounts, or to make online purchases.

Historically, this threat actor has offered a PayPal kit since 2017. This kit was initially marketed and sold under the name zPaypal. However, in late June 2019, this kit was rebranded as “Adrenaline” to fit with the rest of the actor’s drug-based naming scheme.

Figure 1. Login dashboard of the original zPayPal kit.

The newest iteration of Adrenaline is more sophisticated than the average kit. The landing pages are indistinguishable from the actual PayPal website, making it difficult for users to realize they are not interacting with the legitimate site. The kit requests information ranging from credit card information to billing address to driver’s license information, to mother’s maiden name and social security number.

Figure 2. One landing page of Adrenaline kit, requesting visitors confirm their billing address.

As with all Cazanova kits, this kit is purchased through a central purchasing site and is available for $99 USD. The kit was advertised for a period of two years on the Facebook page, Cazanova Haxor Store. This page has since been taken down in a coordinated effort between ZeroFOX and Facebook. After successful takedown of this site, this actor appears to have ceased operations on Facebook. At present, ZeroFOX has been unable to identify any additional pages being used by Cazanova. A blurb posted on the website used for license purchase and management now informs kit users that the group has been moved to Telegram. This seems to be a trend in kit and tool sales - as the social networks crack down on this kind of activity on their platforms, actors are moving to more covert channels.

The kit we obtained includes functionality to automatically report new credentials received to attackers via email. After receiving the kit, purchasers must change the reporting email address within the /V2/inc/config.php file. Additionally, credentials are logged locally in a results file at /result/Re3sult.txt. All victim-entered credentials are verified using a series of scripts that verify length and pattern of entered text.

Conclusion

Phishing kits have been around a long time - and aren't going anywhere any time soon. Financial Services organizations like PayPal are highly attractve targets for scammers given the high reward. The trend of moving towards more covert communiciation channels like Telegram or Discord, versus public social media platforms, is also interesting to note. ZeroFOX recommends applying the recommendations listed above in order to protect your organization from this threat, as well as other phishing campaigns.

Alpha Team Research: Domain Registration and Donald Trump

Recently, ZeroFOX has observed spikes in domains registered related to current major news events. Recently, with the announcement of the formal impeachment inquiry of Donald Trump on Sept. 24, 2019, we observed trends in domains related to the impeachment of the president.

Recommendations

• If you are interested in detecting domains registered that are related to your organization, which could be used to serve malicious content, consider adding these domains as entities in the platform. Reach out to [email protected] for assistance if needed

Details

Between Sept. 24 and Sept. 25, 2019, an additional 127 domains containing “trump”, 47 domains containing “impeach”, 8 containing “whistleblow”, and 1 containing “pelosi” were registered.

Figure 1. Domains registered containing “impeach” between Sept. 1 - 25, 2019.

Domains containing “impeach” spiked dramatically after the Sept. 24 announcement of the impeachment inquiry. The vast majority of these domains are either not presently hosting content, or parked. A small few of these domains are blogs that appear to be in progress. None are being used to host malicious content.

This registration correlation is not specific to political events, however. We have also observed this trend following news events such as the announcement of the Facebook fine after the Cambridge Analytica scandal, and the Capital One data breach.

Figure 2. Domains registered containing “facebook” between July 5, 2019 and July 30, 2019.

As seen above, on July 12, 2019, there was a flurry of domains registered containing “facebook.” This correlates with the date that the FTC approved the fine. Additionally, this trend can be observed with regards to the Capital One data breach, disclosed in July 2019.

Figure 3. Domains registered containing “capitalone” between July 5, 2019 and July 30, 2019.

The breach was disclosed July 30, 2019, and we observed 70 domains registered containing “capitalone” that same day. A notable spike can also be seen on July 12, 2019. This could be related to the FTC ruling released that day, as domains registered containing keywords like “equifax” and other words related to financial institutions also spiked. It could also potentially be completely unrelated.

Conclusion

Although correlation does not imply causation, it is interesting to observe the spike in domain registration immediately following world news events. This can be seen for a variety of types of events - from political to financial.

Breaking News: 2019-09-20 - 2019-09-26

Update Google Chrome Browser to Patch New Critical Security Flaws

Google has released an urgent update for Chrome which addresses 1 critical and 3 high severity vulnerabilties. These vulnerabilties are use-after-free issues, which are a class of memory corruption issues which could lead to corruption or modification of data in the memory, and also lead to sensitive information disclosure, security restrictions bypass, unauthorized actions, and cause denial-of-service conditions. It is recommended to upgrade Google Chrome immediately.

See the full report here: https://thehackernews.com/2019/09/google-chrome-update.html

Magecart strikes again: hotel booking websites come under fire

In early September, two hotel booking websites, owned by separate chains, were being injected with a JavaScript-based card-skimmer. This skimmer was only activated on mobile devices, and not present when users visited the site using a desktop browser, and employed a variety of tricks to gather as much information as they could from victims. These tricks included replacing an iFrame that is typically used to enter payment details with an attacker created iFrame in order to capture that sensitive data. This card skimmer wasn't in the actual websites of the hotel booking websites, but rather it was found in scripts provided by the developer of the domains, Roomleader.

Even though the number of websites compromised was small, it is still significant considering one brand caters for 107 hotels, while the other supports 73 hotels. These establishments are located in a total of 28 countries.

See the full report here: https://www.zdnet.com/article/magecart-strikes-again-hotel-booking-websites-come-under-fire/

Two Widely Used Ad Blocker Extensions for Chrome Caught in Ad Fraud Scheme

Two Chrome extensions have been seen masquerading as legitimate ad blocking extensions in an effort to inject cookies into users web browsers, allowing them to generate affiliate income from referral schemes fraudulently. These extensions were mimicking AdBlock and uBlock origin, which are two highly successful extensions for blocking ads. The two extensions, with 1.6 million active users, were stuffing cookies from 300 websites from Alexa Top 10000 most popular websites, including TeamViewer, Microsoft, LinkedIn, Aliexpress, and booking.com, potentially making millions of dollars a month for their developers, according to the researchers who identified this activity.

See the full report here: https://thehackernews.com/2019/09/browser-chrome-extension-adblock.html

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

In this post, Unit42 unveils a threat actor that has developed tools used in attacks against Kuwaiti transportation and shipping organizations. The tools follow an anime naming scheme (anime are Japanese cartoons for the uninformed), and they use a series of C2 techniques that tunnel information over DNS, Email and HTTPS.

See the full report here: https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/

Suspect who DDOSed World of Warcraft Classic is arrested

UK police has reportedly arrested the "hacker" behind the World of Warcraft and Wikipedia DDoS. They did not specifically say if it was the same actor tweeting the DDoS, UkDrillas, but the Twitter account was happily reporting their success in taking down the servers earlier this month. Access to "booter" or "stresser" servers that can help perform DDoS attacks are a dime a dozen, so the barrier to entry is low for these attackers, which can yield bad OPSEC and is good news for authorities.

See the full report here: https://www.pcgamer.com/suspect-who-ddosed-world-of-warcraft-classic-is-arrested/

Instagram phish poses as copyright infringement warning dont click!

Call to actions are one of the single best ways to trick a user into visiting a phishign website. In this scam, a phishing email is generated and sent to victims, where they are accused of copyright infringement of their Instagram accounts. Once visited, the site asks victims to verify their credentials with a convenient username, password and date of birth form, then redirects the user to the main Instagram website.

See the full report here: https://nakedsecurity.sophos.com/2019/09/24/instagram-phish-poses-as-copyright-infringement-warning-dont-click/

Emotet Tries to Infect You By Claiming It's Snowden's Book - BleepingComputer

Emotet operators take an interesting approach to trick users to click on their payloads. The new emails contain attachments that claim to be a scanned copy of Edward Snowden's new book. Those who open and execute the file get infected with Emotet, which then downloads additional malware such as Trickbot and in some cases ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-tries-to-infect-you-by-claiming-its-snowdens-book/

Quebec Provincial Police question 17 people about Desjardins data breach - rdnewsnow.com

On June 20, 2019, the largest financial institution in Canada, Desjardins Group was the victim of a data breach affecting 2.7 million people and 173,000 businesses. The Quebec police executed a operation involving more than 200 officers who questioned 17 people about their involvement in this data breach, conducted six searches that resulted in confiscation of computer equipment.

See the full report here: https://rdnewsnow.com/2019/09/21/quebec-provincial-police-question-17-people-about-desjardins-data-breach-2/

Zebrocy Infects Targets with New Golang-Based Backdoor via Dropbox - BleepingComputer

Believed-Russian APT 28, also known as FancyBear, has been observed using a new version of their backdoor. The new variant is written in GoLang, rather than the previously-used Delphi. In addition, they are hosting the malware dropper on DropBox.

See the full report here: https://www.bleepingcomputer.com/news/security/zebrocy-infects-targets-with-new-golang-based-backdoor-via-dropbox/

Microsoft rushes out patch for Internet Explorer zeroday

Microsoft has released a patch for an 0-day in Internet Explorer, addressing CVE-2019-1367. Microsoft claims this CVE is being leveraged by multiple bad actors in the wild, however, they have not specified any further details. The vulnerability is within the web browswer's scripting engine, and can be leveraged to execute code remotely on a victim machine.

See the full report here: https://www.welivesecurity.com/2019/09/25/microsoft-patch-internet-explorer-zeroday/

How Tortoiseshell created a fake veteran hiring website to host malware

Veterans are being targeted in a new malware campaign. The campaign, conducted by the Tortoiseshell threat actor, leverages a website that (falsely) proclaims to help veterans find jobs, and prompts them to download an app. This app is actually malware in disguise - and drops executables intended to report system information, as well as a remote access trojan.

See the full report here: tag:blogger.com,1999:blog-1029833275466591797.post-8167063229578403713

Leading Magecart Group Targeting Captive Wi-Fi Users via L7 Routers

Magecart seems to have moved towards targeting online shoppers. The group appears to have developed a new attack method, injecting malicious payment code into an open-source Javascript library. This code injection could allow for applications to be installed on a victim's device, or otherwise compromise payment information.

See the full report here: https://securityintelligence.com/posts/leading-magecart-group-targeting-captive-wi-fi-users-via-l7-routers/

vBulletin Zero-Day Exploited for Years, Gets Unofficial Patch - BleepingComputer

A zero-day in vBulletin has been discovered. vBulletin is a popular platform for building web forums. Since disclosure, multiple forums using this software have been reportedly deleted by attackers exploiting this vulnerability. No official response or patch has been released as of yet.

See the full report here: https://www.bleepingcomputer.com/news/security/vbulletin-zero-day-exploited-for-years-gets-unofficial-patch/

iOS 13 Bug Lets 3rd-Party Keyboards Gain 'Full Access' Even When You Deny

A bug in iOS 13 allows third-party keyboard applications full access to what users are typing, regardless of permissions granted, and even if permission has been denied. No fix is presently available, however, Apple has released a statement that one is being developed.

See the full report here: https://thehackernews.com/2019/09/ios-13-keyboard-apps.html

Outlook on the Web to Block File Extensions for PowerShell, Python, and More - BleepingComputer

Microsoft Outlook is set to begin blocking additional file extensions, including Java files, Powershell files, and Python files, as well as file types that are commonly used by attackers looking to exploit vulnerabilities. This is intended to improve user security.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/outlook-on-the-web-to-block-file-extensions-for-powershell-python-and-more/

Google removes Android apps caught grossly overcharging users for basic features

Multiple apps have been removed from the Google Play Store due to unscrupulous practices. These apps are subscription-based and offer an initial free trial period. Users who delete the app without cancelling the subscription of these apps are grossly overcharged for a monthly subscription, with prices ranging from $100 - $240.

See the full report here: https://www.zdnet.com/article/google-removes-android-apps-caught-grossly-overcharging-users-for-basic-features/