New Linux Spyware and Other News
|by Alpha Team
Malware Update: New Linux Spyware
New spyware targeting Linux operating systems had been discovered by a group at Intezer Labs. EvilGnome includes functionality to screenshot a victim's desktop, listen in on microphone audio, and retrieve files from an infected device. Intezer has identified several possible correlations between this spyware and Gamaredon group activity.
Recommendations
- Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat.
- Ensure defensive systems are up to date with the latest detection.
- Blacklist network infrastructure associated with this campaign.
Details
Researchers at Intezer Labs have discovered a new family of spyware targeting Linux systems. Dubbed EvilGnome, the malware includes modules to screenshot a victim's desktop, steal files, and listen to audio over a device's microphone. Additionally, the binary includes an unfinished keylogger, which suggests that the binary is a developmental version.
Intenzer has identified several similarities between the EvilGnome command and control (C2) architecture, and that used by the Gamaredon threat actor group. Currently, EvilGnome operated on an IP address previously controlled by Gamaredon, and it also operates on an uncommon port number, 3436. Intezer has indentified an active Gamaredon Group C2 server with this port.
IOCs
Hashes:
a21acbe7ee77c721f1adc76e7a7799c936e74348d32b4c38f3bf6357ed7e8032
82b69954410c83315dfe769eed4b6cfc7d11f0f62e26ff546542e35dcd7106b7
7ffab36b2fa68d0708c82f01a70c8d10614ca742d838b69007f5104337a4b869
IPs:
195.62.52[.]101
185.158.115[.]44
185.158.115[.]154
Domains:
clsass.ddns[.]net
kotl[.]space
Breaking News - 07.18.2019
Man Charged in Cyberattack Against Financial Records of 7 Million Bulgarians
20 year old Kristian Boykov has been arrested under suspicion of conducting a cyberattack against the Bulgarian NRA tax agency. The attack exposed financial records of nearly every citizen of Bulgaria, and has resulted in a fine of over $22 million for the agency. If found guilty, Boykov could face up to 8 years in jail.
See the full report here: https://www.theguardian.com/world/2019/jul/18/wizard-hacker-charged-after-financial-records-of-nearly-every-bulgarian-exposed
FaceApp Scritinized By US Senate Over Privacy Concerns
The popular mobile photo editor FaceApp is under fire from US Senator Chuck Schumer after a sudden resurgence in popularity. Schumer is requesting the Russian-owned app be reviewed by the FTC and FBI, to ensure that user information is not being relayed to third parties without user consent.
See the full report here: https://www.cnet.com/news/faceapp-might-face-fbi-ftc-investigation-over-security-concerns/
Spike in Breach Disclosures This Week
Eight total data breaches have been disclosed this week. For further details, please see the individual advisories listed below:
MindJolt: https://cloud.zerofox.com/alpha_team/advisories/108
Evite: https://cloud.zerofox.com/alpha_team/advisories/110
Netlog: https://cloud.zerofox.com/alpha_team/advisories/111
PiZap: https://cloud.zerofox.com/alpha_team/advisories/113
Shein: https://cloud.zerofox.com/alpha_team/advisories/114
BlackSpigotMC: https://cloud.zerofox.com/alpha_team/advisories/116
Animoto: https://cloud.zerofox.com/alpha_team/advisories/117
Tags: malware, all industries, global