Threat Intelligence Bulletin: 07/19/2019 - 07/25/2019

Iranian APT34 Group Using LinkedIn to Spread Malware

A new campaign by the Iranian APT34 group is using LinkedIn to spread malware. Claiming to be associated with Cambridge University, APT34 is targeting victims in the oil and gas, energy and utilities, and government industries. Three primary malware families have been seen to be distributed in this campaign: TONEDEAF, VALUEVAULT, and PICKPOCKET.

Recommendations

• Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat.
• Ensure defensive systems are up to date with the latest detection.
• Blacklist network infrastructure associated with this campaign.
• Remain alert to potential phishing attacks on social media.

Details

Researchers at FireEye have identified a new APT34 campaign that leverages LinkedIn to spread malware. Fake accounts, claiming to be associated with Cambridge University, requested to join a potential victim's network before sending a direct message regarding job opportunities. Then, claiming to be too busy to continue the conversation, the actors send a message with a malicious Excel document attached.

Embedded in this Excel document is malicious VBA code which creates a second Office document upon opening, and creates a scheduled task to run the second document every minute. Upon closing of the Excel sheet, the second document is renamed to System Manager.exe. This executable has been identified as belonging to the TONEDEAF malware family. Additional malware associated with this campaign includes VALUEVAULT and PICKPOCKET. TONEDEAF is a backdoor, and has functionality to steal system information, and upload and download files from the command and control server. It can also arbitrarily run shell commands. VALUEVAULT is a Golang credential stealer, and PICKPOCKET is a browser credential theft tool. Additionally, FireEye has associated the LONGWATCH keylogger with this campaign.

This campaign targeted victims mainly within the oil and gas, energy and utilities, and government industries.

IOCs

Hashes (MD5):
b338baa673ac007d7af54075ea69660b
50fb09d53c856dcd0782e1470eaeae35
96feed478c347d4b95a8224de26a1b2c
caf418cbf6a9c4e93e79d4714d5d3b87
9fff498b78d9498b33e08b892148135f
021a0f57fe09116a43c27e5133a57a0a
d8abe843db508048b4d4db748f92a103
6eca9c2b7cf12c247032aae28419319e

Domains:
hxxp[://]www[.]cam-research-ac[.]com
offlineearthquake[.]com
c[.]cdn-edge-akamai[.]com

IPs:
185[.]15[.]247[.]154

New Wave of Phishing Attacks Uses WeTransfer for URL Obfuscation

A new phishing technique has surfaced, using the file hosting service WeTransfer. By hosting malicious HTM and HTML files on the site, attackers are able to leverage the site to redirect victims to a phishng website. Victims are then prompted to enter account credentials. This technique may bypass some protection platforms given that a legitimate service is being misused.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover.
• Always verify the sender of suspicious emails.
• Never download attachments from unknown senders or suspicious email.
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed.

Details

WeTransfer, a popular file hosting site, has recently been used to redirect users to malicious phishing sites. Researchers have identified a new phishing technique where attackers will host malicious HTM or HTML files on WeTransfer. The site is used to send potential victims a legitimate email, stating that files have been shared with them.

Figure 1. Example lure email contaning link to malicious files on WeTransfer.

When a user clicks the link in the email, they are taken to an HTM or HTML files hosted on WeTransfer. If they download and open this file, they are redirected to a phishing link. At this point, victims are generally asked to enter Microsoft Office credentials. This is a useful technique for attackers looking to bypass detection, and some email security platforms may not detect these attacks, because WeTransfer is a legitimate file hosting service.

Malware Update: Monocle, A New Android Surveillance Tool

A new family of Android malware has been identified, called Monokle. This malware aims to exfiltrate sensitive information from victim devices, and also has the ability to conduct man-in-the-middle attacks against device traffic. Additionally, it can record the screen of an infected device. Although unsubstantiated, the organization who discovered this malware claims that this malware can be attributed to a Russian defense contractor.

Recommendations

• Enable multifactor authentication on mobile devices whenever possible
• Regularly update mobile devices and applications
• Consider enabling the Cyber Chatter rule in order to monitor this threat

Details

Researchers at Lookout have identified a new family of Android malware, that looks to conduct surveillance on victims. This malware contains functionality to exfiltrate data from an infected device as well as to conduct man-in-the-middle attacks by installing an attacker-specificed certificate as a trusted certificate on the device. The malware can also record the screen of an infected device, which also allows it access to a victim's phone lock code.

The research team at Lookout feels that there is enough evidence to link this malware to the Russian defense contractor, Special Technology Centre, Ltd. Although that have not published any of this information and ZeroFOX cannot verify the accuracy of the claims, Lookout claims that information in STC's antivirus solution conclusively links the Russian contractor to this malware family.

Breaking News - 07.19.2019 - 07.25.2019

At Least 60 US Colleges and Universities Compromised With ERP Vuln

Exploitation of a vulnerability in enterprise resource planning (ERP) software Ellucian Banner Web Tailor, CVE-2019-8978, has resulted in the compromise of a large number of educational organizations. Hackers were able to used this to make over 600 fradulentstudent accounts, which were then used for criminal activity.

See the full report here: https://www.infosecurity-magazine.com/news/over-60-us-colleges-compromised-by/

Phishing Campaign Targets Office 365 Admins

Phishing attacks targeting Office 365 admins have spiked recently, due to the high reward for successfully gaining access to the admin account. Attackers could potentially use the account for creation of new accounts under an organizations domain, among other things, which legitimizes emails send in further phishing campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/phishers-target-office-365-admins-with-fake-admin-alerts/

Equifax Hit with $700 Million in Fines Over 2017 Breach

The Wall Street Journal has released a statement that credit reporting agency Equifax will pay about $700 million in fines for the exposure of records related to over 150 million Americans, after the organization repeatedly failed to patch a vulnerability in Apache Struts.

See the full report: https://securityaffairs.co/wordpress/88759/breaking-news/equifax-700m-settlement.html

Vigo County, Indiana Hit With Ransomware in Yet Another Attack Against Small Governments

Vigo County, Indiana, has been compromised in a ransomware attack. This is yet another attack in a recent wave of attacks against small city governments, with other notable victims including Baltimore, two municipalities in Florida, and other counties in Indiana.

See the full report here: https://www.heraldbulletin.com/indiana/news/malware-attack-hits-vigo-county-computers/article_ac8975c7-89c9-5872-94c0-2cb49918fa20.html

Vulnerability Indentified in ProFTPD Server

A vulnerability in ProFTPD has been discovered, that could allow for the unauthorized transfer of files on a vulnerable server.

See the full report here: https://www.bleepingcomputer.com/news/security/proftpd-vulnerability-lets-users-copy-files-without-permission

Former Siemens Contractor Pleads Guilty in Code Injection Case

A 62-year old former contractor for Siemens has pled guilty to the injection of "logic bombs" into programs used by the company. "Logic bombs" are code intentionally designed to crash or malfunction if certain criteria is met. David Tinley, the former employee, is facing up to 10 years in jail along with fines of up to $250,000.

See the full report here: https://thehackernews.com/2019/07/siemens-logic-bomb.html

Three Romanian Men Sentenced in Phishing Campaign Trial

Three Romanian men have been sentenced by the Court of the Northern District of Georgia, for their role in phishing campaigns targeting a large financial institution. The trio compromised parts of the court system's servers between 2011 and 2014, and installed software to spam potential victims with spam calls and emails, as well as texts, seeking to gain sensitive financial information from victims.

See the full report here: https://info.phishlabs.com/blog/romanian-cybercriminals-sentenced-for-phishing-campaign

South African Infrastructure Hit in Ransomware attack

City Power, an electric company in Johannesburg, South Africa, has been stricken with a ransomware attack. The exact strain of malware is unknown, and systems are in the process of being restored. Critical infrastructure is an alluring target for attackers - especially given the age of most of these systems, and difficulties in patching them.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-cripples-power-company-s-entire-network/

US Company Claims to Have Developed Working BlueKeep Exploit

Immunity Inc claims it has developed and released a working exploit for the RDP vulnerability BlueKeep, patched earlier this year. This exploit is available only through their paid penetration testing product, Canvas.

See the full report here: https://www.zdnet.com/article/us-company-selling-weaponized-bluekeep-exploit/