Threat Intelligence Bulletin: 09/27/2019 - 10/03/2019

Spotlight on Business Email Compromise

Business Email Compromise is a lucrative, and increasingly popular scam leveraged by attackers. This post details what these attacks are, the trends we see in attack techniques, and discusses recent research released on a sophisticated attacker group, dubbed Silent Staring.

Recommendations

• Never click links or open attachments in suspiscious email. If you receive an email suggesting that you direct payment to an account other than the one you generally deal with, confirm this with the organization - preferably not over email
• Consider enabling ZeroFOX email security rules to protect from scams such as this one
• Blacklist domains/URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed

Details

Business Email Compromise, or BEC, is on the rise. BEC is a type of scam that seeks to convince or blackmail employees into transferring funds into attacker-controlled accounts. This may seem like it would be an obvious scam - however, these kinds of attacks are often highly sophisticated. Generally, they leverage a sense of urgency, often combined with spoofing a person of authority as the sender of the email, to convince victims to meet their demands. One recent example of this is a BEC email scam we saw, that claimed the email sender had details regarding a plan to kidnap the recipient's children. The email sent in this case demanded that the recipient pay the sender, so that the sender would disclose details regarding the potential kidnapping.

Recent research has demonstrated an even higher level of sophistication in these kinds of scams, however. A report released today by the BEC team at Agari details how a Nigerian BEC team, Silent Starling, had managed to infiltrate over 500 organizations to tailor their scam campaigns to each organization. In short, the members of this group first sought to compromise employees at these organizations via phishing attacks. Then, after gaining access to email accounts within these organizations, the group monitored all communication regarding outgoing payments. Finally, the attackers interjected their own scam emails into these communication chains. Because the attackers had access to existing email communication regarding payments in and out of the compromised organization, they were able to tailor their scam emails to be extremely convincing. These scam emails would generally state that the bank account for an existing payment had changed, and would direct potential victims to send payment to an atatcker-controlled account.

Both phishing and BEC have become huge concerns in recent years. It only takes one employee within an organization to fall for a phishing scam, to give an attacker insider knowledge that is hugely beneficial in conducting further attacks. Additionally, as users have become more and more savvy regarding phishing, phishing pages have become far more sophisticated than they once were.

Figure 1. Example landing page of phishing page leveraged in BEC scam.

As these kinds of scams become increasingly sophisticated, organizations will have to take greater measures to ensure they are protected against them. Often, a successful phishing campaign allows attackers an enormous amount of access to a organization, and is relatively simple for an attacker to conduct, so it is imperative that organizations take appropriate measures to prevent these attacks.

IOCs

1sthealth[.]net/Feladoc/
account-dominicplaisance[.]net/direct/
activation-confirming-mainpage[.]com/
parkdoc/
alsonsproperties[.]com/voicemessage/one/
arind[.]net/Telefax/one/
ascententerprise[.]in/Scan/Newnew/docusi/
beautybuzzed[.]com/OneDrive/
benefitsofhoney[.]us/miracle/one/
blushhairmakeupbeauty[.]com[.]au/fastonedrive/
blushhairmakeupbeauty[.]com[.]au/One/
cacoinnatur[.]org[.]ve/dkny/one/
capitallaw[.]com[.]ng/mercy/one/
chamandelsur[.]net/kall/one/
chapapax[.]club/doc/Onedriv/
chisonia[.]com/Onedriv/
choumqnktrse[.]gq/micah/one/
confirmyour[.]stream/OneDrive/
creditwaves[.]com/powerdesign/one/
datamix[.]us/call/Aquadrive/
dhartidhorari[.]com/OneDrive/
dominique-services[.]org/Casefile/
dominique-services[.]org/vmail/365/
dynamanagement[.]net/OneDrive/
emater[.]com[.]br/data/one/
exploreitbd[.]net/OneDrive/
fagiot[.]co[.]vu/Med/OneDrive/
galacticbridge[.]com/Disk/OneOne/
groupinvestment[.]in/Disk/OneOne/
hearingaidexpert[.]co[.]in/YandAdoc/
hjks[.]in/generation/one/
host5[.]biz/filename/one/
hotelpuertasdecartagena[.]com/page/
fastonedrive/
idehijau[.]com/OneDrive/
jimezq[.]com/one/
justsixpackabs[.]com/office/
kesho-kenya[.]org/OneDrive/
khaledsabry[.]eu/pope/one/
kuiters[.]co[.]vu/Doc/OneDrive/
lethbridgecoffee[.]com/YandAdoc/
libertymerchantservices[.]com/Max/Newnew/
docusi/
limitedshelpt[.]online/Doc/OneOne/
lisetti[.]online/OneDrive/
lucioavila[.]com/doc/OneDrive/
lucioavila[.]com/OneDrive/
marcelopuente[.]com/Sharefile/
mundoestetic[.]cl/Onedriv/
oriereruer[.]info/que/fastdropbox/strdropbox/
office365/
ot-matour[.]com/profile/one/
ot-matour[.]com/voicemail/one/
perrhijosmios[.]com/fuul/Aquadrive/
personalchefbyronbay[.]com[.]au/doc/one/
preemagear[.]com/micro/login/office/
preemagear[.]com/zipdoc/
radiosusanense[.]com/doc/one/
ramminghretire[.]info/jkiu/
sdinpres22menrong[.]sch[.]id/Messagefile/
service-zfairy[.]com/cp/oneddrive/
servisanit[.]cl/domain/one/
servise-eugeniasouplet[.]com/zipdoc/
simone-hoarau[.]fr/doc/zipdov/oneddrive/
simone-hoarau[.]fr/Filedoc/oneddrive/
soutemaire[.]com/betterinvesting/one/
tablo365[.]com/VNreports/one/
top[.]com[.]ar/Ericka/drive/
upditeies-limitednow[.]net/awkazip/
upditeies-limitednow[.]net/zipfile/oneddrive/
urbansaddleranch[.]com/YandAdoc/
www[.]host5[.]biz/filename/one/
zartakin[.]net/doc/OneDrive/
zartakin[.]net/OneDrive/

Darknet Chronicles, Volume 2: Exit Scams and Mysterious Disappearances

In this advisory series, the Alpha Team will explore various parts of "the dark web" that are rarely discussed or known in the security research community. The goal is to showcase peculiarities or stories of the dark web, demystifying the medium as well as giving valuable insight to our customers. This post discusses dark web marketplace exit scams, spam attacks, and the unusual downtime of a dark web social media platform, Dread.

Recommendations

• Continue monitoring the Alpha Team Tab for reports related to dark web activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

Dark web marketplaces operate at a high level of flux. New sites pop up as quickly as others go down - either because the owners have scammed users, law enforcement has gotten involved, or some other situation. DDoS and spam attacks are common against dark web sites. Often, the attackers responsible attempt to extort funds from the sites they target, and threaten not to stop until their demands are met.

Somewhat similarly, exit scams are also relatively common. Dark Web Marketplaces generally have cryptocurrency wallets that receive all incoming payments from buyers, and then route them to seller wallets. These are called escrow wallets, and this is done to decrease chances of a buyer or seller's identify beinng revealed. This also serves to protect buyers, as funds generally sit in this wallet until the buyer receives the goods they have purchased. This does, however, mean that site admins have access to and control all funds flowing through the site. In some cases, site admins choose to "exit scam" with these funds. After a period of time where the site operates as it claims, and sellers recive the funds they are entitled to (which builds a credible reputation for the site), site admins suddenly cease routing payments out of the escrow wallet. This obviously burns the reputation of the marketplace, but site admins have already run away with huge amounts of cryptocurrency. In fact, when Wall Street Market exit scammed, the sites admins sought to gain nearly $12 million USD. This particular exit scam failed, as the site was under investigation by law enforcement, however may other exit scams have been very successful and have made site admins millions. Generally, when dark web marketplaces go down or are unresponsive suddenly, user begin to fear they are being exit scammed.

Although not a marketplace, dark web Reddit clone Dread went down suddenly this week. Predominantly used for buying drugs, reviewing drug sellers, and discussing topics related to dark web market places, the site is run by a user who goes by the handle HugBunter.

Figure 1. Front page of Dread, as of October 3, 2019.

The site initially went down September 18, 2019, for what was supposed to be planned routine maintenance. However, after 5 days, HugBunter posted only that he was sorry for the confusion and downtime. On September 27, 2019, after an additional 5 days of noncommunication,HugBunter's deadman switch was activated.

Figure 2. Deadman's switch message, posted after 10 days of downtime.

The flipping of the switch means that if the site is not restored to functionality within a week, all site contents will be wiped. Finally, however, on Sept. 30, Hugbunter confirmed he was alive and that he was who he said he was. The site's co-admin, Paris confirmed that HugBunter had proven his identity in three separate ways. Finally, on October 1, the site was restored.

The entirety of this situation was highly unusual. Hugbunter has not provided any explanation for his prolonged absence. The site has been victim of huge waves of spam attacks since its restoration, which was actually the initial reason for the downtime. With such little information out there on Dread's downtime, one can only speculate as to why.

Breaking News: 2019-09-27 - 2019-10-03

Phishing attacks abusing appspot.com and web.app domains on Google Cloud

A rash of phishing attacks have been spotted utilizing Google domains Appspot.com and Web.app to host malicious content. Phishing pages and malware are often hosted using legitimate services like these ones, in order to avoid being blocked by a security solution.

See the full report here: http://www.zscaler.com/blogs/research/phishing-attacks-abusing-appspotcom-and-webapp-domains-google-cloud

Arcane Stealer V Takes Aim at the Low End of the Dark Web

The Arcane Stealer V malware is being offered for just $9 on the dark web - making it an ideal tool for low-skill attackers. The tool is easy to use, with a GUI and a number of user support groups offered on platforms like Telegram. This malware seeks to steal system information, cryptocurrency wallet information, and messages from apps like Telegram.

See the full report here: https://threatpost.com/arcane-stealer-low-end-dark-web/148741/

WhiteShadow downloader uses Microsoft SQL queries to deliver malicious payloads

A new dropper is using SQL queries in order to drownload malware and steal sensitive information such as passwords and payment details. This dropper takes the form of Microsoft Word and Excel documents, containing malicious macros. If a victim enables these macros, the dropper sets about launding SQL queries to grab additional malware.

See the full report here: https://www.zdnet.com/article/whiteshadow-malware-uses-microsoft-sql-queries-to-deliver-malicious-payloads/

DoorDash Data Breach Impacts Personal Data of Almost 5M Users

Food delivery service DoorDash has disclosed a data breach affecting nearly 5 million users. Exposed information includes delivery addresses, drivers license information, names, order history, and phone numbers. DoorDash claims this breach involves a third-party service provider, although they did not specify details.

See the full report here: https://threatpost.com/doordash-data-breach-impacts-personal-data-of-almost-5m-users/148724/

Divergent: Fileless NodeJS Malware Burrows Deep Within the Host

New fileless malware called "Divergent" has emerged recently. Written in NodeJS, this malware seeks to generate profit for attackers through clickfraud, and also uses a legitimate application, WinDivert, in an effort to remain undetected. Fileless malware has become more popular as antivirus has gotten better at detecting traditional malware.

See the full report here: https://blogs.cisco.com/security/talos/divergent-fileless-nodejs-malware-burrows-deep-within-the-host

New iOS exploit checkm8 allows permanent compromise of iPhones

A new exploit has been released for iOS. Called checkm8 , this vulnerability affects iPhones 4 up to X and some iPad devices. The exploit is within the bootrom, the very first code executed at boot-up. This means a traditional patch cannot be released. Fortunately, checkm8 cannnot be exploited remotely, but it will lower the barriers for installing third party software and performing jailbreaks.

See the full report here: https://blog.malwarebytes.com/mac/2019/09/new-ios-exploit-checkm8-allows-permanent-compromise-of-iphones/

Data Breach Warning For 200 Million Android And iOS Gamers - Forbes

A new breach has exposed 200 million records of Android and iOS gamers. Exposed data includes names, emails, login IDs, hashed SHA11 passwords and phone numbers of users of games such as Words with Friends, Draw Something and OMGPOP. Zynga, the developer of these games, has announced that action will be taken to avoid invalid logins to affected accounts.

See the full report here: https://www.forbes.com/sites/daveywinder/2019/09/30/data-breach-warning-for-200-million-android-and-ios-gamers/

New PDFex attack can exfiltrate data from encrypted PDF files

A new exploit against encrypted PDF files has been released, that would allow attackers to decrypt encrypted sections of the file. The vulnerability lies in the internal PDF standard encryption, due to the way that the file format allows for certain sections to be encrypted, while others are left unencrypted.

See the full report here: https://www.zdnet.com/article/new-pdfex-attack-can-exfiltrate-data-from-encrypted-pdf-files/

Open Document format creates twist in maldoc landscape

Attackers have been spotten in recent months utilizing a somewhat obscure file format to deliver malware. By using ODT, or open document files as droppers, attackers seek to evade detection. These files contain malicious macros and/or OLEs, which then download and execute malware on a victim machine.

See the full report here: https://blogs.cisco.com/security/talos/open-document-format-creates-twist-in-maldoc-landscape

HELO Winnti: Attack or Scan?

The Winnti malware family has spiked in activity lately. First seen in 2009, Winnti is a RAT that allows an attacker to control and exfiltrate information from a victim machine, without the victim's knowledge. Although this malware originally targeted the gaming industry, it has since moved its sights towards the pharmaceutical and chemical industries.

See the full report here: https://www.lastline.com/labsblog/helo-winnti-attack-scan/

Over A Billion Malicious Ad Impressions Exploit WebKit Flaw to Target Apple Users

Althugh the use of exploit kits has dropped off significantly in recent years, the eGobbler group has begun using them to serve malicious ads. The kits are exploiting vulnerabilities in Chrome and Safari on iOS to forcibly redirect victims to malicious websites. Although these vulnerabilities have sincne been patched in Safari, they remain unpatched in Chrome.

See the full report here: https://thehackernews.com/2019/10/malvertising-webkit-hacking.html

New Adwind RAT Variant Used Against the US Petroleum Sector - BleepingComputer

A new Adwind campaign is targeting the US petroleum sector. This campaign uses multple levels of nested JAR files in order to hide the malicious payload and evade detection. Adwind is cross-platform, targeting Linux, macOS, and Windows devices, and is generally seen delivered by email malspam campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/new-adwind-rat-variant-used-against-the-us-petroleum-sector/

Comodo Forums Hack Exposes 245,000 Users' Data Recent vBulletin 0-day Used

Cybersecurity company Comodo fell victim to exploitation of the recent vBulletin 0-day this morning. The vulnerability was used to breach their discussion and support forums, and login information of over 245,000 users was exposed. Users of this forum should change their passwords immediately.

See the full report here: https://thehackernews.com/2019/10/Comodo-vbulletin-hacked.html

A Look Into Continuous Efforts By Chinese Hackers to Target Foreign Governments

Chinese hacking group Rancor has been targeting South Asian government entities in the last six months. Since December 2018, targeted phishing campaigns have been launched against a variety of government agencies. The group has been leveraging legitimate executables in order to side-load malicious DLLs, and potentially evade detection.

See the full report here: https://thehackernews.com/2019/10/chinese-hackers-phishing.html

Academics find eight vulnerabilities in Android's VoIP components

Multiple vulnerabilities have been identified in Android's VoIP components, which could allow attackers to make unauthorized calls, spoof caller ID, or execute code remotely. At present, only a few of the 8 total vulnerabilities have been patched by Google.

See the full report here: https://www.zdnet.com/article/academics-find-eight-vulnerabilities-in-androids-voip-components/

American Express Customer Info Accessed by Employee for Possible Fraud - BleepingComputer

An American Express employee is under investigation for fradulently accessing card holder information and using it to perform identity theft. American Express began notifying affected customers September 30, 2019.

See the full report here: https://www.bleepingcomputer.com/news/security/american-express-customer-info-accessed-by-employee-for-possible-fraud/

New Silent Starling Gang Targets 500+ Vendors in BEC Scam Twist - BleepingComputer

Employees of over 500 companies, in 14 countries, have been compromised by a BEC scam run by the Silent Starling group. After compromising the email account of an employee, and gaining access to all email commuication going to the compromised account, the attackers used their insider knowledge to better tailor their scam emails. Scam emails were fit into the timeline of existing communication regarding payments in and out of organizations, to make them more credible and entice victims to send funds to attacker-controlled accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/new-silent-starling-gang-targets-500-vendors-in-bec-scam-twist/

COMpfun successor Reductor infects files on the fly to compromise TLS traffic

New malware has popped up, likely written by the same authors as COMpfun. The new variety, dubbed Reductor, seeks to compromise web communications by manipulaitng web traffic.

See the full report here: https://kasperskycontenthub.com/securelist/?p=93633

Sberbank Hit by Huge Data Breach - The Moscow Times

Credit card information of up to 60 million Sberbank accounts has been identified on the dark web, and confirmed to belong to legitimate accounts. Sberbank is the largest bank in Russia, and after researchers contacted the bank to disclose the leak, they confirmed that the accounts of at least 200 clients had been compromised. This is the largest banking breach found on the dark web to date.

See the full report here: https://www.themoscowtimes.com/2019/10/03/sberbank-hit-by-huge-data-breach-a67570

Zendesk announces data breach impacting years-old accounts - CyberScoop

Zendesk, a popular support ticketing software platform, has disclosed a data breach that occurred in 2016. This affects up to 10,000 customers of Zendesk - which are generally large organizations such as Spotify and Vimeo. Exposed data included usernames, salted and hashed passwords, agent names, contact information, and more.

See the full report here: https://www.cyberscoop.com/zendesk-data-breach/

Ramnit Targets Japanese Shoppers, Aiming at Top Fashion Brands

The Ramnit banking trojan has begun targeting Japanese e-commerce vendors - in particular, fashion brands. Compromised e-commerce sites are used to host the Gandsoft exploit kit, which ultimately drops the Ramnit banking trojan on users who visit the site.

See the full report here: https://securityintelligence.com/posts/ramnit-targets-japanese-shoppers-aiming-at-top-fashion-brands/

WhatsApp vulnerability exploited through malicious GIFs to hijack chat sessions

A new vulnerability in WhatsApp allows attackers to execute remote code on victim devices. By sending a user a corrupted GIF file, which is automatically downloaded by WhatsApp upon receipt, an attacker can trigger a double free. Additionally, if the recipient opens the WhatsApp Image Gallery after receiving the malicious GIF, remote code execution can be achieved.

See the full report here: https://www.zdnet.com/article/whatsapp-vulnerability-exploited-through-malicious-gifs-to-hijack-chat-sessions/