Threat Intelligence Bulletin: 10/04/2019 - 10/10/2019

Cybercriminal Group FIN7 Updates Toolset

FIN7, a notorious cybercriminal group with significant resources that target the retail, restaurant and hotel industries, has been deploying new tools within their arsenal. Incident responders at FireEye's Mandiant released a post outlining two new tools - dubbed RDFSNIFFER and BOOSTWRITE. BOOSTWRITE is an in memory dropper for malware, and RDFSNIFFER is a malicious DLL that hijacks a remote administration client built by NCR Corporation.

Recommendations

• Never click links or open attachments in suspicious email. FIN7 uses spearphishing to deliver payloads to their targets
• Consider enabling ZeroFOX email security rules to detect indicators associated with this campaign
• Blacklist file hashes, domains and URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed

Details

Recent incident response engagements performed by the company unveiled a number of these tools. BOOSTWRITE is an in-memory dropper used to deliver payloads, such as RDFSNIFFER. In-memory malware, also called 'fileless' malware, uses a technique where the malware carves out space within already-running processes and executes within the target process. BOOSTWRITE abuses DLL search orders for applications that load Dwrite.dll. This aims to find an application to first load the DLL, then execute the malware. Once executed, the malware reaches out to a hardcoded address and retrieves an encryption key to decrypt two additional payloads. The associated samples decrypts two payloads, a CARBANAK backdoor as RDFSNIFFER.

RDFSNIFFER is a payload that uses a similar DLL loading technique as BOOSTWRITE. Once the payload is delivered, the RDFSNIFFER DLL is loaded by NCR Corporations 'Aloha Command Center', a remote access tool. It also hooks a number of Win32 API functions to tamper with the Aloha Command Center. The tampering of the client includes intercepting communications, issuing arbitrary code execution commands on the victim machine as well as hijacking the client UI.

One of the BOOSTWRITE samples contained a signed binary by a valid certificate authority, or CA. This is consistent with FIN7 tactics, as they are known to use signed binaries from valid CA's to help reduce detection probabilities of their toolsets.

IOCs

MD5
==

a67d6e87283c34459b4660f19747a306
af2f4142463f42548b8650a3adf5ceb2

SHA1
==
a873f3417d54220e978d0ca9ceb63cf13ec71f84
09f3c9ae382fbd29fb47ecdfeb3bb149d7e961a1

SHA256
==
8773aeb53d9034dc8de339651e61d8d6ae0a895c4c89b670d501db8dc60cd2d0
18cc54e2fbdad5a317b6aeb2e7db3973cc5ffb01bbf810869d79e9cb3bf02bd5

C2s
==
109.230.199.227

Threat Feed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/105/list_indicators/

Breach Disclosure: Sephora

On or around July 29, 2019, cosmetic giant Sephora reported a data breach. This breach affects customers in Southeast Asia, and ANZ who have used Sephora's online services. Exposed data includes full name, date of birth, gender, email, encrypted data, and data related to customer product preferences.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

In late July 2019, Sephora reported a data breach affecting customers in Singapore, Malaysia, Indonesia, Thailand, Philippines, Hong Kong SAR, Australia, and New Zealand. Leaked information includes full name, date of birth, gender, email, encrypted data, and data related to cust omer product preferences.

No payment information appears to have been accessed. At this time, Sephora believes no personal information has been abused, and has notified affected customers. Sephora is also offering customers a personal data monitoring service at no charge.

Breach Disclosure: StreetEasy

Real estate company StreetEasy appears to have suffered a data breach. This breach data appeared for sale on the dark web in February 2019, and the listing included over a million EasyStreet accounts and SHA-1 hashed passwords. Exposed breach data includes phone numbers, email addresses and encrypted passwords, and credit card information. Although full card numbers were not compromised, the last 4 digits of customer cards, along with billing address, card type, and expiration date were all exposed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Data from a 2016 EasyStreet backup server has been compromised. The exact date of this breach is unknown, however, breach data appeared for sale on the dark web in February 2019. EasyStreet is a real estate company, that allows users to search for apartments and apply online for them, among other things.

Compromised data includes usernames, email addresses and SHA-1 hashed passwords, phone number, and card payment information. Fortunately, no full card numbers or CVV/CVC codes have been exposed. StreetEasy has released a statemet urging customers to change passwords and monitor credit card activity, but has declined to give any information on what measures the company will be taking in order to prevent this happening again in the future.

Breaking News: 2019-10-04 - 2019-10-10

New 0-Day Flaw Affecting Most Android Phones Being Exploited in the Wild

A new 0-day vulnerability has been disclosed in Android OS. Additionally, evidence points to active exploitation of this vulnerability by the Israeli Surveillance Vendor NSO Group. Because this is being exploited in the wild, this vulnerability has been disclosed publicly after giving the vendor shorter notice than usual, so a patch is not available at this time. Popular phone models such as the Pixel 2, and the Samsung S7, S8, and S9 remain vulnerable.

See the full report here: https://thehackernews.com/2019/10/android-kernel-vulnerability.html

Hospitals in US, Australia hobbled by ransomware

Three Alabama hospital networks have been hit by Ryuk ransomware this week. A Victoria, Australia hospital was also hit this week, although details regarding the ransomware strain have not been released. Given the age of systems, and difficulties in patching, as well as the criticality of data on these systems, hospitals make for very attractive targets for bad actors.

See the full report here: https://www.welivesecurity.com/2019/10/03/hospitals-us-australia-ransomware/

Data breach exposes nearly 1000 Kaiser Permanente patients' information - ABC10.com KXTV

After an employee email account was compromised, the American healthcare consortium Kaiser Permanente has notified 990 patients that their healthcare information has been compromised. Although this notice went out earlier this week, the breach occured in mid-August. The group has not responsed to requests for comment on the delay.

See the full report here: https://www.abc10.com/article/news/data-breach-potentially-exposes-kaiser-permanente-patient-information/103-0f04f7ed-b49c-4f0d-b90e-c282708d4863

PKPLUG: Chinese Cyber Espionage Group Attacking Asia

New research has been released, regarding the activity of a Chinese APT called PKPLUG over the past three years. This group has been conducting espionage attacks primarily against Southeast Asia, leveraging malware such as Poison Ivy, PlugX, and Zupdax in these attacks.

See the full report here: https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/

Ransomware incident to cost Danish company a whopping $95 million

A Danish manufacturer of hearing aids has reported estimated losses of approximately $95 million after a ransomware attack in the beginning of September. The company has not released any further detail surrounding this attack. Historically, this is one of the largest ransomware losses ever reported.

See the full report here: https://www.zdnet.com/article/ransomware-incident-to-cost-danish-company-a-whopping-95-million/

White-hat hacks Muhstik ransomware gang and releases decryption keys

After a software developer fell victim to Muhstik ransomware, he got his revenge by hacking back - and releasing the private decryption keys for the malware. The developer has also released a free decryption tool in order to help other victims of the ransomware.

See the full report here: https://www.zdnet.com/article/white-hat-hacks-muhstik-ransomware-gang-and-releases-decryption-keys/

Iran-linked Hackers Target Trump 2020 Campaign, Microsoft says

The Iranian Phosphorus actor group has been involved in multiple targeted attacks against US entities involved in the Trump campaign since August, claims a report released by Microsoft. Because the Trump campaign website is linked to the Microsoft cloud email service, attackers seek to identify and hijack consumer email accounts associated with these Microsoft accounts. In four cases, these attacks were successful and a personal email was compromised.

See the full report here: https://threatpost.com/iran-linked-hackers-target-trump-2020-campaign-microsoft-says/148931/

HildaCrypt Ransomware Developer Releases Decryption Keys - BleepingComputer

The developer of the HildaCrypt ransomware has released the master decryption keys for it, claiming it was never intended to be used against people. The developer states that HildaCrypt was intended to be an educational excercise, and has released the keys in case someone were to use the ransomware in an attack. A security researcher has confirmed that the keys do in fact work for decryption.

See the full report here: https://www.bleepingcomputer.com/news/security/hildacrypt-ransomware-developer-releases-decryption-keys/

Signal fixes FaceTime-like eavesdropping bug

Secure instant messaging application Signal has patched a bug that allowed attackers to place, then auto-answer calls without the user's permission. This could have potentially allowed attackers to listen in on victims without their knowledge. Only Android devices are vulnerable to this, and the issue has been resolved in version 4.48.13.

See the full report here: https://www.zdnet.com/article/signal-fixes-facetime-like-eavesdropping-bug/

Google October Android Security Update Fixes Critical RCE Flaws

Google released 3 critical-severity vulnerabilities for their Android operating system. These vulnerabilities, if triggered, could allow a remote attacker to execute arbitrary code. Alongside the 3 critical vulnerabilities, 3 high-severity vulnerabilities were also fixed.

See the full report here: https://threatpost.com/google-october-android-security-update/148964/

vBulletin Releases Patch Update for New RCE and SQLi Vulnerabilities

vBulletin, a popular software used for administering forums, released fixes for 3 high-severity vulnerabilities in their software. 1 vulnerability results in a remote code execution, while the other 2 results in SQL injection. If exploited, an attacker can control the machine that the forum is ran on, or dump the entire database contents and use them maliciously.

See the full report here: https://thehackernews.com/2019/10/vBulletin-hacking-exploit.html

APT Groups Exploiting Flaws in Unpatched VPNs, Officials Warn

Government big-wigs released advisories on Monday stating that state-sponsored groups are using recent VPN-based vulnerabilities to attack targets in the US and overseas. The vulnerabilities specifically target VPN technologies from Palo Alto, Fortinet and Pulse Secure. These vulnerabilities were part of a trio released by security researchers Orange Tsai and Meh Chang at Blackhat this year.

See the full report here: https://threatpost.com/apt-groups-exploiting-flaws-in-unpatched-vpns-officials-warn/148956/

Mariposa Botnet Author, Darkcode Crime Forum Admin Arrested in Germany Krebs on Security

The alleged Mariposa botnet author and Darkode crime forum admin was arrested in Germany. This arrest follows a string of arrests in Germany targeting cybercrime based darkweb forums. The alleged author and admin was the acting CTO of a cryptocurrency mining company, who reportedly "lost" millions of dollars of Bitcoin in December 2017. The man faces extradition to the US for his charges.

See the full report here: https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/

BEC explodes as attackers exploit emails identity crisis

A recent study of DMARC policies and enforcement shows a 5x increase of DMARC since 2016. Although DMARC is deployed, only 17% are enforced, meaning that although they fail DMARC, they still arrive in victim mailboxes. This shows a significant gap in protection especially for Business Email Compromise (BEC) attacks. BEC continues to be a profitable cybercriminal act, where a recent FBI statistic showed 26 billion dollars in losses to BEC since 2013.

See the full report here: https://www.helpnetsecurity.com/2019/10/09/dmarc-records-increase/

Twitter Uses Phone Numbers, Emails to Sell Ads

Twitter disclosed that it "inadvertently" used the email addresses and phone numbers from their 2-Factor Authentication workflow in their Tailored Audiences and Partner Audiences ad service. Tech companies continue to show that although they push the boundaries of technology, research and user experiences for their customers, that they are not perfect and routinely misuse data. Privacy experts commented on the matter, pointing out these chinks in Twitter's armor.

See the full report here: https://threatpost.com/twitter-uses-phone-numbers-emails-to-sell-ads/149014/

October 2019 Patch Tuesday: A small batch of updates from Microsoft, none from Adobe

Patch Tuesday is in full effect! 60 vulnerabilities were patched for Microsoft, none being publicly disclosed to be exploited in the wild, and only one has a PoC, which relates to a local privilege escalation.

See the full report here: https://www.helpnetsecurity.com/2019/10/09/october-2019-patch-tuesday/

Sesame Street store hacked with Java cookie

Our computers and our childhood heroes are now under attack - this time with a Javascript cookie designed to steal payment information. The Sesame Street store, which contains the Volusion e-commerce package, was found to be serving malicious javascript that exfiltrated payment information. Volusion is used by 20,000 small businesses to help bootstrap their online shopping experiences.

See the full report here: https://www.itpro.co.uk/cyber-crime/34602/sesame-street-store-hacked-with-java-cookie

Mahalo FIN7: Responding to the Criminal Operators New Tools and Techniques

FireEye's Mandiant team uncovered new tools attributed to FIN7 in recent engagements. FIN7 is a cybercriminal group that targets mostly US-based retail, restaurant and hospitality verticals. The two tools, BOOSTWRITE and RDFSNIFFER, tout the gang's ability to stay undetected while inside networks. BOOSTWRITE is an in-memory-only dropper that decrypts embedded payloads using a key, while RDFSNIFFER is developed to specifically target the "Aloha Command Center" client from NCR Corporation.

See the full report here: https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html

Critical command execution vulnerability in iTerm2 patched, upgrade ASAP!

iTerm2 was patched due to a critical vulnerability in its tmux integration. If an attacker can access the system and produce output to the terminal, then they can execute malicious code on the target machine. The vulnerability was found by the Mozilla funded Radically Open Security.

See the full report here: https://www.helpnetsecurity.com/2019/10/10/iterm2-vulnerability/