Threat Intelligence Bulletin: 10/11/2019 - 10/17/2019

Actor Profile: Cazanova Haxor is Back At It

Previously, Alpha Team reported on a phishing kit author who goes by the alias Cazanova Haxor. This actor has announced that they are releasing a new kit, targeting American Express customers.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

As we've mentioned in the first two reports on this threat actor, phishing kits often spoof financial organizations because the credentials associated with these types of organizations are the most valuable. Other kits released by this author have targeted Netflix and Paypal. Previously, we reported that this actor was operating on a Facebook page, where they advertised kits and posted notices regarding updates. Shortly after the release of that advisory, ZeroFOX sucessfully took down that page.

Following our sucessful takedown, the actor moved operations to a Telegram channel. This is something we have observed occurring more and more often lately, as the social networks have become better at taking down criminal pages.

Figure 1. Announcement of the move to Telgram.

This morning, Cazanova announced that a new kit, dubbed Heroin, would be released within 24 hours. This kit will target American Express customers.

Figure 2. Release announcement of American Express kit on actor's Telegram channel.

At the time of this posting, the kit has yet to be released. This actor generally is not particularly timely with his releases, and so it could be that this kit will be released later than expected. ZeroFOX is actively monitoring this actor, and will provide updates as they are available.

Alpha Team Research: Probable TA505 Domains Uncovered

TA505 is a financially motivated threat actor group that frequently changes their malware and distribution techniques to attack their victims. A recent report on BleepingComputer shows that they are using a new Remote Access Trojan, dubbed SDBot, in their malspam campaigns. This downloader is used to deliver a combination of payloads such as ransomware, information stealers and more. A recent tweet showed a domain associated with TA505, dropbox-eu[.]com, which delivered a malicious XLS document and matched the TTPs of TA505. Alpha Team pivoted on this domain to potentially uncover 20+ other domains with similar patterns as dropbox-eu[.]com

Recommendations

• Consider enabling ZeroFOX email security rules to detect indicators associated with this campaign
• Blacklist file hashes, domains and URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails

Details

Issuing a WHOIS request on dropbox-eu[.]com yielded an interesting registrant e-mail address:

Domain Name: DROPBOX-EU.COM
Registry Domain ID: 2443820029_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: www.publicdomainregistry.com
Updated Date: 2019-10-15T17:02:56Z
Creation Date: 2019-10-15T17:02:55Z
Registrar Registration Expiration Date: 2020-10-15T17:02:55Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID: Not Available From Registry
Registrant Name: Wiet Lee
Registrant Organization:
Registrant Street: NO.1111 Chaoyang Road
Registrant City: Beijing
Registrant State/Province: Beijing
Registrant Postal Code: 361322
Registrant Country: CN
Registrant Phone: +86.86756381050
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID: Not Available From Registry
Admin Name: Wiet Lee
Admin Organization:
Admin Street: NO.1111 Chaoyang Road
Admin City: Beijing
Admin State/Province: Beijing
Admin Postal Code: 361322
Admin Country: CN
Admin Phone: +86.86756381050
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID: Not Available From Registry
Tech Name: Wiet Lee
Tech Organization:
Tech Street: NO.1111 Chaoyang Road
Tech City: Beijing
Tech State/Province: Beijing
Tech Postal Code: 361322
Tech Country: CN
Tech Phone: +86.86756381050
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: [email protected]
Name Server: a.dnspod.com
Name Server: b.dnspod.com
Name Server: c.dnspod.com
DNSSEC: Unsigned
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.2013775952
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2019-10-17T17:40:34Z <<<

whois-protect@hotmail[.]com is a unique e-mail address associated with the following domains:

coinxkeep.com
drm-server-booking.com
dropbox-en.com
dropbox-eu.com
etimerando.com
ie-settings.com
ioustories.com
magestories.com
mesinotek.com
mgstrs.com
netflix-members.com
onedrive-download-en.com
onedrive-download.com
onedrive-sd.com
onedrive-sn.com
pleiadesheaven.com
veracc.com
verzerchk.com
windows-afx-update.com
windows-en-us-update.com
windows-several-update.com
www1-worldremit.com
yries.com

windows-afx-update[.]com and dropbox-en[.]com have been identified by security researchers as possible TA505 domains. They all have served malicious documents that are consistent with the behavior of TA505 and with the BleepingComputer article.

Many of these domains responded to the common patterns seen in the distribution of malware, specifically related to the subdomains. For example, dw[1-3].dropbox-eu[.]com were all used to deliver the malicious documents. DNS resolution on these domains are listed in the indicators at the end of this report.

Two interesting findings with this data include the e-mail address, and the domain mesinotek[.]com. When visiting that webpage, it returns a login panel for Predator the Thief, a stealer malware commonly sold on the Dark Web.

Fortinet did a good writeup of the kit, but its main focus is gathering information on the target host to steal passwords, replace cryptocurrency wallets, access web-cameras and other capabilities. This does suggest that if this e-mail address is associated with TA505, then they are also using and deploying Predator the Thief in their toolset.

Screenshot courtesy of Fortinet

As of 6 October 2019, Predator the Thief is still under development, according to their Telegram channel.

The second finding pertains to the e-mail address whois-protect@hotmail[.]com. Last year, this e-mail address was attributed to the Necurs botnet by TALOS. This could provide a linking between TA505 and the Necurs botnet, both due to the whois registrant and both of the campaigns usage of malspam to distribute their attacks.

Alpha Team will continue to monitor these domains and add indicators to Alpha Team page as well as Threat Feed for our customers.

IOCs

------
104.24.113.191
161.117.35.201
185.212.128.146
185.33.86.40
185.74.252.164
193.124.191.47
195.123.246.71
217.8.117.28
38.135.122.153
45.136.111.150
45.136.111.23
45.136.111.244
45.136.111.25
45.136.111.33
45.136.111.5
47.254.175.94
93.189.42.139
coinxkeep.com
drm-server-booking.com
dropbox-en.com
dropbox-eu.com
etimerando.com
ie-settings.com
ioustories.com
magestories.com
mesinotek.com
mgstrs.com
netflix-members.com
onedrive-download-en.com
onedrive-download.com
onedrive-sd.com
onedrive-sn.com
pleiadesheaven.com
veracc.com
verzerchk.com
windows-afx-update.com
windows-en-us-update.com
windows-several-update.com
www1-worldremit.com
yries.com
dl1.coinxkeep.com
dl1.dropbox-eu.com
dl1.etimerando.com
dl1.ie-settings.com
dl1.ioustories.com
dl1.magestories.com
dl1.mesinotek.com
dl1.mgstrs.com
dl1.netflix-members.com
dl1.onedrive-sd.com
dl1.onedrive-sn.com
dl1.pleiadesheaven.com
dl1.veracc.com
dl1.verzerchk.com
dl1.windows-afx-update.com
dl1.windows-several-update.com
dl1.www1-worldremit.com
dl1.yries.com
dl2.coinxkeep.com
dl2.dropbox-eu.com
dl2.etimerando.com
dl2.ie-settings.com
dl2.ioustories.com
dl2.magestories.com
dl2.mesinotek.com
dl2.mgstrs.com
dl2.netflix-members.com
dl2.onedrive-sd.com
dl2.onedrive-sn.com
dl2.pleiadesheaven.com
dl2.veracc.com
dl2.verzerchk.com
dl2.windows-afx-update.com
dl2.windows-several-update.com
dl2.www1-worldremit.com
dl2.yries.com
dl3.coinxkeep.com
dl3.dropbox-eu.com
dl3.etimerando.com
dl3.ie-settings.com
dl3.ioustories.com
dl3.magestories.com
dl3.mesinotek.com
dl3.mgstrs.com
dl3.netflix-members.com
dl3.onedrive-sd.com
dl3.onedrive-sn.com
dl3.pleiadesheaven.com
dl3.veracc.com
dl3.verzerchk.com
dl3.windows-afx-update.com
dl3.windows-several-update.com
dl3.www1-worldremit.com
dl3.yries.com
dw1.coinxkeep.com
dw1.dropbox-eu.com
dw1.etimerando.com
dw1.ie-settings.com
dw1.ioustories.com
dw1.magestories.com
dw1.mesinotek.com
dw1.mgstrs.com
dw1.netflix-members.com
dw1.onedrive-sd.com
dw1.onedrive-sn.com
dw1.pleiadesheaven.com
dw1.veracc.com
dw1.verzerchk.com
dw1.windows-afx-update.com
dw1.windows-several-update.com
dw1.www1-worldremit.com
dw1.yries.com
dw2.coinxkeep.com
dw2.dropbox-eu.com
dw2.etimerando.com
dw2.ie-settings.com
dw2.ioustories.com
dw2.magestories.com
dw2.mesinotek.com
dw2.mgstrs.com
dw2.netflix-members.com
dw2.onedrive-sd.com
dw2.onedrive-sn.com
dw2.pleiadesheaven.com
dw2.veracc.com
dw2.verzerchk.com
dw2.windows-afx-update.com
dw2.windows-several-update.com
dw2.www1-worldremit.com
dw2.yries.com
dw3.coinxkeep.com
dw3.dropbox-eu.com
dw3.etimerando.com
dw3.ie-settings.com
dw3.ioustories.com
dw3.magestories.com
dw3.mesinotek.com
dw3.mgstrs.com
dw3.netflix-members.com
dw3.onedrive-sd.com
dw3.onedrive-sn.com
dw3.pleiadesheaven.com
dw3.veracc.com
dw3.verzerchk.com
dw3.windows-afx-update.com
dw3.windows-several-update.com
dw3.www1-worldremit.com
dw3.yries.com

Threat Feed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/106/list_indicators/

Breaking News: 2019-10-11 - 2019-10-17

Microsoft NTLM vulnerabilities could lead to full domain compromise

Researchers from Preempt discovered two vulnerabilities associated with NT LAN Manager (NTLM) that could lead to a compromise of an Active Directory domain. The two vulnerabilities, CVE-2019-1166 and CVE-2019-1338 impact Message Integrity Code (MIC) protection on NTLM authentication and potentially allow "Man-in-the-Middle" MitM attackers to use exploit these vulnerabilities and authenticate to critical servers, such as OWA and ADFS to steal user data.

Microsoft has released a few security updates in their October 2019 Patch Tuesday batch to mitigate both of these vulnerabilities. In addition, the researchers recommend encorcing NTLM mitigations (server signing and EPA), apply NTLM relay detection and prevention techniques, monitoring NTLM traffic in your network, getting rid of clients sending LM responses, and in general, limiting NTLM usage in your networks as much as possible

See the full report here: https://www.helpnetsecurity.com/2019/10/10/ntlm-vulnerabilities/

Apple iTunes and iCloud for Windows 0-Day Exploited in Ransomware Attacks

A vulnerability associated with Bonjour (Apple's implementation of zero-configuration networking) has been exploited to avoid detection from traditional endpoint protection, and allowed the BitPaymer ransomware to evade detection. This vulnerability was associated with the Updater associated with Bonjour, which is a standalone program on Windows, and is not removed alongside other Apple software, such as iTunes or iCloud. Due to Bonjour Updater being a separate program, it is often left running on systems, un-updated and silently running in the background.

This flaw is a "Unqouted Service Path Vulnerability", which means that the path of an executable contains spaces in the filename and is not enclosed in quote tags (""). In this scenario, Bonjour was trying to run from the Program Files folder, however, due to the unquoted path, it instead ran the BitPaymer ransomware since it was named "Program".

Apple has released updates for iCloud, iCloud for Windows 10.7 and iCloud for Windows 7.14, and for iTunes, they released iTunes 12.10.1. It is recommended to update this software, and remove Bonjour Updater if you are not utilizing it.

See the full report here: https://thehackernews.com/2019/10/apple-bonjour-ransomware.html

macOS users targeted with new Tarmac malware

Security researchers at Confiant have identified a new piece of Mac malware, named Tarmac (OSX/Tarmac), which is being served through online malvertising campaigns. Malicious ads were running code on user's browsers to redirect them to ads, most commonly for Adobe's Flash Player. Once the user would download the malicious "updates", the users would end up installing two different malware families, the first stage OSX/Shlayer would subsequently launch OSX/Tarmac. This campaign has been active since January 2019, however, OSX/Tarmac was not identified alongside OSX/Shlayer. All that's known about this malware at the moment is that Tarmac gathers information about the victim's hardware setup and sends it to the command and control (C2) server, however, the original C2 servers have been shut down or moved, and the full capability of this malware family is unknown. One thing the researchers have identified, is that this campaign is targeted towards users in the US, Italy, and Japan. Also to note that Tarmac is using legitimate Apple developer certificates, so traditional security measures in OSX, like Gatekeeper and XProtect won't identify this malware to the users.

See the full report here: https://www.zdnet.com/article/macos-users-targeted-with-new-tarmac-malware/

Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit - BleepingComputer

The RIG exploit kit is back and better (or worse?) than ever. A security researcher published an analysis of how the kit is now pushing out the Nemty ransomware. If a user is redirected to a site hosting RIG, and if the victim has vulnerable software, the kit will exploit the vulnerabilities and then drop Nemty.

See the full report here: https://www.bleepingcomputer.com/news/security/nemty-16-ransomware-released-and-pushed-via-rig-exploit-kit/

Imperva: Data Breach Caused by Cloud Misconfiguration

Imperva self-disclosed a breach of one of their AWS cloud instancesin August. On Thursday, the Imperva CTO made a blog post outlining how the attacker breached the company and stole customer data. During a migration to Amazon's RDS database storage solution, the company left a publicly open AWS instance open to the internet. An attacker gained access to the instance, which allowed them to pivot to a database snapshot and therefore, their customer data.

See the full report here: https://threatpost.com/imperva-data-breach-cloud-misconfiguration/149127/

Apple Under Fire Over Sending Some Users Browsing Data to China's Tencent

In more recent versions of Apple iOS (12.2+), Apple's Safari uses both Google Safe Browsing and Tencent Safe Browsing APIs to check if a website is malicious. Millions of users rely on Google Safe Browsing to help fight against malicious websites, and is a common integration within modern browsers. Until recently, Apple's Safari also uses Tencent Safe Browsing to check to see if a website is malicious, which raised privacy concerns as Tencent is a Chinese owned company.

See the full report here: https://thehackernews.com/2019/10/apple-safari-safebrowsing-tencent.html

Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted

Sudo, one of the most common defensive binaries on Linux systems, suffers from a privilege escalation flaw. If a sudoers file is configured to allow one user to execute commands of any other user except root, then the sudoers binary will execute as superuser.

See the full report here: https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html

Checkrain fake iOS jailbreak leads to click fraud

Attackers are using an exploit found in legacy iOS hardware in order to conduct click fraud. In order to draw users to their site, the attackers advertize that they are hosting checkra1n which uses the Checkm8 vulnerability to load a jailbroken image onto an iPhone. Seekers of jailbroken content are drawn into the attackers website where they are told to download an app to jailbreak their devices. However, the app doesn't provide a jailbreak and instead installs a malicious profile onto the target device. When the malicious app is accessed, the clickfraud begins. The user is lead through multiple redirects, ultimately resulting in ads being accessed and clicked on the user's behalf. Furthermore, the same techniques can be used to get a user to download a profile and enroll the user in a Mobile Device Management (MDM) platform, where an attacker can gain arbitrary control of the device.

See the full report here: tag:blogger.com,1999:blog-1029833275466591797.post-7359058300927390438

Instagram clamps down on fake messages with anti-phishing tool

Phishing on Instagram can have devestating impact on users. Hackers will target users with sophisticated emails claiming to be from Instagram and use these emails to compromise users' credentials. Instagram introduced a new feature "Emails from Instagram" which shows you emails that a verifiably from Instagram and all other emails are placed into an "Other" folder. This tool will greatly help reduce phishing scams on Instagram and provides better protection to users.

See the full report here: https://blog.malwarebytes.com/?p=40730

BriansClub Hack Rescues 26M Stolen Cards

One of the largest card fraud underground stores, BriansClub, was hacked. The hack contained over 26 million credit and debit card records. Most of the data contained cards skimmed from brick-and-mortar retailers over the past 4 years. Krebs, the reporter that released this article, reached out to BriansClub for comment and their response said that their data center was hacked.

See the full report here: https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/

Phorpiex Botnet Sending Out Millions of Sextortion Emails Using Hacked Computers

A botnet that has been active for around a decade has been seen changing their tactics from using ransomware or crypto miners to using them for sending out sextortion emails to millions of people. With the popularity of password breach information in recent years, these attackers can take compromised credentials found for email addresses and include these in emails intended to extort victims for money. It has become relatively trivial for average users to identify passwords contained in breaches, and with that knowledge, attackers can make very well crafted and believable messages to victims insisting they have more than just the password they include in their templated emails. This botnet, named Phorpiex, has been able to send around 30,000 sextortion emails per hour and will download the victim list from a remote C2 server, and then use their implementation of SMTP to send these emails out. This campaign has been seen to generate only around 11 BTC ($88,000) as of yet, but this number could be larger since it has only been monitored recently.

See the full report here: https://thehackernews.com/2019/10/phorpiex-botnet-sextortion-emails.html

OnionShare Lets Anyone Host Anonymous Sites on the Dark Web - BleepingComputer

OnionShare, a popular tool that allowed you to share files anonymously through the Tor network, has been updated to allow users to quickly and easily create basic websites on the Tor network. This allows users to quickly deploy a site, without having to worry about the underlying architecture and maintenance of the servers needed. This removes some of the hurdles most users would face now for getting a Tor website up and running, and lowers the barrier to entry for other users looking to do this. Depending on how popular this server becomes with these recent changes, more users could move to these short-lived Tor websites for sharing content versus running a traditional web server, which would potentially allow owners of these sites to avoid detection easier and remain unnoticed.

See the full report here: https://www.bleepingcomputer.com/news/software/onionshare-lets-anyone-host-anonymous-sites-on-the-dark-web/

Chinese Hackers Use New Cryptojacking Tactics to Evade Detection - BleepingComputer

The Chinese-speaking cybercrime group Rocke have modified their processes and infrastructure used in their financially motivated attacks. This group has changed tactics quite a bit over the course of this year, ranging from switching to Golang from Python, and from using Pastebin for C2 to DNS text records to store their cryptomining scripts. In addition to changing infrastructure, they also implemented new exploits for ActiveMQ servers vulnerable to CVE-2016-3088. These new changes made by the group are an ongoing pattern of trying to remain undetected and able to continue their cryptomining efforts on their victims.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-new-cryptojacking-tactics-to-evade-detection/

Malicious Payloads - Hiding Beneath the WAV

Researchers recently discovered a class of malware that uses steganography to hide malicious code inside WAV files. Steganography is the process of hiding data within other data such that is is difficult to detect. Each type of steganography uses a separate loader to decode the malicious payload. For instance, one type of steganography changes the least significant bit (LSB) of every other byte in the WAV file until the entire payload is encoded. So it would take 64 contiguous bytes to encode a single 32-byte word. This results in a WAV file which plays normally, but has encoded data, if one knows how to harvest it. There are many ways to hide data within other file formats and despite the fact the technique only obscures the payload, it is difficult to find if one doesn't know what they are looking for. It also makes it difficult to detect the malicious payload inside of the container file format. However, if the malware is well-known it could be detected when the encoded malware is dropped onto the victim's system.

See the full report here: https://threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html

Ponys C&C servers hidden inside the Bitcoin blockchain

Redaman is a piece of banking malware that uses blockchain to determine the command and control server IP address. Redaman connects to a hard coded bitcoin wallet and grabs the last two transactions posted to the wallet. With each transaction amount, it converts the decimal BitCoin amount into hexadecimal and inverts the bytes to form half of the IP address. Using both transactions the IP of the command and control can be constructed. The value of the BitCoin posted to the wallet is about $5 and can be easily updated to a new value if the original server is shut down or taken offline.

See the full report here: https://research.checkpoint.com/ponys-cc-servers-hidden-inside-the-bitcoin-blockchain/

Stripe Users Targeted in Phishing Attack That Steals Banking Info - BleepingComputer

Stripe users are being targeted in a phishing campaign designed to steal banking information. Attackers add a title field to the HTML links they provide in their phishing emails. The title keyword allows the attacker to change the mouse-over behavior so that the link appears to be legitimately from Stripe. Once the victim clicks the link in the email, they are redirected to domains with names visually similar to Stripe. The credentials are collected before finally rerouting to the actual Stripe login page in hopes that redirecting to the actual site will quelle suspicion. To avoid attacks like this, don't click links in suspicious emails and always make sure the domain you intend to visit is shown in the URL bar.

See the full report here: https://www.bleepingcomputer.com/news/security/stripe-users-targeted-in-phishing-attack-that-steals-banking-info/