Threat Intelligence Bulletin: 11/01/2019 - 11/07/2019

How to Identify a Phishing Kit

Over the last several months, ZeroFOX Alpha Team has reported on a variety of different phishing kits targeting major organizations. These targets are from diverse verticals. Some are within the Financial Services sector, while others are email services or cloud hosting platforms..

Often, the landing pages of these scams are nearly identical to the real thing, making it difficult for potential victims to distinguish between the two. This post takes a look at the landing pages of several different phishing kits, and seeks to give readers a better understanding of how they can identify a scam.

Recommendations

• Verify the URL of any website where you input credentials, prior to submitting them. Ensure that the URL matches what you would expect. Attackers use many strategies to disguise their malicious URLs, including using very long URLs where the beginning contains keywords related to the legitimate site, or using shortened links that conceal the real URL
• Never click a link from a suspicious email, or one from an unknown sender
• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Olux Targets SharePoint Customers

Yesterday, Alpha Team posted an analysis of the Olux SharePoint phishing kit. This kit seeks to steal email credentials from its victims. The landing page for this kit at first glance, is a pretty good copy of the legitimate service’s page. The scammer has used the real SharePoint logo, and has also included the logos of other Microsoft Office products in order to make themselves seem more credible.

However, a closer look at the language on this page indicates that this is an imitation - not the real thing. Several phrases use odd language and capitalization, like “Put Email to access document…” and “No account? Create sharepoint!” Neither of these phrases use natural language, and multiple errors are present.

Figure 1. Olux SharePoint kit landing page.

Cazanova Haxor Targets Netflix, Paypal, and more

Although the landing page for the Olux kit has some glaring errors that make it suspicious, some phishing kit developers are more sophisticated, to the point where it becomes difficult to discern what is fake and what is real. For example, the scam page for the Cazanova Netflix kit is shown below.

Figure 2. Scam page of Cazanova Haxor’s Netflix kit

The branding used on this page is an excellent impersonation of Netflix’s official branding and there are also no obvious spelling or grammar mistakes. This makes it much more difficult to tell that this is a phishing page unless you are paying very close attention. Because the phishing kit branding spoofs Netflix so well, it becomes very important to verify the URL of the page. Is the web address something that would be expected, like netflix.com/verify? Or is it something new and likely suspicious, like netflix-verify-438u5lk34235gdfhd87fgd.xyz? If the latter is the case, it’s likely not safe to be submitting personal information to the page.

Conclusion

Although some phishing scams are obvious, many phishing kit authors have become highly sophisticated in the graphic design of their kits. By expertly mimicking the branding of their targeted organization, phishing kit authors are able to trick their victims into submitting personal, or even credit card information, without realizing they have been scammed. Being vigilant and applying the recommendations mentioned above will help readers to remain safe from phishing scams and potential account compromise.

Olux Phishing Kit Targets Microsoft SharePoint Customers

Through our trust group partners, ZeroFOX Alpha Team has obtained a phishing kit targeting SharePoint customers. SharePoint is a Microsoft product that integrates with Microsoft Office, used for cloud-based hosting and sharing. The kit, called Olux, is available for purchase through a website set up for handling kit administrator-related tasks. The use of a custom website for kit sale operatons is relatively common - ZeroFOX also saw this with Cazanova Haxor kits previously discussed.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Kit Mechanics

The Olux SharePoint kit is relatively simplistic. The landing page spoofs the legitimate SharePoint site fairly well, and claims that a potential victim must log in, in order to access some kind of document.

Figure 1. Olux Phishing kit landing page.

After a victim has submitted an email, the kit then requests the victim input their password twice. Finally, the user is redirected to a fake PDF loading page. Finally, after a few seconds of faked "loading," a message is displayed that the document is no longer available, and the victim is redirected to the legitimate Outlook Mail website. The images and other resources used in building the pages that are displayed to a potential victim are hosted on the domain ungeared-prevention.000webhostapp[.]com.

While the victim is inputting this information, it is aggregated and sent to an attacker-specified email address. This kit is simplistic, but likely to be affective due to the simplicity of it.

Kit Advertising, Sales, and Support

This kit is advertised on ICQ, Telegram, and also leverages a private Facebook group which has existed since November 2017. At present, this group has 258 members and remains active at the time of this posting. The site admins also advertise their Skype and Gmail accounts for support purposes.

Kit purchasers can use the admin website to submit support tickets, purchase and download updates to the kits, and access other resources. The site is also used to update kit users with a small news feed on the front page. Although this kind of service is not uncommon (similar features were present on the Cazanova Haxor kit admin site), what is unusual is the ability to purchase "Leads" and "Hosts" to use for scam activity. In particular, the Leads page is used to sell large groupings of email addresses, from various locations. Kit users are able to purchase dumps of anywhere from 10,000 to over 100,000 active email addresses.

Figure 2. Leads available for purchase as of 11/05.

Kit users also have the option of purchaing mailing programs from the site, and can even test these mailers by clicking a button to send the email associated with the users account a sample email.

For the scammer who is brand new to the scene, this kit even offers the "Olux Academy." For $250, new users will be given access to a "spamming torurial"[sic] with how-to videos and easy-to-use scripts. This appears to be done over an ICQ group.

Figure 3. Sample of "toturial"[sic] ICQ group offering, offered for $250.

Other Kit Offerings

In addition to the SharePoint phishing kit for which Alpha Team obtained kit code, Olux also offers many other kits targeting Discover, Office 365, Yahoo, Comcast Xfinity, and many others. The Discover kit phishes for account credentials, PII including social security number and date of birth, and credit card information. Other kits harvest user credentials for the targeted site.

Conclusion

The Olux phishing kit offerings are simple, but easy-to-use. Because of this, they are likely highly attractive to scammers, especially given that this group has been around since 2017. The level of support offered by the Olux group is high, even compared to other more boutique scam offerings Alpha Team has analyzed previously. ZeroFOX recommends implementing the recommendations above in order to reduce your risk of falling victim to these kinds of scams.

IOCs

angelsnatch[.]com
rockwool.vmwareidentity[.]edu
ungeared-prevention.000webhostapp[.]com

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/111/list_indicators/

Breaking News: 2019-11-01 - 2019-11-07

On Halloween night, Google discloses Chrome zero-day exploited in the wild

Google released a patch on Halloween night to address two high severity vulnerabilities that have been seen being exploited in the wild. These vulnerabilities are "use-after" free vulnerabilities which impact the audio component (CVE-2019-13720) and the PDFium library (CVE-2019-13721). These vulnerabilities can be exploited by having a victim user browse to a malicious website which could allow for arbitrary code execution to occur. Google is recommending to update to the latest version of Chrome on whatever platform you are using, and should be updated to at least version 78.0.3904.87.

See the full report here: https://www.zdnet.com/article/halloween-scare-google-discloses-chrome-zero-day-exploited-in-the-wild/

40 million emoji-addicted keyboard app users left with $18m bill after malware sneaks into Play Store yet again

A popular Android keyboard app is responsible for ad fraud resulting in up to $18,000,000 in fraudulent purchases by victims using this app. Ai.type, which had around 40 million downloads, and has since been removed from the Android Play store, contained the malicious code to perform the ad and click fraud through SDK's included in the app itself. By including this malicious code in the SDK's, most of the links and external code are obfuscated and make it difficult to detect this malicious behavior, which is completely transparent to the user, using this keyboard app.

See the full report here: https://www.theregister.co.uk/2019/11/01/aitype_keyboard_malware_alert/

Thousands of QNAP NAS devices have been infected with the QSnatch malware

A new strain of malware, dubbed QSnatch, has been targeting network-attached storage (NAS) devices from Taiwanese vendor QNAP. There have been over 7,000 infections reported in Germany alone, however, this appears to be an ongoing outbreak with more devices to become infected over time. There are little details of how this malware is being spread, but cursory analysis identified methods that this malware is obtaining persistence in the firmware. Some capabilities identified include preventing firmware updates, preventing malware removal software from running and extracting usernames and passwords for all NAS users. Users are recommended to disconnect the devices on their NAS until a better solution can be found.

See the full report here: https://www.zdnet.com/article/thousands-of-qnap-nas-devices-have-been-infected-with-the-qsnatch-malware/

Office for Mac Users Warned of Malicious SYLK Files

US-CERT warns Microsoft Office for Mac users against symbolic link (SYLK) files that contain dangerous XML macros which could allow arbitrary code execution on the victims machine. These can be executed whether or not "Disable Macros" is checked on inside Microsoft office. It is suggested to completely block SYLK files in MS Office. This can be done via the File Block settings in the MS Office Trust Center settings.

See the full report here: https://threatpost.com/office-for-mac-malicious-sylk-files/149823/

First Bluekeep Exploit Found in the Wild

The first public disclosure of Bluekeep being exploited in the wild has been observed by security researcher and founder of Bluekeep, Kevin Beaumont. He noted on Twitter that his RDP Honeypots started to Blue Screen. The researcher passed his results over to another researcher, MalwareTech, who verified the telemetry to indeed be Bluekeep. The attack attempts to exploit a vulnerable server and download a Monero miner.

See the full report here: https://www.darkreading.com/attacks-breaches/first-bluekeep-exploit-found-in-the-wild/d/d-id/1336265

Targeted Ransomware Attacks Hit Several Spanish Companies

Everis, a large IT and consulting company based in Spain, suffered a ransomware attack today. The attack forced the company to shut down all of its computer systems until they resolve the issue. A Spanish security consultant told the news that the files being encrypted had an extension of .3v3r1s, indicating it might be a targeted attack.

See the full report here: https://thehackernews.com/2019/11/everis-spain-ransomware-attack.html

C2 With It All: From Ransomware To Carding

Cisco Talos has discovered a malware campaign targeting an American metal manufacturing company, as well as one other unspecified target. This campaign seeks to drop DopplePaymer ransomware on victims, and in once instance, TinyPOS. TinyPOS is point-of-sale malware that seeks to exfiltrate payment information from infected systems. Manufacturing companies are often targeted by attackers, as the systems they use are generally difficult to patch, leaving them vulnerable. Because these systems are used for critical processes, targeted organizations may be more likely to pay a ransom.

See the full report here: tag:blogger.com,1999:blog-1029833275466591797.post-5956203273363236574

MESSAGETAP: Whos Reading Your Text Messages?

Researchers at FireEye Mandiant have recently analyzed a new espionage tool used to spy on SMS messages, by targeting Linux Short Message Service Center servers. This kind of server is used to route SMS messages to the intended recipient. This malware limits which text messages are reported to the attacker, using keyword searches, phone numbers, and ISMI numbers. This level of selectivity indicates attackers with very specific espionage goals.

See the full report here: https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html

Nikkei hit by BEC scammers, loses $29 million

Japanese media company Nikkei has fallen victim to a BEC scam, costing the organization over $29 million. Although the company has not released many details, they have said that a US-based employee transferred these funds to a scammer who represented themself as a management executive. Authorities in both Hong Kong, where the scammer's account was located, as well as the United States, are currently investigating the situation.

See the full report here: https://www.helpnetsecurity.com/2019/11/05/nikkei-bec-scam/

Hackers Can Silently Control Your Google Home, Alexa, Siri With Laser Light

A new technique to exploit and control smart home devices like Alexa and the Google Home uses lasers, which the devices interpret as sound. Laser light can be manipulated to produce an acoustic pressure wave. When this manipulated light is shined at a smart device, even through a window, the microphone embedded in the device will interpret it as a voice command. This could be used to record audio near the device, open a smart garage door, or even unlock and smart a smart vehicle.

See the full report here: https://thehackernews.com/2019/11/hacking-voice-assistant-laser.html

Ransomware freezes govt IT in Canadian territory of Nunavut, drops citizens right Inuit

A new and sophisticated malware infection paralyzed the government's IT infrastructure in the Canadian territory of Nunavut on Saturday morning. While the government assures essential services will not be impacted, there might be a delay as they recover from the infection and get back online. Though not much information has been provided by the government post-attack, a CBC report disclosed the copy of a ransom note that appears to be identical to that of the Dridex malware's DoppelPaymer ransomware module.

See the full report here: https://www.theregister.co.uk/2019/11/04/ransomware_freezes_nunavut_canada/

Buran Ransomware; the Evolution of VegaLocker

A new strain of ransomware, called Buran, is being sold according to a ransomware as a service (RaaS) model. Advertised primarily on Russian cybercrime forums, key features of Buran include compatibility with all Windows versions, and 24/7 support from the seller. Pricing was not advertised, but appears to be customized according to each buyer's needs. Oddly, the ransomware checks any potential victim system to determine if it is in Russia, Belarus, or Ukraine. If this is the case, the files on the machine will not be encrypted.

See the full report here: https://securingtomorrow.mcafee.com/?p=97285

German Dridex spam campaign is unfashionably large

A new, unusually large Dridex campaign has been targeting German-speaking countries including Switzerland, Luxembourg, Liechtenstein, Germany, and Austria. The emails associated with this campaign contain malicious Excel attachments. These Excel files contain a highly obfuscated Powershell command within a VBA macro, which serves to download the final payload - the Dridex banking trojan.

See the full report here: https://www.virusbulletin.com/blog/2019/11/german-malspam-campaign-unfashionably-large/

Facebook admits to another data leak, saying that up to 100 developers accessed people's data from Groups

Following the April 2018 Cambridge Analytica scandal, Facebook restricted the amount and type of user data that could be accessed by third parties. Despite this policy change, however, Facebook has announced that at least 100 app developers still had access to user personal data. Facebook reports that there is no evidence of abuse of this information, and the developers have been asked to delete it. No further details regarding this breach have been released.

See the full report here: https://www.businessinsider.com/100-facebook-app-developers-may-have-had-access-to-private-groups-data-2019-11

Nemty Ransomware Now Spreads via Trik Botnet - BleepingComputer

Symantec researchers have come across a new variant of Nemty ransomware, which delivers Trik botnet via malicious spam campaigns. It generates a random list of IPs and attempts to connect to them on port 139, using a list of hardcoded credentials. Once the machine is connected, the malware leverages the SMB protocol to spread across the infected systems. This new variant has improved delivery mechanisms and better payload persistence.

See the full report here: https://www.bleepingcomputer.com/news/security/nemty-ransomware-now-spreads-via-trik-botnet/

New Megacortex Ransomware Changes Windows Passwords, Threatens to Publish Data - BleepingComputer

MegaCortex, ransomware that installs itself on the victim's machine through network access provided by trojans such as Emotet, is back with its latest version. This new version not only encrypts the victim's files but also modifies the user credentials and threatens to publish victim's files if they do not agree to pay the ransom. The ransomware uses .m3g4c0rtx as its extension and displays a message which reads Locked by MegaCortex on the compromised machine.

See the full report here: https://www.bleepingcomputer.com/news/security/new-megacortex-ransomware-changes-windows-passwords-threatens-to-publish-data/

Libarchive vulnerability can lead to code execution on Linux, FreeBSD, NetBSD

A new vulnerability, CVE-2019-18408, has been identified in Libarchive. Successful exploitation could allow attackers to execute code on user machines via malformed archive files. Linux systems including Debian, Ubuntu, Gentoo, Arch Linux, FreeBSD, and NetBSD are affected, however, macOS and Windows OS are not. A patch has been released for affected systems.

See the full report here: https://www.zdnet.com/article/libarchive-vulnerability-can-lead-to-code-execution-on-linux-freebsd-netbsd/

German housing giant fined 12.5m for GDPR violations

The German real estate company Deutsche Wohnen has been fined 14.5 million after investigations revealed it was improperly storing sensitive information without consent, violating GDPR. The company was initially warned about improper storage systems in 2017, and after no changes were made, the fine was administered.

See the full report here: https://www.itpro.co.uk/policy-legislation/34776/german-housing-giant-fined-125m-for-gdpr-violations

North Korean hackers allegedly targeted Indian space agency

The Indian Space Research Organization, National Cyber Coordination Centre, and other organizations associated with critical infrastructure like the Nuclear Power Corporation were infected with Dtrack malware in early September 2019. This infection spread via phishing emails, which were opened by agency employees. The DTrack RAT allows for data exfiltration and for arbitrary commands to be run on an infected system.

See the full report here: https://www.itpro.co.uk/security/34779/north-korean-hackers-allegedly-targeted-indian-space-agency

Amazon's Ring Video Doorbell Lets Attackers Steal Your Wi-Fi Password

A vulnerability has been discovered in the popular Ring video doorbell that would allow attackers to steal home WiFi passwords via a man-in-the-middle attack. Access to a home WiFi network could then allow attackers to interact with all devices connected to the compromised network, infiltrate and monitor all network activity, and access security footage on the Ring device. Amazon Ring claims that they have partially patched this issue, however, a complete fix is not available.

See the full report here: https://thehackernews.com/2019/11/ring-doorbell-wifi-password.html

Phishing attacks at highest level in three years

According to the Anti-Phishing Working Group, or APWG, phishing attacks have reached their highest levels in three years. There was a 46% increase in phishing attacks in Q2 of 2019 when compared to Q1 of 2019. Of them all, BEC, spear-phishing scams remained highly damaging, these attacks target employees who have access to an organization's financial or sensitive information.

See the full report here: https://www.helpnetsecurity.com/2019/11/07/phishing-attacks-levels-rise/

You've Been Served with Subpoena-Themed Phishing Emails

Predator the Thief, a publicly sold data stealer, is delivering subpoena-like emails in an attempt to spoof UK Ministry of Justice communications. The malware is sold as a package containing a builder and a C2 panel. After victims are successfully infected, information is harvested related to cryptocurrency wallets and system configuration. The malware self-terminates after data exfiltration, making it harder for forensic investigations to track it.

See the full report here: https://threatpost.com/youve-been-served-subpoena-themed-phishes/149963/