Weekly Threat Intelligence Bulletin - 11/15/2019 - 11/21-2019

Alpha Team Research: Black Friday Scams, Malware and Phishing, Oh My!

With Thanksgiving rapidly approaching, the holiday shopping season has begun to ramp up for consumers worldwide. Just like consumers, however, scammers are also prepping for holiday activities. In preparation for this annual barrage of holiday scams, Alpha Team has deployed the ZeroFOX platform to collect hundreds of thousands of posts, pages, domains, certificate transparency logs, websites and chatter related to Black Friday. Our goal in doing this warroom activity was to uncover how cybercriminals use holidays such as Black Friday in order to defraud, scam or attack internet users.

Recommendations

• Verify the URL of any site you may purchases from. Phishing and counterfeit goods sites often imitate the websites of legitimate brands in order to appear more credible
• Use caution when interacting with promotional sites, especially when asked to provide sensitive personal information. If a promotion sounds too good to be true, it probably is. Consider using a separate email for promotional entries

Details

Holiday Scammers on Social Target Brick and Mortar Stores in Droves

Between November 1 and November 20, 2019, ZeroFOX identified 61305 potential scams across 26 brands selected for this report. When broken out among these brands, we observed that the vast majority of these scams targeted customers of brick and mortar retail stores. Smaller percentages targeted electronics brands and online marketplaces. Only small fractions of a percent targeted luxury brands and jewelry brands.

Figure 1. Pie chart showing distribution of scams by vertical targeted

Scammers likely target brick and mortar retailers in such high quantities, because these kinds of scams will be attractive to a larger pool of consumers and thereby potential victims. Fewer consumers are in the market for luxury goods and high end jewelry than are shopping at large brick and mortar stores that appeal to multiple price points. Brick and mortar stores also carry a wide range of goods, from electronics to jewelry, versus stores that only sell one kind of good.

These kinds of scams generally offer victims "something for nothing," in the form of a giveaway, giftcards, or some kind of discount or coupon. Users are urged to input personal information, usually at minimum their email and physical address, to be entered to win a giveaway or giftcard, or to receive a coupon. Although these scams operate year-round, they also capitalize on gift-givers during the holiday season, exploiting the season to instill a sense of urgency in prospective victims. Of the retail scams we analyzed during this work:

• 11741 contained language related to gift-giving
• 4593 contained the word “holiday”
• 637 were specifically related to Black Friday or Cyber Monday
• 353 mentioned "Christmas" or "Thanksgiving"

Additionally, 554 scams took advantage of charitability, and included the word "donate."

In order to increase visibility, scammers often leverage hashtags in their posts, like #blackfriday, #cybermonday, and #giveaway. This makes these posts more likely to be shown to social media users, based on the social platform's algorithms, and also makes them searchable. Similarly, scammers may leverage fake accounts to like and share or retweet these scam posts, giving them more legitimacy.

Figure 2. Twitter giftcard scam, linking to malicious "giveaway" site

Above is one such example of a giftcard scam. Clicking the link in this post takes users to a poorly designed landing page, where several giveaways are advertised. Clicking through to one of these givaways redirects users to a phishing page, which requests a selection of personal information.

Figure 3. Samsung Galaxy S10 giveaway phishing page

Online Shopping and Electronics Lead The Pack in Suspicious Domains

If brick and mortar dominate scams on social and digital platforms, online shopping and electronics dominate suspicious domains. ZeroFOX Alpha Team found 124,000 domains that contain the brand name out of the list of 26 selected for this report. The team filtered the 124,000 domains by Certificate Issuer for legitimate domains and found that Apple, Amazon and Target are the top impersonated domains within the bunch:

Figure 4. Pie Chart for Abused Brands filtered by Issuer in Certificate Transparency Log

Many of these domains contain keywords that indicate it could be used for phishing or abuse. This is generally combined with a call to action, especially with phishing attacks, to trick the user that they must login or verify their account to continue.

Figure 5. Pie Chart for Top Suspicious Words

Since these domains were retrieved from the certificate transparency log, the probability of them serving content is higher than a registered or parked domain, due to generating a TLS certificate is an additional step when setting up attack infrastructure. Alpha Team performed a hunt on small sample the associated list and found phishing websites, giveaway scams, coupon scams and even some suspicious chrome extensions.

Figure 6. iPhone Giveaway Scam

Figure 7. Impersonating domain for Walmart, leading users to install a potentially unwanted/malicious Chrome extension

In the case of Figure 7, the Chrome extension had over 60,000 installs and dozens of negative reviews complaining about data theft, malware, and one person even saying they were extorted by the developer:

Figure 8. User reporting malicious behavior done by extension and the developer themselves.

Conclusion

Cybercriminals are opportunistic, and capitalize on anything they can in order to improve their odds of profiting off a scam. Social media scams, as well as malicious domains, are two attack vectors ZeroFOX has observed spiking in use as the holiday season approaches. To best protect yourself against these kinds of scams, ZeroFOX recommends exercising a level of caution whenever you consider giving away valuable personal information for promotions or giveaways. Legitimate giveaways rarely ask for anything more than an email address. A promotion requesting anything further is likely a scam. Additionally, as you make online purchases this holiday season, be sure to verify that the domain you are making a purchase from, is the one you intend to interact with. Attackers often mimic reputable brands to peddle their own scams and phishing sites.

Methodology

The Alpha Team seeded a ZeroFOX platform deployment with top retail brands, from a variety of different verticals, in order to uncover chatter and malicious traffic that could be related to Black Friday. Within 1 week, the platform analyzed 600,000 posts, pages, accounts and blogs, and 90,000 of those pieces of content where suspicious and alerted in our platform. The team also reviewed 1 months worth of Certificate Transparency log data (approximately 22,000,000 logs) in order to study how scam infrastructure is being deployed and abused by fraudsters in order to target victims.

Breach Disclosure: Gatehub

Gatehub, a cryptocurrency wallet service, suffered a data breach of 1.4 million accounts. According to an article by ArsTechnica, the full contents of the database were leaked online, including two-factor keys, mnemonic phrases and wallet hashes. ArsTechnica reached out to Gatehub to confirm the full extent of the breach, and the company refuted that the keys, phrases and wallet hashes were leaked. The full contents include email addresses, mnemonic phrases, wallet hashes and bcrypt password hashes were leaked.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Raidforums user Troy Hunt (previously Jnx3cx) posted this breach on October 25, 2019. It is worth noting that Troy Hunt is most likely a troll account.

The RaidForums administrator, Omnipotent, then moved this to the Official subforum on November 2, 2019.

Breach Disclosure: EpicBot

EpicBot, a bot provider for the popular online role playing game RuneScape, suffered a data breach. According to an article by ArsTechnica, the full contents of the database were leaked online, and contained 817,000 rows of breach data. The data includes email addresses, IP addresses, usernames and either salted md5 or bcrypt password hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Raidforums user DonJuji posted a download link to the dump on October 25, 2019.

The stats in the post match the description in the ArsTechnica article.

Breach Disclosure: GPS Underground

On or around summer 2016, vBulletin forum dedicated to GPS discussion, GPSUnderground, was breached. The forum allegedly ran vBulletin software that was susceptible to a number of vulnerabilities which caused it's breach. The breach specifically contained 670,000 rows of data with email addresses, usernames, dates of birth and salted md5 passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2019-11-15 - 2019-11-21

Officials warn about the dangers of using public USB charging stations

People are advised to avoid using public USB power charging stations because they may contain dangerous malware. USB connections used to transfer electrical power can deliver secret data payloads. In the past, proof-of-concept for Juice Jacking which can transfer malware to the device and Video Jacking which can mirror the user's screen, has been observed. It is recommended to use AC power outlets, car chargers, and portable charges instead of potentially vulnerable USB charging stations.

See the full report here: https://www.zdnet.com/article/officials-warn-about-the-dangers-of-using-public-usb-charging-stations/

Stealthy new Android malware poses as ad blocker, serves up ads instead

Android/Trojan.FakeAdsBlock, a new Trojan malware for android is on the rise. The malware masquerades as an ad blocker while serving up a host of advertisements. On successful installation of the disguised ad blocker, users are asked to connect to a VPN. When the user clicks "Okay", instead of setting up a VPN, the user has actually granted the malware the ability to run in the background which allows the infection to spread and leaves the machine compromised. As of now, it is not known where the malware is coming from but most likely, users are downloading it from third-party app stores in the hunt for an ad blocker that's legit.

See the full report here: https://blog.malwarebytes.com/android/2019/11/stealthy-new-android-malware-poses-as-ad-blocker-serves-up-ads-instead/

Silly Phishing Scam Warns That Your Password Will be Changed - BleepingComputer

A silly phishing scam has been discovered wherein the phishing email prominently displays a button with the title “Keep same password”. The phishing email states that password expires today and asks the victim to click on the button in order to keep the same password. When the victim clicks on the button, they will be redirected to a page where they are asked to login to the mail server. Once logged in, the attacker gains login credentials of the victim. Furthermore, these harvested credentials can be used by the attackers in BEC scams or to take over other email accounts under the same email address.

See the full report here: https://www.bleepingcomputer.com/news/security/silly-phishing-scam-warns-that-your-password-will-be-changed/

Google patches ‘awesome’ XSS vulnerability in Gmail dynamic email feature

Security researchers at Securitum have discovered a security flaw in AMP4Email, a feature in Gmail. AMP4Email has a validation system that restricts access to elements and attributes in HTML and is designed to help prevent XSS attacks. There are certain tags and attributes which are whitelisted and can be leveraged to perform DOM clobbering. DOM clobbering occurs when an element is given a name that is also a function on the DOM. Due to legacy compatibility of the DOM, elements can be accessed by window.name which clobbers the original DOM content with user controlled content, thus side-stepping DOM sanitization. The vulnerability was reported as a part of Google Vulnerability Reward Program and has been patched.

See the full report here: https://www.zdnet.com/article/google-patches-awesome-xss-vulnerability-in-gmail/

Thousands of hacked Disney+ accounts are already for sale on hacking forums

Within an hour of Disney+ launching, hackers were successful in hijacking Disney+ user accounts. Hijacked accounts were offered for free on hacking forums or were sold for $3 to $11. Disney+ was launched in November 12, 2019 and the service is available only in the US, Canada, and the Netherlands. During the launch, Disney+ encountered technical issues and many users have reported that they were unable to stream their favorite movies and shows. Also, a small set of users complained about access to the service, stating they have lost access to their account, and their account's email and password were changed. These stolen credentials were later found for sale. As a best practice, passwords should be unique on a per service basis and should be difficult to guess or brute force.

See the full report here: https://www.zdnet.com/article/thousands-of-hacked-disney-accounts-are-already-for-sale-on-hacking-forums/

Extensive personal health information exposed in Solara Medical data breach | SC Media - SC Magazine

Solara Medical Services was hit in a data breach, allowing attackers to gain customers' personal information. Many employees fell prey to a phishing scam giving unauthorized access to their Office 365 accounts. The compromised information includes name, address, social security number, employee identification number, medical information, financial information and passport information of the employees and customers. The number of victims to this breach is not known. Affected accounts' passwords' have been reset by Solara and its cybersecurity policies are under review.

See the full report here: https://www.scmagazine.com/home/security-news/data-breach/extensive-personal-health-information-exposed-in-solara-medical-data-breach/

New NextCry Ransomware Encrypts Data on NextCloud Linux Servers - BleepingComputer

NextCry, a new ransomware, has been found in the wild and can encrypt data on NextCloud Linux Servers. The malware is currently not detected by antivirus engines on public scanning platforms. The malware consists of a Python script compiled in a Linux ELF binary using pyInstaller. A ransom note in a file named “READ_FOR_DECRYPT” is displayed on the machine indicating that the files have been encrypted. NextCloud released an urgent alert in the last week of October about a remote execution vulnerability tracked as CVE-2019-11043 that impacts the default Nextcloud NGINX configuration. Administrators are advised to upgrade their PHP packages and NGINX configuration file to the latest version.

See the full report here: https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/

Ransomware hits Louisiana state government systems

The Louisiana state government was hit by a ransomware attack. The Office of Technology Services has identified the threat and taken measures to prevent propagation of infection. Impacted services include public state government websites, email servers and internal applications. At the time of reporting, most of the services were back online.

See the full report here: https://www.zdnet.com/article/ransomware-hits-louisiana-state-government-systems/

Buran Ransomware Infects PCs via Microsoft Excel Web Queries - BleepingComputer

Recently, an independent security researcher has discovered a spam campaign that distributes Buran ransomware through Microsoft Excel Web Query (IQY) attachments. Users are targeted using spam emails that instruct them to "Print the document in attach" [sic]. Once opened, the attached IQY file executes a PowerShell script to install Buran ransomware. The ransomware encrypts files on the infected system and leaves a ransom note in each folder. Users are advised to block all Excel Web Queries to prevent such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/buran-ransomware-infects-pcs-via-microsoft-excel-web-queries/

WhatsApp Remote Code Execution Triggered by Videos

Facebook patched a vulnerability in their popular WhatsApp messaging platform. The vulnerability can trigger a remote code execution if a specially crafted MP4 file is sent to a victim. A Facebook spokesperson said there is no evidence of the vulnerability being exploited in the wild.

See the full report here: https://threatpost.com/whatsapp-remote-code-execution-videos/150360/

Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites

A new JavaScript skimmer called “Pipka” has been found on popular E-Commerce websites which attempts to steal visitor’s payment data. Pipka was first detected on the North American merchant website and since then discovered on other sixteen popular E-Commerce websites. Unlike the other skimmers, Pipka comes with detection evade technique, that it removes itself from the compromised website’s HTML code after exfiltrating the payment data. Pipka was injected into the E-Commerce website and whenever the visitor visits the compromised website, it then extracts data entered on the site including payment-card information such as payment account number, expiration date, three-digit Card Verification Value (CVV) and the cardholder’s name and address. The skimmer uses ROT13 cipher to encrypt the stolen data before sending it to attackers C&C server. In addition, it also checks for uniqueness of data to avoid duplicate entries.

See the full report here: https://threatpost.com/pipka-card-skimmer-removes-itself-after-infecting-ecommerce-sites/150341/

Official Monero Site Hacked to Distribute Cryptocurrency Stealing Malware

The official site of Monero cryptocurrency was hacked and the original binaries of Windows and Linux systems were replaced with malicious versions. It was found that the modified binaries injected functions in the software that executed after a user opened or created a new wallet. The functions allowed the remote attacker-controlled servers to steal wallet seeds and transfer funds from them. Users are strongly advised to check the hashes of their binaries for the Monero CLI software and delete the files if they don't match the official ones.

See the full report here: https://thehackernews.com/2019/11/hacking-monero-cryptocurrency.html

1.19 billion confidential medical images available on the internet

Greenbone's researchers have identified approximately 1.19 billion medical images available publicly on the internet. The confidential images belong to Picture Archiving and Communication Systems (PACS) servers that are used by health providers across the world to store images of X-rays as well as CT, MRI and other medical scans. The affected countries include US, India, South Africa, Brazil, and Ecuador. Countries are advised to remove all accessible data from the internet.

See the full report here: https://www.helpnetsecurity.com/2019/11/20/confidential-medical-images/

New Flaw Lets Rogue Android Apps Access Camera Without Permission

A new vulnerability tracked as CVE-2019-2234 has been discovered in Android smartphones manufactured by Google and Samsung. This vulnerability could allow attackers to take photos, record videos, eavesdrop on conversations, and track location without specific permissions. A malicious app abusing this vulnerability can simply requiring access to device storage and manipulates specific actions to trick camera apps to perform actions on behalf of the attacker. Users are advised to update to the latest camera app version on their android smartphones.

See the full report here: https://thehackernews.com/2019/11/android-camera-hacking.html

Hackers breached Macy's website and hijacked customers' payment info - The Next Web

Macy’s, a popular US department store chain, has revealed that its online storefront "macys.com" was infected with a credit card skimmer in an attempt to steal customers’ payment information. The attackers were able to gain control over victims detailed personal information, including the customer’s full name and address, phone number, email address, payment card number, payment card security code, and payment card month/year of expiration. Macy's claim that only a small number of users were impacted and offered its victims with one year of free credit monitoring as a corrective measure.

See the full report here: https://thenextweb.com/security/2019/11/19/hackers-breached-macys-website-and-hijacked-customers-payment-info/

Linux Webmin Servers Being Attacked by New P2P Roboto Botnet - BleepingComputer

Security researchers have discovered a new peer-to-peer botnet dubbed “Roboto” that targets Linux servers running vulnerable Webmin installations. The Webmin vulnerability is tracked as CVE-2019-15107, and can result in a remote code execution. Roboto comes with the unique internal structure, that bots are organized in peer-to-peer network and most of them are zombies, which relays commands received from C&C server to each other or works as scanner to search other vulnerable Webmin systems.

See the full report here: https://www.bleepingcomputer.com/news/security/linux-webmin-servers-being-attacked-by-new-p2p-roboto-botnet/

Microsoft rebukes rumors that Microsoft Teams is being used in ransomware attacks

Microsoft went on the record to deny rumors that Microsoft Teams was being used in attacks related to the Doppelpaymer ransomware. Simon Pope, Director of Microsoft Security Response Center, said that his team found no evidence of Microsoft teams being used, and that the ransomware was being remotely administered via tried-and-true Domain Administrator credential compromise.

See the full report here: https://www.zdnet.com/article/microsoft-rebukes-rumors-that-microsoft-teams-is-being-used-in-ransomware-attacks/

US student was allegedly building a custom Gentoo Linux distro for ISIS

Authorities have charged a US student in providing material support for ISIS. The student was creating a number of automated scripts and hardening tools to distribute a custom Gentoo Linux distro. Undercover agents communicated with the student, whose goal was to create a "secure" version of this distro, to prevent intelligence agencies and law enforcement from accessing it.

See the full report here: https://www.zdnet.com/article/us-student-was-allegedly-building-a-custom-gentoo-linux-distro-for-isis/