Threat Intelligence Bulletin: 12/06/2019 - 12/12/2019

Hijalyh Phishing Kit Targets Apple Customers

The Hijalyh Phishing Kit has been available to the scam community since 2018, and targets Apple and Amazon customers. Although early versions of the kit were rudimentary and easily identified as scams, recent kit development has made the scam pages much more believable. ZeroFOX Alpha Team has obtained copies of the Apple version of the kit and has analyzed the kit for this blog post.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

The Hijalyh, also known as Hijayah, Hijalyh:Re, and Hijalyh Reborn, phishing kit targets Apple and Amazon customers, and has been on the phishing-as-a-service scene since 2018. Kit administration is done on a central domain, hijaiyh[.]me. Recently, the developer of Hijalyh has partnered with both antipot[.]pw, allowing phishing kit users to better block researchers from accessing and blocking their scams, as well as KuzuluyArt, another phishing kit group that targets PayPal. ZeroFOX Alpha Team has obtained and analyzed multiple versions of the Hijayah kits targeting Apple customers.

Figure 1. Landing page of kit admin site, advertising new partnerships

Features and language support

The kit offers antibot and anti-analysis capabilities and blocks a number of IP ranges associated with security research organizations. It also blocks AWS IPs, used by many research teams to access these sites without compromising their organization’s environment, as well as specific User-Agents and hostnames.

Initially, in versions 1 and 2, Hijalyh offered only English, Japanese, and Indonesian language support, however, in the most recent version (4.1, released late November 2019), this has expanded to include support for Spanish, German, French, Dutch, Thai, and Chinese.

Figure 2. Kit landing page of the Indonesian version

Hijalyh requests that potential victims submit identifying information in order to verify their identity so that they can reclaim their Apple ID. The requested information is tailored according to the location of the visitor of the phishing site - for example, US visitors are asked for Social Security numbers, while visitors from Canada are asked for a Social Insurance Number. Requested information includes the identifying number used by the victim’s local government, a selfie photo of the victim holding an ID card, images of the front and back of an ID card, and credit card information.

Kit pricing and sales

Early versions of the kit were sold for $30, however, the recent improvements to the kit have been used to justify selling the kit at a higher price. Currently, the kit is sold for $90. This includes updates to the kit, as well as support and the ability to request features. This kind of customer service offering has become common for phishing kits, as the market has become more saturated with offerings.

Figure 3. Membership requirements and offerings

Conclusion

Recent improvements to the Hijalyh phishing kits have made them much more sophisticated than the early versions of the kit. As we’ve seen with other phishing kit offerings, the trend of scammers requesting selfies of victims is present here as well. Phishing continues to be a popular attack vector given its high level of reward for minimal effort, and the increasing availability of ready-to-go phishing kits lowers the barrier to entry so drastically that it is basically non-existent. Because of this, the pool of would-be attackers is even greater than it has been in the past, and it is likely that we will continue to see a surge in attacks leveraging these kits.

Breaking News: 2019-12-06 - 2019-12-12

North Korean hackers may be behind malware distributed by cryptocurrrency trading platform - The Next Web

The North Korean Lazarus group is targeting cryptocurrency traders new strain of malware targeting macOS users. The malware, called 'UnionCryptoTrader.dmg,' runs a script to achieve persistence upon download and execution, exfiltrates system information for the attacker, and also has the cabability to download and execute additonal payloads.

See the full report here: https://thenextweb.com/hardfork/2019/12/04/cryptocurrency-trading-platform-macos-malware-lazarus-north-korea/

Atlassian scrambles to fix zero-day security hole accidentally disclosed on Twitter

An independent security researcher has accidentally disclosed a zero-day vulnerability in Atlassian on Twitter.. The vulnerability, identified as CVE-2019-15006, occurs because an Atlassian domain uses a common SSL certificate to connect to Conflunece cloud service. An attacker can leverage this to conduct man-in-the middle attack and redirect traffic to a malicious site. Atlassian has confirmed the flaw and is currently working to resolve it, however, at present, no fix is available.

See the full report here: https://www.theregister.co.uk/2019/12/05/atlassian_zero_day_bug/

Scammy and spammy harassers are chasing veteran pros off crypto-collab platform Keybase

Keybase, a multi-platform secure messaging and meeting service, has recently become overwhelmed with bad actors and scammers who are bombarding the platform with unwanted messages users have no way of disabling. Keybase has teamed up with cryptocurrency Stellar to begin a series of free "drops" where coins are distributed into users' wallets. This attracted an influx of new users solely interested in cashing in on the currency. These users can then connect with and message anyone else on the site, or add them to a group chat. Keybase has said that it is working on a new interface with more controls for users, including the ability to block and report users directly to an administrator.

See the full report here: https://www.theregister.co.uk/2019/12/05/keybase_struggles_with_harassment/

New Linux Vulnerability Lets Attackers Hijack VPN Connections - BleepingComputer

Researchers have discovered a new Linux vulnerability that allows potential attackers to hijack VPN connections on affected *NIX devices and inject arbitrary data payloads into IPv4 and IPv6 TCP streams. Tracked as CVE-2019-14899, this vulnerability is known to impact most Linux distributions and Unix-like operating systems including FreeBSD, OpenBSD, macOS, iOS, and Android. This security flaw allows a network-adjacent attacker to determine if another user is connected to a VPN, the virtual IP address they have been assigned by the VPN server, and whether or not there is an active connection to a given website. Attacks exploiting CVE-2019-14899 work against OpenVPN, WireGuard, and IKEv2/IPSec. Users are advised to turn reverse path filtering on, by using bogon filtering —filtering bogus (fake) IP addresses — or with the help of encrypted packet size and timing.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-vulnerability-lets-attackers-hijack-vpn-connections/

Reddit Says Influence Campaign is Behind Leaked U.S.-U.K. Trade Documents

Social-media platform Reddit has reported a vote-manipulation campaign involving leaked US/UK trade documents tied to Russian operatives. This manipulation campaign first appeared on Facebook earlier this year. A post was made on Reddit, containing leaked documents from the UK. The account that posted the documents, as well as connected accounts, originated in Russia. 61 user accounts and a sub-Reddit were banned in connection with this investigation.

See the full report here: https://threatpost.com/reddit-says-influence-campaign-is-behind-leaked-u-s-u-k-trade-documents/150912/

Fake Elder Scrolls Online developers go phishing on PlayStation

A new phishing campaign is targeting Elder Scrolls Online players via Playstation direct messaging. These scammers pose as game developers, and send their targets messages regarding supposed suspicious activity on their accounts. The scammers claim that users must submit their email, password, and birthday within 15 minutes of receiving the message in order to verify the account and avoid being banned. This false sense of urgency and deadline is commonly used by attackers in order to pressure victims into submitting personal information without questioning the legitimacy of the message.

See the full report here: https://blog.malwarebytes.com/social-engineering/2019/12/fake-elder-scrolls-online-developers-go-phishing-on-playstation/

Ad network ransomware crook to flog £5k Rolex after court confiscates £270k in ill-gotten gains

Zain Qaiser, a member of a gang that distributed ransomware using the Angler exploit kit and pornographic ads, has been sentenced to six and a half years in prison and fined 270,000 British pounds. These ads locked victim's browsers and demanded a ransom be paid in order to restore functionality to the device. Although the ad network blacklisted these ads when the realized their true intent, Zain Qaiser is estimated to have made over 700,000 pounds in ransoms extorted from victims.

See the full report here: https://www.theregister.co.uk/2019/12/09/zain_qaiser_confiscation_order_270k/

NVIDIA Patches Severe Flaws in Mercedes Infotainment System Chips - BleepingComputer

Six high-severity vulnerabilities have recently been patched in the Tegra Linux Driver Package used by chips in Mercedes-Benze's infotainment system, as well as Bosch self-driving systems, and the Nintendo Switch gaming console. Two of these vulnerabilities, all of which require local access, would allow attackers to gain code execution on a vulnerable system. The other four would allow for a denial of service or escalation of privileges. A patch is available for all of these issues.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-patches-severe-flaws-in-mercedes-infotainment-system-chips/

Clever Microsoft Phishing Scam Creates a Local Login Form - BleepingComputer

Recent phishing campaigns have shifted from redirecting potential victims to scam sites, to bundling the landing page HTML into an email attachment. When would-be victims open this attachment, they see a standard phishing login page for the spoofed site in question, along with a message that they must log in to view the document. While the victim completes the login process, information is transmitted in the background to the attackers, via malicious javascript. Current campaigns utilizing this technique are phishing for email credentials to numerous platforms including Office 365, Yahoo, Hotmail, and Gmail.

See the full report here: https://www.bleepingcomputer.com/news/security/clever-microsoft-phishing-scam-creates-a-local-login-form/

DHS Rolls Back Facial-Recognition Expansion Plan

The US Department of Homeland security has rolled back a plan to use facial-recognition technology on all US citizen travelers after meeting with privacy experts. US citizens will now be permitted to opt-out of the facial recognition process by presenting their passport as is presently standard at point of entry.

See the full report here: https://threatpost.com/dhs-rolls-back-facial-recognition-expansion-plan/150951/

3,000 Fort Worth water customers affected by data breach - FOX 4 Dallas

A breach of the payment system of the Fort Worth Water Department, in Texas, has exposed the personal information of nearly 3,000 customers. Breached information includes victim names, billing addresses, credit card numbers, and card security codes. Victims have been notified via letter. According to a spokesperson for the department, “an unauthorized part inserted unauthorized code into Fort worth’s online payment system,” ultimately resulting in the breach. CentralSquare, developer of the Click2Gov software compromised in this case, is offering a year of free credit monitoring to those affected.

See the full report here: https://www.fox4news.com/news/3000-fort-worth-water-customers-affected-by-data-breach

Ryuk Ransomware Decryptor Is Broken, Could Lead to Data Loss - BleepingComputer

Changes to the Ryuk ransomware encryption algorithm have created issues with the decryptor, which could lead to massive data loss. Ryuk was recently modified so that it does not encrypt the entire file if it is larger than 57,000,000 bytes or 54.4 megabytes. This is done to prevent the encryption process from taking too long, which could allow victims to more readily detect that the ransomware was running. As a result, the decryptor is not properly calculating the size of the footer in large files due to the variable nature of the block count. This causes the decryptor to truncate certain files before the last byte, which results in them being improperly decrypted even if the ransom is paid.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-decryptor-is-broken-could-lead-to-data-loss/

Pensacola, Florida Hit by Cyber Attack, City Services Impacted - BleepingComputer

The city of Pensacola is struggling to recover from a cyberattack that hit its computer network. It is unclear what specifically is causing the issues but the online payment systems at Pensacola Energy and for city sanitation are among the impacted services. Computer-based communication, including email, is also down but 911 and other emergency services (police and fire departments) remained unaffected. As a preventive measure, most of the systems are currently offline and investigators are trying to determine if data was exposed in the attack. Currently, there is no clear estimate of when the problem will be fully resolved.

See the full report here: https://www.bleepingcomputer.com/news/security/pensacola-florida-hit-by-cyber-attack-city-services-impacted/

Snatch Ransomware Reboots to Windows Safe Mode to Bypass AV Tools - BleepingComputer

Researchers have discovered a new Windows Snatch ransomware strain that reboots infected computers into Safe Mode in order to bypass security measures. It does so by installing itself as a Windows service called SuperBackupMan and forcibly restarting the compromised machine. Following this, the victims' files are encrypted and all volume shadow copies on the system are deleted to prevent forensic recovery and, making recovery without payment impossible. To avoid infection, companies are advised to avoid exposing RDP services to the Internet and to use multifactor authentication.

See the full report here: https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/

This Advanced Keylogger Delivers a Cryptocurrency Miner

Recent Hawkeye campaigns are dropping a cryptocurrency miner, called CGMiner. Hawkeye is a keylogger that has been sold on forums since 2013. The attackers behind this campaign have modified the file installation feature, which is normally used to establish persistence, in order to drop and execute the miner. The initial malware is distributed via crafted emails, which attempt to convince the recipient that a malicious Hawkeye attachment is a resume for a job posting.

See the full report here: https://cofense.com/advanced-keylogger-delivers-cryptocurrency-miner/

Data breach affects Desjardins' 1.8 million credit cardholders - Verdict

Following the data breach announced in June 2019, the Canadian Desjardins Group has announced that the personal information of nearly 1.8 million credit cardholders were compromised in addition to the originally announced 4.2 million banking customers. Evidence suggests that this was the work of a malicious insider, and that a Desjardins employee leaked this information. The Group is offering an identity protection program to affected parties.

See the full report here: https://www.verdict.co.uk/cards-international/news/data-breach-desjardins-credit-cardholders/

Windows, Chrome Zero-Days Chained in Operation WizardOpium Attacks - BleepingComputer

Two zero-day vulnerabilities in Google Chrome and Microsoft Windows, tracked as CVE-2019-13720 and CVE-2019-1458, are actively being exploited to drop malware onto Windows machines that visited a Korean-language news portal. The attackers injected a JavaScript tag into this site that executed malicious scripts in the visitor's browser. These scripts exploited a zero-day in Google Chrome, ultimately allowing the attackers to compromise Windows systems. The initial malware then dropped further payloads onto the affected machine. Both of these vulnerabilities have since been patched.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-chrome-zero-days-chained-in-operation-wizardopium-attacks/

Hundreds of counterfeit online shoe stores injected with credit card skimmer

Magecart has turned its sights to counterfeit high-end shoe sites and has injected card skimming code into hundreds of fraudulent sites. Unfortunate customers of these counterfeit sites had credit card numbers and billing addresses exposed and exfiltrated to a server in China. Shoppers are advised to update their machines with the latest patches, and to monitor bank/credit card statements regularly and report any fraudulent activity.

See the full report here: https://blog.malwarebytes.com/?p=41511

455,000 Turkish card details put up for sale, web skimmers suspected

More than 455,000 Turkish payment card details are currently being sold online on Joker's Stash. The leaked data included expiration date, CVV/CVC, cardholder name as well as some additional info such as email, name and phone number. Though the source of this compromise remains unknown, experts believe that the data could have come from JavaScript-based skimmers that stole the data as the user entered it on a hacked online store. Turkish local authorities have been notified about the card dump so they can take appropriate measures.

See the full report here: https://www.zdnet.com/article/455000-turkish-card-details-put-up-for-sale-web-skimmers-suspected/

Apple Fixes ‘AirDoS’ Bug That Cripples Nearby iPhones, iPads

Apple has released a patch for a bug that allows attackers to crash iPhones and iPads using the AirDrop feature. Exploitation of this vulnerability would block the user interface and cause an AirDop notification to pop up repeatedly, forcing the user to chose to accept or decline, indefinitely until the device crashes. Users are advised to patch as soon as possible.

See the full report here: https://threatpost.com/airdos-bug-cripples-nearby-iphones/151030/

Beware of bad Santas this Xmas: Piles of insecure smart toys fill retailers' shelves

Children could be at risk due to security flaws in smart toys like children’s karaoke and walkie-talkie toys this holiday season. According to a U.K. consumer advice organization, toys purchased from major retailers could potentially allow strangers to interact with children. One of the most serious issues with these toys was the lack of any authentication, such as a PIN code, for Bluetooth connectivity. This could allow anyone to connect to the toy, and capture data or interact with children. Experts advise parents to be extremely cautious while purchasing smart toys that do not meet minimum standards.

See the full report here: https://www.theregister.co.uk/2019/12/11/top_toys_still_toppled_by_security_testing/

Bad news: KeyWe Smart Lock is easily bypassed and can't be fixed

Improperly designed communications protocols in the KeyWe Smart Lock could allow an attacker to unlock the device. This device is primarily used in private dwellings, and allows users to unlock the door with either a physical key, via a mobile app, or with Amazon Alexa. This vulnerability can be exploited by attackers to steal door passcodes, which can be used to unlock the device. To make matters worse, the device's firmware cannot be upgraded either locally or remotely, making it rather impossible to remediate the issue. Users of these locks are urged to replace them immediately.

See the full report here: https://www.theregister.co.uk/2019/12/11/f_secure_keywe/

Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom Demand - BleepingComputer

The operators of Maze Ransomware claim that they are responsible for encrypting the City of Pensacola, Florida's data and are demanding a ransom of $1,000,000. The attackers have shared documents that were allegedly stolen from the city as proof, but have no given a deadline to the city regarding public release of the stolen files. City officials have declined to release a statement due to the ongoing investigation but assure they are trying to restore online services as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/

Illinois hospital warns 1,400 patients of data breach - Becker's Hospital Review

Illinois-based Katherine Shaw Bethea Hospital was hit in a data breach, allowing attackers to gain around 1400 patients' personal information. Attackers are believed to have gained entry by compromising an employee's email account. Exposed information includes names, dates of birth, phone numbers, health insurance carrier names, diagnoses, and clinical information. The hospital claims that there is no evidence of misuse of the exposed data. Katherine Shaw Bethea Hospital has assured patients they will be implementing additional security measures to avoid future security

See the full report here: https://www.beckershospitalreview.com/cybersecurity/illinois-hospital-warns-1-400-patients-of-data-breach.html