Threat Intelligence Bulletin: 12/13/2019 - 12/19/2019

Piledriving Domain Takedowns in 2019

In 2019, ZeroFOX successfully took down thousands of domains hosting malicious content or otherwise impersonating our customers. This post seeks to take a closer look at these takedowns, and identify trends we observed in 2019.

Recommendations

• Consider enabling ZeroFOX domain security rules for keywords related to your brand, in order to detect imposter domains. Reach out to [email protected] for assistance if needed
• Consider purchasing domains other than the ones your organization actively uses for domains, and redirecting visitors to the legitimate site. This prevents attackers from registering and using these similar domains for malicious purposes

Details

Anatomy of a domain-based attack

Just as attackers impersonate high-profile social media accounts to take advantage of an existing following, attackers also impersonate legitimate organizations in domain names. These impersonating domains are often used to conduct phishing attacks, host malware, execute a scam or steal ad revenue from the victim organization. A user who clicks this link, likely disguised in a targeted email or social media post, may not realize that it is not associated with the legitimate organization. This means that users are much more likely to enter their personal information into scam pages or download malicious files from the site in question.

Domain takedown breakdown

Of the domain takedowns conducted by ZeroFOX for our customers in 2019, the top 5 registrars of these domains are:

1. GoDaddy
2. NameCheap
3. Public Domain Registry
4. Cloudflare
5. NameSilo

Each of these registrars makes the registration process quick and straightforward, which is just as ideal for threat actor use as it is for a non-malicious user. A buyer can search for a domain of interest, and site algorithms will suggest related domains, as well as cheaper domains. Domain names are relatively inexpensive, and often, discounts are offered for the first year’s registration. There are also minimal restrictions on new domain names. Registrars also do not prevent trademark infringement in any way. This burden is on the trademark owner, who would be required to submit a dispute to ICANN to resolve the issue. All of these factors make it painless for bad actors to register malicious domains, like the example below.

Figure 1. Sample pricing for a potential Apple phishing kit using various TLDs on GoDaddy

Analyzing WHOIS information for 2019 takedown domains illuminates a few interesting trends. The top email domains for registrant contact email are:

1. Whoisguard
2. Domainsbyproxy
3. Gmail

With increased legislation surrounding digital privacy, much WHOIS information, which can be thought of like a phone book for domain ownership, is now redacted. GPDR, which took effect in May 2018, spurred many registrars to make domain registrant information private by default. Additionally, many registrars now offer privacy protection services in addition to domain registration - for example, GoDaddy owns Domains by Proxy and NameCheap owns WhoisGuard. These services can even be bundled together with domain registration during the initial purchase of the domain name. Because WHOIS data is public and can be searched by anyone, this is highly advantageous to bad actors, as it makes redacting personal information automatic. When these privacy services are used, it replaces registrant contact information with anonymized contact information that can be used to contact the registrant.

However, Gmail is the email domain seen third-most-often - and neither Gmail nor Google offers privacy protection services. This suggests threat actors are either using personal email to register malicious domains, or that they are using Gmail in order to register throwaway emails associated with these domains. While unsophisticated actors may be sloppy enough to use a personal email to register a malicious domain, it is much more likely that these Gmail addresses are throwaway emails.

Concealing sensitive identifying information, also known as operational security, is a forefront concern for threat actors. Although improvements in digital privacy benefit the average Internet user greatly, they also allow threat actors to better cover their tracks.

Industry breakdown

The domains ZeroFOX took down in 2019 targeted customers across a variety of industries. The majority of our domain takedowns in the last year were within the Consumer Goods industry. Telecommunications, Banking and Finance, Entertainment, and Services round out the top five industries. In total, 117 organizations across 17 industries were targeted by threat actors.

Figure 2. Full breakdown of 2019 domain takedowns by industry

Most of these domains attempted to impersonate the legitimate organization in some way. Often, attackers do this by mutating the legitimate domain name of an organization, and registering this mutated domain. Some of mutation methods we observed were:

• Adhering “123-” to the beginning of the brand name
• Replacing an “L” with an “I” or a “1”
• Registering unused TLDs - for example brand.fr and brand.ca if brand.com is the legitimate domain
• Adding keywords like “support,” “help,” and “customer-service” to the targeted organization’s name

Each of these methods seeks to make a domain seem legitimate so that an unsuspecting user will not realize they have navigated to a malicious domain.

Conclusion

Domains are an attractive attack vector to attackers, who are drawn to the low-barrier of entry, affordability, and ease of scale. Malicious domains are used to impersonate legitimate brands, host phishing pages, and even host malware. Only by proactively monitoring their domains can organizations keep ahead of this threat into 2020.

Breach Disclosure: Zynga

In September 2019, game developer Zynga suffered a data breach. A report from HackerNews claims that data breach villain gnosticplayers was responsible for the breach. 218 million rows were downloaded, with the following column data: names, emails, logins, SHA1 hashed and salted passwords, password reset tokens, phone numbers, Facebook IDs and Zynga account IDs.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

According to a September 12, 2019 post by Zynga, no financial data was accessed. The company engaged leading third-party forensics firms and are working with law enforcement. Players of two of Zynga's games, Draw Something and Words with Friends, were included in the breach.

Breaking News: 2019-12-13 - 2019-12-19

Smart Krampus-3PC Malware Targets iPhone Users

More than 100 publisher websites, including online newspaper and international weekly news magazines, were compromised via malicious ads to serve a new mobile malware called “Krampus-3PC”. The malware targets iPhone users who visit any of these compromised websites. The malware first checks whether the ad was hosted by Adtechstack- Adtech provider and then injects another script to check whether the victim’s device was an iPhone. If these parameters are met, then malware executes the payload URL and sends victim data to the attacker’s C&C server. The gathered phone numbers were used later to send phishing texts and cookie IDs which allows the hackers to hijack the browser or to gain access to any of the online accounts which were left open on the victim’s machine.

See the full report here: https://threatpost.com/krampus-3pc-malware-iphone-users/151043/

Why Ring Doorbells Perfectly Exemplify the IoT Security Crisis

Hackers are breaking into users' Ring accounts, which can also be connected to indoor Ring cameras, to take over the devices. There have been multiple incidents across various countries where the hackers hijack Ring cameras to either talk to children or record audios. A Ring Spokesperson said that they investigated various incidents and have no evidence of an unauthorized intrusion or compromise of Ring’s systems or network. The company claims to have taken appropriate actions to promptly block bad actors from known affected Ring accounts. Concerned users have been notified about these incidents by the company. Users are urged to change their passwords regularly and enable two-factor authentication.

See the full report here: https://www.wired.com/story/ring-hacks-exemplify-iot-security-crisis/

Maze Ransomware Demands $6 Million Ransom From Southwire - BleepingComputer

The operators of Maze Ransomware claim that they are responsible for encrypting the data of Southwire Company, LLC (Southwire) from Carrollton, Georgia and are demanding a ransom of 850 BTC, amounting to approximately $6 million. Multiple systems were affected by the attack, causing significant delays in shipping customer orders. As a precaution, the company had to shut down the entire network, including shipping services. The company is fully focused on rebuilding systems and restoring critical operations as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-demands-6-million-ransom-from-southwire/

Google rolls out Verified SMS and Spam Protection in Android

Google announced two new message updates for the Android mobile operating system, namely, Verified SMS and Spam Protection. Verified SMS works by confirming the identity of the SMS sender and will only be used to verify the authenticity of SMS messages sent by businesses. It won't verify and add a verification badge to messages sent by normal users. Spam Protection feature works by showing a notification bar at the top of the Messages app when the app believes a newly-received message contains the markers of a classic SMS spam text. Google said it created this feature to help users trust the messages they receive. Android users in the US and selected countries will get access to these new features.

See the full report here: https://www.zdnet.com/article/google-rolls-out-verified-sms-and-spam-protection-in-android/

New Echobot Variant Exploits 77 Remote Code Execution Flaws - BleepingComputer

An independent security researcher has discovered a new version of the Echobot variant that exploited around 77 Remote Code Execution flaws. The 77 exploits in the current version are for products ranging from routers, IP cameras, VoIP phones, presentation systems, smart home hubs, software, data analytics platforms, biometric scanners, network-attached storage systems, and thermal cameras. An attacker can leverage this to run code of their choice and gain elevated access to victims' devices. It is recommended that users patch their devices with the latest updates, IoT devices for the most part.

See the full report here: https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits-77-remote-code-execution-flaws/

VeChain Foundation Hacked, $6.5 Million in VET Stolen - Crypto Briefing

The VeChain Foundation has been hacked - likely by an insider seeking to gain access to 1.1 billion VET tokens worth $6.5 million. The hack represents a loss of over 4.6% of the foundation’s treasury and accounts for 1.3% of VeChain’s total supply. The company is working on mitigating the damage caused by the hack and enlisted a dedicated website Vechainstats.com to help monitor and contain the situation.

See the full report here: https://cryptobriefing.com/vechain-foundation-hacked-6-5-million-vet-stolen/

Valuable personal info leaks from Facebook – not Zuck selling it, unencrypted hard drives of staff data stolen

The personal information of nearly 29,000 current and former Facebook employees have been stolen. The theft of data this time is unusual, as hard drives containing unencrypted payroll information were stolen from a Facebook employee's car. The stolen records include employee names, bank account numbers, and partial social security numbers. The company claims that there is no evidence of misuse of the lifted data. Facebook has informed people who were on its US payroll in 2018 and is offering them free identity theft and credit monitoring services. This theft impacts current and former Facebook employees only and no Facebook user data was involved.

See the full report here: https://www.theregister.co.uk/2019/12/13/facebook_data_loss/

Critical Bug in WordPress Plugins Open Sites to Hacker Takeovers

Security researchers have discovered a major vulnerability in two WordPress plugins - Ultimate Addons for Beaver Builder and Ultimate Addons for Elementor, both made by Brainstorm Force. This vulnerability could allow hackers to gain admin access to any WordPress website that had the plugin installed. To exploit the bug and gain full access and control over a site, all that is needed is the email address of an admin user of the site. Brainstorm Force has released a fix for the bug affecting both plugins. WordPress users are urged to update to patched versions of the plugins.

See the full report here: https://threatpost.com/critical-bug-in-wordpress-plugins-open-sites-to-hacker-takeovers/151123/

Ryuk Ransomware Likely Behind New Orleans Cyberattack - BleepingComputer

Researchers at Red Flare Security have attributed the recent ransomware attack on the city of New Orleans to Ryuk ransomware after identifying related files that were uploaded to VirusTotal. One of these, an executable named 'yoletby.exe,' was found to contain numerous references to the City of New Orleans including domain names, domain controllers, internal IP addresses, user names, file shares, and references to the Ryuk ransomware. City authorities have yet to confirm these details, however.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-likely-behind-new-orleans-cyberattack/

Largest hospital system in New Jersey was hit by ransomware attack

Hackensack Meridian Health, one of the largest hospitals in New Jersey, has announced a ransomware attack on Friday that disrupted functions across its clinics and 17 hospitals. The attack began on December 2, 2019, when the hospital's network was breached and all medical records were encrypted. As a result, the hospital was forced to reschedule surgeries and other clinical procedures. Later, the IT staff paid a ransom to decrypt all records. All the systems have been restored and are back online.

See the full report here: https://securityaffairs.co/wordpress/95152/cyber-crime/new-jersey-hospital-ransomware-attack.html

VISA warns of POS malware incidents at gas pumps across North America

The VISA Payment Fraud Disruption (PFD) team have issued security alerts to gas station merchants about cyber attacks involving point-of-sale(POS) malware. Many of the POS terminals in gas stations operate on older technology that does not encrypt payment card data prior to sending it to the main network. Cyber criminals leverage this flaw to intercept the communication and steal card related information. Gas station merchants are recommended to implement a mechanism to encrypt data during transfer or switch to a chip-and-PIN card acceptance policy.

See the full report here: https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/

GALLIUM: Targeting global telecom

Microsoft has reported that the GALLIUM group is targeting telecommunications companies. The group exploits unpatched vulnerabilities to compromise systems running on WildFly/JBoss application servers. After successful infiltration, the group aims to collect credentials, and drop web shells to gain persistence and run further commands, on compromised devices. Additionally, second-stage malware is dropped, including customized Gh0st RAT and Poison Ivy malware payloads to evade detection.

See the full report here: https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/

High-Profile Users in the US and Europe Targeted by Zeppelin Ransomware - Security Intelligence

Blackberry Cylance have observed samples of a new variant of Vegalocker, dubbed Zeppelin. The variant is actively targeting technology and healthcare companies in the US and Europe. The ransomware sample checks for Russia or any former Soviet Union country based systems and immediately quits running if detected. Otherwise, it encrypts all the files on the infected system and drop a ransom note. Further, the ransomware samples are found to be hosted on watering hole sites, Pastebin and wrapped in a Powershell loader.

See the full report here: https://securityintelligence.com/news/high-profile-users-in-the-us-and-europe-targeted-by-zeppelin-ransomware/

SQL Server 2019 Security Tool Inadvertently Reveals Where Sensitive Data is Stored

Microsoft’s SQL Server 2019 introduces a new tool: SQL Data Discovery & Classification. Built into SQL Server Management Studio (SSMS), the software allows users to discover, classify, label and report the sensitive data in their databases. Common security tools perform this process outside the database but Microsoft’s new classification tool performs it within a database, revealing the location of sensitive data. Insider attackers can leverage this to track sensitive data and then access it. Users are urged to use a security classifier outside the database to ensure that the data is secure.

See the full report here: https://www.imperva.com/blog/?p=11420

Where's our data, Google? Chrome 79 update 'a catastrophe' for Android users with WebView apps

Developers complain that users' data are being deleted as they receive the Chrome 79 update on Android. A change to the location of profile data in Chrome 79 on Android means that applications using the WebView component lose data stored locally. The problem appears to originate from a change to the location of profile data in Chromium, the open-source project on which Google Chrome is based. The good news is that the update does not delete the previous data but only makes it invisible. It can, therefore, be recovered by a developer or with debug tools, but this is not easy for the user.

See the full report here: https://www.theregister.co.uk/2019/12/16/chrome_79_update_a_catastrophe_for_android_users_with_webview_apps/

Chinese e-commerce site LightInTheBox.com bared 1.3TB of server logs, user data and more

An unsecured and unencrypted Elasticsearch database has exposed over 1.3TB of web server log entries held by Chinese e-commerce website LightInTheBox.com. The exposed server logs included user email addresses, IP addresses, countries of residence, and pages each visitor viewed on LightInTheBox’s website. It also contained data from the company’s subsidiary sites including MiniInTheBox.com. With holiday shopping around the corner, even a large leak with no user Personally Identifiable Information data could be a threat to both the company and its customers. With access to just users’ email addresses and precise browsing history, attackers could easily phish customers.

See the full report here: https://www.theregister.co.uk/2019/12/16/lightinthebox_data_breach_1_5bn_customer_records/

PowerShell Scripts Delivered Via Office Macro Attachments Target Polish Employees

A new phishing campaign has emerged that targets Polish employees who deliver PowerShell scripts. The phishing e-mail includes an attachment that contains a Microsoft (MS) Office macro which checks the language of the installed Office program and only proceeds if it is in the Polish language. A PowerShell script is downloaded that, in turn, downloads a set of additional PowerShell scripts, enabling the threat actor to seize control of the computer remotely. By using deceptively simple commands and minimal code, threat actors can perform data exfiltration and payload downloading while maintaining a relatively small footprint.

See the full report here: https://cofense.com/powershell-scripts-delivered-via-office-macro-attachments-target-polish-employees/

Google fixes Chrome 79 data loss bug on Android

Google has released a patch for a bug that reset or caused data loss for some Android applications. The bug impacted only Android apps built to run on top of WebView, a slimmed-down version of the Chrome browser. The bug will be fixed in Chrome for Android, version 79.0.3945.93, which will restore user access to their old data and is being rolled out to users this week. Chrome and WebView updates are synced on Android devices, effectively fixing all impacted applications. Users are advised to patch as soon as possible.

See the full report here: https://www.zdnet.com/article/google-fixes-chrome-79-data-loss-bug-on-android/

A Twitter cyberattack on the Epilepsy Foundation posted strobing images that could trigger seizures

A series of cyberattacks on the Epilepsy Foundation's Twitter account exposed thousands of people to videos of flashing strobe lights in an apparent attempt to trigger seizures, causing significant harm to those with the condition. Flashing lights at certain intensities or in certain patterns can trigger a seizure in people with photosensitive epilepsy. While the population of those with photosensitive epilepsy is small, the impact can be quite serious. The foundation has reported the issue to law enforcement officials. Twitter said it has some tools in place to protect this kind of abuse and are exploring additional options.

See the full report here: https://www.cnn.com/2019/12/17/tech/epilepsy-strobe-twitter-attack-trnd/index.html

Facebook Fixes WhatsApp Group Chat Security Issue

A bug was detected in WhatsApp chat platform that allowed attackers to send maliclious messages on group chats and crash the entire application. Initially, the attacker gains access by manipulating the message parameter containing the user's phone number. Other message parameters are also tampered to create a malicious message and send it to all the group members, leading to loop-crash. A fix for the flaw is available in WhatsApp version 2.19.58 and users should apply it manually.

See the full report here: https://www.darkreading.com/attacks-breaches/facebook-fixes-whatsapp-group-chat-security-issue/d/d-id/1336645

Canadian Insurance Firm Hit By Maze Ransomware, Denies Data Theft - BleepingComputer

Andrew Agencies, an Insurance and financial service company based out of Canada was targeted by Maze Ransomware. The attack happened on 21st, October 2019 wherein the attackers intruded into the company network and encrypted 245 computers. Attackers have disclosed 876 usernames and users hashed passwords and demanded ransom amount of $1.1 million from the company. According to reports, the encrypted data was of size 63 terabytes. The company stated that it is not going to pay a ransom amount as there was no evidence of any sensitive data stolen. However, Maze operators claim that they have 1.5 GB of data about insurance customers.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-insurance-firm-hit-by-maze-ransomware-denies-data-theft/

Honda Exposes 26,000 Records of North American Customers - BleepingComputer

Personally Identifiable Information (PII) of nearly 26,000 Honda customers has been exposed after misconfiguring an Elasticsearch cluster. The database in question is a data logging and monitoring server for telematics services for North America covering the process for new customer enrollment as well as internal logs. The exposed information included the customers' full names, email addresses, phone numbers, mailing address, vehicle make and model, vehicle VINs, agreement ID, and various service information on their Honda vehicles. If leaked, this information can be used in highly targeted phishing attacks. Honda claims that none of its North American customers' financial information, credit card data, or credentials were exposed in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/honda-exposes-26-000-records-of-north-american-customers/

TP-Link Routers Give Cyberattackers an Open Door to Business Networks

TP-Link patched a critical firmware vulnerability, tracked as CVE-2017-7405 in Archer C5 v4 routers. If exploited, an attacker can take control of the router’s configuration via Telnet on the local area network (LAN) and connect to a File Transfer Protocol (FTP) server through the LAN or wide area network (WAN). The vulnerability was discovered by IBM Red‘s Grzegorz Wypych. Users are advised to apply patches to the device through the TP-Link support portal.

See the full report here: https://threatpost.com/tp-link-routers-cyberattackers-open-door/151254/

Cryptocurrency-mining botnet uses a Taylor Swift image to hide malware payloads

According to Sophos, the MyKingz crew is now experimenting with steganography, a technique that allows them to hide malicious files inside legitimate ones. The operators of MyKingz, a cryptocurrency-mining botnet are currently using an image of pop singer Taylor Swift to hide malware payloads they send to infected computers. The purpose of using this technique is to trick security software running on enterprise networks. These security products will only see a host system downloading a banal JPEG file, rather than a much dangerous EXE file.

See the full report here: https://www.zdnet.com/article/cryptocurrency-mining-botnet-uses-a-taylor-swift-image-to-hide-malware-payloads/