Threat Intelligence Bulletin: 12/27/2019 - 1/02/2020

Mozi Botnet Analysis

Netlab recently published a blog identifying a botnet using Distributed Hash Table (DHT) dubbed Mozi. This botnet uses the DHT protocol to build its P2P botnet that has been spreading through Telnet with weak passwords as well as some known exploits for various systems and software and performs a variety of attacks controlled from the botnet master.

Recommendations

• Make sure you patch and update any networking appliances which could be impacted by the vulnerabilities listed in this advisory
• It is recommended to use YARA or similiar file scanning software to analyze potentially malicious files
• Evaluate network traffic to identify potentially nefarious communications, especially those using DHT/P2P

Details

Mozi gets its name from the propogation sample file, Mozi.m and Mozi.a, and currently performs a variety of attacks, including:

• DDoS attacks
• Collecting information from the bots
• Execute payload of specified URL
• Update sample from the specified URL
• Execute system or custom commands

Figure 1. Network Structure of Mozi (Image from https://blog.netlab.360.com/mozi-another-botnet-using-dht/)

The infection process is relatively simple, with an infected bot starting a http service locally that can provide the samples to other victims or can download the sample identified in the configuration file issued by the botnet master. The bots will then either login to the new victim with a weak password and will copy the malware locally from the download address provided by the bot, or will exploit one of a few vulnerabilities that have been identified to download the malware by the provided address from the bot.

Once the code is fetched, the code will execute on the victim machine, and then join the Mozi P2P network to become the new Mozi bot node and proceed to infect other devices. At the moment there are 11 known vulnerabilities being used to exploit systems:

Figure 2. List of vulnerabilities currently being exploited by Mozi (Image from https://blog.netlab.360.com/mozi-another-botnet-using-dht/)

During cursory analysis of potentially impacted devices, there are around 22,000 devices identifying one of the vulnerable versions of software that are being exploited, with Netgear and GPON Routers being around 85% of the total number of potentially impacted devices. This number could potentially be in the 240,000 range however, due to the number of D-Link devices which could be exploited, however, not enough information is known about the devices available and if the vulnerability is present on these systems.

Another unknown factor to the scale of this botnet is devices using the Realtek SDK. In some reporting, there are around 350 wireless networking devices that could be using this SDK, which would be a large number of IoT devices, and the potential scale is not known, however, it could be assumed to be relatively high based on the number of models of networking devices impacted.

Mozi reuses quite a bit of code from the Gafgyt's malware, and is seen reproduced in various functions in Mozi, including the single instance, process name modification, and ACL modification. Based on this, the majority of Mozi samples get flagged by Anti-Virus vendors as Gafgyt.

Due to the packed nature of this file, it has been identified through the YARA signature, SUSP_ELF_LNX_UPX_Compressed_File, which can identify suspicious ELF binaries with UPX compression (which is how Mozi is currently packed). In addition, two MD5 hashes have been identified as associated with this botnet and have been included below.

Conclusion

Mozi could pose a decent threat to network based devices and with the amount of IoT devices available, this botnet could quickly scale to a signficant amount of victims capable of leveraging a large scale botnet to attack targets.

Customers should ensure that all their devices have been patched and updated to potentially mitigate these vulnerabiltiies, as well as monitoring network traffic for indications that hosts are using DHT to communicate with potential victim hosts.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/117/list_indicators/

IOC's

eda730498b3d0a97066807a2d98909f3
849b165f28ae8b1cebe0c7430f44aff3

Breaking News: 2019-12-27 - 2020-01-02

Report alleges massive Wyze data breach, but many questions remain - SlashGear

According to a new security report, Wyze, a budget smart home company allegedly suffered a massive data breach. The company has acknowledged the report but has not confirmed the breach yet. According to Twelve Security, Wyze’s production databases were left entirely open, exposing data of nearly 2.4 million users. The report claims the exposed data includes email addresses, lists of cameras with their nicknames, WiFi SSID, API tokens, Alexa tokens, and more. As precautionary measures, Wyze urges customers to relink any integrations they have with IFTTT, Alexa, and Google Assistant.

See the full report here: https://www.slashgear.com/report-alleges-massive-wyze-data-breach-but-many-questions-remain-26604513/

Ryuk Ransomware Stops Encrypting Linux Folders - BleepingComputer

A new version of Ryuk Ransomware has been discovered that uses executable called “v2.exe” and purposely avoids the encryption of folders associated with *NIX operating systems. The blacklisted *NIX folder includes bin, boot, Boot, dev, etc, lib, initrd, sbin, sys, vmlinuz, run, and var. Windows Subsystem for Linux (WSL), is a feature on Windows machine through which one can install Linux distribution on windows directly and which uses folder names as blacklisted above. Allegedly, Ryuk attackers encrypted a Windows machine that had affected *NIX folders used by WSL and due to which WSL installations stopped working. This led the attackers to blacklist the NIX folders as they intended to encrypt the victim data and not to harm the functionality of the OS and which also reduced the additional overhead of dealing with the customer whose WSL installation was crashed.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-stops-encrypting-linux-folders/

Twitter Warns Indian Users About Data Breach - Herald Publicist

The brand new information breach in Twitter was reported after several Indian customers noticed warning pop-ups from Google as they opened sure affected web sites within the Google Chrome browser, alerting them a few information breaches on the positioning or app that they had visited which additionally uncovered their passwords. Twitter confirms data breach, admits that a malicious code was inserted into its app by a foul actor, compromising customers’ data worldwide. This vulnerability in Twitter for Android might enable the actor to see personal account data or to manage victims' accounts. Twitter has notified the affected customers and urges users to update their Android devices.

See the full report here: https://heraldpublicist.com/twitter-warns-indian-users-about-data-breach/

Ransomware Hits Maastricht University, All Systems Taken Down - BleepingComputer

Maastricht University (UM), a university from the Netherlands, suffered a cyberattack that has encrypted almost all their Windows systems via unnamed ransomware strain. Particularly email services are being impacted. It is currently unknown if scientific data was also accessed or exfiltrated during the attack. As a precautionary measure, UM has temporarily taken all of its systems offline. At this time, the University is focused on getting its services back online as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-hits-maastricht-university-all-systems-taken-down/

Google Chrome Affected By Magellan 2.0 Flaws

Tencent Blade researchers have disclosed five recently-patched vulnerabilities: CVE-2019-13734, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753 in the Google Chrome browser that could lead to remote code execution. Dubbed as Magellan 2.0, these vulnerabilities exist in the SQLite database management system. Both, Google and SQLite have fixed these issues in their latest updates. Users are urged to patch their vulnerable machines to a fixed version.

See the full report here: https://threatpost.com/google-chrome-affected-by-magellan-2-0-flaws/151446/

Ransomware at IT Services Provider Synoptek

California-based IT management services provider and cloud hosting company, Synoptek suffered a Ransomware attack, disrupting operations for many of its clients. The company serves state and local governments, financial services, healthcare, manufacturing, media, retail, and software. According to the sources, the company was hit by Sodinokibi Ransomware, also known as "rEvil" that encrypts the data. Synoptek has reportedly paid a ransom to unlock access to the infected systems.

See the full report here: https://krebsonsecurity.com/2019/12/ransomware-at-it-services-provider-synoptek/

US Coast Guard Says Ryuk Ransomware Took Down Maritime Facility - BleepingComputer

A marine safety alert has been published by U.S. Coast Guard (USCG) to inform about a Ryuk Ransomware attack that took down the IT network of a Maritime Transportation Security Act (MTSA) regulated facility. The Ransomware was managed to infiltrate cargo transfer industrial control systems and allowed the threat actor to access confidential IT network files and encrypt them. The attack forced the company to shut down its operation for more than 30 hours.

See the full report here: https://www.bleepingcomputer.com/news/security/us-coast-guard-says-ryuk-ransomware-took-down-maritime-facility/

FIN7 Hackers' BIOLOAD Malware Drops Fresher Carbanak Backdoor - BleepingComputer

Security researchers have discovered a new tool called “BIOLOAD" which is being used by a financially motivated threat group named “FIN7” to drop Carbanak backdoor on the victim machine. The malware uses a technique called “binary planting” that abuses a method utilized by Windows to search for DLLs required to load into a program. “BOOSTWRITE” is another loader that is associated with FIN7 arsenal and BIOLOAD is believed to be the precursor of BOOSTWRITE based on the compilation date and behavior. BIOLOAD has certain features, such as; it does not support multiple payloads, uses XOR to decrypt the payload and, the decryption key is customized for every victim system and can be derived from its name.

See the full report here: https://www.bleepingcomputer.com/news/security/fin7-hackers-bioload-malware-drops-fresher-carbanak-backdoor/

Wyze Exposes User Data via Unsecured ElasticSearch Cluster - BleepingComputer

Wyze Labs has confirmed the data leak of 2.4 million users through an unsecured database connected to an Elasticsearch cluster. The database was left exposed from December 4 to December 26. It contained a copy of the company's production database containing customer emails and camera nicknames, WiFi SSIDs, Wyze device info, roughly 24,000 tokens associated with Alexa integrations, as well as body metrics including height, weight, gender, and other health info for a small number of product beta testers. As a precautionary measure Wyze logged out all users by pushing a token refresh and added a new level of protection to our system databases.

See the full report here: https://www.bleepingcomputer.com/news/security/wyze-exposes-user-data-via-unsecured-elasticsearch-cluster/

School software vendor Active Network suffers data breach | SC Media - SC Magazine

Active Network’s Blue Bear Software platform has reported a data breach that may have led to the exposure of customers’ personal information. An unauthorized activity took place between October 1, 2019 and November 13, 2019, where personal information was accessed by the hackers. The information possibly exposed included name, payment card expiration date and security code and Blue Bear account usernames and passwords. The incident is under investigation and authorities are taking steps to enhance its security controls. The company is offering free identity monitoring services to affected customers.

See the full report here: https://www.scmagazine.com/home/security-news/data-breach/school-software-vendor-active-network-suffers-data-breach/

Microsoft takes down 50 domains operated by North Korean hackers

Microsoft has successfully taken down 50 domains associated with a North Korean government-backed hacking group. The group, tracked as Thallium(APT 37), used these domains to send phishing emails and host phishing pages. The targets include government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues.

See the full report here: https://www.zdnet.com/article/microsoft-takes-down-50-domains-operated-by-north-korean-hackers/

Special Olympics New York Hacked to Send Phishing Emails - BleepingComputer

The email server of Special Olympics New York was hacked during the Christmas holidays to launch a phishing campaign against the donors. Special Olympics is a non-profit organization that organizes athletic competitions for those with intellectual disabilities across New York. The phishing email was camouflaged as an alert of an impending donation transaction that would automatically debit $1,942,49 from the target's account within two hours. Attackers create a false urgency to force the users into visiting the embedded hyperlinks. These links redirect the victims to the attackers’ landing page, thereby infecting their machines with malware. The company has fixed the issue and notified all the affected users.

See the full report here: https://www.bleepingcomputer.com/news/security/special-olympics-new-york-hacked-to-send-phishing-emails/

Chrome extension caught stealing crypto-wallet private keys

A Google Chrome extension called “Shitcoin Wallet” which was launched on December 9th, 2019 was caught stealing passwords and private keys from cryptocurrency wallets and portals. Shitcoin wallet lets the user manage Ether coins as well as Ethereum ERC20-based tokens. The user either can install the extension or can install the Windows desktop app to manage the funds. However, a researcher discovered that the extension contained malicious code and it sends the private keys of all wallets created through its interface to a third party website. Also, extension actively injects JavaScript code when the user visits five popular cryptocurrency platforms and steals login credentials, private keys and then forwards it to the same third-party website. It is still unclear whether Chrome extension is compromised by a third party or not.

See the full report here: https://www.zdnet.com/article/chrome-extension-caught-stealing-crypto-wallet-private-keys/

Starbucks Devs Leave API Key in GitHub Public Repo - BleepingComputer

An exposed JumpCloud API key which belongs to Starbucks found on GitHub public repository that could allow an attacker to access internal systems and manipulate the list of authorized users. JumpCloud is an Active Directory Management platform that provides user management, web app single sign-on (SSO) access control, and Lightweight Directory Access Protocol (LDAP) service. The vulnerability has been rated as critical as the key allowed access to JumpCloud API. A vulnerability hunter has reported this issue to the company along with Proof-of-Concept and following which, the company removed the repository and the API key has been revoked.

See the full report here: https://www.bleepingcomputer.com/news/security/starbucks-devs-leave-api-key-in-github-public-repo/

Aurora Water announces data breach - 9News.com KUSA

A breach of the payment system of the Aurora Water has exposed the personal information of some customers. Customers who used the Click2Gov payment system to make one-time payments or set up recurring payments between August 30, 2019 and October 14, 2019 were impacted. According to the investigation, an unauthorized person modified a piece of computer code that the Click2Gov software uses which was designed to capture limited personal information, such as first and last name, billing address, payment card type, payment card number, payment card verification value and payment card expiration date, ultimately resulting in the breach. The company is yet to notify the affected customers about the breach.

See the full report here: https://www.9news.com/article/news/local/aurora-water-data-breach/73-4a717e74-9827-4a05-bab9-25782737dda6