Threat Intelligence Bulletin: 01/03/2020 - 01/09/2020

Iran Research Report

In light of the recent targeted killing of Iran’s Maj. Gen. Qassem Soleimani ordered by the United States, there has been increased speculation and tension surrounding the potential cyber-attacks directed towards the US and its allies. This research report seeks to address the threats and capabilities associated with Iran, what risks these groups pose, and how they may impact ZeroFOX customers.

The Threats Associated with Iran’s Cyber Capabilities

Iran has a mature Computer Network Operations (CNO) capability that is realized through multiple groups, both civilian and military. Although Iran has multiple groups to carry out CNO, they are often segmented from each other due to bureaucracy and thus are unable to coordinate all of their resources effectively.

Iran has varying levels of resourcing and motivations associated with the groups that operate on behalf of Iran, ranging from non-technical to Advanced Persistent Threat (APT), from non-funded but highly politically motivated to Nation-state funded attackers.

ZeroFOX classifies the various threats associated with Iran into four groups ranked by their access to funding and their motivation:

Figure 1. Breakdown of groups operating in Iran and their motivations

APTs

There are a number of groups in the military and civilian government services that operate in varying capacities, including APT33, APT34, APT35, and APT39.

These government-sponsored groups have some overlap between Tactics, Techniques, and Procedures (TTP's), and have been seen using standard built-in Windows tools to live on the land. Using built-in tools allows them to avoid introducing new software or tools (however, in most cases they will use 3rd party tools in addition to standard software) into the victim environment. All of these APT groups have been seen initially trying to compromise their victims through the use of highly-targeted phishing attacks, also known as spearphishing, while groups like APT35 will spearphish in addition to compromising publicly available sites through SQL injection.

All of these groups also will attempt to dump victim credentials through the use of various software, with the majority using Mimikatz to collect these credentials. Most of these groups will also use WinRAR for compressing their data before exfiltrating it to potentially avoid network scanners or DLP solutions.

These APTs targets range pretty broadly, from telecommunications and travel industries aligned with Iran priorities to targeting multiple industries in the US, Saudi Arabia, South Korea, and Israel focusing on aviation and energy sectors. Some groups distinctly focus on financial, government, energy, chemical, and telecommunications in the Middle East as well.

Figure 2. Map of Iranian APT Targets

Criminals

Iran’s cyber capabilities extend beyond just government actors and espionage and destructive missions. There are several criminal organizations operating in Iran, such as Silent Librarian, ITSecTeam, and Mersad Company. Several private companies and Iranian citizens have been indicted by the US Department of Justice for involvement in the development of tools to sell to Iranian cyber groups. They have also been directly involved in the theft of intellectual property and selling the stolen property to buyers both inside and outside of Iran, as detailed in the press statements below.

https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged https://www.justice.gov/usao-sdny/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic

The TTPs of criminal groups are very close to that of the government-sponsored APT groups. We assess with moderate confidence this is because 3rd party tool developers/operators are reusing the same tools and techniques sold to government groups for freelance criminal activities.

Patriots/Idealists

Several patriot and idealist groups, such as Rocket Kitten, Internal Proxies, Basij Cyber Council, Cutting Sword, and Cyber Fighters of Izz ad-Din al-Qassam fall into this category.

Actors in this group are highly motivated by their desire to serve their country and strive to defend their country however they can. These attackers typically aren’t well-funded as they are normal citizens of their country, which limits the threat these attackers place. These groups are not directly affiliated with the government but are often brought together and given training by political or religious organizations in Iran.

These groups usually don’t have high-end toolsets. They often use open source tools and techniques. The well-known techniques work to add a level of obfuscation to their activities making attribution hard.

Script Kiddies

The recent website defacements of public sites are most commonly attributed to script kiddies, due to them attacking targets of opportunity, rather than specific sites that would cause more of an impact than defacing the Texas Department of Agriculture or the South Alabama Veterans Council site.

Figure 3. Image used to deface the South Alabama Veterans Council Site.

Risks to Your Organization

As broken down above, the range of motivation and skill set of the groups currently active in Iran vary greatly and may or may not fall into your threat model. Depending on what vertical you are in, the risk to your organization should be business as usual and be mitigated by typical defenses that organizations typically deploy.

Smaller companies that do not have the resources available to protect themselves will be as much of a target from Iran as any random hacker on the Internet. If state-sponsored APTs are in your threat model, then you should have identified and/or employed potential mitigations to the threats associated with them. For instance, APT33 has used Shamoon wiper malware in the past, and if your organization has a robust Disaster Recovery plan in place, you would be prepared for this type of attack.

Looking at other typical types of threats from groups operating in or with Iran, the following recommendations could be followed for how to mitigate some of these threats:

• Use 2FA for all available services. Not all attacks can be stopped simply by using 2FA, however, this is an excellent method for ensuring that access to your resources can not be defeated through credential stuffing attacks. Charming Kitten has been observed trying to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. Using 2FA could help in protecting your social media accounts from attackers accessing them.
• Ensure your systems are kept up-to-date with the most recent patches, especially if external facing systems, like webservers or mail servers. Magic Hound/APT35 has been seen using publicly available tools, such as Havij and sqlmap to target publicly available servers in the energy, government, and technology sectors that are either based or have business interests in Saudi Arabia.
• Have a Disaster Recovery Plan in place to be able to quickly and effectively recover from wiper malware impacting your systems. The Shamoon wiper malware, used by APT33, has been seen in recent years targeting industrial players in the Middle East and Europe.
• Remain vigilant to spearphishing attempts targeting your employees and organization to prevent credential compromise or using malicious attachments to gain access. APT39 has previously used spearphishing to initially compromise victims in the telecommunications sector, with additional targeting of the travel industry and IT firms that support it and the high-tech industry.

We have added multiple campaigns to ThreatFeed for our customers to ingest into their security tooling using various sourcing and reporting. Indicators from recent campaigns like DNSpionage, Muddywater, ZeroCleare, and Tortoiseshell have been included, and details can be found below for how customers can view the campaigns added to ThreatFeed.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/119/list_indicators/

Conclusion

While the threat from Iran is real, depending on your vertical, defenses, and scope, you may never experience any targeted attacks. There is a lot of noise and media attention focused on this, and with smaller attackers hitting any target of opportunity, there is bound to be more news about this which can cause panic. This is also a perfect time for other attackers to mimic Iranian APT techniques to increase tension and create false-flags for targeting other interests.

If your company practices defense-in-depth and takes standard precautions against threats like these, you’ll be in decent shape. These groups use standard tooling that have detections built to detect malicious behavior, however, the threat comes from the highly-motivated attackers that are specifically targeting your organization over a longer period of time. In this case, understanding what defenses you have, and how you can defend against those specific threats is vital. Aligning your defenses to MITRE’s ATT&CK framework and seeing how you can detect these specific adversaries can aid in this journey.

Breaking News: 2020-01-03 - 2020-01-09

Ransomware Attackers Offer Holiday Discounts and Greetings - BleepingComputer

Ransomware operators are treating their organization as a business and are providing discounts and season greetings to lure victims into paying a ransom. The Sodinokibi Ransomware (REvil) had changed their ransom note over the holiday to include a message “Merry Christmas and Happy New Year” followed by a message asking them to pay the ransom. Another ransomware operator called Maze had offered a 25% discount, if victims paid between December 25th and December 31st. Maze operators also stated that they have decided not to publish private information of Pensacola city, delete their data completely from their servers and discounted the ransom to $500,000.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attackers-offer-holiday-discounts-and-greetings/

Oddly specific 'cyber attack' hits Alaskan airline RavnAir and one plane type

RavnAir Group experienced a malicious cyberattack on its IT network, causing it to cancel all of its flights operated with Dash 8s on its RavnAir Alaska airline. No information was given by the airline on precisely what the cyberattack consisted of. Ken Munro of Pen Test Partners speculated the attack could have been carried out by a disgruntled ex-employee or perhaps a commercial rival, based on the targeting of RavnAir's Dash 8 maintenance system. The company said that it might take as long as one month to have all affected IT systems fully restored.

See the full report here: https://www.theregister.co.uk/2020/01/02/ravnair_ransomware_dhc_dash_8/

Travelex forced to take down website after cyber-attack

A foreign exchange company, Travelex, was forced to take its websites offline following a cyberattack on New Year’s Eve. According to the investigation, there is no indication that any personal or customer data has been compromised. The company said that it was unable to perform transactions on the website or through the app. The incident has also affected other companies whose travel money services are provided by Travelex. At this time, the company is focused on getting its services back online as soon as possible.

See the full report here: https://www.theguardian.com/technology/2020/jan/02/travelex-forced-to-take-down-website-after-cyber-attack

Data Breach Affects 63 Landry’s Restaurants

Dining giant Landry’s disclosed a data breach that exposed customers’ payment card information from nearly 63 restaurants across America. Attackers are believed to have gained entry by infecting the company's order-entry systems with malware. The malware was able to read track data from the order-entry systems including the cardholder’s name, card number, expiration date, and internal verification code. The company did not disclose the number of payment cards that were accessed as part of the breach. Landry's urges potentially impacted customers to closely monitor their payment card statements for any unauthorized activity.

See the full report here: https://threatpost.com/data-breach-affects-63-landrys-restaurants/151503/

US Government Issues Warning About Possible Iranian Cyberattacks - BleepingComputer

The Director of Cybersecurity and Infrastructure Security Agency, Christopher C. Krebs issued a warning against Iranian cyberattacks targeting the U.S. assets after Maj. Gen. Qassim Suleimani was killed in a drone strike. According to sources, the Department of Homeland Security (DHS) may also update the National Terrorism Advisory System to warn on potential cyberattacks from Iran. Krebs urges private companies and government agencies to refresh their knowledge of Iranian state-backed hackers.

See the full report here: https://www.bleepingcomputer.com/news/security/us-government-issues-warning-about-possible-iranian-cyberattacks/

Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools - BleepingComputer

The Clop Ransomware has evolved with a new and integrated process killer. Clop now terminates 663 Windows processes before encrypting files, which include new Windows 10 apps, popular text editors, debuggers, programming languages, terminal programs, and programming IDE software. Some of the more interesting processes that are terminated include the Android Debug Bridge, Notepad++, Everything, Tomcat, SnagIt, Bash, Visual Studio, Microsoft Office applications, programming languages such as Python and Ruby, the SecureCRT terminal application, the Windows calculator, and even the new Windows 10 Your Phone app. In addition to the new and large list of targeted processes, this Clop Ransomware variant also utilizes a new .Cl0p extension, rather than the .CIop or .Clop extensions used in previous versions.

See the full report here: https://www.bleepingcomputer.com/news/security/clop-ransomware-now-kills-windows-10-apps-and-3rd-party-tools/

Ransomware Attack Topples Telemarketing Firm, Leaving Hundreds Jobless

Arkansas-based telemarketing organization, The Heritage Company was hit by ransomware and was forced to suspend its operations, leaving hundreds of workers unemployed. The 61-year-old telemarketing firm that works with nonprofit organizations, sent a letter to more than 300 employees saying that the company has lost hundreds of thousands of dollars due to the attack. According to The Heritage Company CEO Sandra Franecke, the company’s servers were hit by a ransomware attack two months ago, after which it paid an undisclosed ransom to get systems back up and running. At this time, the company is focused on post-attack recovery and urges employees to search for other employment.

See the full report here: https://threatpost.com/ransomware-attack-topples-telemarketing-firm/151530/

3 Critical Bugs Allow Remote Attacks on Cisco NX-OS and Switches

Tenable researchers have analyzed three recently-patched critical vulnerabilities: CVE-2019-15975, CVE-2019-15976, CVE-2019-15977 in Cisco's network platform and switches that could allow an unauthenticated, remote attacker to bypass endpoint authentication and execute arbitrary actions with administrative privileges. Two of the flaws, CVE-2019-15975 and CVE-2019-15976, are authentication bypass vulnerabilities in the REST API and SOAP API endpoints for Cisco DCNM. The third bug, CVE-2019-15976, is described by Cisco as data center network manager authentication bypass vulnerability. Cisco has released software updates patching the vulnerabilities. Users are urged to patch their vulnerable machines to a fixed version.

See the full report here: https://threatpost.com/cisco-patches-3-critical-bugs-nx-os/151529/

Colorado Town Wires Over $1 Million to BEC Scammers - BleepingComputer

Colorado Town of Erie lost more than $1 million to a business email compromise scam (BEC). The fraudsters used an electronic form on the town's website to request a change to the payment information on the building contract for Erie Parkway Bridge awarded to SEMA Construction. While Erie staff should follow guidelines designed to verify the authenticity of payment information change requests, in this case, the Erie staff member failed to do so. This resulted in the payment information used to wire roughly $1,01 million to SEMA, pointing to the attacker's account. Following the incident, the Town of Erie removed the contact form from the website and temporarily discontinued electronic payments. Erie Town Administrator Malcolm Fleming said that the town is actively investigating to identify potential risks and to mitigate them.

See the full report here: https://www.bleepingcomputer.com/news/security/colorado-town-wires-over-1-million-to-bec-scammers/

Apparent Pro-Iran Hackers Deface Federal Library Program Site - NBC 10 Philadelphia

The website for the Federal Depository Library Program was hacked and defaced on Saturday and has been taken offline. 'Iranian hackers' claim breach of US govt website. The officials at the U.S. The Government Publishing Office (GPO) has confirmed that the other sites are unaffected and fully operational. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) is currently investigating the issue.

See the full report here: https://www.nbcphiladelphia.com/news/national-international/apparent-pro-iran-hackers-deface-federal-library-program-site/2270478/

Suspected Ryuk ransomware attack locks down Adelaide's City of Onkaparinga council - ABC News

Adelaide's City of Onkaparinga council fell victim to a cyber-attack just before Christmas that locked down its systems. and disrupted email and phone lines. The council suspects that the systems were infected by Ryuk ransomware. Except for the public computers and printers at its libraries, all the systems are restored. The council is launching a new IT system with enhanced security elements.

See the full report here: https://www.abc.net.au/news/2020-01-06/city-of-onkaparinga-hit-by-ryuk-ransomware/11843598

'Serious cyber-attack' on Austria's foreign ministry

Austria's foreign ministry has reported an ongoing cyber incident, started Saturday night. It is suspected to be carried out by a "state actor". Coincidently, the breach occurred on the same day the Greens agreed to a coalition with the country's conservatives. The incident is under investigation and it may take days to recover the systems.

See the full report here: https://www.bbc.co.uk/news/world-europe-50997773

Sodinokibi Ransomware Hits Travelex, Demands $3 Million - BleepingComputer

Bleeping Computer has confirmed that Travelex systems were infected by REvil/Sodinokibi ransomware. The operators of Sodinokibi ransomware encrypted the entire Travelex network and copied more than 5GB of personal data. The extension added to some of the encrypted files was a string of more than five random characters, similar to .u3i7y74. The encrypted information includes dates of birth, social security numbers, card information, and other details. The attackers are demanding a ransom of $3 million to decrypt the files.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/

Magecart Hits Parents and Students via Blue Bear Attack - Threatpost

Magecart targeted Blue Bear Software, an educational accounting software platform that parents use to pay for student fees, books, and school supplies. According to Active Networks, customers who had purchased items from a school webstore that was powered by its platform are potentially affected. Magecart compromises websites by exploiting vulnerabilities in third-party e-commerce platforms, to inject card-skimming scripts on checkout pages. Card skimmers harvested information including names, payment card numbers, expiration dates and CVV codes, and Blue Bear user IDs and passwords. Social Security numbers, driver license numbers or similar government ID card numbers were not caught up in the breach.

See the full report here: https://threatpost.com/magecart-blue-bear-attack/151585/

ToTok Returned to Google Play Despite ‘Spy Tool’ Claims

Google has made the popular chat app ToTok available again for download on Google Play Store. The popular app was taken down from Google Play and the Apple App Store after a report from New York Times claimed that the app was being used by the government of the United Arab Emirates as a spy tool used to track users’ conversations and locations. In the updated version of ToTok, there is now a newly-designed dialog to ask for user authorization for accessing and syncing their contact lists. However, the app remains unavailable on the App Store.

See the full report here: https://threatpost.com/totok-returned-to-google-play-spy-tool/151576/

Google disables Xiaomi smart home integration after camera bug

A Xiaomi smart camera user reported that his Xiaomi Mijia 1080p Smart IP Security Camera received still images from random people’s homes. This led Google to temporarily shut down access for Xiaomi devices to Google Nest Hub and Assistant. Both, Google and Xiaomi acted immediately to solve the issue and it is now fixed. Upon investigation, it was found that the issue was caused by a cache update, which was designed to improve camera streaming quality. In this case, it happened during the integration between Mi Home Security Camera Basic 1080p and the Google Home Hub with a display screen under poor network conditions.

See the full report here: https://www.welivesecurity.com/2020/01/03/google-disables-xiaomi-smart-home-integration/

Half of the websites using WebAssembly use it for malicious purposes

Researchers from the Technical University in Braunschweig, Germany have found that most of the WebAssembly running websites use it for cryptocurrency-mining and online gaming. The cryptocurrency-mining Wasm modules are often found on hacked sites, part of so-called cryptojacking (drive-by mining) attacks. Academics have recommended cybersecurity firms to upgrade security products to handle threats that will originate from this new technology.

See the full report here: https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes/

3 Google Play Store Apps Exploit Android Zero-Day Used by NSO Group

Malicious Android applications like Camero, FileCrypt, and callCam are supposedly linked to Sidewinder APT, a sophisticated hacking group specialized in cyber espionage attacks. According to Trend Micro, FileCrypt and Camero act as droppers and connect to a remote command and control server to download a DEX file, which then downloads the callCam app and tries to install it by exploiting privilege escalation vulnerabilities or abusing accessibility feature. Upon installation, the app harvests information including device location, battery status, files on the device, installed app list, camera information, screenshots, accounts, wifi information and data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome. Google has removed all the above-mentioned malicious apps from the Play Store.

See the full report here: https://thehackernews.com/2020/01/android-zero-day-malware-apps.html

TikTok Bugs Could Have Allowed Account Takeovers

Recently patched vulnerabilities in TikTok could have allowed an attacker to take over TikTok accounts, add or delete videos, and expose private data marked "hidden". Check Point researchers discovered that TikTok offers a feature on its website for users to enter their phone numbers and receive an SMS message with a link to download the app. Attackers can revamp the SMS to send malicious links. If a TikTok user clicked one of these malicious links, an attacker could have manipulated bugs in TikTok's browser redirect setup and authentication mechanisms to manipulate their account and send commands to add or delete videos, forcing the victim account to follow other accounts, making private videos public, or exfiltrating the victim's account data like name and email addresses.

See the full report here: https://www.wired.com/story/tiktok-bugs-account-takeover/

Medical Info of Roughly 50K Exposed in Minnesota Hospital Breach - BleepingComputer

Personal and medical information of 50K patients was exposed in a breach incident at Minnesota-based hospital, Alomere Health. The security breach was discovered on 6th November, where an employee's email account was compromised. The attackers were able to gain access to patients’ names, addresses, dates of birth, as well as medical info such as record numbers, health insurance information, treatment information, and diagnosis information. The hospital has informed the customers about the breach and offers complimentary credit monitoring and identity protection services for patients whose SSNs and driving license were exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/medical-info-of-roughly-50k-exposed-in-minnesota-hospital-breach/

SNAKE Ransomware is The Next Threat Targeting Business Networks - BleepingComputer

Security researchers have discovered a new ransomware called “SNAKE” that targets enterprise network and encrypts all the devices connected to the network. The ransomware is written in Golan and has a high level of obfuscation. Once infected, it deletes Shadow Volume Copies from the system and kills various processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software, and more. It then encrypts the files on the devices except for the one which is located in Windows system folders and various system files. Upon encrypting the files, it appends 5 random characters as the file extension. Further, in each encrypted file, it appends the ‘EKANS’ file marker, which is "SNAKE" in reverse and then drops the ransom note in the desktop folder.

See the full report here: https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next-threat-targeting-business-networks/

Facebook bans deepfakes but not all altered content

Monika Bickert, Facebook’s vice president of global policy management, made an announcement stating that deepfakes will be added to the list of Facebook’s categories of banned content. Facebook will remove manipulated content that has been edited or synthesized beyond adjustments for clarity or quality, in ways that aren’t apparent to an average person and would likely mislead someone into thinking that a subject of the video said words that they did not say. Facebook will also remove manipulated content that is a product of artificial intelligence or machine learning that merges, replaces or superimposes content onto a video, making it appear to be authentic.

See the full report here: https://www.welivesecurity.com/2020/01/07/facebook-bans-deepfakes-not-all-altered-content/

Drake Lyrics Used as Calling Card in Malware Attack

In a new business email compromise(BEC) campaign, a hacker with the handle “Master X” is delivering emails containing a malicious PowerPoint attachment that ultimately downloads either the Lokibot info stealer or Azorult remote access trojan. According to security researchers, the sample emails contained two attachments, “INVOO13433361.pss” and “Blank slip.pss”. Upon opening either of the PowerPoint attachments, it automatically runs a heavily obfuscated visual basic script. The attacker leverages a PowerShell script that contains a reference to singer-songwriter Drake lyric’s “Kiki Do You Love Me”. As of now, it’s unclear how successful this campaign has been.

See the full report here: https://threatpost.com/drake-lyrics-used-as-calling-card-in-malware-attack/151665/

New Iranian data wiper malware hits Bapco, Bahrain's national oil company

A new strain of data-wiping malware, Dustman, has been deployed by Iranian state-sponsored hackers on the network of Bahrain's national oil company, Bapco. The incident came into light in between rising political tensions between the US and Iran. The attack didn't last long as only a few computers were affected. The Saudi CNA has issued mitigation advice for companies active in the oil and gas field, which could be a target for attacks with the Dustman malware.

See the full report here: https://www.zdnet.com/article/new-iranian-data-wiper-malware-hits-bapco-bahrains-national-oil-company/

City of Las Vegas said it successfully avoided devastating cyber-attack

The city of Las Vegas successfully avoided a harmful cyber-attack that took place on January 7th, 2020. It is believed that the email delivery vector was involved and the attacker is still unknown. The city was quick to detect the intrusion and took steps to protect the impacted systems. The city responded by taking several services offline, including its public website. However, the company confirmed over Twitter, on January 8th, 2020, that no data was stolen from the system and resumed its operations with all data systems functioning as normal.

See the full report here: https://www.zdnet.com/article/city-of-las-vegas-said-it-successfully-avoided-devastating-cyber-attack/