Malware Spotlight: FollowKade Instagram Phisher

On April 12 2019, Malwarebytes released a blog about a fake Instagram assistance app. The app claims to boost your likes and increase your followers if you download it. Although now removed from Google Play store, ZeroFOX has found it on multiple 3rd party Android APK websites and the app has existed for close to a year on some of these websites. The app introduces an Instagram login page in order for it to work, where the credentials are harvested and shipped into a malicious 3rd party server.

Recommendations

• Enable Mobile App rules in the ZeroFOX platform to scan for apps that may be impersonating your brand or organization
• Never use services that claim to boost your social media following, as they are against Terms of Service and almost all of them are malicious
• Enable 2-factor authentication to protect against phishing attacks

Details

The app had over 50,000 installations before being removed from the Google Play Store. The Android ecosystem has a myriad of third party app stores, so the app still exists on these markets. A recent report from Trend Micro said that mobile malware increased by 100% last year and continues to grow. ZeroFOX Alpha Team found dozens of APK sites that have cloned the Google Play store and are hosting the malware. Even freelance designer website, dribbble, has a link to the malware from what looks like a posting that the malware authors commissioned.

Threat Actor Update: Land Lordz

On April 14 2019, Krebs on Security published a report of a scam website targeting AirBnB. The website, "Land Lordz", charges customers in a SaaS-like model where you pay for different plans. This service allows users to create and manage multiple fake AirBnB Web sites and create fraudulent listings in order to run multiple scams at once. Starting at $550 per month, a scammer can create up to 500 scam properties and maintain interactions with 100 "customers" who are falling victim to these attacks. The fraudulent listings are displayed as regular AirBnB properties, but when the customer asks about the property, the attacker sends a link that looks exactly like the AirBnB page to either skim their credit card information or phish their credentials.

Recommendations:

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Enable 2-factor authentication to protect against phishing attacks
• Never put your personal information or credentials on a website where you're not sure it's legitimate

Details

The website is now down, but screenshots from the report yield a surprisingly professional website. A basic plan is $550 per month, a pro plan is $900 and a team plan is $1600. The site has integrations with SMS services for spamming, as well as phishing site generators that offload credentials via email, text file and jabber. The report listed 4 domains, which are all now removed:

airbnb.longterm-airbnb[.]co.uk
airbnb.pt-anuncio[.]com
airbnb.request-online[.]com
airbnb-invoice[.]com

The listings in the report were found on Gumtree. AirBnB scams of this type are especially bad for victims - policies on AirBnB's website dictate that they cannot help victims who travel off the official website. This is difficult for users, as AirBnB does not have 2-factor authentication support, but will sometimes send a verification email or text if they detect unusual logins.

Data Breach: Bukalapak

On April 12 2019, Bukalapak posted a disclosure outlining an unauthorized access of their cold storage systems that contained sensitive user data. This unauthorized access leaked 13 Million rows of email, IP addresses, names and bcrypt and salted SHA-512 passwords. Every account created in 2017 might be compromised. The company said they moved their cold storage systems to a “safer location” and reset passwords of all users who made an account in 2017.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Bukalapak is a private held technology company from Indonesia and is one of the largest e-commerce in South-East Asia. Customers that created their accounts in 2017 might have been affected by this breach. Bukalapak reactively forced users to enable two-factor authentication, reset the passwords of all affected accounts and migrated all backup information into a more secure environment. The company also hired a third-party forensic company to help with the investigation.

In The News: WiPro Compromised

On April 16 2019, the India Times published that the IT outsourcing and consulting giant WiPro confirmed their IT systems were compromised. Prior to the India Times article, Brian Krebs independently reported that Wipro was dealing with a multi-month intrusion from an assumed state-sponsored actor. The compromised systems were being used as a pivoting point to attack WiPro customer systems. Sources close to Krebs said that at least 11 WiPro customers were affected, as they found artifacts of these customers on the back-end infrastructure of the attacker. The initial breach is believed to be through a phishing email.

Recommendations

• If you are a WiPro customer, consider contacting your account manager there for an update on this compromise
• Use the Indicators of Compromise in the Details section to perform analysis of the intrusion on your systems
• Train your employees the best practices on phishing prevention

Details

The discovery of the attack was through 2 trusted sources close to Krebs. The article also outlines an attempt of Krebs trying to contact WiPro for comment on April 9 and did not get a response until April 12. The attackers supposedly abused their access to perform gift card fraud on one of WiPro’s retail customers. The forensic investigation, and subsequent IOCs, yielded that attackers obtained access via phishing emails and maintained access with a popular remote access tool, ScreenConnect.

Indicators of Compromise

Malicious Domains:
xsecuremail[.]com
wipro365[.]com
microsoftonline-secure-login[.]com
secure-message[.]online
encrypt-email[.]online
secured-mail[.]online
internal-message[.]app
encrypted-message[.]cloud

Malicious IP Addresses:
65[.]52[.]17[.]132
52[.]191[.]194[.]66
163[.]172[.]204[.]41
137[.]135[.]91[.]49
78[.]142[.]62[.]200

MD5                                  SHA1                                           File Name
95f04aa18dc27e4f0c73ac6829dcc3d8     0x2f361486c18e23cea4b375e1c9cccdc14bdd620d     ScreenConnect.WindowsClient.exe.config
29cd6dfecba72957d72ba539a9d3a489     0x4791ffdc93a896293544acc868ec0b99b93ee667     ScreenConnect.ClientService.exe
e6c3816372b044b3cb89188c421b23b8     0x4ed583aa32043deefda57d02c18b4e6f03b426cf     ScreenConnect.Client.dll
fcba211bca9d3514718fc371c817558a     0xcc5e05970d7798e40c5eba95b670f6dc6a78c26d     ScreenConnect.Core.dll
35afdddc519859bb0d0040a5b12d97f9     0x92ef9788568f4b5d6f5014e41d9d9663c7c659b1     ScreenConnect.WindowsClient.exe
11713afad22a3198479898b4b6916de3     0x3b8ae3b0d58c804a525dec63cdb4b12ffb75483a     ScreenConnect.ClientService.dll
99fe092ddca873c2f7c36439913f8b0b     0x57c1bed746895e6ba48a436700c9df75f53bc702     ScreenConnect.Windows.dll
4d5b8d2cd7ebada296f675484cb43bfc     0xa5988a23d0f1d09e807600eabaa170336e3c1af1     Client.resources
0b0b9684f87f73d26f31d558a4edddb2     0xed7396e7917754f020c71dc2f94b34cf64595f2d     Event Viewer.evtx
02617920479e65136f9164fb8e42fe30     0xd3e62e844f6974933840c540b5a1ee9eb6a1164f     app.config
1c48f5e0d1f72fa86bce4fcb6649a219     0xe2c3e787aacb17beb3b82d2f0017dbc8086e2ef0     Client.en-US.resources
e2e88d6ea5d5d2a4c7b8039988644043     0x1a1db93766e31994507511c9c70a1dd94465cf6d     abc.ps1
dd5986339aaf23f2baf8c245923a0f69     0xac9fc01c1284bbe9ee4ddf424216a82b5d64a42c     sc.ps1