Threat Intelligence Bulletin: 01/17/2020 - 01/23/2020

Research Report: 16Shop Adds Paypal to Catalog

Since 2019, ZeroFOX Alpha Team has been tracking a prolific phishing kit distribution network known as “16Shop”. These kits are the phishing version of “ransomware-as-a-service” - users can purchase these kits and are given a license to distribute them for a cost. They are also provided installation and tear down instructions, updates for no additional cost, and access to portals to purchase more kits. Some phishing kit distribution networks even have live support channels, social media pages and email addresses.

16Shop has been publicly attributed to a group called Indonesian Cyber Army, and specifically, one of the authors, DevilScreaM, has his moniker plastered over the kit code and distribution network. The kit first made a splash on the scene by targeting Apple kits, then moved to Amazon and was uncovered by McAfee right before Amazon Prime Day in 2019.

Screenshot Courtesy of McAfee

Automation Prevent and Paranoia

In early January 2020, ZeroFOX Alpha Team obtained a phishing kit from 16Shop that now targets Paypal customers, indicating they are actively adding brands to their phishing kit portfolio. The kit was hosted on a webserver attributed to 16Shop distributors and the filename is called 16Shop-PP-V1.zip. Taking a peek inside, there are four main directories:

Screenshot of 16Shop Paypal Top Level Directory

Higher tier phishing kits such as 16Shop have a number of features, one of them being the ability to block automated crawlers for security vendors, as well as web indexers, to limit exposure of the kit. The latest versions of 16Shop’s Amazon, Apple and now Paypal kit employ 3 anti-bot and anti-indexing features. The first being a simple blacklist file under security, with a file named blacklist.dat. Secondly, they use an open-source anti-crawling library called CrawlerDetect.

Crawlerdetect Github page

The latest versions also employ an integration with antibot.pw.

Antibot php file

Antibot has an API endpoint where 16Shop operators can load an API key into the kit and the kit will send the visitor’s User-Agent out to antibot to see if a visitor is a “bot or not”. The antibot website is in English as well as Indonesian. This is an interesting observation as the 16Shop authors have been attributed to be Indonesian, and there is Indonesian littered throughout their code. Antibot also offers services for link shortening, link clickthrough and tracking, as well as Bank Identification Number (BIN) checking.

Antibot splash page

Antibot pricing and packaging

Much like any SaaS product, many features of 16Shop are “a la carte”, and adding additional features helps the operators land and expand when selling their kits. For example, a kit author could purchase only an Amazon kit, and then see a new Paypal kit with great antibot features, so it incurs a “fear of missing out” and causes the operator to purchase the new package. The authors also make an honest attempt to block as much security scanning and indexing engines as possible, as the quicker these automated tools find phishing websites, the faster they get taken down. Lastly, 16Shop employs a Digital Rights Management (DRM), limiting the number of deploys per kit unless you buy more.

Previous Product panel for 16Shop

Feature set for an Amazon Scampage

Paypal Kit Features

The Paypal kit, much like the Apple and Amazon kit, is designed with a number of features that are aimed to steal as much Personally Identifiable Information (PII) as possible. It has similar DRM features as Amazon and Apple pages, where once a kit is deployed, the kit reaches out to a DRM Command and Control (C2) server for authorization.

Local deployment shows a POST request to C2 server with password, domain and path

By intercepting traffic between 16Shop kits and the C2 server, you can see the server panel for kit operators.

New 16Shop Panel for Paypal

Much like a SaaS product, user experience and dashboard analytics are keys to success. The 16Shop kit panel is professionally done, with reactive elements and data updating in real time. Whether it’s login credentials collected, emails collected, credit cards, bots or clicks, kit operators are able to see the success of their operation in a quick and efficient manner. The goal of phishing kits is to make this experience seamless, so not-so-technical kit operators can deploy phishing pages without needing to understand the underlying protocols behind managing this infrastructure.

Antibot.pw API key update page

Much like previous kits, the stolen information is exfiltrated via SMTP to an attacker-controlled email inbox.

PHP Code Mailer in 16Shop for Paypal

The kit makes an attempt to collect as much information as possible, including country specific PII, as seen in the photo. The kit has fewer languages supported in Paypal rather than Amazon or Apple, which could indicate they are working on adding localizations that match their other kits.

Localizations for Paypal show English, Japanese, Spanish, German and Thai

Conclusion

Phishing kits are becoming more popular, as it allows an economy where more technical cybercriminals sell services and reduce the barrier to entry for less technical operators. These kit authors use product features and marketing tactics from SaaS products to advertise, sell, deploy, maintain and update their products. 16Shop is especially adept as deploying antibot features as well as DRM to maintain their licensing and to try to upsell to current customers.

ZeroFOX Alpha Team has coordinated with the phishing research community on combating these kits and the cybercriminal economy behind them. We’d like to thank everyone on Twitter who has contributed research to combating phishing kits, especially @dave_daves, and other defenders in the community.

We are presenting our research on phishing kits at Shmoocon on February 1st, where we will have more detail on the C2 infrastructure behind 16Shop and other kits. Come check us out!

I.M.L. SLU Breach Advisory

Earlier this month, a popular adult cam site and its affiliate network were compromised due to an exposed AWS S3 bucket. This breach resulted in the loss of personal data for over 4,000 models that use their cam sites. There were around 875,000 files in total exposed in the breach, with extremely sensitive files and personal information being exposed.

Recommendations

• Ensure your cloud providers buckets are not open to the world and you are aware of any permission changes to these buckets to prevent accidental data-leakage
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The exposed S3 bucket was identified by the vpnMentor security team in early January as potentially belonging to ImLive (the actual bucket owner was not identified by vpnMentor), and included an incredible amount of sensitive information related to their models, including:

• Videos
• Marketing materials
• Photographs
• Clips and screenshots of video chats
• Zip files
• Scanned documents

The files included in this bucket span back 15-20 years old, with the most recent files being a few weeks old. Along with the types of data listed above, the type of information gathered from these documents is massive, which includes: Full name, birth date, birthplace, citizenship status, nationality, passport ID, ID photo, personal signature, parent's full names, fingerprints.

In addition, there were pictures of some models' military identification card, which can have potentially career-ending consequences for military members engaging in this type of activity. Even outside of the military members, the data found in this breach can have devastating effects for all of the models, which could include extortion/blackmailing, used for targeted phishing attempts and/or scams, potential legal repercussions, stalking, and identity theft.

Breaking News: 2020-01-17 - 2020-01-23

FBI Seize WeLeakInfo.com For Selling Info From Data Breaches - BleepingComputer

The FBI attained ownership of the WeLeakInfo.com domain after seizing it for illegally selling breached data. According to the FBI, the website was hosting more than 12 billion indexed records from over 10,000 data breaches, including names, email addresses, phone numbers, usernames, and passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-seize-weleakinfocom-for-selling-info-from-data-breaches/

Customer-Owned Bank Informs 100k of Breach Exposing Account Balance, PII - BleepingComputer

Western Australia-based P&N bank suffered a data breach, exposing personal information such as name, address, age, email, phone number, customer, account number, and account balance. Supposedly, the leaked information was stored in a customer relationship management system which was accessed by the threat actors. The attack took place on December 12, 2019, during a server upgrade via a third party that provides hosting services to P&N bank. Following the attack, the company has shut down the source of vulnerability and is investigating the attack further to prevent future risks.

See the full report here: https://www.bleepingcomputer.com/news/security/customer-owned-bank-informs-100k-of-breach-exposing-account-balance-pii/

New JhoneRAT Malware Targets Middle East

Security researchers have come across an active ongoing campaign that distributes new remote access trojan called ‘JhoneRAT’. The RAT is written in Python and is distributed via malicious Microsoft Office documents that target only Arabic-speaking victims. The RAT determines its targets via the victim's keyboard layout. The malicious document once downloaded gathers the victim's system information also downloads additional payloads. The attackers have used various cloud services, such as Google Drive and Google Forms, as part of the payload’s infection process. This RAT uses three different cloud services to perform all its C2 activities. It checks for new commands in the tweets from the handle @jhone87438316 every 10 seconds using the BeautifulSoup HTML parser to identify new tweets. At this time, the API key has been revoked and the Twitter account also has been suspended.

See the full report here: https://threatpost.com/new-jhonerat-malware-targets-middle-east/152002/

Fraudsters Set Up Site Selling Temporary Social Security Numbers - BleepingComputer

Fraudsters have set up a scam site named "Official Personal Data Protection Fund" to be for a data protection fund created by the U.S. Federal Trading Commission (FTC). The site purports to offer financial compensation to victims whose personal data appeared in information leaks. This money-making scheme accepts victims from any country and offers to sell "temporary social security numbers (SSNs)" to those that don't have one by offering a fake verification service that can help users find out if their data was ever leaked.

See the full report here: https://www.bleepingcomputer.com/news/security/fraudsters-set-up-site-selling-temporary-social-security-numbers/

Microsoft Issues Mitigation for Actively Exploited IE Zero-Day - BleepingComputer

An actively exploited zero-day remote code execution (RCE) vulnerability impacting Internet Explorer receives mitigation measures from the Microsoft security advisory. According to the advisory, a remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer and could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. If exploited, this security flaw can gain the same user permissions to attackers as the user logged into the compromised Windows device. While no patch exists for this issue so far, users are urged to follow the workarounds to mitigate this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-issues-mitigation-for-actively-exploited-ie-zero-day/

New Jersey Synagogue Suffers Sodinokibi Ransomware Attack - BleepingComputer

Temple Har Shalom, a New Jersey Synagogue was hit by ransomware on 9th January. The ransomware, suspected to be Sodinokibi, encrypted all the server-based files and other data. Attackers have demanded a ransom of $500,000 to receive a decryptor for their network. The affected data include name, email ids, and addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/new-jersey-synagogue-suffers-sodinokibi-ransomware-attack/

Hacker leaks passwords for more than 500,000 servers, routers, and IoT devices

A hacker has publicly disclosed a huge list of Telnet credentials for more than 515,000 servers, home routers, and IoT (Internet of Things) "smart" devices. The list was published online by the maintainer of a DDoS-for-hire (DDoS booter) service, which includes each device's IP address, along with a username and password for the Telnet service. The leaked data are dated October-November 2019. Some of these devices might now run on a different IP address or use different login credentials. Attackers can use these data to connect to the devices and install malware.

See the full report here: https://www.zdnet.com/article/hacker-leaks-passwords-for-more-than-500000-servers-routers-and-iot-devices/

Mitsubishi Electric discloses security breach, China is main suspect

Mitsubishi Electric, one of the world's largest electronics and electrical equipment manufacturing firms, has disclosed a major security breach today. The breach occurred on 28 June 2019, where attackers gained access to Mitsubishi Electric's internal systems and stole sensitive data. Suspected that a Chinese-linked cyber-espionage group named Tick (or Bronze Butler) is behind this intrusion.

See the full report here: https://www.zdnet.com/article/mitsubishi-electric-discloses-security-breach-china-is-main-suspect/

US Retailer Hanna Andersson Hacked to Steal Credit Cards - BleepingComputer

US children's apparel maker and online retailer, Hanna Anderson suffered a Magecart attack in which threat actors hacked into its e-commerce platforms and injected malicious JavaScript-based scripts known as web skimmers into checkout pages to collect the customers' payment information. The exposed information includes name, shipping address, billing address, payment card number, CVV code, and expiration date. The incident was brought to light after the credit cards were available for purchase on a dark web site. Following the attack, the company has notified the affected customers via email and is offering them identity theft protection services, as an added benefit.

See the full report here: https://www.bleepingcomputer.com/news/security/us-retailer-hanna-andersson-hacked-to-steal-credit-cards/

FTCode Ransomware Now Steals Saved Login Credentials - BleepingComputer

FTCode ransomware is upgraded to steal user credentials from email clients and web browsers. FTCode is a PowerShell-based ransomware that resurfaced in October, targeting Italian recipients with spam email campaigns. The additional feature allows the ransomware to exfiltrate the stored credentials before encrypting its victims' files. It is capable of stealing saved credentials from both web browsers (Internet Explorer, Mozilla Firefox, Google Chrome) and email clients (Mozilla Thunderbird and Microsoft Outlook). An FTCode Decryptor is available for those who can capture the encryption keys while having their computers encrypted.

See the full report here: https://www.bleepingcomputer.com/news/security/ftcode-ransomware-now-steals-saved-login-credentials/

600 Computers Taken Down After Florida Library Cyberattack - BleepingComputer

Volusia County Public Library (VCPL), Florida, suffered a cyberattack that has encrypted almost 600 staff and public access computers via unnamed malware strain. Approximately 50 computers are back online, enabling library staff to perform patron business, such as checking books in and out and making reservations but services such as public printing, public WiFi, Catalog Account login, and Link+ Renewals are still down. Currently, the Library is focused on being fully functional with public access computers as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/600-computers-taken-down-after-florida-library-cyberattack/

New Nest Video Extortion Scam Plays Out Like a Spy Game - BleepingComputer

An unusual sextortion scam is attempting to trick victims that their smartphone has been hacked to spy upon their private lives. The scam begins with victims receiving an email claiming to come from hackers who say they have spied on their victim for 11 months, and have managed to record nude video footage of the victim through their smartphone camera. As proof, the hackers offer victims the credentials of an email account, which contains a link to a webpage that appears to show a live feed from Google Nest cameras to trick victims. The hackers demand payment of EUR 500 from the victims and threaten to upload their nude photos and videos on online forums.

See the full report here: https://www.bleepingcomputer.com/news/security/new-nest-video-extortion-scam-plays-out-like-a-spy-game/

This Citibank Phishing Scam Could Trick Many People - BleepingComputer

A new Citibank phishing scam has been uncovered that uses a convincing domain name, TLS certification and even requests OTP codes to lure the victims. When a user visits an impersonated Citibank login page, “update-citi[.]com”, it presents various forms which request for personal information that includes full name, DOB, address, last four digits of social security number, debit card number, debit expiration date, and security code. The collected information is sent to the attacker’s server that is further used to access the victim's Citibank account. Currently, the source of the phishing site is unknown. Users are advised to stay vigilant while visting such links and inform the bank in case of any transactional discrepencies.

See the full report here: https://www.bleepingcomputer.com/news/security/this-citibank-phishing-scam-could-trick-many-people/

Microsoft discovers new sLoad 2.0 (Starslord) malware

After being exposed by Microsoft, the operators of the sLoad malware have now put into circulation a revamped 2.0 version (also known as Starslord). The main purpose of the malware is to infect Windows systems, gather information and function as a delivery system for more potent malware strains. The new sLoad malware uses WSF scripts during the infection process, checks to detect if malware analysts are looking at the code, and the rollout of a new system that tracks the stages of the sLoad infection. Among the three new additions, the last is the most unusual one, not seen in other malware strains. This new mechanism works by adding a small numerical value at the end of a BITS job that communicates with the C&C server.

See the full report here: https://www.zdnet.com/article/microsoft-discovers-new-sload-2-0-starslord-malware/

BitPyLock Ransomware Now Threatens to Publish Stolen Data - BleepingComputer

MalwareHunterTeam has discovered a new malware called BitPyLock, that uses the technique of stealing data before encryption. First found on 9th January 2020, the malware adopts this technique to target individual workstations and to compromise networks. It targets 346 file extensions and encrypts them with .bitpy extension. The hackers demand a ransom of 5 bitcoins for the entire network and threaten to disclose the stolen data publicly if the victims fail to pay the ransom.

See the full report here: https://www.bleepingcomputer.com/news/security/bitpylock-ransomware-now-threatens-to-publish-stolen-data/

FBI Warns Job Applicants of Scams Using Spoofed Company Sites - BleepingComputer

In an attempt to harvest personal information and steal money, scammers are spoofing company websites and post fake job openings on online job boards to trick job applicants. FBI's Internet Crime Complaint Center (IC3) issued a public service announcement to warn about these scammers. The potential victims are contacted via email with the attackers posing as employees from the hiring company. After the fake online interview, to appear legitimate, the criminals send victims an employment contract to physically sign and also request a copy of the victims’ driver’s licenses, Social Security numbers, direct deposit information, and credit card information. The attackers ask the victims to pay upfront for background checks or screenings, job training, start-up equipment, or supplies and after receiving the money, the scammers close all communications channels.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-job-applicants-of-scams-using-spoofed-company-sites/

Citrix Releases Scanner to Detect Hacked Citrix ADC Appliances - BleepingComputer

Citrix and FireEye have released a free scanner for detecting compromised Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances. According to Citrix, the goal of the scanner is to analyze available log sources and system forensic artifacts to identify evidence of successful exploitation of CVE-2019-19781. The IoC scanner allows you to discover evidence of devices that were successfully compromised by attackers, evidence of attackers having scanned vulnerable Citrix servers, as well as evidence of failed scanning attempts. The customers are urged to run the scanning tool against their appliances as soon as possible to identify potential compromises.

See the full report here: https://www.bleepingcomputer.com/news/security/citrix-releases-scanner-to-detect-hacked-citrix-adc-appliances/

New Muhstik Botnet Attacks Target Tomato Routers

A new Muhstik botnet variant has been discovered by the researchers at Palo Alto Networks' Unit 42. This new variant scans for Tomato routers on TCP port 8080 and bypasses the admin web authentication by default credential brute-forcing. The botnet consists of three modules, the first module is a scanner that identifies WordPress installed on a server, the second module is also a scanner that identifies Webuzo solutions installed on a server and the third module targets Oracle WebLogic Server, which sends a deserialization vulnerability found in the server to port 7001/TCP. Other than the variant harvesting vulnerable Tomato routers, there were no additional malicious activities observed.

See the full report here: https://threatpost.com/muhstik-botnet-attacks-tomato-routers/152079/

Microsoft Exposes 250M Customer Support Records on Leaky Servers - BleepingComputer

Microsoft accidentally exposed nearly 250 million customer support and service records following a security breach caused by a misconfigured internal customer support database. According to Security Researcher, Bob Diachenko, the exposed records were stored on five identical ElasticSearch clusters and mostly contained chats and case descriptions of properly anonymized records. The records that weren't properly anonymized exposed customer email addresses, IP addresses, locations, CSS claims and case descriptions, Microsoft support agent emails, and internal notes. Following the incident, Microsoft has secured the misconfigured database.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exposes-250m-customer-support-records-on-leaky-servers/

Data leak strikes US cannabis users, sensitive information exposed

Personally Identifiable Information (PII) belonging to 30,000 people connected to the medical and recreational marijuana industry was exposed in a data leak. According to the VPNMentor Research Team, the source of the leak was an unsecured Amazon S3 bucket. The database was reportedly owned by THSuite, a Point-Of-Sale (POS) and management system used in dispensaries across the United States. The leaked information included the full names of patients and staff members, dates of birth, phone numbers, physical addresses, email addresses, medical ID numbers, cannabis used, price, quantity, receipts, scanned government and employee IDs. Access to the leaked database has been revoked by the Amazon Web Services.

See the full report here: https://www.zdnet.com/article/data-leak-strikes-us-cannabis-users-sensitive-information-exposed/