Threat Intelligence Bulletin: 02/07/20 - 02/13/20

The True Cost of Business Email Compromise

Scams are on the rise. Much of cybercrime is financially motivated, and attack tactics tend to follow what attackers perceive as being the most lucrative. Running a scam takes much less technical prowess compared to developing or deploying a malware campaign, making scams highly attractive to cybercriminals. A new report from the FBI’s Internet Crime Complaint Center reports that 76% of reported losses in 2019 were a result of scams, with 40% of loss because of business email compromise scams. For comparison, only 4% of loss was the result of ransomware or malware attacks. This advisory seeks to shed some light on the rapidly-evolving threat BEC poses to ZeroFOX customers.

Recommendations

• Never click links or open attachments in suspicious email. If you receive an email suggesting that you direct payment to an account other than the one you generally deal with, confirm this with the organization - preferably not over email
• Enabling ZeroFOX Advanced Email Security rules to protect from BEC scams and Phishing via your company’s e-mail

Details

Business email compromise, also known as BEC, is a type of email fraud that seeks to convince employees to transfer funds into an attacker-controlled account. BEC attackers often use social engineering tactics in order to achieve this. Commonly, BEC attackers will impersonate organizations with which a target already has a payment agreement. Attackers will communicate new payment account information to a target, usually under the pretense that the spoofed organization has changed their systems. Aside from requests for payment, attackers also request confirmation of information like phone numbers, to gain access to personally identifiable information, or PII.

Figure 1. Sample BEC email impersonating an employee’s CEO, requesting PII.

The FBI has recently released a new report on the actual cost of cybercrime to organizations across 2019. BEC made up over $1.7 billion of the total unadjusted $4.3 billion ($3.5 billion after adjustments for recovered funds) in reported losses. Of all cybercrime categories detailed in this report, scams - specifically BEC scams - are by far the largest percentage of this total.

Figure 2. Total loss across all cybercrime reported to the Internet Crime Complaint Center for 2019.

Although we often think of simple scams when we think of BEC, these attacks are often rather sophisticated and involve large-scale planning. In some extreme cases, like the kidnapping scam detailed in a previous advisory, blackmail and extortion techniques are used to create a sense of urgency within the victim, with the goal of getting the victim to do something they may not typically do under normal circumstances, like wire an attacker large sums of money. Other angles include the impersonation of individual employees in order to convince members of HR to update payroll information to an attacker-controlled account, as detailed in this report.

Also of note is that $78 million in losses could be traced back to social media as a vector for attack. Social media is often a pivotal part of social engineering-based attacks. Criminals often seek to establish fake or misleading social media accounts in order to better extort their victims out of cash. Sometimes this false persona development goes as far as a romantic relationship formed under false pretenses, as in this case detailed by the NY Times..

The combination of huge loss and continually evolving tactics poses a huge threat to organizations across all verticals, highlighting the importance of BEC protection. ZeroFOX highly recommends customers evaluate their BEC protection, and expand if necessary.

Threat Update: Brute Force Attacks

ZeroFOX Alpha Team has observed a spike in brute force attacks against our honeypots. Brute force attacks target user accounts, services, or devices and make multiple log-in requests in the hopes of finding a set of successful credentials. This advisory covers a brief overview of brute force attacks, and trends we’ve observed in our honeypots.

Recommendations

• Never reuse passwords between accounts
• Ensure that your organization is not unnecessarily exposing services to the internet, as these services could potentially be targeted in brute force attacks

Details

Brute force attacks describe any tactic that involves an attacker attempting to login to an account, or internet-facing device or service, with a list of potential passwords. These password lists may be random, or they may be built from the data breach databases that are bought and sold on the deep/dark web. Often, attackers will build password lists by combining the passwords of multiple breaches. Password lists of this nature are particularly dangerous to users who re-use passwords between accounts, were the list to be used in a brute force attack against the account.

Brute force attacks can also be used against services and devices that face the internet. Login attempts may target ssh, for example, in an attempt to connect to a device. Alternatively, routers and other network infrastructure may also be targeted. These attacks could be particularly fruitful because some of these devices may use hardcoded passwords for their administrative accounts.

After successfully gaining access to their target, attackers may exploit their victims in a number of ways. Compromised account credentials may be sold on criminal forums, used to drain financial accounts, or used to pivot into other high-value accounts. For example, a compromised email account may be used to reset the passwords of other associated accounts, allowing the attacker access to those accounts. Compromised services/devices could be used to infiltrate an organization’s network and gain access to sensitive information, ultimately resulting in a data breach.

This week, the ZeroFOX Alpha Team observed a spike in brute force attacks targeting our honeypots. Alpha Team enlists a network of honeypots in order to gain insight into attack vector trends. Our honeypots consist of multiple different deliberately vulnerable services in the hopes of luring attackers into targeting them. The most commonly-tried passwords in these attacks are shown in the wordcloud below.

Figure 1. Commonly-tried passwords in this week’s bruteforce attempts

The most commonly-tried usernames were:

• root
• support
• admin
• sh

These attacks come from a variety of sources, with the majority of requests coming from IP addresses in Moldova. ZeroFOX recommends blacklisting the list of top-ten known-attacker IPs, below.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/121/list_indicators/

IOCs

185.153.199.51
45.143.220.4
119.42.99.35
196.2.9.16
27.254.108.33
45.141.87.10
185.202.2.238
195.154.45.194
66.186.160.54
141.98.81.150

Breaking News: 2020-02-07 - 2020-02-13

Critical Android Bluetooth Flaw Exploitable without User Interaction - BleepingComputer

Researcher, Jan Ruge, discovered a critical-severity bug in Android Oreo (8.0 and 8.1) and Pie (9) that could lead to remote code execution. An attacker could leverage flaw, dubbed as CVE-2020-0022 without user participation to run arbitrary code on the device with the elevated privileges of the Bluetooth daemon when the wireless module is active. Exploitation requires only the Bluetooth MAC address which can be deduced from the WiFi MAC address. Android users are urged to apply the latest security patches released for the operating system that addresses the critical vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-android-bluetooth-flaw-exploitable-without-user-interaction/

Google Chrome to Block Mixed Content Downloads, Prevents MiTM Attacks - BleepingComputer

Google is going to gradually block mixed content downloads from web sites as they are a risk to a user's security and privacy as they could be swapped out or viewed in man-in-the-middle (MiTM) attacks. This feature will be rolled out in the upcoming Google Chrome releases: Chrome 81 to Chrome 86, this year. For Android and iOS users, the rollout will be delayed by one version with warnings starting in Chrome 83 as mobile devices have better native protection against downloaded files.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-to-block-mixed-content-downloads-prevents-mitm-attacks/

Oscar Nominated Movies Featured in Phishing, Malware Attacks - BleepingComputer

The hype around this year's Oscar Best Picture nominations is actively being exploited to lure fans into streaming fake previews, where attackers seek to steal credit card details and infect victims with malware. Kaspersky researchers have found over 20 phishing websites and 925 malicious files that were presented as free movies to attack the users. These websites collect users’ credit card data, under the pretense of taking a survey. Users are advised to adhere to legal streaming platforms to avoid falling prey to phishing websites.

See the full report here: https://www.bleepingcomputer.com/news/security/oscar-nominated-movies-featured-in-phishing-malware-attacks/

Community Housing Nonprofit Hit with $1.2M Loss in BEC Scam

In a business email compromise(BEC) campaign, Red Kite Community Housing, a coop housing association in High Wycombe, U.K. lost more than $1.2 million to cybercrooks. The attackers set up an imposter website and fake email addresses purporting to be known suppliers to Red Kite. The attack took place in August 2019, after which Red Kite notified its members and upgraded its security posture.

See the full report here: https://threatpost.com/community-housing-nonprofit-bec-scam/152563/

Phishing Campaign Targets 250 Android Apps with Anubis Malware

According to the researchers at Cofense, a new phishing campaign is targeting more than 250 Android applications to deliver sophisticated malware called Anubis. The phishing mail includes a link, which when opened from an Android device, downloads an APK file (Fattura002873.apk) and if banking, financial or marketplace applications are identified, the Anubis malware overlays the original application with a fake login page to capture the user's credentials. If installed, the malware’s capabilities include capturing screenshots, enabling or changing administration settings, opening and visiting any URL, recording audio and initiating phone calls.

See the full report here: https://threatpost.com/phishing-campaign-targets-250-android-apps-with-anubis-malware/152666/

Over 4.5L card records from India uploaded on Darknet - ETtech.com

A database containing card details of more than 450,000 individuals have been uploaded on the darknet's largest carding fraud forum, Joker's Stash. According to Group-IB, nearly 98% of the cards belong to large Indian banks. However, the source of the database remains unknown. As of now, 16 cards have been sold and the underground market value of the database is estimated to be more than $4.2 million at $9/card.

See the full report here: https://tech.economictimes.indiatimes.com/news/internet/details-of-450000-payment-card-details-of-indian-banks-leaked/74013671

Emotet Hacks Nearby Wi-Fi Networks to Spread to New Victims - BleepingComputer

Emotet Trojan features a Wi-Fi worm module to spread the malware to new victims connected to nearby insecure wireless networks. The process starts by using wlanAPI.dll calls to discover wireless networks around an already infected Wi-Fi-enabled computer and brute-forces its way in if they are password protected. Upon a successful connection with the network, the worm finds other Windows devices with non-hidden shares. All accounts on the compromised devices are scanned and broken inside to drop a malicious payload in the form of the service.exe binary. A new service named "Windows Defender System Service" is installed to gain persistence on the system.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-hacks-nearby-wi-fi-networks-to-spread-to-new-victims/

Hackers deface Facebook's official Twitter and Instagram accounts

Facebook's official accounts on Twitter and Instagram were hacked and defaced by a hacker group, OurMine. Currently, details of how the defacements took place are unclear. However, tweets posted by the OurMine crew on the hijacked accounts are emanating from the Khoros app. All hacked accounts have now been restored into Facebook's possession and the defacement posts removed.

See the full report here: https://www.zdnet.com/article/hackers-deface-facebooks-official-twitter-and-instagram-accounts/

Windows 7 bug prevents users from shutting down or rebooting computers

Users of Windows 7 have reported a new bug where they receive a popup message that reads "You don't have permission to shut down this computer" every time they attempt to shut down or reboot their systems. Currently, the cause of the bug is unknown. A workaround & an unofficial fix has been put forward by several users on Reddit and by IT support firm Quick Heal. Microsoft has announced the official end-of-life for Windows 7 on 14th January 2020.

See the full report here: https://www.zdnet.com/article/windows-7-bug-prevents-users-from-shutting-down-or-rebooting-computers/

US Charges Chinese Military Hackers for Equifax Breach - BleepingComputer

The U.S. Department of Justice has charged four members of the Chinese People’s Liberation Army (PLA) 54th Research Institute, for hacking Equifax in 2017. The four members, Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei, allegedly broke into Equifax systems and stole obtained names, birth dates, social security numbers driver's license numbers and credit card information of nearly half of all American citizens. In addition, the PLA hackers obtained personally identifiable information belonging to nearly a million citizens of the United Kingdom and Canada.

See the full report here: https://www.bleepingcomputer.com/news/security/us-charges-chinese-military-hackers-for-equifax-breach/

Docker Registries Expose Hundreds of Orgs to Malware, Data Theft

According to Palo Alto Networks’ Unit 42 division, misconfigured Docker container registries have exposed source code for nearly 15,887 unique versions of applications owned by research institutes, retailers, news media organizations and, technology companies due to improper network access control. Researchers were able to identify 941 Docker registries exposed to the internet and 117 registries accessible without authentication. The unsecured repositories in total accounted for 2,956 vulnerable repositories and 15,887 vulnerable docker images. Misconfigured Docker registry could leak confidential data, lead to a full-scale compromise and interrupt the business operations. The firm recommends adding firewall rules to restrict access and enforce authentication of API requests.

See the full report here: https://threatpost.com/docker-registries-malware-data-theft/152734/

12,000+ Jenkins servers can be exploited to launch, amplify DDoS attacks

According to Radware researchers, more than 12,000 internet-facing Jenkins servers can be abused to mount and amplify reflective DDoS attacks. Tracked as CVE-2020-2100, this vulnerability is caused by a network discovery service (UDP multicast/broadcast) that is enabled by default and exposed in publicly facing servers. Attackers can abuse the exposed Jenkins servers by reflecting UDP requests off port UDP/33848, resulting in an amplified DDoS attack containing Jenkins metadata. The vulnerability is fixed in Jenkins 2.219 and LTS 2.204.2. Additionally, administrators can also add firewall policy to block access to port UDP/33848.

See the full report here: https://www.helpnetsecurity.com/2020/02/11/cve-2020-2100/

Dell Patches SupportAssist Flaw That Allows Arbitrary Code Execution

Dell has patched a high-severity flaw in its SupportAssist software that allows a local user to use DLLs to escalate privileges and affect Windows systems. The vulnerability, tracked as CVE-2020-5316, could allow a locally authenticated user with low privileges to load arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code. The vulnerability affects Dell SupportAssist for business PCs version 2.1.3 or older and home PCs version 3.4 or older. Though all versions of SupportAssist automatically upgrade to the latest version, customers are advised to check if they are running a vulnerable version and upgrade to the latest available version of SupportAssist.

See the full report here: https://threatpost.com/dell-patches-supportassist-flaw-that-allows-arbitrary-code-execution/152771/

Amex, Chase Fraud Protection Emails Used as Clever Phishing Lure - BleepingComputer

In a new phishing campaign discovered by MalwareHunterTeam, scammers are spoofing fraud protection emails from American Express and Chase, asking users to confirm the legitimacy of charges from Best Buy, TOP-UP B.V., and, SQC*CASH APP. Victims receiving these phishing emails may assume that their card has been stolen and dispute the transactions. Upon which, the victim will be directed to a fake Chase or Amex login site where the "verification" process has to be done by entering their login name and password, address, birth date, social security number, and, bank card and credit card information. Moreover, the collected information is transmitted to the scammer's server where it can be used for identity theft, dark web sales, or other malicious activities.

See the full report here: https://www.bleepingcomputer.com/news/security/amex-chase-fraud-protection-emails-used-as-clever-phishing-lure/

Estée Lauder Exposes 440M Records, with Email Addresses, Network Info

Security Researcher, Jeremiah Fowler discovered an unsecured cloud database containing the records of hundreds of millions of customers of a cosmetic company, Estée Lauder. The database contained nearly 440,336,852 individual data pieces that exposed plaintext email addresses (including internal email addresses from the @estee.com domain), reams of logs for content management systems (CMS) and middleware activity. Payment data or sensitive employee information was not included in the exposed records. Following the incident, the company closed the database.

See the full report here: https://threatpost.com/estee-lauder-440m-records-email-network-info/152789/

Office 365 Users Get Automated Protection From Malicious Docs - BleepingComputer

Microsoft announced a new security feature for the Office 365 ProPlus customers, named, Safe Documents. Safe Documents is an Office 365 Advanced Threat Protection (ATP) feature that automatically checks Microsoft Office documents against known threat profiles and risks before allowing the users to open them. The update is available in private preview for Microsoft 365 E5 and E5 Security customers. Safe Documents will be rolling out in stages, to be initially available for tenants from the U.S., the U.K., and the European Union.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-users-get-automated-protection-from-malicious-docs/

WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users - BleepingComputer

WordPress users are urged to update the GDPR Cookie Consent plugin to the patched version to mitigate a critical security bug that allows attackers to delete and change content and inject malicious JavaScript code due to improper access controls. The vulnerability affects version 1.8.2 and earlier and doesn't yet have a CVE ID assigned.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-cookie-consent-plugin-fixes-critical-flaw-for-700k-users/

Microsoft Patches Actively Exploited Internet Explorer Zero-Day - BleepingComputer

An actively exploited zero-day remote code execution (RCE) vulnerability (CVE-2020-0674) impacting Internet Explorer receives a security patch from Microsoft. According to Microsoft, the vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. The mitigation measures released earlier were breaking printing due to printer drivers and software utilizing the jscript.dll. However, it is not known at this time if the latest security updates addressing the IE flaw will continue to cause issues with printing.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-patches-actively-exploited-internet-explorer-zero-day/