Threat Intelligence Bulletin: 08/02/2019 - 08/08/2019

Alpha Team Research: Deep Dive into Rewards Carding

Rewards carding is a popular method of financial fraud. Generally, this kind of fraud tends to go unnoticed by banking customers much more than a drained bank account or suspcious credit card activity would. These rewards points can actually be very valuable, however. They can be used to book hotel rooms and flights, or to purchase expensive retail goods. The sparseness of monitoring and protection, combined with the high potential value, makes this a very appealing target for scammers.

In this post, Alpha Team discusses one particular rewards carding forum, Cardhouse, and how it is used and promoted on the dark web and otherwise.

Recommendations

• Enable multi-factor authentication on your accounts whenever possible
• Actively monitor rewards accounts for suspiscious activity
• Consider enabling dark web rules in order to monitor activity related to your protected entities on the dark web

Details

Cardhouse is a so-called "carding service provider," where a small group of carders offer their services to purchase goods at a discount from retail price. The carders on this site target American Express accounts with high numbers of rewards points. These points are then stolen from the account and used to purchase items of the fradulent purchaser's choosing - usually high-dollar electronics. The site has been advertised via direct message over Discord, seemingly at random. Throwaway accounts are used to send messages with details about the site and services offered.

Once an item is purchased on the site, it is sent to a drop-reshipper. Drop-reshipping is used both to avoid international shipping fees, as well as to provide a level of anonymity to the sender. Generally, the purchaser of the stolen goods will ship the goods to a reshipper, generally a person recruited through a work-from-home scam, and then the object is re-shipped to the buyer of the goods. These re-shippers are generally employed for a very short period of time so that they do not actually have to be paid. The exact re-shipping configuation of the Cardhouse site is unknown, but they claim that their reshipping process "make[s] it impossible for feds to link you to the purchase." Cardhouse will not ship goods to Ghana, Albania, Algeria, or Nigeria. Scammers often avoid doing business within their home countries, to prevent potentially unwanted legal attention, so this could indicate the location of the carders offering their services on this site.

The site charges buyers 30% of the retail price of the desired object, and the site has set a $300 minnimum order so that they are able to cover their costs. Payment is accepted through gift card, debit card, or cryptocurrency. To submit an order, users simply have to submit a form on the site with their desired carder and discord username. All further business is discussed over Discord, a popular game chat platform. In order to bolster their credibility, the scammers have posted "vouches" or reviews from supposedly happy customers. These images show iPhones, expensive gaming chairs, and laptops that purportedly were purchased via Cardhouse. Images include shipping boxes, where a label starting "CARDHOUSE[.]*** ORDER ####" is displayed.

In their FAQ, hosted on pastebin, the group claims to utilize a secret AmEx account carding method, and that users of the service will not go to jail.

Q: Wont I go to jail for this?

A: NO. We are fed up with newcomers quizzing our carders as if they know more about OpSec then we do. 
For one, we use an amex account carding method which is a practically unknown method. Reward point carding 
is very safe as most if not all victims don't call police due to missing reward points, they simply contact 
their bank and get reimbursed assuming they care enough. Even if they did happen to call the police, all 
items we card are shipped to our drop re-shipper and then shipped to you (unless you have your own drop available).

Unfortunately, the scammers aren't necessarily wrong. This type of fraud does tend to go unnoticed - and when affected customers do report it, banks and card companies tend to refund the points without much further investigation. Alpha Team urges readers to follow the recommendations in this post, in order to better protect themselves and their organizations.

Names and Addresses of Over 2000 Journalists Leaked by E3 Trade Show

Major tech trade show E3 has leaked the personal addresses of 2000 journalists who registered to attend the 2019 iteration of the conference. This database was available publicly on the conference website, but has since been taken down. Although E3 has released a statement regarding the leak, the damage has been done and this database has been circulated online.

Recommendations

• Consider enabling the Compromised Credentials rule to monitor involvement in future data breaches
• Consider enabling the Dark Web Mentions rule in order to monitor dark web activity related to your montored entities

Details

Youtuber Sophia Narwitz has discovered a spreadsheet containing the names and personal addresses of 2000 journalists who attended E3 2019, a popular electronics trade show. The database was freely available on the E3 website, and was titled "Registered Media List." Sophia promptly contacted the ESA, and they have since removed this spreadsheet.

This breach affects journalists from publications including Vice, Polygon, IMDb, and also Twitch and YouTube content creators. ESA has made the following statement regarding the breach:

ESA was made aware of a website vulnerability that led to the contact list of registered journalists
attending E3 being made public. Once notified, we immediately took steps to protect that data and
shut down the site, which is no longer available. We regret this occurrence and have put measures in
place to ensure it will not occur again.

News of the breach has since spread across Twitter, and has been posted about by a few nefarious groups known to hold journalists in contempt. Alpha Team highly recommends considering the use of the Dark Web Mentions rule to monitor for potential information leak of important entities on the dark web.

Spotlight on APT41

APT41 is a Chinese actor group, targeting mainly organizations in the video game industry. Researchers at FireEye have released a comprehensive report tracking the group's activity since 2014, and have proposed evidence linking the group to two personas based on DNS registratiion information as well as online activity times.

Recommendations

• Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat
• Ensure defensive systems are up to date with the latest detection
• Blacklist network infrastructure associated with this campaign
• Remain alert to potential phishing attacks on social media, email, and other platforms

Details

APT41 is a Chinese espionage and cybercrime group, with activity dating back to 2014. Although historically, the group has targeted the video game industry, in recent years, targets have shifted to include the telecom, healthcare, education, and high-tech industries. Attacks against the video game industry are generally financially motivated for the group. Often, the group will include backdoors with legitimate software. One such example is the case of the Infestation and PointBlank game compromises. Both games were injected with CRACKSHOT, a dropper used to download and execute files directly in memory.

FireEye has attributed activity associated with APT41 to Chinese individuals working on behalf of the state. Two individuals have been identified, using monikers Zhang Xuguang and Wolfzhi that have been linked to the group based on time of activity, amongst other things. Both individuals can be linked to APT41 via email and domain registration. Many domains utilized in APT41 campaigns were registered to emails associated with these individuals. This registration information also included Chinese location information and phone numbers. Many other domains registered to these emails are spoofing legitimate gaming companies - which is often seen utilized in the group's attacks.

New Phishing Campaign Uses DocuSign to Bypass Email Gateway

New phishing campaigns have been seen to spoof DocuSign, a digital document signature platform, in order to steal credentials. These phishing emails redirect to malicious fake login pages for a variety of email platforms, where victims are prompted to enter their email credentials. This is yet another example of attackers piggybacking off of the credibility of legitimate organizations, in order to give their attacks an air of legitimacy.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover
• Always verify the sender of suspicious or unexpected emails
• Never download attachments from unknown senders or suspicious email
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

A new phishing campaign has been identified, leveraging DocuSign in orer to bypass email gateway and steal credentials. DocuSign is a popular signature software often used in digital signing of legal documents. Lure documents associated with this campaign spoof legitimate DocuSign emails very well, making the attack difficult to detect.

Example of a phishing email spoofing legitimate DocuSign emails

The link embedded in these emails, however, is not to DocuSign, but an attacker-controlled phishing domain.

Example phishing landing page, when link in email is clicked

Each of these options directs to a phishing page spoofing the log in for the email provider chosen. These pages are used to harvest credentials and compromise email accounts, which can be used in other attacks.

Breaking News: 08.02.2019 - 08.08.2019

New Lord Exploit Kit Discovered

A new exploit kit has been discovered by researchers at Virus Bulletin. Dubbed Lord, this is the first exploit kit seen to use ngrok. Ngrok is a service that can be used to expose a local web server to the internet. The kit also checks for vulnerable versions of Adobe Flash Player, before attempting to exploit CVE-2018-15982.

See the full report here: https://www.virusbulletin.com/blog/2019/08/virus-bulletin-researcher-discovers-new-lord-exploit-kit/

New Banking Trojan: Amavaldo

In a deep dive into Latin American banking trojans, researchers at ESET have identified a new malware family named Amavaldo. Written in Delphi, this trojan targets Spanish and Portuguese speaking countries, and seeks to use social engineering to exfiltrate sensitive banking information from infected devices. It is still actively been developed and utilized by attackers.

See the full report here: https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/

No Summer Break for Magecart as Web Skimming Intensifies

Magecart, a notorious cybercrime group, continues their barrage of web-skimming attacks with 65,000 attempts seen in July. In particular, the group is targeting e-commerce sities in order to skim payment information.

See the full report here: https://blog.malwarebytes.com/web-threats/2019/08/no-summer-break-for-magecart-as-web-skimming-intensifies/

Fraudster Stole $870,000 from 2 US Universities

A good win for victims of Business Email Compromise and Spear-Phishing. Amil Hassan Raage co-conspired with fraudsters from Kenya to send fraudulent emails to University of San Diego and managed to get them to 1 million dollars to his Wells Fargo account in Minnesota. When law enforcement caught on, he fled to Kenya where the Kenyan government and the FBI arrested and extradited him back to the US.

See the full report here: https://securityaffairs.co/wordpress/89408/cyber-crime/spear-phishing-frauds.html

Cloudflare Terminates Service to 8chan After Recent US Shootings

8Chan is notorious for hosting discussions for the *chan culture in a more edgy fashion. Recently, they've been associated with hosting manifestos by the perpetrators of the New Zealand, Poway and El Paso mass shootings. Cloudflare has long stood by their non-regulatory stance of sites that they host, but they are taking a much harder stance on extreme websites within the last few years.

See the full report here: https://www.zdnet.com/article/cloudflare-terminates-service-to-8chan-after-recent-us-shootings/

MegaCortex Ransomware Revamps for Mass Distribution

MegaCortex, a ransomware family known for large ransom demands based on a targeted organization's perceived ability to pay, has updated to make it easier for actors to stage attacks at volume. Previously, the ransomware utiilized a unique password for each infection - however updated modules have automated this process so that the malware is able to self-install.

See the full report here: https://threatpost.com/megacortex-ransomware-mass-distribution/146933/

Machete Group Targets Venezuelan Military

An espionage campaign targeting the Venezuelan military has been uncovered. The Machete group, responsible for these attacks, have been utilizing Python tools along with their dropper and malware modules.

See the full report here: https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/

ECh0raix Ransomware Decryptor Restores QNAP Files For Free

A decryptor has been released for the eCh0raix ransomware. This malware family generally targets QNAP NAS devices, and has been active since June 2018. Many victims of the ransomware will now be able to decrypt infected devices.

See the full report here: https://www.bleepingcomputer.com/ransomware/decryptor/ech0raix-ransomware-decryptor-restores-qnap-files-for-free/

FBI Warns of Romance Scams Turning Victims into Money Mules

New research on ever-popular romance and confidence scams has been released - with over $363 million in losses reported. Interestingly, this research actually shows that victims of these scams tend to be used as money mules for funds gained due to business email compromise, in order to transfer funds for scammers.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-romance-scams-turning-victims-into-money-mules/

New Flaws in Qualcomm Chips Expose Millions of Android Devices to Hacking

New vulnerabilities have been identified in the Qualcomm chipsets used in many Android devices. Exploitation of these vulns could allow a remote attacker to hijack control of a targeted device.

See the full report here: https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html

Security researchers warned for years about the cloud-security flaw used in the massive Capital One hack, but Amazon apparently leaves it up to customers to protect

New information has surfaced regarding the Capital One database breach. The vulnerability that likely allowed for breach, is a server-side request forgery that has been known since 2014. Alpha Team highly recommends customers enable the compromised credentials rule in order to monitor for their involvement in future breaches.

See the full report here: https://www.businessinsider.com/capital-one-hack-vulnerability-on-cloud-amazon-known-for-years-2019-8

Ransomware, “wiper” malware attacks have more than doubled, IBM team says

Research teams at IBM claim that they are seeing a 200% increase in ransomware and wiper malware attack, over the last six months. 50% of cases seen by the team were attacks against organiziations in the manufacturing industry. Oil and gas, and education sectors are also often targeted.

See the full report here: https://arstechnica.com/information-technology/2019/08/ransomware-wiper-malware-attacks-have-more-than-doubled-ibm-team-says/

Unpatched KDE vulnerability disclosed on Twitter

An unpatched vulnerability in KDE Frameworks has been publicly disclosed. Successful exploitation of this vulnerability could result in malicious code being run on a targeted device. A proof of concept has been released publicly, and prior to the notification of the vendor by the researcher, who did not follow any sort of responsible disclosure policy, and claims he just wanted to release an 0-day prior to Defcon.

See the full report here: https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/

Sephora’s Online Customers Suffer Data Breach

Makeup retailer Sephora has suffered a data breach, with 3.7 million customer records exposed. These records are of customers in Hong Kong, Singapore, Thailand, Indonesia, Phillipines, Malaysia, Australia, and New Zealand. No credit card information has been compromised. This breach comes in the wake of the recent breaches of an additional 10 French companies.

See the full report here: https://www.cisomag.com/sephoras-online-customers-suffer-data-breach/

Smominru hijacks half a million PCs to mine cryptocurrency, steals access data for Dark Web sale

A new Monero miner, called Smominru, has managed to infect over 500,000 machines. This malware mainly targets victims in the Asia Pacific.

See the full report here: https://www.zdnet.com/article/new-cryptojacking-campaign-strikes-half-a-million-pcs/

New Windows malware can also brute-force WordPress websites

A new malware family is making the rounds. Dubbed Clipsa, this malware seeks to infect Windows devices, then scans for cryptocurrency-related files, and uses these files to hijack cryptowallets. The malware also launches brute-force attacks againsty WordPress sites, likely seeking to steal sensitive information from breached sites.

See the full report here: https://www.zdnet.com/article/new-windows-malware-can-also-brute-force-wordpress-websites/

Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer

Binance, the world's largest cryptocurrency exchange, has been hit with a ransomware attack. The ransom demand is bitcoin currently valued at a shocking $3.5 million USD. The attacker has purportedly started a Telegram group, where ID documents for Binance customers have been released. At this time, Binance has refused to pay the ransom demand, and has released a statement. Binance claims "images posted to the attacker's Telegram group lacks the digital watermark the exchange uses for its internal information, adding doubts about its authenticity."

See the full report here: https://thehackernews.com/2019/08/binance-kyc-data-leak.html

LokiBot malware now hides its source code in image files

In the midst of a spike of malware campaigns utilizing steganography for concealment, LokiBot has begun to utilize the technique. Samples have been identified hiding source code within image files.These images can actually be opened as image files, despite containing code used in the malware's unpacking process, making it difficult for users to detect attacks.

See the full report here: https://www.zdnet.com/article/lokibot-information-stealer-now-hides-malware-in-image-files/

Varenyky: Spambot à la Française

Malware targeting French organizations has been on the rise since May 2019. Two of the most prominent of these campaigns are a malvertising campaign, which redirects victims to malicious ads, and a sextortion campaign. This malware is generally spread through email.

See the full report here: https://www.welivesecurity.com/2019/08/08/varenyky-spambot-campaigns-france/

The Curious Case of a Fileless TrickBot Infection

Researchers at IBM have observed recent changes to the TrickBot banking trojan. New versions of this malware, specifically the ones targeting 64-bit Windows 10 machines, are now completely fileless, making it more difficult for AV to detect. TrickBot first appeared on the scene in 2016, and since then, has continued to steal banking credentials.

See the full report here: https://securityintelligence.com/posts/the-curious-case-of-a-fileless-trickbot-infection/

MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play

Korean and Japanese Android users are at risk from a new family of malware. A new campaign called MoqHao, has been disguising itself as security and police apps on the Google play store. These applications are actually spyware, which seeks to exfiltrate information about the victim for the attacker.

See the full report here: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/

New SWAPGS Side-Channel Attack Bypasses Spectre and Meltdown Defenses

A new side-channel attack against Intel microprocessors has been released, which can bypass all mitigations put in place for the Spectre and Meltdown attacks.To successfully exploit this, however, an attacker would need access to data stored in memory, which is unlikely unless the system is already compromised in some way.

See the full report here: https://threatpost.com/new-swapgs-side-channel-attack-bypasses-spectre-and-meltdown-defenses/147034/