Phishing to Blame for iNSYNQ Ransom Attack

iNSYNQ, a QuickBooks cloud hosting firm, was hit by a MegaCortex attack July 16. New details have come to light surrounding the attack after a customer briefing was held August 8. Nearly 50% of customer files were encrypted in the attack. At present, most of the data has been recovered, and only 10% remains encrypted.

Recommendations

Use caution when opening unexpected emails, especially from unknown senders
Maintain and frequently update offline backups of all critical information
Ensure defensive systems are updated with the latest detection
Consider enabling the Cyber Chatter rule in order to monitor activity related to this malware family

Details

In mid-July, iNSYNQ fell victim to the MegaCortex ransomware. MegaCortex is known for scaling ransom demands to its victim's perceived ability to pay, ranging from $20,000 to nearly $6 million. Although iNSYNQ has declined to release the amount demanded of them, chief executive Elliot Luchansky has stated it was a "very substantial amount." Ultimately, the firm has declined to pay the ransom.

Additionally, Hold Security, has disclosed that they have discovered dark web chatter related to the compromise, indicating that the attack began July 6, when an employee fell for a phishing attack. Given that the date of compromise was July 16, this means attackers would have maintained system access for 10 days prior to data encryption.

Breaking News - 08.12.2019

Canon DSLR Cameras Can Be Hacked With Ransomware Remotely

Vulnerabilities have been identified in several Cannon DSLR cameras, including the PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5X Mark II. These vulnerabilities are within the implementation of picture transfer protocol within these Canon devices. All could be exploited over WiFi or USB, and could result in an attacker taking control of the device. Potentially, these vulnerabilities could be leveraged in order to hold a victim's devices for ransom.

See the full report here: https://thehackernews.com/2019/08/dslr-camera-hacking.html

Facebook hits two app developers with lawsuit

Two Chinese developers are being sued by Facebook, over alleged ad fraud. LionMobi and JediMobi, based in Hong Kong and Singapore respectively, purportedly planted malware on people's phones in order to generate fake clicks on Facebook ads. These clicks generated payouts from Facebook, through the social network's ad platform. This malware was allegedly delivered through malicious mobile apps, posing as tools to "clean" a device, a calculator, and a battery life extender.

See the full report here: https://www.welivesecurity.com/2019/08/08/facebook-android-app-developers-lawsuits/

Suspected BITTER APT Continues Targeting Government of China and Chinese Organizations

A phishing campaign has been spotted impersonating the Chinese Ministry of Foreign Affairs. Using Let's Encrypt certificate information, researchers have identified this group responsible for this site as the BITTER APT. Sites have also been seen impersonating the China National Aero-Technology Import and Export Corporation, the National Development and Reform Commission, and the Ministry of Commerce.

See the full report here:

Cloud Atlas threat group updates weaponry with polymorphic malware

Cloud Atlas, an APT known to target Russia, Ukraine, and parts of Europe, is now using polymorphic components in their infection chain. The latest attacks seen coming from this APT utilize polymorphic code in the HTML and Visual Basic droppers, which serve to drop additional malware to steal passwords and other sensitive information.

See the full report here: https://www.zdnet.com/article/cloud-atlas-threat-group-updates-weaponry-with-polymorphic-malware/