Threat Intelligence Bulletin: 08/30/2019 - 09/05/2019

Four Data Breaches Occurred This Week

Four data breaches were disclosed this week, affecting Coinmama, XKCD, Mastercard, and Poshmark. For full details on these breaches, please see the full disclosures here:

Coinmama: https://cloud.zerofox.com/alpha_team/advisories/713

XKCD: https://cloud.zerofox.com/alpha_team/advisories/714

Mastercard: https://cloud.zerofox.com/alpha_team/advisories/715

Poshmark: https://cloud.zerofox.com/alpha_team/advisories/716

Alpha Team Research: ChucklingSquad, Jack Dorsey and SIM Swaps

On 30 August 2019, Jack Dorsey, the CEO of Twitter, had his Twitter account hacked. The actors who compromised the account controlled it for only a few minutes, but managed to send dozenz of tweets containing racist language, a bomb threat and shoutouts to the "hacker" group. The account, @jack, has over 4 million followers, and according to a tweet by a Twitter spokesperson, "The phone number associated with the account was compromised due to a security oversight by the mobile provider. This allowed an unauthorized person to compose and send tweets via text message from the phone number. That issue is now resolved". The tweets by @jack were being posted via the Cloudhopper app, which means it came from someone texting the 40404 number to tweet on Dorsey's behalf.

Recommendations

• Authenticate your organization's Twitter accounts with ZeroFOX and enable Hacked Account Post, which now contains the actor groups signatures
• Review the whitelist of Twitter applications on ZeroFOX and uncheck "Cloudhopper" as a trusted app. Enable the Unauthorized Application rule which will alert if someone SIM swaps your protected accounts and tweets via the Cloudhopper app
• Enable the Cyber Attack Chatter rule and add monitoring for the actor group, with the indicators listed under Details
• Work with your ZeroFOX Account Manager and Platform Specialists to ensure protection of all of your social accounts

Details

The group, ChucklingSquad, has been on an account takeover tear for the last 2 weeks. On August 23rd, 2019, influencers Amanda Cerny, Etika and Shane Dawson's Twitter and Instagram accounts had been hacked. The actors tweeeted at Youtube influence Keemstar via Shane Dawson's hacked account and bragged about "intel on jake Paul" [sic] and other influencers. It seems that their modus operandi is to perform a SIM swap attack against their victims. A SIM swap attack is where an attacker socially engineers a mobile phone company employee to transfer the "SIM" card from the account owner to an attacker controlled phone. Using the phone number that they just took over, SIM Swappers can easily reset passwords, take over accounts and in this case, post on behalf of the victim.

Each Twitter and Instagram profile contained offensive tweets or posts that clearly broke Terms of Service on the networks. The goal up to that point looked to be to gain notoriety and to troll the community with their account takeovers. KingBach, an influencer and a verified account on Twitter, made a video shortly after his hack that blamed AT&T for allowing hackers to easily takeover his phone number. James Charles made a similar tweet blaming his mobile company.

On or around 1600 on August 30, Dorsey's account was hacked.

The account contained a bomb threat, racist words, retweets of alleged members of ChucklingSquad, and a link to their Discord server. User's began tweeting out invites to the discord which were quickly banned by Twitter. The Discord server appears to be disabled now as well.

One of Dorsey's tweets called out specific members of ChucklingSquad, asking for them to be unbanned:

Alpha Team has HIGH confidence that this was the result of a SIM swap attack. The app, Cloudhopper, is used to activate SMS based tweets and account management for Twitter users. Dorsey's tweets did indeed come from the Cloudhopper app, and due to the previous ChucklingSquad hacks, it would be the easiest way to tweet on Dorsey's behalf without compromising his password or email address. If a user sets up 2-factor authentication with their phone number in Twitter, they are automatically enrolled into this SMS service. This auto enrollment is common amongst social networks, and Facebook faced backlash of this auto enrollment feature and turned it off for users.

The specific accounts listed in the previous tweet are now banned, but ZeroFOX Alpha Team performed an investigation on the aliases. Plugwalkjoe is a name that has been attributed to an OGUser account, j0e, and has made a number of enemies that try to dox him.

Post from pastebin, PII removed:

*FOR THE IMMEDIATE ATTENTION OF REACT TASK FORCE - SANTA CLARA*

Hello,

I am writing in regarding Sim Swap attacks. I have gathered intelligence of how the scheme works, 
and have discovered who is behind "Chuckling Squad".

Debug from the United Kingdom
He is also responsible for the rumored theft of $60K+ in cryptocurrency.
https://twitter.com/bug
https://ogusers.com/dewdnuioed

Gurv from the United Kingdom
Responsible for the theft of over $1M in cryptocurrency.
Full name - redacted 
Address -  redacted
Date Of Birth: redacted 
https://ogusers.com/gurv [banned]
https://instagram.com/L

Plugwalkjoe from the United States or United Kingdom. I am not sure.
https://ogusers.com/j0e
https://instagram.com/L
Face - redacted 

Plugwalkjoe is responsible for hundreds of illegal sim-swaps, and plays the role of the "plug". 
Plugwalkjoe activates sim cards for the thieves or trolls. 
He can do this for any major carrier, from Verizon to AT&T and T-Mobile.

From what I know, members Debug and Gurv provide the P.I.I (Personal Identifying Information) to member Plugwalkjoe, 
who then performs the alleged "sim swap", 
activating another unknown member's sim-card, who provides the SMS verification codes to 
reset passwords to members Debug, Gurv or Alpha.
I have not scooped up any information yet on Alpha, but I am on it! I will be keeping in touch, 
and awaiting an article stating that these bad guys were locked up.

Even Brian Krebs, a well-established cybersecurity reporter, is aware of Plugwalkjoe's antics, dated in November of 2018.

A post by Krebs in response to someone commenting on "plugs":

Right. That’s why Phobia has friends like @Plugwalkjoe who chides Phobia and 
his Team Hype friends for dropping valuable methods for hacking accounts.

https://twitter.com/CoolItsConvict/status/1045849836124278785

Account takeover is alive and well. SIM Swap attacks are extremely effective, especially in the account takeover community, because once an attacker controls a phone number, they can reset passwords via text messages and through phone calls. The reliance on phones as an authentication mechanism is an antiquated idea, solely because mobile companies have been notorious for not adhering to anti-social engineering protocols.

Many account takeover forums, especially OGUsers, specialize in recruiting mobile employees to perform SIM swaps as well as providing training for wanna-be swappers to perform these attacks. The recent hack of OGUsers hasn't deterred people from still using the site, and with the current attribution of some of the ChucklingSquad users back to OGUsers, it seems to be still going strong.

Indicators of Compromise:

Hashtags

#chuckling
#chucklinghella
#chucklingsquad

Twitter Accounts

@plugwalkjoe
@percocet
@99

Alpha Team Research: Cazanova Haxor Actor Profile

Alpha Team has been tracking a phishing kit author, who has just released a new kit targeting Netflix customers, as of 08.26.2019 at approximately 4 PM EST. This actor is known as Cazanova Haxor, and has been active on both Facebook and Twitter since 2014. This actor’s phishing kits are heavily marketed on a public Facebook group, which has been online since 06.20.2017. This group at present has 20,703 likes and 40,801 follows.

Recommendations

• Consider enable the Cyber Attack Chatter rule to monitor for phishing activity related to your organization.
• Never click links in emails from unknown senders, or in emails that seem in any way suspiscious.

Details

This actor has written and released phishing kits targeting at least three major US companies. Targets include organizations in the entertainment, software, and financial services sectors. In addition to these phishing kits, Cazanova Haxor has also developed a mass-mailer tool called ZLetter. Graphics and design of the kits associated with this actor are of a higher quality than the average phishing kit, suggesting some level of professionalism.

Figure 1. Teaser graphic posted to marketing Facebook page, prior to Cocaine kit release.

Payment and Purchasing Structure

Figure 2. Pricing of various kits offered by actor Cazanova Haxor.

Kits sold by this author go for $99 each, while the mass-mailer is priced depending on the length of time desired. Payment and licensing is done using a central site, via bitcoin, to an address specified on the site. After submitting payment to a specified wallet, users are asked to submit their own bitcoin wallet address to the site, so that kits may be enabled on accounts that have paid for them. The payment wallet used for these kits has been active since June 29, 2019.

Figure 3. Activity to and from payment wallet from 06.29.19 to 08.27.19.

At present bitcoin pricing, this wallet has been the recipient of just under $3000 USD, which indicates that up to 30 kit licenses could have been purchased over the two-month activity period of this wallet.

Kit Features

Figure 4. Features of the Cocaine kit as listed by actor.

Kits generally, as described on the licensing site, indicate that they can be used in multiple languages, and will even validate that emails provided to the kit belong to valid user accounts. Kits phish for login credentials, identity documents, selfies of users with their identity documents, as well as photos of credit cards. Some features appear to be ubiquitous to kits developed by Cazanova, as all kits are advertised as having advanced anti-bot capabilities, Captcha systems, and free updates, among other things. True to their word, this author does actively update kits, releasing a new update every few weeks.

Figure 5. Update 1.5 of the Adrenaline kit.

Conclusion

Although this operation appears to be smaller in scale, the kits produced by Cazanova Haxor are of high quality to the point that they are of concern to the organizations targeted by this actor. Kit design is excellent, and expertly imitates the sites being impersonated. These landing pages are convincing enough that users who are targeted in these scams could very easily fall for them. These kits demonstrate that although phishing attacks are nothing new or novel, they will likely remain popular because they can be lucrative if executed well, as in this case.