GandCrab Authors Shutdown Operations

GandCrab, a ransomware-as-a-service (RaaS) provider, is shutting down operations and their affiliates and being told to stop distributing the malware. GandCrab gained popularity in January of 2018 when they started to sell their malware as a service on crimeware forums. Two security researchers, Damian and David Montenegro, provided BleepingComputer images of the actors in an article where the operators announced their shutdown. The actors claim to have made close to $2 billion in payments.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any GandCrab related traffic on social and dark web channels
• Regularly back up critical information on your information systems to be resilient to Ransomware attacks

Details

The authors claimed to have personally made $150 million dollars from selling their service to cybercriminals. The forum post also outlined that they plan to shut down the payment servers, so victims must pay or they will lose their data forever. The screenshot provided to BleepingComputer shows that they plan to delete their announcement at the end of the month.

The post was made on popular cybercriminal forum exploit.in. The moderator for the forum shut the thread down due to people spamming the thread, and asked the authors to post the decryption keys for the public good.

Quest Diagnostics Breach

A data breach has impacted Quest Diagnostics and over 11.9 million patients are potentially impacted. The American Medical Collection Agency informed Quest Diagnostics that an unauthorized user had gained access to billing system. The data leaked contains social security numbers, medical information and financial data. At this point the specific financial data leaked is not known. The company has hired a third party firm to investigate the scope of the attack.

Recommendations

• Enable the Social Security rule to monitor for any leaked social security numbers of users within your organization
• Monitor announcement from Quest Diagnostics in order to determine if your information was a part of the breach

Details

On Monday June 3, 2019, Quest Diagnostics announced that there had been a data breach of potentially 11.9 million patient records containing social security numbers, medical information and financial data. Quest Diagnostic's collection company, American Medical Collection Agency, was the target of the attack and a billing web page was the vector of the intrusion. Currently, the scope of the financial data is not known. It is unclear from the breach what type of medical records were leaked, but at this point it is believed that no laboratory results have been compromised. Quest was made aware of the breach on May 14, but currently claims they have not been able to verify the scope of the attack on AMCA. As a result, Quest has hired a third party firm to investigate the scope of the attack and the attack vector used to gain a foothold in the system. When the scope of the breach is better understood impacted customers will be notified.

LabCorp Breach

Brian Krebs reports that the medical testing company LabCorp was a victim of a data breach where 7.7 million patient records were leaked. LabCorp reported that the patients' name, address, birthday, phone, medical provider, date of services, and account balance information were potentially included in the leak. Currently. LabCorp is sending out notices to 200,000 customers whose bank or credit card information may have been accessed. The American Medical Collection Agency, which LabCorp uses for payment collection, was the source of the breach. This is the second report this week of an AMCA affiliated company being affected. Earlier this week, Quest Diagnostics reported that some 11.9 million customer records were compromised.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Monitor announcement from LabCorp in order to determine if your information was a part of the breach
• Monitor for further medical company disclosures and breaches by the American Medical Collection Agency

Details

It has been a bad week for medical providers using American Medical Collection Agency as their billing agency. Earlier this week, we reported that Quest Diagnostics had been compromised and 11.9 million patient records were leaked. Brian Krebs reported that Quest was not the only victim in this leak and that LabCorp, a medical testing company, was also affected by the breach. LabCorp announces that 7.7 million patient records were potentially compromised. The data leaked from LabCorp customer records indicates that name, date of birth, address, phone, service dates, medical provider, and account balance information was among the information improperly disclosed. Given that the AMCA collects payments for a variety of businesses including medical providers, marketers, telecommunication companies and traffic and toll agencies, these leaks are likely just the beginning and there will likely be further disclosures about compromised records.

Platinum Malware

Researchers at Symantec have observed a new malware campaign they believe to have been conducted by the Platinum APT group. The campaign leverages an obfuscation technique known as steganography, in order to evade detection. This campaign, referred to as EasternRoppels, was first observed in 2012, and has generally targeted South and Southeast Asian countries. However, the updated obfuscation techniques used in this attack could very easily be expanded to other campaigns. These obfuscation techniques could potentially prevent security products from alerting appropriately, as they are highly complex.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any related chatter or traffic on social and dark web channels
• Ensure all antivirus definitions are up to date
• Monitor your organization's outbound network traffic and take action if suspicious or malicious domains are contacted

Details

Platinum is an APT group first reported on by Microsoft in 2016. The group is known for utilizing novel obfuscation techniques and has previously been observed using Windows hotpatches to cover their tracks. In this recent campaign, Platinum is using a multistage attack, with the obfuscation present in the secondary stage. The first stage leverages Windows Management Instrumentation, or WMI, to execute a Powershell downloader and drop a second Powershell backdoor. This backdoor serves to fingerprint the victim machine. Concurrently, a secondary piece of malware has been observed, and is believed to be the secondary stage of this attack. It is this secondary stage that Symantec has determined to be related to the Platinum group.

After some initial checks, the main backdoor utilized by the secondary stage connects to the command and control server. The HTML response of the server would initially seem to suggest that the server is down, however, this is actually a clever obfuscation trick. Within the HTML of the C2 landing page, the attackers have used permutation of HTML attributes to encode hidden data. The backdoor collects this data, and decrypts it using an encryption key that is also embedded within the HTML of the original landing page. The encryption key is hidden using a technique that attaches white space to the end of lines in a particular pattern. This method of hiding data within other data is called steganography. Decrypting this information reveals a file containing commands from the attacker.