Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for MontysThree: Industr ...

 Business

Our experts have found traces of activity of a new cybercriminal group that spies on industrial enterprises. The crooks are carrying out targeted attacks, using a tool that our researchers call MontysThree, looking for documents on victims’ computers. The group appears to have been active since at least as far   show more ...  

back as 2018. How MontysThree infects computers The cybercriminals use classic spear-phishing techniques to penetrate victims’ computers, sending e-mails containing executable files that look like documents in .pdf or .doc format to employees of industrial enterprises. Such files are typically named “Corporate data update,” “Technical specification,” “List of employee phone numbers 2019,” and the like. In some cases, the attackers try to make the files look like medical documents, with names like “Medical analysis results” or “Invitro-106650152-1.pdf” (Invitro is one of the largest Russian medical labs). What the attackers want MontysThree preys on specific documents in Microsoft Office and Adobe Acrobat formats located in various directories and on connected media. After infection, the malware profiles the victim’s computer, sending the system version, a list of processes, and desktop snapshots to its C&C server, as well as lists of recently opened documents with the extensions .doc, .docx, .xls, .xlsx, .rtf , .pdf, .odt, .psw, and .pwd in the USERPROFILE and APPDATA directories. What else MontysThree can do The authors implemented several rather unusual mechanisms in their malware. For example, after infection, the downloader module extracts and decodes the main module, which is encrypted in a picture using steganography. Our experts believe that the attackers wrote the steganography algorithm from scratch, that they didn’t simply copy it from open-source samples, as is most commonly the case. The malware communicates with the C&C server using public cloud services such as Google, Microsoft, and Dropbox, as well as WebDAV. In addition, the communications module can make requests through RDP and Citrix. What’s more, the malware creators did not embed any communication protocols in their code; instead, MontyThree uses legitimate programs (RDP, Citrix clients, Internet Explorer). So as to keep the malware in the victim’s system as long as possible, an auxiliary module modifies the shortcuts on the Windows Quick Launch panel, so when the user launches a shortcut (for example, to a browser), the MontyThree loader module is executed at the same time. Who are the attackers? Our experts see no signs linking MontysThree’s creators to past attacks. By all appearances, it is a completely new cybercriminal group, and judging by pieces of text in the code, the authors’ native language is Russian. Likewise, their main targets are most likely Russian-speaking companies; some of the directories the malware rummages through exist only in the Cyrillic version of the system. Although our experts also found account details for communications services that hint at a Chinese origin, they believe those are false flags meant to obfuscate the attackers’ tracks. A detailed technical description of MontysThree, together with indicators of compromise, is available in our post on the Securelist website. What to do For a start, convey to all employees once again that targeted attacks most often begin with an e-mail, so they need to be extremely careful when opening files, especially ones they were not expecting. To make doubly sure they understand why they need to stay alert, we recommend not only explaining the dangers of such behavior, but also fostering skills in countering modern cyberthreats using the [KASAP placeholder] Kaspersky Automated Security Awareness Platform [/KASAP Placeholder]. Moreover, to protect against sophisticated targeted attacks, use integrated security solutions that combine workstation protection, EDR capabilities, and additional tools for analyzing and defeating attacks.

image for Amid an Embarrassmen ...

 A Little Sunshine

There’s an old adage in information security: “Every company gets penetration tested, whether or not they pay someone for the pleasure.” Many organizations that do hire professionals to test their network security posture unfortunately tend to focus on fixing vulnerabilities hackers could use to   show more ...  

break in. But judging from the proliferation of help-wanted ads for offensive pentesters in the cybercrime underground, today’s attackers have exactly zero trouble gaining that initial intrusion: The real challenge seems to be hiring enough people to help everyone profit from the access already gained. One of the most common ways such access is monetized these days is through ransomware, which holds a victim’s data and/or computers hostage unless and until an extortion payment is made. But in most cases, there is a yawning gap of days, weeks or months between the initial intrusion and the deployment of ransomware within a victim organization. That’s because it usually takes time and a good deal of effort for intruders to get from a single infected PC to seizing control over enough resources within the victim organization where it makes sense to launch the ransomware. This includes pivoting from or converting a single compromised Microsoft Windows user account to an administrator account with greater privileges on the target network; the ability to sidestep and/or disable any security software; and gaining the access needed to disrupt or corrupt any data backup systems the victim firm may have. Each day, millions of malware-laced emails are blasted out containing booby-trapped attachments. If the attachment is opened, the malicious document proceeds to quietly download additional malware and hacking tools to the victim machine (here’s one video example of a malicious Microsoft Office attachment from the malware sandbox service any.run). From there, the infected system will report home to a malware control server operated by the spammers who sent the missive. At that point, control over the victim machine may be transferred or sold multiple times between different cybercriminals who specialize in exploiting such access. These folks are very often contractors who work with established ransomware groups, and who are paid a set percentage of any eventual ransom payments made by a victim company. THE DOCTOR IS IN Enter subcontractors like “Dr. Samuil,” a cybercriminal who has maintained a presence on more than a dozen top Russian-language cybercrime forums over the past 15 years. In a series of recent advertisements, Dr. Samuil says he’s eagerly hiring experienced people who are familiar with tools used by legitimate pentesters for exploiting access once inside of a target company — specifically, post-exploit frameworks like the closely-guarded Cobalt Strike. “You will be regularly provided select accesses which were audited (these are about 10-15 accesses out of 100) and are worth a try,” Dr. Samuil wrote in one such help-wanted ad. “This helps everyone involved to save time. We also have private software that bypasses protection and provides for smooth performance.” From other classified ads he posted in August and September 2020, it seems clear Dr. Samuil’s team has some kind of privileged access to financial data on targeted companies that gives them a better idea of how much cash the victim firm may have on hand to pay a ransom demand. To wit: “There is huge insider information on the companies which we target, including information if there are tape drives and clouds (for example, Datto that is built to last, etc.), which significantly affects the scale of the conversion rate. Requirements: – experience with cloud storage, ESXi. – experience with Active Directory. – privilege escalation on accounts with limited rights. * Serious level of insider information on the companies with which we work. There are proofs of large payments, but only for verified LEADs. * There is also a private MEGA INSIDE , which I will not write about here in public, and it is only for experienced LEADs with their teams. * We do not look at REVENUE / NET INCOME / Accountant reports, this is our MEGA INSIDE, in which we know exactly how much to confidently squeeze to the maximum in total. According to cybersecurity firm Intel 471, Dr. Samuil’s ad is hardly unique, and there are several other seasoned cybercriminals who are customers of popular ransomware-as-a-service offerings that are hiring sub-contractors to farm out some of the grunt work. “Within the cybercriminal underground, compromised accesses to organizations are readily bought, sold and traded,” Intel 471 CEO Mark Arena said. “A number of security professionals have previously sought to downplay the business impact cybercriminals can have to their organizations.” “But because of the rapidly growing market for compromised accesses and the fact that these could be sold to anyone, organizations need to focus more on efforts to understand, detect and quickly respond to network compromises,” Arena continued. “That covers faster patching of the vulnerabilities that matter, ongoing detection and monitoring for criminal malware, and understanding the malware you are seeing in your environment, how it got there, and what it has or could have dropped subsequently.” WHO IS DR. SAMUIL? In conducting research for this story, KrebsOnSecurity learned that Dr. Samuil is the handle used by the proprietor of multi-vpn[.]biz, a long-running virtual private networking (VPN) service marketed to cybercriminals who are looking to anonymize and encrypt their online traffic by bouncing it through multiple servers around the globe. Have a Coke and a Molotov cocktail. Image: twitter.com/multivpn MultiVPN is the product of a company called Ruskod Networks Solutions (a.k.a. ruskod[.]net), which variously claims to be based in the offshore company havens of Belize and the Seychelles, but which appears to be run by a guy living in Russia. The domain registration records for ruskod[.]net were long ago hidden by WHOIS privacy services. But according to Domaintools.com [an advertiser on this site], the original WHOIS records for the site from the mid-2000s indicate the domain was originally registered by a Sergey Rakityansky. This is not an uncommon name in Russia or in many surrounding Eastern European nations. But a former business partner of MultiVPN who had a rather public falling out with Dr. Samuil in the cybercrime underground told KrebsOnSecurity that Rakityansky is indeed Dr. Samuil’s real surname, and that he is a 32- or 33-year-old currently living in Bryansk, a city located approximately 200 miles southwest of Moscow. Neither Dr. Samuil nor MultiVPN have responded to requests for comment.

image for Opinion: Staying Sec ...

 5G

To achieve their 5G transformation, telecommunications providers require security solutions and platforms built from the ground up for modern, dynamic business models. The post Opinion: Staying Secure Through 5G Migration appeared first on The Security Ledger. Related StoriesSecurity Ledger Turns 8!Podcast Episode   show more ...  

189: AppSec for Pandemic Times, A Conversation with GitLab Security VP Jonathan HuntPublic Sector Mega-Vendor Tyler Technologies Says It Was Hacked

 Malware and Vulnerabilities

From a guest acccount, an attacker could send the victim a specially crafted D3DKMTCreateAllocation API request to cause an out-of-bounds read, leading to a denial-of-service condition.

 Companies to Watch

The Boston-based cyber risk rating company closed a $7.5m Series A funding round led by Moore Strategic Ventures, with participation from existing investors Glasswing Ventures and Data Point Capital.

 Expert Blogs and Opinion

The introduction of the virtual war room is a new but necessary shift. To ensure its success, security teams must implement new systems and a new approach to cybersecurity.

 Malware and Vulnerabilities

This type of malicious dropper is hard to detect because its goal is not to directly execute a backdoor, remote shell, or file upload, but rather connect attackers to other malicious resources.

 Malware and Vulnerabilities

Out-of-context ads are banned on the Play Store since February this year, when Google banned more than 600 apps that were abusing this practice to spam their users with annoying ads.

 Malware and Vulnerabilities

As per research by CyberARK, certain flaws in antivirus software made by Kaspersky, McAfee, Symantec, Fortinet, and others, provide threat actors with the capability to escalate privileges in vulnerable systems.

 Companies to Watch

Existing investors Fidelity Management & Research Company, LLC, Baillie Gifford, their respective affiliates, and accounts advised by T. Rowe Price Associates, Inc. participated in the round.

 Feed

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged   show more ...  

the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.

 Feed

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.

 Feed

RedTeam Pentesting discovered a denial of service vulnerability in the D-Link DSR-250N device which allows unauthenticated attackers in the same local network to execute a CGI script that reboots the device. Version 3.12 is confirmed affected.

 Feed

Red Hat Security Advisory 2020-4214-01 - Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2020-4213-01 - Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.2.10 serves as a replacement for Red Hat support   show more ...  

for Spring Boot 2.2.6.SP2, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.

 Feed

Red Hat Security Advisory 2020-4211-01 - Red Hat AMQ Interconnect is a component of the AMQ 7 product family. AMQ Interconnect provides flexible routing of messages between AMQP-enabled endpoints, whether they are clients, servers, brokers, or any other entity that can send or receive standard AMQP messages. This   show more ...  

release of Red Hat AMQ Interconnect 1.9.0 serves as a replacement for Red Hat AMQ Interconnect 1.8.0 and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include code execution and cross site scripting vulnerabilities.

 Feed

Ubuntu Security Notice 4574-1 - It was discovered that libseccomp-golang did not properly generate BPFs. If a process were running under a restrictive seccomp filter that specified multiple syscall arguments, the application could potentially bypass the intended restrictions put in place by seccomp.

 Feed

Red Hat Security Advisory 2020-4183-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly.

 Feed

Red Hat Security Advisory 2020-4056-01 - Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

 Feed

As businesses are increasingly migrating to the cloud, securing the infrastructure has never been more important. Now according to the latest research, two security flaws in Microsoft's Azure App Services could have enabled a bad actor to carry out server-side request forgery (SSRF) attacks or execute arbitrary code and take over the administration server. "This enables an attacker to quietly

 Podcast

An internet-connected adult toy could leave its users encaged, the official NHS COVID-19 contact-tracing app alarms users, and would you be happy if a robot interviewed you for a job? All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security   show more ...  

veterans Graham Cluley and Carole Theriault, joined this week by BBC technology correspondent Zoe Kleinman.

 Google

The confirmation that US President Donald Trump has been infected by the Coronavirus, and had to spend time this weekend in hospital, has – understandably – made headlines around the world. And there are plenty of people, on both sides of the political divide, who are interested in learning more about his health   show more ...  

status. It’s no surprise, therefore, to discover that cybercriminals are exploiting that interest with the intention of infecting users’ computers. Read more in my article on the Tripwire State of Security blog.

2020-10
Aggregator history
Thursday, October 08
THU
FRI
SAT
SUN
MON
TUE
WED
OctoberNovemberDecember