Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


These campaigns were sent using newly created Gmail accounts to non-Google accounts, so the success rate of these campaigns is unknown.


We have not observed any Gmail accounts successfully compromised during these campaigns.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.


While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.


Once a user provides credentials in the dialog, they are posted to an attacker controlled domain.


Recently observed Ghostwriter credential phishing domains:


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.


On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.


These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus.


We observed the campaigns targeting U.S. based organizations spanning news media, IT, cryptocurrency and fintech industries.


However, other organizations and countries may have been targeted.


One of the campaigns has direct infrastructure overlap with a campaign targeting security researchers which we reported on last year.


The exploit was patched on February 14, 2022.


The earliest evidence we have of this exploit kit being actively deployed is January 4, 2022.


We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques.


It is possible that other North Korean government-backed attackers have access to the same exploit kit.


In this blog, we will walk through the observed tactics, techniques and procedures, share relevant IOCs and analyze the exploit kit used by the attackers.


In line with our current disclosure policy, we are providing these details 30 days after the patch release.


The campaign, consistent with Operation Dream Job, targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.


The targets received emails claiming to come from recruiters at Disney, Google and Oracle with fake potential job opportunities.


The emails contained links spoofing legitimate job hunting websites like Indeed and ZipRecruiter.


Victims who clicked on the links would be served a hidden iframe that would trigger the exploit kit.


Attacker-Owned Fake Job Domains: Exploitation URLs:


Another North Korean group, whose activity has been publicly tracked as Operation AppleJeus, targeted over 85 users in cryptocurrency and fintech industries leveraging the same exploit kit.


This included compromising at least two legitimate fintech company websites and hosting hidden iframes to serve the exploit kit to visitors.


In other cases, we observed fake websites — already set up to distribute trojanized cryptocurrency applications — hosting iframes and pointing their visitors to the exploit kit.


Attacker-Owned Websites: Compromised Websites (Feb 7 - Feb 9): Exploitation URLs:


The attackers made use of an exploit kit that contained multiple stages and components in order to exploit targeted users.


The attackers placed links to the exploit kit within hidden iframes, which they embedded on both websites they owned as well as some websites they compromised.


The kit initially serves some heavily obfuscated javascript used to fingerprint the target system.


This script collected all available client information such as the user-agent, resolution, etc. and then sent it back to the exploitation server.


If a set of unknown requirements were met, the client would be served a Chrome RCE exploit and some additional javascript.


If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX”, a common acronym for Sandbox Escape.


We unfortunately were unable to recover any of the stages that followed the initial RCE.


Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages.


These safeguards included: Although we recovered a Chrome RCE, we also found evidence where the attackers specifically checked for visitors using Safari on MacOS or Firefox (on any OS), and directed them to specific links on known exploitation servers.


We did not recover any responses from those URLs.


Example Exploit Kit:


The attackers made multiple attempts to use the exploit days after the vulnerability was patched on February 14, which stresses the importance of applying security updates as they become available.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also sent all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted or suffered from these activities.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.


&nbsp; [Lightly edited transcript of the video above] Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement.


And the reason why I want to tackle this today is because I've had some conversations in the last few days that have really kind of hit that idea bulb that people don't truly understand how cybercriminals get away with their crimes in the organization.


Specifically how they launch their attacks


Now don't get me wrong, this isn't to blame on defenders.


This isn't to blame of the general public.


I'm going to go with Hollywood's to blame a little bit here, because we're watching movies in Hollywood inevitably…you know the hackers in their dark hat and with no lighting, underground, Lord knows where they find these places to hack from and they are attacking directly through.


You see a bunch of text go across the screen and they penetrate through the first firewall, through the second firewall in into the data.


That's not how it works at all.


That's ridiculous.


It's absurd.


[00:59] It makes for interesting cinema, just like the red code/green code in CSI Cyber, but it's not a reflection of reality and that's a real challenge.


Because a lot of people don't have the experience of working with cybersecurity, working in cybersecurity, so their only perception is what they see either through media—you know TV, movies, books—or if they happen to run into somebody at in the industry.


So there is an overwhelming amount of sort of information or misinformation.


Not even misinformation, just storytelling that tries to make it far more dramatic than it is.


The reality is that cybercriminals are out for profit.


We know this time and time again—yes a bunch of nation-state stuff does happen but the vast majority of you are unaffected by it same with there's a massive amount of script-kiddie just sort of scanning random people with random tools that are just seeing what they can get away with that and if you have solid, automated defenses that doesn't really impact you.


What does impact you is the vast majority of organized cybercriminals who are out to make a profit.


Trend Micro had a great series and continues to have a great series on the Underground, the Digital Underground that shows just how deep these profit motivations go.


This is very much a dark industry.


And with that in mind we come back to the concept of lateral movement.


[02:22] If an attacker breaches into your systems, whether they come in like a fourth of all attacks do via email whether they come in directly through a server compromise, which is about half of all breaches according to the Verizon data breach investigation report or one of the other methods that is commonly used…then they start to move around within your network.


That's lateral movement.


We talk about north/south traffic with the network, which is basically inside the network to outside of the network, so out to the the internet and back.


East/west is within the network itself.


Most defenses, traditional defenses worry about that north/south traffic.


Not enough worry about the east/west and it's breaking down finally.


We are getting rid of this hard perimeter.


"It's mine, I defend everything inside" …and realizing that this is actually how cybercriminals work.


Once they're inside they move around.


So we need to defend in-depth and have really great monitoring and protection tools within our networks because of this challenge of lateral movement.


[03:23] Let me give you a little easier to digest analogy.


Most of us in a home have a grocery list and maybe once a week—maybe twice–we head to the grocery store and we try to get everything we want off the list and then we come back.


That just makes sense.


That's how we do it.


Right?


You would never think of going, "Okay.


Number one of the list is ketchup.


I'm going to drive to the store to get ketchup.


I'm going to buy it and I'm going to come back home.


I'm going to look at item number two.


I need a loaf of bread.


I'm going to drive back to the store.


I'm going to buy a loaf of bread and I'm going to come back and we can go to item 3, and I'm going to go and I'm going to come back.


I'm going to..."


That's just ridiculous, right?


That's absolutely absurd and cybercrimals agree.


Once they've driven to the store.


They're going to buy everything that they need and everything that they see as an opportunity, right?


They are really susceptible to those end caps and impulse buys... and then they're going to leave.


This is how they attack our organizations.


We know that, because of the average time to detect a breach is around 197 days right now and that stat has fluctuated maybe plus or minus 15 days for the last decade.


We also know that it takes almost three…it takes two and a half to three months actually contain a breach once you discover it and the reason for all of this is lateral movement.


Once you're in as a cybercriminal, once you've made headway, once you gained a beachhead or a foothold within that network you're going to do everything you can to expand it because it's going to make you the most amount of money.


[04:55] What do you think?


Let us know in the comments below, hit us up on social @TrendMicro or you can reach me directly @marknca.


How are you handling lateral movement?


How are you trying to reduce it?


How are you looking for visibility across all of your systems?


Let's continue this conversation because when we talk we all get better and more secure online.


Tags  Cloud | APT & Targeted Attacks | Cyber Crime | Expert Perspective | Network | Articles, News, Reports


By Federico Maggi, Rainer Vosseler (Trend Micro Research), Mars Cheng, Patrick Kuo, Chizuru Toyama, Ta-Lun Yen (TXOne Networks), Erik Boasson (ADLINK), and Victor Mayoral Vilches (Alias Robotics)


Despite being unknown even to industry practitioners, the Data Distribution Service (DDS) protocol has been in use for more than a decade.


This middleware software technology is responsible for running billions of public and private devices and mechanisms currently in use.


DDS is integral in embedded systems that require real-time machine-to-machine communication, facilitating a reliable communication layer between sensors, controllers, and actuators.


This technology is situated at the beginning of the supply chain as a layer that connects, controls, and monitors applications, sensors, and actuators, aimed at maintaining interoperability and fault tolerance.


It is used in various critical sectors such as healthcare, transportation, industrial internet of things (IIoT), robotics, aeronautics, and the military, among others.


Given these factors, this makes the middleware technology an attractive target for attackers.


We analyzed this software and found multiple security vulnerabilities.


This blog lists 13 identified security gaps that were assigned new CVE IDs found in the six most common DDS implementations, mostly concerning deployment.


We also show a preview of the security gaps we found in the standard’s specification and a summary of our testing procedure.


For details on the known vulnerabilities, attack scenarios, and research methodology, read our full paper “A Security Analysis of the Data Distribution Service (DDS) Protocol.”


All the vulnerabilities found have been disclosed and patched or mitigated by their respective vendors.


New vulnerabilities


We studied six widely used DDS implementations, chosen based on executions’ number of users and customers in the critical sectors globally.


We also looked at each implementation’s real-time publish-subscribe (RTPS) packet, as DDS is dependent on its own lower layer standard protocol.


Notably, we also studied the Robot Operating System 2 (ROS 2) because it uses DDS as its default standard operating system (OS) middleware for all robotics and automation use cases.


Given the service’s position as a security and operations building block, all vulnerabilities that affect DDS also affect the rest of the software stack, such as RTPS and all ROS 2 instances.


Product Name


Developer HQ Region Open Source


Core Language Year Developed Fast-DDS eProsima EMEA Apache License 2.0 C++ 2014 Cyclone DDS Eclipse Foundation project, driven by ADLINK EMEA Eclipse Public License 2.0 and Eclipse Development License 1.0 C 2011 OpenDDS OCI NABU Custom C++ 2005 Connext DDS RTI NABU Extensions are open source C++ 2005 (NDDS – 1995) CoreDX DDS TwinOaks NABU Not open source C 2009 Gurum DDS GurumNetworks APAC Not open source C    Table 1.


A list of all DDS implementations analyzed for this research.


MITRE ATT&CK ICS Attack Surface Vector CVE Scope CVSS Weaknesses (CWE) T0804:


Brute Force I/O T0814: DoS T0827: Loss of Control T0880: Loss of Safety T0802: Automated Collection T0846: Remote System Discovery T0856: Spoof of Reporting Message


Network RTPS discovery packet CVE-2021-38425 Fast-DDS, ROS 2 7.5 CWE-406: Network amplification CVE-2021-38429 OpenDDS, ROS 2 7.5 CVE-2021-38487 Connext DDS, ROS 2 7.5 CVE-2021-43547 CoreDX DDS, ROS 2 7.5 Malformed RTPS packet CVE-2021-38447 OpenDDS, ROS 2 8.6 CWE-405:


Network amplification CVE-2021-38445 OpenDDS, ROS 2 7.0 CWE-130: Improper handling of length CVE-2021-38423 Gurum DDS, ROS 2 8.6 CWE-131: Incorrect calculation of buffer size CVE-2021-38435 Connext DDS, ROS 2 8.6 CVE-2021-38439 Gurum DDS, ROS 2 8.6 CWE-122:


Heap-based buffer overflow T0862: Supply Chain Compromise T0839: Module Firmware T0873: Project File Infection


Configuration XML file CVE-2021-38427 Connext DDS, ROS 2 6.6 CWE-121: Stack-based buffer overflow CVE-2021-38433 Connext DDS, ROS 2 6.6 CVE-2021-38443 Cyclone DDS, ROS 2 6.6 CWE-228: Improper handling of syntactically invalid structure CVE-2021-38441 Cyclone DDS, ROS 2 6.6 CWE-123:


Write-what-where condition  Table 2.


A summary of our findings across the main DDS implementations and standard specification.


When the security gaps on the network attack surface are exploited, it allows an attacker to perform spoofing, reconnaissance, automated data collection, and denial of service (DoS), affecting the control of an exposed system.


Meanwhile, the vulnerabilities we found on the configuration attack surface can be abused to affect the DDS developer or system integrator, potentially compromising the integrity of the software supply chain.


Vulnerabilities in the standard specification


The built-in RTPS discovery protocol is used in peer-to-peer networks to discover the locator of each participant (such as IP address and UDP/TCP port or offset in shared memory).


The “chatty” nature of this discovery protocol and the fact that it expects a reply from each contacted participant, paired with easy-to-spoof transport protocols such as the User Datagram Protocol (UDP), make RTPS vulnerable to network reflection and amplification.


Confidentiality and authenticity for this data is not protected even with DDS Security, making it possible for an attacker to spoof the information.      CVE ID


Scope


Partially Mitigated*


BAF Percentage of Attack Duration (Total experiment duration = 139s)  CVE-2021-38425 Fast-DDS, ROS 2 master branch 9.875 100.0 CVE-2021-38429 OpenDDS, ROS 2 >= 3.18.1 18.68 24.17 CVE-2021-38487


Connext DDS, ROS 2 >= 6.1.0 2.011 84.17 CVE-2021-43547 CoreDX DDS, ROS 2 > 5.9.1 32.82 18.14  Table 3.


The network reflection and amplification vulnerability with bandwidth amplification factor (BAF) is calculated as the ratio between outbound and reflected traffic.


Note: Implementations with less than 100% attack duration likely have a timeout mechanism.


(*) A full mitigation will require relevant changes in the RTPS specification.


The longest running node was based on Connext DDS (at 139 seconds), which we kept as a reference.


Table 3 shows that the BAF is greater than one, implying there are asymmetric network flows although the values are at the order of magnitude lower than modern amplification attacks (note that Memcached can reach 10,000 to 51,000 BAF).


However, the network bandwidth in embedded systems is also lower than, for example, what internet nodes can provide.


An attacker can abuse this built-in discovery feature for remote discovery and fingerprinting.


We sent RPTS discovery probes to the entire IPv4 space (except for the no-scan subnets) and received answers from 643 hosts (excluding obvious honeypots).


Notably, hosts never stopped sending traffic to us, even if we only sent them a single 288-byte packet.


This new network-reflection vulnerability that we found is not the only instance of a specification-level vulnerability.


Security researchers from different organizations have been documenting and creating attack scenarios abusing these vulnerabilities as early as 2015.


Conclusion


Proper supply chain management processes allow contextualization, tracking, and monitoring of new vulnerabilities within different downstream software using a specific library such as DDS.


In the case of this middleware technology, DDS is just one of the many critical libraries used in embedded applications that’s easy to lose track of.


Our paper, “A Security Analysis of the Data Distribution Service (DDS) Protocol,” includes short- and long-term mitigation best practices and recommendations, as well as a consideration for adopting a shift-left approach.


We also acknowledge the cooperation and engaging response that some vendors like ADLINK have adopted when we approached them with our findings.


As we encourage more DDS researchers, users, and implementors to keep on studying and promoting security awareness for the DDS ecosystem, we hope the level of engagement we received can serve as a model for the software industry.


Download our full paper here.


Tags  Exploits & Vulnerabilities | Research | Cyber Threats | ICS OT | APT & Targeted Attacks | Compliance & Risks | IoT | Articles, News, Reports


Android malware like ransomware exemplify how the platform can be lucrative for cybercriminals.


But there are also other threats stirring up as of late: attacks that spy on and steal data from specific targets, crossing over between desktops and mobile devices.


Take for instance several malicious apps we came across with cyberespionage capabilities, which were targeting Arabic-speaking users or Middle Eastern countries.


These were published on Google Play — but have since been taken down — and third-party app marketplaces.


We named these malicious apps AnubisSpy (ANDROIDOS_ANUBISSPY) as all the malware’s payload is a package called watchdog.


We construe AnubisSpy to be linked to the cyberespionage campaign Sphinx (APT-C-15) based on shared file structures and command-and-control (C&C) server as well as targets.


It’s also possible that while AnubisSpy’s operators may also be Sphinx’s, they could be running separate but similar campaigns.


What can AnubisSpy do?


AnubisSpy can steal messages (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).


It can also take screenshots and record audio, including calls.


It can spy on the victim through apps installed on the device, a list of which is in its configuration file that can be updated.


This includes Skype, WhatsApp, Facebook, and Twitter, among others.


After the data are collected, they are encrypted and sent to the (C&C) server.


AnubisSpy can also self-destruct to cover its tracks.


It can run commands and delete files on the device, as well as install and uninstall Android Application Packages (APKs).


AnubisSpy has several modules, each of which has a separate role.


AnubisSpy’s code is well constructed, indicating the developer/s’ know-how.


Below is a visualization of the modules: Figure 1: Structure of AnubisSpy’s modules


How is AnubisSpy related to Sphinx?


Sphinx reportedly uses the watering hole technique via social media sites to deliver its payloads — mainly a customized version of njRAT.


The Sphinx campaign operators cloaked the malware with icons of legitimate applications to dupe recipients into clicking them.


Sphinx was active between June 2014 and November 2015, but timestamps of the malware indicate the attacks started as early as 2011.


A simple WHOIS query of AnubisSpy’s C&C server showed it abused a legitimate managed hosting service provider in Belize.


We correlated the AnubisSpy variants to Sphinx’s desktop/PC-targeting malware through the following:  Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx’s malware Similar targets (highly concentrated in Middle Eastern countries)     Figure 2: Comparison of file structure in Sphinx’s desktop/PC-targeting malware (left) and AnubisSpy (right)


These apps were all written in Arabic and, in one way or another, related to something in Egypt (i.e., spoofing an Egypt-based TV program and using news/stories in the Middle East) regardless of the labels and objects in the apps.


Our coordination with Google also revealed that these apps were installed across a handful of countries in the Middle East.


Was AnubisSpy actively distributed?


We analyzed seven apps that were actually AnubisSpy.


These were signed with the same fake Google certificates.


We found two more apps created by the same developer, but they had no espionage-related codes; we think they were made as experimental projects.


Based on hardcoded strings in the Agent Version, the malicious apps were developed as early as April 2015.


Timestamps indicate that the earliest sample was signed on June 2015; the latest variant was signed on May 2017.


AnubisSpy wasn’t only published on Google Play.


We also found versions of it in third-party app marketplaces, most likely as a way to expand the malware’s reach.


The apps mainly used Middle East-based news and sociopolitical themes as social engineering hooks and abused social media to further proliferate.


Versions of AnubisSpy posed as social news, promotional, healthcare, and entertainment apps.


What does AnubisSpy mean to the mobile landscape?


Persistent and furtive spyware is an underrated problem for the mobile platform.


While cyberespionage campaigns on mobile devices may be few and far between compared to ones for desktops or PCs, AnubisSpy proves that they do indeed occur, and may have been more active than initially thought.


Will mobile become cyberespionage’s main frontier?


It won’t be a surprise given mobile platform’s increasing ubiquity, especially in workplaces.


Beyond its effects, AnubisSpy also highlights the significance of proactively securing mobile devices, particularly if they’re on BYOD programs and used to access sensitive data.


Enforcing the principle of least privilege and implementing an app reputation system are just some of the best practices that can help mitigate threats.


We disclosed our findings to Google on October 12 and worked with Google on further analyzing the AnubisSpy-related apps.


Updates were also made to Google Play Protect to take appropriate action against those apps that have been verified as in violation of Google Play policy.


An in-depth technical analysis of AnubisSpy, along with indicators of compromise, is in this technical brief.


Trend Micro Solutions End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security which is also available on Google Play.


For organizations, Trend Micro™ Mobile Security for Enterprise provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that leverage vulnerabilities, preventing unauthorized access to apps, as well as detecting and blocking malware and fraudulent websites.


Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies.


It can protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.


Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Mobile


With additional insights from Philippe Z Lin Note: This article has been updated on March 17, 2022, 2:00 a.m. ET to include Asus’ security bulletin.


Cyclops Blink, an advanced modular botnet that is reportedly linked to the Sandworm or Voodoo Bear advanced persistent threat (APT) group, has recently been used to target WatchGuard Firebox devices according to an analysis performed by the UK’s National Cyber Security Centre (NCSC).


We acquired a variant of the Cyclops Blink malware family that targets Asus routers.


This report discusses the technical capabilities of this Cyclops Blink malware variant and includes a list of more than 150 current and historical command-and-control (C&C) servers of the Cyclops Blink botnet.


This list aims to aid cybersecurity defenders in searching for affected devices in their networks and starting the remediation process.


We have reached out to Asus regarding our investigation, and they have created a security bulletin that includes a security checklist to help prevent Cyclops Blink attacks, as well as a list of affected Asus products.


Our data also shows that although Cyclops Blink is a state-sponsored botnet, its C&C servers and bots affect WatchGuard Firebox and Asus devices that do not belong to critical organizations, or those that have an evident value on economic, political, or military espionage.


Hence, we believe that it is possible that the Cyclops Blink botnet’s main purpose is to build an infrastructure for further attacks on high-value targets.


Cyclops Blink has been around since at least June 2019, and a considerable number of its C&C servers and bots are active for up to about three years.


The Sandworm APT group has been attributed as creating both Cyclops Blink and the VPNFilter internet of things (IoT) botnet.


VPNFilter, first discovered in 2018, targeted router and storage devices.


It was also reported to have infected hundreds of thousands of devices.


In 2021, Trend Micro published a technical analysis of VPNFilter, which includes a discussion of how the botnet continues to affect infected systems two years after its discovery.


Sandworm was also responsible for many high-profile attacks, including the 2015 and 2016 attacks on the Ukrainian electrical grid, the 2017 NotPetya attack, the 2017 French presidential campaign, the 2018 Olympic Destroyer attack on the Winter Olympic Games, and a 2018 operation against the Organization for the Prohibition of Chemical Weapons (OPCW).  Cyclops Blink malware analysis  Cyclops Blink is a modular malware written in the C language.


In its core component, the first thing that the malware does is to check if its executable file name starts with "[k".


If it does not, it performs the following routine:   It redirects both stdout and stderr file descriptors to /dev/null.


It sets the default handlers for SIGTERM, SIGINT, SIGBUS, SIGPIPE, and SIGIO signals.


It reloads itself with a new "[ktest]" process name.


It then waits for 37 seconds before it sets up its hard-coded parameters.


These include the hard-coded C&C servers and the interval that should be used to communicate with the C&C servers.


It also creates a pipe for inter-process communication (IPC) by calling the pipe() function for getting two file descriptors for reading and writing data.


It also enables non-blocking I/O for the writing file descriptor by using ioctl().


After this, a new data packet will be created in memory, which will then be sent to a C&C server.


The details of this communication are covered later in this analysis.


For every hard-coded TCP port used to communicate with the C&C servers, the malware creates a rule in Netfilter — the Linux kernel firewall — using the iptc_insert_entry() function from libiptc1 to allow output communication to it.


The rules have the following parameters:  Protocol: TCP Chain: filter Table: OUTPUT Action: ACCEPT


Destination ports: 636, 994, and 995


For an unknown reason, the malware deletes the aforementioned rules and creates them again, this time using the iptables command via the system() function.


The commands are as follows:  iptables -D OUTPUT -p tcp --dport %d -j ACCEPT   iptables -I OUTPUT -p tcp --dport %d -j ACCEPT


The OpenSSL library is then initialized, and the core component proceeds to initialize the hard-coded modules.


Modules initialization


During this part, the core component initializes the modules.


Communication with the modules is performed via pipes.


For each hard-coded module, the malware creates two pipes before executing them in their own child processes.


Figure 1.


The function that initializes the modules      In Figure 1, we inferred the following mod_t structure:      Figure 2.


Inferred mod_t structure; the last member is unknown.


Parameters


The parameters are then initialized.


They consist of a 592-byte structure containing essential information sent to the modules via pipes.


This information includes:  A “<p: ” string header   The pipe of the core component   All C&C IP addresses and ports   The local IP address   An interval for C&C server communication   When the next packet to be sent to a C&C server is   The main process PID   A hard-coded ID (we saw 0xA08F078B, 0xBD0A5B36, and 0xA244E5E2)   The parameters are pushed to the modules, which are initialized at this point.    C&C communication


After obtaining data from the modules, the core component starts the encryption routines that will cipher the data before sending it to the C&C server.


Encryption Cyclops Blink encrypts data using OpenSSL functions that should be available in the infected device as they are dynamically loaded.


The data is encrypted using AES-256 in cipher block chaining (CBC) mode with a randomly generated 256-bit key and 128-bit initialization vector (IV).


It is then encrypted using a hard-coded RSA-2560 (320-bit) public key unique to each sample.


The malware authors decided to use the EVP_SealInit() function.


This function performs all of the aforementioned encryption steps, including the random AES key and IV generation.


The C&C server must have the corresponding RSA private key to decrypt the data.


After encryption, if the total packet length is greater than 98,303 bytes, the packet is sent.


Data transferring


To send data to the C&C server, the core component performs a TLS handshake with a randomly chosen C&C server at a random TCP port, both of which are from a hard-coded list.


After choosing an IP address and a TCP port pair, the core component creates a child process to perform the communication.


The child process will connect to the C&C server and write four bytes to the SSL socket.


These four bytes are the packet size that it wants to send.


Figure 3.


The child process writes four bytes to the SSL socket.


The server must reply with an exact four-byte answer, which is the victim's IPv4 address.


10 bytes are then written to the core component pipe.


The data follows a specific format.


For example:   Packet length Target module Command Data (victim's IPv4 address) 00 00 00 0a 00 07 c0 a8 00 01


The core component then receives more data from the C&C server.


This time, it expects an encrypted packet to be decrypted using the hard-coded RSA-2560 public key.


The malware expects a response where the first four bytes are the size of the packet followed by the encrypted data.


Figure 4.


Core component code that receives and decrypts data from the C&C server      If something is received, it is decrypted and written to the main pipe.


For decryption, the malware uses the RSA_public_decrypt() function, which decrypts data encrypted with a corresponding private key, leveraging the “reversibility” of the RSA encryption algorithm.


Finally, a variable containg the next time a packet should be sent is updated and all of the parameters are sent to the modules again.


This is because the core component can receive new parameters from the C&C servers.


Commands


The data received from the C&C servers comprises either commands to the core component itself or to one of its modules.


First, the core component sends the supported commands to the C&C server and then enters in a loop where it expects one of the commands.


If a command targets the core component, it can be one of the following:   Command ID Action 0 Terminates the program 1 Bypasses the data-sending interval and sends data to C&C servers immediately 2 Adds a new C&C server to the list in memory 3 Sets time to send the next packet to the C&C server 4 Sets time to send the next packet to the C&C server 5 Adds a new module (an ELF file should be received following the command)


6 Reloads the malware 7 Sets the local IP address parameter 8 Sets a new worker ID 9 Sets an unknown byte value 10 Resends configuration to all running modules  Modules Asus (0x38)  This module can read and write from the devices' flash memory.


The flash memory is used by these devices to store the operating system, configuration, and all files from the file system.


Our research was carried out on the RT-AC68U, but other Asus routers such as RT-AC56U might be affected as well.


It’s important to note, however, that since the malware is modular in nature, it can be easily recompiled to target any other device.


The samples we’ve obtained work in the conditions mentioned in this report, but the malware actors seem ready to target any other router model or brand.


In fact, this is what they have done with WatchGuard — it’s the same code, but it has been recompiled for the brand.  First, the module examines the content /proc/mtd file, which provides general information about the devices’ Memory Technology Device (MTD) subsystem.


The MTD provides an abstraction layer to access the device's flash memory.


The malware looks for the strings “linux” and “rootfs” and reads it using a printf()-like format:      Figure 5.


The module looks for “linux” and “rootfs” strings      The inferred mdt_data_t structure is as follows:      Figure 6.


The mtd_data_t structure      The data is read to this structure.


The content of /proc/mtd for an Asus RT-AC68U device is as follows:      Figure 7.


Typical /proc/


mtd


from an Asus RT-AC68U router


Therefore, for the case here, the malware would open /dev/mtd2, which is the partition where the Linux kernel image is stored.


Why the malware authors decided to read either “linux” or “rootfs” partition is unclear.


Based on our knowledge, they have quite different purposes.


While the first holds the operating system, the second stores programs’ critical files, such as executables, data, and libraries.


Cyclops Blink reads 80 bytes from the flash memory, writes it to the main pipe, and enters a loop to wait for a command to replace the partition content:      Figure 8.


Asus module main loop     If the data coming from the core component starts with “<p:”, it means that it is a parameter for this module and 80 bytes will be written to the flash memory, effectively replacing its content.


The writing is done by the j_save_data() function.


It does this by correctly erasing the NAND eraseblocks first via ioctl() calls, and then writing the new content to them, as the following image shows:      Figure 9.


Cyclops


Blink


Asus module code for writing to raw flash memory      As the flash memory content is permanent, this module can be used to establish persistence and survive factory resets.


Although it cannot be used as proof of attribution, the preceding code reminded us of a routine from the third-stage code of VPNFilter’s process called “dstr” that was intended to “brick” the infected device.


Apart from deleting many important files and even trying to delete the whole root file system, this particular VPNFilter stage also writes many 0xff bytes to the raw flash memory:


Figure 10. VPNFilter “dstr” third-stage code for writing to raw flash memory      System reconnaissance (0x08) This module is responsible for sending information from the infected device to the C&C server.


The following data is obtained from an infected device:    The Linux version, which the module gets by calling the uname() function and /etc/issue file   Information about the device’s memory consumption, which it gets by calling the sysinfo() function   The SSD storage information, which it gets by calling the statvfs() function  The content of the following files:  /etc/passwd /etc/group   /proc/mounts  /proc/partitions     Information about the network interfaces, which it gets by calling the if_nameindex() and iotctl() functions with the SIOCGIFHWADDR and SIOCGIFADDR commands.


File download (0x0f) This module can download files from the internet.


The DNS resolution is performed using DNS over HTTPS (DoH).


The malware sends an HTTP POST request to a Google DNS Server (8.8.8.8) using the following headers:      Figure 11.


HTTP POST request over SSL for DNS resolution      This module seems to be an earlier version of the same module (0x0f) that is used by the Cyclops Blink variant reported by NCSC.


The main differences between the modules are as follows:    This module does not have an upload feature.    The 0x1 bit in the control flags is used in this module to specify if the download should be done via HTTPS.  Infrastructure


We have been able to determine that the botnet of Cyclops Blink infected routers from both compromised WatchGuard devices and Asus routers.


These compromised devices periodically connect to C&C servers that are themselves hosted on compromised WatchGuard devices.


We have evidence that the routers of at least one vendor other than Asus and WatchGuard are connecting to Cyclops Blink C&Cs as well, but so far we have been unable to collect malware samples for this router brand.


The botnet of Cyclops Blink has been around for some time.


Using historical data of internet-wide scans and SSL certificate data, it is likely that Cyclops Blink dates back to at least June 2019.


Since June 2019, the actor has issued more than 50 SSL certificates that were used on WatchGuard C&Cs on various TCP ports (as far as we are aware, the following TCP ports were used: 636, 989, 990, 994, 995, 3269, and 8443).


In Appendix A, we have listed both the live and inactive C&Cs used by Cyclops Blink for the benefit of network defenders.


We have observed that some of the WatchGuard and Asus bots were never cleaned up because these routers still try to connect periodically to old C&Cs that were secured or taken offline.


Figure 12.


The timeline of several SSL certificates that were issued for Cyclops Blink C&Cs      Our investigation shows that there are more than 200 Cyclops Blink victims around the world.


Typical countries of infected WatchGuard devices and Asus routers are the United States, India, Italy, Canada, and a long list of other countries, including Russia.


It should be noted that these victims do not appear to be evidently valuable targets for either economic, military, or political espionage.


For example, some of the live C&Cs are hosted on WatchGuard devices used by a law firm in Europe, a medium-sized company producing medical equipment for dentists in Southern Europe and a plumber in the United States.


This is in line with the increasing number of brute-force attacks performed by other APT groups such as Pawn Storm, a group that has compromised numerous assets like email addresses and email servers of targets that are typically not aligned with Pawn Storm’s objectives.


Just like Pawn Storm, Sandworm is fishing with a wide net or looking to compromise assets on a larger scale.


Figure 13.


The number of months that Cyclops Blink C&Cs have been live; it is important to note that live C&Cs during the time of reporting have been included.


Conclusion and security recommendations


Over the past few years, IoT attacks have been escalating globally and internet routers have been one of the primary targets.


There are several reasons that these devices are favored by an attacker — the infrequency of patching, the lack of security software, and the limited visibility of defenders.


Combined, these allow for the possibility of what we refer to as "eternal botnets."


Once an IoT device is infected with malware, an attacker can have unrestricted internet access for downloading and deploying more stages of malware for reconnaissance, espionage, proxying, or anything else that the attacker wants to do.


The underlying operating systems for the majority of IoT devices is Linux, which is also used by many powerful systems tools.


This can allow attackers to add anything else that they might need to complete their attacks.


In the case of Cyclops Blink, we have seen devices that were compromised for over 30 months (about two and a half years) in a row and were being set up as stable C&C servers for other bots.


The NCSC report covered malware targeting a specific vendor, namely WatchGuard.


Based on our previous analysis of VPNFilter, we assumed that there were more vendors being attacked by this group.


The vendors that were targeted by VPNFilter were Asus, D-Link, Huawei, Linksys, MikroTik, Netgear, QNAP, TP-Link, Ubiquiti, UPVEL, and ZDE.


In the case of Cyclops Blink, we received samples targeting Asus routers that were not previously reported on.


The Asus version of the Cyclops Blink malware that we have analyzed showed some differences compared to the WatchGuard versions that have been previously discussed.


The samples that we have analyzed are compiled for ARM and are dynamically linked against uClibc.


They also contain a module that specifically targets Asus routers.


Asus is likely only one of the vendors that is currently being targeted by Cyclops Blink.


We have evidence that other routers are affected too, but as of reporting, we were not able to collect Cyclops Blink malware samples for routers other than WatchGuard and Asus.


Looking into the malware and the infrastructure being used by Cyclops Blinks actors gives us some clues about the other vendors that might be affected and how widespread this malware is.


By sharing this additional technical observation, we aim to help network defenders, as well as those likely to be targeted by APT groups (such as Sandworm), gain a more complete picture of the Cyclops Blink campaign.


Based on our observation, we strongly believe that there are more targeted devices from other vendors.


This malware is modular in nature and it is likely that each vendor has different modules and architectures that were thought out well by the Cyclops Blink actors.


Moreover, the purpose of this botnet is still unclear: Whether it is intended to be used for distributed denial-of-service (DDoS) attacks, espionage, or proxy networks remains to be seen.


But what is evident is that Cyclops Blink is an advanced piece of malware that focuses on persistence and the ability to survive domain sinkhole attempts and the takedown of its infrastructure.


The APT group behind this malware has learned from its VPNFilter campaigns and continues to attack IoT devices such as routers.


In the age of work-from-home (WFH) during the pandemic, it’s possible that espionage is part of the reason that IoT devices are still major targets for advanced attackers.


The more routers are compromised, the more sources of powerful data collection — and avenues for further attacks — become available to attackers.


Having a distributed infrastructure also makes it more difficult for cybersecurity teams to take down the whole attack.


This is also why, after more than two years, there are still live VPNFilter hosts out there.


Organizations can protect themselves from Cyclops Blink attacks by using strong passwords and re-examining their security measures.


It is also important to ensure that only the services that absolutely need to be exposed to the internet are exposed.


Access to these services should be limited, which can be achieved by configuring a virtual private network (VPN) that can access those services remotely.


It’s also important to set reminders to check if devices such as routers, cameras, network-attached storage (NAS) devices, and other IoT devices have been patched or otherwise.


If it is suspected that an organization’s devices have been infected with Cyclops Blink, it is best to get a new router.


Performing a factory reset might blank out an organization’s configuration, but not the underlying operating system that the attackers have modified.


If a particular vendor has firmware updates that can address a Cyclops Blink attack or any other weakness in the system, organizations should apply these as soon as possible.


However, in some cases, a device might be an end-of-life product and will no longer receive updates from its vendor.


In such cases, an average user would not have the ability to fix a Cyclops Blink infection.


While the Cyclops Blink malware variant that we analyzed in this report is complicated in nature, one thing proves to be unmistakable when it comes to the Sandworm group that created it: Sandworm is a persistent and sophisticated group whose motives are clearly at odds with those that would be expected from groups that are primarily financially motivated.


Sandworm’s previous high-profile victims and their attacks’ substantial impact on these organizations are particularly worrying — even more so for a group that quickly learns from past errors, comes back stronger time and time again, and for whom international repercussions seem minimal at best.


The indicators of compromise (IOCs) can be found in this appendix and the C&C server validation script can be accessed via this text file.


Tags  APT & Targeted Attacks | IoT | Research | Articles, News, Reports


The Brazilian Central Bank recently announced that 2017 was the first year in which people did more banking using mobile devices than on PCs.


There were 24.5 billion mobile banking transactions while there were 20.6 billion PC-based transactions.


Not all countries are embracing mobile banking as quickly as Brazil.


But, mobile banking use is picking up around the globe.


What is it?


As more people move to mobile banking, we believe attackers will focus their attacks away from PC banking and towards mobile banking.


This means the risks of losing control of your accounts through mobile online banking are likely to increase.


And that means the money in your accounts is at risk.


Why should I care, what can it do to me?  Attackers are predictable: they follow people and money.


Brazil was one of the first countries to widely embrace Internet banking and to see attackers go after Internet banking.


What can I do about it?


It’s time to take precautions and start good mobile banking security habits.


About  Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.


They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.  Got a topic you want us to write about for you, your friends, or your family?


Email us at u42comms@paloaltonetworks.com.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


In today’s online chat and dating scene, romance scams are not uncommon, what with catfishers and West African cybercriminals potently toying with their victims’ emotions to cash in on their bank accounts.


It’s quite odd (and probably underreported), however, to see it used as a vector for cyberespionage.


We stumbled upon the Confucius hacking group while delving into Patchwork’s cyberespionage operations, and found a number of similarities.


Code in their custom malware bore similarities, for instance.


Confucius targeted a particular set of individuals in South Asian countries, such as military personnel and businessmen, among others.


Are Patchwork and Confucius the same group?


The commands in their backdoors do resemble each other.


The config files have a similar, custom structure, and both groups have infrastructure overlap.


However, we construe them to be different groups, possibly within the same community, with different objectives and modi operandi.


While Patchwork may be more straightforward with its predominantly malware-based attacks, Confucius’ can be inferred to be more nuanced, relying heavily on social engineering.


Exploiting the human psyche with chat apps Probing Confucius’ infrastructure, we came across websites offering Windows and Android chat applications, most likely iterations of its predecessor, Simple Chat Point: Secret Chat Point, and Tweety Chat.


We are admittedly uncertain of the extent — and success — of their use, but it’s one of the ingredients of the group’s operations.


While the chat applications indeed have real chat features (although the communication is not anonymous, as advertised), they have backdoor routines and file-stealing behaviors that get triggered when specific words are sent to the app: collecting and harvesting all SMS messages, contacts, and accounts.


Tweety Chat’s Android version can record audio, too.


Its latest version can mute the device (i.e., take out the ringtone and vibration features) and sync call logs and SMSs.


We further tested Tweety Chat and saw red flags indicating their targets of interest: verification emails with a physical address whose postal code is assigned to a provincial capital that also appears (upon logging in) as a chat channel in Tweety Chat.


Figure 1: Tweety Chat’s interface (top), and code snippets showing the file types it steals (bottom) Romance in cyberespionage


The user list, chat room names, and content of the applications were stored in a remote server without any authentication.


The chat logs shed light on the social engineering used by the operators to persuade victims to install the cyberespionage malware on their Android devices.


The first user and chatroom were created on August 27, 2017, and were probably the app authors’ testing ground.


The succeeding users and chatrooms were created on October 31 and December 12 the latest.


A certain hayat22 and love piqued our interest.


hayat22, supposedly a female student, engaged in an online romance with a target whose handle was love, describing himself as living in South Asia working in garments manufacturing and wholesaling.


Over the course of their correspondence, love suggested using WhatsApp to communicate.


hayat22 declined, saying she felt safer using Tweety Chat.


love refused, but when hayat22 demurred and gave love an online cold shoulder, love tried installing Tweety Chat — and failed.


He claimed that he wasn’t able to install the app.


hayat22 quickly lost interest and stopped replying to him altogether.


She also sent him a screenshot to show what Tweety Chat looked like.


We’re not sure how love wound up in the chat room or how he met hayat22.


He was probably either using the Windows version of Secret Chat Point or its web interface, which explains why hayat22 was urging him to install Android Tweety Chat.


In an earlier chat group, an operator called Heena urged the members to install Secret Chat Point on other people’s mobile devices to get perks like credits or the ability to “go invisible”.


In another chat room called “Maira’s room”, a target of interest disclosed he was a government officer traveling back from a northern city near the country’s provincial capital.


A few days after, the operator stopped answering in the chat room, and her user account was deleted from the server.


Figure 2: ByeBye Shell’s interface showing Confucius’ campaigns  Figure 3: Screenshot showing a group chat where the moderator is urging users to install Tweety Chat  Figure 4: Screenshot showing Tweety Chat promoted in social media


A tangled web of malware


Confucius’ operations include deploying bespoke backdoors and stealing files from their victim’s systems with tailored file stealers, some of which bore resemblances to Patchwork’s.


The stolen files are then exfiltrated by abusing a cloud storage service.


Some of these file stealers specifically target files from USB devices, probably to overcome air-gapped environments.


Compared to Patchwork, whose Trojanized documents exploit at least five security flaws, Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882.


Their malware’s resemblance to that of Patchwork’s is also notable.


The use of an exploit for a security flaw disclosed in December 2017 and their recent activities suggest Confucius is keenly trailing their targets.


Confucius has a miscellany of backdoors: sctrls, ByeBye Shell, remote-access-c3, and sip_telephone, to name a few.


One of its file stealers, swissknife2, abuses a cloud storage service as a repository of exfiltrated files.


At the time of research, there were around 60 victims whose data were uploaded to Confucius-owned cloud storage account.


There were also a few thousand files in the account that were later deleted.


Our research, Deciphering Confucius: A Look at the Group’s Cyberespionage Operations, delves into the group’s operations, the social engineering methods and gamut of malware it uses, and the countermeasures that organizations can adopt to mitigate them.


The list of indicators of compromise, which includes Trend Micro’s corresponding detections and solutions, is in this appendix.


Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Mobile


"A few weeks ago, British Airways was hit by the largest ever regulatory fine of its kind, after global customers visiting its website had their card data stolen.


The $228m penalty levied by the UK’s privacy watchdog reflects the seriousness of the attack and the carrier’s failure to protect its customer’s personal and financial information.


However, this incident has repercussions way beyond the UK airline and its customers.


It’s part of a new wave of attacks designed to implant “digital skimming” code on e-commerce sites, in order to siphon off your card details as they are entered in to pay for goods.


Although tens of thousands of websites have been caught out in this way, there are things you can do to stay safe—most notably by running Trend Micro Security.


But first, here’s more on what you need to know.


The story so far


Data breaches are so often in the news headlines today, that you could be forgiven for becoming a little desensitized.


From retailers like Target and Home Depot to government breaches at agencies including the Office of Personnel Management (OPM), and from financial organizations like Equifax to tech giants like Yahoo, billions of our personal records have been stolen by cyber-thieves over the past few years.


Yet in all of these cases, there has been little the customer could do about it.


That’s because the hackers target the organization directly.


They find ways to bypass its security controls and sneak inside the company networks to find what they’re looking for: usually databases full of customer data.


A new type of data breach


However, these new digital skimming attacks are different.


In what way?


They involve a hacker deploying malicious code known as Magecart to an organization’s website.


This code is typically designed to stay hidden, under the radar of the company.


And it has a very specific purpose: to steal customer card details as they are entered into the site during payment.


In short, it’s the digital equivalent of those physical skimming devices that criminals insert into ATMs to steal card data as it’s entered: it’s highly effective and happens completely without the knowledge of the cardholder.


By using this method, the hackers get access to the full card details, which have a higher resale value on the cybercrime black market.


The problem (for them) with the more traditional types of attack targeting back-end databases, is that these organizations may store card data encrypted, or else minus the crucial CVV/CV2 code.


Magecart attacks get around that.


What sites are at risk?


Indeed, the Magecart attackers have proven over the past year that no website is safe from skimming attacks.


Whether it’s a big-name e-commerce brand like Newegg, a national airline, a global ticketing site (Ticketmaster), or even online campus stores serving nearly 200 universities in the US and Canada–as long as they accept online payments, they’re at risk.


Magecart is so effective that multiple groups are said to be using the code, a piece of malicious JavaScript, to infect websites around the world.


And they’re developing new tools and tactics all the time to improve their monetization.


These include:     Infecting third-party companies which supply code to other sites (e.g., those that provide online ad services).


Thus, with just one attack, the hackers can get their Magecart code onto potentially thousands of payment pages.


Using automated tools to scan the internet for companies that may be running unsecured servers, which they can then infect with Magecart.


Some 17,000 sites were recently compromised in this way.


In a separate attack, 962 online stores were hit in just 24 hours.


Developing new skimming code which is usable across as many different payment pages as possible.


The record is 57 different payment gateways, which makes the hackers’ job much easier as they can launch attack campaigns across the globe with the same tools            All this is bad news for online shoppers.


So how do you know that the site you’re entering card data into is safe?


What can you do to stay safe?


Unfortunately, there’s nothing obvious that differentiates a website infected with Magecart from any other site.


It will look completely normal and will allow you to pay in the usual manner.


The only difference is that, in the background, a tiny piece of code will be stealing your data and transferring it to the hackers.


So what can you do to protect yourself?


You could try to avoid smaller sites that may not have the same level of security as larger ones.


However, as we’ve seen, Magecart has hit big-name brands as well as less well-known companies.


Another option would be to use a browser plug-in like NoScript for Firefox that prevents JavaScript loading from other untrusted sites – although this won’t prevent you getting potentially stung if the well-known and trusted site you’re on is compromised


Payment systems like Apple Pay and Google Pay can offer more protection.


They use a one-time generated series of numbers for each transaction, so that if attackers get their hands on it, they won’t be able to use it in the future.


It goes without saying that you should keep a close eye on your card statements/bank account at all times – watching out even for small amounts that hackers may be making to test if your card is still active.


However, the most effective way to stay safe is to use Trend Micro Security.


How Trend Micro can help Trend Micro Security features two key mechanisms to help stop Magecart attacks:


It can detect whether the website you want to visit has been injected with skimming code, and block you from visiting the URL (via web reputation), as well as from going to malicious domains the skimming code has access to.


It uses a combination of techniques (via its Advanced Threat Scanning Engine and TrendX-File machine learning) to detect whether the malicious JavaScript code has landed on your local drive and is ready to run in your browser – and then blocks it.


This can spot both Magecart and similar digital skimming code.


Read our Security Intelligence Blog for more technical details on Magecart.


Then go to our Security Products Overview to get Trend Micro Security.


"     Tags  Cloud | APT & Targeted Attacks |


Cyber Crime | Expert Perspective | Cyber Threats


Threats to the internet of things (IoT) continue to evolve as users and businesses grow increasingly reliant on these tools for constant connectivity, access to information and data, and workflow continuity.


Cybercriminals have taken notice of this dependence and now regularly update their known tools and routines to include network-attached storage (NAS) devices to their list of targets, knowing full well that users rely on these devices for storing and backing up files in both modern homes and businesses.


More importantly, cybercriminals are aware that these tools hold valuable information and have only minimal security measures.


In our latest research paper, “Backing Your Backup: Defending NAS Devices Against Evolving Threats,” we studied the current infrastructure, environment, threats, and recommendations for defending systems against current threats targeting NAS devices.


To emphasize the importance of mitigating the risks of malware infection and targeted attacks on NAS devices, we analyzed the technical details of two malware families that potentially included NAS devices in their existing business models, the REvil ransomware and StealthWorker botnets.


REvil


While the disappearance of REvil (aka Sodinokibi) in mid-2021 is filled with uncertainty, security researchers have found a Linux version of the REvil ransomware that they have dubbed as Revix.


After analyzing the samples, we found four different versions of the malware, all of which rely on an embedded JavaScript Observed Notation (JSON)-based configuration to set parameters before encrypting files.


Figure 1. Revix’s JSON-based configuration


While some parameters are ignored by the ransomware, these are most important ones that we observed:  pk: A 64-byte key nbody: The ransomware note text-encoded in base64 nname: The ransomware note name ext: The extension added to encrypted files  After compromising the system, the malicious actors execute it manually on a NAS device to encrypt files and create a ransom note with a unique key per victim.


Figure 2. Revix encrypting a QNAP NAS device      Figure 3.


Revix


ransom note


While the differences between the versions are minor, the group advertised the capability of encrypting NAS devices as early as May 2021 in underground forums.


Given the vulnerability of NAS devices that are directly connected to the internet, we can expect a new wave of ransomware attacks affecting these gadgets in the future.


StealthWorker


In 2021, security researchers found brute-force attacks launched from the StealthWorker botnet on Synology NAS devices.


We found multiple samples for this botnet and confirmed that newer versions are capable of brute-forcing and compromising servers running on several products and systems such as WooCommerce and WordPress.


This botnet is also designed to generally attack any web server using HTTP authentication and other NAS devices like QNAP.


Valid credentials found during compromise are then uploaded to the command-and-control (C&C) server, usually at port 5028/TCP.      Figure 4.


brute-force function targeting QNAP devices


Figure 5. Infected Linux device connected to a C&C server


How to protect NAS devices


Without proper security implemented in NAS devices, users and businesses will continue to be targeted since these tools can be used as entry points for information theft, malware infection, and the disruption of operations, among others.


Here are some best practices to protect your systems against threats that leverage the gaps in your NAS devices:


Avoid connecting a NAS device directly to the internet.


Regularly change the credentials for accessing an NAS device.


Never use the preset default credentials that come with the device as these are well-known to malicious actors.


Enable two-factor authentication (2FA) for additional security.


Uninstall applications, software, and services that are no longer in use as these can be abused as entry points.


Regularly check NAS manufacturers’ online security guides, such as Synology’s recommended best practices and QNAP’s recently released suggestions on how to help defend their devices against additional exposure on the internet.


To find more technical details, threats, insights, and recommendations in protecting your NAS device, download our research “Backing Your Backup: Defending NAS Devices Against Evolving Threats.”      Tags  Malware | Cyber Crime | Exploits & Vulnerabilities | Research | Smart Home | Cyber Threats | APT & Targeted Attacks | Endpoints | IoT | Ransomware | Articles, News, Reports


On April 21st our WildFire analysis cloud detected a new Android Trojan, which is currently completely undetected in VirusTotal and uses a new combination of tactics to make money for the author.


Based on the state of the code and the limited distribution we believe we may have detected this malware during a testing phase, before the attacker released it into the wild through an app store or other means.


We’ve named the Trojan Cardbuyer because of the way it converts an infection into cash for the author.


Cardbuyer is much “smarter” compared to the existing Android malware families that we have ever seen.


Specifically, this malware sample can solve CAPTCHA challenges, emulate user’s behaviors, parse SMS’s content from different vendors, and then automatically reply the confirmation message accordingly.


Code analysis shows that this malware sample can defeat the existing multi-factor verification procedures of many popular game platforms or online payment systems, and impersonate the smartphone user in making the purchase.


While some Android Trojans send premium SMS messages or steal banking credentials, Cardbuyer specifically targets Chinese video games and mobile platforms by purchasing pre-paid and top-up cards.


The attacker can then convert these cards into cash, while the victim’s mobile account is charged for the purchase.


It proves again that the SMS channel is insecure for user authentication in online purchase confirmation.


Cardbuyer’s code allows it to target any of the following services and evade their SMS-based authentication mechanisms:


The vulnerability that Cardbuyer exploits is that many services in China rely on sending and receiving SMS messages to authorize mobile purchases.


This assumes that the mobile phone making the purchase is not only in the possession of the owner, but also that malware is not intercepting their messages.


The service providers have recognized that this is a problem and placed multiple hurdles along the way, but Cardbuyer jumps over each of them.


Cardbuyer in Action


The sample of Cardbuyer we detected this week is disguised as “sexy” video application.


The name is看片神器 which translates to “a super tool for watching videos” and the icon is a provocative photo.


The Trojan was detected by WildFire when a user at a university in China downloaded an Android APK file from fdown.u.qiniudn.com, a Chinese cloud-based file storage service.


After installation, Cardbuyer will be launched automatically by system events and run stealthily in the background.


Once launched, it contacts a command and control server hosted in China using an HTTP GET request to the following website to register the infection with the attacker: http://14.17.95.205:21910/my/service.php.


Next, Cardbuyer begins to methodically jump each of the hurdles put in place by tianxiafu.cn, a third party gateway for purchasing game cards for Perfect World, one of the biggest digital game vendors in China.


The first hurdle to pass is a CAPTCHA, which is intended to prevent machines from ever attempting to log into the tianxiafu.cn website.


It asks users to look at some slightly skewed numbers (see below) and type them into a box.


To add context for the following webpage (Figure 1), written in Chinese: the user is asked to recognize the CAPTCHA image and reply the recognized verification code back to the vendor in order to continue the purchase procedure.


Figure 1.


The payment page of tianxiafu.cn  Cardbuyer evades this CAPTCHA by downloading the CAPTCHA image (Figure 2) and recognizing the image using a Chinese cloud based CAPTCHA solving service named UUDama.


UUDama uses a combination of machines and humans to quickly take CAPTCHA images submitted by Cardbuyer (or anyone else who will pay) and turn them into the expected text within 60 seconds.


We are even able to capture the username “liweixw” and its password for malware to login into the UUDAMA website, (Figure 3).  Figure 2.


Cardbuyer retrieve the CAPTCHA image from webpage and get recognition result from UUDama  Figure 3.


Cardbuyer will login into UUDAMA website with attacker’s account


With the correct numbers in hand, Cardbuyer then assembles a POST request containing the necessary details to initiate a purchase from the infected mobile phone.


This includes the phones mobile number, as well as the payment method, which is always to charge the user’s China Mobile account.


To avoid having this request rejected by the server, the Trojan alters its user-agent string to appear as Internet Explorer 9 running on Windows 7.


Figure 4.


Cardbuyer input user's phone number and choose to pay by SMS  At this point, Tianxiafu has not yet authenticated that the person making the purchase actually owns the phone in question.


To do that, it generates a one-time-code and asks the user to send an SMS message containing it to a specific phone number.


Figure 5.


The payment platform asks user to send a one-time-code to a specific phone service number (Translation of message in the figure: “Information submitted successfully! Please use the phone number you submitted 139********” to send a command code 001942415 to 1065800886172, and follow the instructions shown in replied SMS message to confirm the payment”, the 139******** is the current victim user’s phone number)  To pass this hurdle, Cardbuyer uses a regular expression to parse the numbers out of the websites HTML and sends the message using Android’s built-in SMS API.


Figure 6.


Cardbuyer parses command code and phone number from web page


The complicated user verification procedure continues.


After receiving the command code, the vendor will send a SMS verification message to the user.


The user is required to follow instructions in described in this SMS’s content to finally confirm the purchase.


To defeat the SMS based verification, Cardbuyer registers a BroadcastReceiver to receive all incoming SMS, and registers a ContentObserver to monitor any change of the SMS’s inbox.


When a SMS arrives to the infected device, Cardbuyer will intercept and parse it.


With conditions, this SMS message may be uploaded to the attack through the C&C communication or deleted (Figure 7).  Figure 7.


SMS from targeted vendors will be intercepted and uploaded to Cardbuyer's C&C server  More interesting, the Cardbuyer is “intelligent” and capable of parsing SMS’s content from different vendors, and take actions in a more intelligent way than any existing Android Trojans found.


In Figure 8, we show the patterns for different types of SMS contents.


For example, for any SMS related to the Perfect World, it will try to match its content with two pre-defined regular expressions (Figure 8), search for numbers in it by specified format, and sent SMS of some matched content to matched phone number (Figure 9).  Figure 8.


Matching SMS content with different format and extract information accordingly  Figure 9.


The Cardbuyer sends replied SMS to complete the payment verification procedure  At this point the Trojan has verified ownership of the phone and the service sends an SMS message to the device containing a code that can be redeemed for credit with vendors like Perfect World.


From here the attacker can sell the code to someone else for cash, or redeem it directly.  While in the example here Cardbuyer targeted the Tianxiafu service, all of the services listed above are targets already pre-defined in its source code.


Any service that uses SMS for authentication of information or proof that a user is authorizing a charge is vulnerable to Trojan attacks.


Palo Alto Networks has already released malware signatures for the file, and more details on the sample are available in the ThreatVault.


Join us Wednesday, April 30 at 3 p.m. EDT, for a new webinar, “Need to Defeat APTs?


Tony Sager Explains Where We’re At With Live Threat Detection Automation.”   Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


Google TAG actively monitors threat actors and the evolution of their tactics and techniques.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


We believe this action will have a significant impact on Glupteba's operations.


However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain.


Glupteba is known to steal user credentials and cookies, mine cryptocurrencies on infected hosts, deploy and operate proxy components targeting Windows systems and IoT devices.


TAG has observed the botnet targeting victims worldwide, including the US, India, Brazil and Southeast Asia.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


These services include selling access to virtual machines loaded with stolen credentials (dont[.]farm), proxy access (awmproxy), and selling credit card numbers (extracard) to be used for other malicious activities such as serving malicious ads and payment fraud on Google Ads.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


We’ve terminated around 63M Google Docs observed to have distributed Glupteba, 1,183 Google Accounts, 908 Cloud Projects, and 870 Google Ads accounts associated with their distribution.


Furthermore, 3.5M users were warned before downloading a malicious file through Google Safe Browsing warnings.


In the last few days, our team partnered with Internet infrastructure providers and hosting providers, including Cloudflare, to disrupt Glupteba’s operation by taking down servers and placing warning interstitial pages in front of the malicious domain names.


During this time, an additional 130 Google accounts associated with this operation were terminated.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


Google is alleging violations under the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and tortious interference of business relationships, and unjust enrichment.


While these actions may not completely stop Glupteba, TAG estimates that combined efforts will materially affect the actor’s ability to conduct future operations.


The command and control (C2) communication for this botnet uses HTTPS to communicate commands and binary updates between the control servers and infected systems.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


In the event that the main C2 servers do not respond, the infected systems can retrieve backup domains encrypted in the latest transaction from the following bitcoin wallet addresses:  The following 32 byte AES keys for decryption are hard coded in the binaries:  The blockchain transaction’s OP_RETURN data can be decrypted using AES-256 GCM to provide a backup command and control domain name.


The first 12 bytes of the OP_RETURN contains the IV, the last 16 bytes the GCM tag, while the middle section is the AES-256 GCM encrypted domain


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Recent domains used for command and control:  Recent sha256 hashes of malware samples:


Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes.


The group’s primary motivation seems to be cyberespionage: the list of its victims includes high value targets such as government and educational institutions, religious movements, pro-democracy and human rights organizations in Hong Kong, Covid-19 research organizations, and the media, among others.


However, the threat actor also seems to be financially motivated, as it also took aim at gambling and cryptocurrency companies.


Previous research into the group’s activities attributed it to other threat actors such as the Winnti group due to the use of malware such as Winnti, but despite some similarities, we consider Earth Lusca a separate threat actor (we do have evidence, however, that the group is part of the “Winnti cluster,” which is comprised of different groups with the same origin country and share aspects of their TTPs).


The technical brief provides an in-depth look at Earth Lusca’s activities, the tools it employs in attacks, and the infrastructure it uses.


Infrastructure and operating model Earth Lusca’s infrastructure can essentially be grouped into two “clusters.”


The first cluster is built using virtual private servers (VPS), rented from a service provider, that are used for the group’s watering hole and spear phishing operations, in addition to acting as a command-and-control (C&C) server for malware.


The second cluster is made up of compromised servers running old, open-source versions of Oracle GlassFish Server.


Interestingly, this second cluster performs a different role in an Earth Lusca attack — it acts as a scanning tool that searches for vulnerabilities in public-facing servers and builds traffic tunnels within the target’s network.


Like the first cluster, it also serves as a C&C server, this time for Cobalt Strike.


It’s possible that the group used portions of its infrastructure (particularly the scanning aspects) for diversion in order to trick security staff into focusing on the wrong parts of the network.


Figure 1.


An overview of Earth Lusca’s infrastructure      Social Engineering and Vulnerability Exploitation techniques


The group has three primary attack vectors, two of which involve social engineering.


The social engineering techniques can be broken down into spear phishing emails and watering hole websites.


Our telemetry data shows Earth Lusca sending spear phishing emails containing malicious links to one of their targets — a media company.


These links contain files that are disguised either as documents that would be of interest to the potential target, or as opinion forms allegedly coming from another media organization.


The user eventually downloads an archive file containing either a malicious LNK file or an executable — eventually leading to a Cobalt Strike loader.


In addition to spear phishing emails, Earth Lusca also made use of watering hole websites — they either compromised websites of their targets or set up fake web pages copied from legitimate websites and then injected malicious JavaScript code inside them.


These links to these websites are then sent to their victims (although we were not able definitively pinpoint how this was done).


In one incident, the group injected a malicious script into the compromised HR system of a target organization.


This script was designed to show a social engineering message — typically a Flash update popup or a DNS error (note that Adobe discontinued Flash Player at the end of December 2020) that then instructed the visitor to download a malicious file that turned out to be a Cobalt Strike loader.


Figure 2. Fake installation pop-up     The third attack vector used by Earth Lusca is the exploitation of vulnerabilities that exist in the public-facing applications — such as Microsoft Exchange ProxyShell and Oracle GlassFish — of its targets.


Once these are accomplished, Earth Lusca is free to perform its post-exploitation routines that include installation of tools such as Cobalt Strike and Acunetix (we discuss the post-exploitation routines in detail in the technical brief).


Malware used by Earth Lusca Earth Lusca employs several malware and other hacking tools in its arsenal.


A common theme we’ve seen in its attack vectors is the use of CobaltStrike loaders — and indeed, Cobalt Strike is one of the group’s preferred tools due to its wide range of post-exploitation capabilities.


In this case, the Cobalt Strike shellcode that is dropped into the target system is encoded via XOR along with a corresponding key.


In addition to Cobalt Strike, Earth Lusca also uses malware such as Doraemon, a backdoor named after Japanese manga that has two C&C settings: a primary one for one for IP or DNS, and a public website URL containing encrypted or clear text C&C IP addresses that is used for persistence.


The group employs well-known malware such as ShadowPad and Winnti, as well as other tools such as cryptocurrency miners as part of its operations.


A more comprehensive list of these malware and tools are found in the technical brief.


Security best practices can help defend against Earth Lusca attacks Evidence points to Earth Lusca being a highly-skilled and dangerous threat actor mainly motivated by cyberespionage and financial gain.


However, the group still primarily relies on tried-and-true techniques to entrap a target.


While this has its advantages (the techniques have already proven to be effective), it also means that security best practices, such as avoiding clicking on suspicious email/website links and updating important public-facing applications, can minimize the impact — or even stop — an Earth Lusca attack.


Read our technical brief to learn more about Earth Lusca and its activities.


The indicators of compromise for Earth Lusca can be found in this document.


Tags  APT & Targeted Attacks | Malware | Cyber Crime | Research | Articles, News, Reports


This post is also available in:      日本語 (Japanese)  Unit 42 released details about a new spear phishing campaign called FreeMilk that uses a relatively new attack technique that can be highly effective.


This is the kind of technique that is likely to be aimed at high value targets.


Targets of these attacks are likely to be individuals with access to valuable or sensitive information such as members on a Board of Directors, C-level executives, military and political personnel, or those with compromising information such as journalists or activists.


Individuals close to those previously mentioned could also be used as part of the attack campaign such as an executive assistant to a CEO or even friends or family.


Phishing attacks are broad, leveraging email messages crafted around common, generalized topics in order to trick recipients into opening an email message and its attachments.


Attackers will cast a wide net, with no regard to who the victims are, hoping that a decent percentage of attacks are successful.


Spear phishing, like the name implies, is a more targeted form of phishing which incorporates a theme directly related to the target.


Using this approach, victims are more inclined to trust the sender, and open the email message and any attachments resulting in the success of the attack.


FreeMilk is an advanced spear phishing attack campaign that, instead of using a theme to lure targets into downloading a malicious attachment, hijacks an in-progress email conversation.


Simply explained:  Figure 1 Conversation Hijacking to Deliver Malware  Unit 42 observed this specific attack taking advantage of a vulnerability in Microsoft Office, which has a patch available.


To protect against FreeMilk and attacks alike, ensure your systems and devices are updated with the latest operating systems and security patches.


Additionally, multiple layers of security for devices and networks create additional layers of protection to prevent against these types of attacks.


For example, multi-factor authentication would prevent an attacker from abusing stolen credentials, hindering their ability to access an email account and successfully complete the FreeMilk attack campaign.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days.


This week, learn about Trend Micro’s Cyber Risk Index (CRI) and its results showing increased cyber risk.


Also, read about a data breach from IoT company Wyze that exposed information of 2.4 million customers.


Read on:


The 5 New Year’s Tech Resolutions You Should Make for 2020 Now is the perfect time to reflect on the past and think of all the ways you can make this coming year your best one yet.


With technology playing such a central role in our lives, technology resolutions should remain top of mind heading into the new year.


In this blog, Trend Micro shares five tech resolutions that will help make your 2020 better and safer.


Security Study: Businesses Remain at Elevated Risk of Cyber Attack


Elevated risk of cyber attack is due to increased concerns over disruption or damages to critical infrastructure, according to the Trend Micro’s latest Cyber Risk Index (CRI) study.


The company commissioned Ponemon Institute to survey more than 1,000 organizations in the U.S. to assess business risk based on their current security postures and perceived likelihood of attack.


Parental Controls – Trend Micro Home Network Security Has Got You Covered


In the second blog of a three-part series on security protection for your home and family, Trend Micro discusses the risks associated with children beginning to use the internet for the first time and how parental controls can help protect them.


Cambridge Analytica Scandal: Facebook Hit with $1.6 Million Fine


The Cambridge Analytica scandal continues to haunt Facebook.


The company has been receiving fines for its blatant neglect and disregard towards users’ privacy.


The latest to join the bandwagon after the US, Italy, and the UK is the Brazilian government.


Why Running a Privileged Container in Docker is a Bad Idea


Privileged containers in Docker are containers that have all the root capabilities of a host machine, allowing the ability to access resources which are not accessible in ordinary containers.


In this blog post, Trend Micro explores how running a privileged, yet unsecure, container may allow cybercriminals to gain a backdoor in an organization’s system.


IoT Company Wyze Leaks Emails, Device Data of 2.4M


An exposed Elasticsearch database, owned by Internet of Things (IoT) company Wyze, was discovered leaking connected device information and emails of millions of customers.


Exposed on Dec. 4 until it was secured on Dec. 26, the database contained customer emails along with camera nicknames, WiFi SSIDs (Service Set Identifiers; or the names of Wi-Fi networks), Wyze device information, and body metrics.


Looking into Attacks and Techniques Used Against WordPress Sites WordPress is estimated to be used by 35% of all websites today, making it an ideal target for threat actors.


In this blog, Trend Micro explores different kinds of attacks against WordPress - by way of payload examples observed in the wild - and how attacks have used hacked admin access and API, Alfa-Shell deployment, and SEO poisoning to take advantage of vulnerable sites.


FPGA Cards Can Be Abused for Faster and More Reliable Rowhammer Attacks


In a new research paper published on the last day of 2019, a team of American and German academics showed that field-programmable gate array (FPGA) cards can be abused to launch better and faster Rowhammer attacks.


The new research expands on previous work into an attack vector known as Rowhammer, first detailed in 2014 Emotet Attack Causes Shutdown of Frankfurt’s IT Network


The city of Frankfurt, Germany, became the latest victim of Emotet after an infection forced it to close its IT network.


There were also incidents that occurred in the German cities of Gießen, Bad Homburgas and Freiburg.


BeyondProd Lays Out Security Principles for Cloud-Native Applications BeyondCorp was first to shift security away from the perimeter and onto individual users and devices.


Now, it is BeyondProd that protects cloud-native applications that rely on microservices and communicate primarily over APIs, because firewalls are no longer sufficient.


Greg Young, vice president of cybersecurity at Trend Micro, discusses BeyondProd’s value in this article.


How MITRE ATT&CK Assists in Threat Investigation


In 2013, the MITRE Corporation, a federally funded not-for-profit company that counts cybersecurity among its key focus area, came up with MITRE ATT&CK™, a curated knowledge base that tracks adversary behavior and tactics.


In this analysis, Trend Micro investigates an incident involving the MyKings botnet to show how the MITRE ATT&CK framework helps with threat investigation.


TikTok Banned by U.S. Army Over China Security Concerns


With backlash swelling around TikTok’s relationship with China, the United States Army this week announced that U.S. soldiers can no longer have the social media app on government-owned phones.


The United States Army had previously used TikTok as a recruiting tool for reaching younger users, Mobile Money: How to Secure Banking Applications


Mobile banking applications that help users check account balances, transfer money, or pay bills are quickly becoming standard products provided by established financial institutions.


However, as these applications gain ground in the banking landscape, cybercriminals are not far behind.


What security controls do you have in place to protect your home and family from risks associated with children who are new internet users?


Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.


Tags  Cloud | APT & Targeted Attacks | Expert Perspective | Exploits & Vulnerabilities | Articles, News, Reports | Cyber Threats


Jon Clay, VP of Threat Intelligence: [00:00:00


Hey welcome everybody.


Jon Clay, VP of Threat Intelligence here at Trend Micro and welcome to another episode of #TrendTalksBizSec.


Joining me again is my cohort in crime.


Ed Cabrera, Chief Cybersecurity Officer:


My name's Ed Cabrera.


I'm the Chief Cybersecurity Officer at Trend Micro.


It’s great to be here.


Jon:


You know, interesting Ed, I recently was able to travel to Switzerland, to Davos for the World Economic Forum, as part of our Cybersecurity Tech Accord Allegiance.


They got me to speak at a panel there and the topic was quite interesting.


It was about hybrid warfare and cyber warfare.


And while there was a really good discussion during it, and you can actually find it online – it's on YouTube – if you want to take a look at it.


But we didn't cover a number of areas that I thought we were going to cover, but we didn't.


So I thought you and I [00:01:00] could take time today and talk a little bit about cyber warfare, hybrid warfare.


Obviously, with the issues going on with Russia and Ukraine, we're starting to see this.


Any initial thoughts around this?


Maybe explain to the audience what hybrid warfare or cyber warfare is.


Ed:


Well, yeah, absolutely.


There's been this thought process and planning for many, many years as cyber has become that fifth domain from a Department of Defense perspective.


The Department of Defense has always wanted to, and their goal is to, maintain dominance across all domains.


Cyberspace now is critical and one of the key domains out there.


And so, when we talk about in terms of cyber conflict, cyber war, it has usually been in the context of just [00:02:00] another element within that 360-degree dominance that they hope to achieve in any conflict of war.


Cyber is that one space such as air dominance, for example, right?


Whatever conflict you go into, a war be it, you want to maintain air dominance.


And cyberspace is just one of them now, but we're getting into this unique area which we anticipated…could cyber conflict be the main domain that is being acted upon?


So instead of doing the kinetic or traditional, physical aspects of it, could you have cyber war be the only element that is happening?


I think the Russian invasion of Ukraine has really brought that up to a different level in that discussion and what we're actually seeing.


We'll talk about it [00:03:00] here now, but I think when we talk in terms for, especially for here is like cyber conflict, cyber war, or hybrid, and the hybrid piece is just a definition of kinetic and cyber.


Jon:


Right.


One thing we obviously are seeing is that cyber is going to have a part to play in any upcoming conflict, but it may not be as big as what people thought.


You know, we were thinking, we could do away with the tanks and the air force and all that.


And you just have computers fighting it out.


But obviously that's not the case as we're seeing with Ukraine and Russia, right?


Ed:


No, absolutely.


We've thought of cyberwar as being this dominant part of any conflict, but there's still so many physical, critical infrastructure types of kinetic [00:04:00] targets and goals or objectives that you need to achieve in any conflict.


So cyber is still critical as we become more hyper-connected.


As we approach ubiquitous computing, ubiquitous connectivity, cyber then becomes very relevant.


But as we’ve seen, it's an interesting concept because traditionally cyber has just been more of an information gathering or cyber espionage tool to aid any type of conflict.


But now with critical infrastructure across the globe being much more hyper-connected and being a richer target from a cyberspace perspective, now we do see that now cyber becomes a more dominant role in this.