CryptoBit: Another Ransomware Family Gets an Update

Posted on by Brad Duncan

In April 2016, Panda Security reported yet another new family of ransomware named CryptoBit that spread through exploit kit (EK) traffic. In June 2016, we discovered an updated version of CryptoBit ransomware sent by Rig EK.

On June 23 and June 24, this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host encountered this traffic, Rig EK delivered CryptoBit ransomware to infect the computer. Other sources use different terms for this ransomware, with some calling it "CriptoBit" or "Mobef" instead of Cryptobit. Continue reading "CryptoBit: Another Ransomware Family Gets an Update"

A Quick Update On Our LabyREnth CTF Challenge

Posted on by Richard Wartell

Congratulations to those who solved an introductory challenge hidden in our initial LabyREnth announcement!

Unit 42 CTF 1

If you decode the binary in the Palo Alto Networks logo on http://labyrenth.com, you get the following ascii message:

“For reals yall. Has anyone really been far as decided to use XOR even go want to do look more like? You've got to even have been kidding me with this PAN. I've been further even more decided to use even go need to do look more as anyone can for Rules and even more than Prizes have been the Overviews. Can you really be far from Ordering even as decided half as much to use Digits go wish for that?”

Continue reading "A Quick Update On Our LabyREnth CTF Challenge"

Recent MNKit Exploit Activity Reveals Some Common Threads

Posted on by Anthony Kasza

Unit 42 recently identified a variant of MNKit-weaponized documents being used to deliver LURK0 Gh0st, NetTraveler, and Saker payloads. The documents were delivered to targets involved with universities, NGOs, and political/human rights groups concerning Islam and South Asia. Reuse of this MNKit variant, sender email addresses, email subject lines, attachment filenames, command and control domains, XOR keys, and targeted recipients show a connection between the different payload families delivered.

MNKit is the name given to a builder that generates CVE-2012-0158 exploit documents. The documents are in MHTML format and install a malicious payload on the compromised host. We believe MNKit is privately shared between multiple attack groups, but is not widely available. Continue reading "Recent MNKit Exploit Activity Reveals Some Common Threads"

Prince of Persia – Game Over

Posted on by Tomer Bar

Summary

Unit 42 published a blog at the beginning of May titled "Prince of Persia," in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwide.

Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains. This disabled the attacker’s access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties. Continue reading "Prince of Persia – Game Over"

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Posted on by Kaoru Hayashi

A recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation. PlugX has been used in a number of attacks since first being discovered in 2012, and we have published several articles related to its use, including an analysis of an attack campaign targeting Japanese companies.

Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. We mostly observe attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. We have seen multiple Elirks variants using Japanese blog services for the last couple of years. Figure 1 shows embedded URL in an Elirks sample found in early 2016.

Continue reading "Tracking Elirks Variants in Japan: Similarities to Previous Attacks"

Extending AutoFocus Threat Intelligence With New Tag Types

Posted on by Mike Scott

In previous posts we have discussed how AutoFocus accelerates the analysis, hunting, and incident response workflows by providing full context for threat events seen on your network, as well as high-level visibility into how targeted a threat is against you or your industry peers.

This visibility into the threat landscape enables teams to move away from chasing alerts, instead prioritizing response activities for the most critical threats, and proactively implementing new defensive measures. The real power of AutoFocus is its ability to not only consolidate billions of indicators from WildFire customers around the globe, but more importantly to provide a platform for deriving intelligence and context around those indicators through crowd-sourced tags. AutoFocus customers can develop their own private tags for internal company use, or they can choose to share them publicly for the benefit of all AutoFocus users. And of course, all AutoFocus customers benefit from the expertise of Unit 42, our threat intelligence team, which is constantly monitoring the front lines and dark recesses of the web to identify new malware families and attack campaigns, publish research, and develop new tags. Continue reading "Extending AutoFocus Threat Intelligence With New Tag Types"

New Sofacy Attacks Against US Government Agency

Posted on by Robert Falcone

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government. The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan. The developer implemented a clever persistence mechanism in the Trojan, one which had not been observed in previous attacks. The focus of this blog will be on the attacks and the infrastructure associated with Sofacy using the new persistence mechanism as a correlation point. Continue reading "New Sofacy Attacks Against US Government Agency"

Using IDAPython to Make Your Life Easier: Part 6

Posted on by Josh Grunzweig

In Part 5 of our IDAPython blog series, we used IDAPython to extract embedded executables from malicious samples. For this sixth installment, I’d like to discuss using IDA in a very automated way. Specifically, let's address how we’re going to load files into IDA without spawning a GUI, automatically run an IDAPython script, and extract the results. Using this technique, we’ll be able to process many samples very quickly without needing to manually open each file in a new instance of IDA and run the IDAPython script.

Many may be surprised to learn that IDA can be executed purely on the command-line without spawning a GUI. In order to do so, the user must run the IDA executable with the ‘-A’ switch. This particular switch will instruct IDA to run in autonomous mode, ensuring that no windows or dialog boxes are presented to the user.

Continue reading "Using IDAPython to Make Your Life Easier: Part 6"

Understanding Angler Exploit Kit - Part 2: Examining Angler EK

Posted on by Brad Duncan

This is the second part of a two-part blog post for understanding Angler exploit kit (EK). The first part covered EKs in general. This blog focuses on the Angler EK.

Angler is currently one of the most advanced, effective, and popular exploit kits in the cyber criminal market. It generally uses the most recent exploits based on the latest vulnerabilities. Like most leading EKs, the authors behind Angler use Software as a Service (SaaS) as their business model, and Angler can be rented in the cyber underground for a few thousand dollars a month. Continue reading "Understanding Angler Exploit Kit - Part 2: Examining Angler EK"

Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals

Posted on by Brad Duncan

Generally speaking, criminal groups use two methods for widespread distribution of malware. The most common method is malicious spam (malspam). This is a fairly direct mechanism, usually through an email attachment or a link in the message to the malware. However, malspam requires some sort of action by the user to be successful (for example, opening an attached file).

The other method for widespread malware distribution is an exploit kit (EK). EKs are designed to work behind the scenes while a potential victim is browsing the web. An EK does not require any additional action by the end user.

EKs are a sophisticated delivery method. Malware distribution through an EK involves other components in the chain of events that lead to a malware infection. Continue reading "Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals"

Palo Alto Networks Researchers Uncover Critical Apple Product Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researchers were recently credited with discovery of two new Apple product vulnerabilities.

Researchers Tongbo Luo and Bo Qu discovered a webkit vulnerability (CVE-2016-1855) affecting Safari in OS X Mavericks v10.9.5, OS X Yosemite v10.10.5 and OS X El Capitan v10.10.5. Continue reading "Palo Alto Networks Researchers Uncover Critical Apple Product Vulnerabilities"

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor

Posted on by Robert Falcone

In May 2016, Unit 42 observed targeted attacks primarily focused on financial institutions and technology organizations within Saudi Arabia. Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia, which appears to be related to an earlier wave of attacks carried out in the fall of 2015. We have grouped these two waves of attacks into a campaign we have named ‘OilRig’.

In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme. The campaign appears highly targeted and delivers a backdoor we have called ‘Helminth’. Over the course of the attack campaign, we have observed two different variations of the Helminth backdoor, one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable. Continue reading "The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor"

New Wekby Attacks Use DNS Requests As Command and Control Mechanism

Posted on by Josh Grunzweig

We have observed an attack led by the APT group Wekby targeting a US-based organization in recent weeks. Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeam’s Flash zero-day exploit.

The malware used by the Wekby group has ties to the HTTPBrowser malware family, and uses DNS requests as a command and control mechanism. Additionally, it uses various obfuscation techniques to thwart researchers during analysis. Based on metadata seen in the discussed samples, Palo Alto Networks has named this malware family ‘pisloader’. Continue reading "New Wekby Attacks Use DNS Requests As Command and Control Mechanism"

Operation Ke3chang Resurfaces With New TidePool Malware

Posted on by Micah Yates

Introduction

Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago. However, Unit 42 has recently discovered the actors have continued to evolve their custom malware arsenal. We’ve discovered a new malware family we’ve named TidePool. It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide. This targeting is also consistent with previous attacker TTPs; Ke3chang historically targeted the Ministry of Affairs, and also conducted several prior campaigns against India. Continue reading "Operation Ke3chang Resurfaces With New TidePool Malware"

Ransomware Is Not a “Malware Problem” – It's a Criminal Business Model

Posted on by Ryan Olson

Today Unit 42 published our latest paper on ransomware, which has quickly become one of the greatest cyberthreats facing organizations around the world. As a business model, ransomware has proven to be highly effective in generating revenue for cybercriminals in addition to causing significant operational impact to affected organizations. It is largely victim agnostic, spanning the globe and affecting all major industry verticals. Small organizations, large enterprises, individual home users – all are potential targets.

Ransomware has existed in various forms for decades; but, in the last three years, criminals have perfected the key components of these attacks. This has led to an explosion of new malware families, which make the technique work, and drawn new actors into participating in these lucrative schemes.

To execute a successful ransomware attack, an adversary must be able to do the following: Continue reading "Ransomware Is Not a “Malware Problem” – It's a Criminal Business Model"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow