Cmstar Downloader: Lurid and Enfal's New Cousin

Posted on by Robert Falcone

In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as ‘Enfal’. Cmstar was named for the log message ‘CM**’ used by the downloader.

Unit 42 is aware of threat actors using two toolkits - MNKit and the Tran Duy Linh toolkit - to produce malicious documents that exploit CVE-2012-0158 in order to implant Cmstar. The Cmstar downloader itself has several unique and interesting features, as well as substantial infrastructure overlap with other tools worth discussing. Continue reading "Cmstar Downloader: Lurid and Enfal's New Cousin"

Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered three new critical Internet Explorer (IE) vulnerabilities affecting IE versions 8, 9, 10 and 11. All three are included in Microsoft’s May 2015 Security Bulletin, and documented in Microsoft Security Bulletin MS15-043. Continue reading "Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities"

Trapwot Scareware Activity Spikes in April

Posted on by Josh Grunzweig

In recent weeks, Unit 42 has been monitoring a new e-mail campaign distributing the Trapwot malware family. The Trapwot malware family is considered “scareware” or “rogue antivirus” because it attempts to mislead victims into believing their machine is infected with malware. It disguises itself as an anti-virus product, and attempts to encourage users into purchasing a non-existent protection.

In total, our AutoFocus threat intelligence service has identified 380,000 emails carrying Trapwot in the past 30 days. These 380,000 e-mails have contained over 5,400 unique malware samples. These attacks have primarily targeted the insurance, higher education, and healthcare industries.

Trapwot is just one of many variants of Rogue Antivirus programs that currently plague users. Readers should be skeptical of pop-ups that suggest their system is infected with malware and ask them to purchase a new product. As always, users should also avoid opening attachments delivered over e-mail that they are not expecting, no matter how enticing the content may be. Continue reading "Trapwot Scareware Activity Spikes in April"

PlugX Uses Legitimate Samsung Application for DLL Side-Loading

Posted on by Robert Falcone

Summary

While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-loading, Unit 42 has observed a new executable in use for this purpose. Threat actors are now using this previously unseen executable, created by Samsung, to load variants of the PlugX Trojan.

Using our AutoFocus threat intelligence service, we have flagged these variants to help users identify related attacks.

Malware Details

This story starts with the analysis of a malicious Word document named 雨傘達動後教會生 態.doc (which translates to “Church ecology after the Umbrella Movement”) that was created with the infamous “Tran Duy Linh” exploit kit. This malicious document exploits CVE-2012-0158 to open a decoy document and execute a custom dropper Trojan named word.exe. Continue reading "PlugX Uses Legitimate Samsung Application for DLL Side-Loading"

2015 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42

Posted on by Scott Simkin

The 2015 Verizon Data Breach Investigations Report (DBIR) represents the first time Palo Alto Networks has contributed data to this important publication, and we are proud to be part of an intelligence-sharing ecosystem that, in the end, raises the collective bar for everyone in the industry.

While reviewing the findings, a few key points stood out to the Unit 42 team: Continue reading "2015 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42"

Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets

Posted on by Jen Miller-Osborn

Summary

Palo Alto Networks Unit 42 used the AutoFocus threat intelligence service to identify a series of phishing attacks against Japanese organizations. Using AutoFocus to quickly search and correlate artifacts across the collective set of WildFire and other Palo Alto Networks threat intelligence, we were able to associate the attacks with the group publicly known as “DragonOK.” [1] These attacks took place between January and March of 2015.

DragonOK has previously targeted Japanese high-tech and manufacturing firms, but we’ve identified a new backdoor malware, named “FormerFirstRAT,” deployed by these attackers. See the “Malware Details” section for analysis of the three RATs and two additional backdoors deployed in this persistent attack campaign. Continue reading "Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets"

Android Installer Hijacking Vulnerability Could Expose Android Users to Malware

Posted on by Zhi Xu

Executive Summary

We discovered a widespread vulnerability in Google’s Android OS we are calling “Android Installer Hijacking,” estimated to impact 49.5 percent of all current Android users. In detail:

  • Android Installer Hijacking allows an attacker to modify or replace a seemingly benign Android app with malware, without user knowledge. This only affects applications downloaded from third-party app stores.
  • The malicious application can gain full access to a compromised device, including usernames, passwords, and sensitive data.
  • Palo Alto Networks worked with Google and major manufacturers such as Samsung and Amazon to inform them of the vulnerability and issue patches for their devices.

Introduction

Continue reading "Android Installer Hijacking Vulnerability Could Expose Android Users to Malware"

FindPOS: New POS Malware Family Discovered

Posted on by Josh Grunzweig

Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which we have dubbed ‘FindPOS’ due to strings consistently found in each variant.

While this malware doesn’t show strong sophistication, the large number of variants shows prevalence similar to families such as Alina and Backoff. It is clear that FindPOS should be considered a strong threat to Microsoft Windows POS vendors, and measures should be taken to ensure protection.

Workflow

Continue reading "FindPOS: New POS Malware Family Discovered"

Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered a new critical Internet Explorer (IE) vulnerability affecting IE versions 8, 9, 10 and 11. This is included in Microsoft’s March 2015 Security Bulletin MS15-018 and MS15-019, and documented in Microsoft Security Bulletin MS15-MAR. Continue reading "Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability"

Have You Seen the Latest Threat Intelligence Research from Unit 42?

Posted on by Palo Alto Networks

Unit 42, the Palo Alto Networks threat intelligence team, gathers, researches and analyzes up-to-the-minute threat data, sharing insights with Palo Alto Networks customers, partners and and the broader community to better protect enterprises and governments from advanced threats.

blog-title-unit42 Continue reading "Have You Seen the Latest Threat Intelligence Research from Unit 42?"

Examining the Cybercrime Underground, Part 1: Crypters

Posted on by Tomer Bar

This post is the first in a new series titled Examining the Cybercrime Underground. Each post will delve into different aspects of how cybercriminals operate, using current examples of tools and techniques. What are their tools of the trade? How do they get them? How do they overcome challenges posed by security and anti-fraud systems? How do criminals profit from scams and turn stolen data into cash? Answering these questions will help readers better understand one of their primary cyberadversaries and use that knowledge to better protect their networks.

What is a crypter?

Crypters are software tools that use a combination of encryption, obfuscation, and code manipulation of malware to make them FUD (Fully Undetectable) by legacy security products. Continue reading "Examining the Cybercrime Underground, Part 1: Crypters"

Palo Alto Networks Researcher Identifies 3 Critical Internet Explorer Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered three new critical Internet Explorer (IE) vulnerabilities affecting IE versions 9, 10 and 11. All three are included in Microsoft's February 2015 Security Bulletin MS15-009 and documented in Microsoft Security Bulletin MS15-FEB. Continue reading "Palo Alto Networks Researcher Identifies 3 Critical Internet Explorer Vulnerabilities"

Watch Our Researchers Cover Predicting Malicious Domains at VB2014

Posted on by Palo Alto Networks

Malicious domains are commonly used by cyberattackers for command and control communication, hosting malware and phishing attacks. Palo Alto Networks researchers Wei Xu, Kyle Sanders and Yanxin Zhang recently explored ways to predict malicious domains so they can be added to blacklists before they go live. To hear how they went about this, and to see the results they achieved, take a look at this video from their paper presentation at VB2014: Continue reading "Watch Our Researchers Cover Predicting Malicious Domains at VB2014"

Filmkan: Mysterious Turkish Botnet Grows Through Facebook

Posted on by Ryan Olson

On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of “likes” the malware had generated, Faghani estimated that over 100,000 users had been infected with the malware. We have not been able to identify a common name for this malware and have given it the designation “Filmkan” based on domains it uses for command and control.

Based on our analysis, this malware was most likely created by a Turkish actor. The malware contains many comments written in Turkish, the domains used for command and control were registered through a Turkish company and the social network profiles involved in the attack belong to Turkish speakers.  Filmkan is very flexible, giving it more capability than simple interaction with social networks. The overall motivation of this attack is not clear at this time, but the author of Filmkan has successfully assembled a large botnet in a short amount of time.

Filmkan Functionality

While the initial report only contained sparse details, Faghani followed up with additional analysis on February 2, exposing more functionality related to the malware. Our WildFire analysis cloud first picked up samples of this malware on January 22 and thus far we’ve collected 44 distinct samples the display the behavior described by Faghani.

At a high level, this malware consists of four components: Continue reading "Filmkan: Mysterious Turkish Botnet Grows Through Facebook"

Analysis: CryptoWall 3.0, Dyre and I2P

Posted on by Ryan Olson

For a moment, put yourself in the shoes of a cyber criminal. You’ve collected an array of tools (malware), built up your infrastructure (command and control (C2) servers) and you have a process to make money off your hard work. You wake up on Monday morning and the domains your carefully built malware uses for command and control are shut down. Some security researcher has taken control of them, completely halting your operation. This would certainly be good news to anyone reading this blog, but for the criminal it’s a big setback and source of frustration. These kinds of takedowns are the impetus for some of the most impressive developments in malware technology over the last decade.

Takedown-Resistant Command and Control

Once attackers have infected a PC through some exploit or social engineering, one of their major challenges is keeping control of that system. Antivirus programs running on the PC are trying eradicate the threat, the command and control domains and IPs are being added to denylist and blocked by networks around the world. Many malware authors have taken to building complex mechanisms to ensure that their malware is resistant to these kind of blocks and takedowns. Some of the more innovative mechanisms include: Continue reading "Analysis: CryptoWall 3.0, Dyre and I2P"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow