Posts | Page 107 of 270

Hiddentear ransomware variant encrypts and gives files .poop extension

June 21, 2019/in Threat intelligence /by Security News

The SonicWall Capture Labs Threat Research Team have received reports of ransomware that encrypts files and gives them a .poop extenstion. The malware is created based on the open source platform known as HiddenTear. The operator charges 0.12277114 BTC ($1200 USD) for decryption.

Infection Cycle:

Upon infection, files on the system are encrypted and the desktop background is changed to the following image:

A window pops up with the following message:

The trojan is seen in the process list running as “Ranso”:

The trojan drops the following files onto the system:

%SYSTEMDRIVE%\Users\%USERNAME%\Desktop\READ_IT.txt
%SYSTEMDRIVE%\%USERNAME%\bg.jpg (desktop background image shown above)
%SYSTEMDRIVE%\%USERNAME%\Rand\local.exe (copy of original) [Detected as: GAV: Hiddentear.RSM_22 (Trojan)]

Encrypted files are renamed with “.poop” appended to their original filenames.

READ_IT.txt contains the following text:

The trojan makes the following DNS query:

hostfs1mai.temp.swtest.ru

The infection is reported to a remote server and leaks system information:

The ransom note suggests using Telegram to contact @CyberDexter, the operator. We had the following brief conversation via Telegram with @CyberDexter discussing payment:

The operator offers reassurence that they have control of decryption keys for their victims.

The transaction history for the supplied bitcoin address (1K3YKBq8qGrnmJ7TKkLbTiGL59UHBYh7LF) suggests that the operator may have had some success:

SonicWALL Capture Labs provides protection against this threat via the following signatures:

GAV: Hiddentear.RSM_22 (Trojan)

Also, this threat is detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Cyber Security News & Trends – 06-21-19

June 21, 2019/1 Comment/in Weekly News /by SonicWall Staff

This week, it’s National Selfie Day, Facebook launches its cryptocurrency, and, as predicted by SonicWall, ransomware is all over the news.

SonicWall Spotlight

National Selfie Day

June 21 is National Selfie Day and SonicWall staff around the world are taking part! Can you name all the locations?

Innovation Will Sharpen America’s Tech Edge, Federal Officials Say – NextGov

SonicWall CEO Bill Conner appeared at a Chertoff Group Security Series Event this week. Next Gov quotes his insight as they cover the full discussion between him, Christopher Krebs, director of the Homeland Security Department’s Cybersecurity and Infrastructure Security Agency, and Dimitri Kusnezov, Deputy Under Secretary for Artificial Intelligence & Technology, Department of Energy.

Latest Attack From TrickBot Malware Family Identified: SonicWall – CRN (India)

CRN follow up on the SonicWall Capture Labs Threat Research Team’s identification of a new variant of Trickbot malware. The modular structure on this malware allows it to freely add new functionalities without modifying the core bot. This story was also covered in Var India, DataQuest, NCN Online, Tech Herald, and CSO Forum.

Cyber Security News

U.S. Lawmaker Calls for Facebook to Pause Cryptocurrency Project – Reuters

Amid comments that Facebook is “already too big and too powerful,” House Representative Maxine Waters is calling for Facebook to halt development on the Libra cryptocurrency until Congress and regulators can review the issue.

Hit by Ransomware Attack, Florida City Agrees to Pay Hackers – New York Times

The City Council of Riviera Beach unanimously agrees to have its insurance carrier pay 65 Bitcoin, about $592,000, to hackers after the city systems were caught by a ransomware attack three weeks previously.

Is AI Fundamental to the Future of Cybersecurity? – CSO Online

While traditional cybersecurity tools require some level of human interaction to keep them running and up-to date, CSO Online investigate the development and advancement of AI which may be able to develop and improve with little to no human involvement. They also predict that passwords will become obsolete if AI proves to be the more secure option.

U.S. Cities Are Under Attack From Ransomware — and It’s Going to Get Much Worse – Vice News

With Atlanta, Baltimore, and many smaller cities getting hurt by ransomware, Vice argues that ransomware attacks appear to be spiking right now due to increased focus on government targeting, and just how easy launching an attack has become.

Inside the FBI’s Fight Against Cybercrime – Dark Reading

Dark Reading conducts an interview with a member of one of the small FBI teams that are dedicated to fighting cybercrime. The agent discusses the difficulties of being heavily outnumbered by criminal actors, but also the surprisingly high level of successes that they have achieved – including defeating the massive Mirai DDoS-for-hire attacks

Desjardins, Canada’s Largest Credit Union, Announces Security Breach – ZDNet

Canada’s largest credit union announces that 2.9 million members had customer data – including names, date of birth, social insurance number, addresses and more – taken from its database by a now ex-employee. The Credit Union is currently working with law enforcement to investigate the breach.

Maryland Governor Signs Order to Boost Cybersecurity After Baltimore Ransomware Attack – The Hill

Responding to Baltimore’s recent ransomware woes, Maryland Governor Larry Hogan signs an executive order establishing the “Maryland Cyber Defense Initiative” and creating a Chief Information Security Officer who will be charged with giving cybersecurity recommendations to the governor.

In Case You Missed It

Defending Endpoints from Fast, Ferocious Ransomware Attacks – Brook Chelmo
SonicWall, ADT Ink Partnership to Offer Managed Cybersecurity Solutions to SMBs – David Chamberlin
The E-rate ‘Fear Less’ Solution – SonicWall Staff
Navigating the E-rate Program: Forms, Filling Cycles & Rules – SonicWall Staff
An Explanation of E-rate: How to Cost-Effectively Protect K12 Networks – SonicWall Staff
Inside the Modern Phishing Campaigns of 2019 – Ganesh Umapathy

Old Microsoft Office vulnerability CVE-2017-11882 actively being exploited in the wild

June 18, 2019/in Threat intelligence /by Security News

Attacks exploiting an one and half year old vulnerability in Microsoft office (CVE-2017-11882), are active in the wild again.

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploits the vulnerability could run arbitrary code in the context of the current user.

The vulnerability is caused by the Equation Editor, which fails to properly handle OLE objects in memory. This allows the attacker to execute arbitrary code in RTF files without interaction. Microsoft had patched this on 11/14/2017 . Recently Sonicwall Capture Labs threat research team observed a wave of exploits in the wild attacking this vulnerability.

The malicious rtf file has equation object

Microsoft has this warning about equation editor.

In the current wave of attacks, the malicious office document files are attached in the emails. The sender lures the user to open the file. The file has some content but the in background it exploits this vulnerability to download malicious payload on the victims computer.

The spam emails look like this:

The file when opened looks like this

The rtf file drops file and contacts the attacker-controlled server.

These types of attacks are a reminder to the importance of keeping systems updated with latest security patches.

SonicWall Capture Labs Threat Research team provides protection against this exploit with the following signatures:

SPY 5046 Malformed-File rtf.MP.22
GAV MalAgent.J_37354
GAV CB_3 (Exploit)
GAV H_12144 (Trojan)
GAV CB_4 (Exploit)
GAV CB_5 (Exploit)
GAV CB_6 (Exploit)
GAV BX_10 (Exploit)
GAV BS_4 (Exploit)
GAV AS (Exploit)

SonicWall Capture Advanced Threat Protection (ATP) with RTDMI provides protection against this threat.

Threat Graph:

IoC:

Rtf files :

760ff63642a0c236c4d1f88a8a6c94de1d4087010d3373a6122ab48fa505aed3

2af097a6fe6cc30943ef386c8950787492c5a20ae5de2d15b7d8a248b0c44a8c

cf00a1c2a61cc6a684e768b71bbca78436a28d37e8f982af409eaea1881f1f1f

ab618f0fc42cd3dd63d4901a678cfef419ee06ee374d6425d2ea27668c207b62

b865e203294170ed4de563371dee3a5c4e42d3bf19345ae72c5b2b463121edfb

5b5e9b8165cc731fe242796422dabd8721433a07426de4717f248e3c250439a5

Email:

9ccb84d16ff5ea5b1837bfe4951934b3382ce0bc2b9dd2ffd795a75232303831

7ba7a39fc505601966e88c31ecc3521a3f44ab9397ec24f1b2d5c136fe8c60c2

JURASIK Ransomware actively spreading in the wild

June 14, 2019/in Threat intelligence /by Security News

The SonicWall Capture Labs Threat Research Team observed reports of a new variant family of JURASIK ransomware [JSWormC.RMS] actively spreading in the wild.

The JURASIK ransomware encrypts the victim’s files with a strong encryption algorithm until the victim pays a fee to get them back.

Contents of the JURASIK ransomware

Infection Cycle:

The ransomware adds the following files to the system:

Malware.exe
- %Userprofile\Desktop %\ JURASIK-DECRYPT.txt
  - Instruction for recovery
- %App.path%\ [File Name]. JURASIK

Once the computer is compromised, the ransomware runs the following commands:

The ransomware encrypts all the files and appends the [.JURASIK] extension onto each encrypted file’s filename.

After encrypting all personal documents, the ransomware shows the following text file containing a message reporting that the computer has been encrypted and to contact its developer for unlock instructions.

We have been monitoring varying hits over the past few days for the signature that blocks this threat:

SonicWall Capture Labs provides protection against this threat via the following signature:

GAV: JSWormC.RMS (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Defending Endpoints from Fast, Ferocious Ransomware Attacks

June 14, 2019/1 Comment/in BYOD and Mobile Security /by SonicWall Staff

It’s 2019 and massive ransomware attacks are still making headlines, especially against city governments.

In 2018, the City of Atlanta attack shut down over a third of 424 software programs with total damages expected to be over $40 million USD. This year, the City of Baltimore was targeted with multiple systems and agencies down. At the time of writing, the damage caused by the attack hasn’t been fully repaired and the bill is coming in at $18 million.

As much as people preach about segmenting networks, backing up data and improved network security, ransomware attacks are happening at scale with increasing ferocity.

IT administrators look for solutions and that quest usually involves security for the endpoint. Since a lot has changed in the world of endpoint security, administrators are exploring the options that fall into the endpoint detection and response (EDR) category.

“As much as people preach about segmenting networks, backing up data and improved security, ransomware attacks are happening at scale with increasing ferocity.”

Osterman Research published a research paper to outline the concerns, reasons and requirements admins on the front lines have with EDR solutions. Use this latest white paper to guide your organizations as you deploy your first endpoint protection solution or upgrade legacy antivirus protection.

The SonicWall Capture Client endpoint solution offers many endpoint detection and response (EDR) capabilities that give organizations the ability to mitigate attacks, remediate them and report back to the organization.

White Paper: The Critical Role of Endpoint Detection & Response

The current level of endpoint protection is not adequate against improving evasion tactics, end users who work outside of perimeter defenses, infected USBs, fileless attacks and others. Explore this exclusive Osterman Research paper, which frames the importance of advanced endpoint security.

READ NOW

Cyber Security News & Trends – 06-14-19

June 14, 2019/0 Comments/in Weekly News /by SonicWall Staff

This week, why businesses need layered cybersecurity, the “most dangerous hacking group” are eyeing up the US power grid, and inside the online leak of hours of sought-after Radiohead rehearsals.