RaidForums Users – Where is their Next Home?

 

Requiring no introduction, the RaidForums(RF) was the leading and most popular hacking forum residing on the surface web. This online community of opportunistic cybercriminals – notorious for leaking valuable data from databases, credentials, credit card information to the latest vulnerabilities & exploits – abruptly come to a closure. Whether it was a seizure by a law information agency or a compromise by a competing threat actor group, no one has come forward claiming the responsibility and little information has come to light concerning its abrupt disruption. Even the question of whether it is a permanent takedown of RF is left unanswered. As a result, defenders and most importantly the intelligence community are only speculating based on events that took place during its disruption. Without dwelling too much on “who” was responsible, as intel analysts, we are more interested to understand “where” the RF users have migrated to carry out their illicit activities.

While there are some obvious choices for threat actors used to operate through RF, our intelligence has revealed there are certainly new ones that have emerged that look forward to grabbing the opportunity and becoming the RF alternative.

 

The Old and Obvious Ones

XSS & Exploit: Both these Russian-speaking forums garnered similar reputation and popularity on the dark web as RF on the surface web. While arguably, RF can be considered a less technically skilled community compared to XXS and Exploit, we see it as the best fit for RF users to migrate to both of these forums. Soon after the closure of RF, conversations around these forums being flooded with RF users start to brew, especially in XSS. However, it certainly does make up for an interesting turn of events as both of these forums are primarily home to Russian users and RF members – before going down – were engaged in multiple anti-Russian activities.

Telegram: For a couple of years in the making, Telegram has emerged as the go-to place for cybercriminals looking to buy/ sell stolen data and engage in related conversations. While this platform may not provide forum-like features, its popularity among cybercriminals is exploded in recent times. This can be attributed to factors like guaranteed privacy, providing a low barrier to entry as compared to DDW forums, eliminating the need to register/ host/ maintain a domain, and support for automation. Given the bad track record of Telegram to tackle the illicit activities that take place on its platform, it becomes an easy alternative for RF users.

 

The Similar Ones

Likes of Nulled, Cracked, Eternia, Eleaks, and others: These forums can be considered most similar to RF in terms of technical skill-set and the style in which they operate. The users who were already active on RF are most likely to, if not active, have an account on these similar forums. Reportedly, an increased number of posts have been observed in some of these forums after RF went down.

 

The New Ones

DarkNetWorld: With the tagline “We love illegal” the forum DarkNet World came into existence soon after the RF incident took place. For defenders, the forum looked like a promising replacement for RF as one of its admins used the pseudonym “Omnipotent” – also used by the RF founder. Possibly suspecting an action from law enforcement for being affiliated with RF, the DarkNet World was quick to clarify that there was no relation with RF. While people behind this forum have been successful in getting the attention in absence of RF, most consider it to be just an exit scam. Most recently, suspecting an FBI investigation, the maker of these forums hosted the FBI’s seizure page and their motive in doing so remains unclear.

Breached: AKA “BreachForums” is visually a replica of RF and run by a former member of RF who goes by the pseudonym of “pompompurin”. The forum is a straightforward alternative to RF, however, not affiliated with RF in any way – the makers claim. The forum appears to come into existence around mid-March, although its domain has been registered for quite some time. The admin “pompompurin” also states that in an event where RF returns in an official capacity the domain will redirect to RF. As an initial observation, we don’t see Breached as a replacement of RF – neither it is aiming to be one. It appears that “pompompurin” has re-purposed one of his old domains to create a temporary community that was loyal to RF like him. At the time of our observation, Breached is close to 1800 members strong and we have started to see RF-like activities.

 

Parting Thoughts

During our analysis, it was found that the seizure page for DarkNetWorld was fake. Also, on their telegram channel, DarkNetWorld has said that their new page is now redblackhat.com, which when checked by CYFIRMA’s threat intelligence team, looks exactly like darknetworld.com. At this point, it is worth mentioning that its reputation has taken a significant hit.

Lastly, we would like to highlight that there is the possibility that the Raid forums page as was and is now, has the potential to be a phishing page.

 

Understanding Cyber Risk Related to Mobile Apps | Android Banking Trojan – Red Alert 2.0

 

The malware, Red Alert 2.0, tricks users into downloading it by hiding in third-party app stores as fake versions of legitimate applications such as WhatsApp, Viber, and updates for both Android and Flash Player.

Once a user downloads one of these malicious apps into his or her devices and opens it, a popup overlay will appear prompting the user to enter their login credentials. The credentials are sent to the attacker’s command-and-control (C&C) server.

Red Alert 2.0 will block incoming calls from banks, presumably to block verification attempts. The malware also intercepts SMS text messages, sending messages to the attackers for future use. By disrupting the device’s actual communication capabilities, the attackers can maximize the time spent on malicious activities.

 

Distribution Vector

 

The malware is distributed through fake versions of legitimate applications or games via Google play store. Like the above image, the Easy Rates Converter application is a fake app which the application itself is clean. But once the application is installed on the mobile device it contacts its C2 server and requests the user to update the flash player to install an additional payload.

 

Once the user installs the flash player, it requests the user to activate the device administrator.

After the installation of the flash player, it is redirected to Play Store.

 

If a user were to suspect the app to be fake and proceeds to uninstall, the additional payload would still remain in the device.

 

On-Screen Phishing Overlay

The payload gathers information about the device and sends it to the C2 server. The C2 server provides the list of applications that the malware should target.

Whenever the victim launches the target application, the malware will create an overlay of the legitimate application and request the user to provide credentials as shown below.

 

Code Analysis

The app, when installed on the device, will request the user to install an additional payload as shown in the below image.

The list of permissions for the Application is as shown in the figure above. Suspicious indicators include permissions for Internet and permission to install packages.

The highlighted code shows the app trying to contact C2 to download and install the additional payload.

Capturing the network activity on the device, we could see the application establishing a connection with C2.

The application requests for the payload.

Once the payload is installed in the app, it gathers all information from the victim’s device and sends it to the C2 server.

The C2 server evaluates and sends the list of applications the payload should target.

The payload opens an overlay page of the target application to steal credentials and other sensitive information like account details.

 

If you’d like to understand the cyber risk related to mobile apps, pls reach out to us at [email protected]

 

Top 3 Ransomware Entry Points Used by Cyber Criminals

 

In the past 2 years, ransomware attacks have grown by leaps and bounds with the average ransom demand surging from roughly USD 10,000 to a whooping USD 100,000. While there is a lot of discussion around whether companies should pay the ransom or not, based on our cyber threat intelligence and monitoring of the deep and dark web – we bring you a comprehensive list of the common entry points for ransomware into an organization.

During our analysis, we found that the top ransomware groups continue to use emails to start their attack chain. But unlike in the past, emails are just steppingstones used indirectly to launch a lethal attack. According to CYFIRMA researchers, the most common and often-exploited entry points for ransomware groups are as follows:

Phishing for Access to Remote Services

To gain access to the remote access services like RDP/ VPN servers, the threat actors resort to phishing activities to get hold of the credentials. There are several instances, wherein, these groups also employ the credential dumps available on dark web forums. Before the rampant use of phishing, cyber criminals would leverage downloaders as the initial payload. It is since 2020, that there has been a spike in the volume of phishing as an initial payload for a ransomware attack.

One of the recent reports reveals that close to 260,642 phishing attacks in July 2021 took place in the US alone. Given that humans are the weakest links in a cybersecurity framework, CYFIRMA Cyber Threat Intelligence (CTI) suggests organizations consider advanced threat intelligence capability to complement their email security solutions. For an organization, a robust email security strategy should include:

• a) Full-scale visibility of email threats being faced;
• b) Implementation of solutions that can correlate and analyze such threat data;
• c) Understanding of who and what is being targeted;
• d) Identify steps to counter email threats; and
• e) Mark external emails with a banner denoting the email are from an external source to assist users in detecting spoofed emails.

 

Leveraging Vulnerable Systems

Vulnerable systems are another low-hanging fruit for ransomware attackers. Some of the most frequently exploited vulnerable internet-facing services include SSL VPN (Fortinet, Citrix, Pulse, SonicWall, etc.), Microsoft Exchanger Servers, Telerik UI-based web interfaces. To overcome all kinds of prospective cyberattacks (ransomware or otherwise), CTI suggests:

1. Implementation of an advanced endpoint protection solution (EDR) that provides detection/prevention of malicious activities that do not rely on signature-based detection methods.
2. Updating all applications/software regularly with the latest versions and security patches alike.
3. In case of running a vulnerable version at any point in time, disable all VPNs (SSL-VPN or IPSEC) until the following remediation steps have been taken:

• a) Immediately upgrade to the latest available release
• b) Regardless of the upgrade, reset user password
• c) Consider all credentials as potentially compromised and initiate an organization-wide password reset
• d) Contact users to reset their passwords explaining the reason.
• e) Leverage third-party credential leak monitoring services.

 

Exploit Emails to Deliver Malware

Ransomware attack groups are also known to deliver vicious malware into their target’s infrastructure. And it is through emails that these groups execute malware implants. Hackers’ modus operandi include attaching malicious .xls and .doc in the emails. When unsuspecting victims open these documents, macros will execute, run payload, and load malware on the computers.

According to CTI, organizations should:

1. Establish a robust plan to identify assets by leveraging a risk-based approach along with the Defense-in-Depth (DiD) method as part of the organization’s security strategy to minimize the risk exposure of vulnerabilities to an acceptable level for an organization.
2. Create a strategy of layering security controls in the organization to make it difficult for adversaries to carry out reconnaissance, exploiting a weakness in the system and potential exfiltration of data.

As per researchers at CYFIRMA, ransomware attacks are all set to evolve constantly in the upcoming years. We predict that

1. Operational technology is the next target for ransomware attackers;
2. IoT will be used heavily as the entry point for ransomware; and
3. Ransomware attacks on third-party software are all set to grow.

 

Additional Reading:

Double Extortion Ransomware Attack-The Achilles Heel for Organizations (cyfirma.com)

Counter Ransomware Evolution with Zero Trust in 2021 – CYFIRMA

Risk Score: 8

Confidence Level: High

Suspected Malware: SmokeLoader Malware

Function: Mainly act to download other malware and as Information Stealer.

Threat actor Associations: Association with Russians

Other Malwares related to SmokeLoader: Dofoil

First Seen: August 2011 but also recently seen in October 2021.

Target Industry: Multiple

Target Countries: Multiple

 

SmokeLoader is primarily a loader, and its main objective is to download or load a stealthier or more effective malware into the system. First detected in 2011 and its functioning is highly complex, and it increases its capability by adding new tactics/techniques regularly and constantly evolving with time. You may guess the advancement of the SmokeLoader from the fact that it was the first malware that used the “Propagate DLL Injection Method” when just its POC was released by researchers.

SmokeLoader variants are used for the purpose of information stealing, botnet, backdoor as well. SmokeLoader has also been used to install/load cryptominers, ransomware, banking trojans, and point of sale (POS) malware. The functionality of the malware changes with the attack type or target and depends on the modules used by attackers as the SmokeLoader is modular in nature.

Earlier, the SmokeLoader was sold on dark-web portals by the name SmokeLdr and since 2014, it is sold only to Russian-based threat actors.

The SmokeLoader is distributed through malicious documents like word or pdf documents send either through spam emails or targeted spear-phishing attacks. Once the victim downloads and opens the malicious document, the malware drops to the system and in the next stage injects malicious code into a compromised system process like explorer.exe and starts its malicious activity in disguise as a legitimate process.

 

SmokeLoader has been evolved over time and has the following capabilities:

1. Act as a downloader for other malware like ransomware.
2. Stealing confidential information.
3. System and Network Reconnaissance.
4. Multiple advance anti-debugging and analysis detection techniques.
5. Anti-Sandbox, Anti-VM, and Anti-Hooking techniques.
6. Code obfuscation techniques to thwart analysis.
7. Decrypts code prior to execution and encrypts again after execution.
8. Capability to encrypt payloads and network traffic.
9. Implementation of Propagate DLL Injection method to compromise legitimate processes like explorer.exe.
10. Provide Persistence.
11. Command and Control Functionality.

 

Initial Analysis:

File Details: As shown in Figure1, the following are the details related to the malware SmokeLoader.

File Type: Windows PE-32 Executable

MD5: 6a8f92ba4df2ba5415cd1fd97fcb87da

SHA256: fa611609c25485e53c73a059ae49eb25b8650727b0cf0d62ae4f72642e1b3d49

Subsystem: GUI

Compilation Time: March 2021

Figure1: Basic Information

Figure1 above shows the basic information related to our malicious file, its hashes, it has Microfoft Visual C++ code and is a 32 bit PE executable. Further, the subsystem is GUI and has a compilation time of March 2021 which is quite recent.

Figure2: Sections

Figure2 above shows the sections present in our malware. All are looking quite normal imported by the malware except .rotuge section which is a suspicious ad when we checked it as shown in Figure3 given below. It is all empty which gives us an indication that may be used by malware later to store and access some code here.

Figure3:

Figure4: Libraries

Figure4 above shows the libraries used by the malware, kernel32.dll used for core functionality such as access and manipulation of memory and gdi32.dll used for displaying and manipulating graphics.

Figure5: Imports/APIs

Figure5 shows above the APIs imported by the malware and indicates towards all the capabilities which we have mentioned earlier can be present int the SmokeLoader.

 

MITRE Attack Techniques:

Sr. No.	Tactics	Technique
1	Initial Access(TA0001)	Spam Emails
		Spear Phishing
2	Execution(TA0002)	Shellcode
		Scheduled Task
3	Persistence(TA0003)	Windows Registry Key/Startup Folder
4	Privelege Escalation(TA0004)	Windows Registry Key/Startup Folder
5	Evasion(TA0005)	Obfuscation
		Process Injection/Process Hollowing
6	Credential Access (TA0006)	Credentials from Web Browsers & Files
7	Discovery(TA0007)	Files and Directories Discovery
8	Command & Control(TA0011)	Web Protocols

 

 

Dridex is Back – This Time on Your Slack

A modified version of the banking trojan Dridex – named DoppelDridex – is being delivered via payloads staged on Slack and Discord CDNs. To launch this malware, several campaigns are leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload that is hosted on domains of popular messaging CDNs such as discordapp[.]com and files.slack[.]com. As these sites are usually ‘allowlisted’ by several network-based control or proxies, several threat actors find them to be attractive launchpads to stage payloads.

DoppelDridex and Threat Groups

TA505

This financially motivated threat group is active since 2014. CTI suspects the group to have Russian origins. Apart from providing initial access development to other threat actors, TA505 is notorious for its Big Game Hunting operations. While several threat actors had distributed Dridex malware, it was this group which was the first one to use this trojan in its campaign back in July 2014.

Target Countries: Canada, Germany, South Korea, UK, USA

Target Industries: Enterprises across Industries, Government Agencies

DoppelSpider

Another suspected Russian ransomware group, DoppelSpider has been active since 2019. CYFIRMA Researchers suspect this threat actor to be responsible for operating DoppelPaymer and DoppelDridex. Researchers have observed this group has been regularly leveraging Slack as well as Discord to drop DoppelDridex.

Target Countries: Austria, Canada, Chile, China, France, Italy, Germany, Japan, Mexico, Qatar, Saudi Arabia, South Africa, Spain, Sweden, Switzerland, UAE, UK, USA

Target Industries: Aviation, Healthcare, Financial Services, Manufacturing, Media, Telecommunications, Others

Grief Ransomware

This ransomware-extortion threat group first emerged in May 2021. It is known to maintain a public leak site where it posts stolen victim data. Threat Actor TA505 is also suspected of leveraging Grief Ransomware to carry out various campaigns/malicious activities.

Till date the Grief Ransomware has targeted the following industries:

• Education – US
• Government – US
• Manufacturing – European Nations, Canada
• Hospitality – UK
• IT Services – France
• Pharmaceuticals – Italy
• Food & Beverage – France
• Agriculture – Croatia
• Online Retail – UK
• Healthcare – US
• Advanced Technology – Portugal

Recommendations

Integrate CTI feeds with existing SIEM solutions to allow faster detection and alerting of malicious activities. Enrich threat intelligence by combining local monitoring, internal and external feeds.

Assess and deploy alternatives for the deployment of an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.

Implement identification and prioritization of cyber risks and PII/CII/PIFI (personally identifiable information/ customer identifiable information/ personally identifiable financial information) through risk assessments, vulnerability assessments, and system reviews.

Ensure software and applications are being inventoried, allowing the organization to keep track of software name and version, installation, last patch date, and current known vulnerabilities. This will help organizations support scheduling updates and removing vulnerable utilities that ransomware could exploit and significantly reduce the attack surface.

Immediate action must be taken to isolate the ransomware to minimize the damage to the data, to prevent the spread of infection to other systems and networks, and to minimize the impact on the mission or business.

Minimize business impact by being open and transparent in case of a ransomware event to restore confidence among stakeholders. Restoration activities must be coordinated with internal as well as external parties (coordinating centers, ISP, system owners, victims, other CSIRTs, vendors, etc.)

 

What to Look for When Choosing An Attack Surface Management Tool

Attack surface management (ASM) is one of the most essential components of IT security. Any software, hardware, SaaS, and cloud assets that store an organization’s data and can be accessed by the internet make up the attack surface. These all become points of entry for a cybercriminal attempting to steal data. In the past, a company could perhaps profess to have control and awareness on all of its attack surfaces. ASM has long been used to address cyber risk.

Today, protecting an organization’s data has become ever more complex. Companies building applications work with third-party vendors who in turn work with more third-party vendors. For one SaaS product or webpage, hundreds of indirect vendors could be involved. Covid has further exacerbated the situation.

In the months following March 2020, the US saw an intense spike in cyber attacks. Employees are now working from home and using their own internet connections to handle sensitive company data. The use of cloud applications, virtual desktops, sharing of devices with family members can all present security concerns.

Companies were not prepared to keep a remote workforce secure. Many processes and procedures like mortgage approvals have not been designed to be done from less-secure home environments. Many organizations improvised and the results were less than secure. Furthermore, a new government call for data disclosure around the pandemic may force companies to re-evaluate the security of that data. All of these factors have created an expanded attack surface. To protect against malicious attacks, the right ASM is essential for this process.

Pre-Covid ASM

Before the pandemic, companies were certainly facing many cyber threats. ASM was developed to address these threats and ensure asset and data security. In order to keep an asset secure, it must be known. All the assets belonging to an organization must be uncovered and accounted for. ASM is a strategy for doing this and ensuring these assets are secure. In pre-covid days, managing an attack surface would require the following:

1. Uncover Known assets: Accounting for assets such as a corporate website, servers, and dependencies running on them, such as SaaS applications.
2. Uncover Unknown assets: Discovering forgotten IT infrastructure, also known as shadow IT, that has been outside of the purview of an IT security team. This could include development websites or marketing sites.
3. Uncover Rogue assets: Threat actors may have already spun up malicious infrastructures such as malware, typo squatted domains, or a website or mobile app impersonating your domain—all of these need to be discovered.

ASM usually involves several phases—discovery, inventory and classifications, risk scoring, monitoring, and malicious asset and incident monitoring. A decent pre-Covid ASM would uncover all your internet-facing assets as well as those managed by third parties. These would include:

1. Web applications, services, and APIs
2. Mobile applications and their backends
3. Cloud storage and network devices
4. Domain names, SSL certificates, and IP addresses
5. IoT and connected devices
6. Public code repositories such as GitHub, GitLab, and BitBucket
7. Email servers

Post-Covid ASM

As the threats presented by the expanded attack surfaces of the Covid world grew, all the above was not enough to keep cybercriminals out. From email or Gmail phishing addresses to malicious apps disguised as Covid tracing tools, remote employees have been targeted by cyberattacks. Between third and fourth-party vendors and remote workers, ecosystems have become highly exposed to numerous threats.

The pandemic world posed new and unique security risks to organizations. Companies had to respond quickly to the environment with increased security. As we settle into the ‘new normal,’ there is an opportunity to improve data security further. Many companies are taking a zero-tolerance policy when it comes to poor IT security and actively working to improve the IT hygiene of their employees and infrastructure.

ASMs must become even more sophisticated than the cybercriminals they are attempting to thwart. To protect an organization in the new normal, an ASM needs to be able to do the following:

1. Have the ability to uncover the risk presented by third-party and fourth-party vendors.
2. Uncover your data/assets on the dark web. This includes data leaks and assets being discussed by cybercriminals.
3. Be able to find exposed datasets on the open and deep web, such as open S3 buckets, public GitHub repositories, FTP servers, etc.
4. Have the ability to risk-rate each attack surface by correlating the exposed asset against industry, geo, tech, or unique ways of rating that are more relevant and accurate.
5. Have the ability to evaluate threats by looking at an attack surface against vulnerabilities. Doing this increases accuracy significantly and saves time. It is critical to take action before a hacker does.
6. Use attack surface discovery not just as a ‘detection’ tool but also as a tool to understand a threat actor’s ‘attack path.’
7. Identify weaknesses not just in technology but also in people and processes. It should evaluate whether your employees and various stakeholders have the training and know what to do to prevent cyberattacks. The ASM should also evaluate the configure process, asset discovery, operational processes while including other IT departments.

The pandemic has brought with it expanded opportunities for cyberattacks. The ‘New Normal’ requires organizations to adopt new tools. It has also brought with it many opportunities to institute new security tools to combat these attacks. Attack Surface Management is one of these tools. However, the previous standards for ASM no longer apply. Organizations must continuously assess threats and have visibility over all assets, third parties, and remote workers. ASM must work in tandem with vulnerability and patch management platforms and be guided by cyber-intelligence to provide continuous monitoring of digital risk profiles. Attack surface discovery, vulnerability intelligence, brand intelligence, digital risk protection, cyber situational awareness and cyber-intelligence should be integrated into a single pane of glass to give cyber defenders a solid hold over new and emerging cyber threats.

 

Leviathan_CobaltStrike

Cobalt Strike is a penetration testing tool that allows an attacker to deploy an agent named ‘Beacon’ on the target machine. The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.

MD5 |113b04ecf632492b3a91ec4ac3129798

SHA-1 | a983cbdbd8a3caf954282b36b37433eabe4d5374

SHA-256 | d4770c15dd2c804322a1a623b6ce36739684d0e9ced380013d45ef90c38f2e9d

Risk Score: 10
Confidence Level: High
Suspected Malware: Cobalt_Strike
Function: Backdoor
Threat actor Associations: Leviathan
Target Industry: Multiple

CYFIRMA’s Threat Discovery and Cyber-Intelligence platform, DeCYFIR, has flagged the file as ‘Suspicious’ due to the factors illustrated in this report.

The file was analyzed in DeCYFIR and below are findings based on the analysis:

The malware was seen to have multiple suspicious TTPs as shown below:

Usually, the Cobalt Strike beacon injects itself into any running process to evade detection and stay persistent.

It was found to be blocking or disabling the system security services to execute the malware flawlessly. This sample was trying to find out the firewall service and terminate it.

The DLL file has 2 export functions:

Anti Debugging function IsDebuggerPresent() is used to identify the presence of the debugger by returning a non-zero value.

The kernel32 UnhandledExceptionFilter() is also used as an anti-debugging parameter to detect debugger.

The function GetCurrentProcessId() is used to get all process id along with ThreadId, the GetSystemTimeAsFileTime() to obtain current time. The GetTickCount() will take time as parmeter to make malware idle.

GetStartupInfoA is used to retrieve the content of the STARTUPINFO structure from when the calling process is created.

GetUserNameA is used to retrieve the name of the user associated with the thread. To retrieve the name of the local computer GetComputerNameA API is used. The malware extracts the name of the files in the current directory.

HttpOpenRequestA is used to create an HTTP POST request handle.

HttpOpenRequestA API is used to send the request to an HTTP server.

The malware queries the server to determine the amount of data available using the InternetQueryDataAvailable API.

MITRE ATTACK Techniques:

 

EXECUTIVE SUMMARY

Russian Cybercriminals – FIN11 Group is suspected of leveraging common target infrastructure indicators (IoCs) across two major campaigns attributed to them known as EmB0 and Topaz Stone, which are tracked and monitored by CYFIRMA in DeCYFIR.

Based on our research and analysis, we observed multiple similarities between the campaign’s target industry & geography, TTPs (Tactics, Techniques, and Procedures), threat actor’s motives, the malware used, along with shared infrastructure and indicators.

The potential collaboration with North Korean hackers as part of hacker-as-a-service (HaaS) and Chinese hackers under ransomware-as-a-service (RaaS), is also suspected post the detailed analysis that was carried out.

The widespread primary motive of both these campaigns appear to be to the exfiltration of sensitive information, Customer information for financial gains.

CYFIRMA recommends using the reported IOC details for measures against this campaign and threat hunting within your environment.

CYFIRMA Risk Rating for this Research is Critical.

FIN11 GROUP CAMPAIGNS

CYFIRMA observed several similar target infrastructure indicators shared between two major campaigns suspected to be carried out by the Russian Cybercriminals – FIN11 Group.

The two campaigns are EmB0 and Topaz Stone. Following are the details of both the campaigns:

Campaign 1

• Campaign Name: EmB0 is suspected to be launched on 12 April 2021.
• Target Industries: Critical Infrastructure, Electricity Supply, Water Management, Transportation, Logistics, Equipment Making, Supply Chain.
• Target Geographies: USA, Japan, South Korea, Taiwan, European Nations, South-East Asia.
• Motivation: Exfiltrate design, supply chain information, sensitive information, Personally Identifiable Information (PII), Customer Identifiable Information (CII), Financial Gains.
• Method Discussed by Hackers and their Interest: Exploiting vulnerabilities, Implanting specialized malwares and ransomware, Lateral movement into the organization.

Campaign 2

• Campaign Name: Topaz Stone aka камень топаз is suspected to be launched on 1 February 2021.
• Target Industries: Financial Institutions, Trading, Financial Regulatory Bodies, FinTech, Supply Chain.
• Target Geographies: Thailand, Singapore, India, Australia, USA, Japan, South Korea
• Motivation: Exfiltration of sensitive information, system information, financial and customer information for financial gains.
• Method Discussed by Hackers and their Interest: Malwares, Custom-built exploit, keen on taking over administrative accounts using specialized malware implants.

Similarities between both campaigns:

Following are the similarities observed between both the campaigns:

COMMON TARGET INFRASTRUCTURE

Following are the common target infrastructure indicators observed between both the campaigns:

HYPOTHESIS – POTENTIAL TTPs

Based on our quick research and analysis of the target infrastructure indicators leveraged by the threat actor, the following malware details are observed:

Dewmode Backdoor: CYFIRMA identified DEWMODE web shells associated with the campaign activities. A set of threat actors named UNC2546, UNC2582 with possible ties to FIN11, Clop, and Ryuk ransomware gangs. The backdoor was suspected to be used in Accellion FTA attacks. Dewmode could download files, delete footprints on the target asset from commands executed by the malicious user remotely.

Ryuk Ransomware: Ryuk is a highly sophisticated type of ransomware that is being used to target organizations all over the world since its discovery in August 2018. With its payloads being found in roughly one out of every three ransomware attacks over the last year, Ryuk is one of the top ransomware-as-a-service (RaaS) groups to amass a fortune of at least USD150 million. The use of worm-like capabilities by developers of Ryuk ransomware suggests that the ransomware operators are evolving in their attack techniques with the motive of cyber espionage and financial gains.

Based on the Attack Mitre framework, the following techniques and tactics are suspected to be used by Dewmode malware/Ryuk Ransomware potentially leveraged by FIN11 Group as part of the campaigns:

INSIGHTS

1. The Russian cybercriminals have been observed to be very active and have targeted multiple organizations in the past. Our findings show their clear interest in potentially targeting organizations across multiple industries, geographies, and leveraging the common infrastructure indicators during the campaigns.
2. The primary intent of these hacker groups in targeting foreign organizations appears to be to exfiltrate sensitive details to be sold in the grey market or to potential competitors for financial gains.
3. CYFIRMA observes clear indicators of Russian cybercriminals suspected of expanding their attack surface and targeting multiple geographies and industries. It is suspected that the cybercriminals and ransomware operators could be operating under the guidance of their masters in carrying out these campaigns.
4. CYFIRMA observed clear potential indicators of Russian Cybercriminals: A) Collaborating with Chinese Threat Groups and Ransomware Operators under Ransomware-as-a-Service (RaaS model), and B) Possible collaboration with North Korean Groups as part of Hacker-as-a-Service (HaaS model).
5. Based on the initial analysis of the indicators, it appears the threat actors are interested in exfiltrating data for financial benefits.
6. We strongly recommend organizations be prepared against potential cyberattacks by the FIN11 Group and other potential Russian Cybercriminals.

RECOMMENDATIONS

1. Build and undertake safeguarding measures by monitoring/blocking the IOCs and strengthen defences based on the intelligence provided.
2. Webservers and application servers need to be updated/patched to prevent attacks such as remote code execution (RCE), which could lead to data exfiltration, data breach, etc. This may also need to be done as needed if critical exploits exist, and a patch and/or workaround is available.
3. Configure network defence systems such as intrusion detection systems (IDS), intrusion prevention systems (IPS) for real-time alerts.
4. Deploy an advanced Endpoint Detection and Response (EDR) engine as part of the organization’s layered security strategy.
5. Limit the unsuccessful login attempts with account lockouts and progressive delays into the login process to make it effective.
6. The use of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is effective against automated bots.
7. Restrict the logins to a specific range of IP Addresses.
8. Implement Multi-Factor Authentication (MFA) to reduce the risk of potential data breaches.
9. Make the root user inaccessible via SSH by editing the sshd_config file and implementing ‘DenyUsers root’ and ‘PermitRootLogin no’ options.
10. Move to a non-standard port for SSH instead of using the default port 22 and edit the new port line in the sshd_config file.
11. Move to a non-standard port for SMB, RDP instead of using the default ports.

 

By Mihir Bagwe, Snr Technical Writer @ CISO Mag

The Cyber-readiness Gap

Here’s a quick recap of what we read in the first two parts of this series. We saw how SMBs have become the mainstay of economies in the APAC region. However, in the second part, we saw the byproducts of this booming sector as the cyberthreat landscape for SMBs continued to surge. But businesses paint a different picture altogether. They feel they are well equipped and prepared to take on the cyber threat “Goliath”. But are they? Let’s see…

Putting in place a dedicated cybersecurity team is just the first of many challenges that an SMB owner faces, but it is a prime one. It begins with educating themselves about the importance of cybersecurity for their business in the first place, then finding the right talent, and then shelling out an extra bit on the recommendation of tools and technologies that they suggest. This can burn a big hole in the SMB owner’s pocket and often is regarded as a reason why they overlook having cybersecurity personnel on board.

Most of these businesses are either bootstrapped or have limited funding, but this does not leave them with much of an option for cybersecurity budgets. Moreover, there is already a “demand and supply” crunch for cybersecurity. Meaning, cybersecurity demands three core components, skilled people, process, and technologies, which are all scarce at the moment. But it is also the only way SMBs can build a cybersecurity culture in their business.

People

At a time when the cybersecurity talent pool is most required, estimates state that unfortunately, up to 3.5 million cybersecurity jobs will go unfilled this year according to Cybersecurity Ventures. The uptake of formal cybersecurity education at the university level has seen a gradual increase over the past few years. But what needs to be understood is that it takes time to educate and train highly skilled professionals, and then a bit more time for them to gain practical work experience. But this talent is mainly absorbed by industry heavyweights and the SMBs are often left high and dry with an under-skilled workforce, which at times only has theoretical knowledge rather than the practical set.

The solution to this Problem

1. Technology is important, but it is the people who use it. Train them to abide by basic security principles.
2. Cross-train your employees.
3. Build a security first consciousness within your company.

Process

Policies, processes, and procedures help companies to stay in control of their cybersecurity architecture. And although there are various frameworks around the globe like NIST in America and SMESEC in the European Union for SMBs of these respective regions, there does not seem to be any formal cybersecurity framework specifically designed for SMBs in the APAC region. This is the need of the hour and we hope formal bodies are listening to it. In the meantime, what can SMBs in APAC do?

The solution to this Problem

1. Have an acceptable yet comprehensive user policy.
2. Create a playbook for different security scenarios and for different business modules too.
3. Conduct a periodic external IT audit.
4. Keep your employees and management updated on the latest cybersecurity news.

Technology

For an SMB owner, cybersecurity can cause technological headaches. The Internet of Things (IoT) is one of the most exciting components of the evolving technology landscape. We are seeing the arrival of tools that can communicate seamlessly with other machines for simplifying the way we live and work. IoT is gradually becoming more ubiquitous and helping especially small businesses grow at a faster pace.

For example, a coffee shop owner who had to pay for manhours of a person to simply take orders from its customers and serve them has now introduced tablets on their tables. QR codes on tables and restaurant apps have also now become the new norm in a society that is more aware of hygiene and social distancing. Tablets and apps offer two key benefits. First, it improves efficiency in the kitchen. The time for taking the order from the customer and conveying it to the kitchen is next to negligible. This helps coffee shops and restaurants to dish out to their customers in lesser time than before. Secondly, the self-service culture aided by digital technologies means recruiting fewer people to wait on tables, and this can bring in significant cost savings for restaurant owners.

However, one of the most pressing issues with such technologies is the security considerations it comes with. As the number of IoT and new-age devices increases, the risk of “rogue” technology is now higher than ever. For this reason, SMBs need to keep fine-tuning their cyber defense technologies, but the lack of people and process capabilities to do this often hampers their technology efforts.

The solution to this Problem

1. Defend against known malware by using a comprehensive antivirus solution.
2. Endpoint security is of utmost importance. So have one for ALL your endpoints. The cost is equivalent to that of an antivirus solution. So, this is a viable investment.
3. Have a data backup solution.
4. Use two-factor authentication for all endpoints and systems of your small business. This should include owner’s as well as employees’ mobile and laptops.
5. Be aware of your cyber and digital risk profile.

In APAC the most commonly used security tools of SMBs include web application firewalls (WAF), cloud access security broker (CASB), and software and application scanners for detecting respective vulnerabilities. The ability to discover digital risks and their impact on business operations remains elusive.

Digital risks include uncovering attack surfaces where hackers can find their way in as well as the continuous monitoring for vulnerabilities that exist in the various technologies which SMBs have implemented. The once-a-year pentest would not be sufficient if businesses want to ensure they are protected 24/7.

Businesses that are not equipped to detect data leaks or breaches would continue to put their business at risk. The “head in the sand” mindset will not work if they want to take a proactive approach to stem out attacks and put a stop to hackers’ pilferage.

As competition heats up on the business front, the need to ensure the brand is not hijacked or negatively impacted is of utmost importance. This means business owners need to be equipped with the knowledge of any brand impersonation and infringement and these issues could show up as lookalike domains, fake social media accounts, and more. All of these digital risks can easily translate to a direct business impact if left unattended.

To help SMBs overcome their cybersecurity challenges, CYFIRMA has built a solution that can help businesses build a stronger defense against cyber threats.

Learn more about CYFIRMA’s Digital Risk Discovery platform, DeTCT, here.

 

By Mihir Bagwe, CISO Mag

In the first part of this series, we have already seen why small and medium businesses (SMBs) are the backbone of modern economies and hold the lion’s share in the majority of APAC’s GDP. But the pandemic has impacted the growth of SMBs and owners today have to re-strategize their businesses and operations. And this has become the catalyst for rapid digital transformation. However, with some pros, come some cons and digital risk tops the list. So, let us discuss what challenges do SMBs have to face from threats in the digital world.

Let’s take a dive into some of the latest facts and figures related to cyberthreats and attacks aimed at SMBs.

The Numbers Game

As per a global small businesses survey, almost 25% of small businesses feel that their cybersecurity protection is inadequate.

A PwC survey stated that of the total number of reported cyberattacks that took place in the APAC region during the last year, 75% of them were specifically targeted at SMBs.

57% SMBs sustained cyberattacks in the past 24 months with 76% of them suffering more than one attack.

44% of the SMBs reported a data breach in the past 24 months.

Nearly 60% of the data breaches reported by SMBs in developed markets of Australia, New Zealand, and Singapore, were due to third parties.

The average detection time of a cyberattack in APAC is 54 days.

As per Cisco’s “2020 CISO Benchmark Study,” 46% of SMBs with < 1k employees had 5-16 Hours of Breach-Related Downtime.

83% of data breaches against SMBs are financially motivated.

52% of the SMBs surveyed in APAC for the “SMB State of Cybersecurity” report, agreed to lack of in-house skills necessary to properly deal with security issues.

Since the beginning of the pandemic, 86% of SMBs now place cybersecurity within their top five priorities of their organization.

As per an Infrascale report, globally 83% of the SMBs felt they were prepared for a ransomware attack. However, 46% have been targeted successfully, and a staggering 73% have made ransom payments.

Of the above, 43% percent of SMBs paid ransom ranging between $10,000 to $50,000 and 13% said they were forced to pay more than $100,000.

In APAC, more than 30% SMBs suffered damages between $50,000 to $250,000, while another 9% sustained damages of more than $1 million.

Reportedly, 22% of SMBs switched to remote work without having a full-proof cybersecurity threat prevention plan in place.

These numbers certainly suggest that the cyberthreat landscape for SMBs is growing alarmingly and is very concerning, to say the least. But what are the exact threats? How do they intrude on the networks in the first place? How much bearing does it have on your pocket? Let us dig deeper.

Cyberthreats to be wary of

The end goal of a cyberattack is to explicitly steal and exploit the customer, employee, financial data, or the intellectual property of the targeted business. But there is an order to this chaos. Notably, SMBs are at a higher risk of the following threats in the immediate future:

Our Old Nemesis – Malware

It is a malicious code or software that is specifically designed to damage, disrupt, steal, or in general inflict some of the other “bad” or illegitimate action on data, hosts, or networks, on which it is injected. This is regarded as a top threat because in general, 70% of Asia Pacific’s SMBs have experienced an incident of an exploit or malware evading the intrusion detection system adopted by them.

How to Avoid Malware Damages?

The National Cyber Security Centre’s “Small Business Guide for Cybersecurity,” suggests that SMBs should adopt a “defense-in-depth” approach. This means using a layered defense mechanism that has several mitigation steps at each layer. However, it notes that the most important mechanism that SMBs need to have in this case is a real-time digital risk assessment and protection mechanism or platform. Smaller businesses need to proactively keep track of their digital footprint for validating attack surfaces, vulnerable systems, and data leaks. The quicker they can detect their threats, the better armed they are to plug the gaps and deflect them.

The New Cartel in the Digital Space – Ransomware

As per a “Beazley Breach Report 2020”, 62% of ransomware attacks were targeted at small businesses. This is a stark reminder to the people who believe in the myth that “ransomware gangs only go after larger companies since SMBs do not offer anything valuable to them.” Now let’s figure this out. Like the big players, SMBs also store data, which includes credit card numbers, protected health information (PHI), personally identifiable information (PII) and even biometric data in some cases. For cybercriminals, this is equivalent in value to GOLD. They can pilfer and use this data to take out loans, steal identities, make wire transfers and complete other scams.

Another reason why ransomware is a serious threat particularly to SMBs is the fact that this type of attack can mean the end of the road for a small business. One such example of an SMB calling it a day due to a ransomware attack is that of the Heritage Company. It was asked to pay-up if it wanted to get its systems back online. After weighing its options, the Arkansas-based telemarketing firm paid the ransom. But that did not end the nightmare. Its system had been trashed, and two months later it still failed to recover its data. The company restructured to stop the bleeding but to no avail. Eventually, it was forced to shut down as it could not take any more financial drain.

How to stop ransomware in its tracks?

Follow these four easy steps:

1. Install quality endpoint protection which includes web and email protection.
2. Take regular offline backups to make sure all key data can be reliably restored.
3. Train your employees to spot latest forms of ransomware delivery methods.
4. Install a real-time tracking solution that can monitor your employees’ credentials, customer PII, and other critical data on the open and darker side of the internet – the hackers’ forums, dark web, and bin sites.

The Regulars – Phishing and Business Email Compromise

In the Asia Pacific, phishing remains one of the top three cyberattack types suffered by SMBs. One in every three SMBs has reported facing this attack in the past year.

Through the cycle of the ongoing pandemic, phishing scams have only seen an uptick. In the initial days, it leveraged COVID-19 testing and the associated anxiety, and now vaccine-related phishing scams are bursting through the roof.

Another popular type of attack that scammers have been successfully adopting in recent years is business email compromise (BEC). In a BEC attack, cybercriminals first steal legitimate business email account credentials, which are later used to launch financial fraud campaigns like fraudulent email messages, requests for out-of-channel funds/wire transfers, and deleted accounting trails. However, the recent traits in a BEC attack have found scammers posing as HR specialists recommending vaccines to their employees and exploiting the emotions of their victims.

Both phishing and business email compromise attacks are now getting sophisticated, persuasive, targeted, and are very well disguised. They will keep coming at you no matter what. Because the weakest link in your business security is…YOU! To mitigate the human threat, we need to work on changing cyber user behavior.

How to Prevent a Compromise through a Phishing Email?

Follow these steps:

• Train your employees to identify phishing emails. ALL of them!
• Run periodic phishing simulations to test their vigilance and keep them better prepared.
• Keep following steps 1 and 2 again, and again… and again.
• Consider incentivizing employees who act responsibly and report phishing attacks.
• Counsel those who repeatedly fail or ignore internal phishing drills.

Proliferation of mobile, IoT and BYOD devices

Since the onset of the pandemic, mobile and BYOD (bring your own device) devices have been deemed as saviors for business continuity. The relatively recent developments such as Internet of Things (IoT) devices, biometrics, and the use of personal mobile devices for work have been quickly and broadly adapted by SMBs. However, these new endpoints and revolutionary technologies such as IoT appear to be one of the major factors driving these cyberattacks towards SMBs. Why? Because security technologies and practices tend to lag in these areas.

Companies may be aware of this, yet many feel helpless.  In APAC, the most vulnerable endpoints in an SMBs operational ecosystem were identified as desktop and laptop computers (44%) with an equal weightage given to web servers (44%). These numbers suggest that SMBs are aware of their weak links, however, it is alarming to note that only 53% of SMBs have antivirus solutions in place.

Mobile devices, IoT, and BYOD are currently the weakest link for not just SMBs, but businesses of all sizes. But the scale tilts further for small businesses because their entire business ecosystem is thriving on these devices.

So, how to keep your devices protected?

Follow this simple three-step process:

1. Use a strong password and multi-factor authentication.
2. Have antivirus or anti-malware software installed on all your mobile devices.
3. Update all devices with the latest security patches and software versions.

The attack surface for SMBs is growing at an unprecedented rate as newer IoT devices and technologies keep taking center stage. It is now becoming increasingly difficult to track and keep an account of your entire digital footprint, more so because of a resource crunch (both money and manpower), that majority of the SMBs are currently facing. To address this issue and keep a track of your entire digital footprint, you may take help from an able hand like CYFIRMA’s DeTCT.

CYFIRMA’s DeTCT can uncover the digital risks profiles for SMBs and help them detect the following:

1. Gain awareness of the potential attack surfaces including forgotten systems and applications in which hackers can find their way in.
2. Fake identities of your business executives – these can be fake social media profiles, fake email IDs. These are signs of potential phishing campaigns where threat actors can impersonate persons of authority to trick other employees or even potential clients into clicking malicious emails.
3. Look-alike domains and websites – created to deceive users into believing fake content or divulging personal/financial information.
4. Your IP addresses, employee credentials, customer personally identifiable information are mentioned and thrown into underground forums, dark web, bin sites. This means threat actors have found a way to breach your defenses and have exfiltrated important data.
5. Vulnerabilities in your system, software and applications which if left undetected and unattended would leave the door wide open for hackers.

For more information on CYFIRMA’s DeTCT, click here.

 

Stay tuned for Part-3: The Cyber-Readiness Gap

 

SMBs – The Backbone of APAC Economies

If you are a small or medium-sized business (SMB) and still surviving the wrath of the ongoing pandemic, then pat your back, and take a bow. Not many have survived, but you did. You already are a winner!

These unprecedented times have tested the mettle of all business sizes around the globe. But this cannot hold truer than for the small and medium-sized businesses. We say so because when it comes to the Asia-Pacific region, SMBs hold a market share of more than 90% (in some countries this goes up to 98%) of businesses and employ a whopping 50% (the number goes above 90% in some Asian countries) of the total workforce.

SMBs in the APAC region contribute nearly 17% to the national GDP. However, this number shoots up three times in the higher income countries like Malaysia and Singapore, where their contribution is nearly half of the country’s annual GDP (40 to 50%).

COVID-19 Pandemic Gives a Wobbly Wheel

The number mentioned above has taken a beating since the beginning of the pandemic though. As per Facebook’s ongoing research collaboration with the Organization for Economic Co-operation and Development (OECD) and the World Bank, 1 in 4 (24%) Global SMBs have reported closures by February 2021 and an astonishing 55% decline in sales.

These numbers, however, increased while speaking about the condition of businesses in the APAC region. The report stated that 61% of small-medium businesses reported a drop in sales volumes and an overall 45% of the workforce faced the axe due to the COVID-19 pandemic. This trimming of the workforce and the need to paddle harder through troubled waters of the pandemic has led to an increase in the adoption of digital tools in SMBs.

However, this embrace of digitization has aroused the interest of major cybercriminals groups who until now were only interested in the big-ticket names. A 2021 Data Breach Investigations Report shows that 46% of all cyberattacks targeted globally were aimed at SMBs. This means the number has exactly doubled in a year where it was hovering around the 28% mark previously. The reason? Mass digitization wave owing to the pandemic.

Digitization Drive of SMBs

Since the onset of the pandemic, stringent lockdowns were imposed around the globe. This made the situation precarious for SMBs as they struggled with multiple challenges such as disruptions in logistics, restrictions on labor mobility, overall declines in demand or market orders, and a subsequent drying up of cashflow. The challenges are uneven across the industries. For example, export firms suffered more than others, due to a decline in external demand and a lack of key raw material supplies, whereas those in the manufacturing sector reported more problems with supply chain disruptions.

However, in the face of adversity, SMBs found an ally that would help them get through this torrid time and not only help them recover but also leapfrog competitors who are digital laggards. Yes, we are talking about the ally named “Digitization” – the use of digital technologies and digitized data to impact how work gets done, transform how customers and companies engage and interact, and create new (digital) revenue streams.

According to the “2020 Asia Pacific SMB Digital Maturity Study”, based on a survey conducted by the International Data Corporation, 94% of SMBs in APAC say they have become more reliant on technology to ensure business continuity during the pandemic, while nearly 70% say they are accelerating the digitization of their businesses to cope with the situation.

Digitalization cannot happen without digitization – the conversion of business processes and data from analog to digital.

Evidently, SMBs have started using or have increased their usage of digital tools at some point in the customer lifecycle, since the onset of the pandemic. The biggest advantage of the digital medium is that it helps them immensely to reach their customers directly. It seems easy, gives great ROI but like all services, it comes with its own set of challenges, and cybersecurity is one of them.

The digital risk faced by SMBs is immense and can be categorized into two broad areas – the lack of cybersecurity awareness and the shortage of cybersecurity resources. This has resulted in the inability to recognize cyber risk and thus unable to plan and implement mitigation strategies. The basic understanding of attack surfaces can be sorely lacking when business owners are uninformed of how cybercriminals could compromise a network and steal data. Every system or application that is somehow connected to the Internet can turn into entry points for hackers with malicious intent. By rapidly moving their processes into digital formats and connecting to third-party systems, SMBs would have added many potential attack surfaces overnight. Furthermore,  not fully understanding how the software supply chain works, SMBs can be easy targets for enterprising cybercriminals.

In many instances, SMBs would not even be aware that they have been compromised, that data related to their businesses, partners, and customers would be floating in dark web marketplaces and sold over and over again. Not knowing they have been breached, these business owners would not be able to take action to strengthen their defense.

Without adequate IT and security resources, SMBs would be exposed to vulnerabilities which they would be unable to mitigate. These could come in the form of expired certificates, weaknesses in their operating systems and applications, unpatched software, and more.

SMBs could also be in the dark should hackers impersonate their domains, companies, websites, social media profiles. These are all signs of phishing attacks and scams in the making.

The threats associated with SMBs are growing by the day. The lack of basic cyber hygiene can hinder SMBs’ growth and threaten their long-term business viability.

And before the problem escalates, we would recommend SMB owners onboard a technology partner that can help them gauge their digital exposure so they would have a pulse on their digital risk profile and can start to take actions to close cybersecurity gaps.

One such technology partner would be CYFIRMA’s DeTECT.

DeTCT helps businesses remove the blind spots in their cyber risk profile and arms them with critical information of data leaks, breaches, and impersonation related to the business. Equipped with this knowledge, business owners can implement the right solutions confidently and accelerate their business growth.

For more information on CYFIRMA’s DeTCT, click here.

Stay tuned for Part-2: The Looming Cyberthreats to SMBs

 

It was in 2019 when America’s security staffing company, Allied Universal, was hit by a cyberattack, that Double Extortion Attacks came into the picture. Fast forward 2021, just like WFH (work from home) amidst the COVID-19 pandemic, even double extortion ransomware attacks have become the new normal. Simply put this technique involves:

1. Stealing of confidential data and encrypting the victim’s files; and
2. In case the victim refuses to pay the ransom, to expose the data online

No doubt that double extortion attacks boost the threat actors’ chance of making profits, but it also highlights the various ways in which cybercriminals are improvising on their attack arsenal. Even in cases where data backup is available, it is the kind of pressure and potentially serious consequences – like reputation damage – which makes these attacks highly potent and dangerous. One best example of this case is the REvil group. Rather than simply leaking the data online, the group prefers to monetize the stolen data by auctioning it on the dark web – thereby increasing the pressure on its target.

Ransomware operators have traditionally relied on operational disruptions and reputational damage to force victims to pay the ransom. However, their tactics are consistently improving. Some operators are attempting to build trust with the victims by adhering to a set of “principles” and providing “guarantees”. Another approach may involve “Ransom DDoS attacks” (RDDoS) where the RDDoS attackers use the threat of taking down the organization’s network or other such aggressive approaches.

Ransom Distributed-Denial-of-Service (DDoS) attacks begin with a ransom note served to the targeted organization about an impending attack. This could be accompanied by a demo attack to prove the attacker’s intent and capability. If the targeted organization chooses to ignore this ultimatum, they could be inundated with attack traffic generated by either their botnets or by a DDoS service they hired. Such attack traffic is likely to target layers 3, 4, or 7 in the Open Systems Interconnection (OSI) model, ergo the Network Layer, Transport Layer, or the Application Layer. As a result, the targeted application or service slows down to a crawl or crashes completely. Usually, after their point has been proven, the attackers will renew their ransom demand.

In a world where downtimes equate to financial losses, the threat of RDDoS is likely to garner the potential victim’s undivided attention. Process-driven industries are attractive targets for ransomware attackers as a break in the supply chain and ecosystem would cause significant disruption, prompting the victim to pay the ransom rather than face reputational damage, loss of business, and the impending costs associated with recovery operations.

At present, ransomware operators are suspected to follow a 4-layer approach of targeting organizations which includes:

1. Infiltrate into the target organization’s network;
2. Exfiltrate and encrypt data;
3. Demand ransom and “Name & Shame”; and
4. Leave behind their footprints in the targeted organizations to come back and attack again.

The double extortion attack, thus, is not only a milestone in the ransomware landscape – rather it is a clear indicator of how mature the cyberattack strategy has grown. Evolving from plain opportunistic attacks to a well-studied, planned, and executed maneuver – these attackers are pushing cybersecurity personnel to up their game.

New Cyberattack Strategy Through Old Attack Vectors?

To say that phishing, or rather spear-phishing (to be precise) is the primary way in which double extortion attacks are executed would be true and at the same time quite an understatement. If one were to look into the modus operandi of most double extortion attacks, there is a glaring pattern and a common denomination that is being exploited. These attacks usually thrive on the vulnerability of the on-premises devices – with internet-facing systems being their prime target. For instance, since the end of 2019, almost every VPN (virtual private network) vendor has suffered severe vulnerabilities. With VPNs being directly exposed to the internet and providing access to internal resources, it has emerged as an ideal target for double extortion attacks.

Some of the vulnerabilities affecting the VPN devices actively exploited to inject ransomware are CVE-2019-11510, CVE-2018-13379, CVE-2019-1579, CVE-2019-19781, CVE-2020-2021, CVE-2020-5902.

Apart from VPN concentrators, internet-facing systems like RDP (remote desktop protocol) is also providing double extortion opportunities to threat actors. While opening up the RDP connections directly on the internet is insecure, with the ongoing pandemic this was the route most organizations resorted to providing remote access to their internal resources. The extent to which this move exposed businesses to cyberattacks can be gauged from the FBI’s Private Industry Notifications to K-12 schools warning them about the risks of ransomware attacks leveraging open RDP connections.

DDoS – The Newest Trend in Double Extortion Ransomware Attack

Distributed denial of service (DDoS) attacks is the latest trend leveraged by ransomware groups to execute double extortion. With the COVID-19 pandemic and the subsequent WFH scenario, the DDoS attacks have made a major comeback. Not only has there been a rise in its frequency (surpassing 10 million attacks in 2020 as against 8.5 million in 2019), these attacks emerged more lethal and powerful. For instance, in September 2020, the SunCrypt ransomware adopted DDoS as an added tactic for double extortion. The surge in bitcoin prices in recent times is yet another reason why this tactic is used by ransomware gangs.

Thus, from being a seasonal event, DDoS extortion campaigns have morphed into an integral part of the threat landscape for organizations targeting nearly every industry since mid of 2020.

The trend is expected to continue given the growth in the use of connected and Internet of Things (IoT) devices.

DarkSide Ransomware – Exposing the Sinister Aspect of Double Extortion

Human-operated ransomware, DarkSide works on ransomware-as-a-service (RaaS) business model – with ransom demands ranging from $200,000 to $2,000,000, depending on the size of the compromised organization.

This ransomware group follows the double extortion tactic – meaning not only do they encrypt the user’s data, but also exfiltrate it and threaten to make it public in case the ransom demand is not met. The first step of their attack method is to harvest the clear text from the victim’s server, after which they encrypt it and demand ransom. Darkside ransomware group then make a backup of this data in its own servers.

The group prefers high-value targets such as banking and financial institutions as these are deemed as repositories of customers’ personally identifiable financial information (PIFI).  For instance, the recent attack on Banca di Credito Cooperativo (BCC) in Rome was conducted by the DarkSide ransomware group. The attack affected the operations at 188 branches causing serious distruptions to the bank.

Similarly, the American subsidiary of a prominent Japanese manufacturer, Komari, was targeted by the DarkSide ransomware gang in March 2021. The incident resulted in the exfiltration of critical data including personal data of clients, details of agreements, information about company activities, etc.

Apart from leveraging the double extortion tactics, the modus operandi of DarkSide also reflects the growing trend of Ransomware-as-a-Corporation (RaaC). When it comes to its tactics, techniques, and procedures (TTPs) the operation of this group is similar to Maze, NetWalker, Sodinokibi, and DoppelPaymer. What differentiates the DarkSide ransomware group from other threat actors is  its targeted attack methodology, highly customized ransomware executables for every target, and a communication process which is highly corporate-like.

Apart from making headlines for its aggressive attack tactics, the group gained attention for its ‘ethical’ principles which executing an attack. The DarkSide operation is never targeted towards vulnerable and critical bodies like hospitals, schools, and even governments – a silver lining in the era of double extortion ransomware attacks?

The Possible Solution?

Organizations recovering from ransomware attacks must determine how the malware was able to enter their network, even before they start thinking about restoring it. The key learning from such an incident must be to understand the degree of compromise – the how, when, what, and why equation. It is possible that to install the ransomware, operators would have leveraged backdoor access to the network using remnants from a previous malware intrusion. Ransomware operators are increasingly leaving behind footholds that could be exploited in a future attack. By not examining how their network was originally compromised, potential victims are helping the ransomware operators’ cause.

Recently, UK’s National Cyber Security Centre (NCSC) wrote in a blog post about one such incident where the victimized company paid millions in bitcoins to secure their stolen files and restore the compromised network. Unfortunately, they failed to analyze how the cybercriminals originally infiltrated the network. In less than two weeks after the settlement, the same ransomware gang infected the now restored network with the same ransomware.

Updating all your internet-facing devices with the latest patches is the first step towards containing all kinds of cyberattacks, especially ransomware attacks. Restricting users’ ability (permissions) to install and run unwanted software applications is yet another way in which the attack surface can be reduced.

It will be wise to assess and deploy an advanced endpoint protection solution that provides detection/prevention for ransomware activities that do not rely on signature-based detection methods. We would also recommend organizations be prepared for ransomware attacks by constructing a business continuity plan that includes backup and recovery.

The best outcome would be to prevent the ransomware attack from occurring in the first place. This requires a telemetry system with insights into cybercrime in the making where defenders are equipped with early warnings to thwart an attack.

 

 

Research on this cyberattack is ongoing. Its full magnitude and impact are still under investigation. This report will be updated by CYFIRMA researchers as new data comes to light.

Report covers the following:

OUTLINE

1. Summary
2. Introduction
3. Key Findings
4. Suspected Threat Actors
5. Insights
6. YARA Rules
7. Recommendations
8. Indicators of Compromise
9. Extract of List of Organizations affected by the campaign (As of 21 December 2020)

SUMMARY

Attack Vector: Vulnerabilities and Exploits, Steganography
Objective: Lateral Movement, Data Exfiltration, Credential Theft
Suspected Hacker Group: Unknown Russian Groups <Reach out to CYFIRMA for details>
Target Country: Global
Target Industry: Government agencies, Universities, Manufacturing, Hospitals, Telco and Technology, Semiconductor, Retail, Financial, and many more
Type of Attack: Supply Chain
Target Technology: SolarWinds – Orion Platform 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1
Detected Date: 13 December 2020
Attack Status: On-going
Risk Rate: High

INTRODUCTION

As per researchers, threat actors have gained access to numerous institutions and organizations around the world in a widespread campaign, known as UNC2452. This was executed by trojanizing SolarWinds Orion business software updates that inserted a vulnerability (SUNBURST) within their Orion Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1, which, if present and activated, potentially allowed attackers to compromise the server on which the Orion products run.

Subsequent activity after this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly qualified set of possibly state-sponsored threat actors and the operation was carried out with significant operational efficacy and competency.

The cyberattack, which began to be exploited last spring, targeted numerous entities of the US administration, in addition to public and private organizations from around the world. Potentially attributed to Russia, it would be one of the most unsettling attacks identified in years.

In the subsequent analysis of the trojanized Orion artifacts, the .NET .dll app_web_logoimagehandler.ashx.b6031896.dll was dubbed SUPERNOVA, details of its operations are still being uncovered and progressively getting explored publicly.

After an initial period of inactivity of up to two weeks, the backdoors recover and run commands, called “Jobs,” which include the ability to transfer files, run files, profile the system, reboot the machine, and disable system services. The malware disguises its network traffic as the Orion Improvement Program (OIP) protocol and stores the recognition results within legitimate plug-in configuration files, allowing it to integrate with legitimate SolarWinds activity. The backdoors use multiple obfuscated block lists to identify forensic and antivirus tools running as processes, services, and drivers.

KEY FINDINGS

Post-compromise behavior following this supply chain compromise involved lateral movement and data theft. The campaign is the work of a highly-skilled threat actor and the operation was conducted with significant operational proficiency and persistence.

Traces of SUPERNOVA (Latest)

By analyzing artifacts from the SolarWinds Orion supply chain attack, security researchers uncovered another backdoor, likely coming from a different threat actor. Dubbed SUPERNOVA, the malware is a webshell planted in the code of the Orion network and application monitoring platform and has allowed adversaries to execute arbitrary code on machines running the Trojan horse version of the software.

The webshell is a Trojan variant of a legitimate .NET library ( app_web_logoimagehandler.ashx.b6031896.dll ) present in the SolarWinds Orion software, modified to allow it to bypass automated defense mechanisms.
Orion software uses the DLL to expose an HTTP API, allowing the host to respond to other subsystems when requesting a specific GIF image.

Researchers analysing the DLL concluded that malware could escape even manual analysis, as the code implemented in the legitimate DLL is harmless and of “relatively high quality”. Threat actors have added four new parameters to the legitimate SolarWinds file to receive signals from the command and control infrastructure (C2).

The malicious code contains a unique method, DynamicRun, that compiles the parameters to an in-memory .NET assembly on the fly, leaving no artifacts on the disk of a compromised device. In this way, the attacker can send arbitrary code to the infected device and execute it in the context of the user, who most often has elevated privileges and visibility on the network.

Most webshells run their payloads in the context of the runtime environment or by calling a subshell or process such as CMD, PowerShell, or Bash.

Microsoft believes that SUPERNOVA is likely the work of an adversary different than the one who breached cybersecurity firm FireEye and more than half a dozen US government entities.

SUNBURST Backdoor (Earlier)

SolarWinds.Orion.Core.BusinessLayer.dll is a digitally signed Orion software system component that includes a backdoor that communicates to a third-party servers using HTTP. This SolarWinds Orion plugin is being monitored as a trojanised version.

It retrieves and runs commands, called “Jobs,” after an initial sleeping time of up to two weeks, which includes file capability, executing scripts, profiling programs, rebooting the computer, and deactivating device services. The malware masks its network traffic as a protocol for the Orion Improvement Program (OIP) and stores recognition results from invalid plugin configuration files that allow it to integrate with legit SolarWinds operation. The backdoor is used to classify forensic and anti-virus methods as systems, utilities, and drivers using several fog lists.

Post-Compromise Operations

After gaining initial access, this group uses a variety of tactics to cover up their activities when advancing laterally. These threat actors tend to keep a light malware footprint, choosing to provide the legal certificate and remote access to the victim’s environment.

TEARDROP is a memory-only dropper that operates as a service, spawns a thread, and reads “gracious truth.jpg” from a file that is likely to have a bogus JPG header. Then, verify that HKU\SOFTWARE\Microsoft\CTF exists, decode an embedded payload using a custom XOR rolling algorithm, and manually load an embedded payload into memory using a custom PE-like file format. TEARDROP has no incompatible coding for any previously seen malware.

The threat actor sets hostnames on their command-and-control infrastructure to represent the legal hostname contained in the victim’s setting. This helps the adversary to pass into the atmosphere, avoid suspicion, and avoid detection.

SolarWinds.Orion.Core.BusinessLayer.dll (b91ce2fa41029f6955bff20079468448) is a SolarWinds-signed plugin feature of the Orion software system that includes an obfuscated backdoor that communicates to third party servers through HTTP. After an initial inactive duration of up to two weeks, it retrieves and executes commands called “Jobs,” which provide the ability to pass and execute data, device profile, and disable system services.

Backdoor’s behavior and network protocol combine into legitimate SolarWinds operations, such as masking the Orion Improvement Program (OIP) protocol and storing identification data in plugin configuration files. Backdoor uses a range of blocklists to identify forensically and anti-virus approaches through networks, services, and drivers.

Researchers have claimed that FireEye, Microsoft, and Godaddy worked together to build a “kill switch,” for the Sunburst malware.

SUSPECTED THREAT ACTORS

Unknown Russian Groups. Reach out to CYFIRMA for detailed insights on the attributions and correlations.

INSIGHTS

SolarWinds is a well-known managed services provider that provides a range of tools and services to organizations to manage their IT infrastructure. Adversaries have interfered with the SolarWinds’ Orion platform, a software used to monitor and manage large networks. It is expected that the software update version between 2019.4 and 2020.2.1 has been exploited by the adversaries. The company has now released a fix to version 2020.2.1 HF 2.

Researchers warned that software updates for SolarWinds’ Orion product had been subverted by backdoors dubbed SUPERNOVA and SUNBURST. Malicious software updates, which have been signed with valid digital signatures, could steal files, profile systems, and disable system services.

Threat actors are upgrading their arsenal with new and sophisticated malware tools to target organizations and exfiltrate sensitive information. Threat actors are observed pushing their malware/tools as part of updates of a legitimate application and using steganography to evade detection.

For more research data on Yara Rules, IoCs, and hashes, email [email protected]