Bi-Weekly Security Update 8/3/2017

Malicious Content Identified and Inserted:

• IPs – 504
• Domains – 545

Target List Content Updated:

• TSCritical
• TSRansomware
• TSPhishing
• TSBanking
• TSInbound

Indicators of compromise have been updated for the following:

(For a deeper dive into the research behind a threat or campaign, click on the links in each description)

• Aleta ransomware is attributed to the BTCware malware family. This ransomware uses two encryption ciphers: AES-256 and RSA-1024, making it more difficult to decipher without sending payment to operators. The encrypted files are in this format: [original filename].[email address].aleta. Distribution is manually executed by compromising Remote desktop protocol (RDP) connections not password protected, or through the fake software, “Rogers Hi-Speed Internet,” used to spread the BTCWare ransomware.
• Phishing campaign with fake HealthCare invoices.
• Phishing campaign with fake Google Docs.
• Phishing targeting Microsoft accounts.
• Necurs botnet is known for spreading malware by sending spam e-mails with payloads. These specific campaigns were found by Flashpoint. (May 2017) These spam campaigns feature a multi-stage infection chain including a PDF file, a malicious Microsoft Office document, and the Jaff ransomware loader. More on the blog.
• Vortex is ransomware crypto virus, seemingly targeting Polish speakers with a Polish ransom note. The encrypted files are changed to show extension: *.aes. This may be related to the algorithm used for encryption, AES encryption algorithm with 256-bit cipher.
• Malvertising campaign Seamless leads to the Rig EK and Ramnit Ramnit malware family that steals your sensitive information, including bank user names and passwords. It can give a malicious hacker access and control of your PC, as well as stop your security software from running. Rig Exploit Kit, discovered in 2014, primarily exploits vulnerabilities in Internet Explorer, Java, Adobe Flash and Silverlight. These threats can be installed on your PC through an infected removable drive, such as a USB flash drive.
• KS Clean, a malicious Android app discovered by researchers at Zscaler, is delivered via malvertising. Once installed on the user's device, it can't easily be removed, as it removes the app's uninstall button and locks the device (for a couple seconds) if the user tries to remove the app's administrative privileges.
• RoughTed is a large malvertising operation active for a year, with increased activity in March 2017. This malvertising campaign is diverse and able to target users of any operating system or browser. For each platform, there is a distinct payload, including: Exploit Lits like Magnitude and Rig EK, Rogue Chrome extensions, PUP for Windows, etc.
• The Trojan Kovter surfaced in 2014 as a screen locker and scareware sample masquerading as a law enforcement tool. Since then, it has been used in click-fraud and malvertising campaigns, as data-encrypting ransomware, and a malware installation tool.
• Cerber ransomware debuted in late February 2016 and is one of the most prevalent ransomware variants. This ransomware is typically distributed via emails containing macro-enabled Word documents, Windows Script Files or Rich Text Documents. Cerber uses a strong, presently unbreakable encryption, and has a number of features that, when combined, make it unique in today's ransomware landscape. A new development of the ransomware potentially gives it DDOS capabilities. One recent variant of the ransomware has been spotted quietly sending out huge amounts of network traffic from infected machines. Read more in our blog post, here.
• BankBot is a malware targeting android OS, appearing in Google Play in different forms, often impersonating well-known application icons or names. The predecessor of this malware, BankBotAlpha, was first advertised back on December 19, 2016, on a Russian forum as a new initiative to build an Android banker from scratch. This malware achieves device admin privileges from the user and collects information like IMEI, Bank applications present on the device, OS version, presence of root, etc. The communicates to the C&C is by SMS and over HTTP protocol.
• Bahamut is a cyber espionage group targeting mostly human rights activists and political figures in the Middle East. In a writeup by bellingcat, they described the significant effort put into the spear phishing emails sent to these targets. For example, in emails attempting to harvest Google credentials, the target's redacted phone number would appear within the email as a way to feign legitimacy.
• The Gamaredon Group, discovered by Palo Alto Networks, has been active since 2013. Although previously using off the shelf products, they are now developing their own tools that can download and execute payloads, capture screenshots, scan network drives for specific data and remotely execute commands on victim computer. They primarily use compromised domains, Russian and Ukrainian country code top-level domains (ccTLDs) and Russian hosting providers to distribute their malware.

 Blog Roundup:

 New Targets: Comments Spamming Bots

 New/Updated Targets:

• New Targets for “Comment Spamming Bots – IPs” are now available and should be used to protect your websites/forums/blogs from automated sources of spam.

Don't have ThreatSTOP but want to try it out? Check out our no fuss, quick product demo here.