Tag: CLOUD

Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage to the infected machine it runs on CPR sees over 17K of Azov-related samples submitted to VirusTotal

During the past few weeks, we have shared the preliminary results of our investigation of the Azov ransomware on social media, as well as with Bleeping Computer.…

Read More

This post is also available in: 日本語 (Japanese)

Executive Summary

Cloud breaches often stem from misconfigured storage services or exposed credentials. A growing trend of attacks specifically targets cloud compute services to steal associated credentials and illicitly gain access to cloud infrastructure. These attacks could cost targeted organizations both in terms of unexpected charges for extra cloud resources added by the threat actor, as well as time required to remediate the damage.…

Read More

Authored by SangRyol Ryu and Yukihiro Okutomi 

McAfee’s Mobile Research team recently analyzed new malware targeting mobile payment users in Japan. The malware which was distributed on the Google Play store pretends to be a legitimate mobile security app, but it is in fact a payment fraud malware stealing passwords and abusing reverse proxy targeting the mobile payment services.…

Read More

Editor’s Note: Click here to download the report as a PDF.

This report profiles the infrastructure used by the threat activity group TAG-53, which overlaps with public reporting on Callisto Group, COLDRIVER, and SEABORGIUM. The activity was identified through a combination of Network Intelligence and analysis derived from open-source reporting.…

Read More
Targeting different platforms and introducing Zombinder

The history of the threat landscape has seen several cases of threat actors using Trojans targeting different platforms and systems. This time while analyzing the activity of the Android banking Trojan Ermac, ThreatFabric’s analysts discovered a campaign employing several Trojans, and targeting both Android and Windows users at the same time, in order to reach as much victims as possible.…

Read More

In the last issue of our Ransomware Roundup series, we discussed a publicly available open-source ransomware toolkit called Cryptonite. As part of that investigation, we also discovered a Cryptonite sample in the wild that never offers the decryption window, instead acting as a wiper. We recently saw an increase in ransomware intentionally turned into wiper malware, primarily as part of a political campaign.…

Read More

概述

Lazarus组织是疑似具有东北亚背景的APT组织，奇安信威胁情报中心内部追踪编号为APT-Q-1，因2014年攻击索尼影业开始受到广泛关注，其攻击活动最早可追溯到2007年。该组织早期主要针对其他国家政府机构，以窃取敏感情报为目的，但自2014年后，该组织开始以全球金融机构 、虚拟货币交易场等为目标，进行敛财为目的的攻击活动。据公开情报显示，2014 年索尼影业遭黑客攻击事件，2016 年孟加拉国银行数据泄露事件，2017年美国国防承包商、美国能源部门及英国、韩国等比特币交易所被攻击事件都出自Lazarus之手。2021年，Lazarus还开始了针对安全研究人员的新活动【1】。

一直以来，木马样本的免杀率都是各个APT组织高度关注的要点，随着杀毒软件的更新迭代，检出方法不断的完善，恶意样本的检出率也随之提高，攻击者为进一步对抗而使用了各种匪夷所思的绕过方法、千奇百怪的免杀方法。近日，奇安信威胁情报中心红雨滴团队在日常的威胁狩猎中便发现Lazarus组织最新的0杀软查杀攻击样本，样本为VHD（虚拟磁盘映像）文件，以日本瑞穗银行（Mizuho Bank）的招聘信息为诱饵进行攻击。

https://www.virustotal.com/gui/file/826f2a2a25f7b7d42f54d18a99f6721f855ba903db7b125d7dea63d0e4e6df64/detection

在发现该攻击活动后，红雨滴团队便第一时间向安全社区进行了预警【2】，并引发国内外安全研究员对该类型样本进行深度探索。

A sample seems to be from #APT #Lazarus and uses VHD to deploy malware.Decoy document is about job description for Mizuho Bank.

3ce53609211cae4c925b9fee88c7380e (Job_Description.vhd)931d0969654af3f77fc1dab9e2bd66b1 (exe)31e154e560dff21f07f8aff37be6de9b (dump.bin) pic.twitter.com/8OHNdZkSTq

— RedDrip Team (@RedDrip7) November 23, 2022

样本分析

0x01 VHD虚拟磁盘映像文件

在威胁狩猎过程中，我们并未捕获到初始攻击载荷，结合VHD文件，我们猜测初始攻击载荷应该是鱼叉攻击邮件，通过邮件中的附件诱骗受害者点击打开VHD文件。在实际的环境中，Win7系统并不支持直接打开该类文件，因此该样本可能主要针对高版本Windows系统。

通常情况下，Windows操作系统都会隐藏受保护的操作系统文件，Lazarus组织正是利用这一特性：在Win10系统中直接打开VHD文件，仅可见一个名为Job_Description.exe的文件。并且攻击者还对该exe文件进行了伪装：…
Read More
Threat Actors using Shortened URLs to infect Users

Deceptive phishing is the preferred way for cybercriminals to distribute malware since luring the victim into clicking a link in a likely phishing SMS or Email is easier. The Threat Actor(TA) usually uses brand impersonation in phishing campaigns to trick the users into believing that they are reputed and legitimate.…

Read More

There’s a common saying in cyber security, “you can’t protect what you don’t know,” and this applies perfectly to the attack surface of any given organization.

Many organizations have hidden risks throughout their extended IT and security infrastructure. Whether the risk is introduced by organic cloud growth, adoption of IoT devices, or through mergers and acquisitions, the hidden risk lies dormant.…

Read More
Summary

At Zscaler ThreatLabz, we have been closely monitoring web threats such as payment card skimming attacks against e-commerce stores. Starting in July 2022, we have observed an increase in such activity targeted against Magento and Presta Shop e-commerce stores.

With Black Friday and the holiday season approaching, it is expected that there will be an increase in online shopping activity among users as they rush to take advantage of various discount offers.…

Read More

This post is also available in: 日本語 (Japanese)

Executive Summary

Unit 42 researchers introduce a machine learning model that predicts the maliciousness of .NET samples based on specific structures in the file, by analyzing a .NET wiper named DoubleZero. We identify the challenges of detecting this threat through PE structural analysis and conclude by examining the cues picked up by the machine learning model to detect this sample.…

Read More

Summary

Actions to Take Today to Mitigate Cyber Threats from Ransomware:

• Prioritize remediating known exploited vulnerabilities.• Enable and enforce multifactor authentication with strong passwords• Close unused ports and remove any application not deemed necessary for day-to-day operations.

Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.…

Read More