FiveSys Rootkit Abuses Microsoft-Issued Digital Signature

A rootkit named FiveSys is able to evade detection and slip unnoticed onto Windows users’ systems courtesy of a Microsoft-issued digital signature, according to security researchers with Bitdefender.

To prevent certain types of malicious attacks, Microsoft introduced strict requirements for driver packages that seek to receive a WHQL (Windows Hardware Quality Labs) digital signature, and starting with Windows 10 build 1607 it’s preventing kernel-mode drivers to be loaded without such a certificate.

Malware developers, however, appear to have identified a means to circumvent Microsoft’s certification and receive digital signatures for their rootkits, which allows them to target victims without raising suspicion.

In June, Microsoft admitted that attackers managed to successfully submit the Netfilter rootkit for certification through the Windows Hardware Compatibility Program.

Now, Bitdefender’s researchers warn that the FiveSys rootkit too features a Microsoft-issued digital signature, suggesting that this might soon prove to be a new trend, where adversaries manage to get their malicious drivers validated and signed by Microsoft.

FiveSys, the researchers say, is similar to the Undead malware that was initially detailed a couple of years ago. Furthermore, the same as Netfilter, the rootkit targets the gaming sector in China.

“The attackers seem to originate from China and target several domestic games. We can confidently attribute this campaign to several threat actors, as their tools share the same functionality but are vastly different in implementation,” Bitdefender says.

Courtesy of a periodically updated autoconfiguration script that contains a list of domains/URLs, the rootkit routes Internet traffic to a custom proxy server. Additionally, using a list of digital signatures, the rootkit can prevent drivers from the Netfilter and fk_undead malware families from being loaded.

Additionally, FiveSys includes a built-in list of 300 supposedly randomly generated domains that are stored encrypted, and which are meant to prevent potential takedown attempts.

Bitdefender also notes that they have identified several user mode binaries that are used to fetch and execute the malicious drivers onto the target machines. FiveSys appears to be using a total of four drivers, yet the security researchers isolated only two of them.

Microsoft revoked the signature for FiveSys, after being informed of the abuse.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/twW6XaE7Sa8/fivesys-rootkit-abuses-microsoft-issued-digital-signature

Two Bulletproof Hosting Administrators Sentenced to Prison in U.S.

The United States Department of Justice this week announced that two individuals involved in providing bulletproof hosting to various malware families were sentenced to prison.

Between 2009 and 2015, the two individuals – Aleksandr Skorodumov, 33, of Lithuania, and Pavel Stassi, 30, of Estonia – served as administrators for an organization that offered bulletproof hosting to malware families such as Citadel, SpyEye, Zeus, and the Blackhole exploit kit.

The organization, which was founded and led by Russian nationals Aleksandr Grichishkin and Andrei Skvortsov, both 34, rented domains, IP addresses, and servers to cybercriminals looking to infect computers, create botnets, and compromise banking credentials.

The organization also helped clients evade detection and perpetrate their illegal activities unhindered by law enforcement efforts by monitoring sites that maintained lists for blocking infrastructure used for crime and by registering new infrastructure.

Both defendants pleaded guilty in May. Skorodumov served as a lead systems administrator for the organization, configuring and managing domains and IP addresses and offering assistance, while Stassi served in various administrative roles, including overseeing the organization’s online marketing and registering new infrastructure when needed.

For their roles in the scheme, Skorodumov was sentenced to 48 months in prison and Stassi to 24 months in prison.

Grichishkin and Skvortsov, who face up to 20 years in prison, are pending sentencing. They have also pleaded guilty.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/u6UP64YRVjk/two-bulletproof-hosting-administrators-sentenced-prison-us

Magnitude EK Expands Arsenal With PuzzleMaker Exploit Chain

The Magnitude exploit kit (EK) is now capable of targeting Chromium-based browsers running on Windows systems, security researchers with Avast warn.

Exploit kits such as Magnitude are known for expanding their arsenal with new browser or plugin exploits in a timely fashion, but for years they have mainly focused on Microsoft’s Internet Explorer and left other browsers aside.

This, however, changed when Magnitude added to its arsenal exploits for CVE-2021-21224 and CVE-2021-31956, two vulnerabilities that affect Google’s Chrome browser and Microsoft’s Windows platform, respectively.

CVE-2021-21224, which Google addressed in April, is a type confusion flaw in the V8 rendering engine that could lead to remote code execution (RCE). The bug was already exploited in attacks when fixes rolled out.

CVE-2021-31956, on the other hand, is an elevation of privilege (EoP) vulnerability that could allow attackers to escape Chrome’s sandbox and gain system privileges. When patched in June 2021, the security hole was being abused in attacks alongside CVE-2021-31955, another EoP flaw in Windows.

The two vulnerabilities were previously chained in malicious activity that Kaspersky named PuzzleMaker, but which couldn’t be attributed to any known adversary.

On Tuesday, Avast’s security researchers took to Twitter to raise the alarm on Magnitude now targeting the Chrome and Windows vulnerabilities in a new wave of attacks.

“The attacks we have seen so far are targeting only Windows builds 18362, 18363, 19041, and 19042 (19H1–20H2). Build 19043 (21H1) is not targeted. The exploit for CVE-2021-31956 contains hardcoded syscall numbers relevant just for these builds,” Avast said.

For the time being, the activity doesn’t appear to involve the use of a malicious payload, although it does lead to the victim’s Windows build number being exfiltrated.

Since Magnitude typically tests newly implemented exploits in this manner, it’s likely that malicious attacks will follow soon, likely deploying the Magniber ransomware, Avast also says.

First observed in 2017, Magniber was associated right from the start with Magnitude, and was believed to be developed by the EK’s maintainers.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/m99intm6q_0/magnitude-ek-expands-arsenal-puzzlemaker-exploit-chain

S Korea Seeks Interpol Notice for Two Cyber Gang Leaders

South Korea said Friday it’s asked Interpol for help to arrest two foreigners it alleges played a leading role in cyberattacks and large-scale extortion that targeted South Korean and U.S. companies.

The Korean Police Agency said it has received domestic arrest warrants and requested Interpol to issue a “red notice” for the two suspects in an effort to bring them to South Korea.

South Korean authorities did not publicly release the name or further information on the two suspects for whom they requested the Interpol notice — except that one is a Ukrainian national.

The suspect who is a Ukrainian national was among six people detained by Ukrainian police in June, when South Korean and U.S. authorities joined in raids on the homes of suspects affiliated with the Clop ransomware syndicate in Kyiv and elsewhere. The police operations targeted alleged associates of a Russian-speaking ransomware gang blamed for a half billion dollars in damages in cyberattacks that scramble data and can only be stopped with a software key obtained by paying the criminals.

The most potent ransomware gangs operate with Kremlin tolerance, based out of reach of Western law enforcement. Russian authorities neither prosecute nor extradite them.

A South Korea police statement said the suspects detained in Ukraine in June allegedly collaborated with a hacking organization and laundered the virtual currency they obtained through the ransomware and converted them for cash.

Earlier this month, South Korean police decided to take steps to have three of those earlier detained in Ukraine, and another person whose nationality they refuse to disclose, charged with violating South Korea’s laws on communication networks and information protection, extortion and concealing criminal proceeds.

South Korea is now looking to extradite what it says are the two suspects of that group who played a leading role in the cyberattacks, said Choi Jongsang, chief of cybercrime investigation division at the Korea police agency.

Bringing them to South Korea still may not be easy.

A Ukraine law doesn’t allow local criminal suspects to be extradited to a foreign country and the legal status and whereabout of one of the suspects isn’t known, Choi said.

He said three companies and a university in South Korea were hit by the ransomware attacks in 2019 and that they were extorted to pay a Bitcoin ransom equivalent to 4.5 billion won ($3.8 million) in cash in total.

An earlier Ukraine police statement said the gang also targeted U.S. universities, including Stanford Medical School and the University of Maryland.

South Korean police said they’ll continue an investigation to the get to the bottom of the hacking group responsible for the cyberattacks. Police didn’t identify where that organization is based and where its hackers are from.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/R3NPwd-7RHk/s-korea-seeks-interpol-notice-two-cyber-gang-leaders

Israeli Hospital Targeted in Ransomware Attack

An Israeli hospital was targeted Wednesday by a ransomware attack, officials said, with the state’s cyber directorate calling it the first such attack on a hospital in the country.

The Hillel Yaffe Medical Center is “currently using alternative systems to treat its patients”, it said in a statement, describing the attack as “totally unexpected”.

“Medical treatment is continuing as usual, aside from non-urgent elective procedures,” Hillel Yaffe said.

Yigal Unna, director of Israel’s National Cyber Directorate, called it a “major” attack.

“We’re in the middle of trying to solve it, it does not look very good,” he said at a virtual summit on ransomware attacks hosted by the US National Security Council.

According to Unna, it was “the first time in Israel” that a ransomware cyber attack targeted a hospital, although medical centres in other countries have experienced similar attacks.

His agency said that “the health ministry has updated hospitals as a preventive measure”.

One in every five businesses in Israel has been targeted in a cyber attack, according to data presented by Unna in July, with the attacks causing damage to a fifth of the establishments attacked.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/jErjd1vbk_Y/israeli-hospital-targeted-ransomware-attack

Hackers Claim to Have Stolen 60 GB of Data From Acer

A group of hackers claims to have stolen more than 60 gigabytes of data after breaching servers belonging to Taiwanese tech giant Acer.

In a post on a publicly accessible hacker forum, a group calling itself “Desorden” claimed to have stolen databases and other files from breached Acer India servers.

The hackers shared a link to a sample of the stolen data and they promised to leak more once they have analyzed it. They also published a video showing the files they allegedly stole from Acer.

They claim the stolen files include information on millions of customers, login credentials used by thousands of Acer retailers and distributors, as well as corporate, financial and audit documents.

Acer hacked

Desorden previously claimed that it asks targeted organizations to pay a ransom, and they sell the stolen data on the black market if the victim refuses to pay up.

Acer has confirmed the incident, which it described as “an isolated attack on our local after-sales service system in India.” The company said it conducted a full scan of its systems after becoming aware of the breach, and it has started notifying all potentially impacted customers in India.

Acer claimed the attack has “no material impact to our operations and business continuity.” The company said it reported the incident to the Indian CERT and law enforcement.

Reports emerged in March that Acer had been targeted in a REvil ransomware attack, with the hackers demanding a $50 million ransom. In that attack, threat actors apparently stole data and encrypted files on compromised systems.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/cr7OkPHCoKU/hackers-claim-have-stolen-60-gb-data-acer

Nations Reveal Ransomware Pain at US-Led Summit

A digital “disaster” in Germany, growing attacks in the United Arab Emirates and even Israel announcing a blitz underway: nations disclosed their struggle Wednesday against cyber-extortionists at a Washington-led anti-ransomware summit.

The United States has convened some 30 countries — with the notable exception of Russia — to boost cooperation in fighting the costly and disruptive attacks that have boomed around the world.

As if on cue, Yigal Unna, director of Israel’s National Cyber Directorate, broke news of the latest incident.

“I can disclose now that Israel is experiencing, as we speak, a major ransomware attack against one of its big hospitals,” Unna said.

If the experiences recounted are any indication, the threat is painful, widespread, and growing.

Germany recalled that this summer, for the first time, a local government in the eastern district of Anhalt-Bitterfeld declared a state of “cyber disaster” after being crippled by a ransomware attack.

The United States has also been hit, especially in the first half of 2021, by numerous ransomware attacks against businesses.

These attacks involve breaking into an entity’s networks to encrypt its data, then demanding a ransom, typically paid in cryptocurrency in exchange for the key to unlock it.

“We talked about… a 70 percent increase year over year in South Korea, 200 percent in the UAE,” said Anne Neuberger, deputy national security adviser for cyber.

Hospitals targeted in Ireland and the Czech Republic as well as severe disruptions to maritime infrastructure in South Africa were among the experiences recounted.

The United Kingdom, Australia, India, Japan, France, Germany, South Korea, the European Union, Israel, Kenya, Mexico, and others joined in the virtual gathering that opened Wednesday and is set to continue Thursday.

– Russia not invited –

“No one country, no one group can solve this problem,” stressed White House National Security Advisor Jake Sullivan.

“Our governments may have different approaches with respect to the tools… to counter ransomware” he said, but “we recognize the urgency of the ransomware threat.”

In particular, he praised the active participation of Australia, Germany, India, and the United Kingdom in the preparations for the meeting.

These countries have organized workshops, which will take place on Wednesday and Thursday, around four themes: building resilience to the extortion attempts, the role of cryptocurrency in laundering ransoms, law enforcement and judicial action as well as diplomacy.

Asked about Russia’s absence, a senior White House official said in a briefing Tuesday, “in this first round of discussions we did not invite the Russians to participate.”

The source said Washington and Moscow had already established a “separate channel” of communication on the subject.

Although Moscow denies any responsibility, most recent ransomware attacks against the United States have been blamed on Russian-speaking hacker groups or those operating from Russian territory.

US President Joe Biden spoke with Russian leader Vladimir Putin in July, telling him to “take action” against ransomware groups operating in Russia.

“We’ve seen some steps by the Russian government and are looking to see follow-up actions,” the White House official said Tuesday.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/ycQbWV1U-Mo/nations-reveal-ransomware-pain-us-led-summit

Medical Technology Company Olympus Discloses Cyberattack

Japanese medical technology company Olympus this week revealed that its operations in the Americas were affected by a cyberattack.

Detected on October 10, the attack forced the company to shut down some of its systems, but Olympus says that it is already working on restoring them back to normal.

“Upon detection of suspicious activity, we immediately mobilized a specialized response team including forensics experts, and we are currently working with the highest priority to resolve this issue. As part of the investigation and containment, we have suspended affected systems and have informed the relevant external partners,” the company says.

The company says that only its operations in the Americas (the United States, Canada, and Latin America) were affected by the incident.

“We are working with appropriate third parties on this situation and will continue to take all necessary measures to serve our customers and business partners in a secure way,” the company notes.

The cyberattack came one month after the company disclosed an incident that affected “limited areas of its EMEA (Europe, Middle East, Africa) IT systems.” That attack was reportedly coordinated by the BlackMatter ransomware gang.

Olympus did not share further details on the type of attack that targeted its American systems, but the action it took in response to the incident suggests ransomware might have been used.

Founded in 1919 in Tokyo, Japan, Olympus claims roughly 70% of the gastrointestinal endoscopic equipment market. The company produces electrocautery, endoscopic, endotherapy, ultrasound, and cleaning and disinfection equipment.

“The second cyberattack on technology giant Olympus in a month’s time should be a major wake-up call–no large global corporation should consider itself exempt from ransomware attacks. Senior executives and IT leaders should also be aware that no technological solution is 100% effective, but a large percentage of ransomware attacks can be prevented with diligent preparation,” Neil Jones, cybersecurity evangelist at Egnyte, said in an emailed comment.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/sVTVmgW4y10/medical-technology-company-olympus-discloses-cyberattack

Lots and Lots of Bots: Looking at Botnet Activity in 2021

A botnet today can be used as a foundation for bad actors to carry out other attacks later

Botnets continue to be a major problem for cybersecurity teams. With the growth in sophisticated threats, botnets are becoming more malicious, sometimes able to create hundreds of thousands of drones that can attack a variety of machines, including Mac systems, Linux, Windows systems, edge devices, IoT devices, and so on.

Examining threat trends around botnet activity is helpful because it provides a glimpse into the malicious activities tied to Command and Control tactics. In the first half of 2021, the percentage of organizations detecting botnet activity jumped from 35% to 51%, according to the latest global threat landscape report from FortiGuard Labs.

That increase was led by a surge in the use of TrickBot, which was taken offline in 2020 but came back on the radar in mid-2021, not as prolific as before. Designed initially as a banking trojan but since evolved into a sophisticated, modular and multi-stage toolkit supporting a range of illicit activities. TrickBot certainly wasn’t the only such botnet being used however, as FortiGuard Labs researchers saw.

Major botnet trends

The surge we’ve seen so far this year is rather peculiar for aggregate botnet activity. Mirai was the most prevalent, overtaking Gh0st in 2020 and continuing to dominate ever since. Mirai became notorious several years ago after fueling massive IoT-based DDoS attacks. Since that time, it’s continued adding new cyberweapons to its arsenal to maintain its dominance. It’s likely that Mirai’s dominance stems at least in part from attackers seeking to exploit IoT devices used by (or proximate to) remote workers.

Also, during the first half of this year, Gh0st has been noticeably active. The remote access botnet allows malicious actors to take full control of the infected system, access live webcam and microphone feeds, download and upload files, log keystrokes and perform other nefarious activities.

In a very unusual twist, other than Gh0st and Mirai, most of the remaining botnets we saw in 2021 weren’t in the top 10 previously. The usual suspects tend to turn up every time, so it’s surprising to see some newcomers to the group. The prominent bump in prevalence toward the end of the half-year demonstrates those newcomers helped drive overall botnet activity to new heights. Communications with the Trochilus botnet bumped up early in the year, particularly in Oceania and Southeast Asia.

What’s behind the surge

The traditional perimeter is obviously a relic of the past. The edge – as defined as the kind of barrier between your own network, your LAN and the internet access – has faded away. There are cloud services, mobile services, web services – so there is no edge anymore; everyone’s living on the edge. Organizations are accessing the internet in all sorts of ways, including IoT and other devices, and attackers are leveraging this and finding new ways into your organization. They’re landing and expanding. They’re moving horizontally throughout the network and thinking, “Even if I can only access you through an IoT device, how can I use that to perhaps obtain a more valuable target?”

We’re seeing a lot of web-borne threats and, unfortunately, many environments still aren’t segmented or secured the way they should be. And attackers are definitely using botnets to take advantage of this. A botnet today can be used as a foundation for bad actors to carry out other attacks later.

Next steps

With the traditional edge no more, that means the old ways of securing environments no longer fly, of course. And this means that organizations need to look for ways to expand cybersecurity beyond the edge. Addressing the ongoing security challenges related to increasingly distributed networks and the rapidly dissolving network perimeter can seem daunting.

The first steps to address these challenges, particularly for remote access, include moving to modern endpoint security solutions and embracing a zero-trust model. That means no user or device is trusted until fully verified. Zero trust access (ZTA) focuses on role-based access control to the network. Its partner, zero-trust network access (ZTNA), relates to brokered access for users to applications and allows organizations to extend the zero-trust model beyond the network.

In addition, advanced, automated endpoint protection, detection, and response endpoint security solutions need to provide visibility into devices and their state, strong protection measures, remote monitoring tools and threat remediation for endpoint devices of all kinds.

New security strategies

Botnet attacks continue to rise, with many new varieties entering the field. Old defense strategies won’t work, which highlights the need for new ones, including ZTA and ZTNA. Another needed strategy is more proactive collaboration among organizations and law enforcement, like the kind that helped bring down Emotet. Modern endpoint security solutions will also go a long way toward securing your borderless network.

Derek Manky is Chief of Security Insights and Global Threat Alliances at Fortinet’s FortiGuard Labs. Derek formulates security strategy with more than 15 years of cyber security experience behind him. His ultimate goal to make a positive impact in the global war on cybercrime. Manky provides thought leadership to industry, and has presented research and strategy worldwide at premier security conferences. As a cybersecurity expert, his work includes meetings with leading political figures and key policy stakeholders, including law enforcement. He is actively involved with several global threat intelligence initiatives including NATO NICP, INTERPOL Expert Working Group, the Cyber Threat Alliance (CTA) working committee and FIRST – all in effort to shape the future of actionable threat intelligence and proactive security strategy.

Previous Columns by Derek Manky:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/jE1wtFeaveA/lots-and-lots-bots-looking-botnet-activity-2021

Twitch Struggles With Hackers and Hate Raid Bots

Twitch, Amazon’s popular live video streaming platform, on Thursday said hackers took advantage of a mistake in a server configuration tweak to steal data.

A massive trove of confidential Twitch data dumped on the internet included records showing top game play streamers took in millions of dollars during the past year.

The breach came as another black eye for Twitch’s cyber defenses that have struggled to stop “hate raids” by software “bots” targeting streamers who are not white, male and straight.

“We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party,” the company said in a post.

“Our teams are working with urgency to investigate the incident.”

Twitch had yet to find any sign that log-in information was exposed, but reset access keys to all streamer accounts as a precaution.

“We understand that this situation raises concerns,” Twitch said.

The service, where users often stream live video game play and commentary, confirmed the break-in Wednesday.

– Barrage of abuse –

A post at 4Chan served up 125 gigabytes of data reported to include Twitch source code, records of payouts to streamers, and a digital video game distribution service being built by Amazon Game Studios.

It did not appear that personal Twitch user data was in the dump, but the extent of the hack remained undetermined.

The person who posted the trove of stolen data left a message claiming the break-in was performed to foster competition in video streaming, and because the Twitch community “is a disgusting toxic cesspool,” according to media reports.

Users of Twitch, the world’s biggest video game streaming site, staged a virtual walkout last month to voice outrage over barrages of racist, sexist and homophobic abuse on the platform.

The phenomenon of “hate raids” — torrents of abuse — has seen the platform become increasingly unpleasant for many Twitch streamers who are not white or straight.

The service is suing two users in US federal court, accusing them of orchestrating “hate raids.”

The platform is seeking unspecified cash damages from the pair, identified in the lawsuit as a Netherlands resident behind the account CruzzControl and a Vienna resident with a CreatineOverdose account.

Hate raid targets were often streamers from marginalized groups, such as racial minorities or members of the LGBTQ+ community, according to the filing.

“Defendants attack these streamers by flooding their chats with bot-powered Twitch accounts that spew racist, sexist, and homophobic language and content,” the suit stated.

Bots are software programs that can quickly and automatically fire off messages or other content.

More than 30 million people visit Twitch daily, and the platform hosts more than seven million streamers, according to its website.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/KCdsJcjHB6g/twitch-struggles-hackers-and-hate-raid-bots