From the what-could-possibly-go-wrong files comes this: An industrial control engineer recently made a workstation part of a botnet after inadvertently installing malware advertising itself as a means for recovering lost passwords.

Lost passwords happen in many organizations. A programmable logic controller—used to automate processes inside factories, electric plants, and other industrial settings—may be set up and largely forgotten over the following years. When a replacement engineer later identifies a problem affecting the PLC, they can discover the now long-gone original engineer never left the passcode behind before departing the company.

According to a blog post from security firm Dragos, an entire ecosystem of malware attempts to capitalize on scenarios like this one inside industrial facilities. Online advertisements like those below promote password crackers for PLCs and human-machine interfaces, which are the workhorses inside these environments.

When your industrial system is part of a botnet

Dragos—which helps firms secure industrial control systems against ransomware, state-sponsored hackers, and potential saboteurs—recently performed a routine vulnerability assessment and discovered a customer’s system had run software that was able to successfully recover the plaintext password for the DirectLogic 06, a PLC sold by Automation Direct. The software recovered the password, but not through the normal method of cracking the cryptographic hash. Instead, the software exploited a zero-day vulnerability in Automatic Direct PLCs that exposed the passcode.

“Previous research targeting DirectLogic PLCs has resulted in successful cracking techniques,” Dragos researcher Sam Hanson wrote. “However, Dragos found that this exploit does not crack a scrambled version of the password as historically seen in popular exploitation frameworks. Instead, a specific byte sequence is sent by the malware dropper to a COM port.”

The vulnerability, and a related one also found by Hanson, have now been patched and are tracked as CVE-2022-2033 and CVE-2022-2004. The latter vulnerability can recover passwords and send them to a remote hacker, bringing the severity rating to 7.5 out of a possible 10.

Besides recovering the password, the software installed on the Dragos customer’s network also installed malware known as Sality. It made the infected system part of a botnet and monitored the clipboard of the infected workstation every half second for any data related to cryptocurrency wallet addresses.

“If seen, the hijacker replaces the address with one owned by the threat actor,” Hanson said. “This in-real-time hijacking is an effective way to steal cryptocurrency from users wanting to transfer funds and increases our confidence that the adversary is financially motivated.”

Hanson went on to say that he has found password crackers advertised online for a wide range of industrial software sold by other companies. They include:

Vendor and Asset	System Type
Automation Direct DirectLogic 06	PLC
Omron CP1H	PLC
Omron C200HX	PLC
Omron C200H	PLC
Omron CPM2*	PLC
Omron CPM1A	PLC
Omron CQM1H	PLC
Siemens S7-200	PLC
Siemens S7-200	Project File (*.mwp)
Siemens LOGO! 0AB6	PLC
ABB Codesys	Project File (*.pro)
Delta Automation DVP, ES, EX, SS2, EC Series	PLC
Fuji Electric POD UG	HMI
Fuji Electric Hakko	HMI
Mitsubishi Electric FX Series (3U and 3G)	PLC
Mitsubishi Electric Q02 Series	PLC
Mitsubishi Electric GT 1020 Series	HMI
Mitsubishi Electric GOT F930	HMI
Mitsubishi Electric GOT F940	HMI
Mitsubishi Electric GOT 1055	HMI
Pro-Face GP Pro-Face	HMI
Pro-Face GP	Project File (*.prw)
Vigor VB	PLC
Vigor VH	PLC
Weintek	HMI
Allen Bradley MicroLogix 1000	PLC
Panasonic NAIS F P0	PLC
Fatek FBe and FBs Series	PLC
IDEC Corporation HG2S-FF	HMI
LG K80S	PLC
LG K120S	PLC

Dragos tested only the malware targeting the DirectLogic devices, but a rudimentary analysis of a few samples indicated they also contained malware.

“In general, it appears there is an ecosystem for this type of software,” Hanson said. “Several websites and multiple social media accounts exist all touting their password ‘crackers.’”

The account is concerning because it illustrates the laxness that continues to operate in many industrial control settings. The criminals behind the malware infecting the Dragos customer were after money, but there’s no reason more malicious hackers out to sabotage a dam, power plant, or similar facility couldn’t perform a similar intrusion with much more severe consequences.

https://arstechnica.com/?p=1867297

For owners of more than 70 Lenovo laptop models, it’s time once again to patch the UEFI firmware against critical vulnerabilities that attackers can exploit to install malware that’s nearly impossible to detect or remove.

The laptop maker on Tuesday released updates for three vulnerabilities that researchers found in the UEFI firmware used to boot up a host of its laptop models, including the Yoga, ThinkBook, and IdeaPad lines. The company assigned a medium severity rating to the vulnerabilities, which are tracked CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and affect the ReadyBootDxe, SystemLoadDefaultDxe, and SystemBootManagerDxe drivers, respectively.

“The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of the platform boot, possibly allowing the attackers to hijack the OS execution flow and disable some important security features,” security firm ESET said. “These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call.”

Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove. Typical measures such as wiping the hard drive and reinstalling the OS have no meaningful impact because the UEFI infection will simply reinfect the computer afterward.

Many motherboard-resident flash chips that store the UEFI have access control mechanisms that can be locked during the boot process to prevent unauthorized firmware changes. It’s not clear if the affected Lenovo models have that capability. Even if they do, these protections are often turned off, misconfigured, or hampered by vulnerabilities. ESET researchers weren’t immediately available to comment on the requirements for exploits of these particular vulnerabilities.

In any event, owners of Lenovo laptops should take a minute to check Wednesday’s advisory to see if their model is vulnerable since firmware updates often require manual installation.

https://arstechnica.com/?p=1866641

On the last day of May, one of my inboxes began receiving emails, purportedly from one of the owners of the yoga studio I visit. It concerned a message I sent in January through the studio’s website that had been resolved the following day in an email sent by the co-owner. Now, here she was, four months later, emailing me again.

“Listed below the documents we chatted regarding last week,” the email author wrote. “Contact me if you’ve got any queries about the attached files.” There was a password-protected zip file attached. Below the body of the message was the response the co-owner sent me in January. These emails started coming once or twice daily for the next couple of weeks, each from a different address. The files and passwords were often changed, but the basic format, including the January email thread, remained consistent.

With the help of researchers at security firm Proofpoint, I now know that the emails are the work of a crime group they call TA578. TA578 is what’s known in the security industry as an initial access broker. That means it compromises end-user devices en masse in an opportunistic fashion, spamming as many addresses as possible with malicious files. The gang then sells access to the machines it compromises to other threat actors for use in ransomware, cryptojacking, and other types of campaigns.

What’s thread hijacking?

Somehow, group members got ahold of the message I sent to my yoga studio. The simplest explanation would be the studio owner’s computer or email account was compromised, but there are other possibilities. With possession of my email address and the authentic email the owner had sent me in January, TA578 now had the raw materials to ply its trade.

“Messages in this campaign appear to be replies to previous, benign email threads,” Proofpoint wrote in an email responding to questions. “This technique is referred to as thread hijacking. Threat actors use this technique to make the recipient believe they are interacting with a person they trust so they are less likely to be suspicious about downloading or opening attachments they might be sent as part of the conversation. Threat actors commonly steal these benign messages through prior malware infections or account compromises.”

When unzipped, the attached files installed Bumblebee, a malicious downloader that multiple threat actors use to download and execute additional payloads on the compromised machine. Proofpoint first observed threat actors using Bumblebee in email-based campaigns in March.

The files attached to the emails I received contained an embedded ISO or IMG file along with an LNK shortcut file and a DLL file. The LNK file is used to execute the DLL at a specific entry point to start the malware. Proofpoint says TA578 Bumblebee campaigns typically go on to download second-stage payloads of Cobalt Strike and Meterpreter malware.

Fortunately, I knew almost immediately that the emails were malicious, but it’s not hard to see how some people might fall for the ruse. Who would have thought that a routine message sent to a yoga studio would open the door to a malware attack?

I emailed the owner and explained the series of events and warned that an account or machine the studio was using was almost certainly compromised. I never received a response. When I followed up by sending another message through the studio’s web page, someone responded: “I am sorry to hear that you have been receiving this type of communication but there is no system or server on our end that would be sending you emails. I would double-check to make sure it is not something going wrong on your end.”

All of which goes to say, receiving these types of malicious emails is pretty much a fact of life in 2022. If you shop or socialize online, it’s almost inevitable someone in the chain will be compromised, and that endpoint will be exploited in the hopes of infecting you.

The takeaway: Expect malicious emails from people or addresses you think you recognize using real email threads you’ve received in the past. When something seems out of character, take a step back and either begin a discussion in a separate email thread or call the person directly. And as my experience with my yoga studio shows, don’t expect the other person to understand what’s going on. Above all else, don’t click on links or open attachments.

https://arstechnica.com/?p=1864968

Lug 06, 2022 Redazione news Malware, News, RSS 0

---

I pirati del ransomware distribuito attraverso file di Microsoft Office malevoli hanno reso noto stanno abbandonando l’operazione per dedicarsi al cryptojacking

I responsabili del ransomware AstraLocker hanno dichiarato a BleepingComputer che stanno chiudendo l’operazione e intendono passare al cryptojacking. Hanno anche inviato un archivio ZIP con i decrittatori alla piattaforma di analisi malware VirusTotal.

Gli analisti di BleepingComputer hanno scaricato l’archivio e hanno utilizzato con successo uno dei decrittatori per ottenere nuovamente accesso a dei file crittografati in una recente campagna di AstroLocker. Ritengono che gli altri servano a decrittare i file compromessi in campagne precedenti.

Anche se i cyber criminali non hanno rivelato il motivo della chiusura di AstraLocker, è probabile che sia da ricondurre alla visibilità portata all’operazione da recenti rapporti di analisti sul ransomware che avrebbero potuto mettere l’operazione nel mirino delle forze dell’ordine.

ReversingLabs ha infatti scoperto a fine giugno una nuova versione del malware, AstraLocker 2.0, che viene distribuita direttamente attraverso file di Microsoft Office utilizzati come esca in attacchi di phishing. Questo si distacca dalle comuni modalità operative dei gruppi ransomware che compromettono prima i dispositivi delle vittime, violandoli o acquistando i dati d’accesso sulla dark web.

ReversingLabs ha anche stabilito che un indirizzo di wallet della criptovaluta Monero indicato per il pagamento del riscatto è legato alla banda di cyber criminali del ransomware Chaos.

Emsisoft, una società di cybersicurezza nota per aiutare le vittime di ransomware a decriptare i dati, sta lavorando a un decriptatore universale per AstraLocker.

---

---

---

https://www.securityinfo.it/2022/07/06/ransomware-astralocker-chiude-e-distribuisce-i-decriptatori/?utm_source=rss&utm_medium=rss&utm_campaign=ransomware-astralocker-chiude-e-distribuisce-i-decriptatori

Lug 05, 2022 Redazione news Malware, News, RSS 0

---

Una ricerca di WithSecure™ evidenzia che, nonostante la continua diffusione del ransomware, nel 2021 sono state scoperte meno nuove famiglie e varianti rispetto agli anni precedenti

Un nuovo report di aggiornamento sulle minacce di WithSecure™ ha rilevato che il ransomware è stato il tipo di minaccia più diffuso identificato nel 2021 (quasi il 17% del totale), dimostrando la sua predominanza sugli altri attacchi subiti dalle organizzazioni. Tuttavia, il numero di nuove famiglie di ransomware e di varianti uniche scoperte dai ricercatori nel 2021 è diminuito significativamente rispetto agli anni precedenti.

Ci sono diverse teorie che potrebbero spiegare questo calo. Christine Bejerasco, Chief Technology Officer di WithSecure™, ritiene che sia probabilmente dovuto al fatto che i cyber criminali stiano consolidando i loro sforzi. Questo può creare nuove opportunità per combattere il problema.

“Se gli attaccanti stanno effettivamente consolidando le loro attività attorno a competenze chiave, ciò rende i principali fornitori di ransomware-as-a-service anelli cruciali nelle catene di approvvigionamento dei threat actor. Se riusciamo a spezzare questi legami neutralizzando questi importanti fornitori, potremmo benissimo sconvolgere l’ecosistema e dare un po’ di sollievo ai difensori, almeno per un po’ di tempo.” – spiega Bejerasco.

Altri sviluppi significativi evidenziati dall’aggiornamento sulle minacce includono il fatto che WannaCry è stata la famiglia di ransomware più diffusa nel 2021, seguita da tre famiglie di Ransomware-as-a-Service (RaaS): GandCrab, REvil e Phobos.

Nel 2021, inoltre, il ransomware ha continuato a colpire una varietà di settori e ha utilizzato diversi metodi per penetrare le difese delle aziende, per cui nessuna organizzazione poteva essere considerata immune a questi attacchi.

Pur vedendo spazio per l’ottimismo sulla base delle recenti osservazioni, Bejerasco avverte che la svolta contro le bande di ransomware è complicata. È necessario che le organizzazioni, i mercati e i Paesi adottino un approccio di co-security al problema, che può rivelarsi impegnativo.

“A differenza delle autorità, i threat actor possono operare impunemente oltre confine, il che costituisce un vantaggio. I difensori devono concentrarsi su pratiche di sicurezza basate sui risultati, comprendendo innanzitutto i risultati organizzativi o aziendali che desiderano e progettando misure di sicurezza informatica a supporto di tali risultati.

Da qui, le organizzazioni possono identificare i rischi per tali risultati, le risorse digitali esposte a tali rischi e le potenziali minacce informatiche che tali risorse devono affrontare,” – dichiara.

“Solo a questo punto possono progettare una strategia di sicurezza informatica che l’intera organizzazione può sostenere perché protegge e supporta gli obiettivi che si vogliono raggiungere.” – ha concluso. Ulteriori informazioni sulla sicurezza basata sui risultati sono disponibili sul sito dell’azienda.

---

---

---

https://www.securityinfo.it/2022/07/05/calano-i-nuovi-ransomware-scoperti/?utm_source=rss&utm_medium=rss&utm_campaign=calano-i-nuovi-ransomware-scoperti

Android malware developers are stepping up their billing fraud game with apps that disable Wi-Fi connections, surreptitiously subscribe users to pricey wireless services, and intercept text messages, all in a bid to collect hefty fees from unsuspecting users, Microsoft said on Friday.

This threat class has been a fact of life on the Android platform for years, as exemplified by a family of malware known as Joker, which has infected millions of phones since 2016. Despite awareness of the problem, little attention has been paid to the techniques that such “toll fraud” malware uses. Enter Microsoft, which has published a technical deep dive on the issue.

The billing mechanism abused in this type of fraud is WAP, short for wireless application protocol, which provides a means of accessing information over a mobile network. Mobile phone users can subscribe to such services by visiting a service provider’s web page while their devices are connected to cellular service, then clicking a button. In some cases, the carrier will respond by texting a one-time password (OTP) to the phone and requiring the user to send it back in order to verify the subscription request. The process looks like this:

The goal of the malicious apps is to subscribe infected phones to these WAP services automatically, without the notice or consent of the owner. Microsoft said that malicious Android apps its researchers have analyzed achieve this goal by following these steps:

1. Disable the Wi-Fi connection or wait for the user to switch to a mobile network
2. Silently navigate to the subscription page
3. Auto-click the subscription button
4. Intercept the OTP (if applicable)
5. Send the OTP to the service provider (if applicable)
6. Cancel the SMS notifications (if applicable)

Malware developers have various ways to force a phone to use a cellular connection even when it’s connected to Wi-Fi. On devices running Android 9 or earlier, the developers can invoke the setWifiEnabled method of the WifiManager class. For versions 10 and above, developers can use the requestNetwork function of the ConnectivityManager class. Eventually, phones will load data exclusively over the cellular network, as demonstrated in this image:

Once a phone uses the cellular network for data transmission, the malicious app surreptitiously opens a browser in the background, navigates to the WAP subscription page, and clicks a subscribe button. Confirming the subscription can be tricky because confirmation prompts can come by SMS, HTTP, or USSD protocols. Microsoft lays out specific methods that malware developers can use to bypass each type of confirmation. The Microsoft post then goes on to explain how the malware suppresses periodic messages that the subscription service may send the user to remind them of their subscription.

“By subscribing users to premium services, this malware can lead to victims receiving significant mobile bill charges,” Microsoft researchers wrote. “Affected devices also have increased risk because this threat manages to evade detection and can achieve a high number of installations before a single variant gets removed.”

Google actively bars apps from its Play market when it detects signs of fraud or malice, or when it receives reports of malicious apps from third parties. While Google often doesn’t remove malicious apps until after they have infected millions of users, apps downloaded from Play are generally regarded as more trustworthy than apps from third-party markets.

https://arstechnica.com/?p=1864065

Researchers have identified stealthy new malware that threat actors have been using for the past 15 months to backdoor Microsoft Exchange servers after they have been hacked.

Dubbed SessionManager, the malicious software poses as a legitimate module for Internet Information Services (IIS), the web server installed by default on Exchange servers. Organizations often deploy IIS modules to streamline specific processes on their web infrastructure. Researchers from security firm Kaspersky have identified 34 servers belonging to 24 organizations that have been infected with SessionManager since March 2021. As of earlier this month, Kaspersky said, 20 organizations remained infected.

Stealth, persistence, power

Malicious IIS modules offer an ideal means to deploy powerful, persistent, and stealthy backdoors. Once installed, they will respond to specifically crafted HTTP requests sent by the operator instructing the server to collect emails, add further malicious access, or use the compromised servers for clandestine purposes. To the untrained eye, the HTTP requests look unremarkable, even though they give the operator complete control over the machine.

“Such malicious modules usually expect seemingly legitimate but specifically crafted HTTP requests from their operators, trigger actions based on the operators’ hidden instructions if any, then transparently pass the request to the server for it to be processed just like any other request,” Kaspersky researcher Pierre Delcher wrote. “As a result, such modules are not easily spotted by usual monitoring practices: they do not necessarily initiate suspicious communications to external servers, receive commands through HTTP requests to a server that is specifically exposed to such processes, and their files are often placed in overlooked locations that contain a lot of other legitimate files.”

Once SessionManager is deployed, operators use it to profile the infected environment further, gather passwords stored in memory, and install additional tools, including a PowerSploit-based reflective loader, Mimikat SSP, ProcDump, and a legitimate Avast memory dump tool. Kaspersky obtained multiple SessionManager variants that date back to at least March 2021. The samples show a steady evolution that has added more features with each new version. The most recent version of the malicious module includes the following:

Command name (SM_SESSION cookie value)	Command parameters (additional cookies)	Associated capability
GETFILE	FILEPATH: path of file to be read. FILEPOS1: offset at which to start reading, from file start. FILEPOS2: maximum number of bytes to read.	Read the content of a file on the compromised server and send it to the operator as an HTTP binary file named cool.rar.
PUTFILE	FILEPATH: path of file to be written. FILEPOS1: offset at which to start writing. FILEPOS2: offset reference. FILEMODE: requested file access type.	Write arbitrary content to a file on the compromised server. The data to be written in the specified file is passed within the HTTP request body.
DELETEFILE	FILEPATH: path of file to be deleted.	Delete a file on the compromised server.
FILESIZE	FILEPATH: path of file to be measured.	Get the size (in bytes) of the specified file.
CMD	None.	Run an arbitrary process on the compromised server. The process to run and its arguments are specified in the HTTP request body using the format: <executable path>\t<arguments>. The standard output and error data from process execution are sent back as plain text to the operator in the HTTP response body.
PING	None.	Check for SessionManager deployment. The “Wokring OK” (sic.) message will be sent to the operator in the HTTP response body.
S5CONNECT	S5HOST: hostname to connect to (exclusive with S5IP). S5PORT: offset at which to start writing. S5IP: IP address to connect to if no hostname is given (exclusive with S5HOST). S5TIMEOUT: maximum delay in seconds to allow for connection.	Connect from compromised host to a specified network endpoint, using a created TCP socket. The integer identifier of the created and connected socket will be returned as the value of the S5ID cookie variable in the HTTP response, and the status of the connection will be reported in the HTTP response body.
S5WRITE	S5ID: identifier of the socket to write to, as returned by S5CONNECT.	Write data to the specified connected socket. The data to be written in the specified socket is passed within the HTTP request body.
S5READ	S5ID: identifier of the socket to read from, as returned by S5CONNECT.	Read data from the specified connected socket. The read data is sent back within the HTTP response body.
S5CLOSE	S5ID: identifier of the socket to close, as returned by S5CONNECT.	Terminate an existing socket connection. The status of the operation is returned as a message within the HTTP response body.

Remember ProxyLogon?

SessionManager gets installed after threat actors have exploited vulnerabilities known as ProxyLogon within Microsoft Exchange servers. Kaspersky has found it infecting NGOs, governments, militaries, and industrial organizations in Africa, South America, Asia, and Europe.

Kaspersky said it has medium-to-high confidence that a previously identified threat actor that researchers call Gelsemium has been deploying SessionManager. Security firm ESET published a deep dive on the group (PDF) last year. Kaspersky’s attribution is based on the overlap of code used by the two groups and victims targeted.

Disinfecting servers that have been hit by SessionManager or similar malicious IIS modules is a complicated process. Kaspersky’s post contains indicators that organizations can use to determine if they’ve been infected and steps they should take in the event they’ve been infected.

https://arstechnica.com/?p=1863868

An unusually advanced hacking group has spent almost two years infecting a wide range of routers in North America and Europe with malware that takes full control of connected devices running Windows, macOS, and Linux, researchers reported on Tuesday.

So far, researchers from Lumen Technologies’ Black Lotus Labs say they’ve identified at least 80 targets infected by the stealthy malware, infecting routers made by Cisco, Netgear, Asus, and DrayTek. Dubbed ZuoRAT, the remote access Trojan is part of a broader hacking campaign that has existed since at least the fourth quarter of 2020 and continues to operate.

A high level of sophistication

The discovery of custom-built malware written for the MIPS architecture and compiled for small office and home office routers is significant, particularly given its range of capabilities. Its ability to enumerate all devices connected to an infected router and collect the DNS lookups and network traffic they send and receive and remain undetected is the hallmark of a highly sophisticated threat actor.

“While compromising SOHO routers as an access vector to gain access to an adjacent LAN is not a novel technique, it has seldom been reported,” Black Lotus Labs researchers wrote. “Similarly, reports of person-in-the-middle style attacks, such as DNS and HTTP hijacking, are even rarer and a mark of a complex and targeted operation. The use of these two techniques congruently demonstrated a high level of sophistication by a threat actor, indicating that this campaign was possibly performed by a state-sponsored organization.”

The campaign comprises at least four pieces of malware, three of them written from scratch by the threat actor. The first piece is the MIPS-based ZuoRAT, which closely resembles the Mirai Internet of Things malware that achieved record-breaking distributed denial-of-service attacks that crippled some Internet services for days. ZuoRAT often gets installed by exploiting unpatched vulnerabilities in SOHO devices.

Once installed, ZuoRAT enumerates the devices connected to the infected router. The threat actor can then use DNS hijacking and HTTP hijacking to cause the connected devices to install other malware. Two of those malware pieces—dubbed CBeacon and GoBeacon—are custom-made, with the first written for Windows in C++ and the latter written in Go for cross-compiling on Linux and macOS devices. For flexibility, ZuoRAT can also infect connected devices with the widely used Cobalt Strike hacking tool.

ZuoRAT can pivot infections to connected devices using one of two methods:

• DNS hijacking, which replaces the valid IP addresses corresponding to a domain such as Google or Facebook with a malicious one operated by the attacker.
• HTTP hijacking, in which the malware inserts itself into the connection to generate a 302 error that redirects the user to a different IP address.

Intentionally complex

Black Lotus Labs said the command and control infrastructure used in the campaign is intentionally complex in an attempt to conceal what’s happening. One set of infrastructure is used to control infected routers, and another is reserved for the connected devices if they’re later infected.

The researchers observed routers from 23 IP addresses with a persistent connection to a control server that they believe was performing an initial survey to determine if the targets were of interest. A subset of those 23 routers later interacted with a Taiwan-based proxy server for three months. A further subset of routers rotated to a Canada-based proxy server to obfuscate the attacker’s infrastructure.

This graphic illustrates the steps listed involved.

The threat actors also disguised the landing page of a control server to look like this:

The researchers wrote:

Black Lotus Labs visibility indicates ZuoRAT and the correlated activity represent a highly targeted campaign against US and Western European organizations that blends in with typical internet traffic through obfuscated, multistage C2 infrastructure, likely aligned with multiple phases of the malware infection. The extent to which the actors take pains to hide the C2 infrastructure cannot be overstated. First, to avoid suspicion, they handed off the initial exploit from a dedicated virtual private server (VPS) that hosted benign content. Next, they leveraged routers as proxy C2s that hid in plain sight through router-to-router communication to further avoid detection. And finally, they rotated proxy routers periodically to avoid detection.

The discovery of this ongoing campaign is the most important one affecting SOHO routers since VPNFilter, the router malware created and deployed by the Russian government that was discovered in 2018. Routers are often overlooked, particularly in the work-from-home era. While organizations often have strict requirements for what devices are allowed to connect, few mandate patching or other safeguards for the devices’ routers.

Like most router malware, ZuoRAT can’t survive a reboot. Simply restarting an infected device will remove the initial ZuoRAT exploit, consisting of files stored in a temporary directory. To fully recover, however, infected devices should be factory reset. Unfortunately, in the event connected devices have been infected with the other malware, they can’t be disinfected so easily.

https://arstechnica.com/?p=1863305

Giu 10, 2022 Redazione news Malware, News, RSS 0

---

Un nuovo ransomware vende il suo sistema di decrittazione sulla piattaforma di gioco Roblox, facendolo pagare con sua la moneta interna Robux

MalwareHunterTeam  ha reso noto sulla sua pagina Twitter un nuovo ransomware di nome WannaFriendMe che adotta un approccio inusuale nella sua richiesta di riscatto. Invece di chiedere un pagamento in criptovalute, infatti, i pirati richiedono agli utenti di acquistare il sistema di decriptazione sulla piattaforma Roblox.

Si tratta di una piattaforma di gioco online per ragazzi in cui gli utenti possono creare i propri titoli e guadagnare vendendo Game Pass che danno accesso a elementi speciali all’interno dei titoli. Per poterli acquistare, gli utenti devono usare la moneta della piattaforma, Robux, con cui è possibile comprare anche il “Ryuk Decrypter” che dovrebbe teoricamente permettere alle vittime di decriptare i file resi inaccessibili dai pirati.

Anche se il nome usato dai malviventi fa pensare che WannaFriendMe sia legato a Ryuk, è in realtà una variante del ransomware Chaos. Lo scorso giugno, è iniziata la vendita degli strumenti che consentono agli aspiranti criminali di creare il proprio attacco Chaos personalizzato. Il malware finge sempre di essere Ryuk, usando l’estensione  .ryuk per i file criptati.

Chaos e le sue varianti, però, sovrascrivono con dati casuali i file più grandi di 2MB invece di criptarli. In questo modo la vittima, anche pagando il riscatto, può recuperare solo quelli di dimensioni inferiori. Anche se non sono stati confermati attacchi effettivi, il fatto che questo ransomware distrugga parte dei file e prenda di mira giovani giocatori lo rende potenzialmente pericoloso.

Non sarebbe la prima volta che delle varianti di Chaos sono rivolte al mercato degli utenti di videogame. Lo scorso ottobre, infatti, dei pirati hanno fatto una campagna mirata agli appassionati di Minecraft giapponesi.

---

---

---

https://www.securityinfo.it/2022/06/10/pagare-il-ransomware-su-una-piattaforma-di-gioco/?utm_source=rss&utm_medium=rss&utm_campaign=pagare-il-ransomware-su-una-piattaforma-di-gioco

Giu 01, 2022 Redazione news Malware, News, RSS 0

---

Le soluzioni ESET NetProtect tutelano l’accesso in sicurezza a Internet sia da dispositivi mobili sia da reti fisse escludendo domini malevoli

ESET ha annunciato una nuova suite di prodotti per il settore delle telecomunicazioni (Telco) e degli Internet Service Provider (ISP), al fine di assicurare un’ampia protezione ai clienti.

La telemetria di ESET ha evidenziato l’aumento del volume degli attacchi informatici, soprattutto verso gli smartphone. Secondo la ricerca dell’azienda, inoltre, le comuni app stalkerware (che permettono di spiare segretamente la vita privata di un’altra persona attraverso il suo dispositivo mobile) per Android contengono vulnerabilità che mettono a rischio la sicurezza dei dispositivi.

---

---

---

https://www.securityinfo.it/2022/06/01/da-eset-nuovi-prodotti-per-laccesso-sicuro-a-internet/?utm_source=rss&utm_medium=rss&utm_campaign=da-eset-nuovi-prodotti-per-laccesso-sicuro-a-internet