IT NEWS

Imagine logging into your bank’s website after responding to a text message claiming you’re due a refund, only to see a warning to watch out for bogus texts:

For those who don’t read Dutch, the warning reads:

Never respond to unusual emails or texts!

Fraudsters often send e-mails under the guise of renewing your debit card or digipas. Never go into that. They refer to websites that are not owned by Argenta. Argenta will also never ask you to provide your card number by telephone because you will allegedly receive a new debit card or digipas.

Do you still receive suspicious messages?

Have you already passed on codes over the phone? Or has money already been withdrawn from your account? Please contact us immediately on (available 24/7 for victims of phishing).

The warning above is genuine, on a real bank’s website. But the warning, in this case, comes too late because this is the last and only legitimate stop in a victim’s passage through a phishing scam.

The bogus SMS trail begins

Here’s one of the suspect SMS messages, as tweeted by Twitter user @ypselon:

it has been decided that you will receive a refund. to receive this amount you can visit our website [url removed]

The text claims to be from “FOD”. This is the Federale Overheidsdienst Financien in Belgium. The suspect URL includes a domain registered just this month (often a red flag), in India, rather than Belgium.

Visiting the site presents you with a message that says:

Refund:

In order to receive a refund of your personal income tax, you must verify your account so that we can transfer the full amount of €278.35 to the correct account.

It is important to carry out a one-time verification as a check. Afterwards you will receive the amount on your account within a few working days.

For “one-time verification” read “send us money”.

We all love a tax refund so it’s an effective hook to lure in potential victims. Continuing reveals a large assortment of banks commonly used in Belgium.

A slippery phish

The scam site includes customised pages for each popular bank. Some ask for card details, others for account numbers. All are fake, all are trying to hoover up information that can be used to steal your money.

No matter which route you go down, entering your details will neither verify your identity nor secure you a tax refund. But all will leave you poorer and eventually redirect you to your bank’s real website (where you might encounter a warning about falling for scams like the one you’ve just fallen for).

At this point, your only option is to contact the bank for real, and tell them what’s happened. If you’re lucky, you may be able to have them shut things down. If not, days or weeks of hassle might lie in wait.

Faking it to make it

Fake tax refunds are hugely popular. They’re especially rampant during (or immediately following) any tax season. The Federale Overheidsdienst Financien has some advice for avoiding scams like this..

• If the FOD helped you with a tax return the previous year, it may contact you by phone. The organisation warns that if the caller doesn’t know your name; asks for payment for assistance; asks to come to your home; or requests passwords, PINs, email, or address, then you should hang up.
• Report any request to provide confidential data related to banking you receive by email, text, or WhatsApp.
• If you’re asked to make a payment to the FOD directly, check their site because there’s only a limited number of ways to make a payment to an official account.

The post Watch out for this SMS phish promising a tax refund appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs:

• Why you shouldn’t automate your VirusTotal uploads
• North Korean Lazarus APT group targets blockchain tech companies
• Watch out for Ukraine donation scammers in Twitter replies
• Beware tragic “my daughter died…” Facebook posts offering free PS5s
• US warns of APT groups that can “gain full system access” to some industrial control systems
• Oracle releases massive Critical Patch Update containing 520 security patches
• The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich
• It’s legal to scrape public data—US appeals court
• Beware of fake Twitter philanthropists offering to put $750 into your Cash App account
• Pegasus spyware found on UK government office phone

Stay safe!

The post A week in security (April 18 – 24) appeared first on Malwarebytes Labs.

Web scraping—the automated extraction of data from websites—has been around for a long time. Simultaneously cursed and praised, with nobody being able to quite land the decisive blow about whether it should be allowed, one way or another.

This may have changed, thanks to a recent US appeals court ruling.

A tangled web of scraped content

LinkedIn (and, by extension, Microsoft) is not impressed with people or organisations scraping publicly available data from its site. In fact, they’re so massively not impressed by the practice that things became legal in 2017 via a LinkedIn cease-and-desist. The social network objected to a company scraping public data from its pages, and the story rumbled into 2019 with another setback for the LinkedIn / Microsoft combo.

Last year, the data scraping saga was given one final chance to swing a decision in favour of scraping being viewed as a very bad thing. The decision has now been made, and it’s not good news for LinkedIn. Scraping public data is not considered to be a violation of the Computer Fraud and Abuse Act.

LinkedIn has vowed to keep on fighting this one. However: Is scraping really that big a deal?

The case for

1. The main argument in favour of scraping is that it is not a violation of privacy. It’s simply making use of content that has already been shared publicly.
2. It’s fantastic for archival purposes. Thanks to link rot and link reuse, huge chunks of the Internet simply vanish on a daily basis: Websites go bust, pages are moved or removed.

The case against

1. People who agree to share data on a site like LinkedIn probably don’t expect their data to be hoovered up by third-parties, and may not even realise it’s possible. So they don’t understand the implications of sharing their personal information publicly. If the only safe course of action is to simply post nothing, that feels like quite a big chilling effect.
2. Sometimes pages or sites go missing because the site owner wants them to go missing. There may be privacy reasons, or security issues, or something else altogether involved. Some archival sites and services will allow you to block their crawlers, but it can be a convoluted process and often involves a certain time and effort investment. Should people have to pre-emptively hunt down all the archival services in the first place to ensure something isn’t immortalised online forever?
3. Scraping can have a big impact on sites and services generally. It can be a little overwhelming for a small site owner to try and stop content thieves and scrapers repurposing their content for ad clicks. Sometimes sites will grab content and place it alongside malware or phishing for an additional twist of “please stop doing that”.

It’s verdict time

As you can see, I’m probably leaning more towards siding with LinkedIn on this one. Even so, with this latest decision in place and with so many frankly worrying ways scraped data can be misused, perhaps we are edging towards that previously mentioned chilling effect. One thing’s for sure, we’ll see this one back in a courtroom somewhere down the line.

As far as your own data goes, keep all of the above in mind. That one random photograph could be sucked up into a facial recognition platform. Your tweet from 11 years ago could be aggregated with other data about you in ways you hadn’t anticipated. That incredibly awesome public work profile you created may just pull in a bunch of spammers and con artists.

Prune accordingly, and keep the really sensitive stuff away from public view. That way, no matter the end result of any number of court cases, you’ll still hopefully have a firm grip of where your most important data ends up.

The post It’s legal to scrape public data—US appeals court appeared first on Malwarebytes Labs.

Twitter philanthropists are a controversial emergence on the social media platform. In essence, Twitter-based philanthropy is about incredibly rich people helping out those who need it. The help is random, and often focused around performing a task like listening to a podcast or simply retweeting something. Of course, not everyone can “win” and many, many people miss out.

Unfortunately there is no shortage of people who could use some assistance. So it was probably inevitable that copycats and scams offering false hope would jump in, ready to leave victims worse off than when they started.

The biggest name in Twitter philanthropy is probably William J. Pulte. His account, specifically, has developed a few barnacles of the copycat variety. Shall we take a look?

Fake it till you make it

Spot the problem below:

The bio and profile on both accounts is a straight copy of the real thing. Well, almost. The fake profiles aren’t verified so they edit the profile picture to include a blue Twitter bird. It’s not going to pass as verified for experienced social media users, but it’s the only option the scammers have.

The fake accounts take the unusual decision to retweet the real William a few times. They then drop their own bogus tweets into the mix.

One of them says:

Your chance to get $750 to your Cash App account.
Please Confirm your email now!
Click here [URL removed]
Have a good life with the $750
Good luck

It’s not a Lorem Ipsum page, but it’s close

The above tweet already sounds quite a bit different to the genuine article from “the inventor of Twitter philanthropy”. There, money is given directly with no use of shortening links or external sites (not that I’ve seen, anyway!)

For argument’s sake, let’s assume you’re convinced by the fake profile and you’re ready to click the bit.ly link. Before clicking, imagine the following scenario: You are William. You are rich. Staggeringly rich. So rich, you can give away a million dollars on social media over the course of a pandemic.

You then decide to put together the worst looking website anybody has ever seen and throw it on a free hosting service…

The site reads as follows:

Congratulation!

Your chance to get $750 to your Cash App account.

Please Confirm Your Email Now!

The link is only aimed at residents of the US. Should you click it from outside the desired region, you’ll be bounced off to a random assortment of other promo-style websites.

When free money isn’t free money…

Assuming you are indeed in the US, you’ll end up on the below page:

The offer has shifted gears abruptly from “rich person on Twitter might give me money I may urgently need” to “complete twenty deals to claim $750.”

Wait, what?

Yes, the fake profiles have quite cruelly sent people to some sort of sign-up offers deal. Not only that, but it’s the type which requires some form of monetary outlay in the first place. In fact, it’s entirely possible taking part could leave them less well off in total than if they’d tried to save up. Under the “how fast can I get my reward?” section, it says you can “typically complete” the required sponsored deals “within 5 – 7 days.” It also says some may take “up to 60” days to complete.

This does not really sound like what was originally promised by fake William.

Closing out the deal

Anyone genuinely giving away huge sums of money on Twitter is almost certainly going to have a verified profile. At the very least, you should be very cautious around non-verified profiles where promises of money are concerned. Even where profiles are verified, they can still be compromised and used for scams. Anything falling outside the typical posting pattern of accounts which do give away money to those in need should be treated with suspicion.

While the concept of free money from Twitter philanthropists is a potentially good one, simply ensuring the deck hasn’t been stacked against you may be too much of a risk itself. Stay safe out there!

The post Beware of fake Twitter philanthropists offering to put $750 into your Cash App account appeared first on Malwarebytes Labs.

“When we found the No. 10 case, my jaw dropped.”

John Scott-Railton recalled after finding out on July 7, 2020 that Pegasus, the highly sophisticated flagship spyware of Israel’s NSO Group, was used to infect a phone linked to the network at 10 Downing Street, the UK Prime Minister’s home and office.

For years, the Citizen Lab, a specialized research group based at the University of Toronto where Scott-Railton works as a senior researcher, has been investigating Pegasus and its misuse by governments—usually authoritarian ones—who bought the spyware from NSO.

The Pegasus infection at Downing Street was unearthed in The New Yorker article entitled “How democracies spy on their citizens,” an investigative look at governments’ use of Pegasus. A UK official confirmed the network had been compromised.

The National Cyber Security Centre (NCSC), a British intelligence body, painstakingly but thoroughly tested phones at Downing Street, including Boris Johnson’s, the current UK Prime Minister. However, they were unable to identify the infected device.

Based on the servers this device was said to phone back to, the United Arab Emirates (UAE) may be behind the hacking and spying against Downing Street.

“I’d thought that the US, UK, and other top-tier cyber powers were moving slowly on Pegasus because it wasn’t a direct threat to their national security,” Scott-Railton was quoted saying, “I realized I was mistaken: even the UK was underestimating the threat from Pegasus, and had just been spectacularly burned.”

Citizen Lab further revealed that phones connected to the Foreign Office, pre- and post-merger, were hacked via Pegasus on at least five more occasions. Again, based on destination servers, the UAE, India, and Cyprus were named potential instigators.

The UAE’s link to the hack only deepened after a British court revealed that Pegasus was used to spy on Princess Haya, former wife of current Prime Minister of Dubai Sheikh Mohammed bin Rashid al-Maktoum. The Sheikh was in a custody dispute with Haya, who fled to the UK with her children. Pegasus was also found to have been used to target Haya’s British attorneys.

David Ruiz, senior privacy advocate, spoke at length about Princess Haya’s case—and other Pegasus infections—in an earlier episode of the Malwarebytes podcast Lock and Code, which can be listened to in full here.

After an alert reached the NSO Group regarding the use of Pegasus against Princess Haya, the UAE shut down its spyware system, and NSO announced that its software would no longer target UK phone numbers the same way it has avoided targeting US numbers.

Goodbye, Pegasus. Hello, Maestro?

NSO consistently touted Pegasus as an aid to law enforcement in combating criminal organizations and terrorists. The New Yorker article and many others, however, only detail harrowing accounts of abuse: from hacking government officials’s phones via a WhatsApp zero-day exploit to tracking Loujain al-Hathloul, a women’s rights activist in Saudi Arabia. Her iPhone could easily have been patient zero to a vulnerability that bypasses Apple’s BlastDoor security feature using a malformed PDF.

As Pegasus has become publicly scrutinized, NSO Group has expanded its product line. This latest release is called Maestro, an AI tool that “scrutinizes surveillance data, builds models of individuals’ relationships and schedules, and alerts law enforcement to variations of routine that might be harbingers of crime.” One of product’s designers was quoted saying, “Turning every life pattern into a mathematical vector.”

NSO Group revealed that a handful of countries already use Maestro. Perhaps it’s only a matter of time for Maestro to become another controversy like Pegasus, and one that groups like Citizen Lab will investigate and reveal its potential dangers to the world.

The post Pegasus spyware found on UK government office phone appeared first on Malwarebytes Labs.

An “exceptionally rare and dangerous” advanced persistent threat (APT) malware kit, containing custom-made tools designed to target some of North America’s industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices, appears to have been caught before it could be let loose on America’s oil refineries and power grids.

Multiple US federal government agencies, including the FBI, NSA, and CISA, have released a joint advisory about this kit dubbed PipeDream. It features one-of-a-kind tools designed to work against systems belonging to Schneider Electric, OMRON, and the Open Platform Communications Unified Architecture (OPC UA).

While CISA has declined to name the state actor behind the tools, Mandiant and Dragos, two cybersecurity companies specializing in advanced persistent threats (APTs) that partnered with the agency, said that the tools’ behavior pointed to Russia as the likely source. However, this link, they say, is “largely circumstantial”.

Once inside ICS/SACADA operational technology (OT) networks, PipeDream can gain full system access to target devices, allowing them to scan, control, and compromise Windows-based engineering workstations using an exploit. Having full access also enables threat actors to elevate privileges, move laterally within the OT environment, and disrupt critical systems. Such disruptions could lead to machinery getting physically destroyed and, worse, loss of human lives.

Since the invastion of Ukraine began, President Biden has urged businesses to strengthen their security against possible Russian cyberattacks. However, cyberthreats against vital US infrastructure have been a concern for years, not least since Stuxnet successfully compromised nuclear centrifuges in Iran more than a decade ago.

ICS attacks—scary, but very hard to do

The outcome of a successful attack against vital infrastructure—such as a power grid, power station or water treatment plant—could be very bad indeed. And although we have yet to learn of a nation state successfully attacking one in the US, we can get a glimpse of the possible disruption by looking at other, similar forms of attack.

For example, a ransomware attack against Colonial Pipeline in 2021 caused it to halt operations for six days. Long lines of US motorists began queuing up at gas stations to panic buy fuel, causing prices to go up on the East Coast. A similar attack happened a month later, against meat processing giant JBS, stirring fear of shortages and price rises.

With catastrophic possibilities forecasted before any actual events ever happen, it is easy to get caught in the hype and assume that a critical infrastructure “big one” will play out sooner than expected. But such a possibility is, in fact, very slim, according to Lesley Carhart, principal threat hunter with Dragos.

Carhart spoke to Malwarebytes podcast host David Ruiz on an episode of the Lock and Code podcast last year all about disaster planning and the slim chance of a critical infrastructure “big one.”

Internet-connected ICS may be easy to find, but they are difficult to exploit in reality. Carhart attests to this. “These systems are honestly so complex and so distributed and so heterogeneous that they are really difficult to attack at scale,” she said.

The problem for attackers is that OT environments are all about risk mitigation. Their designers and operators spend their lives thinking about the risks in their environment and coming up with ways to mitigate them. Even if an attacker can compromise a computer and use it to make an environment do something it’s not supposed to, there are typically controls and operators primed to identify and stop errant systems before they can cause any harm.

“A more sophisticated, determined adversary has to think about how to get around those mitigations,” Carhart added.

A successful attack also demands a lot of time, resources, and preparation. According to Carhart, attackers oftentimes sit in networks for months and even build their own industrial facility to learn more about it. ICS attacks are “astronomically expensive”, she says.

Manufacturers of such systems are also increasingly creating them with security in mind. Despite what you might hear, Carhart does not think the dangers of an ICS “big one” are increasing. “In a lot of ways, people are more aware of the threats,” says Carhart. “They’re deploying more security monitoring, and they’re starting to build incident response plans for their industrial environments specifically. They’re starting to do threat hunting, penetration testing, [and] red teaming in their industrial environments.”

To learn more about the reality of defending critical infrastructure, listen to the podcast, embedded below.

The post US warns of APT groups that can “gain full system access” to some industrial control systems appeared first on Malwarebytes Labs.

Oracle has issued a Critical Patch Update which contains 520 new security patches across various product families. A few of these updates may need your urgent attention if you are a user of the affected product.

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). These are the CVEs that look most urgent.

Oracle Communications Applications

The update contains 39 new security patches for Oracle Communications Applications. 22 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

CVE-2022-21431 is a vulnerability in the Connection Manager component of the Oracle Communications Billing and Revenue Management product and it has the maximum CVSS score of 10 out of 10. Supported versions that are affected by this flaw are 12.0.0.4 and 12.0.0.5.

CVE-2022-23305 is a Log4j vulnerability with a CVSS score of 9.8. It affects the Oracle Communications Messaging Server and allows attackers to manipulate a database by entering SQL strings into input fields or headers. (Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.) The same Log4j vulnerability affects the Cartridge Deployer Tool component of Oracle Communications Network Integrity and the Logging component of Oracle Communications Unified Inventory Management. It also affects several components of Oracle Fusion Middleware.

CVE-2022-23990 is a vulnerability in the user interface (LibExpat) component of the Oracle Communications MetaSolv Solution, and it also has a seriously high CVSS score of 9.8. LibExpat versions before 2.4.4 have an integer overflow in the doProlog function that allows an attacker to inject an unsigned integer, leading to a crash or a denial of service.

Oracle Blockchain Platform

The update contains 15 new security patches for Oracle Blockchain Platform. 14 of these vulnerabilities may be remotely exploitable without authentication.

CVE-2021-23017 is a security issue in nginx resolver with a CVSS score of 9.8. It could allow an attacker who is able to forge UDP packets from the DNS server to cause a 1-byte memory overwrite.

Oracle GoldenGate

The update contains 5 new security patches plus additional third-party patches for Oracle GoldenGate.  4 of these vulnerabilities may be remotely exploitable without authentication.

CVE-2021-26291 is a security issue in Apache Maven with a CVSS score if 9.1. it affects the Oracle GoldenGate Big Data and Application Adapters. Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository.

Oracle Communications

The update contains 149 new security patches plus additional third party patches noted below for Oracle Communications. 98 of these vulnerabilities may be remotely exploitable without authentication.

CVE-2022-22947 is another vulnerability with a CVSS score of 10. It is a vulnerability in Spring Cloud Gateway that affects Oracle Communications Cloud Native Core Network Exposure Function and Oracle Communications Cloud Native Core Network Slice Selection Function. In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

Oracle Java SE

The update contains 7 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication.

CVE-2022-21449 is a vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE with a CVSS score of 7.5. The 7.5 is a very low score due to the wide range of impacts on different functionality in an access management context. This vulnerability applies to Windows systems only, but an attacker can trivially and completely bypass them if your server is running any Java 15, 16, 17, or 18 version before the April 2022 Critical Patch Update. An elaborate analysis of this vulnerability was published by ForgeRock.

Mitigation

For a complete list of the security vulnerabilities have a look at the Oracle security alerts page. Several of the discussed vulnerabilities in this Patch Update are vulnerabilities in third-party components which you may have patched earlier, but it’s definitely worth looking into.

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible. You can follow the links in the Patch Availability Document column on the Oracle page to access the documentation for patch availability information and installation instructions.

Stay safe, everyone!

The post Oracle releases massive Critical Patch Update containing 520 security patches appeared first on Malwarebytes Labs.

Today we look at a fakeout which begins with Elon Musk, and ends with a trip to Mars (or, if you’re really lucky, the Sun).

One of the most annoying “features” of Twitter is being added to lists without permission. It’s a theoretically useful way to keep track of certain topics. It’s often also used for trolling or spam. A friend of mine was added to a list over the weekend by what appeared to be Elon Musk.

It was not Elon Musk.

Dodging detection

The account in question is doing a pretty good job of not attracting attention while getting up to mischief. As you can see from the profile, it has an almost perfect no followers / no following ratio. There’s no tweets, no replies, no likes…nothing.

The account would simply pass you by, if you were looking for people up to no good.

Except.

Check out the account’s Twitter lists. This is done by clicking into the “…” and then hitting lists in the dropdown menu. With this done, we see a so-called “giveaway marathon” list. The giveaway isn’t detailed with text, so it is again very easy to miss. Rather, it’s a picture of a fake Elon Musk tweet which reads as follows:

I decided to randomly choose 1000 new followers, who can participate to the biggest crypto giveaway. Hurry up to join at [url removed].

For flying under the radar purposes, it’s almost perfect. Shall we take a look at this “biggest crypto giveaway”?

Behold, the “biggest crypto giveaway”

“5,000 BTC giveaway”, screams the banner.

They say:

Our marketing department here at Tesla HQ came up with an idea: to hold a special giveaway event for all crypto fans out there.

For those keeping score, 5,000 Bitcoin totals somewhere in the region of $200,000,000. Not bad for a giveaway pot!

How do you get your hands on this amazing slice of cash, I hear you cry? Well, you have to guess which planet “Tesla” is trying to explore. You do this by clicking on the planet we’re supposed to be exploring.

Some observations:

1. You can click on Earth, or indeed the Sun.
2. The image includes Pluto—a big salute to “Team Pluto is Definitely a Planet”. That muddy ball of ice and rock couldn’t have done it without you.
3. I did say we’d be going to Mars at the start of this blog, but the truth is, you can click anywhere you like to proceed. Yes, even the Sun.

I guess what I’m trying to say is I doomed humanity with an all-expenses paid trip to the Sun. With a payoff like that, I sure hope we’re about to get rich off the back of this giveaway.

Getting rich quick off the back of this giveaway

The site presents itself as being a giveaway specifically from Tesla.

It makes the following claim:

To verify your address, just send from 0.02 to 1 BTC to the address below and get from 0.10 to 10 BTC back.

Well, that’s a bold strategy. They’re saying that if you give them $40,000 then you’ll get $400,000 back at the upper contribution level. The advice is to use any wallet which supports Bitcoin, and then “select the amount you want multiplied…for example, to get 10 BTC, send 1 BTC.”

There’s also a fake “free Bitcoin remaining” timer counting down which tries to panic you into getting involved. Refreshing the page restarts the timer.

Speeding things up

One thing which people may not know about Bitcoin transactions is that there can be a delay with regard to transaction confirmation. This is down to verification and recording of new transactions. Essentially: You perform an action of some kind, and you have to wait for the Bitcoin blockchain to do blockchain things and confirm that you did, in fact, send cryptocurrency to somebody and it all went through as planned.

You’ll note that our Sun-bound BTC giveaway says “Still waiting for transaction? Click here!”

You’d assume it would mention the possibility of transaction notifications being delayed. To be fair, it does – but then adds a little something extra:

“Sometimes transaction network is under load and it can take more time. You can speed up the transaction by sending the same amount again to our address. This is an official promotion and every transaction address we receive gets their bonus back”

Considering we arrived here in the first place from Fake Elon, and this “official” Tesla giveaway is absolutely not an official Tesla giveaway, I’m not entirely sure I believe them. They’re asking you to send, at the upper donation limit, roughly $80,000 to try and help nudge the first transaction through.

In what may be the most not-needed spoiler warning of all time: This probably isn’t going to end well.

Aborting launch

All in all, we’d have to suggest giving this one a big miss. You’re not going to magically generate tons more money than you put in, and as fun as it is to suggest sending humanity into the fiery heart of the Sun it probably won’t make you very rich in the meantime.

Sorry, Fake Elon, but we’re going to have to pass.

The post The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich appeared first on Malwarebytes Labs.

Tragic tales are being posted to Facebook, combined with the offer of a giveaway. However, some are perhaps not quite what they seem. The PS5 is still one of the hottest bits of tech around, and near-total lack of availability, combined with a high sale price, means that some people will do whatever they can to obtain one.

As a result, PS5 scams are rife. Bogus giveaways and deals abound on social media and elsewhere. Scammers will often sweeten the deal by offering the item for free initially, before switching to asking for postage costs. Should you pay up, it’s quite possible the seller will vanish and you’ll be left out of pocket with no PS5 and no way to recover your funds.

“Browser beware” in local trade groups

Multiple posts have appeared in various groups where goods are sold or traded, typically from accounts with no other content associated with them. On initial viewing, they appear to tell a terrible tale of loss and bad memories, with the offer of household objects too painful to keep around.

The first red flag is that the Facebook posts that have been popping up, on and off, over the past few months are all very similarly written. Here’s one example, sent to me by a friend:

My daughter died while coming back from college last week. She was hit by a running car, my heart bleeds everyday. I bought a PS5 for her, she never got to see it. I want to give out the PS5 for free to someone who needs it. Seeing the PS5 everyday hurts my soul.

This sounds awful.

But before you offer yourself up as a potential recipient, there are some questions you should ask yourself. Starting with “why do the pictures of the unused machine show a PS5 that’s clearly plugged in, and in use?” I’m not saying it’s impossible for a parent to set up a PS5 for their kid. However, having set one up myself, there’s a fair bit of work involved. Not even accounting for system updates and other aspects of the setup routine, you also have to tie the console to a playstation account. This means a username, password, potential use of QR codes, and more.

An even better question is “why are completely unrelated people posting the exact same message elsewhere?” The one linked reads as follows:

My daughter died while coming back from college on Friday, she was hit by a running car my heart bleeds everyday I thought a PS5 for her she never get to see it. I want to give the PS5 out for free to someone who need it. Seeing the PS5 each day hurt my soul

As someone notes in the replies, they’ve seen this identical post from somebody else posted elsewhere, with the same images.

Here’s the same “my daughter died” example, except this time applied to a PS4. If you forward through to image 2 on that post, you’ll see image reuse for both the PS5 and also the dog in the funeral home—except now it’s about someone’s son instead of their daughter.

A popular seller group post format…

Seller groups are seeing these types of post more and more. Speaking of image reuse, here’s one from a group in Glace Bay, Canada in relation to someone’s daughter. Note the dog at the coffin, it appears a lot:

Meanwhile, here’s one from a different person in Ohio except now the dog is mourning the loss of the poster’s son:

I’ve lost count how many times the dog has now put in an appearance, and that’s before we get to the PS5 pictures!

“Buyer” beware

The majority of these posts switch off replies and have interested parties message them directly. They then try and convince them to pay for shipping costs upfront. Assuming the person paying is dealing with a scammer, both money and seller will drop all communication and / or vanish afterward.

It’s probable that some of these accounts have been compromised, so the supposed seller is likely going to have more problems once they recover their account. All things considered, there’s simply too many red flags associated with this style of Facebook post.

If you see a post like the above in a local group, you may want to contact the Admin and have them do some investigation before anybody commits to paying anything. We suspect the post will be removed long before anybody starts looking for shipping fees.

The post Beware tragic “my daughter died…” Facebook posts offering free PS5s appeared first on Malwarebytes Labs.

A new advisory issued by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the US Treasury Department (Treasury), highlights the cyberthreats associated with cryptocurrency thefts and tactics used by a North Korean state-sponsored advanced persistent threat (APT) group since at least 2020.

The Lazarus Group

APTs are defined as prolonged attacks on specific targets that aim to compromise their systems, and to gain information from or about them. The Lazarus Group, aka APT38, is commonly believed to be run by the North Korean government. It is thought to conduct financial cybercimes as a way to raise money for a regime that has few trading opportunities, because of long-standing international sanctions.

These days, financial cybercrimes often involve Bitcoin and other cryptocurrencies. The CISA advisory warns that:

The US government has observed North Korean cyber actors targeting a variety of organizations in the blockchain technology and cryptocurrency industry, including cryptocurrency exchanges, decentralized finance (DeFi) protocols, play-to-earn cryptocurrency video games, cryptocurrency trading companies, venture capital funds investing in cryptocurrency, and individual holders of large amounts of cryptocurrency or valuable non-fungible tokens

AppleJeus

Since 2018, one of the Lazarus Group’s tactics has been to disguse AppleJeus malware as cryptocurrency trading platforms for both Windows and Mac. CISA warns that it uses these trojanized applications to gain access to victims’ computers, to spread other malware, and steal private keys or to exploit other security gaps. All of this is done to create an environment where the group can initiate fraudulent cryptocurrency transactions.

Victims are lured into downloading the malware with a variety of social engineering tactics, including spearphishing.

Spearphishing campaigns

Spearphishing is a targeted form of phishing that’s directed at and addresed to specific individuals. It uses personalization to convince victims that they are reading and responding to legitimate messages.

CISA reports that the Lazarus Group has been sending spearphishing messages to employees of cryptocurrency companies—often working in system administration or software development/IT operations (DevOps) roles—using a variety of communication platforms and social media. The messages often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malicious “TraderTraitor” malware disguised as cryptocurrency trading or price prediction tools.

TraderTraitor describes a series of malicious Electron applications that can download and execute malicious payloads, such as remote access trojans (RAT).

Mitigation

The advisory contains a lot of specific IOCs for the most recent campaigns, but if we have learned anything from the past behavior of the Lazarus APT group it is that they will change man of them as soon as their current campaigns are outed. It is important therefore to apply the basic mitigation methods to counter this type of attacks:

• Use patch management to stay on top of those security updates!
• Educate users on social engineering attacks like spearphishing.
• Enforce credential requirements and use multi-factor authentication.
• Use endpoint protection to detect exploits and stop malware.
• Watch out for third-party downloads—especially cryptocurrency applications.
• Create an incident response plan so you know how to respond to cyber-intrusions.

Stay safe, everyone!

The post North Korean Lazarus APT group targets blockchain tech companies appeared first on Malwarebytes Labs.