IT NEWS

Last week on Malwarebytes Labs, we looked at IoT problems, Microsoft’s Patch Tuesday, and how cybercriminals want access to your cloud services. We also explored how VPNs can protect your privacy, and asked if MSPs have picked the right PSA.

Other cybersecurity news

• Hot phishing targets: Some brands are more appealing to scammers than others (Source: ZDNet)
• Not so private: Student finds way to watch private YouTube videos (Source: The Register)
• Gone dark: Dark-web marketplace DarkMarket taken down (Source: Interpol)
• Don’t lose your keys: Researchers lock horns with Google Titan (Source: Naked Security)
• Malware under fire: Malware vulnerability database launches (Source: Daily Swig) 
• Holiday phishing: Iranian APT group launches not-so-festive attack (Source: Bank Info Security)
• COVID scams: Vaccine used as bait by criminals (Source: IT Pro)
• Holes in the safety net: Banks warned not to scrap protection (Source: This is money)
• Scam confusion: Pushy sales tactics mistaken for scam (Source: Guardian)
• Mac Malware on the run: Malware operation avoids detection for 5 years (Source: ZDNet)

Stay safe, everyone!

The post A week in security (January 11 – January 17) appeared first on Malwarebytes Labs.

Have you ever experienced the feeling of relief that comes when you do something silly, but you’re glad you did it where people don’t know you? Or maybe you wished you were somewhere like that, but alas…

That is what a Virtual Private Network (VPN) can do for you: it can put you in a place where you are unknown.

To determine if and when you need a VPN, you must define what your goal is. If your main goal is to improve your privacy online, then a VPN is one of the possible solutions. Privacy is a right that is yours to value and defend. If you don’t fall into the categories of people who say “I have nothing to hide” or “they already know everything about me” then you may care enough about your privacy to use a VPN.

For the latest Malwarebytes Labs reader survey we asked “Do you use a VPN?” 2,330 responded and an impressive 36 percent said they now used a VPN. For perspective, ten years ago, only 1.5 percent of Americans used VPNs.

So, how does a VPN work?

In short and easy terms, a VPN acts as a middle-man between a user and the Internet. When the user wants to visit a site, they send information to the VPN over an encrypted connection, the VPN visits the site, and then it sends the data to the user over the same encrypted connection. These connections are not limited to web browsing, even though that is the first one that usually comes to mind.

In this post we will focus on the consumer using a VPN to browse the web. But it is good to know that many organizations use a VPN to allow secure, remote access to company resources. For example, an employee working from home can log in on a VPN to get access to systems, files or email, for example.

Hide your IP address

Your IP address is the address your home network uses on the Internet. It is usually assigned to you by your Internet Service Provider (ISP). The first thing a website you visit will receive is your IP address, because it’s the return address for the information that you requested. If you are using a VPN the website will receive the IP address of the VPN server instead. The VPN will reroute the information so that it reaches your screen, without the website ever seeing your IP address.

Not everyone is willing to share their IP address because it can be used to determine their approximate location, and to identify their ISP (who can, in turn, identify who the IP is assigned to).

Hide your traffic from your ISP

Speaking of which, people who distrust their ISP and don’t want them to know which sites they’re visiting, route their traffic through a VPN. The encrypted tunnel between the user and the VPN stops anyone, including their ISP, from seeing their traffic. And this isn’t a theoretical or unlikely problem: In the USA ISPs can sell information about their users’ browsing habits to the highest bidder.

If you use a VPN to hide your traffic from your ISP it’s important to keep in mind that you are now putting your trust in the hands of that VPN provider instead. In theory, the VPN provider can now track your online behavior.

Pretend to be in another country

Another reason we often hear for using a VPN, is when you want to pretend you are in another country. Certainly, a VPN is the easiest solution to accomplish that. Some websites or services are only available in certain territories (geofenced), so pretending to be somewhere you aren’t can give you access to resources that would otherwise be hidden from you.

Imagine being a foreign correspondent in a country where news media from abroad are blocked or redacted. Or you are having a vacation in a country where Facebook is forbidden, and you want to check up on your family and friends. That is where using a VPN comes in very handy. Keep in mind however that in many such countries the use of a VPN is forbidden as well and using one could get you into trouble.

Disadvantages of using a VPN

So far, we have discussed the advantages and reasons for choosing a VPN. Why does there always have to be a downside? In this case, it’s a typical you win some, you lose some scenario.

• It can make browsing slower. Even though Internet traffic can theoretically move at the speed of light, taking a detour takes time. Using a VPN can have a performance impact that varies from hardly noticeable to considerable. Another point to research when you are deciding which one to use.
• Some websites will block known VPN servers. Usually this is for reasons that would be grounds for not wanting to visit those sites anyway, but it can be annoying to disable your VPN for a specific site.
• Some sites don’t work correctly. Some sites are designed without considering that a visitor might be using a VPN. This can sometimes result in a partial loss of the information being sent back and forth so you may have to fill out a form twice or you may have to temporarily disable the VPN to complete the data transaction.
• Overconfidence can come back to bite you. Just because you are hiding behind a VPN, that doesn’t mean it’s impossible to find out who you are. And if your actions might put you in danger where you are using the VPN, some extra measures may be needed.

Choosing a VPN

To achieve the goal of enhancing privacy it is most important to choose a VPN that you can trust. A VPN provider that logs your activities and either sells them to advertisers or surrenders them to the authorities may not have the same goals as you do.

Another important feature for a VPN is that it encrypts the traffic between your computer and the VPN server, so that nobody can tap into the connection to find out what you are doing. That encryption stops at the VPN server, so anyone with access to that server can see see or modify the traffic. Again, putting too much trust in such a feature can prove to be misguided.

To go back to our comparison, even if they can’t conclusively prove that it was you, sometimes a strong suspicion can be just as damaging for your reputation.

Stay safe, everyone!

The post How a VPN can protect your online privacy appeared first on Malwarebytes Labs.

Not long ago, we helped MSPs pick the right remote monitoring and management (RMM) platform for them, and make it an essential part of their service toolkit. As you may recall, an RMM is a tool that helps MSPs do the work. And what better way to track the work—and other elements associated with it—than to have professional service automation (PSA) software do it for you?

“Do we really need a PSA?”

A PSA is, essentially, an all-in-one tool that helps MSPs manage an array of tasks, such as project management, collaboration, invoicing, ticketing, resource planning, and reporting and data analysis (to name a few), of every client project, throughout its lifecycle. It keeps all data and processes about a project available and linked in one place, so MSPs can see the big picture and waste no time making decisions or adjustments as needed. Some may think and liken PSA software to Enterprise Resource Planning (ERP) software for MSPs.

Many MSPs are realizing that they have little time and patience to waste on tedious and time-consuming tasks when they could have been doing more productive things. If you’re an organization that is just breaking into the MSP world, or already have years of experience, “Do we really need a PSA?” should no longer be the question you ask.

A PSA is not just a nice-to-have anymore. It has become an integral and critical platform that MSPs must have to scale effectively and profitably. What you should be asking instead is “Which PSA is right for my business?”

Benefits of using a PSA

Gone are the days when PSAs were akin to helpdesk software. They have evolved beyond merely managing support tickets and tasks. The modern-day PSA’s kit can offer (but is not limited to) the following benefits:

• Significantly cut the time it takes to search for documentation
• Reduced time spent on doing repetitive tasks
• Improved service level agreements (SLAs)
• Accurate tracking and recording of onsite services from start to finish
• Automatic generation of billing statements
• Efficient management of customer engagement
• Automatic patching and system updating
• Increased customer satisfaction
• A uniform consolidation of data used to make mission critical decisions

Know that each PSA in the market right now offers different solutions and bundles, and that MSPs could be impacted by them differently as well.

Of course, not every benefit above is what MPSs would want.

Not all MSPs, for example, want a suite that automatically applies patches to the system, because they would rather do some rigorous testing themselves first, before deployment. Picking the right PSA eventually boils down to what your organization needs, what you want to automate and/or improve on, and what best fits into your business practices and processes.

PSA considerations for the smart MSP

Before MSPs can take a deep dive into implementing a PSA suite, they must realize that this is no easy feat. It is a time-consuming, disruptive, and sometimes expensive task to undertake. But patience and perseverance have their rewards. Here are three simple questions MSPs should ask when deciding which PSA to pick.

“How well does it integrate with our other tools?”

While a PSA houses all of an MSP’s data under one virtual roof and boasts an assortment of other tools for their employees to use, it’s not the only system the business uses. An MSP could have its own bespoke customer relationship management (CRM) tool or use other systems from third parties, too, such as an accounting, data backup and recovery, RMM, and, of course, endpoint security software. Make sure that the PSA of your choice can achieve deep integrations with the tools you rely on.

“Is it scalable?”

Every organization’s goal is to grow its customer base, making it especially important for MSPs to have a PSA that can scale with its growth. Pick a PSA that has been designed and built with scalability in mind, so it can cope with these “growing pains”.

On an additional note, you will want to know how the cost of the PSA will change as your business grows. Make sure that it’ll still be within a reasonable budget and sustainable in the long run.

“Will it help us achieve accountability and efficiency?”

One of the main reasons for using a PSA is to bridge those gaps that are inherently found in disparate systems used by different departments in an organization. A good PSA should be able to eradicate siloed data by tracking, recording, and reporting everything. This way, employees are expected to perform tasks efficiently and in a timely manner, clients are provisioned with the best resources to get issues resolved quickly, and bills are issued accurately.

“Can it provide data that’ll help us make informed decisions?”

A PSA can also help MSPs handle unforeseen hurdles, such as customer security issues, or delays in project deliveries. Your choice of PSA should be capable of not only collecting and keeping data from different departments but also processing, analyzing, and presenting it to your users in a way that shows trends, reveals problem points, and forecasts needs, so that you can make improvements, create plans months ahead, and effectively respond to security threats.

All we need is time

Of all the different assets MSPs must manage efficiently in order to be profitable and remain competitive, the most important is time. And what better way to manage time than to automate important but mundane daily tasks, so employees can make better use of their time and provide a higher level of security to customers. That said, the choice of investing or not investing in a PSA is no longer up for debate for MSPs. The benefits of having one as part of your toolkit just far outweighs the costs and initial challenges that naturally come with change. At the end of the day, you’ll be glad you went for one.

The post MSPs, have you picked the right PSA for you yet? appeared first on Malwarebytes Labs.

On January 13 the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about several recent successful cyberattacks on various organizations’ cloud services.

What methods did the attackers use?

In the initial phase, the victims were targeted by phishing emails trying to capture the credentials of a cloud service account. Once the attackers had stolen a set of valid credentials, they logged into the compromised account and used it to send phishing emails to other accounts within the organization. Those phishing emails used links to what appeared to be existing files on the organization’s file hosting service.

In some cases, threat actors modified victims’ email rules. On one user’s account an existing rule was set up to forward mail to their personal account. The threat actors updated the rule to forward all email to their own accounts. In other cases, the attackers created new rules that forwarded mails containing certain keywords to their own accounts.

As an alternative to the phishing attempts, attackers also used brute force attacks on some accounts.

Perhaps most eye-catching of all though, in some cases multi-factor authentication (MFA) logins were defeated by re-using browser cookies. These attacks are called “pass-the-cookie” attacks and rely on the fact that web applications use cookies to authenticate logged-in users.

Once a user has passed an MFA procedure, a cookie is created and stored in a user’s browser. Browsers use the cookie to authenticate each subsequent request, to spare visitors from having to log in over and over again in the same session. If an attacker can capture an authentication cookie from a logged-in user they can bypass the login process completely, including MFA checks.

Who is behind these attacks on cloud services?

Even though the attacks that CISA noticed had some overlap in the tactics they used, it is unlikely that they were all done by the same group. While some were clear attempts at a business email compromise (BEC) attack, there could be other groups active that are after different targets.

Countermeasures

Educate users on cybersecurity in general and point out the extra risks that are involved in working from home (WFH). For these specific attacks, extra training to recognize phishing certainly wouldn’t hurt.

Use a VPN to access an organization’s resources, such as its file hosting service. The temptation to leave these resources openly accessible for remote employees is understandable, but dangerous.

Sanitize email forwarding rules or at least let the original receiver of the mail be notified when a forwarding rule has been applied. If there are rules against forwarding mails outside of the environment (and maybe there should be) it should not be too hard to block them.

Use MFA to access all sensitive resources. (It’s important to note that although the CISA report mentions a successful attack where MFA was bypassed, it also mentions unsuccessful attacks that were defeated by MFA.)

Ensure resources are only be accessible to people authorized to use them, and enable logging so you can review who has used their access.

Set the lifespan of authentication cookies to a sensible time. Find a balance between keeping session duration short, without annoying legitimate users and “allowing” attackers to use stale cookies to get access.

Verify that all cloud-based virtual machine instances with a public IP do not have open Remote Desktop Protocol (RDP) ports. Place any system with an open RDP port behind a firewall and require users to use a VPN to access it through the firewall.

IOCs

The CISA report also links to a downloadable copy of IOCs for those that are interested.

The post Cybercriminals want your cloud services accounts, CISA warns appeared first on Malwarebytes Labs.

Every second Tuesday of the month it’s ‘Patch Tuesday’. On Patch Tuesday Microsoft habitually issues a lot of patches for bugs and vulnerabilities in its software.

It’s always important to patch, but the update that was released on January 12 is one to pay attention to. That’s because it contains a patch for a vulnerability in Windows Defender that is already being exploited in the wild.

The vulnerability in Windows Defender

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list—a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

The vulnerability in Windows Defender was registered as CVE-2021-1647—a Remote Code Execution (RCE) vulnerability—and was found in the Malware Protection Engine component (mpengine.dll). According to Microsoft:

“While this issue is labeled as an elevation of privilege, it can also be exploited to disclose information. The type of information that could be disclosed if an attacker successfully exploited this vulnerability is uninitialized memory.”

I don’t see an update for this vulnerability

If you are missing this fix in your list, it’s possible that this bug has already been patched by Microsoft on end-user systems, as the company continuously updates Defender outside of the normal monthly patch cycle. But you may want to check whether you are using a patched version.

What version of Windows Defender am I using?

The first patched version is 1.1.17700.4. If you want to make sure that you have a patched version of Windows Defender, here is how you can check this on a Windows 10 computer:

• From the Windows Start Menu, search for Windows Security and click on the result that has the App text and the “white on blue” shield.
• When Windows Security opens, click on the gear box icon with the Settings text at the bottom left of the Window.
• When the Settings screen opens, click on the About link.
• The Windows Security About page will now be open and will show the Antimalware Client Version (Microsoft Defender version), the Engine version (Scanning Engine), the Antivirus version (Virus definitions), and the Antispyware version (Spyware definitions).
• The engine version is the one that matters here. It needs to be at 1.1.17700.4 or newer.

The rest of the Microsoft updates

The total package contained over 80 patches. Ten of them were classified as critical, which means that they could possibly be used in the future by cybercriminals to attack unpatched systems. And even the ones that are not rated as critical could put you at risk at some point. It’s always important to apply all the patches as soon as you possibly can, especially when it concerns your operating system. So, please do go install these patches as soon as possible.

Stay safe, everyone!

The post Microsoft issues 83 patches, one for actively exploited vulnerability appeared first on Malwarebytes Labs.

Networking equipment manufacturer Ubiquiti sent out an email to warn users about a possible data breach. The email stated there had been unauthorized access to its IT systems that are hosted with a third-party cloud provider.

Ubiquiti Networks sells networking devices and IoT devices. It did not specify which products were affected but pointed at UI.com, which is its customer web portal. The servers in this domain store user profile information for account.ui.com, the web portal that Ubiquiti makes available to customers who bought one of its products. From there, users can manage devices from a remote location and access a help and support portal.

According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords, although the company says there’s no evidence of the attacker accessing the specific databases that contained user information.

Ubiquiti advised users to change their password and enable 2FA for their Ubiquiti account. The manufacturer also warned customers who stored their physical address and phone number in their account that these may also have been accessed.

What happened exactly?

Unfortunately, there is very little other information about this breach. How many Ubiquiti users are impacted and how the data breach occurred is unknown at this time.

Ubiquiti’s advice

The advice provided by Ubiquiti as shown in a copy of the email is sensible:

• Change the password.
• Enable 2FA.
• Don’t forget to change passwords on sites where you have used the same credentials.

Other IoT shenanigans

In other IoT news this week, a security flaw in a chastity belt for men made it possible for hackers to remotely lock all the devices in use simultaneously. The internet-linked sheath has no manual override, so owners might have been faced with the fear of having to use a grinder or bolt cutter to free themselves from its metal clamp. Luckily a workaround was provided by the Chinese developer.

Also, a group of Dutch safety experts have demonstrated that a traffic light system for bikes connected to a smartphone app can be hacked, potentially causing an accident. The smart system, part of which is still in the testing phase, has currently only been installed by ten local councils, but future plans included all the traffic at some 1,200 crossroads to be regulated via the internet to improve the flow of the traffic.

IoT insecurity

These are all examples of IoT insecurity that reached us this week alone, and clearly there is still a lot of work to be done to improve IoT security in general.

The examples show that there are a lot of angles that attackers can look at when they want to breach devices or interfere with their operations. The Ubiquiti attack was carried out through the online customer portal. The chastity belts were operated by compromising the server that provided remote control. The Dutch white hats were able to send false information to the traffic lights by reverse engineering and altering the signal sent by the app.

Advice for IoT users

Firstly, users should ask themselves if they need the device they are buying to be an IoT device. Is the remote functionality a mere “gadget” or is it something you expect to use regularly?

Secondly, look at the manufacturers track record when it comes to data privacy and the nature of the data you are providing them with. If it looks dodgy, it may well be.

Stay safe, everyone!

The post Ubiquiti breach, and other IoT security problems appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs, we released survey results about VPN usage and found that 36 percent of our respondents use it. We also talked about Adobe Flash Player reaching its end of life—meaning, Adobe won’t be supporting the updating and patching of its Flash Player software; covered the ransomware attack against Funke Media Group, one of Germany’s largest publishers; and reported on a new Bitcoin sextortion scam making rounds since the eve of 2021. Lastly, we profiled the latest campaign of APT37, a North Korean threat actor, wherein they used a self-decoding VBA Office file to inject RokRat, a cloud-based RAT, onto Notepad.

Other cybersecurity news:

• A couple of Chinese APT groups moved to doing ransomware attacks. (Source: BleepingComputer)
• Juspay, a company that processes payments for companies like Amazon, MakeMyTrip, Swiggy, and others, revealed it was a victim of a data breach in Q3 of 2020. (Source: Business Insider – India)
• More than haf a million leaked employee credentials of leading video games companies were found for sale on the Dark Web. (Source: SiliconANGLE)
• Babuk Locker was hailed as the first new enterprise ransomware of 2021. (Source: BleepingComputer)
• COVID-19 vaccine phishing scams are growing. (Source: InfoSecurity Magazine)
• News of several Instagram scams are making the rounds: One is about a fake copyright violation, and the other is a fake overpayment of a service, which police call an overpayment scam.
• Think twice about using IoT chastity belts as hackers can—and have—locked up their wearers with ransomware. (Source: TechRadar Pro)
• The United Nations revealed that it might have been breached. (Source: ITProPortal)

Stay safe, everyone!

The post A week in security (January 4 – January 10) appeared first on Malwarebytes Labs.

On December 22, Germany’s third largest publisher fell victim to a cyberattack that affected systems in offices all around the country. The Funke Media Group publishes dozens of newspapers, like Berliner Morgenpost, Hamburger Abendblatt, and Bergedorfer Zeitung, as well as magazines, several local radio stations, and online news portals. It reaches over 3 million readers on a daily basis.

The impact of the ransomware attack

The attack hindered work at the newspaper editorial offices and halted some of its major printing houses. As a result, subscribers received only emergency issues of a few pages. Because of this impact on the printed editions of the newspapers, the publishing house has decided to temporarily remove the paywall that is normally active on its news site, so everyone has full access to all of its articles. Unlike the newspapers, the publishing of the magazines that belong to the Funke Media Group are not expected to be delayed.

The press release by Funke states that several of its main systems in offices around Germany had been encrypted. This would indicate a ransomware attack. In a later press release, Funke stated that over 6000 laptops and thousands of other systems (endpoints and servers) were affected, and that its IT staff worked with the help of cybersecurity professionals throughout the holidays to get as many systems as possible up and running again. The attack is under investigation by police.

Getting the damage undone

The IT specialists have organized wipe and rebuild lines in the style of a digital car wash. These are functional in three of the publisher’s main locations where all the laptops are checked, cleaned, re-installed, and then returned to users. On January 4, some 1200 endpoints had undergone this procedure.

As we’ve pointed out many times before, the damage that’s done by ransomware is far greater than the amount of the ransom. It takes huge efforts to get a large-scale operation up and running again, especially in this case where the victim is a wide-spread and highly computerized organization like a major publisher.

Leaked data

A lot of the major current ransomware families threaten to publish breached data in order to create greater leverage for the victim to pay the ransom. With over three million subscribers and maybe even some interesting information unearthed by journalists, the obtained information could be very costly.

Since it’s unknown which type of ransomware was used in this attack, it is not yet possible to tell whether any data were exfiltrated during the attack, and whether any such data will be published if the Funke Media Group refuses to pay the ransom. Of course, we will keep you posted about any developments.

Stay safe, everyone!

The post Funke Media Group suffers nationwide ransomware attack in Germany appeared first on Malwarebytes Labs.

Malwarebytes recently received a report about a fresh spate of Bitcoin sextortion scam campaigns doing the rounds.

Bitcoin sextortion scams tend to email you to say they’ve videoed you on your webcam performing sexual acts in private, and ask you to pay them amount in Bitcoin to keep the video (which doesn’t exist) private. This type of blackmail has become quite popular since the middle of 2018.

Sextortion scammers frequently use spoofed or made up email addresses to contact their targets. Previous campaigns have targeted those with compromised account passwords scraped from third-party breaches, minors, and other vulnerable groups. In this case, our experts believe that these emails have been targeting .org email addresses, and senior leadership almost exclusively.

From: {spoofed sender name}

Subject: I have full control of your device

Message body:

Hi

Did you notice that I sent you an email from your address? Yes, that means I have full control of your device. I am aware you watch adults [sic] content with underage teens frequently. My spyware recorded a video of you masturbating. I also got access to your address book. I am happy to share these interesting videos with your address list and social media contacts. To prevent this from happening, you need to send me 1000 (USD) in bitcoins.

Bitcoin wallet part 1: 1C1FfgyNsJGJZfuR2ePXxTraa

Bitcoin wallet part 2: CqE6WLWSM

Combine part 1 and part 2 with no space between them to get the full bitcoin wallet.

Quick tip! You can procure bitcoins from Paxful. Use Google to find it.Once I receive the compensation (Yes, consider it a compensation), I will immediately delete the videos, and you will never hear from me again. You have three days to send the amount. I will receive a notification once this email is opened, and the countdown will begin.

What we may perceive as a-dime-a-dozen, cookie-cutter blackmail email may be something new to someone, especially those who aren’t aware of such a charade. Make no mistake: Email scams that contain little to no threats towards recipients have worked repeatedly like a charm.

This is why it’s important to keep up with what’s happening in cybersecurity, how online threats affect aspects of our lives, and how we can better protect ourselves, our data, and the people around us from those who scare, threaten, and bluff their way into our wallets. Treat all emails like this with a healthy amount of skepticism and you should be able to really see the email as it truly is: a fake.

Malwarebytes has extensively written about Bitcoin sextortion scams through the years. And what we advised then is still relevant to these new sextortion scams.

Change your passwords—or, better yet, consider using a password manager to help you create and store more complicated passwords for you.

Always use multi-factor authentication (MFA) to add an extra step of security. Most companies with an online presence have this, so make full use of it.

Do not pay the scammer.

If you received a sextortion email at work, let your IT department know. If you’re in the United States, feel free to report this to the FBI’s IC3.

Our Director of Mac and Mobile, Thomas Reed, had drafted a post aimed at Mac users who have received such scammy emails but need guidance on what these are what they need to do.

Stay safe, as always, and remain vigilant.

Bitcoin addresses related to this scam (as of this writing):

• 1Nd3JST1daeyzmPovkRoemjysA6JfXjVRg
• 17qBCU7Y5yrS9eimxvydRYw3XNF9meuSCY
• 1C1FfgyNsJGJZfuR2ePXxTraaCqE6WLWSM

The post “I have full control of your device”: Sextortion scam rears its ugly head in time for 2021 appeared first on Malwarebytes Labs.

This post was authored by Hossein Jazi

On December 7 2020 we identified a malicious document uploaded to Virus Total which was purporting to be a meeting request likely used to target the government of South Korea. The meeting date mentioned in the document was 23 Jan 2020, which aligns with the document compilation time of 27 Jan 2020, indicating that this attack took place almost a year ago.

The file contains an embedded macro that uses a VBA self decoding technique to decode itself within the memory spaces of Microsoft Office without writing to the disk. It then embeds a variant of the RokRat into Notepad.

Based on the injected payload, we believe that this sample is associated with APT37. This North Korean group is also known as ScarCruft, Reaper and Group123 and has been active since at least 2012, primarily targeting victims in South Korea.

In the past, this APT has relied on Hangul Office documents (hwp files) to target victims, as it’s software that’s commonly used in South Korea. However, in this blog we describe an interesting alternative method, delivered via self-decoding VBA Office files. To the best of our knowledge, this is a first for this APT group.

Document analysis

The actor used the VBA self-decoding concept in its macro that was first introduced in 2016. A malicious macro is encoded within another that is then decoded and executed dynamically.

We can consider this technique an unpacker stub, which is executed upon opening the document. This unpacker stub unpacks the malicious macro and writes it into the memory of Microsoft Office without being written to disk. This can easily bypass several security mechanisms.

Figure 3 shows the macro used by this document. This macro starts by calling the “ljojijbjs” function, and based on the results will take different paths for execution.

Microsoft by default disables the dynamic execution of the macro, and if an attacker needs to execute one dynamically—which is the case here—the threat actor needs to bypass the VB object model (VBOM) by modifying its registry value.

To check if it can bypass the VBOM, it looks to see if the VBOM can be accessed or not. The “ljojijbjs” function is used for this purpose and checks read access to the VBProject.VBComponent. If it triggers an exception, it means the VBOM needs to be bypassed (IF clause). If there is no exception, it means the VBOM is already bypassed and VBA can extract its macro dynamically (Else clause).

“fngjksnhokdnfd” is called with one parameter to bypass VBOM. This function sets the VBOM registry key to one.

After bypassing VBOM, it calls another function which creates a Mutex in the victims’s machine by calling CreateMutexA API call and names it “mutexname”. This could be used by the actor to make sure it infects its victim only once but in this document we didn’t observe any evidence of checking the mutex.

Finally, in order to perform the self-decoding process, it needs to open itself by creating a new Application object and load the current document in it in invisible mode.

If VBOM is already bypassed, The function Init is called and generates the malicious macro content in obfuscated format.

In the next step, this obfuscated macro is passed to “eviwbejfkaksd” to be de-obfuscated and then executed into memory.

To de-obfuscate the macro, two string arrays have been defined:

• StringOriginal which contains an array of characters before de-obfuscation
• StringEncoded which contains an array of characters after de-obfuscation

A loop has been defined to de-obfuscate the macro. For each iteration it takes a character in the obfuscated macro and looks for its index in StringEncoded. When it finds its index, it looks for its equivalent index in StringOriginal, takes that character from it and adds it to the new macro. As an example “gm* bf” as encoded macro will be decoded to “Option”.

Following this process gives us the final macro that will be executed in the memory space of Microsoft Office. In order to execute this decoded macro, it creates a module and writes into it before calling its main function to execute the macro.

The main function defines a shellcode in hex format, and a target process which is Notepad.exe. Then, based on the OS version, it creates a Notepad.exe process and allocates memory within its address space using VirtualAlloc. It then writes the shellcode into the allocated memory using WriteProcessMemory. At the end it calls CreateRemoteThread to execute the shellcode within the address space of Notepad.exe.

Shellcode analysis (RokRat):

The shellcode injected into Notepad.exe downloads an encrypted payload from http://bit[.]ly/2Np1enh which is redirected to a Google drive link.

Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud, Dropbox, Box, Yandex).

Similar to its previous variants, it uses several anti-analysis techniques to make sure it is not running in an analysis environment. Here are some of the checks:

• Checking the DLLs related to iDefense SysAnalyzer, Microsoft Debugging DLL and Sandboxies
• Calling IsDebuggerPresent and GetTickCount to identify a debugger
• Checking VMWare related file

This RAT has the following capabilities:

• Capture ScreenShots

• Gather system info (Username, Computer name, BIOS)

• Data exfiltration to cloud services

• Stealing credentials
• File and directory management

For more detailed analysis of this RAT you can refer to the reports from NCC Group and Cisco Talos.

Conclusion

The primary initial infection vector used by APT37 is spear phishing, in which the actor sends an email to a target that is weaponized with a malicious document. The case we analyzed is one of the few where they did not use Hwp files (Hangul Office) as their phish documents and instead used Microsoft Office documents weaponized with a self decode macro. That technique is a clever choice that can bypass several static detection mechanisms and hide the main intent of a malicious document.

The final payload used by this threat actor is a known custom RAT (RokRat) that the group has used in previous campaigns. In the past, RokRat has been injected into cmd.exe, whereas here they chose Notepad.exe.

Indicators of Compromise

Maldoc:
3c59ad7c4426e8396369f084c35a2bd3f0caa3ba1d1a91794153507210a77c90

RokRat:
676AE680967410E0F245DF0B6163005D8799C84E2F8F87BAD6B5E30295554E08
A42844FC9CB7F80CA49726B3589700FA47BDACF787202D0461C753E7C73CFD2A
2A253C2AA1DB3F809C86F410E4BD21F680B7235D951567F24D614D8E4D041576
C7CCD2AEE0BDDAF0E6C8F68EDBA14064E4A9948981231491A87A277E0047C0CB

The post Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat appeared first on Malwarebytes Labs.