Anomali Cyber Watch: Attacks Against Israeli Targets, MacOS Zero-Days, Conti Ransomware Targeting US Healthcare and More
The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Agrius, Conti, North Korea, JSWorm, Nobelium, Phishing, Strrat and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 – IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
New Sophisticated Email-based Attack From NOBELIUM
(published: May 28, 2021)
NOBELIUM, the threat actor behind SolarWinds attacks, has been conducting a widespread email campaign against more than 150 organizations. Using attached HTML files containing JavaScript, the email will write an ISO file to disk; this contains a Cobalt Strike beacon that will activate on completion. Once detonated, the attackers have persistent access to a victims’ system for additional objectives such as data harvesting/exfiltration, monitoring, and lateral movement.
Analyst Comment: Be sure to update and monitor email filter rules constantly. As noted in the report, many organizations managed to block these malicious emails; however, some payloads successfully bypassed cloud security due to incorrect/poorly implemented filter rules.
MITRE ATT&CK: [MITRE ATT&CK] Spearphishing Link – T1192 | [MITRE ATT&CK] Spearphishing Attachment – T1193
Tags: Nobelium, SolarWinds, TearDrop, CVE-2021-1879, Government, Military
Evolution of JSWorm Ransomware
(published: May 25, 2021)
JSWorm ransomware was discovered in 2019, and since then different variants have gained notoriety under different names such as Nemty, Nefilim, and Offwhite, among others. It has been used to target multiple industries with the largest concentration in engineering, and others including finance, healthcare, and energy. While the underlying code has been rewritten from C++ to Golang (and back again), along with revolving distribution methods, JSWorm remains a consistent threat.
Analyst Comment: Ransomware threats often affect organisations in two ways. First encrypting operational critical documents and data. In these cases EDR solutions will help to block potential Ransomwares and data backup solutions will help for restoring files in case an attack is successful. Secondly, sensitive customer and business files are exfiltrated and leaked online by ransomware gangs. DLP solutions will help to identify and block potential data exfiltration attempts. Whereas network segregation and encryption of critical data will play an important role in reducing the risk.
MITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information – T1027 | [MITRE ATT&CK] Private Keys – T1145 | [MITRE ATT&CK] Remote File Copy – T1105 | [MITRE ATT&CK] System Owner/User Discovery – T1033 | [MITRE ATT&CK] Code Signing – T1116 | [MITRE ATT&CK] BITS Jobs – T1197 | [MITRE ATT&CK] Process Injection – T1055 | [MITRE ATT&CK] Standard Application Layer Protocol – T1071 | [MITRE ATT&CK] Data Encrypted for Impact – T1486 | [MITRE ATT&CK] File and Directory Discovery – T1083 | [MITRE ATT&CK] Clipboard Data – T1115 | [MITRE ATT&CK] Drive-by Compromise – T1189 | [MITRE ATT&CK] Deobfuscate/Decode Files or Information – T1140
Tags: JSWorm, Nemty, Offwhite, Fusion, Telegram, Nefilim, Milihpen, Gangbang, RIG Exploit Kit, Trik Botnet, EU & UK, North America, South America, Russia, China, Healthcare, Engineering, Finance, Energy
Threat Actor ‘Agrius’ Emerges to Launch Wiper Attacks Against Israeli Targets
(published: May 25, 2021)
Cyber Operations in Israel have been carried out since mid-2020 by a threat group dubbed ‘Agrius’, targeting military and political organizations to commit espionage. The attacks look like ransomware in order to give the appearance of financial motives, but the malware was wiping systems instead. Agrius uses ProtonVPN to mask their traffic when attacking targets using ‘Apostle’ malware. Apostle has been identified as an ASPXSpy variant, which is open-source and has been used in other state-sponsored attacks. It has recently been updated to a fully-fledged ransomware tool, giving more legitimacy to the misdirection of money.
Analyst Comment: Defense-in-depth (layering of security mechanisms, redundancy, fail-safe defense processes) is the best way to ensure safety from APTs, including a focus on both network and host-based security. Prevention and detection capabilities should also be in place.
MITRE ATT&CK: [MITRE ATT&CK] Web Shell – T1100 | [MITRE ATT&CK] Data Destruction – T1485
Tags: Apostle, ASPXSpy, Agrius, Israel, Russia, Pakistan, Middle East
MacOS Zero-Day Let Attackers Bypass Privacy Preferences
(published: May 25, 2021)
Threat actors have been leveraging vulnerabilities (CVE-2021-30663, CVE-2021-30713, CVE-2021-30665) within MacOS to bypass the Transparency Consent and Control framework, enabling them to control which resources are accessible. This allowed for the theft of browser cookies, enabled screenshot capabilities, and access the system disk without the user being aware. Apple has released patches for the associated vulnerabilities.
Analyst Comment: Always make sure to keep systems up to date with the latest patches to prevent systems from being vulnerable to known exploits.
MITRE ATT&CK: [MITRE ATT&CK] Screen Capture – T1113 | [MITRE ATT&CK] Code Signing – T1116
Tags: XCSSET, CVE-2021-30663, CVE-2021-30713, CVE-2021-30665
North Korean Hackers Behind CryptoCore Multi-Million Dollar Heists
(published: May 24, 2021)
Reports from ClearSky, F-Secure, JPCERT/CC and NTT Security show that the North Korea-sponsored Lazarus group has engaged in widespread theft over the past three years. This has involved breaching cryptocurrency exchanges in the U.S., Israel, Europe, and Japan. Since 2018, the group has relied on spearphishing attacks as an initial foothold into the exchanges, which are leveraged into RAT and infostealer malware infections. The CryptoCore campaign is responsible for at least five breaches, stealing an estimated $200 million dollars.
Analyst Comment: If engaging in cryptocurrency exchanges, only transfer what is being traded. Keep all other funds stored offline in a hardware wallet to reduce the risk of theft by malicious actors
MITRE ATT&CK: [MITRE ATT&CK] Bash History – T1139 | [MITRE ATT&CK] Remote File Copy – T1105 | [MITRE ATT&CK] Data from Local System – T1005 | [MITRE ATT&CK] Data Encoding – T1132 | [MITRE ATT&CK] Exfiltration Over Command and Control Channel – T1041
Tags: Lazarus, CryptoCore, CryptoMimic, EU & UK, North America, Russia, North Korea, Banking & Finance
FBI identifies 16 Conti Ransomware Attacks Striking US Healthcare, First Responders
(published: May 24, 2021)
The Conti ransomware group has been linked to at least 16 recent attacks against healthcare organizations in the US, as well as over 400 attacks worldwide. Using open RDP (Remote Desktop Protocol) ports, stolen credentials or phishing emails, the Conti group will gain access to data and not only encrypt it, but also exfiltrate it in an effort to double-up on extortion money from affected targets. This group also attacked Ireland’s Health Service Executive on May 14th and demanded $20 million in ransom to decrypt the data and prevent data leaks.
Analyst Comment: Ransomware becomes much less effective with proper backup and restoration strategies. These will mitigate downtime and prevent the need to payout massive sums of money for decrypters that don’t work (as well as fueling the ransomware industry). If you are an organization that falls victim to ransomware, scan for infections and try to isolate the infected systems.
MITRE ATT&CK: [MITRE ATT&CK] Remote File Copy – T1105 | [MITRE ATT&CK] Data from Local System – T1005 | [MITRE ATT&CK] Data Encoding – T1132 | [MITRE ATT&CK] Data Encrypted for Impact – T1486
Tags: Conti, Cobalt Strike, Emotet, Sodinokibi, Mimikatz, Trickbot, Nefilim, EU & UK, North America, Healthcare, Military
This Massive Phishing Campaign Delivers Password-Stealing Malware Disguised as Ransomware
(published: May 24, 2021)
Strrat, a Java-based malware, is currently being delivered a PDF document via a phishing campaign using compromised email accounts. Once the PDF is opened, a connection is made to an external IP and a RAT is downloaded and installed. The victim will see that files have a “.crimson” extension added to them, along with a fake ransomware message. No data is actually encrypted. The strategy is to harvest user credentials and other valuable information while the victim deals with a supposedly-encrypted hard drive.
Analyst Comment: Don’t open attachments from unknown senders pertaining to sensitive subjects (such as finances) without first verifying through a known good communication channel. Doing so will reduce your risk of malware infection.
MITRE ATT&CK: [MITRE ATT&CK] Hidden Files and Directories – T1158 | [MITRE ATT&CK] Spearphishing Attachment – T1193 | [MITRE ATT&CK] Credential Dumping – T1003 | [MITRE ATT&CK] Query Registry – T1012 | [MITRE ATT&CK] File and Directory Discovery – T1083 | [MITRE ATT&CK] Clipboard Data – T1115
Tags: Strrat, Phishing, Infostealer, Ransomware, Banking & Finance, Military
