Anomali Cyber Watch: Researchers Break Down WhisperGate Wiper Malware, Trickbot Will Now Try To Crash Researcher PCs to Stop Reverse Engineering Attempts, New DeadBolt Ransomware Targets QNAP Devices
The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: CVE-2022-21882, DazzleSpy , DeadBolt, DTPacker, Trickbot, and WhisperGate. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 – IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
Windows Vulnerability With New Public Exploits Lets You Become Admin
(published: January 29, 2022)
A new vulnerability, tracked as CVE-2022-21882 was discovered by researcher RyeLv in early January 2022. The exploit is a bypass to a previous vulnerability, CVE-2021-1732, and affects all Windows 10 machines that have not applied January’s Patch Tuesday patch. This vulnerability is a privilege escalation exploit, which grants administrator level privileges and allows for the creation of new admin accounts, as well as lateral movement. The exploit abuses a flaw in the manner in which the kernel handles callbacks, changing the flag ConsoleWindow. This will modify the window type, and tricks the system into thinking tagWND.WndExtra is an offset of the kernel desktop heap, thereby granting administrator level read and write access.
Analyst Comment: Apply patches when they become available to keep your systems and assets protected from the latest attacks and vulnerabilities. This is essential when new vulnerabilities are discovered as threat actors will actively attempt to exploit them. A strong patch management policy combined with an effective asset management policy will assist you in keeping your assets up to date and protected.
MITRE ATT&CK: [MITRE ATT&CK] Create Account – T1136 | [MITRE ATT&CK] Exploitation for Privilege Escalation – T1068 | [MITRE ATT&CK] Process Discovery – T1057
Tags: Windows, Priviledge escalation, CVE-2021-1732, CVE-2022-21882
Shipment-Delivery Scams Become the Favored Way to Spread Malware
(published: January 28, 2022)
Researchers at Cofense and Checkpoint have documented a series of Phishing campaigns throughout Q4 of 2021. The campaign imitates large known delivery brands such as DHL or the US postal service, and aims to abuse the trust these companies have associated with them to manipulate their targets into clicking malicious links or files. The most prominent tactic is to provide a link to a missed package, capitalizing on current global supply chain issues. Once clicked, TrickBot malware is delivered, though other campaigns are delivering as of yet non-attributed trojans. The malicious links in these campaigns are not particularly sophisticated, and are easily identified as false as they lead to domains outside the company they are targeting.
Analyst Comment: Never click on attachments or links from untrustworthy sources, and verify with the legitimate sender the integrity of these emails. Treat any email that attempts to scare, coerce, provide a time limit or force you to click links or attachments with extreme suspicion.
MITRE ATT&CK: [MITRE ATT&CK] User Execution – T1204 | [MITRE ATT&CK] Phishing – T1566
Tags: Trickbot, DHL, Phishing, Trojan
PwnKit: Local Privilege Escalation Vulnerability Discovered in Polkit’s Pkexec (CVE-2021-4034)
(published: January 27, 2022)
Qualys research team has discovered a vulnerability named CVE-2021-4034 within polkit’s pkexec, a program installed on Linux distributions by default. The vulnerability allows for root level privilege escalation as well as command execution through the introduction of insecure environment variables. With default configuration, popular distributions of Linux including Ubuntu, CentOS and Debian are all vulnerable in their default configurations.
Analyst Comment: Create and implement a patch management policy to keep systems up to date and protected when new vulnerabilities are discovered. A strong asset management policy will assist in identifying which assets are vulnerable to exploitation and patch prioritization of critical infrastructure.
MITRE ATT&CK: [MITRE ATT&CK] Command and Scripting Interpreter – T1059 | [MITRE ATT&CK] Exploitation for Privilege Escalation – T1068
Tags: CVE-2021-4034, PwnKit, pkexe, Privilege escalation, Linux
DazzleSpy: Pro-democracy org Hijacked to Become MacOS Spyware Distributor
(published: January 26, 2022)
A new macOS malware dubbed DazzleSpy has been discovered by ESET researchers and Google Threat Analysis Group. The malware leveraged a watering hole attack focused on pro-democracy websites and media outlets regarding Hong Kong. Initial infection utilized a XNU privilege escalation vulnerability on macOS Catalina now tracked as CVE-2021-30869, which resulted in backdoor malware execution. These exploits were executed by malicious code delivered via iframes from a radio station website between 30th September and 4th November 2021. After successful exploitation, DazzleSpy gains read and write permissions, which then allows it to perform a variety of functions including executing shell commands, launching remote sessions, downloading files and enumerating files.
Analyst Comment: Never click on links that are untrustworthy, always verify their legitimacy. Apply all patches that are released by vendors to mitigate against vulnerabilities. Collect logs from various sources including command line history to identify potential malicious activity.
MITRE ATT&CK: [MITRE ATT&CK] User Execution – T1204 | [MITRE ATT&CK] Exploitation for Privilege Escalation – T1068 | [MITRE ATT&CK] Phishing – T1566
Tags: DazzleSpy, Hong Kong, Watering hole, Backdoor, CVE-2021-30869
Trickbot Will Now Try to Crash Researcher PCs to stop Reverse Engineering Attempts
(published: January 26, 2022)
IBM Truster Researchers have documented a series of upgrades to the modular Trickbot malware that assist in detection avoidance and anti-reverse engineering. The malware utilizes a Javascript loader to facilitate server-side injection that grants greater real time control over malware delivery. A new anti-reverse engineering technique has been employed that crashes computers analyzing the malware. If researchers attempt to beautify code, a Trickbot RegEx will detect it and trigger a loop that will increase it’s dynamic array size recursively. This will overload the computer’s memory and crash it.
Analyst Comment: Centralizing log collection within a SIEM will assist in monitoring outbound connections to identify anomalous activity that could be potential C2 connections. Anomali Match and Threatstream can assist in investigating malicious activity and can check your logs against known indicators of compromise.
MITRE ATT&CK: [MITRE ATT&CK] Data Obfuscation – T1001 | [MITRE ATT&CK] Virtualization/Sandbox Evasion – T1497
Tags: Trickbot, HTTPS, Javascript, Detection avoidance, anti-reverse engineering
New DeadBolt Ransomware Targets QNAP Devices, Asks 50 BTC for Master Key
(published: January 26, 2022)
Taiwanese company QNAP was victim to a series of ransomware attacks that began on 25th January. The ransomware, identified as DeadBolt and operated by the threat group DeadBolt Gang, claimed that a zero day exploit was utilized to gain access to internet facing systems. The ransom notes left in the form of a hijacked login page, demands 0.03 Bitcoin ($1100 USD) to decrypt an individual machine, 5 Bitcoins ($184,000) for information regarding the zero day exploit and 50 Bitcoins ($1.85 million) for the master decryption key for all affected systems. The master key payment is to be paid to the crypto wallet address of bc1qnju697uc83w5u3ykw7luujzupfyf82t6trlnd8. Unusually for a ransomware attack, the threat actors refuse to communicate or provide a means of contact.
Analyst Comment: Always maintain a comprehensive backup plan that can be used to restore access to critical systems and files in the event of an attack. Priority should then be placed upon mitigation of the means of access the threat actors used to gain access to the system, to prevent further exploitation.
MITRE ATT&CK: [MITRE ATT&CK] Exploit Public-Facing Application – T1190 | [MITRE ATT&CK] Data Encrypted for Impact – T1486 | [MITRE ATT&CK] Defacement – T1491
Tags: DeadBolt, Ransomware, Zero day, QNAP
Weaponization of Excel Add-Ins Part 1: Malicious XLL Files and Agent Tesla Case Studies
(published: January 25, 2022)
Unit 42 researchers have discovered a significant surge in Agent Tesla and Dridex malware between 27th July and 1st December 2021, with both being dropped by malicious Excel add-ins. The initial infection vector began with a phishing email, with recipients receiving either a malicious XLL file or a XLM file as an attachment. If an XLL was attached, an intermediate dropper is received that downloads Agent Tesla and Dridex from Discord. If a XLM attachment, a VBS downloader is instead dropped which in turn downloads Dridex hosted on Discord.
Analyst Comment: Never open links or attachments from unknown sources and delete any suspicious emails. Office file attachments and Macro enabled files are common infection vectors and should be treated with extreme suspicion. Ensure that credentials are stored safely via defense in depth to mitigate against credential theft.
MITRE ATT&CK: [MITRE ATT&CK] Phishing – T1566 | [MITRE ATT&CK] User Execution – T1204
Tags: Dridex, Agent Tesla, XLL, XLM, Phishing
Segway Store Compromised with Magecart Skimmer
(published: January 24, 2022)
Malwarebytes researchers recently discovered that the Segway company website was potentially compromised by a Magecart skimmer. A connection to a malicious domain was uncovered, one that has been active since November 2021 and connected to the Ant and Cockroach campaign, though the compromise has been dated back to early January 2021. The skimmer is dynamically loaded via JavaScript code disguised as a Copyright statement, with the skimmer itself being embedded within a favicon.ico file. The image is preserved, however a hex editor reveals the modification. Many countries have been exposed to the skimmer, including the USA, Australia and Canada.
Analyst Comment: Monitor network traffic to identify any unusual domains that are being connected too. Anomali Threatstream can assist in investigations into threat actors and their associated domains, malware and C2 servers. Maintain a defense in depth approach to minimize data exfiltration.
MITRE ATT&CK: [MITRE ATT&CK] Exfiltration Over C2 Channel – T1041 | [MITRE ATT&CK] Automated Collection – T1119 | [MITRE ATT&CK] Data Obfuscation – T1001
Tags: Magecart Group 12, Magecart, Skimmer, Segway, USA, Australia, UK
Unusual ‘Donald Trump’ Packer Malware Delivers RATs, Infostealers
(published: January 24, 2022)
A .NET malware packer named DTPacker has seen a resurgence in popularity as of late 2021, as noted by Proofpoint researchers. Tracking the packer since 2020, researchers have documented the functionality of DTPacker, with the ultimate goal of the packer to deliver Agent Tesla, although Ave Maria, AsyncRAT and Formbook have also been spread. DTPacker is noticeable for having dual functionality It can function as both a packer that contains its own payloads, and also as a downloader to fetch payloads from a command and control server. The downloader portion of the malware contains its namesake, with a hardcoded password referencing Donald Trump.
Analyst Comment: Monitor network traffic for unusual or unauthenticated outbound connections, which may indicate a C2 connection. Anomali Match can assist in identifying any C2 indicators of compromise within your network. Studying computer resource usage can help detect the presence of spyware that is abusing those resources.
MITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information – T1027 | [MITRE ATT&CK] Exfiltration Over C2 Channel – T1041
Tags: Spyware, Agent Tesla, Formbook, Ave Maria, AsyncRAT, packer, DTPacker, downloader
Researchers Break Down WhisperGate Wiper Malware Used in Ukraine Website Defacement
(published: January 24, 2022)
A new malware, dubbed WhisperGate, was observed targeting domains owned by the Ukrainian government in early January 2022. The targeting resulted in the defacement of 70 of government-owned websites, with an additional 10 suffering interference. Cisco Talos has alleged that stolen credentials were used for the initial infection. Microsoft has released it’s analysis of the malware detailing it’s execution cycle. It first attempts to delete the master boot record with one of it’s wipers, before downloading some code and using a hardcoded downloader to retrieve a DLL. The DLL is a dropper obfuscated with Eazfuscator that executes a VBscript to disrupt Windows Defender and execute another wiper, targeting fixed and remote logical drives. This cyberattack compromised two Ukrainian government websites at a time where there is an increased tensions with Russia due to troop amassment at the countries shared border. This suggests geopolitical intent and potential state-sponsored actors. WhisperGate invites comparison to NotPetya, sharing it’s destructive capabilities and camouflage as ransomware though no link is yet established between the two.
Analyst Comment: Enforce a strong password policy to maintain the strength of credential defenses. Adopting a defense in depth approach to security will mitigate the harm caused during a stolen credential attack. Monitoring network traffic will assist in identifying anomalous activity within your network.
MITRE ATT&CK: [MITRE ATT&CK] Valid Accounts – T1078 | [MITRE ATT&CK] Impair Defenses – T1562 | [MITRE ATT&CK] Data Destruction – T1485
Tags: NotPetya, WhisperGate, Ukraine, Russia, Defacement, Windows Defender, VBscript, Eazfuscator
Scammers are Creating New Fraudulent Crypto Tokens and Misconfiguring Smart Contracts to Steal Funds
(published: January 24, 2022)
Check Point Research have documented recent techniques threat actors utilize to steal Crypto wallet funds through the abuse of smart contracts functions after initial access through Phishing campaigns. Smart contracts charge not the owner of the contract, but the one who executes it’s commands, in addition to being able view the code for executed functions. Thus, actors that have access to the contract can inject new functions into the contracts that charge users for their use, or modify the charge cost of a function and then return it to it’s default value after the money has been charged. Furthermore, compromised smart contracts can be abused to set permissions as to who can sell tokens, as well as create new tokens to sell or “burn” tokens, destroying them to inflate the price.
Analyst Comment: Care should be taken when exposing crypto wallets. Consider only using trusted marketplaces. Only use smart contract technology that is secure. Take all precautions when dealing with potential Phishing attacks, never click links or open attachments from untrustworthy sources.
MITRE ATT&CK: [MITRE ATT&CK] Phishing – T1566 | [MITRE ATT&CK] Exploit Public-Facing Application – T1190 | [MITRE ATT&CK] Hide Artifacts – T1564
Tags: Cryptocurrency, Phishing, Smart Contracts, EVM, Blockchain
