News

From Search Results to Malware Lures: SEO Poisoning

As search engines became the first point of contact for internet, threat actors are leveraging it for their advantage to spread malware using SEO Poisoning. Loopholes and vulnerabilities in SEO algorithms are used to improve ranking of fake or compromised websites to deceive search engines and unsuspecting users. Malvertising are also used to trick users into these websites.

What is SEO?

SEO, or Search Engine Optimization, is like the secret sauce for getting noticed online. It’s all about making your website show up higher in search results, so more people can find you when they’re looking for what you offer. Think of it as giving your online presence a boost so that you stand out in the crowd. You tweak your website’s content, structure, and technical bits to make search engines love it, which means more folks stumble upon your corner of the internet. It’s like waving a big, flashy sign that says, “Hey, come check me out!” SEO is the key to getting your voice heard amidst the noise of the internet, helping you connect with the right people at the right time.

SEO Poisoning

SEO poisoning is like a digital trap set by cyber tricksters, waiting for unsuspecting users to stumble into it. Picture yourself scrolling through search results, looking for answers or cool stuff online. You click on what seems like a legit link, expecting to find what you’re after—a great blog, a handy tutorial, or maybe a sweet deal. But instead of landing where you wanted, you’re whisked away to a sketchy website, like a back alley in the internet world.How

How it Works

Exploiting Hot Keywords: Malicious actors identify popular keywords and sneak them into compromised web pages. When users search for these terms, they get directed to malicious sites instead of the legitimate ones they’re expecting.
Compromising Legitimate Sites: Threat actors exploit vulnerabilities in websites, like outdated software or missing security measures, to insert malicious code or links. These unsuspecting sites then become unwitting vehicles for spreading malware to innocent visitors.
Cloaking Techniques: SEO poisoners use cloaking to show search engines one thing while displaying something else to users. This deceitful tactic lets them manipulate search rankings while keeping their malicious activities hidden.
Phishing and Malware Distribution: Once users land on these rogue websites, they might encounter phishing scams, bogus software downloads, or malware-laden content. The aim? To steal personal info, install malware on devices, or hijack browsers for further exploitation.

Recent Cyber Attacks that weaponized SEO Poisoning

SEO Poisoning to Domain Control: In this article by DFIR Report, SEO Poisoning was used for Gootloader infection. The Gootloader deployed Cobalt strike beacons to the registry of the infected machine and executed it in memory. The attacker also gained RDP access to the system and compromised domain controllers.
SEO#LURKER Attack Campaign: WinSCP lures were used to trick the users to download the infected software. It installed the malware along with the legitimate WinSCP. Winscp is an open source file manger software which is very popular among IT administrators. Given below is the attack chain

SEO Poisoning: SEO#LURKER attack chain example — SEO#LURKER attack chain example(securonix)

Detect and Stop

Be Cautious with Search Results: When searching for information online, be cautious of search results. Be careful when it is too good to be true. Beware of unfamiliar websites that appear at the top of the list. Stick to reputable websites and sources you trust.
Verify Website Authenticity: Pay attention to the website’s domain name and URL. Make sure it matches the legitimate source you intended to visit. Be cautious of misspelled URLs or slight variations that may indicate a phishing scam or spoofed website.
Watch Out for Suspicious Pop-ups: If you encounter unexpected pop-up windows or advertisements while browsing the web, proceed with caution. Close any suspicious pop-ups immediately to avoid potential malware infections.
Use Security Software: Install reputable antivirus and antimalware software on your devices. This will detect and block malicious threats, including those spread through SEO poisoning. Keep your security software up to date and perform regular scans to identify and remove any malware infections.

News Threat Intel

Qakbot: The Evil Duck Reappears

Dec 29, 2023

Qakbot malware also known as Qbot has remained a persistent and formidable adversary since mid-2000s, it emerged as a banking Trojan. It has evolved and adapted itself against cyber defences to remain in the list of top malwares over a decade.

The Genesis of Qakbot

First identified in 2008, Qakbot was designed to steal financial data and confidential information from compromised system. Earlier versions used key-logging and web traffic analysis to get hold of these sensitive data. It’s also known as Pinkslipbot. It is a second stage malware which requires an initial access technique like phishing as a first stage .

Infrastructure

Qakbot uses a layered infrastructure for its Command and Control servers. Threat actors typically host these servers through providers who lease them out; consequently, these providers generally avoid cooperating with law enforcement agencies to shut them down. The graph below depicts the malware’s C2 structure. Tier1 nodes represent a subset of infected systems chosen as supernodes to establish communication with victim computers. Supernodes had it’s presence in 63 countries. The intermediary nodes acts as proxies between the main C2 server and the infected machines to cover the tracks.

Qakbot malware — Qakbot C2 Server Tires (CISA)

Evolutionary Phases

Over the years, the malware has undergone several evolutionary phases, showcasing its adaptability and resilience to security measures. It evolved from a basic banking Trojan to a multifunctional threat capable of employing various attack vectors, including exploit kits, phishing emails, and lateral movement within networks. One significant evolutionary leap involved the integration of worm-like capabilities, enabling Qakbot to propagate across networks swiftly. It utilized brute force techniques to spread laterally, infecting interconnected devices and networks, amplifying its impact and complicating mitigation efforts.

Ransomware Gangs using Qakbot

Various financially motivated ransomware groups are known to utilize Qakbot as an infection vector. These list includes Conti, ProLock, Egregor, REvil, MegaCortex, Black Basta, Royal.

FBI-Led Law Agencies takes down Qakbot

In August 2023, FBI in collaboration with other Law enforcement agencies were able to take down the infrastructure of Qakbot and seize bitcoins worth about $8.6 million. The operation identified over 700,000 infected machines with the malware, of which 200,000 were in the US. Redirecting the malicious traffic to a controlled environment facilitated taking down the malware network, instructing the infected machines to download an uninstaller.

Qakbot Returns

About 3 months after the take down in December 2023, Microsoft Threat intelligence reported phishing campaigns connected to Qakbot. On it’s return the primary targets were hospitality sector. The phishing email was masquerading IRS as shown in the image below.

Qakbot Phishing Email (Microsoft)

Conclusion

Qakbot has been around for a long time and it’s roots are strong. Cyber criminals from Eastern European operates it. According to a report published by Checkpoint, Qakbot was the most prevalent malware in multiple regions globally.

Top Malware Groups (Checkpoint)

The Maware targeted multiple sectors.

Impacted Sectors (Checkpoint)

Although the infrastructure has been taken down, the individuals responsible for the malware and their connections continue to persist. They will learn their lessons and make a comeback. As cybercriminals grow stronger, the security solutions also advance. Therefore, prepare for such attacks by implementing and maintaining robust security measures.

News Threat Intel

LockBit 3.0 and Citrix Bleed Vulnerability (CVE-2023-4966)

Nov 25, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) issued an important advisory. It focuses on LockBit 3.0 ransomware. This ransomware exploits the CVE-2023-4966 vulnerability, also known as Citrix Bleed. LockBit 3.0 targets various critical sectors. It uses Citrix Bleed to bypass multifactor authentication (MFA). This vulnerability is in Citrix NetScaler ADC and Gateway appliances.

Citrix Bleed vulnerability is exploited by affiliates of LockBit 3.0. This vulnerability enables attackers to circumvent password protocols and multifactor authentication (MFA). As a result, they can hijack legitimate user sessions on Citrix NetScaler ADC and Gateway systems. By gaining control of these sessions, the attackers obtain higher access levels, allowing them to gather credentials, navigate across the network, and access various data and resources.

Affected Citrix NetScaler Versions

NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
NetScaler ADC and NetScaler Gateway version 12.1 (EOL)
NetScaler ADC 13.1FIPS before 13.1-37.163
NetScaler ADC 12.1-FIPS before 12.1-55.300
NetScaler ADC 12.1-NDcPP before 12.1-55.300

Indicators of Compromise (IOC)

IP Addresses

192.229.221[.]95: Calls out to this IP address are made by Mag.dll. It ties back to dns0.org.
193.201.9[.]224: An FTP to this Russian geolocated IP from a compromised system.
62.233.50[.]25: Another Russian geolocated IP.
51.91.79[.]17: Associated with Temp.sh IP.
70.37.82[.]20: Seen from a known compromised account reaching out to an Altera IP address.
185.17.40[.]178: Teamviewer LockBit C2, linked to a Polish service provider.
172.67.129[.]176 and 104.21.1[.]180: Used to download obfuscated toolsets

Tools

Remote Administration : Teamviewer, AnyDesk, Splashtop.

Network Scanning and Command Execution: Plink.exe, Netscan.exe.

PowerShell Scripts:123.ps1

Persistence Mechanism

Scheduled Tasks: \MEGA\MEGAcmd, UpdateAdobeTask

MITRE ATT&CK Tactics AND Techniques

Technique ID	Technique Name	Use
T1082	System Information Discovery	Threat actors will attempt to obtain information about the operating system and hardware, including versions, and patches.
T1556.006	Modify Authentication Process: Multi-Factor Authentication	Threat actors leverage vulnerabilities found within CVE- to compromise, modify, and/or bypass multifactor authentication to hijack user sessions, harvest credentials, and move laterally, which enables persistent access.
T1539	Steal Web Session Cookie	Threat actors with access to valid cookies can establish an authenticated session within the NetScaler appliance without a username, password, or access to multifactor authentication (MFA) tokens.

More actionable intelligence can be obtained from the Alienvault OTX Pulse.

News

Microsoft’s November 2023 Patch:Confronts Five Zero-Day Threats

Nov 15, 2023

The November 2023 Microsoft Patch Tuesday addressed several critical vulnerabilities, it addressed 75 vulnerabilities, with a focus on various critical areas. Three were rated critical, with one being an elevation of privilege in the Windows Common Log File System Driver, allowing attackers to elevate their system privileges. Another critical issue was a remote code execution vulnerability in Microsoft SharePoint, where an authenticated attacker could create a site and remotely execute code. Microsoft Exchange Server also had a remote code execution vulnerability, potentially allowing authenticated users with LAN access to perform remote code execution on the server mailbox back-end as NT AUTHORITY\SYSTEM.

Zero-day vulnerabilities

CVE-2023-36025: A Windows SmartScreen security feature bypass vulnerability that could be exploited via a specially crafted Internet Shortcut or hyperlink.

CVE-2023-36033: An elevation of privilege vulnerability in the Windows DWM Core Library

CVE-2023-36028: A critical remote code execution flaw

CVE-2023-36397: Another critical remote code execution vulnerability

CVE-2023-38545: A critical heap-based buffer overflow in the curl library.

Other Vulnerabilities

Here are some important CVEs other than the zero-days, addressed in the November 2023 Patch Tuesday

Elevation of Privilege Vulnerability:
- CVE-2023-36036: Windows Cloud Files Mini Filter Driver
- CVE-2023-36400: Windows HMAC Key Derivation
- CVE-2023-36399: Windows Storage
Remote Code Execution Vulnerability:
- CVE-2023-36397: Windows Pragmatic General Multicast (PGM)
- CVE-2023-38177: Microsoft SharePoint Server
- CVE-2023-36439: Microsoft Exchange Server
Information Disclosure Vulnerability:
- CVE-2023-36052: Azure CLI REST Command
Denial of Service Vulnerability:
- CVE-2023-36038: ASP.NET Core
Security Feature Bypass Vulnerability:
- CVE-2023-36025: Windows SmartScreen

In conclusion, Microsoft’s November 2023 Patch Tuesday was a robust response to a diverse set of vulnerabilities threatening the cybersecurity landscape. By addressing five zero-day vulnerabilities, along with a spectrum of other critical security flaws ranging from remote code execution to privilege elevation, Microsoft has taken decisive action to fortify its software against potential cyber-attacks.

News

Cybersecurity News: Nov 5-Nov 11

Nov 14, 2023

The cybersecurity landscape from the week of November 5 to November 11, 2023, was marked by several significant events:

Boeing Data Breach by Lockbit: Boeing, a major defense and space contractor, experienced a data breach. Internal data from the company was published online by the cybercrime gang Lockbit. This incident highlights the ongoing threat posed by cybercrime groups to significant corporate and governmental entities.

NIST SP 800-53 Release 5.1.1 Update: The National Institute of Standards and Technology (NIST) issued SP 800-53 Release 5.1.1, an update concerning cybersecurity and privacy controls. This release provides organizations using SP 800-53r5 (Revision 5) the option to defer implementing the changes in this patch release until the release of SP 800-53 Release 6.0.0. This update is critical for maintaining the integrity and

DP World Australia’s port operations hit by cyber attack:Global ports operator DP WorldAustralia has restricted access to its ports as it works to contain a cyber security incident that is likely to disrupt the movement of goods for days. DP World Australia, part of Dubai’s state-owned ports giant DP World, operates four container terminals in Australia in Melbourne, Sydney, Brisbane and in Fremantle, Western Australia

Cerber Ransomware Exploits Atlassian Confluence Vulnerability CVE-2023-22518: On October 31, 2023, Atlassian published an advisory on CVE-2023-22518, an Improper authorization vulnerability involving the Confluence Data Center and Server. nitially reported to cause data loss, it was eventually revealed that exploiting this vulnerability allows unauthorized users to reset and create a Confluence instance administrator account, allowing them to perform all admin privileges available to these accounts.

Learning News

Unveiling CVSS v4.0: Updated Vulnerability Scoring

Nov 4, 2023

The Common Vulnerability Scoring System (CVSS) serves as a widely-adopted standard for detailing and ranking the severity of security weaknesses in software1. With the introduction of its fourth iteration, CVSS v4.0, it marks a significant evolution in the system, arriving eight years after its predecessor, version 3.03, courtesy of the Forum of Incident Response and Security Teams (FIRST).

The CVSS Framework: An Overview

The CVSS framework is designed to provide an open and standardized method for rating IT vulnerabilities. It enables IT professionals to prioritize the vulnerability management process by calculating the severity of vulnerabilities in their systems. CVSS scores are typically presented as numerical indicators ranging from 0 to 10, with ten being the most severe. They can be further refined into severity ratings such as Low, Medium, High, and Critical, offering an at-a-glance understanding of a vulnerability’s potential impact.

Why CVSS Matters in Cybersecurity

Prioritization of Threats: CVSS helps organizations prioritize security threats based on their severity, enabling them to allocate resources and attention where it’s needed most.
Consistent and Clear Communication: With a standardized scoring system, CVSS facilitates clear and consistent communication regarding vulnerabilities across different teams and stakeholders.
Informed Decision-Making: CVSS scores inform decision-making regarding patch management, security updates, and system upgrades, fostering proactive cybersecurity practices.

A Leap Forward: What’s New in CVSS v4?

CVSS v4 is not just an update; it’s a comprehensive overhaul designed with current cybersecurity landscapes in mind. It introduces enhancements in several key areas:

Granular Metrics: One of the most notable changes is the addition of more nuanced metrics that allow for a finer-grained analysis of vulnerabilities. This change acknowledges that the digital ecosystem has become more complex, and a one-size-fits-all approach to scoring is no longer viable.
Environmental Scores: While previous versions of CVSS included environmental metrics, v4 provides a more tailored approach, considering the unique aspects of each user’s environment. This means that the same vulnerability might have different scores in different contexts, reflecting its actual risk more accurately.
User Interaction: CVSS v4 places greater emphasis on the necessity of user interaction in exploiting a vulnerability. This shift acknowledges that vulnerabilities requiring user action are less likely to be exploited than those that can be executed remotely.
Temporal Metrics: The temporal metrics in v4 are refined to better reflect the changing nature of vulnerabilities over time. This includes how the availability of exploits, patches, and the understanding of a vulnerability can alter its score as time progresses.

Challenges and Considerations

While CVSS v4 brings many improvements, it also comes with challenges:

Complexity: With the added granularity comes increased complexity. Organizations will need to invest time and training to ensure that their teams can effectively utilize the new system.
Transition: Transitioning from CVSS v3 to v4 could be challenging, especially for organizations with extensive vulnerability management practices already in place. This change will require a recalibration of systems and a reassessment of previously scored vulnerabilities.

Conclusion: Embracing Change for a Safer Future

CVSS v4 represents a significant step forward in the quest for a secure cyber world. By providing a more detailed and context-aware system, it enables a deeper understanding of vulnerabilities and their potential impact. As organizations across the globe adopt this new standard, the learning curve will be steep, but the payoff in terms of improved security posture will be substantial. The journey towards adopting CVSS v4 will be a collaborative effort, requiring input and adaptation from all corners of the cybersecurity community. A self paced training is provided by first.org on CVSS, It describes the standard in a manner that does not presume any previous knowledge of CVSS.

News Threat Intel

StripedFly:Malware Hidden as a Cryptominer

Oct 30, 2023

StripedFly malware is a highly sophisticated and stealthy maware that has been in operation since at least 2017, affecting over a million victims globally. Initially masquerading as a cryptocurrency miner, deeper analysis unveiled its multifaceted capabilities extending far beyond cryptocurrency mining. Here are the key aspects of StripedFly malware based on various reports and additional insights.

Architecture

Based on the report published by Kaspersky, StripedFly operates as a monolithic binary executable with pluggable modules. This design allows for operational versatility often found in Advanced Persistent Threat (APT) operations. The modular nature of StripedFly enables the addition of various functionalities without altering the core structure of the malware, making it a flexible and adaptable threat.

StripedFly Windows execution flow (Kaspersky)

Evolution

Initially functioning as a cryptocurrency miner, StripedFly was later discovered to have a complex, multifunctional wormable framework. This framework enables the malware to function as an APT, a crypto miner, and potentially even as a ransomware group, indicating a possible evolution in motives from financial gain to espionage over time.

Impact

StripedFly has had a significant impact with a global reach, affecting over a million Windows and Linux computers worldwide since 2016 or 2017. This global reach illustrates the significant threat posed by StripedFly to both individual and organizational cybersecurity, transcending geographical and platform boundaries.

Modus Operandi

StripedFly harvests credentials every two hours, collecting a range of sensitive data including site and WiFi login credentials, and personal information. It can capture screenshots, exert significant control over infected machines, and even record microphone input without detection, underlining its invasive and persistent nature.

Infection Vector

The initial infection vector was uncovered as a custom-made EternalBlue ‘SMBv1′ exploit used to infiltrate victims’ systems. Despite the public disclosure of the EternalBlue vulnerability in 2017 and the subsequent release of a patch by Microsoft, many users failed to update their systems, leaving a significant number of computers vulnerable to StripedFly exploitation.

Discovery and Analysis

StripedFly’s sophisticated nature allowed it to evade detection for a prolonged period, being misclassified as a mere cryptocurrency miner. The extensive analysis conducted by cybersecurity researchers unveiled the remarkable effort invested in creating this malicious framework and highlighted the necessity for continuous research and vigilance in the cybersecurity domain.

Cross-Platform Nature

StripedFly is identified as a cross-platform malware capable of infecting both Windows and Linux systems. Its cross-platform nature broadens the scope of potential victims and presents a challenge for cybersecurity measures across different operating environments .

Attack Mitre Techniques

Att&ck IDs

T1210 – Exploitation of Remote Services

T1564 – Hide Artifacts

TA0004 – Privilege Escalation

T1053 – Scheduled Task/Job

T1060 – Registry Run Keys / Startup Folder

T1094 – Custom Command and Control Protocol

T1573 – Encrypted Channel

Alientvault OTX Pulse

Virustoatal Analysis