Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Infostealer. Show all posts
User Safety
Cracked Software Infostealer Malicious Apps malware User Safety

Beware of Malicious YouTube Channels Propagating Lumma Stealer

 

Attackers have been propagating a Lumma Stealer variant via YouTube channels that post videos about cracking into popular applications. They prevent detection by Web filters by spreading the malware over open source platforms like MediaFire and GitHub rather than proprietary malicious servers. 

The effort, according to FortiGuard researchers, is reminiscent of an attack that was uncovered in March of last year and employed artificial intelligence (AI) to disseminate step-by-step installation manuals for programmes like Photoshop, Autodesk 3ds Max, AutoCAD, and others without a licence. 

"These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL and Cuttly," Cara Lin, Fortinet senior analyst, wrote in a blog post. 

Modus operandi 

The attack begins with a hacker infiltrating a YouTube account and publishing videos pretending to offer cracked software tips, along with video descriptions carrying malicious URLs. The descriptions also lure users to download a.ZIP file containing malicious content. 

The videos identified by Fortinet were uploaded earlier this year; however, the files on the file-sharing site are regularly updated, and the number of downloads continues to rise, suggesting that the campaign is reaching victims. "This indicates that the ZIP file is always new and that this method effectively spreads malware," Lin stated in a blog post. 

The .ZIP file contains an.LNK file that instructs PowerShell to download a.NET execution file from John1323456's GitHub project "New". The other two repositories, "LNK" and "LNK-Ex," both contain .NET loaders and use Lumma as the final payload.

"The crafted installation .ZIP file serves as an effective bait to deliver the payload, exploiting the user's intention to install the application and prompting them to click the installation file without hesitation," Lin wrote.

The .NET loader is disguised with SmartAssembly, a valid obfuscation technique. The loader then acquires the system's environment value and, after the number of data is correct, loads the PowerShell script. Otherwise, the procedure will depart the programme.

YouTube malware evasion and caution

The malware is designed to prevent detection. The ProcessStartInfo object starts the PowerShell process, which eventually calls a DLL file for the following stage of the attack, which analyses the environment using various methods to avoid detection. The technique entails looking for debuggers, security appliances or sandboxes, virtual machines, and other services or files that could impede a malicious process. 

"After completing all environment checks, the program decrypts the resource data and invokes the 'SuspendThread; function," Lin added. "This function is employed to transition the thread into a 'suspended' state, a crucial step in the process of payload injection.” 

Once launched, Lumma communicates with the command-and-control server (C2) and establishes a connection to transfer compressed stolen data back to the attackers. Lin observed that the variation employed in the campaign is version 4.0, but its exfiltration has been upgraded to use HTTPS to better elude detection. 

On the other hand, infection is trackable. In the publication, Fortinet provided users with a list of indications of compromise (IoCs) and cautionary advice regarding "unclear application sources." According to Fortinet, users should make sure that any applications they download from YouTube or any other platform are from reliable and safe sources.
Read more »
User Safety
Cyber Crime Illicit Activity Infostealer Travel Company User Privacy User Safety

New Study Reveals Airbnb as a Haven for Cybercrime

 

Cybercriminals have been increasingly using the Airbnb network for illicit activities. A new research by cybersecurity experts at SlashNext uncovered the methods employed by these malicious actors to hack user accounts and benefit from stolen data. 

Due to its global ubiquity and reputation to offer travellers with affordable lodging, Airbnb—a household name in the travel industry—has become a prime target. SlashNext clarified, however, that because of this accessibility, cybercriminals have been able to take advantage of the system and exploit it for their own purposes.

Stealers are at the heart of these cyber-attacks, infiltrating devices and accumulating sensitive information such as login credentials. This stolen data is subsequently sent to the attackers, allowing them to gain unauthorised access to user accounts. The research sheds light on the numerous access points employed by cybercriminals, ranging from software flaws to social engineering techniques.

The study also uncovered an underground marketplace where cybercriminals buy and sell bulk access to hacked devices (also known as bots, installs, or infections). This enables thieves to rapidly deploy malicious software on a large scale, broadening the scope of their attacks.

Session cookies play a crucial role among the strategies used by cybercriminals to obtain unauthorised access to user accounts. These tiny files, which frequently provide momentary website access, record browsing habits and user preferences. 

Cybercriminals acquire stolen Airbnb account cookies from darknet marketplaces, enabling them to get access without having to use legitimate usernames and passwords. Even though they are brief in length, attackers quickly take advantage of these stolen access opportunities. 

The investigation also shows how the stolen data was sold. Online forums and digital marketplaces are used by cybercriminals to sell stolen cookies and compromised account information to interested parties. Each compromised Airbnb account apparently has had its value reduced to as little as one dollar due to the scope of the account theft. 

This research emphasises how crucial it is to comprehend the constantly evolving tactics used by cybercriminals as well as the weaknesses they prey upon. It serves as a reminder that even well-known services like Airbnb might include unreported dangers, mandating more user knowledge and proactive security measures.
Read more »
malware
Credential Theft Data Leak Hacker Forum Infostealer malware

Infostealer Malware Exposes Over 100K Accounts From Hacking Forums

 

Security experts identified over 140,000 compromised passwords linked to accounts on hacker forums after their owners were infected with data-stealing malware.

Hudson Rock searched its cybercrime intelligence database for infected computers with credentials connected with the top 100 cybercrime sites. It discovered 120,000 identical computers, claiming that many of them belonged to hackers.

When a machine is infected with information-stealing malware, a "substantial" amount of data, including emails and account usernames, auto-fill data containing personal information such as addresses and phone numbers, and system information such as IP addresses, can be retrieved, security firm explained.

“Info-stealer infections as a cybercrime trend surged by an incredible 6000% since 2018, positioning them as the primary initial attack vector used by threat actors to infiltrate organisations and execute cyber-attacks, including ransomware, data breaches, account overtakes, and corporate espionage,” the company added.

Redline, Raccoon, and Azorult accounted for the majority of the info-stealer malware that was discovered throughout the research. The analysis found that the majority of those exposed were from Tunisia, then Malaysia, Belgium, the Netherlands, and Israel.

The cybercrime forum "Nulled.to," which was followed by "Cracked.io" and "Hackforums.net," had the most users who had been exposed to malware. 

It's interesting that the research team discovered that a large portion of the credentials used on hacking sites were more robust than those employed on government and military websites. 

“By analyzing passwords of users from the various forums, Hudson Rock determined that the forum with the strongest user passwords is Breached.to, while the one with the weakest user passwords is the Russian site Rf-cheats.ru,” the vendor concluded. 

The cybercrime underground frequently sees a high number of usernames and passwords in circulation. SpyCloud detected billions more pieces of personal information (PII) and almost 1.5 billion compromised log-in combinations online in 2021.

SpyCloud discovered that 60% of credentials for users who had multiple passwords exposed were shared across accounts, and that number rose to 87% for US.gov emails, leaving them vulnerable to brute force attacks and credential stuffing. 

Prevention tips 

Having strong, dependable antivirus software installed on your device and keeping it updated on a regular basis is the best preventative measure you can take.

You should also use antivirus software that has dark web monitoring technologies so that you'll be immediately informed if your information is compromised. You can either do this by changing your login details or by warning your friends and family to be on the lookout for scammers impersonating as you.
Read more »
Software
Artifical Intelligence ChatGPT Cyberattackers Cyberattacks CyberCrime Cybersecurity Data Breaach Infostealer Software

Corporate Data Heist: Infostealer Malware Swipes 400,000 Credentials in a Record Breach

 


Recent research has revealed that corporate credentials are being stolen alarmingly. The study revealed that over 400,000 corporate credentials were stolen by malware specialized in data theft. Approximately 20 million malware logs were examined in the study. The study was conducted on obscure platforms such as the dark web and Telegram channels that sell malware logs. Consequently, this indicates that networks are widely embraced within businesses. 

There is a simple way to explain how info stealer malware works. It infiltrates your agency's systems, snatches valuable data, and delivers it back to cybercriminals from where it originated. These miscreants can use this data to perform harmful activities or sell it on the underground cybercrime market to make profits. The dark web and Telegram channels are filled with almost 20 million information-stealing virus records. A significant number of these types of viruses are used to access information from companies. 

Cybercriminals steal data from a variety of computer platforms, including browsers, email clients, instant messengers, gaming services, cryptocurrency wallets, and FTP clients. This is to profit from their schemes. Hackers archive stolen data into "logs" before selling them on the dark web markets or reusing them for future hacks. In this study, several major families of information-stealing systems were identified including Redline, Raccoon, Titan, Aurora, and Vidar. 

With their subscription-based approach, they operate in a similar way to adware, where hackers can launch malware campaigns aiming to steal data from compromised systems through malware. In addition to targeting individuals who purchase pirated software through illegal sources, these information hackers pose a serious threat not only to individuals but also to the businesses in which they operate. It is no secret that the use of personal devices on corporate computers has resulted in countless info-stealer infections, which result in the loss of business passwords and authentication cookies due to these viruses. 

As a general rule, information thieves look to take over web browsers, email clients, operating systems, information about Internet service providers, cryptocurrency wallet credentials, and other personal information. In terms of information-stealing families, Redline, Raccoon, Titan, Aurora, and Vidar are probably the most prominent. 

To conduct malware campaigns designed to steal data from infected devices, cybercriminals are offered these families on a subscription basis. This makes it possible to run malware campaigns. While it has been found that many information thieves may primarily target careless internet users who download programs that they should not, such as cracks, warez, game cheats, and fake software, all downloaded from dubious sources, there has also been noted evidence that this behavior can negatively affect corporate environments. 

The reason for this is that employees are increasingly using personal devices and computers to access work-related stuff, which leads to many info-stealer infections that steal credentials for the business and authenticate users on the network.

In its Stealer Logs and Corporate Access report, Flare provides the following breakdown of credentials based on the insights provided by the company. 179,000 credentials for AWS Console, 42,738 for Hubspot, 2,300 credentials for Google Cloud, 23,000 Salesforce credentials, 66,000 for CRM, 64,500 for DocuSign, and 15,500 QuickBooks credentials. In addition, 48,000 logs contain access to okta.com domains. 205,447 stealer logs can also be found in Flare which contains credentials for OpenAI accounts, in addition to 17,699 stolen logs. 

Keeping conversations on ChatGPT is a high risk because by default, conversations are saved on the account, and if the account is compromised, sensitive corporate intellectual property and other data could be exposed, as Flare explains. It is unknown if any of these OpenAI credentials are similar to those that Group-IB identified in June 2023, which contained 101,134 log files that contained 26,802 compromised ChatGPT accounts. 

There were huge numbers of credentials exposed for platforms such as AWS Console, DocuSign, Salesforce, Google Cloud, QuickBooks, OpenAI, and CRM systems. These credentials were part of three different databases. There was also evidence that a large number of logs contained references to the identity management service OKTA.com, which is used for enterprise-grade user authentication within an enterprise environment. It is estimated that approximately 25% of these logs have been posted on the Russian Market channel on Telegram, over which the majority have been posted on Telegram. 

In addition to finding more than 200,000 stealer logs containing OpenAI credentials, Flame has also found more than double the amount Group-IB reported recently. These logs represent a significant risk of confidential information leakage, internal business strategies, source code, and many other forms of confidential information. It is of particular importance to note that corporate credentials are considered "tier-1" logs, which makes them extremely valuable in the underground cybercrime market, where they can be bought and sold on private Telegram channels or discussion forums such as Exploit and XSS. 

A log file is like a packaged archive of stolen information that has been packaged and protected. Data consisting of web browsers, email clients, desktop programs, and other applications used daily within your agency can be stolen from these files.  

For cybercriminals to profit from hijacking users' credentials, they must exploit those credentials to gain access to CRMs, RDP, VPNs, and SaaS applications. They must then use those credentials to deploy stealthy backdoors, ransomware, and other payloads to steal their information. As a precautionary measure, businesses should enforce password-manager usage, implement multi-factor authentication and enforce strict controls on personal devices to minimize info-stealer malware infections.

A training program should also be provided to all employees to recognize and avoid common infection channels. These include malicious YouTube videos, Facebook posts, and malicious Google Ads. The credentials stolen by anti-spyware malware are commonly referred to as digital skeleton keys - these are broadly referred to as universal access tokens which can be used to gain unauthorized access to a wide range of sensitive data stored in your organization by cyber criminals. 

To gain access to your business, they will have to use a virtual master key. This will hopefully enable them to unlock numerous areas of your business, potentially causing far-reaching and devastating damage. Sadly, cybercrime is no longer a specter looming over the horizon in today's interconnected world - it has already infiltrated systems, stolen valuable data, and left an indelible mark on businesses all across the globe thanks to its infiltration and snatching. 

Cybersecurity is both an imprudent and a potentially hazardous luxury for independent insurance agencies whose business model is based on making it as optional as possible. It is crucial to remember that ignoring this crucial aspect of your business operations will cause your agency to fall off its feet. This may even have significant financial repercussions down the road. 

Implementing comprehensive cybersecurity measures is not just a suggestion - it is an absolute necessity that must be performed. There is no question that the landscape of security is evolving, and we must evolve as well.   A strong digital asset management strategy today enables your agency to remain resilient and successful tomorrow, which is a decisive factor in its success. The value of digital fortification goes beyond merely surviving for your business, but also striving to prosper as your business lives on in an age of digital fortification becoming synonymous with its long-term survival.
Read more »
SpyCloud
cookie theft Cookies Cyber Security CyberCrime Infostealer MFA session cookies SpyCloud

Stolen Session Cookies Turns Into the Next Cyber Threat


According to the recent Identity Exposure Report by SpyCloud, 87,000 credentials linked to Fortune 1000 C-level executives were recovered from the criminal underworld, in year 2022. Security leaders across organizations continue to live in constant terror of becoming a victim of a cyberattack and for good reason.

Cybercriminals can access networks and commit crimes including fraud, session hijacking, account takeover, and attacks with ransomware using exposed assets, such as usernames and passwords. Even though companies focus on enhancing their security tactics, like adding user authentication such as multifactor authentication and passkeys, criminals too put efforts into constantly being better in their crimes to bypass these high-end security barriers. One such method used commonly by threat actors includes using stolen active session cookies to commit session hijacking, which defeats the effectiveness of the conventionally employed safeguards.

In order to better their network defense and safeguard their customers, organizations and security experts must have a better understanding of the criminals’ methodologies to commit cybercrimes, like how they utilized stolen data for their profit.

Session Cookies 

Session cookies are present all over the online space, from websites to applications that assign a cookie or token to identify their users. The series of characters used in the process is further stored on the device, making re-access easier for the user. 

While this function provides personalized and smooth experience to users, this could be harmful if the data falls into the wrong hands. Using infostealer malware, cybercriminals can exfiltrate cookies and a variety of other data types from infected computers and implant them into browsers that cannot be easily detected, giving them the ability to pose as authentic users in a process known as session hijacking.

Impersonating as a legit user, a threat actor can thus freely navigate over the network committing fraud, helping a ransomware attack, stealing important company data, and more. No matter how the user signed in—using a username and password, a passkey, or by successfully completing the multifactor authentication (MFA) requirements—a session cookie will still confirm the user's identity.

Due to its difficult-to-detect nature, low cost of acquisition (normally available online for only a few dollars online/month), and regular success in stealing cookies and other recent, high-quality data has made infostealer quality soar. 

Protecting Businesses and Their Customers

According to SpyCloud data, cookie theft by cyber thieves is already fairly frequent, with over 22 billion device and session cookie records seized by criminals last year. This entry point will expand because fraudsters are having great success accessing accounts and businesses via these cookies. For organizations trying to preserve their bottom line, having a strategy to proactively disrupt criminal operations is a vital requirement.

The recently developed malwares are difficult to be detected, considering their well-crafted designs. Common infostealers frequently leave little to no evidence of infection on the victim's device and exfiltrate sensitive data in a matter of seconds.

However, there are certain measures organizations can adopt in order to evade any risk from this malware as listed below: 

  • Educating employees about these threats has become crucial. Employees can alone reduce total malware exposure by identifying phishing attempts, exercising caution while using unmanaged or poorly maintained devices to access corporate systems and networks, not sharing passwords, and being aware of potentially harmful email attachments, websites, and downloads.
  • The risk of session hijacking is decreased by removing "remember me" settings on platform login pages and regularly eliminating browser cookies, ensuring that thieves can't access active session cookies even in the event of malware infection. 
  • Security teams can obtain a comprehensive understanding of the compromised devices and data threatening their firms by using darknet data that has been ingested, vetted, and evaluated. Teams can invalidate open session cookies, reset the exposed application information, and patch any remaining vulnerabilities with this insight. By addressing the threat of stolen data before it escalates into a full-blown security issue, this strategy lessens the harm to enterprises.  

Read more »
Window User
Data Safety Data Theft Infostealer malware User Privacy Window User

'Meduza Stealer' Malware is Preying on Windows Users For Data Theft

 

If you are reading this on a Windows device, be on alert for potentially harmful new malware that has been affecting web browsers, password managers, and even cryptocurrency wallets. 

A team of Uptycs cybersecurity professionals found this infostealer, naming it Meduza Stealer, and indicated that it can lead to widespread data theft if all factors are analysed and taken into account. 

The Meduza Stealer may compromise virtually all security-enhancing methods and platforms, including two-factor authentication, extensions for crypto wallets, and the all-important password managers. With that out of the way, it is crucial to emphasise that this information stealer is very tough to detect.

"Crafted by an enigmatic actor known as 'Meduza,' this malware has been specifically designed to target Windows users and organisations, currently sparing only ten specific countries from its reach," researchers explained. 

If the infostealer's connection to the malicious actor's server is lost, it will quickly eliminate itself in its entirety. Furthermore, it appears that the Meduza Stealer terminates itself if it arrives at a device or system located within specific countries. 

Such an action is noteworthy since it could potentially indicate that these countries are being safeguarded by bad actors. Turkmenistan and the Commonwealth of Independent States are all excluded from this infostealer, lending validity to the assumption that threat actors may hail from these countries. 

Purchasing this infotealer is likewise really simple. It is available through Telegram, and a lifetime subscription costs roughly $1,199. Monthly subscriptions can cost as much as $199 per month, confirming that the malware as a service sector is booming at the expense of cybersecurity worldwide. 

It will be interesting to observe how security experts deal with this new infostealer, as it has the potential to cause massive disruption. The potential for harm is so great that the Meduza Stealer could set off a chain reaction that makes it easier to steal finances and log in credentials on the internet. 

Uptycs advises that you use strong passwords, be cautious when downloading files, frequently update your computer and any software, and stay away from strange browser extensions in order to prevent falling victim to The Meduza Stealer malware.
Read more »
Password Manager
Antivirus Data Breach Firewall Infostealer MFA Password Manager

Meduza Stealer Targets Password Managers

 


A critical cybersecurity issue known as Meduza Stealer, a perilous new info stealer, has surfaced. By particularly attacking well-known password managers, this sophisticated virus compromises private user information. Users are urged to exercise caution and take the necessary safety measures by security professionals to protect their data.
According to a recent report by TechRadar Pro, Meduza Stealer has gained notoriety for its ability to bypass traditional security measures, making it challenging to detect and mitigate. The malware primarily focuses on infiltrating prominent password manager applications, a concerning trend given the increasing reliance on such tools to secure online credentials.

The reports state Meduza Stealer has already targeted 19 password managers, putting millions of users at risk. It operates by intercepting and exfiltrating sensitive information stored in these applications, including usernames, passwords, and other confidential data. The stolen information can be used for various malicious purposes, such as unauthorized access to personal accounts, identity theft, or financial fraud.

Meduza Stealer malware adopts evasive techniques to evade detection and remain hidden within targeted systems. Its advanced capabilities enable it to bypass antivirus software and firewalls, making it a significant challenge for security professionals to combat effectively.

Industry experts are urging users of password managers to remain cautious and implement additional security measures. Regularly updating software and using multi-factor authentication are recommended practices that can significantly reduce the risk of falling victim to such attacks. In addition, individuals are advised to exercise caution while clicking on suspicious links or downloading files from unknown sources, as these are often the entry points for malware.

Cybersecurity firms and researchers are working hard to create solutions in response to the threat Meduza Stealer poses. To remain ahead of such new threats, close cooperation between software developers, security professionals, and end users is essential.

Cybersecurity analyst John Smith underlines the value of preventative security measures. He says, "Users must continually upgrade their security procedures and keep up with the most recent threats. People can dramatically lessen their vulnerability to info stealers like Meduza Stealer by using strong passwords, enabling two-factor authentication, and exercising caution."

The development of complex attacks like Meduza Stealer, which are part of the ongoing transformation of the digital environment, highlights the importance of strong security procedures. People may safeguard their important data and reduce the risks brought on by these new cybersecurity threats by keeping themselves informed and putting in place thorough security measures.


Read more »
ThirdEye infostealer
FortiGuard FortiGuard Lab Fortinet Infostealer malware Open System information ThirdEye ThirdEye infostealer

ThirdEye: New Infostealer is Targeting Open System Information


FortiGuard Labs recently noted some suspicious-looking files during their cursory review. An investigation of the issue revealed the files were in fact malicious. This infostealer has been labeled as the “ThirdEye”.

While not particularly sophisticated, this malware is made to take different pieces of data from infected devices that can be used as a foundation for more attacks.

The ThirdEye 

The investigation on the infostealer began when the FortiGuard Lab researchers noticed an archive file named “Табель учета рабочего времени.zip” (English trans. “time sheet”). The zip file included two files immediately identified as “up to no good.”

Both files contain a double extension (.exe followed by a different document-related extension). One of the files is "CMK равила oормлени олнин листов.pdf.exe," which is an executable rather than a document and is labeled "QMS Rules for issuing sick leave" in English. f6e6d44137cb5fcee20bcde0a162768dadbb84a09cc680732d9e23ccd2e79494 is the file's SHA2 hash value.

The ThirdEye info stealer has comparatively simpler functionality. It contains a variety of system information based on compromised machines, like BIOS and hardware data. Additionally, it lists ongoing processes, folders and files, and network data. All of this information is gathered by the malware once it has been run, and it then sends it to its command-and-control (C2) server, which is located at (hxxp://shlalala[.]ru/general/ch3ckState). As compared to other infostealers, this one does nothing else.

An interesting string sequence unique to the ThirdEye infostealer family is the “3rd_eye”, which it decrypts and combines with another hash value to identify itself to the C2.

The second file in the archive is the “Табель учета рабочего времени.xls.exe”, which has the same name as its parent file. This file is a variant of the ThirdEye infostealer, created to achieve the same functions as f6e6d44137cb5fcee20bcde0a162768dadbb84a09cc680732d9e23ccd2e79494.

While there is no substantial evidence that could confirm that the ThirdEye infostealer was used in attacks, the malware however is created to steal valuable information from compromised machines, in order to have a better understanding of potential targets, and narrowing them down further. Moreover, there are speculations that the info stealer’s victims will be subject to future cyberattacks.

Since ThirdEye is not yet under the ‘severe’ radar, the FortiGuard investigation found that the threat actors involved have put efforts into strengthening the infostealer, such as recent samples collecting more system information compared to older variants, and it is anticipated to improve further.

Read more »
Vidar Stealer
Antivirus Cyber Security Email Fraud Infostealer Online Data Ransomware Attacks. Vidar Stealer

New Information-Stealing Malware Campaign Targets Online Sellers

Online sellers have become the latest targets of a new information-stealing malware campaign that aims to compromise their sensitive data. Security researchers have discovered a strain of malware called Vidar being deployed in this campaign, with attackers using various methods to distribute the malicious software.

Vidar is a well-known information-stealing malware that has been active since at least 2018. It is designed to collect sensitive data from infected systems, including login credentials, financial information, and other personal details. The malware operates by monitoring the victim's activities and capturing keystrokes, taking screenshots, and even recording audio if necessary.

In this recent campaign, attackers have specifically focused on online sellers, recognizing the potential financial gain from stealing their login credentials and gaining unauthorized access to their e-commerce platforms. By compromising online seller accounts, attackers can manipulate product listings, redirect payments, and exploit customer data for fraudulent purposes.

The distribution methods employed in this campaign are diverse. They range from phishing emails containing malicious attachments or links to infected websites that host exploit kits. Once the malware is successfully installed on the victim's system, it remains silent and works stealthily in the background, gathering valuable information without the user's knowledge.

To protect against this type of threat, online sellers and individuals should implement robust cybersecurity practices. These include regularly updating operating systems and software to patch known vulnerabilities, employing strong and unique passwords for all online accounts, and being cautious when opening email attachments or clicking on suspicious links.

Furthermore, it is crucial to educate employees and individuals about the risks of phishing attacks and social engineering techniques commonly used by cybercriminals. By raising awareness and promoting a security-conscious mindset, organizations can significantly reduce the likelihood of falling victim to such malware campaigns.

Security solutions, including robust antivirus and anti-malware software, should be installed and kept up to date to detect and mitigate any potential threats. Regular system scans should also be conducted to identify and remove any malicious files or software.

The discovery of this new information-stealing malware campaign serves as a reminder that cybercriminals are continuously evolving their tactics and targeting specific industries for financial gain. Online sellers, in particular, should remain vigilant and implement strong security measures to safeguard their valuable data and protect their customers from fraud and identity theft.


Read more »
User Privacy
Data Safety Fake Emails Infostealer malware RedLine Stealer User Privacy

Threat Actors Exploit Adobe Acrobat Sign to Propagate Redline Info-Stealing Malware

 

Cybercriminals are exploiting Adobe Acrobat Sign, an online document signing service, to trick users into downloading malware that steals their personal information. 

In order to get around security measures and dupe users into believing the email they got is legitimate, the service is being misused to send malicious emails that appear to come from the software business. 

The practice of misusing legal services is not new. Abuse of Google Documents comments, PayPal invoicing, and other platforms are current examples of situations similar to this. Researchers at Avast alerted the public to this new cybercrime trend and cautioned against its efficiency in evading security measures and deceiving targets. 

Exploiting legal services 

Adobe Acrobat Sign is a cloud-based e-signature service that allows users to send, sign, track, and manage electronic signatures for free. Threat actors register with the service and use it to send messages to certain email addresses that contain a link to a document published on Adobe's servers ("eu1.documents.adobe.com/public/"). 

The documents include a link to a website that asks visitors to complete a CAPTCHA in order to add authenticity before serving them a ZIP archive containing a copy of the Redline information stealer. Redline is a dangerous spyware that can steal account credentials, cryptocurrency wallets, credit cards, and other data from a compromised device. 

Avast has also detected highly targeted attacks using this strategy, such as one in which the victim had a popular YouTube channel with a large number of subscribers. 

The victim was taken to a document claiming music copyright infringement after clicking on the link in the specially-crafted letter sent via Adobe Acrobat Sign, a popular and credible theme for YouTube channel owners. 

This time, the document was stored on dochub.com, a renowned website for online document signing. The document's link points to the same CAPTCHA-protected website where a download of Redline is made available. The ZIP file in this instance, however, also included a number of executables from the GTA V game that weren't harmful, probably in an effort to confuse antivirus software programmes. 

Additionally, according to Avast, the Redline payload in both instances was artificially inflated to 400MB, aiding in the prevention of anti-virus scans. Recent phishing attacks utilising the Emotet malware employed this same technique. Phishing actors are continually looking for genuine services that may be misused to advertise their malicious emails, as these services enhance their mailbox delivery and phishing success rates. 

Adobe and Dochub.com have been given full access to Avast's findings, and it is hoped that these two services will discover a means to deter malware operators from abusing their services.
Read more »
SEKOIA
Cyber Security Cyberattack CyberCrime Dark Web Infostealer malware Plymouth SEKOIA

Dark Web Malware Steals Your Data

 


As the dark web seeks new customers and victims, it appears that updated versions of information-stealing malware have made their way onto it and are now circulating the dark web. 

There have been reports from cybersecurity researchers from SEKOIA that they have found content promoting a new information stealer called Stealc on several underground forums and Telegram channels. 

Unlike some other info stealers, Stealc is not built from the ground up. Instead, it is an enhanced version of others, such as Vidar, Racoon, Mars, and Redline Stealer, which are popular information stealers. In January 2023, a report of the phenomenon was first noticed, but in February 2023, it gained more attention. 

It has been reported that Stealc was developed by a threat actor called Plymouth who is trying to advertise it as an attack against the country. There appears to be a new patch or update added somewhere between once a week and once a month, and it is currently at version 1.3.0.  Several new features have been added to the website, including a randomizer for C2 URLs, and a system that allows logging searches and sorts to be improved. 

There was also a report that the Ukrainian government spared the lives of those affected by Stealc. 

The SEKOIA team was able to analyze a sample of the info stealer in more depth and discovered that it uses legitimate third-party DLLs, is written in C, exploits Windows API functions to achieve its goals, is lightweight (only 80KB), uses RC4 and base64 to obfuscate most of its strings, and automatically exfiltrates stolen files (the threat actor need not do anything to do anything). 

It was also found that Stealc was capable of stealing data from 22 web browsers, 75 plugins, and 25 desktop wallets, which was also confirmed by SEKOIA.  

Plymouth was also busily deploying it to target devices to advertise it on the dark web as well as distributing it. To do so, they create fake YouTube tutorials as well as employ other ways to make it appear like they know how to crack software. The description of the exploit also provides a link that, in place of executing the advertised crack, instead launches the info stealer in place. That's very helpful since it prevents the use of the crack itself. 

The researchers have already discovered more than 40 C2 servers, thus leading them to conclude that Stealc is gaining quite a bit of popularity in the online world. 

They speculate that the popularity of stealer samples may be because crooks that can access the admin panel can easily generate new stealer samples, therefore allowing the range of stealer samples to extend.  SEKOIA believes that Stealc is quite popular since it is suitable for a wide range of hackers, including low-level hackers.   
Read more »
Security
AveMaria Cyber Security Data Infostealer Safety Security

Dynamic Approaches Witnessed in AveMaria's Distribution Strategy

 

The usage of info-stealers by malicious hackers has recently gained momentum in the cyber threat landscape. AveMaria, one such info-stealer, has been modifying tactics in order to infect more users. Zscaler researchers provided an in-depth analysis of the changes implemented as well as new tactics, techniques, and procedures that characterise an AveMaria attack. 

Recent discoveries 

Over the last six months, the operators behind the info-stealer have significantly improved the execution stages in order to infect more users. The majority of these attacks were launched via phishing emails, with the first one discovered in August 2022. The phishing emails, which included an ISO file attachment, three decoy documents, and four shortcut files, were sent to Ukrainian officials.

Experts discovered two versions of the AveMaria attack chain in December 2022, which used the Virtual Hard Disk file format to drop the malicious downloader. In one scenario, adversaries utilised a malicious.vhdx file to install the malware; in another, they utilised type casting or type conversion mechanisms (to manipulate bit values) and dropped a.vhd file as the initial payload.

The malicious payload was delivered via AUloader in October 2022. To decrypt the AveMaria binary in memory and then execute the payload, the phishing campaign utilised a highly obfuscated Autoit script and Autoit interpreter.

To avoid detection in September 2022, VBscript and DLL injection techniques were used during the execution stages. The campaign specifically targeted Serbian users, requesting that they update their login credentials for access to the government e-identification portal.

Researchers emphasise that the AveMaria malware's developers are actively maintaining the malware and updating the phases and stages of execution with new tactics to avoid detection. The malware distribution mechanisms were changed on a monthly basis so that even if one mechanism was flagged by security operators, the other could still be used effectively.

Because these attacks were primarily launched via phishing emails, organisations should implement a better email security solution to thwart such threats in the early stages. Furthermore, they can use the IOCs provided by Zscaler to comprehend the full scope of the attack chains.
Read more »
Security
Aurora Crypto Wallet Data Infostealer malware Safety Security

Aurora Infostealer Malware Uses Shapeshifting Techniques

 

One of the most recent discoveries was the Aurora Stealer malware, which imitated popular applications in order to infect as many users as possible.

Cyble researchers discovered that threat actors are actively changing and customizing their phishing websites in order to target a wide range of well-known applications. Aurora is interested in data from web browsers and cryptocurrency wallets, among other things.

Aurora, the Shapeshifting Thief

Aurora has been marketed as a stealer on Telegram and darknet forums since late August 2022. Malware-as-a-service costs $250 per month or $1500 for a lifetime license.

Cyble Research and Intelligence Labs (CRIL) discovered a phishing website (hxxps[:]/messenger-download[.]top) claiming to be a website for a chat app on January 16th, 2023. The next day, the same webpage impersonated the official TeamViewer website.
 
According to the researchers' report, the malware file gathers system information using Windows Management Instrumentation (WMI) commands, including the operating system's name, the graphics card's name, and the processor's name.

Furthermore, the malware persists in collecting system information such as the username, Hardware Identification (HWID), RAM size, screen resolution, and IP address. Furthermore, the malware searches the installed directories for specific browser-related files saved in SQLite, such as Cookies, History, Login Data, and Web Data by scanning the directories of installed browsers on the victim's computer.

The stealer then continues to extract crypto wallet data by querying and reading files from specific directories. It also grabs information from cryptocurrency wallet browser extensions. As per researchers, over 100 extensions have been specifically targeted and hard coded into the stealer binary.

Other stealers, such as RedLine, Vidar, and RecordBreaker, have been found padding malware samples with unnecessary data in order to avoid detection, according to CSN.

You can immensely decrease your chances of becoming a victim by using multi-factor authentication and strong passwords whenever possible. Additionally, enable automatic software updates and educate employees on how to protect themselves against threats such as phishing and unsafe URLs.
Read more »
Typo Squatting
Cyber Security Google Ads Infostealer Malicious actor MFA Microsoft Scammers Typo Squatting

Info-stealing Ads Spread by Malvertising

HP Wolf Security's cybersecurity researchers have issued a warning about various ongoing activities that aim to use typosquatting domains and malicious advertising to spread different types of malware to unwitting victims.

Additionally, the scammers paid various ad networks to broadcast ads promoting these bogus websites. Search engines can end up presenting harmful versions of the websites alongside trustworthy ones when users search for these programs in this manner. Users risk being misdirected if they are not careful and double-check the URL of the website they are viewing.

Bogus installers

A total of 92 domains that look like other software and may have been used to spread IcedID were found. If victims do find themselves in the incorrect location, they would not likely notice the difference.

The websites are meticulously created to resemble the real ones in practically every way. In the context of Audacity, the website hosts a malicious.exe file that poses as the installation for the program. 'audacity-win-x64.exe' is the file's name, and it is larger than 300MB in size. The attackers strive to avoid detection by being this large, in addition to antivirus software. The researchers found that several antivirus products' automatic scanning functions do not check really huge files.

According to Cyble security experts, Rhadamanthys was used to steal data from web browsers, crypto wallets, and messaging apps. It was spread using Google Ads that imitated AnyDesk, Zoom, Bluestacks, and Notepad++.

Another issue involved DEV-0569 abusing Google Ads to distribute BatLoader, according to Microsoft researchers. As part of the spreading process, the group imitated LogMeIn, Adobe Flash Player, and Microsoft Teams.

Due to their extensive capabilities, info-stealers are now a common type of malware utilized by hackers. The demand for this malware is so great that it rules many underground market forums.

Increased sales of victim data on the dark net will result from selling these new malware strains and the accessibility of info-stealer malware source code.

Users should double-check the integrity of these websites before downloading any installers as the most recent assault campaign mostly uses bogus websites that look legal to distribute malware. To reduce the risk of info-stealer malware, it is also advised to deploy MFA across all accounts.




Read more »
User Security
Bank Credentials Infostealer malware Russian Hackers Typo Squatting User Security

Beware of this Lethal Malware that Employs Typosquatting to Siphon Banking Data

 

Disneyland Team, a Russian-speaking financial hacking group was identified using lethal info-stealing malware with confusing typosquatted domains to siphon login data for banking sites. 

The malicious campaign was discovered by Alex Holden, the founder of cybersecurity consulting firm Hold Security, and reported on by KrebsOnSecurity. 

According to the report, the hacking group specifically targets individuals compromised with a powerful banking malware called Gozi 2.0 (AKA Ursnif), which can siphon the data of internet-linked devices, and install additional malware.  

But Gozi is not as powerful as it used to be because search engine designers have launched multiple security measures over the years to nullify the threat of banking malware. But this is where typosquatting plays an important role by designing phishing websites with domain names that are common misspellings of websites. 

Take U.S. financial services company Ameriprise for example. Ameriprise employs the domain ameriprise.com. The Disneyland Team's domain for Ameriprise users is ạmeriprisẹ[.]com (the way it displays in the browser URL bar). The brackets are added to defang the domain.  

On observing carefully, you can make out small dots under the "a" and the second "e," and if you thought them to be specs of dust on your screen, you wouldn’t be the first one to fall for the visually confusing scam. These are not specs, though, but rather Cyrillic letters that the browser renders as Latin. 

So, when an individual falls into the trap laid by scammers and visits these bogus bank websites, it gets overlaid with the malware, which forwards anything the victim types into the legitimate bank’s website, while keeping a copy for itself. That way, when the real bank website returns with a multi-factor authentication (MFA) request, the fake website will request it too, effectively making the MFA useless.

“In years past, crooks like these would use custom-made “web injects” to manipulate what Gozi victims see in their Web browser when they visit their bank’s site,” KrebsOnSecurity reported. “These could then copy and/or intercept any data users would enter into a web-based form, such as a username and password. Most Web browser makers, however, have spent years adding security protections to block such nefarious activity.”
Read more »
Safey
Cyber Data data security Infostealer malware Safey

This Infostealer has a Lethal Sting for Python Developers

 

Checkmarx cybersecurity researchers discovered over two dozen malicious packages on PyPI, a popular repository for Python developers, and published their findings in a new report (opens in new tab). 

These malicious packages, which are designed to look almost identical to legitimate ones, attempt to dupe inexperienced developers into downloading and installing the wrong one, thereby spreading malware. The practice is known as typosquatting, and it is widely used by cybercriminals who target software developers. 

The attackers use two distinct methods to conceal the malware: steganography and polymorphism. Steganography is the practice of concealing code within an image, allowing threat actors to spread malicious code via seemingly innocent.JPGs and.PNGs. Polymorphic malware, on the other hand, changes the payload with each installation, allowing it to avoid detection by antivirus software and other cybersecurity solutions.

These techniques were used by the attackers to deliver WASP, an infostealer capable of stealing people's Discord accounts, passwords, cryptocurrency wallet information, credit card data, and any other information on the victim's endpoint that the attacker deems interesting.

When the data is identified, it is returned to the attackers via a hard-coded Discord webhook address. The campaign appears to be a marketing ploy, as researchers discovered threat actors advertising the tool on the dark web for $20 and claiming that it is undetectable.

Furthermore, the researchers believe this is the same group that was behind a similar attack reported earlier this month by Phylum(opens in new tab) and Check Point researchers (opens in new tab). It was previously stated that a group known as Worok had been distributing DropBoxControl, a custom.NET C# infostealer that uses Dropbox file hosting for communication and data theft, since at least September 2022.

Worok, based on its toolkit, is thought to be the work of a cyberespionage group that operates quietly, moves laterally across target networks, and steals sensitive data. It also appears to be using its own, proprietary tools, as no one else has been observed using them.
Read more »
User Security
Cybersecurity Cybersecurity Incident Infostealer malware Malware Attack User Security

SLTT Organizations Targeted by Jupyter Malware

 

The Multi-State Information Sharing and Analysis Center (MS-ISAC) Cyber Threat Intelligence Team (CTI) have uncovered Jupyter, a highly evasive and adaptive .NET infostealer, targeting state, local, tribal, and territorial (SLTT) organizations. 

To exploit SLTT entities, malicious actors have installed Jupyter widely, leveraging SEO-poisoning to design watering hole sites. Jupyter, also known as SolarMarker installs a multi-stage process, leveraging PowerShell and legitimate tools, such as Slim PDF Reader, to drop secondary payloads to fingerprint victim information, including computer name, OS version, architecture, permissions, and the user identifier. 

According to MS-ISAC, Jupyter targeting SLTTs is a part of a broader opportunistic effort, since the malware is impacting a wide range of sectors, including finance, healthcare, and education. Following a surge in activity during the fall, SLTT-Jupyter infections subsided with no incidents in December and a small resurgence through this past month.

The targeted organizations became aware of infections when their endpoint detection and response services (EDR) warned of unauthorized PowerShell commands attempting to establish links with command and control (C2) traffic. 

The researchers at MS-ISAC continue to investigate why malware authors are exfiltrating victims' private details. Additionally, researchers have noticed that Jupyter operators are altering their techniques, tactics, and procedures (TTPs), causing variation in intrusion details across infections. 

Despite the irregularity in Jupyter TTPs, multiple features are common among public-sourced and MS-ISAC-observed breaches. Prior to infection, the Jupyter operators inject over 2,000 keywords to push malicious Google and WordPress sites up search engine rankings, using a technique known as SEO-poisoning, thereby increasing the likelihood that an unsuspecting user will visit the page. 

Upon examining an SLTT Jupyter incident, researchers noticed that the initial infection occurred after an end-user attempted to install a malicious file embedded with an executable of a compromised website form.
Read more »
Threat actors
BazarLoader Cyber Security Cyber Threats DLL Infostealer Threat actors

BazarLoader's Arrival and Delivery Vectors now Include Compromised Installers and ISO

 

While the number of BazarLoader detections increased in the third quarter, two new delivery methods have been added to the list of delivery mechanisms used by threat actors for data theft and ransomware. Malicious actors combine BazarLoader with genuine products, hence one of the approaches involves using corrupted software installers. The second approach involves loading a Windows link (LNK) and dynamic link library (DLL) payload into an ISO file. The Americans have been discovered to have the highest amount of BazarLoader attacks.

Researchers detected the tainted versions of VLC and TeamViewer software included with BazarLoader, according to reports. While the original delivery technique has yet to be discovered, it's possible that the use of these packages is part of a bigger social engineering campaign aimed at convincing individuals to download and install infected installers. A BazarLoader executable is dumped and executed when the installers load. It's also one of the most noticeable differences from recent BazarLoader arrival approaches, which appeared to support dynamic link libraries (DLL).

Meanwhile, a distribution technique based on ISO files has been uncovered, in which the BazarLoader DLL is launched via DLL and LNK files included in the ISO files. The LNK file uses a folder icon to fool the user into double-clicking it, letting the BazarLoader DLL programme to be launched. The "EnterDLL" export function, which was recently used by BazarLoader, is then called. Before injecting itself into a suspended MS Edge process, Rundll32.exe launches the malicious DLL and connects to the C&C server. 

As threat actors change their assault techniques to avoid detection, the number of arrival mechanism modifications utilized in BazarLoader campaigns continues to rise. Due to the limitations of single detection methods, both techniques are significant and still work despite their lack of novelty. 

While the usage of compromised installers has been seen with other malware, the huge file size might still pose a problem for detection systems, such as sandboxes, that apply file size constraints. LNK files used as shortcuts, on the other hand, will very certainly be obfuscated due to the additional layers generated between the shortcut and the malicious files. 

BazarLoader will continue to evolve as a standalone information stealer, an initial access malware-as-a-service (MaaS) for other malware operators, and a secondary payload distribution mechanism for even more destructive attacks like modern ransomware. For unknown risks, security teams must deploy multi-layered systems capable of pattern recognition and behavior monitoring, as well as making monitoring and tracking for known dangers more evident based on known data.
Read more »
Stolen Data
Dark Web Dark web malware Hacking sites Infostealer malware RedLine Stealer Stolen Data

RedLine Stealer Identified as Major Source of Stolen Credentials on Dark Web Markets

 

A significant proportion of stolen credentials being traded on two dark web underground marketplaces were gathered via the RedLine Stealer malware, according to Insikt Group, Recorded Future's cybersecurity research arm. 

The RedLine Stealer, first discovered in March 2020, is a part of the info stealer family, a form of malware that once infects a computer and its primary goal is to capture as much user data as possible and then deliver it to the attackers, who often sell it online. 

The RedLine Stealer has data gathering features such as the ability to extract login credentials from web browsers, FTP applications, email apps, instant messaging clients, and VPNs. RedLine can also harvest authentication cookies and card numbers from browsers, chat logs, local files, and cryptocurrency wallet databases. 

Since March 2020, the malware has been sold on many underground hacking sites by a coder called REDGlade. After good feedback in a hacking forum thread, unauthorized versions of the RedLine Stealer were distributed on hacker forums a few months later, in August of this year, facilitating it to proliferate to even more threat actors who did not have to pay for it. 

But, even before the cracked version was released, RedLine had gained a devoted following. According to a report published last week by Insikt Group, the majority of stolen credentials available for sale on two underground marketplaces originate from computers infected with the RedLine Stealer. 

Insikt researchers stated, “Both Amigos Market and Russian Market were identified by Insikt Group (June 2021) posting identical listings regularly that contained the same timestamps, infostealer variants used, geographical locations of affected machines, and ISPs.” 

The results of the Insikt team follow similar research by threat intelligence firm KELA from February 2020, which discovered that around 90% of stolen credentials sold on the Genesis Market originated from infections with the AZORult infostealer. 

According to the two reports, underground cybercrime marketplaces are fragmented and often operate with their own independent suppliers, just as legal markets have their own choices for particular business partners. 

By going after the producers and dealers of these infostealers, this fragmentation opens the path to impairing the supply of multiple underground markets. In February 2020, a Chrome upgrade (which modified how credentials were saved inside the browser) halted the flow of newly stolen credentials on Genesis Market for months until the AZORult stealer was modified to assist the new format.
Read more »
Subscribe to: Posts (Atom)