Infocomm Security

[Admin]

The 2024 Crypto Crime Report: The latest trends in ransomware, scams, hacking, and more (March 2023)

Chapter 1: IntroductionChapter 2: Ransomware
Chapter 3: Money Laundering
Chapter 4: Stolen Funds
Chapter 5: Market Manipulation
Chapter 6: Child Sexual Abuse Material
Chapter 7: Sanctions
Chapter 8: Terrorism Financing
Chapter 9: Darknet Markets
Chapter 10: Scams

Publisher: Chainalysis

PDF (21MB): http://tiny.cc/p24ccr

[Admin]

TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service
By Bill Toulas | March 26, 2024

A new variant of "TheMoon" malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.

TheMoon is linked to the "Faceless" proxy service, which uses some of the infected devices as proxies to route traffic for cybercriminals who wish to anonymize their malicious activities.

Black Lotus Labs researchers monitoring the latest TheMoon campaign, which started in early March 2024, have observed 6,000 ASUS routers being targeted in under 72 hours.

The threat analysts report that malware operations such as the IcedID and SolarMarker currently use the proxy botnet to obfuscate their online activity.

Overview of the Faceless proxying service
Source: Black Lotus Labs

Targeting ASUS routers

TheMoon was first spotted in 2014 when researchers warned that the malware was exploiting vulnerabilities to infect LinkSys devices.

The malware's latest campaign has been seen infecting nearly 7,000 devices in a week, with Black Lotus Labs saying they primarily target ASUS routers.

"Through Lumen's global network visibility, Black Lotus Labs has identified the logical map of the Faceless proxy service, including a campaign that began in the first week of March 2024 that targeted over 6,000 ASUS routers in less than 72 hours," warn the Black Lotus Labs researchers.

The researchers do not specify the exact method used to breach the ASUS routers, but given that the targeted device models are end-of-life, it is likely that the attackers leveraged known vulnerabilities in the firmware.

The attackers may also brute-force admin passwords or test default and weak credentials.

Once the malware gains access to a device, it checks for the presence of specific shell environments ("/bin/bash," "/bin/ash," or "/bin/sh"); otherwise, it stops the execution.

If a compatible shell is detected, the loader decrypts, drops, and executes a payload named ".nttpd" which creates a PID file with a version number (26 currently).

Next, the malware sets up iptables rules to drop incoming TCP traffic on ports 8080 and 80 while allowing traffic from specific IP ranges. This tactic secures the compromised device from external interference.

The malware next attempts to contact a list of legitimate NTP servers to detect sandbox environments and verify internet connectivity.

Finally, the malware connects with the command and control (C2) server by cycling through a set of hardcoded IP addresses, and the C2 responds with instructions.

In some cases, the C2 may instruct the malware to retrieve additional components, like a worm module that scans for vulnerable web servers on ports 80 and 8080 or ".sox" files that proxy traffic on the infected device.

Sox sample communicating with a Faceless server
Source: Black Lotus Labs
The Faceless proxy service
Faceless is a cybercrime proxy service that routes network traffic through compromised devices for customers who pay exclusively in cryptocurrencies. The service does not utilize a "know-you-customer" verification process, making it available to anyone.

Purchasing access to the Faceless proxy service
Source: Black Lotus Labs

To protect their infrastructure from being mapped by researchers, Faceless operators ensure that each infected device communicates with only one server for as long as the infection lasts.

Black Lotus Labs reports that one-third of the infections last over 50 days, while 15% are lost in under 48 hours. This indicates that the latter are better monitored, and the compromise is detected quickly.


Lifetime of infected devices
Source: Black Lotus Labs

Despite the clear connection between TheMoon and Faceless, the two operations appear to be separate cybercrime ecosystems, as not all malware infections become part of the Faceless proxying botnet.

To defend against these botnets, use strong admin passwords and upgrade your device's firmware to the latest version that addresses known flaws. If the device has reached EoL, replace it with an actively supported model.

Common signs of malware infection on routers and IoTs include connectivity problems, overheating, and suspicious setting changes.

Source: https://www.bleepingcomputer.com/news/security/themoon-malware-infects-6-000-asus-routers-in-72-hours-for-proxy-service

Archive: https://archive.md/xthIT

[Admin]

Ransomware group Dark Angels claims the theft of 1TB of data from chipmaker Nexperia
Pierluigi Paganini | April 16, 2024

The Dark Angels (Dunghill) ransomware group claims responsibility for hacking chipmaker Nexperia and stealing 1 TB of the company’s data.

Nexperia is a semiconductor manufacturer headquartered in Nijmegen, the Netherlands. It is a subsidiary of the partially state-owned Chinese company Wingtech Technology. It has front-end factories in Hamburg, Germany, and Greater Manchester, England. The company’s product range includes bipolar transistors, diodes, ESD protection, TVS diodes, MOSFETs, and logic devices.

The chipmaker has 14,000 employees as of 2024.

The Dark Angels ransomware group added Nexperia to the list of victims on its Tor leak site. According to the announcement, the stolen data includes:

- 285 Gb of quality control data
- 24 Gb - 896 client folders, many famous brands like SpaceX, IBM, Apple, Huawei, etc.
- 139 Gb project data, very detailed and highly confidential: NDA, internal documents, trade secrets, design, specifications, manufacturing
- 49 Gb industrial production data and instructions
- Assessment of the product's competitiveness in comparison with competitors
- 45 Gb engineers' experience and studies
- 20 Gb product management
- 201 Gb semiconductor manufacturing technologies
- 70 Gb semiconductor commercial marketing data
- 26 Gb pricing, analysis, price books
- 20 Gb HR department, employee data, personal data, passports, contracts, diplomas, salaries, insurance.
- 18 Gb .dwg - 38295 pcs - drawings and schematics of chips, microchips, transistors, etc. All data is confidential, contains trade secrets.
- 30 Gb user data
- production line settings
- repository with equipment configures
- 26 Gb machine operation logs
- 1.2 Gb AWACS software
- 13 Gb .esm files
- 1.9 Gb .job files
- 3 Gb .svn-base
- 101 Gb - .pst files
- 1.5 Gb - NDA

The group published a set of files as proof of the security breach and threatens leak all the stolen data if the victim will not pay the ransom.

The chipmaker confirmed it became aware of the unauthorized access to certain Nexperia IT servers in March 2024.

In response to the incident, the company disconnected the affected systems from the internet to prevent the threat from spreading. The Nexperia launched an investigation into the security breach with the help of third-party cybersecurity experts.

“we have reported the incident to the competent Authorities, including the ‘Autoriteit Persoonsgegevens’ and the police, and are keeping them informed of the progress of our investigation.” reads the press statement published by the company. “Together with our external cybersecurity expert FoxIT, Nexperia continues to investigate the full extent and impact of the matter and we are closely monitoring the developments. In the interest of the ongoing investigation, we cannot disclose further details at this point.”

In September 2023, the Dark Angels ransomware group hacked Johnson Controls and demanded a $51 million ransom.

Source: https://securityaffairs.com/161888/cyber-crime/ransomware-dark-angels-nexperia.html

Archive: https://archive.fo/08yJZ

Enlarged

Enlarged
Enlarged
_____________________________________________________________________

About "Ransomware - Dunghill Leak"

Dunghill Leak (Active)
Decryptor Available: No

Description:

The Dunghill Leak operation made itself known in mid-April 2023. However, based on the creation time of their Telegram page, they began this specific operation in January of the same year. All of their double extortions are posted to this Telegram before being mirrored to their dark web page. Most ransomware threat actors name themselves after their encryptor or data leak site. However, Dunghill Leak is operated by a ransomware group that calls themselves Dark Angels Team. This is the same group that operated the self-named Dark Angels data leak site in 2022. How they came up with the name Dunghill Leak is unknown.

Since switching to the Dunghill Leak name, they've breached large organizations. Public reporting and their data leak site show that they breached Sysco Corporation in late Spring 2023. In September of the same year, they allegedly breached Sabre Corporation and Johnson Controls International. The outcome of those alleged breaches is unknown, but it has been reported that they demand multi-million-dollar ransoms. This amount probably varies depending on the cyber insurance of the victim, which Dark Angels Team is known to elicit or steal upon breaches.

Regarding the technical attributes of their encryptors, the cybergroup initially leveraged the stolen Babuk source code to create their own encryptor. This was during the time of the Dark Angels data leak site. They forked the Babuk code from GitHub and slightly tailored it to their needs. However, they also have been observed using a tailored version of Ragnar Locker (ESXi version). Meanwhile, the operators themselves claim that they have created their own encryptor. The only official sample we have collected is the Ragnar Locker variant reported by @MalGamy12. Thus, the encryption information is from that sample too.

Note: We added Johnson Controls as a victim to Dunghill Leak even though they were never posted by the Dark Angels Team. However, it was the Dark Angels Team that was responsible for the ransomware attack on Johnson Controls. As such, we have posted that entry here.

Ransomware Type: Crypto-Ransomware | Data Broker | HumOR

First Seen: January 2023

Threat Actors:
1. Type: Cybergroup
2. Actor: Dark Angels Team

Extortion Links
1. Telegram, https://t.me/leaksdirectory
2. TOR, http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion

Extortion Types: Direct Extortion | Double Extortion | Elicit Cyber Insurance | Free Data Leaks | Unveil to Media | Victim Client Communication | Victim Employee Communication

Extortion Amounts: $51,000,000

Communication: Telegram, https://t.me/leaks_directory

Encryption:
1. Type: 2. Hybrid
2. Files: Salsa20
3. Key: RSA-2048

Samples (SHA-256): fe8b6b7c3c86df0ee47a3cb04a68891fd5e91f3bfb13482112dd9042e8baebdf

Known Victims(14):
Industry Sector     Country     Extortion Date     Amount (USD)
Construction & Architecture     Brazil     2023-01-23   
Construction & Architecture     Portugal     2023-01-23   
Sports & Gaming     United States     2023-02-03   
Automotive     United States     2023-04-18   
Food & Beverage     United States     2023-05-09   
Information Technology     United States     2023-09-06   
Manufacturing     Ireland     2023-09-24    $51,000,000
Information Technology     United States     2023-09-26   
Information Technology     United States     2023-09-26   
Transportation     United Kingdom     2023-09-26   
Construction & Architecture     United States     2023-09-26   
Construction & Architecture     United States     2023-09-26   
Distribution & Logistics     United States     2023-11-07   
Information Technology     United States     2024-02-29

References & Publications( :
BleepingComputer: Building automation giant Johnson Controls hit by ransomware attack
Reddit: r/HVAC - Anyone know about Johnson controls
TechCrunch: Ransomware gang claims credit for Sabre data breach
TechTarget: Gentex confirms data breach by Dunghill ransomware actors
The Cyber Express: Dark Angels Ransomware’s Spin-off Dunghill Leak Claims Incredible Technologies …
Twitter | X: @MalGamy12 - Dark Angels Team Samples
Twitter | X: @malwrhunterteam - Dark Angels Team::RagnarLocker
Twitter | X: @ThreatLabz - Dunghill Leak

Source: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dunghill-leak

Archive: https://archive.fo/TFGop

Reference 1 (Onion): http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion/lot12.html

Reference 2 (Onion, proof12.zip): http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion/files/proof12.zip

Reference 2 (Telegram): https://t.me/leaksdirectory

[Admin]

OpenAI's GPT-4 can exploit real vulnerabilities by reading security advisories
Thomas Claburn | Wed 17 Apr 2024

AI agents, which combine large language models with automation software, can successfully exploit real world security vulnerabilities by reading security advisories, academics have claimed.

In a newly released paper, four University of Illinois Urbana-Champaign (UIUC) computer scientists – Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang – report that OpenAI's GPT-4 large language model (LLM) can autonomously exploit vulnerabilities in real-world systems if given a CVE advisory describing the flaw.

"To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the CVE description," the US-based authors explain in their paper.

"When given the CVE description, GPT-4 is capable of exploiting 87 percent of these vulnerabilities compared to 0 percent for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and Metasploit)."

    If you extrapolate to what future models can do, it seems likely they will be much more capable than what script kiddies can get access to today

The term "one-day vulnerability" refers to vulnerabilities that have been disclosed but not patched. And by CVE description, the team means a CVE-tagged advisory shared by NIST – eg, this one for CVE-2024-28859.

The unsuccessful models tested – GPT-3.5, OpenHermes-2.5-Mistral-7B, Llama-2 Chat (70B), LLaMA-2 Chat (13B), LLaMA-2 Chat (7B), Mixtral-8x7B Instruct, Mistral (7B) Instruct v0.2, Nous Hermes-2 Yi 34B, and OpenChat 3.5 – did not include two leading commercial rivals of GPT-4, Anthropic's Claude 3 and Google's Gemini 1.5 Pro. The UIUC boffins did not have access to those models, though they hope to test them at some point.

The researchers' work builds upon prior findings that LLMs can be used to automate attacks on websites in a sandboxed environment.

GPT-4, said Daniel Kang, assistant professor at UIUC, in an email to The Register, "can actually autonomously carry out the steps to perform certain exploits that open-source vulnerability scanners cannot find (at the time of writing)."

Kang said he expects LLM agents, created by (in this instance) wiring a chatbot model to the ReAct automation framework implemented in LangChain, will make exploitation much easier for everyone. These agents can, we're told, follow links in CVE descriptions for more information.

"Also, if you extrapolate to what GPT-5 and future models can do, it seems likely that they will be much more capable than what script kiddies can get access to today," he said.

Denying the LLM agent (GPT-4) access to the relevant CVE description reduced its success rate from 87 percent to just seven percent. However, Kang said he doesn't believe limiting the public availability of security information is a viable way to defend against LLM agents.

"I personally don't think security through obscurity is tenable, which seems to be the prevailing wisdom amongst security researchers," he explained. "I'm hoping my work, and other work, will encourage proactive security measures such as updating packages regularly when security patches come out."

The LLM agent failed to exploit just two of the 15 samples: Iris XSS (CVE-2024-25640) and Hertzbeat RCE (CVE-2023-51653). The former, according to the paper, proved problematic because the Iris web app has an interface that's extremely difficult for the agent to navigate. And the latter features a detailed description in Chinese, which presumably confused the LLM agent operating under an English language prompt.

Eleven of the vulnerabilities tested occurred after GPT-4's training cutoff, meaning the model had not learned any data about them during training. Its success rate for these CVEs was slightly lower at 82 percent, or 9 out of 11.

As to the nature of the bugs, they are all listed in the above paper, and we're told: "Our vulnerabilities span website vulnerabilities, container vulnerabilities, and vulnerable Python packages. Over half are categorized as 'high' or 'critical' severity by the CVE description."

Kang and his colleagues computed the cost to conduct a successful LLM agent attack and came up with a figure of $8.80 per exploit, which they say is about 2.8x less than it would cost to hire a human penetration tester for 30 minutes.

The agent code, according to Kang, consists of just 91 lines of code and 1,056 tokens for the prompt. The researchers were asked by OpenAI, the maker of GPT-4, to not release their prompts to the public, though they say they will provide them upon request.

OpenAI did not immediately respond to a request for comment.

Source: https://www.theregister.com/2024/04/17/gpt4_can_exploit_real_vulnerabilities

Archive: https://archive.fo/G6GSS

Reference: Fang, R., Bindu, R., Gupta, A., & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities (arXiv:2404.08144). arXiv. https://doi.org/10.48550/arXiv.2404.08144

[Admin]

New Android security flaw lets hackers seize control of apps — uninstall these immediately
By Alyse Stanley | 6 May 2024

Another day, another new Android malware strain. Microsoft is sounding the alarm about a recently discovered critical security vulnerability on Android named "Dirty Stream" that can let malicious apps easily hijack legitimate apps. Worse still, this flaw impacts multiple apps with hundreds of millions of installs. If you have one of the best Android phones, here's what you need to know to protect your data.

The vulnerability relates to the ContentProvider system prevalent across many popular Android apps, which manages access to structured data sets meant to be shared between different applications. It's basically what lets your Android apps talk to one another and share files. To protect users and ward off unauthorized access, the system includes safeguards such as strict isolation of data, unique permissions attached to specific URIs (Uniform Resource Identifiers), and path validation security.

What makes the Dirty Stream vulnerability so devious is how it manipulates this system. Microsoft has found that hackers can create "custom intents," messaging objects that facilitate communication between components across Android apps, to bypass these security measures. By exploiting this loophole, malicious apps can send a file with a manipulated filename or path to another app using a custom intent, sneaking in harmful code disguised as legitimate files.

From there, a hacker could trick a vulnerable app into overwriting critical files within its private storage space — and the results can be devastating. As BleepingComputer put it, Dirty Stream essentially turns a common OS-level function into a weaponized tool to execute unauthorized code, steal data, and even hijack an app while the user is none the wiser.

"Arbitrary code execution can provide a threat actor with full control over an application’s behavior," Microsoft said in a security bulletin this week. "Meanwhile, token theft can provide a threat actor with access to the user’s accounts and sensitive data."

How widespread is this threat?
Microsoft’s investigation found that this vulnerability is not an isolated issue. The company uncovered incorrect implementations of the content provider system prevalent across many popular Android apps.

"We identified several vulnerable applications in the Google Play Store that represented over four billion installations," Microsoft explained. "We anticipate that the vulnerability pattern could be found in other applications."
Microsoft gives two examples of popular apps that were susceptible to this risk that have since been patched: Xiaomi Inc.’s File Manager (1B+ installs) and WPS Office (500M+ installs).

Given the nature of how this vulnerability works, it's hard to know exactly how many other legitimate apps may have been impacted. But it's safe to assume this potential risk is on an industrial scale until all apps are patched.

How to stay safe from Android malware

To steer clear of potentially harmful malware infecting your Android device, the first and easiest step is to avoid sideloading apps altogether. While it might seem convenient, and certain apps may require sideloading, the majority of people can find what they need on official app stores like Google Play Store, Samsung Galaxy Store, or Amazon Appstore.

The reason you don’t want to sideload apps is that they don't go through the same stringent security checks that apps hosted on official stores do. This is why it's crucial to rely on reputable sources for app downloads to keep your device safe from malware.

Next, you should ensure Google Play Protect is enabled on your Android smartphone. It comes pre-installed on most phones with the Play Store, and it actively scans both existing and newly downloaded apps for viruses. Likewise, you can also install one of the best Android antivirus apps for additional protection and extra features to help keep you safer online.

Alyse Stanley is a news editor at Tom’s Guide overseeing weekend coverage and writing about the latest in tech, gaming and entertainment. Prior to joining Tom’s Guide, Alyse worked as an editor for the Washington Post’s sunsetted video game section, Launcher. She previously led Gizmodo’s weekend news desk, where she covered breaking tech news — everything from the latest spec rumors and gadget launches to social media policy and cybersecurity threats.  She has also written game reviews and features as a freelance reporter for outlets like Polygon, Unwinnable, and Rock, Paper, Shotgun. She’s a big fan of horror movies, cartoons, and miniature painting.


Source: https://www.tomsguide.com/computing/malware-adware/new-android-security-flaw-lets-hackers-seize-control-of-apps-uninstall-these-immediately
Archive: https://archive.fo/Eq96p

Reference (Technical): https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps

Source (Technical): https://archive.fo/HHCV7

[Admin]

Botnet sent millions of emails in LockBit Black ransomware campaign
Sergiu Gatlan | May 13, 2024 03:08 PM 0

Since April, millions of phishing emails have been sent through the Phorpiex botnet to conduct a large-scale LockBit Black ransomware campaign.

As New Jersey's Cybersecurity and Communications Integration Cell (NJCCIC) warned on Friday, the attackers use ZIP attachments containing an executable that deploys the LockBit Black payload, which encrypts the recipients' systems if launched.

The LockBit Black encryptor deployed in these attacks is likely built using the LockBit 3.0 builder leaked by a disgruntled developer on Twitter in September 2022. However, this campaign is not believed to have any affiliation with the actual LockBit ransomware operation.

These phishing emails with "your document" and "photo of you???" subject lines are being sent using "Jenny Brown" or "Jenny Green" aliases from over 1,500 unique IP addresses worldwide, including Kazakhstan, Uzbekistan, Iran, Russia, and China.

The attack chain begins when the recipient opens the malicious ZIP archive attachment and executes the binary inside.

This executable then downloads a LockBit Black ransomware sample from the infrastructure of the Phorphiex botnet and executes it on the victim's system. After launching it, it will attempt to steal sensitive data, terminate services, and encrypt files.

​Cybersecurity company Proofpoint, which has been investigating these spray-and-pray attacks since April 24, said on Monday that the threat actors target companies in various industry verticals worldwide.

Although this approach is not new, the massive number of emails sent to deliver the malicious payloads and ransomware being used as a first-stage payload make it stand out even though it lacks the sophistication of other cyberattacks.

"Beginning April 24, 2024 and continuing daily for about a week, Proofpoint observed high-volume campaigns with millions of messages facilitated by the Phorpiex botnet and delivering LockBit Black ransomware," Proofpoint security researchers said.

"This is the first time Proofpoint researchers have observed samples of LockBit Black ransomware (aka LockBit 3.0) being delivered via Phorphiex in such high volumes."

​The Phorpiex botnet (also known as Trik) has been active for over a decade. It evolved from a worm that spread via removable USB storage and Skype or Windows Live Messenger chats into an IRC-controlled trojan that used email spam delivery.

While it slowly grew to a massive size, controlling over 1 million infected devices after years of activity and development, the botnet's operators tried selling the malware's source code on a hacking forum after shutting down the Phorpiex infrastructure.

The Phorpiex botnet has also been used to deliver millions of sextortion emails (spamming over 30,000 emails per hour) and, more recently, used a clipboard hijacker module to replace cryptocurrency wallet addresses copied to the Windows clipboard with attacker-controlled ones.

Within a year after adding crypto-clipping support, Phorpiex's operators hijacked 969 transactions and stole 3.64 Bitcoin ($172,300), 55.87 Ether ($216,000), and $55,000 worth of ERC20 tokens.

To defend against phishing attacks that push ransomware, NJCCIC recommends implementing ransomware risk mitigation strategies and using endpoint security solutions and email filtering solutions (like spam filters) to block potentially malicious messages.

Source: https://www.bleepingcomputer.com/news/security/botnet-sent-millions-of-emails-in-lockbit-black-ransomware-campaign

Archive: https://archive.fo/WFeNq

Phorpiex: https://www.microsoft.com/en-us/security/blog/2021/05/20/phorpiex-morphs-how-a-longstanding-botnet-persists-and-thrives-in-the-current-threat-environment

A Phorpiex BTC wallet:https://www.blockchain.com/explorer/addresses/btc/1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw

Anatomy of Phorpiex: https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions

[Admin]

Newly discovered ransomware uses BitLocker to encrypt victim data
ShrinkLocker is the latest ransomware to use Windows' full-disk encryption.
Dan Goodin | 5/25/2024

A previously unknown piece of ransomware, dubbed ShrinkLocker, encrypts victim data using the BitLocker feature built into the Windows operating system.

BitLocker is a full-volume encryptor that debuted in 2007 with the release of Windows Vista. Users employ it to encrypt entire hard drives to prevent people from reading or modifying data in the event they get physical access to the disk. Starting with the rollout of Windows 10, BitLocker by default has used the 128-bit and 256-bit XTS-AES encryption algorithm, giving the feature extra protection from attacks that rely on manipulating cipher text to cause predictable changes in plain text.

Recently, researchers from security firm Kaspersky found a threat actor using BitLocker to encrypt data on systems located in Mexico, Indonesia, and Jordan. The researchers named the new ransomware ShrinkLocker, both for its use of BitLocker and because it shrinks the size of each non-boot partition by 100 MB and splits the newly unallocated space into new primary partitions of the same size.

“Our incident response and malware analysis are evidence that attackers are constantly refining their tactics to evade detection,” the researchers wrote Friday. “In this incident, we observed the abuse of the native BitLocker feature for unauthorized data encryption.”

ShrinkLocker isn’t the first malware to leverage BitLocker. In 2022, Microsoft reported that ransomware attackers with a nexus to Iran also used the tool to encrypt files. That same year, the Russian agricultural business Miratorg was attacked by ransomware that used BitLocker to encrypt files residing in the system storage of infected devices.

Once installed on a device, ShrinkLocker runs a VisualBasic script that first invokes the Windows Management Instrumentation and Win32_OperatingSystem class to obtain information about the operating system.

“For each object within the query results, the script checks if the current domain is different from the target,” the Kaspersky researchers wrote. “If it is, the script finishes automatically. After that, it checks if the name of the operating system contains 'xp,' '2000,' '2003,' or 'vista,' and if the Windows version matches any one of these, the script finishes automatically and deletes itself.”



The script then continues to use the WMI for querying information about the OS. It goes on to perform the disk resizing operations, which can vary depending on the OS version detected. The ransomware performs these operations only on local, fixed drives. The decision to leave network drives alone is likely motivated by the desire not to trigger network detection protections.

Eventually, ShrinkLocker disables protections designed to secure the BitLocker encryption key and goes on to delete them. It then enables the use of a numerical password, both as a protector against anyone else taking back control of BitLocker and as an encryptor for system data. The reason for deleting the default protectors is to disable key recovery features by the device owner. ShrinkLocker then goes on to generate a 64-character encryption key using random multiplication and replacement of:

• A variable with the numbers 0–9;
• The famous pangram, “The quick brown fox jumps over the lazy dog,” in lowercase and uppercase, which contains every letter of the English alphabet;
• Special characters.

After several additional steps, data is encrypted. The next time the device reboots, the display looks like this:


Decrypting drives without the attacker-supplied key is difficult and likely impossible in many cases. While it is possible to recover some of the passphrases and fixed values used to generate the keys, the script uses variable values that are different on each infected device. These variable values aren’t easy to recover.

There are no protections specific to ShrinkLocker for preventing successful attacks. Kaspersky advises the following:

• Use robust, properly configured endpoint protection to detect threats that try to abuse BitLocker;
• Implement Managed Detection and Response (MDR) to proactively scan for threats;
• If BitLocker is enabled, make sure it uses a strong password and that the recovery keys are stored in a secure location;
• Ensure that users have only minimal privileges. This prevents them from enabling encryption features or changing registry keys on their own;
• Enable network traffic logging and monitoring. Configure the logging of both GET and POST requests. In case of infection, the requests made to the attacker’s domain may contain passwords or keys;
• Monitor for events associated with VBS execution and PowerShell, then save the logged scripts and commands to an external repository storing activity that may be deleted locally;
• Make backups frequently, store them offline, and test them.

Friday’s report also includes indicators that organizations can use to determine if they have been targeted by ShrinkLocker.

Source: https://arstechnica.com/security/2024/05/newly-discovered-ransomware-uses-bitlocker-to-encrypt-victim-data

Archive: https://archive.fo/RD8PZ

[Admin]

Over 90 malicious Android apps with 5.5M installs found on Google Play
Bill Toulas | May 28, 2024

Over 90 malicious Android apps were found installed over 5.5 million times through Google Play to deliver malware and adware, with the Anatsa banking trojan seeing a recent surge in activity.

Anatsa (aka "Teabot") is a banking trojan that targets over 650 applications of financial institutions in Europe, the US, the UK, and Asia. It attempts to steal people's e-banking credentials to perform fraudulent transactions.

In February 2024, Threat Fabric reported that since late last year, Anatsa had achieved at least 150,000 infections via Google Play using various decoy apps in the productivity software category.

Today, Zscaler reports that Anatsa has returned to Android's official app store and is now distributed via two decoy applications: 'PDF Reader & File Manager' and 'QR Reader & File Manager.'

At the time of Zscaler's analysis, the two apps had already amassed 70,000 installations, demonstrating the high risk of malicious dropper apps slipping through the cracks in Google's review process.

One thing that helps Anatsa dropper apps evade detection is the multi-stage payload loading mechanism that involves four distinct steps:

The DEX file also performs anti-analysis checks to ensure the malware won't be executed on sandboxes or emulating environments.

Once Anatsa is up and running on the newly infected device, it uploads the bot configuration and app scan results and then downloads the injections that match the victim's location and profile.

Zscaler reports that during the past couple of months, it has also discovered over 90 malicious applications on Google Play, which were collectively installed 5.5 million times.

Most of the malicious apps impersonated tools, personalization apps, photography utilities, productivity, and health & fitness apps.

The five malware families dominating the scene are Joker, Facestealer, Anatsa, Coper, and various adware.

Though Anatsa and Coper only account for 3% of the total malicious downloads from Google Play, they are far more dangerous than the others, capable of performing on-device fraud and stealing sensitive information.

When installing new apps on Google Play, review the requested permissions and decline those associated with high-risk activities such as Accessibility Service, SMS, and contacts list.

The researchers did not disclose the names of the 90+ apps and whether they had been reported to Google for takedown.

However, at the time of writing this, the two Anatsa dropper apps discovered by Zscaler have been removed from Google Play.
Related Articles:

Source: https://www.bleepingcomputer.com/news/security/over-90-malicious-android-apps-with-55m-installs-found-on-google-play

Archive: https://archive.fo/59ad9

[Admin]

Man in Japan arrested for creating virus using generative AI systems
May 28, 2024

TOKYO – A 25-year-old unemployed man in Japan has been arrested for allegedly creating a computer virus by using interactive generative artificial intelligence (AI) available online. This is believed to be the first case in Japan related to the creation of viruses using generative AI systems.

The Metropolitan Police Department (MPD) arrested Ryuki Hayashi, who is from Kawasaki, on May 27 on suspicion of making of electric or magnetic records containing unauthorised commands. He is believed to have used his home computer and smartphone to combine information about creating malware programs obtained after giving instructions to several generative AI systems in March 2023, according to investigators.

The crafted virus was designed to do things such as encrypt data on targeted systems and demand cryptocurrency as ransom. There have been no reports of damage caused by the virus, police said.

According to the police, Hayashi admitted to the charge during questioning, saying, “I wanted to make money through ransomware. I thought I could do anything if I asked AI.”

Platforms such as OpenAI’s ChatGPT have stepped up measures to prevent output related to criminal activity. Yet some interactive AI systems on the internet provide unlimited information that could be used for criminal purposes, according to sources.

Hayashi allegedly gave instructions to the AI systems while concealing his purpose of creating the virus to obtain design information necessary for encrypting files and demanding ransom. He is said to have searched online for ways to illegally obtain information. The MPD is also investigating the functions of the generative AI he used.

In March, the MPD arrested Hayashi on suspicion of fraud for fraudulently signing up for a smartphone SIM card. Police found a homemade virus on a computer and other items seized from his home. THE JAPAN NEWS/ASIA NEWS NETWORK

Source: https://www.straitstimes.com/asia/east-asia/man-in-japan-arrested-for-creating-virus-using-generative-ai-systems

Archive: https://archive.fo/TSuLt


Reference: WormGPT, https://flowgpt.com/p/wormgpt-v30

[Admin]

Chinese national arrested in S’pore for creating malware that allowed criminals to steal billions
Aqil Hamzah and Andrew Wong | May 30, 2024

SINGAPORE – A 35-year-old Chinese national has been arrested in Singapore for creating and operating malware, which resulted in a network of zombie computers that allowed cyber criminals to steal billions of dollars.

Wang Yunhe was arrested on May 24 in a multi-jurisdiction operation led by the United States Department of Justice (DOJ).

The Singapore Police Force (SPF) was among law enforcement agencies that took part in the international probe.

An SPF spokesman said on May 30 that Washington had made an extradition request for Wang after the arrest. The US has an extradition treaty with Singapore.

The spokesman said: “The Police and Attorney-General’s Chambers have been working with the DOJ and Federal Bureau of Investigation (FBI) since August 2022. On May 24, 2024, the police launched an operation to arrest Wang at his residence.”

In a statement on May 29, the DOJ said Wang had allegedly worked with others between 2014 and July 2022 to create and disseminate the 911 S5 Botnet to millions of home-based Windows computers across the world.

Mr Kevin Reed, chief information security officer at cyber-security firm Acronis, said the “bots” in this case refer to the computers being controlled by the malware. A botnet refers to a network of such computers.

Principal Deputy Assistant Attorney-General Nicole Argentieri, head of the DOJ’s Criminal Division, said Wang allegedly created malware that compromised millions of residential computers around the world, and then sold access to the infected computers to cyber criminals.

“These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyber stalking,” she added.

The DOJ said more than 19 million internet protocol (IP) addresses – unique characters that identify each computer – ended up in the “world’s largest botnet ever”.

“The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft and child exploitation,” said Mr Christopher Wray, director of the FBI.

An archived version of one of the websites selling IP addresses showed that it costs US$28 (S$38) to purchase 150 addresses. Payment is made through several options, including Bitcoin, Alipay and WeChat Pay.

The most expensive option would cost US$674, and provide access to 9,000 IP addresses, with users able to choose from 190 countries.

Mr Reed said: “In this case of VPN (virtual private network) software being distributed by Wang, it provided an encrypted tunnel for victims by pretending to be a free VPN service.

“But the tunnel also worked in reverse, allowing Wang’s customers to access the internet from the IP addresses of unsuspecting victims.”

He added that this allowed Wang’s customers to bypass geographical restrictions and security checks to commit various acts of fraud.

Ms Joanne Wong, interim chief marketing officer at cyber-security firm LogRhythm, said botnet attacks are disruptive and can cause extensive and severe damage.

Ms Wong said: “Devices can be unknowingly co-opted into a botnet, leading to degraded performance, increased data usage, and potential legal ramifications if those devices are traced back to cyber-criminal activities.”

Botnet attacks, especially distributed denial-of-service (DDoS) attacks, can disrupt critical online services and expose users to elevated risks of phishing and ransomware.

During DDoS attacks, attackers spam servers with internet traffic to prevent users from accessing online services.

Ms Wong added that safeguards against botnets include the adoption of proactive cyber-security measures, including tools with advanced threat detection and analytics capabilities. Maintaining good cyber-security hygiene, such as regularly patching software and implementing strong encryption, authentication and access controls, is essential “to mitigate the risks associated with botnets”, she said.

The DOJ said that Wang, who also holds a St Kitts and Nevis citizenship, allegedly received US$99 million from cyber criminals who tapped his network from 2018 to July 2022.

He used the money to purchase 21 properties across the US, St Kitts and Nevis, Singapore, Thailand, China and the United Arab Emirates.

US court documents showed he resided in the properties he owned in Singapore, Thailand and China, and owned and operated several companies in various jurisdictions.

He was also the sole shareholder in Eternal Code*, a now-defunct wholesaler of computer software. The company was incorporated on Dec 30, 2020, and struck off the registry on Jan 9, 2023.

Court documents described the firms Wang registered as “shell companies he used to conceal the identity and illegitimate nature of his 911 S5 service and its related proceeds”.

Dozens of his assets and properties may be seized, the DOJ said. They include a Singapore-registered 2022 Ferrari F8 Spider, bank accounts with CIMB Bank, Citibank Singapore and banks in Thailand, a condominium unit in Angullia Park, and Patek Philippe and Audemars Piguet watches.

Pandemic relief programmes

The DOJ said that Wang’s customers had also allegedly targeted Covid-19 relief programmes in the US, resulting in losses of more than US$5.9 billion due to fraudulent claims made from compromised IP addresses.

It added that Wang’s arrest was a multi-agency effort led by law enforcement agencies in the US, Singapore, Thailand and Germany.

They had searched residences and seized assets valued at about US$30 million, and identified more forfeitable property valued at another US$30 million.

Law enforcement agencies also seized 23 internet domains and more than 70 servers located worldwide that functioned as the backbone of Wang’s criminal activities.

The US Treasury Department has also placed Wang on its sanctions list, along with two other Chinese nationals and three Thai-based businesses tied to him.

The two – Liu Jingping and Zheng Yanni – also hold passports from St Kitts and Nevis, both of which were issued on May 13, 2022, according to the department’s specially designated nationals list.

Liu, who is said to be Wang’s co-conspirator in laundering the proceeds from his criminal activities, shares a common address with Wang – the condominium in Angullia Park.

Zheng does not have an address in Singapore, according to the Treasury Department.

In a separate statement, it described Zheng as someone who made several business transactions and purchased real estate property on behalf of Wang.

The three firms linked to Wang are all based in Chonburi, which is south of Thai capital Bangkok.

The Straits Times has contacted the FBI and SPF for more information.

For his alleged crimes, Wang faces a maximum of 65 years in a US prison if convicted on all counts.

* Entity Name: ETERNAL CODE PTE. LTD.
UEN: 202042138N   
UEN Status: DEREGISTERED
Entity Type: LOCAL COMPANIES   
UEN Issuance Agency: Accounting and Corporate Regulatory Authority   
Address: 120, ROBINSON ROAD, #13-01, SINGAPORE 068913From: https://www.uen.gov.sg

Source: https://www.straitstimes.com/singapore/chinese-national-arrested-in-s-pore-for-creating-malware-that-allowed-criminals-to-steal-billions

Archive: https://archive.fo/9oecs

[Admin]

75 S’pore bank customers cheated of S$500,000 through unauthorised credit card transactions via diverted SMS one-time passwords
Tessa Oh | September 15, 2021

SINGAPORE — Overseas hackers cheated 75 bank customers here of a total of S$500,000 through fraudulent credit card transactions performed between September and December last year.

The perpetrators had diverted and used one-time passwords sent via short message service (SMS) to perform the fraudulent credit card transactions, the Monetary Authority of Singapore (MAS), the Infocomm Media Development Authority (IMDA), and the police said in a joint statement on Wednesday (Sept 15).

Investigations by the affected banks found that their systems were uncompromised and had not been the cause of these incidents.

Joint investigations by the police and IMDA later found that the perpetrators from abroad had gained unauthorised access to the systems of overseas telecommunication operators and used them to modify the location data of the mobile phones used by the victims in Singapore, the authorities said.

They were then able to receive through the overseas mobile network systems the SMS one-time passwords sent by the banks to the victims.

Having already obtained the victims’ credit card details, the perpetrators were then able to make the fraudulent online card payment transactions and authorised them using the one-time passwords they retrieved.

MAS, IMDA and the police said the compromised overseas telecommunication networks have already been identified and notified.

Investigations are underway to identify and prosecute the perpetrators, they said.

The affected banks have reviewed the case and will provide a goodwill waiver to the affected customers who had taken care to protect their credentials.

The authorities said SMS diversion “is a mode of attack that requires highly sophisticated expertise to compromise the systems of overseas telecommunication networks”.

“While our local telecommunication networks are secure and have not been compromised, IMDA, in consultation with the Cyber Security Agency of Singapore, has required operators to put in place additional safeguards, including specialised firewalls and system safeguards to monitor and block suspicious diversions of SMS,” they said.

The authorities advised members of the public to be alert and vigilant against malware and phishing attempts seeking to obtain personal information, including their credit card details.

They should keep bank account, credit and debit card details safe at all times and never disclose these details, along with personal identification numbers, passwords and codes to anyone else.

The public should also keep their electronic devices updated with the latest security patches and anti-virus software.

They should only use credible online services, including only downloading applications from official online application stores and making online purchases through trustworthy platforms.

Individuals should also refrain from clicking on suspicious links from unknown sources, and set low thresholds for payment transaction alerts so as to flag any unauthorised activities early.

They should then alert their banks as soon as possible should they discover any discrepancies or unauthorised transactions. 

Source: https://www.todayonline.com/singapore/75-spore-bank-customers-cheated-s500000-through-unauthorised-credit-card-transactions

Archive: https://archive.fo/frb4K

[Admin]

Ex-MOM officer gets 5 weeks' jail for asking former DBS employee to find out his ministry colleagues' salaries
Jasmine Ong | September 14, 2023

SINGAPORE — Curious about his own standing relative to his colleagues at the Ministry of Manpower (MOM), a man reached out to a former co-worker at DBS to help him to find out their salary details by conducting an unauthorised search in the bank's database, so that he can compare their pay against his own.

On Thursday (Sept 14), Dinath Silvamany Muthaliyar, 35, was sentenced to five weeks' jail after pleading guilty to four charges under the Computer Misuse Act for abetting his former colleague Liong Yan Shin to perform the search, and another four charges under the Banking Act for asking Liong to disclose the salary details.

Fourteen other similar charges were taken into consideration during sentencing.

Liong, 32, no longer works for DBS and was jailed for 16 weeks for his role in the offences.

WHAT HAPPENED
The court heard that Dinath and Liong were both employed as collections officers at DBS, before Dinath switched jobs and joined MOM in 2018.

Dinath was thus aware of the bank's rules, which prohibited collections officers from disclosing customer's information to others. They were also prohibited from accessing the bank's customer information system without authorisation.

The court heard that from June 2018, after Dinath left the bank, he began asking Liong to help him to find out the salary details of his colleagues at MOM.

Deputy Public Prosecutor (DPP) Tan Shi Yun said that Dinath did this, on more than one occasion, because he wanted to "ascertain his standing, in respect of his salary, with his colleagues and find out if there are any differences between their salaries".

Liong agreed and conducted unauthorised searches on the bank's customer information system to find the salary details of Dinath's colleagues. He would then disclose the salary details to Dinath through messaging application WhatsApp on the same day that he did the unauthorised searches, the court heard.

Court documents did not state if Liong got anything in return for helping Dinath or how many MOM officers' salaries are available in DBS' customer information system.

It is common for salaries to be credited directed to employees' bank accounts but it is unclear if all salaries paid by MOM are credited to DBS accounts or also to those of other banks.

Dinath's requests were eventually found out after the Commercial Affairs Department under the Singapore Police Force received a report lodged by DBS on Dec 14, 2018, about Liong's unauthorised access into its system.

In a response to TODAY's query, MOM said that it was informed of police's investigations into Dinath in Dec 2018 and it had immediately redeployed him to another role, pending the outcome of investigations.

It said that his contract with the ministry was not renewed when it expired in June 2019 and he is no longer in MOM's employment.

'NO MISCHIEF, HE WAS JUST CURIOUS'

While Dinath had lower culpability than Liong in committing these crimes, the prosecution argued that Dinath had still abetted another person into disclosing the salary details when he knew that it was prohibited by the bank, and sought six to seven weeks' jail.

In Dinath's mitigation plea, his defence counsel Dhillon Surinder Singh emphasised that there was no mischief behind Dinath's intentions as he was only curious about the salaries of his colleagues at MOM.

Mr Dhillon said that after receiving the details from Liong, Dinath had not provided the salaries of his colleagues to third parties.

He added: "If only Dinath could turn the clock back, he would not have engaged in such foolish actions."

Deputy Principal District Judge Luke Tan, however, disagreed with the defence, stating that even though Dinath's motivation was to find out his MOM colleagues' salary information, it does not mean that it did not cause harm to those colleagues as the offences were committed out of self-interest.

In delivering the sentence, the judge said that Dinath was aware of the importance of banking secrecy and information contained in the banks' computers since he was a former DBS collections officer.

For abetting Liong into disclosing information under the Banking Act, Dinath could have been fined up to S$125,000 or jailed up to three years.

For abetting Liong to make the unauthorised search under the Computer Misuse Act, Dinath could have been fined up to S$5,000 or jailed up to two years, or both.

Source: https://www.todayonline.com/singapore/mom-officer-jailed-unauthorised-search-2254771

Archive: https://archive.fo/Zl32m

[Admin]

Qilin ransomware gang linked to attack on London hospitals
By Sergiu Gatlan | June 5, 2024

A ransomware attack that hit pathology services provider Synnovis on Monday and impacted several major NHS hospitals in London has now been linked to the Qilin ransomware operation.

Ciaran Martin, the inaugural CEO of the UK's National Cyber Security Centre (NCSC), said today that the Qilin gang is likely responsible for the incident

The attack has resulted in Synnovis being locked out of its systems and is causing ongoing service disruptions at Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust, and various primary care providers across south east London.

"We believe it is a Russian group of cyber criminals who call themselves Qilin," Martin told BBC Radio 4 on Wednesday.

"They're simply looking for money. It's unlikely they would have known that they would have caused such serious primary healthcare disruption when they set out to attack the company."

An alert on Synnovis' customer service portal currently warns of data center issues and that all systems are currently inaccessible.

Memos sent by officials of hospitals affected by the Synnovis ransomware attack revealed on Tuesday that this "ongoing critical incident" has had a "major impact" on their procedures and operations.

Some non-emergency pathology appointments, blood transfusions, and surgeries at the impacted London hospitals have been either postponed, canceled, or redirected to other providers.

The NHS said on Wednesday that urgent and emergency services like A&E, urgent care centers, and maternity departments are open as usual. An NHS England cyber incident response team is currently assessing the full extent of the attack and its impact on patient and employee data.

"All urgent and emergency services remain open as usual and the majority of outpatient services continue to operate as normal," an NHS spokesperson said today.

"Unfortunately, some operations and procedures which rely more heavily on pathology services have been postponed, and blood testing is being prioritised for the most urgent cases, meaning some patients have had phlebotomy appointments cancelled."

Qilin's dark web leak site is currently down, although there is no evidence that this outage is linked to the ransomware attack that hit Synnovis' systems on Monday, June 3.

The Qilin ransomware operation surfaced in August 2022 under the "Agenda" name but was rebranded as Qilin one month later.

The gang has been linked to or claimed a steady stream of victims since its launch, with over 130 companies added to its dark web leak site over the last two years. However, Qilin operators haven't been very active until attacks picked up towards the end of 2023.

Since December 2023, these cybercriminals have also been developing one of the most advanced and customizable Linux encryptors seen to date, specifically designed to target VMware ESXi virtual machines favored by enterprise organizations for their light resource needs.

Similar to other ransomware gangs targeting businesses, Qilin operates by infiltrating a company's networks and extracting data while moving through the victim's systems.

After obtaining admin credentials for the servers and collecting all sensitive data, the attackers deploy the ransomware payloads to encrypt all devices connected to the network.

They then leverage the stolen data and the encrypted files to carry out double-extortion attacks, pressuring the targeted companies to meet their demands. So far, BleepingComputer has seen ransom demands ranging from $25,000 to millions of dollars, depending on the victim's size.

Source: https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-linked-to-attack-on-london-hospitals

Archive: https://archive.fo/39QRk

Reference: Exposing Qilin’s RaaS program, https://www.group-ib.com/blog/qilin-ransomware

Archive 2: https://archive.fo/0hVSU

[Admin]

Companies advised not to pay if hit by Akira ransomware
Ng Hong Siang | 07 Jun 2024

SINGAPORE: Singapore authorities on Friday (Jun 7) issued an advisory about the Akira ransomware group and advised organisations against paying a ransom should they fall victim to an attack.

Instead, victims should immediately report the incident to the authorities, said the police, Cyber Security Agency of Singapore (CSA) and the Personal Data Protection Commission (PDPC).

Local law firm Shook Lin & Bok said in May that it was hit by a ransomware attack from the Akira group.

Suspectfile, an independent website that covers the ransomware phenomenon, reported that Shook Lin & Bok paid a ransom of US$1.4 million in Bitcoin.

The authorities said that they "do not recommend paying the ransom" when hit with a ransomware attack, and that companies should report such incidents immediately.

"Paying the ransom does not guarantee that the data will be decrypted or that threat actors will not publish your data.

"Furthermore, threat actors may see your organisation as a soft target and strike again in the future. This may also encourage them to continue their criminal activities and target more victims."

Akira ransomware first emerged in March 2023, with the threat group operating a "ransomware-as-a-service" model that targets both Windows and Linux operating systems.

The group provides its software and infrastructure to its affiliates - other cybercriminal groups - in exchange for a percentage of any ransom paid by victim organisations.

Businesses and organisations in sectors including education, finance, manufacturing, and healthcare around the world have been affected by the Akira threat group, the authorities said, adding that affiliates have been observed to be "indiscriminate" in their targets.

The proposed ransom amounts will also be based on a study of the victim organisations’ business profiles.

In the joint advisory, the authorities outlined how Akira works and provided a set of measures that organisations can use to avoid succumbing to the ransomware. This information was drawn from various sources including national CERT publications and threat intelligence reports.

HOW AKIRA WORKS

Akria affiliates have been observed to use a range of techniques to gain initial access to a victim organisation's network. These include:

• Exploiting known vulnerabilities, like a Cisco VPN service without multi-factor authentication (MFA) configured.
• Brute-forcing external-facing services such as Remote Desktop Protocol.
• Deploying social engineering campaigns to trick victims into downloading malicious software that obtains user credentials or inputting their credentials on phishing websites.
• Using compromised credentials that may have been obtained by the affiliate from access brokers who sell access to corporate networks.

Akira affiliates can sometimes create a new domain account on the compromised system to establish persistence, which they can use to maintain a connection with a target system even when the machine is rebooted or shut down.

Through the use of numerous tools, affiliates can also glean users' credentials and use them for their own ends. They can additionally grant themselves higher-level access within an organisation's security system through privilege escalation.

Once inside, Akira users can gain knowledge about the victim's system and the connected network, which can be leveraged to spread to the rest of the network.

Sensitive company information will then be exfiltrated and encrypted. Commonly used tools such as WinRAR can be used for this, with its ability to split and compress data, said the authorities.

Once data exfiltration is completed, the Akira ransomware encrypts data runs commands to inhibit system recovery and leaves a ransom note behind.

The note typically includes a code unique to each victim, along with instructions to contact the affiliates on a TOR site, or a site on the dark web.

Ransom payments are usually demanded to be paid with Bitcoin. The TOR site also contains stolen information and a list of the affected organisations.

An example of a ransom note provided by the authorities shows how the hackers attempt to pressure organisations into paying the ransom quickly: "Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately."

"Keep in mind that the faster you will get in touch, the less damage we cause."

RECOMMENDED MEASURES

The authorities advised companies to implement and regularly monitor the compliance of several mitigation measures and policies in order to reduce the risks and impact of a ransomware incident.

Organisations should enforce strong password policies requiring the use of strong passwords or passphrases requiring at least 12 characters with mixed composition- upper case letter, lower case letter, numbers and special characters.

They should also implement multi-factor authentication to minimise the risk of unauthorised access to all internet-facing services like VPNs and accounts that access critical systems.

Reputable anti-virus or anti-malware software can help to detect the presence of Akira or other ransomware variants, the authorities said.

"This can be done through real-time monitoring of system processes, network traffic, and file activity for indicators of compromise typically associated with the malware."

The software can be configured to block the execution of suspicious files, prevent unauthorised remote connections, and restrict access to sensitive files and folders.

"Organisations should periodically scan their systems and networks for vulnerabilities and regularly update all operating systems, applications, and software by applying the latest security patches promptly, especially for functions critical to the business," said the police, CSA and PDPC.

Companies using older applications that are no longer supported by the developer should migrate to newer alternatives.

Segregating networks can also help control traffic flow between sub-networks, limiting the spread of ransomware. Organisations should also monitor their logs for any suspicious activities and carry out remediation measures where necessary.

Routine backups of important data should be conducted. The authorities recommended companies follow the 3-2-1 rule when performing backups: Keep three copies of backups, store them in two different media formats and store one set of backups off-site.

Conducting incident response exercises and developing business continuity plans can help improve an organisation's readiness for a ransomware attack, they added.

Retaining only essential data and minimising the collection of personal data will also keep the impact of a data breach to a minimum.

Source: https://www.channelnewsasia.com/singapore/akira-ransomware-group-cybersecurity-4394296

Archive: https://archive.fo/KHSwz

Reference: https://www.nomoreransom.org/en/decryption-tools.html

[Admin]

594 people have lost $1.3m in online marketplace scams since April
Elaine Lee | Jun 13, 2024

SINGAPORE – A total of 594 people have lost $1.3 million to scammers on online marketplaces in the past two months, the police said on June 12.

Scammers would first pose as interested buyers on Carousell, Facebook Marketplace or other platforms.

After agreeing on the selling price of the listed items via the platforms’ in-app chat functions, the scammers would then impersonate the relevant online marketplace platforms or delivery companies to inform victims that the money was transferred.

They then send the victims a phishing link or a QR code to purportedly receive payment, schedule a delivery, or complete the transaction.

Victims who click on the link or scan the QR code would be redirected either to a spoofed bank website, or to a spoofed delivery company website, before arriving at the spoofed bank website.

“Victims would then be deceived into keying their banking credentials, credit card details and one-time passwords, thinking that it was part of collecting payment from the scammers,” the police said.

“Victims would subsequently realise that they have been scammed when they discovered unauthorised transactions made to their bank accounts or bank cards.”

There were 46,563 scam cases reported in 2023, the highest number since the police started tracking such cases in 2016, and 46.8 per cent higher than the 31,728 cases in 2022.

In total, scam victims in Singapore lost $651.8 million in 2023.

The police advised the public to apply the ACT steps to fight scams, namely: Add security features, Check for signs of a scam, and Tell the authorities and others about scams.

For more information on scams, visit www.scamalert.sg or call the Anti-Scam Hotline on 1800-722-6688.

To report scam-related information, call the police hotline on 1800-255-0000 or submit details online at www.police.gov.sg/iwitness with the assurance of confidentiality.

Source: https://www.straitstimes.com/singapore/courts-crime/594-people-have-lost-13m-in-online-marketplace-phishing-scams-since-april

Archive: https://archive.fo/aIDi2