Connect with us

Press Release

Malware is now being concealed by hackers in Windows Event Logs.

Published

on

Malware is now being concealed by hackers in Windows Event Logs.

Undocumented publicly for attacks in the wild, security researchers have discovered a malicious operation that leveraged Windows event logs to contain malware.

The assault’s threat actor was able to use the technology to introduce fileless malware into the file system as part of a covert attack using a variety of techniques and modules.

Payloads are added to Windows event logs.
After being recognised as a threat on a customer’s computer by a commercial product equipped with technologies for behavior-based detection and anomaly control, researchers at Kaspersky collected a sample of the virus.

According to the study, the malware utilised a sizable number of both custom-made and commercially available tools as part of a “highly targeted” effort.
One of the most intriguing aspects of the attack is the bespoke malware dropper’s injection of shellcode payloads into Windows event logs for the Key Management Services (KMS).

According to Kaspersky’s lead security researcher Denis Legezo, the malicious campaign marked the first time this technique had been deployed “in the field.”

At order to load malicious code via DLL search order hijacking, the dropper copies the genuine OS error handling programme WerFault.exe to “C:WindowsTasks” before dropping an encrypted binary resource to the “wer.dll” (Windows Error Reporting) in the same location.

A hacking method called DLL hijacking uses weak security checks in normal programmes to load a malicious Dynamic Link Library (DLL) into memory from any location.

According to Legezo, the dropper’s functions include looking for specific entries in the event logs (category 0x4142, or ‘AB’ in ASCII), as well as putting data onto the disc for the side-loading procedure. In the absence of such a record, it generates 8KB chunks of encrypted shellcode that are then merged to create the code for the subsequent stager.

Given that the source code for injecting payloads into Windows event logs has been publicly available for a short while, the new technique examined by Kaspersky is probably on its way to becoming more well-known.

Advanced technical actor
Legezo states that the overall campaign “looks remarkable” based on the numerous methods and modules (pen-testing suites, personalised anti-detection wrappers, and final stage trojans) utilised in it.

He claimed to an APT-level adversary, saying to BleepingComputer that “the actor behind the campaign is pretty adept by itself, or at least has a good set of quite sophisticated commercial tools.”

The commercial penetration testing frameworks Cobalt Strike and NetSPI were among the tools utilised in the attack (the former SilentBreak).

Although the researcher believes that some of the attack’s modules are original, they may really be a part of the NetSPI platform, which testing required a paid licence for.

For instance, two trojans with the names ThrowbackDLL.dll and SlingshotDLL.dll could represent tools that belong to the SilentBreak penetration testing framework and are known to use those names.

According to the research, the attack started in September 2021 when the victim fell for a scam to download a RAR archive from the file-sharing website file.io.

The Cobalt Strike module, which was signed with a certificate from the business Fast Invest ApS, was subsequently distributed by the threat actor. 15 files were signed with the certificate, but none of them were genuine.

According to the researcher, the ultimate goal of targeted malware with such last stager functionality is typically to collect some valuable data from the victims.

When analysing the attack, Kaspersky did not discover any resemblances to earlier efforts linked to a recognised threat actor.

The researchers label the new activity SilentBreak, after the name of the tool most frequently employed in the attack, until a connection with a known opponent is made.

 

Continue Reading

Press Release

Microsoft fumbles supply chain and acknowledges signing rootkit malware.

Published

on

Microsoft fumbles supply chain and acknowledges signing rootkit malware.

As of right now, Microsoft has admitted to signing a malicious driver that is disseminated in gaming contexts.

This “Netfilter”-named driver is actually a rootkit that has been seen interacting with Chinese C2 IP addresses.

Last week, the whole infosec. community joined G Data malware specialist Karsten Hahn in tracking down and analysing the malicious drivers that bore the Microsoft logo.

This incident exposed vulnerabilities to software supply-chain security once more, but this time it was caused by a flaw in the code-signing procedure used by Microsoft.

Rootkit “Netfilter” driver is Microsoft-signed.
A Microsoft signed driver dubbed “Netfilter” was detected last week by G Data’s cybersecurity alert systems as what at first glance appeared to be a false positive, but wasn’t.

The driver in question was observed interacting with C&C IPs based in China, which had no valid functionality and raised red flags.

This is when Karsten Hahn, a malware analyst at G Data, disclosed this publicly and contacted Microsoft at the same time:

Since Windows Vista, all code that operates in kernel mode must be tested and certified before being made available to the public in order to maintain the stability of the operating system.

According to Hahn, “Drivers without a Microsoft certificate cannot be deployed by default.”

At that time, BleepingComputer started tracking C2 URL behaviour and approached Microsoft for a comment.

A list of further routes (URLs), denoted by the pipe (“|”) symbol, are returned by the first C2 URL:

Each of these, in Hahn’s opinion, has a function:

The URL that ends in “/p” refers to proxy settings, “/s” offers encoded redirection IPs, “/h?” is for getting CPU-ID, “/c” offered a root certificate, and “/v?” refers to the malware’s self-updating capabilities.
For instance, as observed by BleepingComputer, the malicious Netfilter driver in question (residing at “/d3”) was accessible via the “/v?” path at the following URL:

After thoroughly examining the driver, the G Data researcher came to the conclusion that it was malware.

In a thorough blog post, the researcher examined the driver, its ability to self-update, and Indicators of Compromise (IOCs).

According to Hahn, the sample features a self-update routine that transmits its own MD5 hash to the server via the URL hxxp:/110.42.4.180:2081/v?v=6&m=.

An illustration of a request would be as follows:

hxxp:/110.42.4.180:2081/v?v=6&m=921fa8a5442e9bf3fe727e770cded4ab
“The server then replies with either ‘OK’ if the sample is current or the URL for the most recent sample, such as hxxp:/110.42.4.180:2081/d6. As a result, the malware replaces its own file “further information from the researcher

Other malware specialists like Johann Aydinbas, Takahiro Haruyama, and Florian Roth worked with Hahn during his analysis.

Roth has offered YARA rules for recognising them in your network environments after being able to compile the list of samples in a spreadsheet.

Microsoft is looking at a bad actor who spreads harmful drivers inside of gaming environments.

“In order to be certified by the Windows Hardware Compatibility Program, the actor supplied drivers. A third party created the drivers.”

Microsoft stated yesterday, “We have stopped the account and checked their uploads for additional indicators of malware.”

Microsoft claims that the threat actor primarily targeted the gaming industry in China with these malicious drivers and that there is currently no evidence that enterprise environments have been impacted.

Microsoft is waiting before blaming nation-state actors for this incident.

Sophisticated threat actors may take advantage of falsely signed binaries to help launch extensive software supply-chain attacks.

A well-known event in which code-signing certificates were taken from Realtek and JMicron to assist the comprehensive Stuxnet attack on Iran’s nuclear programme.

However, this specific instance has shown flaws in a reliable code-signing procedure, which threat actors have exploited to obtain Microsoft-signed code without jeopardising any certifications.

Continue Reading

Press Release

FlexBooker reports a data breach, affecting more than 3.7 million accounts.

Published

on

FlexBooker reports a data breach, affecting more than 3.7 million accounts.

In an attack just before the holidays, the accounts of over three million customers of the American appointment scheduling service FlexBooker were taken, and they are now being exchanged on hacker forums.

The same hackers are also selling databases they claim to be from two other organisations: the Australian case management system rediCASE and the racing media outlet Racing.com.

Holiday breaches before
A few days before Christmas, there were supposedly three breaches, and the intruder posted the information on a hacking forum.

A popular programme for booking appointments and syncing employee calendars, FlexBooker, appears to be the source of the most recent data dump.

Owners of any company that needs to plan appointments, such as accountants, barbers, doctors, mechanics, lawyers, dentists, gyms, salons, therapists, trainers, spas, and the list goes on, are among FlexBooker’s clients.

The group claiming responsibility for the attack appears to go by the name of Uawrongteam, and they published links to files and archives containing personal information, including pictures, driver’s licences, and other IDs.

The database, according to Uawrongteam, has a table with 10 million lines of client data, including everything from payment forms and charges to pictures taken for driver’s licences.

Names, emails, phone numbers, password salt, and hashed passwords are among the database’s “juicy columns,” according to the actor.

Customers of FlexBooker have received a data breach notification that confirms the attack and that data on the service’s Amazon cloud storage system was “accessed and downloaded” by the intruders.

The letter states that “our account on Amazon’s AWS servers was compromised on December 23, 2021, starting at 4:05 PM EST,” adding that the attackers did not obtain “any credit card or other payment card information.”

FlexBooker advised consumers to be on the lookout for strange or fraudulent activities, and to monitor account statements and credit reports.

For further information, the developer also directed users to a report on a distributed denial-of-service (DDoS) attack. It was then determined that some customers’ personal information had been obtained by the hackers.

The FlexBooker assault exposed email addresses, names, partial credit card information, passwords, and phone numbers for more than 3.7 million users, according to the data breach reporting service Have I Been Pwned.

Prior to FlexBooker, the threat actor known as Uawrongteam distributed links to material that was purportedly taken from Racing.com, a digital television station that broadcasts horse racing and offers news, stats, and event calendars associated with the sport.

The data from the Redbourne Gang’s rediCASE Case Management Software, which is utilised by numerous enterprises in addition to health and community agencies, looks to be another target of the same group.

Continue Reading

Press Release

The New York Times reports that investigators are investigating whether solarwinds has been hacked via offices in Czech, Polish, and Belorussia, where many of the company’s engineering has taken place (NEW YORK TIMES).

Published

on

solarwinds

Sources: investigators are checking if SolarWinds was hacked via its offices in Czechia, Poland, and Belarus, where the company moved much of its engineering  —  Those behind the widespread intrusion into government and corporate networks exploited seams in U.S. defenses and gave away nothing to American monitoring of their systems.

Continue Reading

Trending