Newsletter compiled by Jonathan Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
Generally, when we write about a threat group or attack, that threat will calm down for a while. After all, it’s much for difficult for these threats to survive once awareness spreads about them. However, in the case of Sea Turtle, they’ve actually doubled down on their DNS hijacking techniques. Our new research indicates this group has developed a new way to secretly redirect DNSs, and they’re unlikely to slow down any time soon.
Ransomware has been making headlines over the past 12 months. Between Atlanta, Baltimore and, most recently, two cities in Florida, governments have been taken down by attackers looking for extortion payments. In the case of the two Florida cities, they chose to pay the extortion payment to the attackers, while Atlanta and Baltimore chose to go the more expensive route and manually recover their data. Which route is best? Which makes the most fiscal sense? We tried to find out in a roundtable featuring experts from Cisco Talos and Cisco Incident Response.
We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week. Due to the Fourth of July holiday in the U.S., expect our blog and social media to be fairly quiet over the next few days.
Upcoming public engagements with Talos
Event: “DNS on Fire” at Black Hat USALocation: Mandalay Bay, Las Vegs, Nevada
Date: Aug. 7
Speaker: Warren Mercer
Synopsis: In this talk, Warren will go over two recent malicious threat actors targeting DNS protocol along with the methodology used to target victims, timeline, and technical details. The first is a piece of malware, “DNSpionage,” targeting government agencies in the Middle East and an airline. The second actor, more advanced and aggressive than the previous one, is behind the campaign we named “Sea Turtle.”
Event: “It’s never DNS…It was DNS: How adversaries are abusing network blind spots” at SecTor
Location: Metro Toronto Convention Center, Toronto, Canada
Date: Oct. 7 - 10
Speaker: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Cyber Security Week in Review
- A new version of the surveillance tool FinSpy has been spotted in the wild stealing information from government and law enforcement agencies. Security researchers say the actors behind the attack appear to monitor mobile device updates closely and constantly tailor FinSpy to avoid detection.
- GitHub is cracking down on open-source versions of a deepfake software that can make some people appear naked in videos. The creator of “DeepNude” destroyed the original app, but other creators had tried uploading clones to the code repository.
- A vulnerability in the Zoom video conference app could allow an attacker to unknowingly turn on some Mac users’ cameras. The best current workaround is to update the Zoom Mac app and disable the feature that allows Zoom to turn on the camera when joining a meeting.
- Adobe’s monthly security update included fixes for vulnerabilities in DreamWeaver, Experience Manager and Bridge CC. None of the bugs are considered critical.
- A malicious app on Android known as “Agent Smith” was downloaded more than 25 million times before being removed. The malware disguised itself as a Google updater but instead made modifications to legitimate apps such as WhatsApp.
- The U.K.’s privacy watchdog is preparing to fine Marriott the equivalent of more than $11 million for a data breach last year. More than 339 million guests across the globe had their information accessed in an attack that dates back to 2014 but was only disclosed in 2018.
- Microsoft security researchers discovered a new fileless campaign that uses living-off-the-land techniques. Known as “Astaroth,” the attack only runs system tools throughout its attack chain.
- The Buhtrap APT exploited a Windows zero-day to spy on government institutions in Eastern Europe and Central Asia. The targeted campaigns abused a NULL pointer dereference in the Windows win32k.sys component, which has since been patched.
- Apple patched a bug in iMessage that could allow an attacker to completely brick a device. If a user opened a message containing a specific string of characters, they would have to perform a factor reset to regain access to their device.
Notable recent security issues
Title: Microsoft Patch TuesdayDescription: Microsoft released its monthly security update this week, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 77 vulnerabilities, 16 of which are rated “critical," 60 that are considered “important” and one “moderate.” This month’s security update covers security issues in a variety of Microsoft’s products, including the Chakra scripting engine, Internet Explorer and the Windows Server DHCP service.
Snort SIDs: 45142, 45143, 46548, 46549, 49380, 49381, 50198, 50199, 50662 - 50683
Title: Cisco warns of three critical vulnerabilities in DNA Center
Description: Cisco released fixes for three critical bugs in its DNA Center last week. Two of the vulnerabilities — which both have a CVSS score of 9.8 out of 10 — involve Cisco Data Center Network manager. The flaws could allow an attacker to gain a valid session cookie or create arbitrary files on the victim machine’s underlying Cisco Data Center Network Manager (DCNM).
Snort SIDs: 50622, 50637, 50650 - 50653
Most prevalent malware files this week
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b
MD5: 42143a53581e0304b08f61c2ef8032d7
Typical Filename: N/A
Claimed Product: JPMorganChase Instructions SMG 82749206.pdf
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos
SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
Article Link: http://feedproxy.google.com/~r/feedburner/Talos/~3/WWaoCya3bbk/threat-source-newsletter-july-11-2019.html