Category: Internet Security

Safety scientists at Trend Micro have found a new Python ransomware threat that takes credit on the achievement of Locky ransomware. The threat actors behind the ransomware have mimicked the ransom note utilized by the gang accountable for Locky. The ransomware note declares files have been encrypted by Locky Locker. Trend Micro have instead named this new ransomware threat PyLocky.

Python is a common script-writing language, even though it is not usually used for generating ransomware. There have been remarkable exclusions such as CryPy and Pyl33t which were issued in 2016 and 2017 respectively.

What makes the latest Python ransomware variation to be prominent is its anti-machine learning abilities. PyLocky unites the Inno Setup installer and PyInstaller which makes it tougher to recognize the threat utilizing static analysis techniques and machine learning-based cybersecurity solutions. Trend Micro notices that similar methods have been used in certain Cerber ransomware variations.

Pylocky ransomware was first seen in electronic mail spam campaigns carried out in July. The campaigns were targeted and comparatively small, although all through July and August, the scale of the campaigns has risen. At first, the spam electronic mail campaigns were mainly transmitted in France and Germany, even though by the end of August it was French companies that were mainly targeted with France accounting for 63.5% of attacks. A quarter of attacks were carried out in Germany, and 7.5% of attacks were carried out in New Caledonia. Variations of the ransom note have been written in English, Italian and Korean, showing the attacks may spread to other areas in the near future.

The spam electronic mails utilized to dispense PyLocky are different and use social engineering methods to get end users to visit a malevolent URL where a .zip file having the PyLocky executable file is downloaded.

If that file is run, PyLocky will hunt for files on all logical drives and will encrypt over 150 different file kinds including images files, audio files, Office documents, databases, game files, archives, video files and system files. Files are encrypted utilizing the triple-DES cipher and the original files are overwritten. As an anti-sandbox safety, PyLocky will sleep for 999,999 seconds if the system has a total memory size of less than 4GB.

There is no free decryptor available that will open files encrypted by PyLocky. Recovery without paying the ransom is only possible by reestablishing files from backups.

A huge URL deceiving campaign targeting at 76 universities in 14 countries has been found by safety students at SecureWorks.

The threat group called Cobalt Dickens is supposed to be behind the attack. The group is supposed to work out of Iran and is well known for carrying out these sorts of attacks.

The latest campaign has seen the hacking group generate over 300 deceived websites on sixteen domains. Hosted on those websites are bogus login pages for 76 universities, mainly in the United States, but also in universities in Canada, Australia, China, Israel, Japan, Switzerland, Turkey, South Africa, Italy, Germany, the Netherlands, Malaysia, and the UK.

When people are deceived into visiting the bogus login pages and enter their identifications, they are redirected to the genuine university website where they are logged in to a lawful session automatically. They will be unaware that their login identifications have been stolen. The stolen identifications are then used to gain access to the online library systems of universities and intellectual property is stolen.

Universities are appealing targets for cybercriminals. Attacks on financial organizations provide more immediate profit and healthcare companies keep large quantities of valuable data that can easily be sold to identity thieves. Nevertheless, attacks on those companies are more difficult and time-consuming as they normally have more improved cybersecurity protections.

It is much harder to secure university networks and weaknesses often exist which can be easily abused. Universities are therefore seen as easy targets. Attacks can also be very lucrative. Universities often have prized intellectual property which has not yet been commercialized. The information can give companies a substantial competitive advantage.

SecureWorks has issued indicators for the threat and a list of domains that are known to be used by the attackers. Those domains and IP addresses must be obstructed through a router, firewall, or web filter to avoid users from accessing the fake login pages.

The use of 2-factor verification is also strongly suggested. While not infallible, 2-factor verification is an important safety control that can avoid illegal people from gaining access to online resources when login identifications are stolen.  Without the second verification factor, access will be disallowed.

Security scientists at Proofpoint have found a new malware danger that is being used in targeted attacks on restaurants, hotels, and telecom companies. AdvisorsBot malware, so called since its C&C servers comprise the word advisors, was first noticed in May 2018 in a range of spam electronic mail promotions.

AdvisorsBot malware is under development even though the existing form of the malware has been used in several attacks all over the world, although the majority of those attacks have been carried out in the United States. The spam campaigns are thought to be carried out by a threat actor known to Proofpoint scientists as TA555.

AdvisorsBot isn’t linked to Marap malware, even though it operates in a similar way in that the malware is a first-stage payload which is utilized to fingerprint the sufferer and identify whether the aim is of interest and worthwhile of a more broad compromise. Proofpoint notices that these malware variations are two instances of a rising tendency of extremely versatile modular malware that can be utilized in a range of different strikes.

AdvisorsBot malware is written in C, even though another type of malware has been recognized that has been written using PowerShell with a .NET DLL in the PowerShell script. This type of the malware, which has been called PoshAdvisor, and runs in the memory without writing any data to the disk.

The scientists note that these malware variations have several anti-analysis characteristics and can identify a range of different malware analysis tools and can decide if they are running on a virtual machine. If on a VM or malware analysis tools are noticed, the malware exits.

The spam electronic mails used to provide the malware comprise a Word attachment with a macro that, if permitted to run, performs a PowerShell command that downloads a PowerShell script that performs inserted shellcode that runs AdvisorsBot.

Three different electronic mail lures have been found, each of which aims a particular industrial sector. Although the campaign seems to be targeted, electronic mails have been sent to targets unconnected to the content of the electronic mails which indicates a more haphazard distribution of the electronic mails.

Hotels are being targeted with a message that claims to have been sent by one who has earlier remained at the hotel and has been charged two times for the stay. The electronic mail attachment seems to be a bank statement displaying the double charge.

The electronic mails targeting restaurants claim that the sender of the electronic mail visited the restaurant and experienced complicated, dangerous food poisoning. The electronic mail attachment has details of disease and the opinion of a doctor, together with a warning of legal action.

The electronic mails targeting telecom companies claim to be a resume sent in a speculative application for work.

A free decryptor for Fileslocker ransomware has been created after the leaking of the master key for the ransomware on Pastebin.

The master key is the key utilized by threat actors to decrypt files that have been encoded by the ransomware. The post was generated on December 29, 2018, and states that the master key, which decrypts the secret key, is “relevant to V1, V2 version” and that the poster is “waiting for safety personnel to create decryption tools.”

A free decryptor for Fileslocker ransomware was created by Michael Gillespie, the inventor of MalwareHunterTeams’ ID Ransomware – A tool that can be utilized to decide what ransomware variation has been utilized to encrypt files.

Interestingly, a new Christmas-themed type of Fileslocker ransomware was released in late December which encrypted files and modified the Desktop wallpaper to a Christmassy background. Moreover, the browser on an infected appliance was opened and the Pastebin decryption key was shown.

In order for the free decryptor for Fileslocker ransomware to operate, a victim should upload the ransomware note from the Desktop. The ransom note has the encrypted decryption key, which is unlocked using the newly developed master key-based decryptor.

Filerlocker ransomware is a ransomware-as-a-service offering that is typically distributed by partners who get a cut of the profits from any ransom payments they make from distributing the ransomware. What is not understood is why the master key was released.

The Pastebin posting provides a hint. It finishes with the expression “The end is just the beginning,” which indicates that Fileslocker ransomware is no more and the group at the rear of the ransomware is moving on to other tasks. This is not unusual. When ransomware variations are retired, the master keys are often issued online. What the threat group moves onto subsequent is anyone’s guess, but for now, at least, any persons who are infected with Fileslocker ransomware will be able to decrypt their files for free of charge.

A fresh malware attack on Tribune Publishing has caused interruption to many newspaper print runs including those of the Los Angeles Times, San Diego Tribune, and the west coast editions of the New York Times and Wall Street Journal, among others. The Tribune Publishing cyberattack happened on Thursday, December 28, 2018, and spread all over the Tribune Publishing system on Friday, disturbing the Saturday publications of a number of newspapers that shared the same production platform.

At the outset, the interruption was attributed to a computer failure, even though the LA Times later verified it had suffered a malware attack carried out by threat actors outside the United States. The Tribune Publishing cyberattack didn’t lead to any subscriber or promoter data being accessed and is supposed to have been carried out either to intentionally cause interruption or in an attempt to extract money from Tribune Publishing.

Although the malware variant used in the attack has not been formally verified, numerous sources at the affected newspaper informed the LA Times that the attack included Ryuk ransomware, which was recognized by the extension added to encrypted files: .ryk.

Scientists at Check Point had earlier examined Ryuk ransomware and found it shares some of its source code with Hermes ransomware. The latter had been attributed to an APT danger actor called the Lazarus group: A hacking group with strong relations to North Korea.

Although it is possible that the Lazarus group has carried out the attack specially to cause interruption to News outlets, the attack might similarly have been executed by an actor who has acquired the source code to Ryuk ransomware, or the closely linked Hermes ransomware.

Ryuk ransomware first surfaced in the summer of 2018 and has been used in numerous campaigns targeting companies in the United States. Those attacks seem to have been financially inspired.

Not all agree that Lazarus is behind Ryuk ransomware. Symantec proposes that Ryuk ransomware has been dispersed by the group behind the Emotet banking Trojan and CrowdStrike has attributed Ryuk ransomware to a crime group in Eastern Europe known as Grim Spider.

It’s also presently unclear how the ransomware was connected. Ryuk ransomware campaigns earlier this year have included malspam (phishing) electronic mails. The use of RDP-based methods to connect the malware, such as the use of stolen identifications or brute force RDP attacks is also a probability. IT teams have been working round-the-clock to remediate the Tribune Publishing cyberattack. Production resumed to usual in time for the Sunday publications of the affected papers. It is unclear if the ransom was paid.