Cyber Attackers Double Down on Social Engineering Techniques and Malicious Functionalities Leading to Sharp Increase in Malware Downloads

Netskope: Attackers Double Down on Social Engineering Techniques and Malicious Functionalities Leading to Sharp Increase in Malware Downloads

Researchers Find Attackers Are Successfully Evading Detection By Blending in with Normal Network Traffic Via HTTP and HTTPS

Netskope, a leader in Secure Access Service Edge (SASE), today unveiled new research confirming that attackers are finding new ways to evade detection and blend in with normal network traffic using HTTP and HTTPS to deliver malware. In its latest Cloud & Threat Report: Global Cloud and Web Malware Trends, Netskope identified that on average, five out of every 1,000 enterprise users attempted to download malware in Q1 2023, and new malware families and variants represented 72% of those malware downloads.

Social Engineering and Search Engine Data Voids on the Rise

In the research, Netskope uncovered that nearly 10% of all malware downloads in Q1 were referred from search engines. These downloads mostly resulted from weaponized data voids, or combinations of search terms that have very few results, which means that any content matching those terms is likely to appear very high in the search results. This represents just one of many social engineering techniques that attackers are accelerating.

Social engineering as a whole continues to dominate as a leading malware infiltration technique with attackers abusing not only search engines, but email, collaboration apps, and chat apps to trick their victims. As the top two malware types, Trojans accounted for 60% of malware downloads in Q1 and phishing downloads accounted for 13%.

Evaluation of Primary Communication Channels for Attackers

For the first time in its quarterly cloud and threat reporting, Netskope analyzed attacker communication channels. Researchers found that attackers, in order to consistently evade detection, have used HTTP and HTTPS over ports 80 and 443 as their primary communication channel. In fact, of the new malware executables analyzed by Netskope that communicated with external hosts, 85% did so over port 80 (HTTP) and 67% did so over port 443 (HTTPS). This approach enables attackers to easily go unnoticed and blend in with the abundance of HTTP and HTTPS traffic already on the network.

Additionally, to evade DNS-based security controls, some malware samples sidestep DNS lookups, instead reaching out directly to remote hosts using their IP addresses. In Q1 2023, most malware samples that initiated external communications did so using a combination of IP addresses and hostnames, with 61% communicating directly with at least one IP address and 91% communicating with at least one host via a DNS lookup.

“Job number one for attackers is finding new ways to cover their tracks as enterprises put more resources into threat detection, but these findings indicate just how easy it still is for attackers to do so in plain sight,” said Ray Canzanese, Threat Research Director, Netskope Threat Labs. “As attackers gravitate towards cloud services that are widely used in the enterprise and leverage popular channels to communicate, cross-functional risk mitigation is more necessary than ever.”

Extended Look into Global Cloud and Web Malware Trends

Other notable findings uncovered by Netskope’s research team include:

• 55% of HTTP/HTTPS malware downloads came from cloud apps, up from 35% for the same period one year earlier. The primary driver of the increase is an increase in malware downloads from the most popular enterprise cloud applications, with Microsoft OneDrive tracked as the most popular enterprise app by a wide margin.
• The number of applications with malware downloads also continued to increase, reaching a high of 261 distinct apps in Q1 2023.
• Only a small fraction of total web malware downloads were delivered over web categories traditionally considered risky. Instead, downloads are spread out among a wide variety of sites, with content servers (CDNs) responsible for the largest slice, at 7.7%.

As enterprises work to defend against the onslaught of malware, cross-functional collaboration across multiple teams is required, including network, security operations, incident response, leadership, and even individual contributors. Some of the additional steps organizations can take to reduce risks include:

• Inspect all HTTP and HTTPS downloads, including all web and cloud traffic, to prevent malware from infiltrating your network
• Ensure that security controls recursively inspect the content of popular archive files and that high-risk file types are thoroughly inspected
• Configure policies to block downloads from apps that are not used in your organization to reduce risk surface.

Get the full Netskope Cloud & Threat Report: Global Cloud and Web Malware Trends here.

For more information on cloud-enabled threats and our latest findings from Netskope Threat Labs, visit Netskope’s Threat Research Hub.

About Netskope

Netskope, a global SASE leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data. Fast and easy to use, the Netskope platform provides optimized access and real-time security for people, devices, and data anywhere they go. Netskope helps customers reduce risk, accelerate performance, and get unrivaled visibility into any cloud, web, and private application activity. Thousands of customers, including more than 25 of the Fortune 100, trust Netskope and its powerful NewEdge network to address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements. Learn how Netskope helps customers be ready for anything on their SASE journey, visit netskope.com

43,000 Clipsa Malware Attacks on PCs in India -Avast

PC security maker Avast on Wednesday said it has detected and blocked over 43,000 attacks of Clipsa malware which steals passwords and mines cryptocurrencies that slows down computers.

Clipsa disguises itself as software for installing media players and infects computers when it is downloaded.

"Clipsa is an unusual password stealer. In that it supports a wide range of functionalities. Instead of just focusing on passwords and cryptowallets present on the victim's computer, Clipsa also makes PCs do cybercriminals' dirty work, like searching for vulnerable WordPress websites on the internet and brute-forcing their credentials," said Jan Rubin, malware researcher at Avast.

The campaign is most prevalent in India, where Avast has blocked more than 43,000 Clipsa infection attempts, protecting more than 28,000 users in the country from the malware, the statement said.

If a device is infected with Clipsa, users may notice PC performing slower than usual, due to malicious cryptocurrency mining being executed by the malware in the background. PTI PRS

Cryptominers Tops India Malware Threat Index

Check Point Research,  the Threat Intelligence arm of Check Point® Software Technologies Ltd. , a leading provider of cyber security solutions globally, has published its latest Global Threat Index for March 2019. The index reveals that while cryptomining services such as Coinhive have closed down, cryptominers are still the most prevalent malware aimed at organizations globally.

As announced last month, both Coinhive and Authedmine stopped their mining services on March 8th. For the first time since December 2017, Coinhive dropped from the top position but, despite having only operated for eight days in March, it was still the 6th most prevalent malware to affect organizations during the month. At its peak, Coinhive impacted 23% of organizations worldwide.

Many websites still contain the Coinhive JavaScript code today, though with no mining activity taking place., Check Point’s researchers warn that Coinhive may well reactivate if the value of Monero increases. Alternatively, other mining services may increase their activity to take advantage of Coinhive’s absence.

During March, three of the top five most prevalent malware were cryptominers – Cryptoloot, XMRig and JSEcoin. Cryptoloot headed the Threat Index for the first time, closely followed by Emotet, the modular trojan. Both had a global impact of 6%. XMRig is the third most popular malware impacting 5% of organizations worldwide.

Maya Horowitz, Threat Intelligence and Research Director at Check Point commented: “With cryptocurrencies’ values dropping overall since 2018, we will be seeing more cryptominers for browsers following Coinhive’s steps and ceasing operation. However, I suspect that cyber criminals will find ways to earn from more robust cryptomining activities, such as mining on Cloud environments, where the built-in auto-scaling feature allows the creation of a larger haul of cryptocurrency.  We have seen organizations being asked to pay hundreds of thousands of dollars to their Cloud vendors for the compute resources used illicitly by cryptominers. This is a call for action for organizations to secure their Cloud environments." 

March 2019’s Top 3 ‘Most Wanted’ Malware:

*The arrows relate to the change in rank compared to the previous month.

1. ↑ Cryptoloot - Crypto-Miner that uses the victim’s CPU or GPU power and existing resources for crypto mining - adding transactions to the blockchain and releasing new currency. It is a competitor to Coinhive, trying to pull the rug under it by asking a smaller percentage of revenue from websites.


2. ↑ Emotet – Advanced, self-propagate and modular Trojan. Emotet once used to employ as a banking Trojan, and recently is used as a distributer to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.


3. ↑ XMRig- Open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.

This month Hiddad is the most prevalent Mobile malware, replacing Lotoor at first place in the top mobile malware list. Triada remains in third place.

March’s Top 3 ‘Most Wanted’ Mobile Malware:

1. Hiddad - Android malware which repackages legitimate apps and then released them to a third-party store. Its main function is displaying ads, however it is also able to gain access to key security details built into the OS, allowing an attacker to obtain sensitive user data.


2. Lotoor- Hack tool that exploits vulnerabilities on Android operating system in order to gain root privileges on compromised mobile devices.


3. Triada - Modular Backdoor for Android which grants super user privileges to downloaded malware, as helps it to get embedded into system processes. Triada has also been seen spoofing URLs loaded in the browser.

Check Point’s researchers also analyzed the most exploited cyber vulnerabilities. CVE-2017-7269 is still leading the top exploited vulnerabilities with a 44% global impact. Web Server Exposed Git Repository Information Disclosure and is in second place, with OpenSSL TLS DTLS Heartbeat Information Disclosure in third, both impacting 40% of organizations worldwide.

March’s Top 3 ‘Most Exploited’ vulnerabilities:

1. ↔ Microsoft IIS WebDAV ScStoragePathFromUrl Buffer Overflow (CVE-2017-7269) - By sending a crafted request over a network to Microsoft Windows Server 2003 R2 through Microsoft Internet Information Services 6.0, a remote attacker could execute arbitrary code or cause a denial of service conditions on the target server. That is mainly due to a buffer overflow vulnerability resulted by improper validation of a long header in HTTP request.


2. ↑ Web Server Exposed Git Repository Information Disclosure- An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.


3. ↑ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) - An information disclosure vulnerability exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence, the largest collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors. The ThreatCloud database holds over 250 million addresses analyzed for bot discovery, more than 11 million malware signatures and over 5.5 million infected websites, and identifies millions of malware types daily.

The below table also gives you an understanding on how India is faring in terms of malware attacks as compared to global counterparts

 

Find top 10 per country
Malware_Family_Name	Description	Global Impact	INDIA Impact
XMRig	XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.	7.68%	22.64%
Coinhive	Crypto Miner designed to perform online mining of Monero cryptocurrency when a user visits a web page without the user's approval. The implanted JS uses great computational resources of the end users machines to mine coins, thus impacting its performance.	11.59%	21.40%
Dorkbot	IRC-based Worm designed to allow remote code execution by its operator, as well as the download of additional malware to the infected system, with the primary motivation being to steal sensitive information and launch denial-of-service attacks.	3.75%	12.04%
Jsecoin	JavaScript miner that can be embedded in websites. With JSEcoin, you can run the miner directly in your browser in exchange for an ad-free experience, in-game currency and other incentives.	5.57%	11.52%
Cryptoloot	cryptominer malware, using the victim’s CPU or GPU power and existing resources for crypto mining - adding transactions to the blockchain and releasing new currency. It is a competitor to Coinhive.	6.23%	10.03%
Emotet	Advanced, self-propagating and modular Trojan. Emotet used to operate as a banking Trojan, and has evolved to be used as a distributer of other malware or malicious campaigns. It uses multiple methods and evasion techniques for maintaining persistence and avoiding detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.	5.14%	7.75%
Virut	Virut is one of the major botnets and malware distributors in the Internet. It is used in DDoS attacks, spam distribution, data theft and fraud. The malware is spread through executables originating from infected devices.	1.71%	7.55%
Ramnit	Ramnit is a worm that infects and spreads mostly through removable drives and files uploaded to public FTP services. The malware creates a copy of itself to infect removable and permanent drivers. The malware also functions as a backdoor.	2.57%	7.24%
Nitol	Nitol is a Bot agent that targets the Windows platform. This malware collects basic system information and sends it to a remote server. An attacker can instruct the remote server to respond with commands primarily designed to carry out DoS attacks	1.05%	7.13%
Fireball	Fireball is an adware vastly distributed by the Chinese digital marketing company Rafotech. It acts as a browser-hijacker which changes the default search engine and installs tracking pixels, but can be turned into a full-functioning malware downloader.	1.68%	6.36%

The complete list of the top 10 malware families in March can be found on the Check Point Blog: https://blog.checkpoint.com/2019/04/09/march-2019s-most-wanted-malware-cryptomining-still-dominates-despite-coinhive-closure/

[Top Featured Image - Emsisoft Blog]

WannaCry Attacks Forces Microsoft to Release Update for OS It Doesn't Support

In the wake of the recent WannaCry ransomware saga, Software giant Microsoft has released new security updates for older versions of Windows so as to protect all its Windows customers from any such potential cyber-attacks. The move has come as a surprise to many as the giant typically issues updates only for the operating systems that it is still supporting.

The security updates by Microsoft also includes updates to Windows XP, the OS that was recently targeted by the WannaCry ransomware attack.

For the uninitiated, Ransomware is a malware that blocks access to a computer or its data and demands money to release it. The infamous malware had attacked parts of Britain’s National Health Service and other companies worldwide in May this year.

While Microsoft normally releases updates only for OS that it is still supporting- that means Windows 7 and newer versions, It decided to change its practice this time and extend its service to older versions too because it didn't want the WannaCry ransomeware episode to be repeated again. During the attack in May, the malware ended up taking advantage of un-patched versions of windows to encrpyt millions of computers worldwide.

Commenting on the new security updates, Adrienne Hall, the head of Microsoft’s Cyber Defense Operations Center talked to the Guardian and said, “Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt [alternative name to WannaCry]."

According to industry insiders, the recently released NSA hacking tools, which were released online by an entity calling itself The Shadow Brokers has led Microsoft to believe that there is a potential for state-sanctioned attacks to take place sometime in the near future. The Shadow Brokers were the ones who were responsible for exposing the vulnerability, referred to by the NSA as EternalBlue, which led to WannaCry being able to replicate itself and cause so much chaos all around the globe.

The new security updates by Microsoft will be taking care of a total of 16 vulnerabilities, of which Microsoft believes 15 are critical.

While some welcomed Microsoft's move to include older versions, others weren't so happy and argued that by providing these updates it is just sending out a message to those recalcitrant corporations still using Windows XP to continue using the older version as if and when something serious comes up, Microsoft will update it anyway. However, one needs to take note that more older the Windows version more risk they are putting on the security of their OS and thus their organisation's future.

While WannaCry ransomware couldn't affect Windows XP, it did get to some systems which were running Windows Vista, which is a slightly newer unsupported version of OS.

[Top Image: PSYCHODAILY]

BrickerBot- A New Mirai-Like Malware Targeting Insecure Internet of Things (IoT) Devices

If you're an IoT device owner, our advice to you would be to get the security of all your internet-connected devices in line as soon as possible. The urgent warning is being issued because a new threat called 'BrickerBot' has recently been discovered that is allegedly targeting insecure Internet of Things (IoT) devices.

What is interesting about BrickerBot malware is the fact that instead of harnessing the IoT devices to a distributed denial of service (DDoS) network, it only threatens to permanently brick them instead. This is the reason that IoT experts are still contemplating if the malware is malicious in intent, or it has just been created to take down known vulnerable devices off the internet so that they don't pose any threat in the future. The authors of BrickerBot are currently unknown.

The malware was recently detected on DDoS protection company Radware maintained honeypot servers. The type of attack have been described as a "permanent denial-of-service" (PDoS).

According to a threat advisory issued by Radware, over a four-day period, their honeypot had detected 1,895 PDoS attempts performed from several locations around the world. It also said that the sole purpose of these attacks was to compromise IoT devices and corrupt their storage.

The company has also claimed that they had detected two distinct, different waves of what it has named BrickerBot from different bot-nets. According to the company, the second one was concealed by Tor egress nodes.

Giving out details, Radware said that the BrickerBot PDoS attack made use of Telnet brute force- the same exploit vector used by the Mirai last year to plague internet-connected devices in over 177 countries- to breach a user's insecure IoT device. The company further revealed since Bricker does not try to download a binary, so it unfortunately does not have a complete list of credentials that were used for the brute force attempt. However, they were still successful in recording first attempted username/password pair, which was consistently 'root'/'vizxv'."

Even IoT devices that boost of having hard-wired credentials could become victims to such a targeted attack.

Radware further explained in detail what all did the malware do once successfully accessing a device. After gaining access, the PDoS bot would immediately perform a series of Linux commands that would lead to corrupted storage, followed by commands to disrupt device performance, Internet connectivity, and wipe-off of all files present on the device.

Among the special devices targeted by the malware are, MultiMediaCard, which is a special device type that matches memory card standard, a solid-state storage medium, and Memory Technology Device, which is a special device type to match flash characteristics.

According to Radware researchers, the version of BrickerBot picked up by its honeypot servers is targeted at Linux/BusyBox IoT devices that have their Telnet ports open and publicly exposed to the internet, which is similar to devices that were targeted by Mirai in October.

So, IoT device owners, get your devices in orders as soon as possible because it always "better to be safe than sorry."

BrickerBot- A New Mirai-Like Malware Targeting Insecure Internet of Things (IoT) Devices

If you're an IoT device owner, our advice to you would be to get the security of all your internet-connected devices in line as soon as possible. The urgent warning is being issued because a new threat called 'BrickerBot' has recently been discovered that is allegedly targeting insecure Internet of Things (IoT) devices.

What is interesting about BrickerBot malware is the fact that instead of harnessing the IoT devices to a distributed denial of service (DDoS) network, it only threatens to permanently brick them instead. This is the reason that IoT experts are still contemplating if the malware is malicious in intent, or it has just been created to take down known vulnerable devices off the internet so that they don't pose any threat in the future. The authors of BrickerBot are currently unknown.

The malware was recently detected on DDoS protection company Radware maintained honeypot servers. The type of attack have been described as a "permanent denial-of-service" (PDoS).

According to a threat advisory issued by Radware, over a four-day period, their honeypot had detected 1,895 PDoS attempts performed from several locations around the world. It also said that the sole purpose of these attacks was to compromise IoT devices and corrupt their storage.

The company has also claimed that they had detected two distinct, different waves of what it has named BrickerBot from different bot-nets. According to the company, the second one was concealed by Tor egress nodes.

Giving out details, Radware said that the BrickerBot PDoS attack made use of Telnet brute force- the same exploit vector used by the Mirai last year to plague internet-connected devices in over 177 countries- to breach a user's insecure IoT device. The company further revealed since Bricker does not try to download a binary, so it unfortunately does not have a complete list of credentials that were used for the brute force attempt. However, they were still successful in recording first attempted username/password pair, which was consistently 'root'/'vizxv'."

Even IoT devices that boost of having hard-wired credentials could become victims to such a targeted attack.

Radware further explained in detail what all did the malware do once successfully accessing a device. After gaining access, the PDoS bot would immediately perform a series of Linux commands that would lead to corrupted storage, followed by commands to disrupt device performance, Internet connectivity, and wipe-off of all files present on the device.

Among the special devices targeted by the malware are, MultiMediaCard, which is a special device type that matches memory card standard, a solid-state storage medium, and Memory Technology Device, which is a special device type to match flash characteristics.

According to Radware researchers, the version of BrickerBot picked up by its honeypot servers is targeted at Linux/BusyBox IoT devices that have their Telnet ports open and publicly exposed to the internet, which is similar to devices that were targeted by Mirai in October.

So, IoT device owners, get your devices in orders as soon as possible because it always "better to be safe than sorry."

This Anti-Mirai Tool Makes Your IoT Device Hack Proof

In October, we reported a story about how IoT device owners all around the world needed to be beware of Mirai, the malware, that had single-handedly been responsible for causing one of the worst distributed denial of service (DDoS) cyberattacks that the world had experienced in the last few years, and how it had now managed to spread and infect internet-connected devices in over 177 countries all around the world.

Mirai is so powerful a malware that it had successfully managed to take down Spotify, Twitter, and a number of other so-called high security websites. And since October, there has been no stopping Mirai's growing pace. But now, a new security tool has been developed that has the potential of letting IoT devices owners know if their devices are vulnerable to Mirai's vicious attack.

In the past, the malware has been used in distributed denial of service (DDoS) attacks. Mirai is basically works by scouting for insecure Internet of Things devices, and once that is done, it uses them as bot-nets to do its bidding. And since the malware’s source code has already been leaked, it can used by basically anyone to use/misuse.

Mirai was successful in causing massive outrage in October when it targeted Dyn, a major name in the domain name service (DNS) provider sector. The case saw Internet of Things being put to use to break the internet.

Seeing the havoc that Mirai had managed to achieve and was still causing, Imperva decided to do something about the situation and was successful in determining a way to know if the IoT devices were vulnerable to malwares like Mirai. The best thing is, one doesn't have to buy or install anything to use it -- all that one has to do is to visit the scanner website on the device that you want to check. The scanner then comes to action and analyses the IP address, smart products details used for internet access.

This is how the Mirai scanner works:



1) Initiate a scan request.
2) Once scan request is initiated, the scanner comes to action and looks for connected devices on ports 22/23.
3) The third step involves the scanner testing if a device can be accessed with passwords from Mirai's dictionary.
4) The scan results are finally furnished.

The main issue here is that the scanner can’t do much about the affected devices themselves. If during a scan, one of your connected devices comes out to be vulnerable to Mirai, an immediate step that you should take is change its login credentials from the ones set by the manufacturer by default. If somehow that isn’t possible, or if you don’t know how to do it on your own, you will have to make a quick decision on whether you intend to put your device at risk or just simply stop using it altogether.

Malware like Mirai are the reason that security experts all around the world fear the growing popularity of the Internet of Things.

Read More - https://www.incapsula.com/blog/mirai-scanner-unwitting-mirai-botnet-recruit.html

[Top Image - Shutterstock]