Blog
Anomali Cyber Watch: Uber and GTA 6 Were Breached, RedLine Bundle File Advertises Itself on YouTube, Supply-Chain Attack via eCommerce Fishpig Extensions, and More
Anomali Threat Research
September 20, 2022
<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>China, Cyberespionage, Iran, Ransomware, Stealers,</b> and <b>Supply chain</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/FW4NIn6R0SDzvU1lHLeE"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3><a href="https://www.darkreading.com/attacks-breaches/hacker-pwns-uber-via-compromised-slack-account" target="_blank">Hacker Pwns Uber Via Compromised VPN Account</a></h3> <p>(published: September 16, 2022)</p> <p>On September 15, 2022, ride-sharing giant Uber started an incident response after discovering a data breach. <a href="https://twitter.com/GroupIB_GIB/status/1570821174736850945" target="_blank">According to Group-IB researchers,</a> download file name artifacts point to the attacker getting access to fresh keylogger logs affecting two Uber employees from Indonesia and Brazil that have been infected with Racoon and Vidar stealers. The attacker allegedly used a compromised VPN account credentials and performed multifactor authentication fatigue attack by requesting the MFA push notification many times and then making a social-engineering call to the affected employee. Once inside, the attacker allegedly found valid credentials for privilege escalation: a PowerShell script containing hardcoded credentials for a Thycotic privileged access management admin account. On September 18, 2022, Rockstar Games’ Grand Theft Auto 6 suffered a <a href="https://www.engadget.com/rockstar-grand-theft-auto-6-leak-155755703.html" target="_blank">confirmed data leak, likely caused </a>by the same attacker.<br/> <b>Analyst Comment:</b> Network defenders can consider setting up alerts for signs of an MFA fatigue attack such as a large number of MFA requests in a relatively short period of time. Review your source code for embedded credentials, especially those with administrative privileges.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/3905036" target="_blank">[MITRE ATT&CK] Credentials from Password Stores - T1555</a><br/> <b>Tags:</b> MFA fatigue, Social engineering, Data breach, Uber, GTA 6, GTA VI, detection:Racoon, detection:Vidar, malware-type:Keylogger, malware-type:Stealer</p> </div> <div class="trending-threat-article"> <h3><a href="https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407/" target="_blank">Self-Spreading Stealer Attacks Gamers via YouTube</a></h3> <p>(published: September 15, 2022)</p> <p>Kaspersky researchers discovered a new campaign spreading the RedLine commodity stealer. This campaign utilizes a malicious bundle: a single self-extracting archive. The bundle delivers RedLine and additional malware, which enables spreading the malicious archive by publishing promotional videos on victim’s Youtube channel. These videos target gamers with promises of “cheats” and “cracks.”<br/> <b>Analyst Comment:</b> Kids and other online gamers should be reminded to avoid illegal software. It might be better to use different machines for your gaming and banking activities.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/3905036" target="_blank">[MITRE ATT&CK] Credentials from Password Stores - T1555</a> | <a href="https://ui.threatstream.com/ttp/2402525" target="_blank">[MITRE ATT&CK] Resource Hijacking - T1496</a><br/> <b>Tags:</b> detection:RedLine, malware-type:Stealer, Bundle, Self-spreading, Telegraph, Youtube, target-industry:Games NAICS 513210</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.secureworks.com/blog/opsec-mistakes-reveal-cobalt-mirage-threat-actors" target="_blank">Opsec Mistakes Reveal COBALT MIRAGE Threat Actors</a></h3> <p>(published: September 14, 2022)</p> <p>Secureworks researchers discovered multiple identities connected to Iran-sponsored group Cobalt Mirage (Dev-0270, Nemesis Kitten). The information was derived from the group’s infrastructure connections, leaked materials, and a June 2022 ransom note PDF file metadata. The group acts as a contractor for the Iranian government, so it is able to combine cyberespionage and ransomware for-profit operations.<br/> <b>Analyst Comment:</b> All known Cobalt Mirage indicators are available in the Anomali platform and customers are advised to block these on their infrastructure. Keep your Microsoft Exchange Server updated to avoid exploitation including the ProxyShell exploits that Cobalt Mirage was seen using.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a><br/> <b>Tags:</b> actor:COBALT MIRAGE, actor:DEV-0270, ProxyShell, CVE-2021-31207, CVE-2021-34473, CVE-2021-34523, Iran, source-country:IR, detection:TunnelFish, Cyberespionage, Ransomware</p> </div> <div class="trending-threat-article"> <h3><a href="https://unit42.paloaltonetworks.com/originlogger/" target="_blank">OriginLogger: A Look at Agent Tesla’s Successor</a></h3> <p>(published: September 13, 2022)</p> <p>Palo Alto researchers analyzed OriginLogger (AgentTeslav3) and two of its leaked builders. OriginLogger is a commodity keylogger that is based on Agent Tesla code and is typically detected as Agent Tesla. It has been available since 2018 and became more prevalent in 2020. Out of all studied samples, 1,909 OriginLogger samples exfiltrated stolen data over email (SMTP protocol), 1,888 samples used file sharing servers (FTP), 1,866 samples used web uploads utilizing a PHP file, and 1,732 samples exfiltrated to Telegram channels.<br/> <b>Analyst Comment:</b> Signatures developed for Agent Tesla still mostly work for OriginLogger. Different actors using this keylogger can use additional obfuscation and different delivery methods. Keeping macros disabled in Microsoft Office documents downloaded from the Internet can dwarf one of the observed delivery vectors.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947118" target="_blank">[MITRE ATT&CK] Clipboard Data - T1115</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/947127" target="_blank">[MITRE ATT&CK] Scheduled Task - T1053</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/3905036" target="_blank">[MITRE ATT&CK] Credentials from Password Stores - T1555</a><br/> <b>Tags:</b> detection:OriginLogger, mitre-software:Agent Tesla, detection:AgentTeslav3, malware-type:Keylogger, Crypter, VBA macro, SMTP, FTP, Telegram</p> </div> <div class="trending-threat-article"> <h3><a href="https://sansec.io/research/rekoobe-fishpig-magento" target="_blank">Magento Vendor Fishpig Hacked, Backdoors Added</a></h3> <p>(published: September 13, 2022)</p> <p>Several Fishpig extensions for eCommerce Magento-WordPress integrations were compromised and served the Rekoobe remote access trojan. The file backdoored by the attackers was normally used to validate a Fishpig license, so the free Fishpig extensions that are hosted on Github were not affected. Once installed, Rekoobe removes all malware files and remains in memory only. It mimics a legitimate background process on the targeted Linux server.<br/> <b>Analyst Comment:</b> Fishpig users are advised to re-install all Fishpig extensions and restart the server. No attacker actions were observed past the installation of Rekoobe, but it is a good practice to audit the server for unauthorized files and accounts.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947137" target="_blank">[MITRE ATT&CK] Supply Chain Compromise - T1195</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a><br/> <b>Tags:</b> Magento, Fishpig, Supply chain, detection:Rekoobe, malware-type:RAT, Linux, eCommerce</p> </div> <div class="trending-threat-article"> <h3><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments" target="_blank">New Wave of Espionage Activity Targets Asian Governments</a></h3> <p>(published: September 13, 2022)</p> <p>Symantec researchers discovered a new intelligence gathering campaign targeting government and state-owned entities in Asia. The attackers are likely associated with China-sponsored APT41 (Wicked Panda). They were observed switching from delivering the ShadowPad remote access trojan to delivering multiple payloads including previously unseen Infostealer.Logdatter. This new information stealer has additional capabilities to download files, inject processes, and query SQL databases.<br/> <b>Analyst Comment:</b> Defense-in-depth is an effective way to help mitigate potential APT activity. The layering of defense mechanisms can include network and end-point security, social engineering training (such as training exercises to help detect phishing emails) for staff and robust threat intelligence capabilities. All known APT41 indicators are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a><br/> <b>Tags:</b> mitre-group:APT41, actor:Wicked Panda, CVE-2020-1472, CVE-2021-26855, target-sector:Government NAICS 92, China, source-country:CN, Cyberespionage, mitre-software:PlugX, detection:QuasarRAT, detection:Infostealer.Logdatter, detection:Trochilus RAT, detection:ShadowPad</p> </div> <div class="trending-threat-article"> <h3><a href="https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/" target="_blank">Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free</a></h3> <p>(published: September 12, 2022)</p> <p>The Lorenz ransomware group has been active since at least February 2021. The group uses the double extortion tactic by exfiltrating data and encrypting systems using its custom Lorenz ransomware or Microsoft’s BitLocker Drive Encryption. Arctic Wolf researchers analyzed recent attacks by Lorenz that started with a Mitel MiVoice VoIP appliance vulnerability (CVE-2022-29499) exploitation. Almost a month after the initial access, Lorenz proceeded with post-exploitation activity that relied heavily on open source and living off the land binaries (LOLBins): it downloaded TCP tunneling tool Chisel, used CrackMapExec for a full Local Security Authority Subsystem Service (LSASS) memory dump, and installed FileZilla to exfiltrate data.<br/> <b>Analyst Comment:</b> When attackers abuse legitimate tools, it is important to detect anomalies by establishing a baseline for the normal and expected activities inside your organization. Upgrade to MiVoice Connect Version R19.3 or older, if you have the vulnerable devices.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947138" target="_blank">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/3297595" target="_blank">[MITRE ATT&CK] Server Software Component - T1505</a> | <a href="https://ui.threatstream.com/ttp/947250" target="_blank">[MITRE ATT&CK] Standard Non-Application Layer Protocol - T1095</a> | <a href="https://ui.threatstream.com/ttp/3905359" target="_blank">[MITRE ATT&CK] Proxy - T1090</a> | <a href="https://ui.threatstream.com/ttp/3904531" target="_blank">[MITRE ATT&CK] Encrypted Channel - T1573</a> | <a href="https://ui.threatstream.com/ttp/3905348" target="_blank">[MITRE ATT&CK] OS Credential Dumping - T1003</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/947127" target="_blank">[MITRE ATT&CK] Scheduled Task - T1053</a> | <a href="https://ui.threatstream.com/ttp/947187" target="_blank">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a> | <a href="https://ui.threatstream.com/ttp/3297596" target="_blank">[MITRE ATT&CK] Software Discovery - T1518</a> | <a href="https://ui.threatstream.com/ttp/947195" target="_blank">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947162" target="_blank">[MITRE ATT&CK] Remote Services - T1021</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947224" target="_blank">[MITRE ATT&CK] Exfiltration Over Alternative Protocol - T1048</a> | <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/3297597" target="_blank">[MITRE ATT&CK] System Shutdown/Reboot - T1529</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a><br/> <b>Tags:</b> Lorenz, Ransomware, CVE-2022-29499, Mitel MiVoice Connect, FileZilla, BitLocker, ESXi, LOLBins, 0day, PowerShell, Microsoft, Double extortion, Chisel, CrackMapExec, RDP, FileZilla</p> </div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
