<p><b>Figure 1: IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p><h2>Trending Threats</h2><p>This section provides summaries and links to the top threat intelligence stories from this past week. All IOCs from these stories are attached to this threat briefing and can be used for indicator matching against your logs.</p><p><a href="https://www.bleepingcomputer.com/news/security/ex-admin-deletes-all-customer-data-and-wipes-servers-of-dutch-hosting-provider/" target="_blank"><b>Ex-Admin Deletes All Customer Data and Wipes Servers of Dutch Hosting Provider </b></a> (<i>June 9, 2017</i>)<br/> The Dutch hosting provider, Verelox experienced a significant breach after a former IT administrator deleted all of their customer data. The former employee also wiped most of the company’s servers. The company is asking all of their customers to reset their passwords. At the time of this writing, it is unknown if Verelox will be able to retrieve the deleted customer data.<br/> <b>Recommendation:</b> Ensure that your server is always running the most current software version. Additionally, maintaining secure passwords for RDP and other remote access systems is paramount, and passwords should be changed on a frequent basis. Intrusion detection systems and intrusion prevention systems can also assist in identifying and preventing attacks against your company's network. Furthermore, always practice Defense in Depth (don't rely on single security mechanisms - security measures should be layered, redundant, and failsafe). Furthermore, maintaining comprehensive backups files is important to help ensure the security of important customer data.<br/> <b>Tags:</b> Breach</p><p><a href="https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-as-a-service" target="_blank"><b>MacRansom: Offered as Ransomware-as-a-Service </b></a> (<i>June 9, 2017</i>)<br/> A Ransomware-as-a-Service (RaaS) has been discovered to be targeting macOS users, according to Fortinet researchers. The malware, called "MacRansom," is being offered by actors who claim to be engineers at Yahoo and Facebook in what appears to be attempts to add trust for potential buyers. MacRansom is advertised to be capable of infecting users by moving the malware to a USB drive and then running the program.<br/> <b>Recommendation:</b> Ransomware is a continually evolving threat. It is paramount to have a comprehensive and tested backup solution in place. In the unfortunate case a reproducible backup is not in place, make sure to check for a decryptor before considering payment; avoid payment at all costs. Ransomware should be reported to law enforcement agencies who are doing their best to track these actors and prevent ransom from being a profitable business for cyber criminals.<br/> <b>Tags:</b> RaaS, MacRansom</p><p><a href="http://blog.trendmicro.com/trendlabs-security-intelligence/mouseover-otlard-gootkit/" target="_blank"><b>Mouse Over, Macro: Spam Run in Europe Uses Hover Action to Deliver Banking Trojan </b></a> (<i>June 9, 2017</i>)<br/> A new malspam campaign has been identified to be distributing the banking trojan called Gootkit (Otlard), according to Trend Micro researchers. Gootkit was first discovered in 2012 and is capable of multiple forms of malicious activity such as browser manipulation, credential theft, network traffic monitoring, and remote access capability. In this campaign, some of the spam emails are financially themed with subject lines such as "Fee," and "Purchase Orders" that request the recipient to open the attachment. If opened, a hyperlink will try to open if the user hovers over the text that requests that macros be enabled in order to properly view the document.<br/> <b>Recommendation:</b> Malspam is a constant threat used by malicious actors who are consistently changing the themes of the messages to trick unsuspecting recipients. Anti-spam and antivirus application provided from trusted vendors should be employed in addition to educating your employees to identify such attempts. Additionally, Microsoft Office will not ask a user to leave a protected view mode to view the content of the document.<br/> <b>Tags:</b> Malspam, Banking trojan</p><p><a href="http://www.malware-traffic-analysis.net/2017/06/08/index2.html" target="_blank"><b>Hancitor Malspam (Dropbox-Themed) </b></a> (<i>June 8, 2017</i>)<br/> A malspam campaign has been identified to be impersonating the file sharing software, Dropbox. The content of the email purports that a payment invoice has been shared and requests the recipient to view the file to identify any potential "questions" about the document. If the attachment is opened, it requests that "Enable editing" be clicked which, if done, will begin the infection process of the Hancitor malware. The Hancitor malware is capable of downloading additional malware to steal information from the compromised machine.<br/> <b>Recommendation:</b> Educate your employees on the risks of opening attachments from unknown senders. Anti-spam and antivirus applications provided from trusted vendors should also be employed. Emails that are received from unknown senders should be carefully avoided, and attachments from such senders should not be opened. Additionally, Microsoft Office will not ask a user to leave a protected view mode to view the content of the document.<br/> <b>Tags:</b> Malspam, Dropbox-themed</p><p><a href="https://www.bleepingcomputer.com/news/security/certlock-trojan-blocks-security-programs-by-disallowing-their-certificates/" target="_blank"><b>CertLock Trojan Blocks Security Programs by Disallowing Their Certificates</b></a> (<i>June 8, 2017</i>)<br/> Researchers have discovered a new malware campaign that is capable of preventing antivirus programs from running on the infected machines. The malware, dubbed "CertLock," is being distributed by threat actors by concealing it in program bundles such as miners. CertLock prevents antivirus software from running by adding the vendors digital certificate to a revoked certificate list. Once the antivirus software is blocked, actors would be able to download additional malware.<br/> <b>Recommendation:</b> This story depicts the dangers of downloading free program bundles. The appeal of free, potentially useful software can cause some users to become infected with malware after downloading it themselves. Software should only be downloaded from trusted and verified sources.<br/> <b>Tags:</b> Malware, CertLock</p><p><a href="http://www.securityweek.com/russian-hackers-target-montenegro-country-joins-nato" target="_blank"><b>Russian Hackers Target Montenegro as Country Joins NATO</b></a> (<i>June 7, 2017</i>)<br/> Montenegro has officially joined the North Atlantic Treaty Organization (NATO), amid pressure from Russia to do otherwise. Researchers believe that the Russian-linked threat group, APT28, is targeting Montenegro government officials with NATO-themed spearphishing emails in response. The spearphishing emails have been identified to exploit Adobe Flash vulnerabilities.<br/> <b>Recommendation:</b> This story represents potential threats and attacks that can arise based on current political geopolitical developments. Therefore, awareness of tension between countries and governments can potentially grant some insight as to where attacks may originate. It is crucial that server software be kept up-to-date with the most current versions and that all external facing assets are carefully monitored and scanned for unusual activity and vulnerabilities. The ability to easily restore from backup, incident response planning, and customer communication channels should all be established before a breach occurs.<br/> <b>Tags:</b> Spearphishing</p><p><a href="http://pwc.blogs.com/cyber_security_updates/2017/06/trickbots-bag-of-tricks.html" target="_blank"><b>TrickBot's Bag of Tricks </b></a> (<i>June 6, 2017</i>)<br/> Threat Intelligence Analyst, Bart Parys, has recently released new information regarding the TrickBot banking trojan. At the time of this writing, TrickBot's Multi-Purpose Internet Mail Extensions (MIME) data is similar to the Dyre banking trojan. Additionally, TrickBot also has the ability for Dynamic Link Library (DLL) injection to a web browser in order to perform web injection. TrickBot is also capable of generating a Domain Generation Algorithm (DGA) to direct users to a website that impersonates legitimate banking websites to steal financial information.<br/> <b>Recommendation:</b> Malware authors are always innovating new methods of communicating back to the control servers. Always practice Defense in Depth (don't rely on single security mechanisms - security measures should be layered, redundant, and failsafe). Multi-factor authentication should be also be used when performing financial tasks.<br/> <b>Tags:</b> Malware, Trickbot</p><p><a href="https://blog.eset.ie/2017/06/06/turlas-watering-hole-campaign-an-updated-firefox-extension-abusing-instagram/" target="_blank"><b>Turla's Watering Hole Campaign: An Updated Firefox Extension Abusing Instagram </b></a> (<i>June 6, 2017</i>)<br/> ESET researchers have discovered that the Advanced Persistent Threat (APT) group "Turla" is engaged in a new watering hole campaign. The group is known to compromise websites, typically associated with government embassies, in order to redirect visitors to Turla watering hole C2s. It was also discovered in February 2017 that Turla was distributing malicious Word document attachments via spear phishing emails that dropped a Firefox web browser extension. The group has now resumed this form of malicious activity. The extension is called "HTML5 Encoding 0.3.7" and functions as a backdoor. It will steal information and then send it back to a C2 via a URL that is generated in Instagram comments.<br/> <b>Recommendation:</b> Spear phishing emails represent a significant security risk because the sending email will often appear legitimate to the target; sometimes a target company email is compromised and used for such emails. Education is the best defense, inform your employees on what to expect for information requests from their managers and colleagues. Employees should also be aware of whom to contact when they suspect they are the target of a possible spear phishing attack. Additionally, emails could be signed with cryptographic signatures in order for employees to properly identify legitimate information requests.<br/> <b>Tags:</b> APT, Turla</p><p><a href="https://www.zscaler.com/blogs/research/malicious-android-ads-leading-drive-downloads" target="_blank"><b>Malicious Android Ads Leading to Drive By Downloads </b></a> (<i>June 5, 2017</i>)<br/> Zscaler researchers have identified a new malvertising campaign that is targeting Android users. This campaign is installing a malicious application onto the user's device that visits certain website forums called "Ks Clean." The application poses as an Android cleaner application that, upon the automatic download, presents the user with a screen that forces the user to accept an "Update" by clicking "OK." Once clicked, the application will request administrator rights, which then must be Installed and then Activated. If the rights are granted, the application is capable of a variety of different capabilities such as accessing external storage locations, downloading files, and stealing device information, among others.<br/> <b>Recommendation:</b> Your company should have appropriate anti-virus, anti-spam, and policies in place that will prevent your employees from visiting potentially malicious websites. Education is also a great mitigation technique that can assist your company in awareness of the risks posed by visiting less reputable online locations. Additionally, automatic downloads should be disabled in Android web browsers.<br/> <b>Tags:</b> Malvertising, Android</p><p><a href="https://blogs.rsa.com/shadowfall/" target="_blank"><b>Shadowfall </b></a> (<i>June 5, 2017</i>)<br/> RSA researchers, in collaboration with other researchers and organizations, have published their findings regarding analysis of the RIG Exploit Kit. The researchers discovered that a significant portion of RIG's infrastructure from February 21 and March 20, 2017 was created via domain shadowing. Domain shadowing is a "technique in which attackers steal domain account credentials from their owners for the purpose of creating subdomains directed at malicious servers." The primary method used to direct users to RIG is being conducted by compromising legitimate websites.<br/> <b>Recommendation:</b> Exploit kits have become one of the most common types of crimeware currently available to the less than sophisticated threat actor. The kits, put together by skilled actors, are then sold to criminal groups as easily deployable exploitation frameworks. The best protection from exploit kits is through employee education in combination with keeping web browsing software (including extensions such as flash and java) up to date at all times, as well as operating system software. Users should be educated on how to browse the web as safely as possible, and to report any suspicious symptoms observed on their devices to IT/secops immediately. In the case of a compromise by RIG, the infected system must be wiped and reformatted.<br/> <b>Tags:</b> RIG EK</p><h2>Observed Threats</h2><p>This section includes the top threats observed from the Anomali Community user base as well as sensors deployed by Anomali Labs. A ThreatStream account is required to view this section. <a href="https://www.anomali.com/products/threatstream">Click here to request a trial.</a></p><p><a href="https://ui.threatstream.com/tip/7471" target="_blank"><b>RIG exploit kit Tool Tip</b></a><br/> The RIG exploit kit is a framework used to exploit client side vulnerabilities in web browsers. The RIG exploit kit takes advantage of vulnerabilities in Internet Explorer, Adobe flash, Java and Microsoft Silverlight. The RIG exploit kit was first observed in early 2014. The RIG exploit kit's objective is to upload malicious code to the target system. The RIG exploit kit is known to distribute ransomware, spambots and backdoors. Victims are redirected to the RIG exploit kit with a landing page coming from malvertising or compromised sites.<br/> <b>Tags:</b> RIG, exploitkit</p>