Is technology amplifying threats in relationships? | Kaspersky official blog

/in

The rise of online dating has created a fertile ground for manipulation and in today’s digital world, it’s easy to trust someone that you’ve never met in person, sharing personal details or intimate images before you truly understand who they are. In fact, our recent study reveals that 39% of people aged 25-34 have shared intimate images with someone they’ve never met in real life.

Unfortunately, this openness is often exploited. Whether it’s through intimate image abuse, stalkerware, or deepfakes, online daters are increasingly vulnerable to dangers that weren’t as common just a few years ago. With that in mind, here’s a breakdown of the top three threats to watch out for.

1. Private photos, public nightmares: the growing threat of image abuse

Intimate image abuse (IIA), or “revenge porn” is a harmful form of digital abuse. As sharing intimate images becomes more normalized, many feel secure when trusting partners or online matches with personal photos. In our “Naked Truth” survey of 9,000 people, nearly half reported experiencing or knowing someone who had been affected by Intimate Image Abuse. The issue is particularly severe among younger generations, with 69% of 16-24-year-olds admitting that they’ve been exposed to it. Despite the risks, victim-blaming remains common, with 50% of respondents believing that those who share intimate images are responsible if they’re leaked, reflecting a widespread misunderstanding of consent and privacy.

How to protect yourself:

Think twice before sharing: сonsider the potential consequences of sharing private images and gauge the level of trust with the recipient.
Stay informed: many social media platforms have systems in place to detect and remove non-consensual intimate images. Learn how to report such content.
Manage your passwords wisely: always use a reliable password manager, like Kaspersky Password Manager, to create and store strong, unique passwords for each account. Avoid reusing passwords across multiple platforms, as this can make you more vulnerable to breaches.

2. When your apps spy on you: the threat of stalkerware

Stalkerware is software that secretly tracks a person’s location, messages, and daily activities, often disguised as anti-theft or parental control tools but used for malicious purposes. In 2023, over 31,000 cases of stalkerware were identified globally, a 6% rise from the previous year. Countries most affected include Germany, France, and the UK. Many victims are unaware they’re being monitored due to the hidden nature of these apps. Beyond stalkerware, tools like GPS tracking and social media are also being misused, with 34% of people admitting to checking their date’s profiles as “due diligence.”

How to protect yourself:

Be vigilant: look for signs of stalkerware on your device, such as unusual battery drain, apps you don’t recognize, or sudden permission changes.
Avoid tampering with stalkerware: if you believe stalkerware is on your device, do not attempt to erase or disable it on your own. This could tip off the perpetrator or delete important evidence that could be used in legal action. Instead, contact a local support organization or consult the Coalition Against Stalkerware for expert help.
Update your privacy settings: regularly review app permissions and adjust privacy settings to minimize the risk of being monitored.

3. Deepfake threats: when what you see isn’t real

Deepfakes use artificial intelligence (AI) to create hyper-realistic fake images, videos and even audio recordings. Once dismissed as low-quality, easy-to-spot tricks, deepfakes have now evolved to become incredibly convincing. Open-source tools have made it easy for anyone with basic tech skills to create deepfakes, making this technology a growing concern in online relationships.

While celebrity deepfakes were the first to capture the public’s attention, ordinary individuals are now victims of this technology. In romantic contexts, deepfakes can be used to create fake compromising images or videos. These materials are then used for blackmail, with perpetrators threatening to release the content unless their demands are met.

How to protect yourself:

Know the warning signs: be cautious if someone makes threats involving compromising media. They could be using deepfake technology.
Report deepfakes: many platforms now use AI detection tools to flag and remove deepfake content. If you are targeted, report the content to the platform.
Stay informed: awareness is key. Educate yourself about deepfake technology and its potential misuse in online dating.

Building a Safer Digital Space: A Call for Education

Education is key to reducing online dating risks. Consent in the digital world must be ongoing, not a one-time agreement. 30% of men believe receiving an intimate image means they own it, highlighting a serious issue around digital privacy. Targeted education for boys and men is crucial to address intimate image abuse, stalking, and harassment. As technology reshapes relationships, we must stay informed and vigilant to protect against growing threats like image abuse, stalkerware, and deepfakes.

By understanding these risks and taking steps to protect ourselves, by Installing a comprehensive security solution such as Kaspersky Premium, you can help protect your devices from threats like stalkerware and other malware.

For more details, read our report and safe dating guide.

Kaspersky official blog – ​Read More

Introducing Safebrowsing: Explore Suspicious Links in a Safe Virtual Browser

/in

Current security measures against phishing links focus on automated checks and timely blocking before they reach users. Yet, some links still make it to their targets, leaving them vulnerable as they often have no simple, fast, and reliable tool at hand to check these links at the final stage. 

To address this security gap, we created Safebrowsing, which makes it easy to safely and easily open any link and manually verify its content.

What is Safebrowsing? 

Safebrowsing offers a fully-interactive browser in the cloud that lets you open and navigate any website as you normally would in a completely isolated and secure environment. This ensures that any malicious activity encountered during browsing is contained and does not affect your local systems or network. 

With Safebrowsing, you can launch a quick virtual browser session to manually explore potentially harmful URLs. The service identifies malicious content in real time using ANY.RUN‘s proprietary technology and notifies you about it.  

After each session, you receive a list of indicators of compromise (IOCs) along with a detailed threat report. 

Safebrowsing gives you the ability to follow the entire chain of attack when facing phishing threats and get an in-depth network traffic analysis, including: 

Connections  

DNS and HTTP requests 

Network threats identified by Suricata IDS 

Free beta of Safebrowsing is available to all ANY.RUN users 



Try it now


How does it work? 

Safebrowsing is built to be simple and effective, letting you quickly run analysis in three steps: 

Step 1: Submit URL

You can quickly submit any URL to open it in a safe virtual browser

You enter the URL of the website you want to analyze and hit “Browse”. 

Step 2: Interact and Examine Threats

You are free to interact with websites just like in a standard browser

You interact with the website, clicking links, opening tabs, solving CAPTCHAs, and seeing what happens after each step with your own eyes.

The service lets you observe network traffic and learn about detected threats

While you explore, the service monitors the websites for any malicious content and lets you know about the danger. 

Step 3: Collect IOCs

Safebrowsing provides a list of identified IOCs

Once you finish, the service generates a report outlining detected threats and suspicious activities, as well as lets you export packet data in PCAP. 

Safebrowsing demonstration 

The service quickly identifies malicious content and provides access to triggered Suricata detection rules

Check out the video above in which we investigate a phishing link using Safebrowsing. 

How is Safebrowsing different from the ANY.RUN sandbox? 

Unlike our advanced malware sandbox, Safebrowsing focuses exclusively on URL analysis.  

It provides a less complex interface that eliminates the need for in-depth system monitoring and file system access, which makes it easy-to-use for non-experts. Yet, ANY.RUN’s signature interactivity is still there. 

How is Safebrowsing different from a URL scanner? 

Compared to URL scanners that simply check any given URL against a database of known malicious URLs, Safebrowsing provides a fully interactive environment for exploring websites. 

What are possible use cases for Safebrowsing? 

Safebrowsing is a universal tool that can be of great help in different scenarios.  

Open URLs within a secure, isolated, and full-size virtual browser to prevent any potential threats from affecting your local system. 

Speed up the process of analyzing and responding to suspicious links.   

Make link checks safe, simple, and quick for non-security employees. 

Prevent infections and increase the general level of security in the organization. 

Demonstrate the risks of clicking on suspicious links as part of training on safe browsing practices. 

Observe network traffic for malicious activity to detect threats in real time. 

Improve detection of phishing threats thanks to ANY.RUN’s advanced capabilities. 

Download traffic data and the identified indicators of compromise. 

Share the completed session as evidence of malicious content. 

How Safebrowsing can help your business 

Phishing Protection  

By allowing your team to safely explore suspicious URLs, Safebrowsing helps in identifying phishing attempts before they can impact your organization. The proactive approach significantly reduces the risk of data breaches and financial losses. 

Staff Training  

Safebrowsing can be used as a training tool to educate employees about the dangers of phishing and other web-based threats. By demonstrating real-world examples in a safe environment, you can enhance your team’s awareness and preparedness. 

Empowering Non-Expert Employees  

Safebrowsing equips non-expert employees with a fast and safe way to check suspicious links without needing to involve the security team. This saves time and resources, allowing your security professionals to focus on more critical tasks 

Try Safebrowsing beta now 

Real-time threat detection, fast performance, and easy-to-use interface make Safebrowsing a perfect tool for any individual and organization that wants to avoid falling victim to phishing attacks.  

The FREE beta version is available to all ANY.RUN users. 

Analyze your first URL right away. 

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

Detect malware in seconds

Interact with samples in real time

Save time and money on sandbox setup and maintenance

Record and study all aspects of malware behavior

Collaborate with your team 

Scale as you need

Request free trial →

The post Introducing Safebrowsing: Explore Suspicious Links in a Safe Virtual Browser appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Critical Vulnerability Discovered in Versa Director: What Organizations Need to Know

/in

Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has highlighted a vulnerability in Versa Networks’ Versa Director, a centralized management platform for Secure SD-WAN and SASE solutions. This vulnerability, identified as CVE-2024-45229, stems from improper input validation and affects various versions of the software. Organizations using vulnerable versions of Versa Director are urged to take immediate action to protect their network security.

Versa Director plays an important role in orchestrating and managing network and security policies across diverse locations. Its REST APIs facilitate automation and streamline operations through a unified interface, allowing IT teams to configure and monitor their network systems efficiently. However, the recent vulnerability exposes critical weaknesses that could compromise its effectiveness and, more importantly, the security of the organizations utilizing it.

The identified flaw involves improper input validation in certain APIs that do not require authentication by design. For Versa Directors connected directly to the Internet, attackers could potentially exploit this vulnerability by injecting invalid arguments into a GET request. This could expose authentication tokens of currently logged-in users, which can then be used to access additional APIs on port 9183. Importantly, this exploit does not reveal usernames or passwords, but the implications of token exposure could lead to broader security breaches.

Affected Versions and Severity Assessment

The vulnerability identified in Versa Director, tracked as CVE-2024-45229, highlights critical security risks that organizations must address promptly. This flaw arises from improper input validation in certain REST APIs, which are integral to the platform’s operation. As a centralized management solution for Secure SD-WAN and SASE, Versa Director plays a vital role in orchestrating and managing network and security policies across various locations. The implications of this vulnerability can impact the security and functionality of network operations for affected organizations.

The vulnerability affects multiple versions of Versa Director, specifically those released prior to September 9, 2024, including 22.1.4, 22.1.3, and 22.1.2, along with all versions of 22.1.1, 21.2.3, and 21.2.2. The CVSS score assigned to this vulnerability is 6.6, indicating a high severity level. The flaw primarily stems from certain APIs that, by design, do not require authentication. These include interfaces for logging in, displaying banners, and registering devices.

When Versa Directors are directly connected to the Internet, attackers can exploit this vulnerability by injecting invalid arguments into a GET request. This exploitation can lead to the unauthorized exposure of authentication tokens belonging to currently logged-in users. While this flaw does not compromise usernames or passwords, the exposure of these tokens can allow attackers to access additional APIs. Such unauthorized access could facilitate broader security breaches, potentially impacting sensitive data and operational integrity.

Conclusion

The vulnerability discovered in Versa Director represents a serious security risk, particularly for the instances exposed to the Internet. As the management platform plays a crucial role in network operations, organizations need to prioritize patching and security enhancements. The CISA advisory highlights the importance of being proactive in addressing vulnerabilities, as failure to do so could lead to severe consequences, including data breaches and operational disruptions.

Mitigation and Recommendations


Implement the latest patches provided by Versa Networks immediately.

Upgrade from version 22.1.1 to 22.1.3 and from 21.2.2 to 21.2.3 for comprehensive protection.

Critical systems are isolated through network segmentation to limit potential attack surfaces.

Using Web Application Firewalls (WAF) or API gateways to block access to vulnerable URLs.

Utilizing advanced Security Information and Event Management (SIEM) systems to detect unusual activities.

Regularly reviewing logs and alerts for real-time threat identification.

Uncover weaknesses in the network infrastructure.

Remediate vulnerabilities before malicious actors can exploit them.

The post Critical Vulnerability Discovered in Versa Director: What Organizations Need to Know appeared first on Cyble.

Blog – Cyble – ​Read More

Kransom Ransomware: New Threat Using DLL-Sideloading to Hijack Popular RPG

/in

Recently, our team of analysts discovered a sample of a yet-unknown ransomware that they dubbed Kransom. The malware employed the malicious DLL-sideloading technique to hijack the execution flow of an .exe file belonging to the popular game Honkai: Star Rail. Here is everything we have on the threat so far.

Initial Infection Vector

View the sandbox session for detailed analysis.

The archive distributed as part of the Kransom attack analyzed in the ANY.RUN sandbox

The Kransom ransomware attack began with a deceptive archive containing two files: an executable and a DLL (Dynamic Link Library) file.

The certificate of the executable found inside the archive

The executable was signed with a valid certificate from COGNOSPHERE PTE. LTD, the publishing company for Honkai: Star Rail, a popular RPG. 

Easily analyze malware and phishing in ANY.RUN sandbox 



Sign up for free


DLL Side-Loading Technique

The .exe and .dll files extracted from the archive in the ANY.RUN sandbox

Kransom employs a technique known as DLL side-loading to evade detection and inject its malicious payload. The method involves loading a malicious DLL into the process of a legitimate application.

ANY.RUN sandbox lists all the malicious activities performed by the ransomware 

Upon launching the legitimate executable named “StarRail.exe”, the user triggers the loading of the malicious DLL (see analysis of StarRailBase.dll), which is responsible for initiating the infection and encrypting the victim’s files.

File Encryption Method

Kransom utilizes a simple XOR encryption algorithm with a weak key (0xaa) to encrypt files on the infected system.

The Static discovering window displaying one of the encrypted files

ANY.RUN’s sandbox helps you track all the encrypted files and see their contents.

Ransom Note

Following successful file encryption, Kransom drops a ransom note that instructs the user to contact “hoyoverse” for solutions. 

The ransom note shared with victims

This is a social engineering tactic designed to impersonate the game’s legitimate developer, Hoyoverse, and extort money from victims.

Collecting Threat Intelligence on Kransom Ransomware

To stay updated on the latest Kransom attacks and enrich your investigations to this and other threats, use Threat intelligence Lookup. 

The service pulls threat data from thousands of public malware and phishing samples analyzed in the ANY.RUN sandbox on a daily basis.

It lets you search its database using over 40 different parameters, helping you zero in on threat using different details like registry keys, IP addresses, mutexes, and more.

Here is an example of a query you can use to find more samples of Kransom that use the DLL-sideloading technique:

fileName:”StarRailBase.dll”

We can gather more intelligence using the name of the file used in the attack 

The service returns more than 20 sandbox sessions that you can explore along with synchronization events and files that match the query.

Start your first investigation in TI Lookup 



Request a free trial


Conclusion

The targeting of games like Honkai: Star Rail in ransomware attacks suggests a potential risk of threat actors using similar methods with other popular software. Organizations need to stay alert and take proactive steps to protect their systems. This includes being careful with downloads from unknown sources, receiving official software updates, and using reliable tools like ANY.RUN’s Interactive Sandbox and Threat Intelligence Lookup as part of a layered security architecture.

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

Detect malware in seconds

Interact with samples in real time

Save time and money on sandbox setup and maintenance

Record and study all aspects of malware behavior

Collaborate with your team 

Scale as you need

Request free trial →

The post Kransom Ransomware: New Threat Using DLL-Sideloading to Hijack Popular RPG appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Necro Trojan infects 11 million Android devices | Kaspersky official blog

/in

Here at Kaspersky Daily we’re forever urging readers of our blog to be real careful when downloading content to their devices. After all, even Google Play isn’t immune to malware — let alone unofficial sources with mods and hacked versions. For as long as the digital world keeps turning, Trojans will continue to worm their way onto devices that don’t have reliable protection.

Today we tell the story of how 11 million Android users worldwide fell victim to the Necro Trojan. Read on to learn which apps we found it in — and how to protect yourself.

What is Necro

Our regular readers may recall reading about Necro when we first wrote about it back in 2019. Back then, our experts discovered a Trojan in CamScanner, a text recognition app, which had clocked up over 100 million downloads on Google Play. Now the “necromancers” have injected new blood into the old Trojan: we found a version richer in features both in popular apps on Google Play and in various app mods on unofficial sites. Most likely, the developers of these apps used an unverified ad integration tool through which Necro infiltrated the code.

Today’s Necro is a loader obfuscated to avoid detection (but that didn’t stop us from finding it). It downloads the malicious payload in no less a crafty way using steganography to hide its code in a seemingly harmless image.

And downloaded malicious modules are able to load and run any DEX files (compiled code written for Android), install downloaded apps, tunnel through the victim’s device, and even — potentially — take out paid subscriptions. In addition, they can display and interact with ads in invisible windows, as well as open arbitrary links and run any JavaScript code.

Read more about how Necro is designed and how it operates on our Securelist blog.

Where Necro hides

We found traces of the malware in a user-modded version of Spotify, in the photo editing app Wuta Camera, in Max Browser, and in mods for both WhatsApp and popular games (including Minecraft).

In modded Spotify

At the very start of our investigation, our eye was caught by an unusual modification of the Spotify Plus app. Users were invited to download a new version of their favorite app from an unofficial source — for free and with an unlocked subscription offering unlimited listening, both online and off. The nice green Download Spotify MOD APK button looks so tempting, right? Stop! It’s malware. Never mind the Security Verified and Official Certification guarantees; this app will wreak havoc.

Well I never, all versions are viewable. Could Necro or other Trojans be lurking there too?

When this app was launched, the Trojan sent information about the infected device to the attackers’ C2 server, and in response got a link to download a PNG image. The malicious payload was hidden in this image by means of steganography.

In apps on Google Play

While the Spotify mod was distributed through unofficial channels, the Necro-infected Wuta Camera found its way onto Google Play, from where the app was downloaded more than 10 million times. According to our data, the Necro loader penetrated version 6.3.2.148 of Wuta Camera, with clean versions starting from 6.3.7.138. So, if your version is lower than that, you need to update immediately.

The impressive download count and decent ratings masked a Trojan

Max Browser’s audience is much smaller — just one million users. Necro infiltrated its app code in version 1.2.0. The app was removed from Google Play following our notification, but it’s still available on third-party resources. These, of course, should be trusted even less, since trojanized versions of the browser may still live there.

In mods for WhatsApp, Minecraft, and other popular apps

Alternative messenger clients usually boast more features than their official cousins. But you should treat all mods, be they on Google Play or a third-party site, as suspicious, for they often come bundled with Trojans.

For instance, we found mods for WhatsApp with the Necro loader being distributed from unofficial sources, as well as mods for Minecraft, Stumble Guys, Car Parking Multiplayer, and Melon Sandbox. And this selection sure isn’t random — attackers always target the most popular games and apps.

How to guard against Necro

First of all, we strongly advise against downloading apps from unofficial sources because the risk of device infection is extremely high. Secondly, apps on Google Play and other official platforms should also be treated with a healthy dose of skepticism. Even a popular app like Wuta Camera, with 10 million downloads, proved powerless in the face of Necro.

Make sure to protect your devices so as not to be caught off guard by a Trojan. Kaspersky for Android detects Necro and other similar malware.
Check the app page in the store before downloading. We particularly recommend looking at reviews with low ratings, as these generally give heads-up about potential pitfalls. Rave reviews could be fake, while a high overall score is easy to inflate.
Don’t look for mods or hacked versions. Such apps are almost always stuffed with all kinds of Trojans: from the most harmless to mobile spyware like CanesSpy.

Kaspersky official blog – ​Read More

Undetected Android Spyware Targeting Individuals In South Korea

/in

Key Takeaways


Since June 2024, a new Android Spyware campaign has been identified targeting individuals in South Korea, leveraging an Amazon AWS S3 bucket as its Command and Control (C&C) server.

The Spyware is capable of exfiltrating sensitive information from an infected device, including SMSs, contact lists, images, and videos.

The stolen data, stored openly on the S3 bucket, suggests poor operational security, potentially leading to unintended leaks of sensitive information.

The spyware operates with a simple source code and few key permissions, demonstrating that even simple malware can be highly effective in exfiltrating sensitive data.

The malware remained undetected by all major antivirus solutions. Four unique samples were identified, exhibiting zero detection rates across all engines.

Overview

Cyble Research and Intelligence Labs (CRIL) has uncovered a previously undetected Android spyware campaign targeting individuals in South Korea, which has been active since June 2024. The spyware leverages an Amazon AWS S3 bucket as its Command and Control (C&C) server and is designed to exfiltrate sensitive data from compromised devices, including contacts, SMS messages, images, and videos.

The spyware samples observed disguise themselves as live video apps, adult apps, refund apps, and interior design applications. Below are the icons used by the malware.

Two malicious URLs distributing the spyware have been identified:


hxxps://refundkorea[.]cyou/REFUND%20KOREA.apk

hxxps://bobocam365[.]icu/downloads/pnx01.apk

Since its emergence, this malware has remained undetected by all security solutions, allowing it to operate stealthily. CRIL has identified four unique samples linked to this spyware, all exhibiting zero detection rates across major antivirus engines.

All identified spyware samples were observed communicating with the same Command and Control (C&C) server hosted on an Amazon S3 bucket: hxxps://phone-books[.]s3.ap-northeast-2.amazonaws.com/. Our analysis revealed that the stolen data, including contacts, SMS messages, images, and videos, was openly stored in the S3 bucket (C&C server), further confirming that the malware specifically targeted individuals in South Korea.

The attackers’ poor operational security resulted in the unintentional exposure of sensitive data. We reported the misuse of the AmazonAWS S3 bucket to Amazon Trust and Safety, which disabled access to the URL and made the data no longer accessible. Furthermore, our investigation found no other C&C servers utilizing S3 buckets or exposing stolen data linked to this campaign.

Technical Details

After installation, all spyware samples display a single screen with a message in Korean tailored to the app’s theme.

The source code of this spyware is relatively simple. It utilizes a minimal set of permissions, including “READ_SMS,” “READ_CONTACTS,” and “READ_EXTERNAL_STORAGE,” to carry out its malicious operations. The manifest file specifies only the main activity, which triggers the malicious functionality upon execution.

Upon installation, the spyware requests the necessary permissions; once granted, it executes its malicious functions. These functions, responsible for collecting data from the infected device, are executed within the API method “onRequestPermissionsResult”, as illustrated in the image below.

To exfiltrate images and videos, the malware queries the device’s content provider and uploads each file to the C&C server via the endpoint “/media/+filename”. This behavior is evident in the exposed data, as shown in Figure 3.

The malware gathers contacts and SMS messages from the infected device and stores them in two separate files: phone.json for contacts and sms.json for SMS data. These files are then transmitted to the C&C server, as demonstrated in the figure below.

Conclusion

This campaign highlights the growing sophistication of Android spyware targeting individuals in South Korea. By utilizing an Amazon AWS S3 bucket for Command and Control infrastructure, the threat actors were able to maintain stealth and evade detection for an extended period. This spyware strain utilizes a minimalist approach—leveraging only a few key permissions to exfiltrate sensitive data such as contacts, SMS messages, images, and videos—and demonstrates how even simple malware can be extremely effective.

It is concerning that attackers are increasingly turning to trusted cloud services like AWS as part of their malicious infrastructure. This tactic allows them to bypass traditional security measures and stay under the radar.

Our Recommendations

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:


Download and install software only from official app stores like Google Play Store or the iOS App Store.

Use a reputed anti-virus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices.

Use strong passwords and enforce multi-factor authentication wherever possible.

Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device where possible.

Be wary of opening any links received via SMS or emails delivered to your phone.

Ensure that Google Play Protect is enabled on Android devices.

Be careful while enabling any permissions.

Keep your devices, operating systems, and applications updated.

MITRE ATT&CK® Techniques

Tactic
Technique ID
Procedure

Initial Access (TA0027)
Phishing (T1660)
Malware distribution via phishing site

Collection (TA0035)
Protected User Data: Contact List (T1636.003)
The malware collects contacts from the infected device

Collection (TA0035)
Protected User Data: SMS Messages
(T1636.004)
Steals SMSs from the infected device

Collection (TA0035)
Data from the Local System (T1533)
Malware steals images and videos from an infected device

Command and Control (TA0037)
Application Layer Protocol: Web Protocols (T1437)
Malware uses HTTPS protocol for C&C communication

Exfiltration (TA0036)
Exfiltration Over C2 Channel (T1646)
Sending exfiltrated data over C&C server

Indicators of Compromise (IOCs)

Indicators
Indicator Type
Description

afc2baf71bc16bdcef943172eb172793759d483470cce99e542d750d2ffee851 63952a785e2c273a4dc939adc46930f9599b9438 1d7bbb5340a617cd008314b197844047
SHA256 SHA1 MD5
Spyware hashes

d9106d06d55b075757b2ca6a280141cbdaff698094a7bec787e210b00ad04cde 46eb3ba5206baf89752fe247eff9ce64858f4135 68e6401293e525bf583bade1c1a36855
SHA256 SHA1 MD5
Spyware hashes

a8e398fc4b483a1779706d227203647db3e04d305057fdc7f3f6a4318677b9c8 d07a165b1b7c177c2f57b292ae1b2429b6187e45 16139baf56200f3975e607f89e39419a
SHA256 SHA1 MD5
Spyware hashes

3608f739c66c9ca18628fecded6c3843630118baaab80e11a2bacee428ef01b3 1fc56a6d34f1a59a4987c3f8ff266f867e80d35c fa073ca9ae9173bb5f0384471486cce2
SHA256 SHA1 MD5
Spyware hashes

hxxps://phone-books.s3.ap-northeast-2.amazonaws.com/
URL
C&C server

hxxps://bobocam365[.]icu/downloads/pnx01.apk
hxxps://refundkorea[.]cyou/REFUND%20KOREA.apk
URL
Distribution URL

The post Undetected Android Spyware Targeting Individuals In South Korea appeared first on Cyble.

Blog – Cyble – ​Read More

FBI, CISA warning over false claims of hacked voter data – Week in security with Tony Anscombe

/in

With just weeks to go before the US presidential election, the FBI and the CISA are warning about attempts to sow distrust in the electoral process

WeLiveSecurity – ​Read More

Cyble Sensor Intelligence: Attacks, Phishing Scams and Brute-Force Detections

/in

Key Takeaways


Five exploits of recent vulnerabilities were detected by Cyble honeypot sensors this week.

A 9.8-severity PHP flaw identified in June remains under widespread attack, and organizations are urged to upgrade as soon as possible.

Cyble researchers also identified 9 phishing scams, a number of very active brute-force attack networks, and the most commonly targeted ports.

Security teams are advised to use the information provided to harden defenses

Overview

The Cyble Global Sensor Intelligence Network, or CGSI, monitors and captures real-time attack data through Cyble’s network of Honeypot sensors. This week, Cyble’s Threat Hunting service discovered and investigated dozens of exploit attempts, malware intrusions, financial fraud, and brute-force attacks. 

The full report is available to subscribers; here we’ll cover a number of important attacks and exploits that security teams need to be aware of, plus Cyble investigations into phishing campaigns and brute force attacks. The report covers the week of Sept. 11-Sept. 17.

Attack Case Studies

The Cyble Sensor Intelligence report examined 18 attacks in all; here are five that stand out.

CVE-2024-7954: Arbitrary Code Execution Vulnerability in SPIP’s Porte Plume Plugin

CVE-2024-7954 affects the porte_plume plugin in SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16, and allows remote unauthenticated attackers to ecute arbitrary PHP code by sending a specially crafted HTTP request. Users should upgrade to patched versions to mitigate this vulnerability.

CVE-2024-7120: OS Command Injection Vulnerability in Raisecom MSG Devices

CVE-2024-7120 is a critical OS command injection vulnerability in the web interface of Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running version 3.90. The flaw in the list_base_config.php file allows remote attackers to exploit the template parameter to execute arbitrary commands. Public exploits are available for this vulnerability.

CVE-2024-4577: PHP CGI Argument Injection Vulnerability

CVE-2024-4577 is a critical PHP vulnerability that impacts CGI configurations. It enables attackers to execute arbitrary commands through specially crafted URL parameters. Given PHP’s importance and wide use, impacted organizations must upgrade to a more secure PHP version as soon as possible.

CVE-2024-36401: GeoServer Vulnerability Allows Remote Code Execution via Unsafe XPath Evaluation

CVE-2024-36401 is a critical RCE vulnerability in GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2. The flaw arises from the unsafe evaluation of OGC request parameters as XPath expressions, allowing unauthenticated users to execute arbitrary code on default installations. The issue affects all GeoServer instances due to improper handling of simple feature types. Patches are available, and a workaround involves removing the vulnerable gt-complex library, though it may impact functionality.

CVE-2024-7029: Network Command Injection Vulnerability Without Authentication in AVTECH IP Cameras

CVE-2024-7029 allows remote attackers to inject and execute commands over the network without requiring authentication. This critical flaw poses a significant risk, enabling unauthorized control over affected systems. AVM1203, firmware version FullImg-1023-1007-1011-1009 and prior, are affected, and other IP cameras and network video recorder products may also be affected.

Phishing Scams Identified

Cyble researchers identified nine email phishing scams this week. Below are the subject lines and deceptive email addresses used in the scams, along with a description of each.

E-mail Subject 
Scammers Email ID 
Scam Type 
Description 

COMPASSION FUND OF 5.5 MILLION DOLLARS. 
info@uba.group.org 
Charity Scam 
Fake charitable fund to steal personal or financial details 

Compensation 
info.us.com 
Compensation Scam 
Offering fake compensation to collect sensitive data 

Dear Beneficiary !!! 
info@federalreservebank.com 
Impersonation Scam 
Scammers posing as a bank CEO to solicit sensitive information 

FACEBOOK GIFTS 
info@fam-koeppel.de 
Social Media Giveaway Scam 
Pretending to offer gifts to steal personal info 

WINNING GIFTS 
fachrisalman.2020@student.uny.ac.id 
Lottery/Prize Scam 
Fake prize winnings to extort money or information 

INVESTMENT PROPOSAL 
David@uS.com 
Investment Scam 
Unrealistic investment offers to steal funds or data 

UN Compensation Fund 
info@usa.com 
Government Organization Scam 
Fake UN compensation to collect financial details 

Your abandoned shipment 
contact@wine.plala.or.jp 
Shipping Scam 
Unclaimed shipment trick to demand fees or details 

RE: Request Commercial We need your product 
accounts@eswil.com 
Business Commercial Scam 
Fake business requests to obtain goods without payment 

Brute-Force Attacks

Brute-force attacks consist of an attacker submitting many passwords or passphrases with the hope of eventually guessing a combination correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found. A brute force attack uses the trial-and-error method to guess login info and encryption keys or to find a hidden web page. Hackers work through all possible combinations, hoping to guess correctly.

Cyble observed thousands of brute-force attacks in the last week. A close inspection of the distribution of attacked ports based on the top five attacker countries revealed that attacks originating from the United States targeted ports 3389 (60%), 445 (19%), 22 (13%), 5900 (6%), and 9200 (3%). Attacks originating from Russia targeted ports 5900 (96%), 445 (2%), 25 (1%), 3389 (1%), and 1025 (1%). Attacks originating from The Netherlands, India, and Bulgaria largely targeted ports 5900 and 445.

 Security analysts are advised to add security system blocks for the attacked ports (such as 22, 3389, 443, 445, 5900, and 3306).

The most frequently used usernames and passwords in brute-force attacks are shown in the figure below. The analysis report indicates brute-force attacks on IT automation software and servers frequently employing usernames such as 3comcso, elasticsearch, and hadoop and database attacks as in mysql and Postgres. Some of the most common username/password combinations were “root”, “admin”, “password”, “123456”, etc. Hence, it is critically important to set up strong passwords for servers and devices, and to always change default credentials.

Cyble Recommendations

Cyble researchers offered a number of recommendations for subscribers in the report:


Blocking the listed hashes, URLs, and email info on security systems.

Immediately patching all open vulnerabilities listed here and routinely monitoring the top Suricata alerts in internal networks.

Constantly check for attackers’ ASNs and IPs in the real-time attack table.

Block brute force attack IPs and the targeted ports listed in the IoC table in security products.

Immediately resetting default usernames and passwords to mitigate brute-force attacks and enforce periodic changes.

For servers, set up strong passwords that are difficult to guess.

The post Cyble Sensor Intelligence: Attacks, Phishing Scams and Brute-Force Detections appeared first on Cyble.

Blog – Cyble – ​Read More

HED: Weekly IT Vulnerability Report for September 11 – September 17, 2024

/in

Key Takeaways


This week, the U.S. Cyber Security and Infrastructure Agency (CISA) incorporated seven vulnerabilities to its Known Exploited Vulnerability (KEV) catalog based on evidence of active exploitation.  

The team at Cyble Research and Intelligence Labs analyzed multiple high- and critical-severity CVEs impacting products and software used worldwide. One such vulnerability is CVE-2024-38812, which impacts the VMware vCenter Server and can be remotely exploited without any user interaction. 

CRIL also assessed a high probability of certain vulnerabilities that attackers can use in malicious campaigns, including data breaches and supply chain attacks. Namely, CVE-2024-29847, which impacts Ivanti Endpoint Manager, CVE-2024-45694, an arbitrary code exaction vulnerability impacting D-Link wireless routers, and CVE-2024-45409, which impacts GitLab CE/EE instance.

CRIL’s dark web monitoring sensors observed 15 instances on underground forums and Telegram channels, where vulnerability and Proof of Concepts (POC) discussions were taking place. Some of the notable ones are: CVE-2024-8504, CVE-2024-8503, CVE-2024-29847, CVE-2024-38014, VMware Workstation client, TOTOLINK routers and TP Link Archer C6U/C6 routers.

Overview

This Weekly Vulnerability Intelligence Report explores vulnerability updates between September 11 and September 17. The Cyble Research and Intelligence Labs team investigated 24 vulnerabilities this week, among other disclosed vulnerabilities, to present critical, high, and medium degree insights.

The Week’s Top Vulnerabilities

CVE-2024-45409: Improper Verification of Cryptographic Signature in GitLab Community Edition (CE) and Enterprise Edition (EE)

The critical SAML authentication bypass vulnerability impacting self-managed installations of the GitLab Community Edition (CE) and Enterprise Edition (EE). Security Assertion Markup Language (SAML) is a single sign-on (SSO) authentication protocol that allows users to log in across different services using the same credentials. An unauthenticated attacker with access to any signed SAML document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as an arbitrary user within the vulnerable system. 

CVSS Score: 10

Internet Exposure: No 

Patch Available: Yes 

CVE-2024-38812: Heap-based Buffer Overflow in VMware vCenter Server

The critical heap-overflow vulnerability impacts the VMware vCenter Server, a centralized management platform for VMware vSphere environments that provides a single interface to manage and monitor multiple ESXi hosts and the virtual machines running on them. A malicious actor with network access to the vCenter Server may trigger this vulnerability by sending a specially crafted network packet, potentially leading to remote code execution. 

CVSS Score: 9.8

Internet Exposure: Yes

Patch Available: Yes 

CVE-2024-29847: Deserialization of Untrusted Data in Ivanti Endpoint Manager

The critical vulnerability impacts Ivanti Endpoint Manager is a comprehensive solution designed for managing and securing endpoints across various operating systems and devices. It integrates Unified Endpoint Management (UEM) capabilities, allowing IT teams to oversee a diverse range of devices from a single platform. Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6 or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. 

CVSS Score: 9.8

Internet Exposure: Yes 

Patch Available: Yes 

CVE-2024-6671, CVE-2024-6670: SQL Injection in Progress WhatsUp Gold

The criticalSQL Injection vulnerabilities impact Progress WhatsUp Gold, a comprehensive network monitoring software designed to provide visibility and control over network devices, servers, applications, and virtual environments. It allows IT teams to monitor performance metrics and ensure the health of their infrastructure, whether deployed on-premises or in the cloud. The exploitation of the vulnerabilities allows an unauthenticated attacker to retrieve the user’s encrypted password. 

Recently, researchers disclosed that attackers are leveraging publicly available exploit code to exploit critical vulnerabilities.  

CVSS Score: 9.8 respectively

Internet Exposure: Yes 

Patch Available: Yes 

CVE-2024-45694: Stack-based Buffer Overflow in D-Link Routers

Impact Analysis: The critical stack-based buffer overflow vulnerability impacts the web service of certain models of D-Link wireless routers. Unauthenticated, remote attackers can exploit this vulnerability to execute arbitrary code on the device. 

CVSS Score: 9.8

Internet Exposure: No

Patch Available: Yes

CVE-2024-6678: Authentication Bypass by Spoofing in GitLab Community Edition (CE) and Enterprise Edition (EE)

Impact Analysis: The high severity vulnerability impacts GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2. The exploitation of the vulnerability allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances, leading to the disruption of automated workflows of targeted organizations. 

CVSS Score: 8.8

Internet Exposure: No 

Patch Available: Yes 

Vulnerabilities and Exploits Discussed in the Underground

CRIL observed multiple instances of vulnerability discussions and the promulgation of proof-of-concepts (POCs) in underground forums and channels.


On a Telegram channel named ‘Proxy Bar,’ the administrator shared POCs for several critical and high-severity vulnerabilities, including CVE-2024-8504 (OS Command Injection), CVE-2024-8503 (SQL injection), CVE-2024-40711 (RCE in Veeam Backup and Replication software) and CVE-2024-38080 (Privilege Escalation in Windows Hyper-V).

On the Telegram channel CyberDilara, the administrator shared a POC for CVE-2024-38014, A high severity vulnerability in the Windows Installer that allows for elevation of privileges.

Hackers Factory also shared a POC for CVE-2024-28000, a critical privilege escalation vulnerability affecting the LiteSpeed Cache plugin for WordPress, which allows unauthorized users to gain Administrator-level access to a WordPress site.

TA tikila claimed to have three a 0-day vulnerabilities affecting VMware Workstation, TOTOLINK routers, and TP-Link Archer C6U/C6 routers.

Cyble’s Recommendations


Stay Up-to-Date with Patches

Make it a priority to update all your systems with the latest vendor patches. Vulnerabilities get exploited quickly, and having a schedule for regular updates ensures you’re not left exposed. Apply critical patches as soon as they’re released—don’t delay.


Streamline Your Patch Management

Building a solid patch management process is key. It starts with knowing what’s in your system, followed by assessing, testing, and deploying patches in an orderly fashion. Automating this process can save time and prevent human error.


Segment Networks for Better Protection

Don’t put all your eggs in one basket. Segregating your network can safeguard your most critical assets by limiting their exposure. Use firewalls, VLANs, and tight access controls to ensure only authorized users have access.


Have a Response Plan Ready

When incidents happen—and they will—having a well-rehearsed incident response plan is a lifesaver. It should clearly define how you’ll detect, react to, and recover from threats. Regularly test and update this plan to ensure it’s aligned with the latest risks.


Monitor and Log Activities 

You can’t fix what you can’t see. Monitoring and logging malicious activity is crucial. Use SIEM solutions to collect and analyze logs in real-time, helping you catch threats before they escalate.


Stay Informed on Security Alerts

Stay ahead of threats by subscribing to security alerts from vendors and authorities. Make sure to evaluate the impact of these alerts on your organization and act swiftly.


Test for Vulnerabilities

Conduct regular Vulnerability Assessments and Penetration Testing (VAPT) to expose weak points in your defenses. Pair these exercises with audits to confirm you’re following security protocols.


Know Your Assets

Keeping a current inventory of internal and external assets, like hardware and software, is essential. Asset management tools can help maintain visibility, so you stay on top of everything in your network.


Strengthen Password Security

Weak passwords are an open door for hackers. Start by changing default passwords immediately and enforcing a strong password policy across your organization. Coupling that with multi-factor authentication (MFA) adds an extra layer of protection, making it harder for unauthorized users to gain access.

The post HED: Weekly IT Vulnerability Report for September 11 – September 17, 2024 appeared first on Cyble.

Blog – Cyble – ​Read More

Solar Monitoring Solutions in Hacktivists’ Crosshairs

/in

Executive Summary

In September 2024, the pro-Russian hacktivist group Just Evil and possibly the state-backed Beregini group led a coordinated cyberattack on Lithuanian energy infrastructure. The attackers claimed to target the PV monitoring solution used by the state-owned Energy holding company Ignitis Group.  

Just Evil is a faction that emerged from the split of the Killnet group, while Beregini exemplifies the complex interplay of hacktivism and state-sponsored cyber operations within the context of the Russia-Ukraine conflict. It operates under the guise of a Ukrainian group while aligning closely with pro-Russian interests.

Just Evil allegedly accessed the power monitoring dashboard of 22 Ignitis’ clients, including hospitals and military academies, via a compromised PV Monitoring Platform in the city of Kaunas. This is the latest in a series of cyberattacks on Ignitis, following earlier DDoS incidents in 2022 and more in 2024, impacting the company’s energy distribution services.

Previous Attacks on Lithuanian Energy Infrastructure

The first significant attack against Ignitis was orchestrated by Killnet in 2022 in retaliation to Lithuania’s ban on the transit of goods to Russia’s Kaliningrad region. The severity of the attack can be adjudged from the fact that the Lithuanian National Cyber Security Centre had to intervene to contain it, and this was widely reported in the media.

In early February 2024, the Russian cybercriminal group Just Evil allegedly gained unauthorized access to the Ignitis ON app control panel, a service that helps electric vehicle owners charge their cars.

The hacktivist group provided video evidence of shutting down user access to charging stations and deleting the users from the control panel. They also demanded a ransom to cease the attacks and for not leaking the user data. As per local media, Ignitis accepted the breach and did not pay the ransom. As a result, Just Evil leaked user data containing details of over 20,000 EV car owners, employee data, access keys, and firmware for car charging stations.

Just Evil later on also advertised selling admin access to Igntis ON platform for Euros 50,000. 

A few days later, the group claimed that they were able to gain access to the Ignitis On app via a vulnerability called ‘Human Factor’, possibly indicating social engineering and the use of valid credentials to gain access. The group also mentioned defacing the panel after gaining illicit access.

Analysis of the Incident Targeting PV Solar Monitoring Solution

Upon closer investigation of the screenshots shared by Just Evil on their telegram channel, Cyble Research & Intelligence Labs (CRIL) investigated the plausibly impacted PV monitoring solutions of Ignitis and ascertained them to be Sungrow’s iSolarCloud. Our open-source search also cemented the fact that Ignitis does use iSolarCloud for managing solar-generated electricity. Hence, considering the compromised panel screenshots, Just Evil’s claims seem credible.  

iSolarCloud by Sungrow offers several features for centralized management, monitoring, and optimization of solar energy systems. The platform offers real-time monitoring of solar systems, tracking energy production, consumption, and inverter performance. It provides data analytics for performance trends, efficiency tracking, and fault alerts, allowing remote diagnostics and predictive maintenance.  

 While the TA claimed to target multiple Lithuanian entities such as hospitals, gymnasiums, and educational facilities, CRIL assessed that the TA was able to access the solar power plants of the institutions mentioned above via the iSolarCloud Platform that provides a centralized PV management solution for managing them, rather than individually compromising them. Considering the names of Lithuanian entities as indicated in the screenshot below, we assess that this iSolarCloud Platform may be in use by Ignitis.  

Looking at the group’s history of attacks, CRIL appraises that the ‘Use of Valid Credentials’ could be the likely initial attack vector in this incident. Conjugate to this hypothesis, Cyble Vision, too, identified recently compromised credentials pertaining to ISolarCloud instances in Europe.

Using Cyble’s ODIN scanner, CRIL investigated other PV monitoring solutions from Lithuania and found that they were exposed on the Internet and could be targeted in the near future.

Conclusion

Solar energy generation and distribution are critical to a nation’s essential services. The recent attack on a centralized PV monitoring platform, which targeted multiple locations simultaneously, represents a significant threat to Lithuania’s energy sector. As observed by Cyble Vision, numerous compromised credentials exist for iSolarCloud platform users from various regions, including Europe and China. CRIL suggests that such compromised credentials could pose a serious risk, potentially being used to target critical infrastructure systems.

Globally, the solar energy sector has increasingly become a target for cybercriminals, with incidents such as ransomware attacks, data breaches, and remote access exploitation growing in frequency.

The impact of such attacks extends beyond immediate operational disruptions, potentially undermining national energy security, causing financial damage, and affecting public trust in renewable energy technologies.

Recommendations

Enhance Network Segmentation: Use firewalls and virtual LANs (VLANs) to separate critical control systems from non-essential networks. Isolate monitoring platforms from other network segments to limit the lateral movement of threats.

Implement Strong Authentication Measures: A key method of preventing unauthenticated access due to compromised credentials is implementing mandatory multi-factor authentication (MFA) for accessing solar monitoring and control systems. Employ strong, unique passwords and regularly update them.

Regular Security Audits and Penetration Testing: Foster a cyber-aware culture with routine security assessments and penetration tests on solar energy systems, including inverters, monitoring platforms, and network devices, to help detect and address vulnerabilities before they can be exploited.

Patch Management and Firmware Updates: Establish a robust patch management policy to ensure all systems, including inverters and monitoring platforms, are up-to-date with the latest security patches and firmware updates. Regularly check for updates from equipment manufacturers.

Implement Advanced Threat Detection and Response: Remember to utilize intrusion detection systems (IDS) alongside intrusion prevention systems (IPS) and Security Information and Event Management (SIEM) tools to oversee, identify, and address potentially malicious activities throughout the network.

Secure Remote Access: Restrict remote access to critical systems through VPNs, limit access to authorized personnel only, and monitor remote sessions for any unusual activity. Disable unused ports and services to reduce attack surfaces.

Employee Training and Awareness Programs: Train employees and operators on cybersecurity best practices, including recognizing phishing attempts and proper handling of sensitive information. Regularly update staff on emerging threats and attack vectors specific to the solar sector.

Incident Response Planning and Disaster Recovery: Create detailed incident response and disaster recovery plans tailored to the solar sector. Ensure that response procedures are in place to quickly isolate and mitigate attacks, minimize downtime, and restore normal operations.

Implement Dark Web Monitoring: Regularly monitor dark web forums, marketplaces, and other underground channels for stolen credentials, sensitive data, or discussions related to your solar infrastructure. Utilize threat intelligence platforms to detect compromised information early, allowing for proactive measures such as credential resets, system audits, and enhanced security protocols to prevent further exploitation.

Minimize Internet Exposure of Critical Systems: Restrict Internet exposure of critical solar monitoring and control systems by ensuring they are not directly accessible from the public internet. Use secure gateways, VPNs, and access controls to shield critical assets. Implement strict firewall rules and regularly scan your network for exposed services to reduce the risk of unauthorized access.

References:

https://faq.isolarcloud.com/web_faq/manage/#/_en_US/a2
https://web3.isolarcloud.com.hk/#/login
https://en.sungrowpower.com/productDetail/987/cloud-platform-isolarcloud

https://ignitis.lt/sites/default/files/inline-files/saules-elektrines-su-sungrow-keitikliu-naudojimosi-ir-eksploatavimo-instrukcija.pdf

The post Solar Monitoring Solutions in Hacktivists’ Crosshairs appeared first on Cyble.

Blog – Cyble – ​Read More