ANY.RUN‘s Threat Intelligence Lookup is a valuable resource for security professionals searching for information on the latest cyber threats. 

One of the key features of Threat Intelligence Lookup is its extensive search capabilities. The service offers over 40 different search parameters that can be combined to form specific queries. These parameters allow you to filter and refine your search results based on various criteria, such as IOCs, behavioral indicators, and other relevant information. 

Let’s explore each search parameter and provide examples of how they can be used in your investigations.

About Threat Intelligence Lookup

Threat Intelligence Lookup is a centralized platform for threat data exploration, collection, and analysis.

At the core of Threat Intelligence Lookup lies a global network of over 400,000 security experts. These individuals actively contribute by submitting suspicious samples to the ANY.RUN sandbox for advanced analysis on a daily basis. 

The submission process generates a wealth of valuable threat data, including indicators of compromise (IOCs), which are then extracted and integrated into Threat Intelligence Lookup.

Thanks to its integration with ANY.RUN’s Interactive Sandbox, users can access real-time search results, each one linked to a corresponding sandbox session, enabling in-depth analysis of the identified threats.

Search Parameters in TI Lookup

Search parameters in TI Lookup are divided into separate groups: tasks, registry, environment, detection, module, connection, process, network threats, file, synchronization, and URL.

Task

Task parameters refer to the characteristics of tasks (sandbox sessions). 

threatName

The name of a particular threat: malware family, threat type, etc., as identified by the sandbox.

Examples: “Phishing”, “xworm”, “ransomware”, “tycoon”.

submissionCountry

The country from which the threat sample was submitted.

Examples: “es”, “us”, “de”.

Here is an example of a query for samples of the Remcos malware submitted by users in Brazil. The service provides a list of sandbox sessions that correspond to the request.

Try it:

threatLevel

A verdict on the threat level of the sample.

Examples: “malicious”, “suspicious”.

taskType

The type of the sample submitted to the sandbox.

Examples: “URL”, “file”.

In this screenshot, you can see a query for malicious URLs uploaded to the sandbox over the past 24 hours. TI Lookup displays a list of the latest one hundred sessions.

Try it:

Registry

Registry parameters refer to specific attributes related to registry modifications detected within sandbox sessions. These parameters provide insights into how a threat interacts with the Windows registry.

registryKey

The specific key within the registry hive where the modification occurred. Please note: when entering registry keys, use a double backslash () to escape the single backslash.  

Examples: “Windows\CurrentVersion\RunOnce”, “Windows NT\CurrentVersionWindows”.

registryName

The name of the Windows Registry key field.

Examples: “browseinplace”, “docobject”, “isshortcut”.

registryValue

The value of the Windows Registry key.

Examples: “internet exploreriexplore.exe”.

Using the query above, we can identify threats that aim to execute malicious code through scheduled tasks.

Try it:

Environment

These parameters are used to provide context about the environment where a threat was detected or executed.

os

The specific version of Windows used in the environment.

Examples: “11”, “10”, “7”.

osSoftwareSet

The software package of applications installed on the OS.

Examples: “clean”, “office”, “complete”.

osBitVersion

The bitness of the operating system, 32-bit or 64-bit.

Examples: “32”, “64”.

We can use these parameters to, for instance, discover Windows 11 x64 sandbox sessions containing analysis of the Lumma stealer launched in the service over the past 14 days.

Try it:

Detection

These parameters are utilized to describe the detection signatures and MITRE TTPs relating to the execution of threats in the sandbox.

ruleName

The name of the detection rule.

Examples: “Executable content was dropped or overwritten”, “Phishing has been detected”.

ruleThreatLevel

The threat level assigned to a particular event.

Examples: “malicious”, “suspicious”, “info”.

MITRE

Techniques used by the malware according to the MITRE ATT&CK classification.

Examples: “T1071”, “T1114.001”.

Let’s consider a query combining the MITRE ATT&CK technique T1053.005, which describes a common persistence mechanism, with a detection rule for threats that steal browser credentials. 

Try it:

Module

Module parameters refer to specific modules or components within a threat. This can be a DLL, library, or other executable that is loaded by the main executable.

moduleImagePath

The full path to the module’s image file, the location on the disk where the module’s executable is stored.

Examples: “SysWOW64\cryptbase.dll”, “SysWOW64\msasn1.dll”.

Above you can see an example of a query that looks for all instances of sandbox sessions where KernelBase.dll was called.

Try it:

Connection

The Connection parameters describe network-related aspects of a threat.

domainName

The domain name that was recorded during the threat execution in a sandbox.

Examples: “tventyvd20sb[.]top”, “5.tcp.ngrok[.]io”.

destinationIP

The IP address of the network connection that was established or attempted.

Examples: “147[.]185[.]221[.]22”, “162[.]125[.]66[.]15”.

destinationPort

The network port through which the connection was established.

Examples: “49760”, “49780”.

destinationIpAsn

Detected ASN.

Examples: “akamai-as”, “akamai international b.v.”.

destinationIPgeo

Two-letter country or region code of the detected IP geolocation.

Examples: “ae”, “de”.

ja3, ja3s, jarm

Types of TLS fingerprints that can indicate certain threats.

Examples: “1af33e1657631357c73119488045302c” (JA3S), “a0e9f5d64349fb13191bc781f81f42e1” (JA3).

In the picture above, we can see a query that searches for threats that made connections to IP addresses located in the Czech Republic (CZ), belonging to Cogent Communications.

Try it:

Process

The following parameters relate to processes registered during active sandbox sessions.

imagePath

Full path to process image.

Examples: “System32\conhost.exe”, “Framework\v4.0.30319\RegAsm.exe”.

commandLine

The full command line that initiated the process.

Examples: “PDQConnectAgent\pdq-connect-agent.exe –service”, “system32\cmd.exe /c”.

Using these parameters, we can find Strela stealer samples that use net.exe to mount a C2 server containing a ‘davwwwroot’ folder.

Try it:

Network Threats

These parameters describe network-based threats detected by the Suricata intrusion detection system (IDS).

suricataMessage

The description of the threat according to Suricata.

Examples: “ET INFO 404/Snake/Matiex Keylogger Style External IP Check”, “STEALER [ANY.RUN] Stealc HTTP POST Request”.

 We can use a Suricata message to discover more samples, as well as IOCs, including those extracted directly from malware’s configs, relating to a particular threat.

Try it:

suricataClass

The category assigned to the threat by Suricata based on its characteristics.

Examples: “misc activity”, “a network trojan was detected”.

suricataID

The unique identifier of the Suricata rule.

Examples: “2044767”, “8001997”.

suricataThreatLevel

The verdict on the threat according to Suricata based on its potential impact.

Examples: “malicious”, “suspicious”, “info”

By combining this parameter with threaName, we can collect Surica rules relating to a specific malware.

Try it:

File

These parameters describe file-related aspects of a threat.

filePath

The full path to the file on the system.

Examples: “invoice”, “order”

We can use this parameter along with threatLevel to find specific files in sandbox sessions with malicious content.

Try it: filePath:”Users\admin\Desktop\README.TXT” AND threatLevel:”malicious”

fileExtension

The extension that indicates the file type.

Examples: “exe”, “dll”.

sha256, sha1, md5

Hash values relating to a file.

Examples: “1412faf1bfd96e91340cedcea80ee09d”, “ce554fe53b2620c56f6abb264a588616”

We can use the hash of a malicious file to discover the specific malware family it relates to.

Try it:

Synchronization

These parameters describe synchronization-related activities within a threat, such as mutexes.

syncObjectName

The name or identifier of the synchronization object used.

Examples: “rmc”, “m0yv”.

syncObjectType

The type of synchronization object used.

Examples: “event”, “mutex”.

syncObjectOperation

The operation performed on the synchronization object.

Examples: “create”, “open”.

By combining operation and type parameters with threatName, we can search for specific mutexes or events created during the execution of a particular malware

Try it:

URL

These parameters describe network traffic related to HTTP requests and responses.

url

The URL called by the process.

Examples: “http://192[.]168[.]37[.]128:8880[/]zv8u”, “http://tventyvd20sb[.]top/v1/upload[.]php”.

httpRequestContentType

The content type of the HTTP request sent to the server.

Examples: “application/octet-stream”.

httpResponseContentType

The content type of the HTTP response received from the server.

Examples: “text/html”.

httpRequestFileType

The file type of the file being uploaded in the HTTP request.

Examples: “binary”.

httpResponseFileType

The file type of the file being downloaded in the HTTP response.

Examples: “binary”.

It is possible to use the parameter with threatName again to find binary files that were requested during the analysis in the sandbox.

Try it:

Conclusion

ANY.RUN’s Threat Intelligence Lookup offers a comprehensive set of search parameters that enable security professionals to effectively analyze and investigate threats. Using these search options, you can identify and enrich your information on emerging threats.

Try Threat Intelligence Lookup for free →

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.

The post How to Collect Threat Intelligence Using Search Parameters in TI Lookup appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Key Takeaways

CISA has added vulnerabilities affecting the Microsoft Windows MSHTML Platform (CVE-2024-43461) and Progress WhatsUp Gold network monitoring solution (CVE-2024-6670) to its Known Exploited Vulnerabilities catalog.

Proofs of Concept and observed exploits of these vulnerabilities mean that users should update affected products as soon as possible.

Progress WhatsUp Gold was observed under exploit within hours after a Proof of Concept emerged, suggesting an urgent need to patch this 9.8-severity vulnerability.

Cyble researchers have detected 381 internet-exposed Progress WhatsUp Gold instances; patching these instances is critical.

Microsoft has patched two high-severity vulnerabilities chained together in Windows MSHTML platform spoofing attacks.

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities affecting the Microsoft Windows MSHTML Platform and Progress WhatsUp Gold network monitoring solution to its Known Exploited Vulnerabilities catalog (KEV) after proofs of concept (PoCs) emerged, and security researchers observed active exploits of the vulnerabilities.

We’ll examine the vulnerabilities, the following steps for affected products, and the best practices that all organizations should follow.

CVE-2024-6670: Progress WhatsUp Gold

CVE-2024-6670 is a critical 9.8 severity SQL Injection vulnerability affecting versions of Progress WhatsUp Gold released before 2024.0.0.

The vulnerability in affected versions of the network monitoring software allows an unauthenticated attacker to retrieve the user’s encrypted password if the application is configured with only a single user.

Exploits began within hours after a Proof of Concept for the vulnerability was made available publicly on GitHub, even though a patch had been available for the vulnerability since mid-August, suggesting that some users were slow to update affected versions.

Trend Micro researchers detected remote code execution (RCE) attacks against WhatsUp Gold that exploited the Active Monitor PowerShell Script, leveraging CVE-2024-6670 and CVE-2024-6671, a companion vulnerability also rated 9.8.

Both vulnerabilities are patched starting with version 2024.0.0.

The Cyble ODIN scanner detected 381 internet-exposed Progress WhatsUp Gold instances, as shown in the figure below. Progress WhatsUp Gold is urged to upgrade as soon as possible and check for indicators of compromise in their environments.

CVE-2024-43461: Microsoft Windows MSHTML

CVE-2024-43461 is a high-severity (CVSS: 8.8) vulnerability in the Microsoft Windows MSHTML Internet Explorer browser engine platform containing a UI misrepresentation flaw that allows attackers to spoof web pages. This vulnerability was exploited in conjunction with CVE-2024-38112.

Microsoft has announced the retirement of Internet Explorer 11 and deprecated Microsoft Edge Legacy. However, MSHTML, EdgeHTML, and related scripting platforms remain supported. MSHTML is used in Internet Explorer mode in Microsoft Edge and other applications via WebBrowser control. WebView and some UWP apps utilize EdgeHTML. Updates for vulnerabilities in MSHTML and scripting platforms are included in IE Cumulative Updates, but EdgeHTML and Chakra updates are not.

CVE-2024-43461 was exploited in conjunction with CVE-2024-38112 before July 2024. A fix for CVE-2024-38112, released in July 2024, disrupted this attack chain. To ensure complete protection, customers should install both the July 2024 and September 2024 security updates.

Affected Windows products include:

Windows Server 2012

Windows Server 2012 R2

Windows Server 2008 R2

Windows Server 2008

Windows Server 2016

Windows 10

Windows Server 2022

Windows 11

Conclusion

The recent addition of these vulnerabilities to the CISA KEV database underscores their active exploitation. These vulnerabilities can lead to severe security breaches, including unauthorized access to sensitive information and effective spoofing of web pages. Owners of affected products are urged to update their systems with the latest patch released by the official vendor.

Cyble Recommendations

Cyble urges the following best practices:

Ensure that you install the latest security updates for all affected systems and regularly check for and apply updates to stay protected against known vulnerabilities.

Implement robust monitoring to detect any unusual activity that could indicate the exploitation of these vulnerabilities. This includes monitoring network traffic, system logs, and user behavior.

Review and strengthen your security configurations, including access controls and permissions. Ensure that applications are not unnecessarily exposed to the internet and that strong authentication mechanisms are in place.

Perform regular vulnerability assessments and penetration testing to identify and address potential security weaknesses before they can be exploited.

Develop a comprehensive patch management strategy that includes inventory management, patch assessment, testing, deployment, and verification.

Implement proper network segmentation to avoid exposure of critical assets over the internet.

Maintain an up-to-date inventory of all internal and external assets, including hardware, software, and network components.

The post CISA Adds Progress WhatsUp Gold and MSHTML Vulnerabilities to Known Exploited Vulnerabilities Catalog appeared first on Cyble.

Blog – Cyble – ​Read More

For nearly two decades, Kaspersky has been at the forefront of integrating artificial intelligence (AI), particularly machine learning (ML), into its products and services. Our deep expertise and experience in applying these technologies to cybersecurity, coupled with our unique datasets, efficient methods, and advanced model-training infrastructure form the bedrock of our approach to solving complex ML challenges. Our Kaspersky AI Technology Research Center brings together data scientists, ML engineers, threat experts, and infrastructure specialists to tackle the most challenging tasks at the intersection of AI/ML and cybersecurity. This includes not only the development of applied technologies but also research into the security of AI algorithms, including the use of promising approaches such as neuromorphic ML, AI risk awareness, and much more.

Our technologies and products

At Kaspersky we’ve developed a wide range of AI/ML-powered threat detection technologies, primarily for identifying malware. These include a deep neural network algorithm for detecting malicious executable files based on static features, decision-tree ML technology for automated creation of detection rules that work on user devices, and neural networks for detecting malicious behavior of programs during execution. We also utilize a system for identifying malicious online resources based on anonymous telemetry received from solutions installed on customer devices and other sources. You can read more about them in our white paper Machine Learning for Malware Detection. Other models – such as the ML model for detecting fake websites and DeepQuarantine for quarantining suspected spam emails – protect users from phishing and spam threats. KSN’s cloud infrastructure makes our AI developments available almost instantly to both home and enterprise users.

Guided by the promise of generative AI, particularly large language models (LLM), we’ve built an infrastructure to explore its capabilities and rapidly prototype new solutions. This infrastructure, which deploys LLM tools akin to ChatGPT, is not only accessible to employees across all departments for everyday tasks but also serves as a basis for new solutions. For example, our Kaspersky Threat Intelligence Portal will soon have a new LLM-based OSINT capability that will quickly deliver threat report summaries for specific IoCs.

To enhance the security of our customers’ infrastructures, we’re actively developing AI technologies tailored to our flagship corporate products and services. For several years now, the AI Analyst in Kaspersky Managed Detection and Response has been helping to reduce the workload of SOC teams by automatically filtering out false positives. Last year alone, this technology closed over 100,000 alerts without human intervention. This allows SOC experts to respond to real threats faster and devote more time to investigating complex cases and proactively hunting for threats. Another of our solutions – AI-based host risk scoring in Kaspersky SIEM (Kaspersky Unified Monitoring and Analysis platform) and Kaspersky XDR – uses ML algorithms to search for suspicious host behavior without the need to transfer data outside a company.

Another key area of Kaspersky’s development is the use of AI/ML in industrial environments. This includes Kaspersky MLAD (Machine Learning for Anomaly Detection) – a predictive analytics software solution that automatically recognizes early (hidden) signs of impending equipment failure, process disruption, human error or cyberattack in telemetry signals. By continuously training the neural network, MLAD analyzes the stream of “atomic” events from the object, structures them into patterns and identifies abnormal behavior. Another of our projects is Kaspersky Neuromorphic Platform (KNP) – a research project and software platform for AI solutions based on spiking neural networks and AltAI, the energy-efficient neuromorphic processor developed by Russian-based Motive Neuromorphic Technologies (Motive NT) in collaboration with Kaspersky.

The widespread adoption of AI technologies requires security control, which is why we’ve also established an AI security team. It offers a range of services aimed at ensuring reliable protection of AI systems and thwarting potential threats to data, business processes and AI infrastructure.

Our people

In the past, ML-based tasks were performed by departments directly involved in detecting specific threats. However, with the growing number of tasks and the increasing importance of ML technologies, we decided to hive off our expertise in AI-based systems to a separate Expertise Center: Kaspersky AI Technology Research. This resulted in the creation of three main teams that drive the use of AI at Kaspersky:

The Detection Methods Analysis Group develops ML algorithms for malware detection in collaboration with the Global Research and Analysis Team (GReAT) and the Threat Research Center. Their AI systems for both static and behavior-based malware detection directly contribute to the security of our users.
Technology Research, under the Future Technologies Department, specializes in: researching promising AI technologies; developing Kaspersky MLAD and KNP; developing the next-generation AltAI neuromorphic processor in collaboration with Motive NT; and providing AIST services for AI security.
The MLTech team is responsible for developing the corporate ML infrastructure for training ML models, creating content threat detection models (phishing and spam), and implementing AI technologies, including LLM-based, into our advanced corporate services and solutions, such as MDR, Kaspersky SIEM (Unified Monitoring and Analysis platform), and Kaspersky XDR.

This doesn’t mean that our AI expertise is limited to the above teams. The field of AI is currently so complex and multifaceted that it’s impossible to concentrate all the know-how in a few research groups. Other teams also make significant contributions to the Expertise Center’s work, and apply ML in many tasks: machine vision technologies in the Antidrone team; research into AI coding assistants in the CoreTech and KasperskyOS departments; APT search in GReAT; and AI legislation study in the Government Relations team.

Our research and patents

The uniqueness of our AI technologies is underscored by the dozens of patents we’ve obtained worldwide. First and foremost, these are patents for detection technologies, such as malware detection based on program behavior logs, detection of malicious servers in telemetry, fake websites, and spam with the aid of ML. But the Kaspersky portfolio covers a much wider range of tasks: technologies for improving datasets for ML, anomaly detection, and even searching for suspicious contacts of kids in parental control systems. And, of course, we are actively patenting our AI technologies for industrial systems and unique neural network approaches to processing event streams.

In addition, Kaspersky actively shares its AI expertise with the community. Some studies, such as those on monotonic ML algorithms or the application of neural networks for spam detection, are published as academic papers at leading ML conferences. Others are published on specialized portals and at information security conferences. For example, we publish research on the security of our own AI algorithms, in particular attacks on spam detection and malware detection algorithms. We study the application of neural networks for time series analysis and explore the use of neuromorphic networks in industry-relevant tasks. Our Kaspersky Neuromorphic Platform (KNP) is open-source software that will be available for use and development by the entire ML community.

The topic of secure AI development and application is of fundamental importance to us, as we need to be able to trust our algorithms and be confident in their reliability. Other topics we cover include our participation in cybersecurity challenges that simulate attacks on ML systems and the use of advanced technologies such as LLMs to detect threats in system logs and phishing links. We also talk about threats to generative AI, including from a privacy standpoint, attacks on various LLM-based systems, the use of AI by attackers, and the application of our technologies in SOCs. Sometimes we open the door and reveal our inner workings, talking about the process of training our models and even the intricacies of assessing their quality.

 

Raising awareness

Finally, the most important function of the Kaspersky AI Technology Research Center is to raise awareness among our customers and the general public about the pros and cons of AI technologies and the threats they pose. Our experts at the Expertise Center demonstrate the dangers of deepfake videos. We talk about the finer points of AI usage (for example, how ChatGPT affects the process of hiring developers) and share our experiences through webinars and roundtable discussions.

The FT Technology Research team organizes conferences on neuromorphic technologies with a separate track devoted to AI security issues, including systems based on the neuromorphic approach. Together with our partner, the Institute for System Programming of the Russian Academy of Sciences (ISP RAS), we’re researching various attack vectors on neural networks in the areas of Computer Vision, LLM, and Time Series, and ways to protect them. As part of Kaspersky’s industrial partnership with ISP RAS, the team is testing samples of trusted ML frameworks.

We’re also involved in the development of educational courses, including a module on the use of AI in cybersecurity at Bauman Moscow State Technical University. Another example is our module on the safe use of AI in Kaspersky ASAP, our solution for raising employee awareness of cyberthreats. Finally, we’re contributing to the creation of a set of international standards for the use of AI. In 2023, we presented the first principles for the ethical use of AI systems in cybersecurity at the Internet Governance Forum.

 

To sum up, the main tasks of the Kaspersky AI Technology Research Center are the development of AI technologies, their safe application in cybersecurity, threat monitoring for improper or malicious AI usage, and forecasting trends. All these tasks serve a single purpose: to ensure the highest level of security for our customers.

Kaspersky official blog – ​Read More

Overview 

The Cyble Global Sensor Intelligence Network, or CGSI, has been actively monitoring and capturing real-time attack data through various Honeypot sensors. Last week’s research reveals the top cyber threats of the week including multiple exploit attempts, malware intrusions, financial fraud, and brute-force attacks. Multiple CVE attempts and targeted malware cases were observed from September 4, 2024, to September 10, 2024.  

CGSI’s recent research highlights a range of vulnerabilities impacting various IoT devices and software systems. A significant issue identified is the arbitrary code execution vulnerability in SPIP’s Porte Plume plugin, tracked as CVE-2024-7954. This flaw affects versions before 4.30-alpha2, 4.2.13, and 4.1.16, allowing attackers to execute arbitrary PHP code via specially crafted HTTP requests. Users are advised to upgrade to the latest patched versions to mitigate this risk. 

Another critical vulnerability is CVE-2024-4577, which involves PHP CGI configurations. This flaw permits attackers to execute arbitrary commands through malicious URL parameters. GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 are affected by CVE-2024-36401, a remote code execution vulnerability due to unsafe XPath evaluation of OGC request parameters. Users should either apply the available patches or remove the vulnerable gt-complex library to secure their systems. 

CVE-2024-32113, a path traversal vulnerability in Apache OFBiz affecting versions before 18.12.13, was also a highlight of this week’s research. This flaw allows unauthorized access to restricted directories, making it essential for users to upgrade to version 18.12.13 to close this security gap. In SolarWinds Web Help Desk, CVE-2024-28987 exposes a hardcoded credential vulnerability that enables remote attackers to gain internal access and manipulate data.  

Brute Force Attacks and Malware Infections 

Brute-force attacks targeting IT automation software and databases have surged. These attacks are characterized by relentless attempts to decipher passwords and gain unauthorized access. They are particularly concerning due to their focus on critical infrastructure, which can lead to substantial disruptions and data breaches.  

These attacks have been significant, involving systematic attempts to guess passwords for unauthorized access. Notable volumes of these attacks have been observed, particularly against IT automation software and databases. Brute-force attacks consist of an attacker submitting many passwords or passphrases with the hope of eventually guessing a combination correctly.  

The attacker employs a systematic trial-and-error approach to test every possible password and passphrase until the correct one is discovered. This brute force attack method involves iteratively guessing login credentials or encryption keys and potentially accessing hidden web pages. Hackers methodically work through all possible combinations in hopes of success. Last week, Cyble recorded numerous such attacks, and the statistics related to specific source IPs are illustrated below (Figure 1). 

Figure 1 – Statistics of recent brute force attacks 

The figure below highlights the most frequently targeted usernames and passwords in brute-force attacks. The analysis shows that these attacks predominantly affect IT automation software and servers, such as “3comcso,” “elasticsearch,” and “hadoop,” as well as databases like “mysql” and “Postgres.” The most commonly used username/password combinations include “root,” “admin,” “password,” and “123456.”  

Figure 2 – Most used usernames and passwords 

Several case studies highlight ongoing threats in terms of malware attacks. The CoinMiner Linux Trojan targets Linux systems to use their resources for cryptocurrency mining, leading to significant performance degradation.  

The Linux Mirai malware attack utilizes the Mirai Botnet to exploit IoT devices and Linux servers for widespread network assaults. The Mirai Botnet is well-known for targeting these devices, converting them into remotely controlled bots that participate in extensive network attacks. 

Similarly, the Linux IRCBot attack leverages IRC connections to take control of compromised systems, frequently incorporating them into a botnet. These IRC connections serve as backdoors, enabling attackers to execute a range of actions on the compromised systems. Many of these systems are subsequently used as part of a botnet controlled through IRC. 

The Rise of Phishing Emails and Other Scams 

Phishing email attacks have been notably prevalent, with several new types of scams emerging recently, leveraging phishing and social engineering. One prevalent type of fraud is the Delivery Scam, where scammers impersonate courier officials to deceive victims into believing they have a package awaiting delivery. Victims are instructed to send sensitive personal details to a specified email address to receive the supposed delivery. These fraudulent emails often come from typo-squatted domains mimicking legitimate courier services.  

Another common phishing attack vector is the Project Funding Scam. In this scam, fraudsters promise victims a large sum of money for a project, tricking them into providing sensitive financial information under the pretense of transferring funds. An example seen in this scam involved an email purporting to be from the “World Bank Group”. 

The Relief Fund Scam is also prevalent. Scammers promise victims a substantial amount of money in exchange for a small upfront payment. The scam often masquerades as an email from a reputable organization, such as the “United Nations Compensation Committee Office,” using similar-looking email addresses.  

In 2024, QR code phishing attacks have surged, reflecting a growing trend among cybercriminals to exploit QR codes for malicious purposes. The rise in QR code phishing can be attributed to several factors.  

The widespread adoption of QR codes, particularly during the COVID-19 pandemic, has made them a convenient target for cybercriminals. Users are now more accustomed to scanning QR codes, which creates a false sense of security. QR codes also obscure the destination URL, making it difficult for users to verify the legitimacy of the site they are directed to. 

Previously, Cyble Research and Intelligence Labs (CRIL) identified a campaign targeting individuals in China. This campaign used Microsoft Word documents containing QR codes, which were distributed via spam email attachments and pretended to be from the Ministry of Human Resources and Social Security of China. The documents falsely offered labor subsidies and directed users to scan QR codes for authentication. These QR codes led to phishing sites designed to collect financial information, including credit card details and passwords. 

The phishing sites associated with this campaign used domains generated by a Domain Generation Algorithm (DGA) and were linked to a series of subdomains and IP addresses. The phishing sites prompted users to enter personal and financial information under the guise of claiming labor subsidies, ultimately aiming to facilitate unauthorized transactions. 

Conclusion 

The data gathered by the Cyble Global Sensor Intelligence (CGSI) network highlights a surge in cyber threats, including intensified brute-force attacks, critical vulnerabilities, and phishing scams. Key issues include vulnerabilities in SPIP’s Porte Plume plugin and PHP configurations, alongside malware attacks like CoinMiner and Mirai Botnet. Phishing scams, including QR code-based attacks, are increasingly targeting users.  

To mitigate these threats, organizations should promptly address vulnerabilities, implement strong passwords, block malicious IPs, and stay vigilant against phishing tactics. Regular updates and proactive security measures are crucial for protecting systems and data. 

Mitigations and Recommendations  

Ensure that your security systems block the hashes, URLs, and email addresses provided in the IoC list attachment. 

Address all listed vulnerabilities promptly and maintain vigilance by regularly monitoring top Suricata alerts within your internal networks. 

Consistently review the real-time attack table for any malicious ASNs and IP addresses. 

Implement measures to block IP addresses associated with brute-force attacks and secure the specific ports outlined in the IoC table. 

Immediately update default usernames and passwords to defend against brute-force attacks and establish a policy for regular password changes. 

Configure servers with complex, hard-to-guess passwords to enhance security. 

The post Top Cyber Threats of the Week: Brute Force Attacks, CVE Attempts and Malware Infections appeared first on Cyble.

Blog – Cyble – ​Read More