March 08, 2021
On March 2, 2021, Microsoft announced that four previously unknown zero-day vulnerabilities were exploited to attack on-premises versions of the Microsoft Exchange Servers. Microsoft has reported that attackers exploited these vulnerabilities to gain access to Exchange servers, gain access to email accounts, and deploy malware (typically web shells) for long-term persistent access to victim organizations. Microsoft credited a security company called Volexity for first observing these exploits on January 6, 2021. These vulnerabilities do not affect Microsoft Office 365 or Azure Cloud deployments of Exchange email servers.
Microsoft has reported they have attributed these attacks to a threat actor group it calls HAFNIUM and assessed it is a People’s Republic of China sponsored campaign. Additional details of HAFNIUM targeting and attack techniques are included in Microsoft’s security blog. Meanwhile, FireEye’s analysis indicates this attack has ties activity it tracks across three unknown attack clusters and provides additional analysis and indicators in their blog.
February 24, 2021
Shortly after the COVID-19 pandemic began, there was a spike in threat infrastructure using the crisis to bait, deceive, and social engineer victims. Reports of threat campaigns attempting to fool Turkish-speaking users into downloading Android apps containing the Cerberus and Anubis banking trojans surfaced. Today, new RiskIQ data shows these attacks have not stopped, shedding light on the full extent of these campaigns.
In May 2020, threat researcher BushidoToken authored a blog pulling together multiple indicators, some appearing as early as April 2020, from researchers tracking Cerberus and Anubis activity targeting Turkish speakers. These two remote access Trojans (RATs), which follow a malware-as-a-service model, steal user credentials to access bank accounts. Highly deceptive, they can overlay over other apps (dynamic overlays), capture keystrokes, SMS harvest and send, call forward, and access other sensitive data across the device.
The campaigns exploited the pandemic to distribute malicious Android applications via web pages promising free internet packages to encourage people to stay home. To get the "free internet," users only had to install an application on their phones. In all, BushidoToken compiled 24 .apk filenames connected to the campaigns and a long list of domains and URLs. However, recent RiskIQ research shows these campaigns went on for much longer, with more infrastructure and tactics than outlined in May reporting.
February 18, 2021
A recent Interisle Consulting Group research report, WHOIS Contact Data Availability, and Registrant Classification Study, finds that more than half of the top-level-domains under ICANN's remit are now controlled by unidentifiable parties. According to the report, "ICANN's policy has allowed registrars and registry operators to hide much more contact data than is required by the GDPR-perhaps five times as much..."
Regardless of if contact data is ultimately needed to maintain a secure and interoperable Internet, it is now more important than ever to leverage available threat intelligence to combat harmful cyber activity. Traditionally, WHOIS has told analysts who owns a domain. Threat hunters used to be able to use this information to pivot on names, addresses, and phone numbers to find other domains registered to the same owner. For the most part, GDPR broke that.
With WHOIS becoming significantly less useful to build out threat investigations, threat analysts must rely more frequently on other internet data sets as part of their digital tool belt. RiskIQ has made it a core part of our business to collect and correlate as much relevant Internet data as possible to supercharge threat investigations—data that's become even more valuable to analysts since the advent of the GDPR.
February 10, 2021
We recently analyzed LogoKit, a simple, modularized, and adaptable phish kit running on thousands of domains. Easy to use and able to accommodate a wide range of attacker skill levels, LogoKit is a hot commodity on the black market.
LogoKit's popularity has given rise to enterprising threat actors who manufacture, package, and sell the kit to meet a strong and still growing demand among cybercriminals worldwide. However, these crimeware purveyors are more than just cybercriminals; they're also expert marketers who use social media sites, web forums, and messaging apps to build their brand, advertise their product, and streamline transactions.
After analyzing LogoKit itself last week, we took a closer look at the infrastructure and criminal enterprise behind it. The resulting investigation illuminated a massive phishing ecosystem and thriving crimeware economy driven by a high demand for simple, effective phishing tools. Below, we'll look at a major player in the sale of LogoKit.
February 02, 2021
Each year, businesses invest more in mobile as the lifestyle of the average consumer becomes more mobile-centric. Mobile growth exploded in 2020, with the COVID-19 pandemic advancing mobile adoption "by at least two to three years." According to App Annie, due to the pandemic, Americans are now spending more time on mobile than watching live TV, and social distancing has caused them to migrate more of their physical needs to mobile. App Annie also shows that mobile spending grew to a staggering $143 billion in 2020, year over year growth of 20%.
This ravenous demand for mobile creates a massive proliferation of mobile apps. Users downloaded 218 billion apps in 2020 and spent more than $240 billion in app stores worldwide. Meanwhile, RiskIQ noted a 33% overall growth in mobile apps available. For organizations, these apps drive business outcomes. However, they can be a dual-edged sword—the app landscape is a significant portion of an enterprise's overall attack surface that exists beyond the firewall, where their security teams often suffer from a critical lack of visibility.
January 27, 2021
As sophisticated attacks dominate the headlines, it's important to remember that the vast majority of cybercrime results from simple, effective, and tested tools. These tools are easy to use and accommodate a wide range of attacker skill levels. The LogoKit phishing kit, which RiskIQ has detected running on more than 300 unique domains in the past week and 700 over the past month, is a prime example.
January 21, 2021
In the wake of the tragic events that unfolded on Capitol Hill on January 6, 2021, it is now clear that abundant warning signs existed to alert lawmakers and law enforcement that a dangerous storm was brewing. It is uncommon for threats of this nature to be so blatantly forecasted. Yet, not enough people did. On December 21, 2020, writer and political analyst Arieh Kovler tweeted, “On January 6, armed Trumpist militias will be rallying in [D.C.], at Trump’s orders. It’s highly likely that they’ll try to storm the capitol after it certifies Joe Biden’s win. I don’t think this has sunk in yet.”
Now that so much of the world has turned to social media, and with the proliferation of so many various platforms, it has become increasingly difficult to monitor where threats broadcast themselves, particularly when so many discovery platforms are keyword based. If a threat actor makes a post that slips past your keyword threat matrix, it will slip through your detection. Your security teams and corporate leadership will be caught off guard by the threat you will later discover was forecast right in front of your very eyes. It didn’t pop up out of nowhere; unfortunately, you just missed it.
January 14, 2021
RiskIQ's recent analysis of Magecart infrastructure has shown its massive scale and put its interconnectivity into focus. Our most recent research takes two email addresses evoking the name of one of the most prominent bulletproof hosting providers on earth and ties them to newly discovered batches of Magecart infrastructure. From there, we show how this infrastructure overlaps with previously reported Magecart activity and highlight some common Magecart operator practices that can help researchers identify skimming infrastructure.
January 02, 2021
There will be many more breaches like the one of SolarWinds.
Moving into 2021 and beyond, the ability to view your organization from the outside-in, as attackers do, will be the best defense against these internet-scale attacks by advanced APTs. FireEye and other security experts analyzing early information on SunBurst have said mass scanning and internet-scale data are critical to incident response efforts. This real-time global visibility shows security teams if their organization is affected and helps uncover attacker fingerprints on the network.
RiskIQ is helping organizations respond to attacks like SunBurst with our Internet Intelligence Graph, built by mapping the Internet via over ten years of crawling and mass scanning. Our brand new JARM feature will help incident responders quickly query this graph, putting the world’s largest index of applications, components, and behaviors at their fingertips for a smarter, faster response.