Blog

As security researchers shine more light on the world of Magecart, we see that this vast card-skimmer underworld is more and more intertwined and connected. As we draw these parallels between different attacks, skimmers, and other infrastructure, many things become more transparent, like which groups are responsible, how they target their victims, and how their tooling evolves. Just last week, RiskIQ published a report tying the ubiquitous 'Ant and Cockroach' skimmer to Magecart Group 12, which indicated just how far-reaching the group's infrastructure and activity have become. 

However, as more of the Magecart landscape comes to the surface, things also get more murky and complicated. In many recent Magecart compromises, we've seen increasing overlaps in infrastructure used to host different skimmers that seem to be deployed by unrelated groups using various techniques and code structures. We also observe new variants of skimmers reusing code seen in the past. For instance, the compromise of boom! Mobile involved the Full(z) House skimmer hosted on infrastructure not previously associated with Full(z) House. This same infrastructure hosted skimming domains we observed loading other skimmers, including different versions of the grelos skimmer. This pattern may indicate that different skimming groups use the same infrastructure to host their skimming domains, possibly purchasing hosting services from the same third party. 

Deloitte expects holiday e-commerce sales to amount to $182 billion to $196 billion this year, increasing by 25% to 35%, compared with year-over-year growth online of 14.7% in 2019. With this surge in online holiday shopping due to COVID-19, malicious actors will be looking to capitalize. 

RiskIQ now detects one phishing domain and at least five domain infringement events every minute, with those numbers expected to increase for e-commerce brands as the holiday shopping season continues to ramp up. In response, RiskIQ announced its new Holiday Shopping Microsite, a free, one-stop cybersecurity resource center that tracks and reports new web hosts and domains that leverage holiday shopping events, including Black Friday, Cyber Monday, and Cyber Week. 

The site will serve as an authoritative source of intelligence that security practitioners can use to block and investigate holiday shopping scams as they increase on an unprecedented scale. Already, RiskIQ’s systems have observed 10,727 instances of new holiday shopping infrastructure stood up in advance of Black Friday and Cyber Week since November 1.

Businesses are undergoing a digital transformation demanding rapid migration to the cloud and expanded adoption of web, mobile, and social platforms. These initiatives are expanding organizations' digital presence far beyond their internal network, exposing the limitations of network security controls like firewalls, DLP, and network monitoring. According to the Verizon Data Breach report, external-facing web applications, into which network security tools lack visibility, comprised the vector category most commonly exploited in hacking-related breaches. 

This transformation was already challenging long-held views of cybersecurity when it was sent into hyperdrive by COVID-19. Almost overnight, workforces and business operations were decentralized and flung all over the world even farther than before, widening protection gaps and turning security protocols on their heads.

This digital transformation has grown the enterprise digital attack surface and dramatically broadened the spectrum of threats and vulnerabilities that can affect the average organization. Sophisticated APTs and petty cybercriminals alike threaten businesses' safety, targeting their data, brand, IP, systems, and people. Today, 375 new threats emerge each minute. 

OVID-19 changed the rules of the game virtually overnight.

The news has covered the broader impacts of the pandemic, particularly the hit to our healthcare, the drops in our economy, and the changes in education. But when a massive portion of our workforce was sent home, and companies moved operations online, no one thought about how vulnerable to cyberattacks those companies had now become. The attack surface had changed, giving malicious actors new inroads that no one had previously watched out for.

The thing is, cybersecurity isn't a battle that's ultimately won, but an ongoing game to play every day against attackers who want to take your systems down. We won't find a one-size-fits-all solution for the vulnerabilities that were exposed by the pandemic. Instead, each company needs to charge the field and fend off their opponent based on the rules of play. Today, those rules are that anything connected to the internet is fair game for cybercriminals, and it's on organizations to protect these digital assets. 

COVID may have changed the rules, but the game is still on. Despite the security threat, this pandemic may have caused a massive opportunity for companies — if they're willing to take it.

Ryuk Ransomware has flooded US hospitals, threatening to shut down their operations when they're needed most. Ryuk now accounts for a third of all ransomware attacks in 2020, with its operators finding success while many healthcare organizations are most vulnerable. 

However, the cybersecurity community is coming together to combat this rash of attacks, combining resources to provide network defenders with alerts and intelligence to protect our healthcare institutions. 

To do our part, RiskIQ released the entirety of the infrastructure related to the Ryuk strain of ransomware collected by RiskIQ's Internet Intelligence Graph.

In incident response, speed and visibility are everything, but they can’t be achieved without a 360-degree view of your attack surface. 

RiskIQ PassiveTotal now integrates directly with Microsoft Defender and Azure Sentinel, bringing Microsoft Defender endpoint telemetry and Azure Sentinel alert data directly to the PassiveTotal threat hunting platform. This combination of RiskIQ and Microsoft data enriches threat infrastructure to show pertinent SIEM alerts and endpoint details alongside RiskIQ's rich Internet intelligence to speed up and supercharge investigations. 

RiskIQ and Microsoft joint customers can enable integrations for both Microsoft Defender and Azure Sentinel separately in their organization's account settings in RiskIQ PassiveTotal. Once enabled, analysts can pivot across RiskIQ data during an investigation to understand all the related infrastructure affecting impacted endpoints or existing security tickets. 

Recently, RiskIQ's suspicious domain classifier surfaced several Google analytics typosquatting domains. One, in particular, led RiskIQ's research team to a phishing campaign impersonating Saudi Arabian government websites.

Based on infrastructure overlap in RiskIQ's Internet Intelligence Graph, our researchers determined that the campaign is connected to a previous research report from March of 2019, which outlined a phishing campaign against the Saudi Arabian government it dubbed Bad Tidings. According to the research—and corroborated by RiskIQ's data—the Bad Tidings campaign dates as far back as 2017.

Analysis of the new infrastructure found by RiskIQ appears to be a follow-on to the Bad Tidings campaign and has been ongoing since the middle of 2019. Based on our analysis of the domain infrastructure used in this new crop of attacks, the attackers appear to be impersonating several organizations, including the Saudi ministries of the interior, foreign affairs, and labor and social development. They are also impersonating the Enjazit e-visa platform and the Absher mobile app, which allows Saudi citizens to access government services. 

Through 2020, the pace of digitalization has only increased as the global pandemic has forced businesses to accelerate the trend of moving assets online. However, as companies shift their infrastructure into the vast and poorly mapped territories of the web, hostile actors are looking to exploit vulnerabilities into company networks – often to devastating effect.

The responsibility of keeping an organization safe falls upon the CISO and their security team, but as the cybersecurity climate has worsened – and threats have grown more sophisticated – simply preventing an attack is no longer enough. CISOs must now act as an intelligence asset to their organization and contextualize attacks to the broader company.
COVID-19 has brought together two tangents that have both exacerbated the risk posed to organizations online.

The Donot APT group (APT-C-35) is an espionage group that focuses its attacks on Pakistan and other South Asian government agencies. One of their hallmarks has been using customized malicious Android APKs to spy on their targets of interest and steal sensitive information. Not much has been released about the group recently, but a recent investigation by RiskIQ has uncovered large swaths of its existing and past mobile C2 infrastructure. These attackers are constantly redeveloping and redeploying tools even though their activity levels may appear to taper off.

Donot has kept mostly quiet for the past year with hardly any new open-source intelligence on them published by the security community. However, on May 31 and then again on June 1, two new malware samples linked to the group surfaced on Twitter. These samples were all RiskIQ needed to leverage our Internet Intelligence Graph to build an update around this well-known APT's most recent activity and malware distribution framework.