Tag Archive for: Cyber security news

• The spam emails tried to mimic Dun & Bradstreet’s official site by having a lookalike, fake domain.
• These emails contained macros that drop malicious BAT files to initiate the download for Trickbot’s payload.

Trickbot, one of the persistent banking trojans these days, has been spotted with another spam campaign. This time the attackers have impersonated the prominent business analytics company, Dun & Bradstreet.

Spam emails touted as ‘complaint’ are found containing malicious macros that deliver Trickbot. It is reported that this Trickbot campaign was directed at people in the US.

The big picture

• Spams have the subject line “FW: Company Complaint #DNBC920201TF” and come from a false domain “service@dnscomplaint[.]com”.
• They contain a Word document attachment named ‘DNBC920201TF.doc’ which in turn, has malicious macros.
• The macros are initiated once the attachment is opened. A number of BAT files are dropped into the system which has instructions to download and install Trickbot.
• Then the bitsadmin.exe, a process used to manage jobs in the command center is copied by the macro and is renamed as ld0CIC0.exe. The reason for performing this step is to evade detection by security software.
• ld0CIC0.exe downloads an EXE file as well as binary files, which are combined to form the Trickbot malware.

Domains registered in GoDaddy – This latest campaign’s emails were also observed to have multiple domains registered on GoDaddy.

“Today’s example of the spoofed domain is, as usual, registered via Godaddy as registrar. Because of new GDPR rules, we cannot easily find the registrants name or any further details. dnbcomplaint.com hosted on & sending emails via 95.211.143[.]199 | 185.203.33[.]172 | 95.211.197[.]182 | 85.17.76[.]82,” myonlinesecurity.co.uk reported.

What can be done to prevent the infection?

Users are advised to disable macros from automatically opening in the Word doc. Newer versions of Microsoft Word usually have macros disabled by default.

Furthermore, any Word file received through emails should be opened in “protected view” which terminates malicious activities such as malware or DDE exploits, from running in the system.

• The ransomware’s TOR site comes with a hidden private chat that can be enabled using one of the discount codes.
• This allows dishonest data recovery firms to hide the final cost of the GandCrab decryption process from its customers.

It was only a few months back that free decryption tools were made available for GandCrab version 5.0 – 5.0.3. And, while these tools are yet to be made public, a new version of GandCrab has appeared. The developers of GandCrab released the new version – GandCrab v5.1 – within 24 hours of the release of the decryption tools.

According to an extensive report from Coveware, the latest version of the ransomware comes with a variety of distribution changes and UX updates to the GandCrab TOR sites.

Multiple attack vectors and distribution techniques

Highlighting on the attack vectors of the ransomware, the researchers said, “The primary attack vector for ransomware remains RDP ports, but GandCrab has a diverse array of distribution methods. While RDP-based ransomware attacks remain popular, automated attacks using exploit kits such as Fallout EK, Emotet, or credential stealers like Vidar have been linked to GandCrab infections as well.”

Given the wide use of these broadly available toolkits, the ransomware authors have increased the average size of GandCrab ransomware.

Hidden private chat

The ransomware’s TOR site comes with a hidden private chat that can be enabled using one of the discount codes. This allows dishonest data recovery firms to hide the final cost of the GandCrab decryption process from its customers, along with their chats with the GandCrab support.

The discount code can be requested over chat. However, it can only be activated on the systems of targeted users.

“After entering the code, the applicable discount is displayed and the USD ransom amount on the payment pages is automatically adjusted. Discounts range from 5-20% depending on the size of the ransom,” the Coveware researchers added.

The payment process for GandCrab v5.1 remains the same. Here, the affected users are required to pay the ransom in Dash rather than in Bitcoin. “The wallet address for each page is unique and is rigged to trigger an updated screen on the TOR site once the correct amount of coins hits the wallet,” the researchers explained.

As you think about how to deploy in advance of a new year of cyber threats, here are the trends and activities most likely to affect your organization

In anticipating the major cyber security and privacy trends for the coming year, you can find plenty of clues in the events of the past 12 months. Among the now familiar forms of attack, cyber hacks of major corporate systems and websites continued in 2018 and will inevitably be part of the 2019 cyber security scene. Many well-known organizations around the world suffered significant breaches this year. The single largest potential data leak, affecting marketing and data aggregation firm Exactis, involved the exposure of a database that contained nearly 340 million personal information records.

Beyond all-too-common corporate attacks, 2018 saw accelerated threat activity across a diverse range of targets and victims. In the social networking realm, Facebook estimated that hackers stole user information from nearly 30 million people. A growing assortment of nation-states used cyber probes and attacks to access everything from corporate secrets to sensitive government and infrastructure systems. At the personal level, a breach into Under Armour’s MyFitnessPal health tracker accounts resulted in the theft of private data from an estimated 150 million people.

So, what can we expect on the cyber security front in the coming year? Here are some of the trends and activities most likely to affect organizations, governments, and individuals in 2019 and beyond.