Security Threat Intelligence Report September 2020 In this issue Trickbot malware targets Linux Internet Explorer script-based malware emerges Business email compromise attacks bypass MFA Zoom phishing campaign harvesting Office 365 credentials Agent Tesla RAT adds new features Security Threat Intelligence Report About this report Message from Mark Hughes Fusing a range of public and proprietary information feeds, The shift to remote work has seen a including DXC’s global network considerable uptick in targeting remote access of security operations centers and cyber intelligence services, solutions. A new Zoom phishing campaign this report delivers an overview is harvesting Office 365 credentials while of major incidents, insights into new business email compromise attacks can key trends and strategic threat awareness. bypass multifactor authentication. We must ensure identity and access management are tight, and cyber This report is a part of DXC Labs | Security, which provides insights hygiene is an ongoing focus. We also must continue to educate and thought leadership to the teams to keep a diligent eye on ongoing phishing schemes and security industry. malware. Intelligence cutoff date: August 24, 2020 Mark Hughes Senior Vice President and General Manager of Security DXC Technology Threat Updates Table of TrickBot’s Anchor malware platform targets Linux Multi-industry 3 contents devices Business email compromise attacks bypass MFA Multi-industry 6 Zoom phishing campaign harvesting O365 Multi-industry 7 credentials Agent Tesla RAT adds new features Multi-industry 9 Vulnerability Updates Internet Explorer scripting malware emerges Multi-industry 12 Incidents/breaches Carnival Corporation suffers ransomware attack Travel Industry 15 Nation State and Geopolitical U.S. Justice Department seizes cryptocurrency Multi-industry 16 accounts of 3 suspected terrorist groups 2 Security Threat Intelligence Report Threat Updates TrickBot’s Anchor malware platform targets Linux devices Discovered by Stage 2 researcher Waylon Grange, TrickBot’s Anchor malware is still in the early stages of development. Intel is limited at this time. Updates will be reported as they become available. TrickBot is a multipurpose Windows malware platform that uses different modules to perform various malicious activities, including information stealing, password stealing, Windows domain infiltration and malware delivery. TrickBot is rented by threat actors who use it to infiltrate a network and harvest anything of value. It is then used to deploy ransomware such as Ryuk and Conti to encrypt the network’s devices as a final attack. Anchor_Linux will configure itself to run every minute using the following crontab entry: */1 * * * * root [filename] Figure 1. Setting up persistence via CRON Source: Vitali Kremez Attack Vector According to Stage 2, this malware is often delivered as part of a ZIP file and is a lightweight Linux backdoor. Upon execution it installs itself as a cron job, determines the public IP for the host and then begins to beacon via DNS queries to its C2 server. Dropper functionality includes: • The ability to drop other malware on Linux devices and execute it • An embedded Windows TrickBot executable • A Linux embedded binary that serves as new lightweight TrickBot malware • Code connections to older TrickBot tools This malware can be used to infect Windows machines on the same network. This is the Windows infection process: • Anchor_Linux will copy the embedded TrickBot malware to Windows hosts on the same network using SMB and $IPC 3 Security Threat Intelligence Report • When successfully copied to a Windows device, Anchor_Linux will configure it as a Windows service using: ATM makers address illegal cash withdrawals – The Service Control Manager Remote protocol ATM manufacturers Diebold Nixdorf – SMB SVCCTL named pipe and NCR have fixed a number of software vulnerabilities that have allowed attackers to execute arbitrary code with or without system privileges. Hackers made illegal cash withdrawals by committing deposit forgery and manipulating underlying systems by issuing valid commands to dispense currency. Figure 2. Copying a file via SMB Source: Waylon Grange Upon startup, the Windows machine will connect to the C2 for instructions. Linux version The Linux version allows threat actors to target non-Windows environments with a backdoor. If successful, attackers can pivot to Windows devices on the same network. It uses an attack vector outside of email phishing for Windows infection. The Linux backdoor has a persistence mechanism as seen in the cron job. It functions in the UNIX environment and targets devices in the UNIX environment, including: • Routers • VPN devices • NAS devices run on Linux operating systems IoT devices also require security controls and monitoring to detect Anchor_Linux. Figure 3. TrickBot’s Anchor framework Source: SentinelOne 4 Security Threat Intelligence Report Hunting Anchor_Linux will create a log file at: /tmp/anchor.log There is a high probability that the name of the log file will change as the malware development progresses. If this file exists, a complete audit of the system for the presence of the Anchor_Linux malware should be conducted. It is expected that TrickBot will continue its development to make it a full-featured addition to its Anchor framework. IoCs – Courtesy of Stage 2 Security Hashes: 55754d178d611f17efe2f17c456cb42469fd40ef999e1058f2bfe44a503d877c C721189a2b89cd279e9a033c93b8b5017dc165cba89eff5b8e1b5866195518bc 7686a3c039b04e285ae2e83647890ea5e886e1a6631890bbf60b9e5a6ca43d0 Domains: *.biillpi[.]com IPs: 23.95.97[.]59 Yara: rule anchor_linux_dns { meta: author = “Stage 2 Security” description = “Trickbot anchor_linux” strings: $hdr = {7f 45 4c 46} $x1 = {80 74 0? ?? b9} $x2 = “anchor_l” $x3 = “getaddrinfo” $x4= “IPC$” $x5 = {48 ?? 2f 74 6d 70 2f 00 00 00} $x6 = “test my ip” $x7 = {73 6d 62 32 5f [4–7] 5f 61 73 79 6e 63 20} $x8 = “Kernel32.dll” $x9 = “libcurl” $x10 = “/1001/” condition: $hdr at 0 and 7 of ($x*) } 5 Security Threat Intelligence Report Impact iOS SDK breach surfaces Trickbot was first detected in 2016 and has developed its capabilities extensively over Researchers discovered malicious the years. Trickbot can disable antivirus systems, propagate throughout a network, functionality within the iOS perform man-in-the-middle attacks and drop other malware. The latest Trickbot MintegralAdSDK (aka SourMint) update means the malware has a completely new attack vector targeting Linux and distributed by Chinese company Unix devices. Based on its success with Windows machines, the impact rating to Mintegral. The malicious functionality organizations should be considered critical. enabled ad fraud on hundreds of iOS apps and brought major privacy TrickBot has been seen in the wild dropping Ryuk and GlobeImposter ransomware. concerns to consumers. It allows Multiple malware infections greatly complicate the remediation process. It has spying on user link click activity successfully disabled endpoint antivirus applications, allowing the infection to spread within thousands of iOS apps that across the network, compromising over a hundred systems. use the SDK, tracking requests performed by the app and reporting Note that Trickbot began as a banking trojan and is proficient at harvesting and it back to Mintegral’s servers.. exfiltrating data from infected systems prior to deploying ransomware, which is a tactic adopted by most ransomware groups in 2020. DXC perspective Trickbot is used by multiple threat actor groups due to its success rate and its ability to propagate throughout the environment and drop other malware. Groups using Trickbot are financially motivated, and successful intrusions will result in the exfiltration of data. Security controls should be tuned to alert on abnormal outbound traffic. It may also deliver disruptive malware such as ransomware and system-wiping malware. The recent addition of this new Trickbot attack vector will require security teams to tune security monitoring tools to detect intrusions as well as hunt for existing network presence of previous non-detected intrusions. Sources: Stage 2 Security Intezer Labs Sans Business email compromise attacks bypass MFA Business email compromise (BEC) campaigns are increasing in frequency, and compromise success rates are up, with reports of email accounts being taken over despite multifactor authentication (MFA) and conditional access. It is not possible to enforce MFA when a user signs into an account using legacy email protocols, including IMAP, SMTP, MAPI and POP. Office 365 licenses provide the ability to configure conditional access policies, which block access from legacy applications. However, attackers are bypassing conditional access controls by obscuring (renaming) the app being used. Credential stuffing campaigns have been seen in the wild using legacy applications in attempts to bypass MFA. 6 Security Threat Intelligence Report Impact The motivation behind BEC attacks is financial and can impact organizations at various levels: • Credential harvesting and data exfiltration • Financial losses from company fund transfer requests • GDPR fines associated with PII data being exfiltrated • Reputational damage resulting from any of the above DXC perspective Even the most highly trained and vigilant employee will get fooled by the variety of tactics that threat actors use. Security controls such as secure email gateways (SEGs) should be used to prevent such emails from reaching the legitimate users. SEGs