August 2019 Threat Intelligence Report - MAN - UFACTUR ING/PUBLIC SECTOR IN THIS ISSUE • New records in fines, ransomware demands • Magecart exploits Amazon Cloud S3 buckets • Can hackers sit in on your next teleconference? • Think twice before scanning QR codes on mobile devices • “What you gonna do, phone the [London] police?” August 2019 About this report Fusing a range of public and proprietary information feeds, including DXC’s global network of Mark Hughes security operations centers and Senior Vice President and General Manager of Security cyber intelligence services, this DXC Technology report delivers a overview of major The cost of cyber incidents is growing, as evidenced by recent substantial fines for data incidents, insights into key trends breaches and increasing ransomware demands. In addition to immediate financial losses and strategic threat awareness. from business disruption, victims face longer-term reputational damage, such as the This report is a part of recent takeover of the London police Twitter account by hacktivists. DXC Labs | Security, which provides insights and thought leadership to This month it’s clear that the threat landscape is continuing to evolve. For example, the security industry. we’re seeing new twists on familiar threats, such as phishing campaigns that use Quick Response (QR) codes to target mobile devices, and the latest Magecart exploit of using Intelligence cutoff date: poorly configured cloud buckets to inject the group’s notorious card-skimming code. 24 July 2019 Table of Contents Threat Ransom payments nearly double in second Multi-industry updates quarter QR codes used to evade mailbox protections Multi-industry Magecart card skimmer hits thousands of Amazon Web Services S3 buckets Multi-industry Suspected malware developer arrested by Dutch National Police Unit Multi-industry Nation state DNS infrastructure hijacking campaigns Public Sector, & geopolitical continue Energy updates Linux desktop malware has suspected Russian links Vulnerability Substantial vulnerabilities in Zoom Multi-industry updates videoconferencing application Critical vulnerability discovered in ProFTPD Multi-industry Incidents/ Huge fines and settlements follow British Travel and Breaches Airways and Equifax breaches Transportation, Financial Services London police suffer social media hijacking Public Sector 2 August 2019 Threat updates Ransom demands nearly double in second quarter The average payment demand related to a ransomware infection has almost doubled, largely as a result of several organizations, including two Florida cities, falling victim to Ryuk ransomware the Ryuk and Sodinokibi ransomware strains. Who? Impact Sole operation by Eastern European cybercriminal group Grim Spider Data from ransomware incident response company Coveware shows that in the second quarter of 2019 the average ransom payment increased by 184 percent to $36,295. The What? analysis also showed that, although public and private sector entities were targeted, public sector victims paid an average of 10 times more in ransom. This dynamic is possibly “Big game hunting” ransomware campaigns, which focus on the largest enterprise fueled by increased media scrutiny of public sector entities and their requirement for environments system availability. How? Increasing ransom demands are likely due to threat actors focusing deployment of Ryuk A combination of automated infection with and Sodinokibi in large enterprise environments. This trend is seen in other prominent manual privilege escalation and expansion strands of ransomware, including LockerGoga, MegaCortex and GandCrab. of access typically using TrickBot or Emotet trojans via malspam for initial access Deployment methods for these strains vary. Ryuk’s operators use common banking Trojans to gain initial access to corporate environments before expanding network access Notable example? and deploying the ransomware binary, normally exploiting Active Directory. Sodinokibi Gained more than $1 million in ransom from has focused on compromising managed services providers (MSPs) and deploying Riviera Beach and Lake City in Florida during attacks in May ransomware to managed endpoints to maximize the scale of the infection. DXC perspective The widely reported decline in ransomware since 2017 is deceptive. The ransomware threat is evolving. There may be fewer total events, but those that occur are often more serious. For example, Ryuk ransomware garnered more than $1 million in ransom from Riviera Beach and Lake City in Florida during attacks in May. Increased sophistication in deployment tactics and a renewed focus on “big game hunting” means the threat has never been greater to enterprise environments. Attacks now seek to infect entire organizations in a single incident rather than a handful of hosts or individual network segments. Denial of initial access is key to prevention. Effective identity and access management controls, network access controls, phishing mail protections and training, and next- generation endpoint solutions can all help prevent account compromise and the delivery of malware. Source: Bleeping Computer QR codes used to evade mailbox protections Among the June 2019 Windows updates, Microsoft released patches for CVE-2019-1040, a vulnerability in the NT LAN Manager (NTLM) message integrity code (MIC) protection mechanism. Impact A phishing campaign was detected using QR codes to avoid detection by URL analysis. Individuals received spam emails posing as a SharePoint notification with an embedded QR code to scan and view an associated document. 3 August 2019 Impact Using a QR code successfully bypasses most traditional mailbox protections and avoids URL sandboxing. The phishing site is optimized for mobile browsers, highlighting the focus on mobile devices. This targeting enables adversaries to bypass the corporate security Most-attacked industries in July zone while retaining a high likelihood of obtaining user credentials. Stolen credentials • Financial services will subsequently be used to achieve initial access to corporate networks by the phishing • Professional services/consulting actor or may be sold to third-party criminal groups for use in further campaigns. • Telecommunications • Manufacturing DXC perspective • Insurance The prevalence of bring-your-own-device (BYOD) policies provides adversaries with an expanded attack surface. Credential phishing remains a prominent attack vector for a range of sophisticated criminal- and state-sponsored actors. We are likely to witness continued efforts to achieve credential compromise outside of the traditional corporate security zone. Targeting of mobile devices is on the increase beyond credential phishing, with several campaigns deploying new mobile-specific malware. The innovative use of QR codes to bypass protections demonstrates the importance of layered security and visibility into access of cloud applications. A well-configured cloud access security broker (CASB) can enable security analysts to highlight suspicious Notable Magecart groups login activity in the event of Office 365 credential theft, enabling swift response and remediation. The use of multifactor authentication is also an effective method of Groups 1 and 2 Use extensive automation to breach and mitigating credential-phishing risk. skim sites. Include a wide target array and Source: Cofense complex, bespoke reshipping infrastructure for monetization. Magecart card skimmer hits thousands of Amazon Web Group 3 Services S3 buckets Focuses on high-volume targeting, often The notorious payment-card skimming tool Magecart has hit another 17,000 websites, in Latin America, using unique skimmers to check web pages to display payment according to RiskIQ. The latest twist is the exploitation of improperly configured change information. to Amazon Simple Storage Services (S3). Group 4 Sophisticatedly blends into “normal” web Impact traffic by mimicking ad providers, analytic Magecart is divided into groups that focus on different targets and employ different modules or victim domains. Realized 3,000+ tactics. The latest campaign is a new spin on a familiar tactic. Card details are still stolen possible compromises by malicious JavaScript skimming code, but this time the injection occurs via storage Group 5 buckets for open public hosting sites with “write” access enabled. Targets third-party suppliers to compromise multiple websites. Was implicated in 2017 Magecart uses open source web-scanning tools, such as Shodan, to identify vulnerable Ticketmaster breach. buckets. Once attackers find a misconfigured bucket, they scan it for any JavaScript Group 6 files, append their skimming code and overwrite the script on the bucket. If these files are Only focuses on largest organizations to loaded onto a payment-processing page, card details will be copied and sent to a system secure high number of transactions. Respon- sible for 2018 British Airways and Newegg under Magecart control. This scattershot approach to the injection is likely to return a breaches. low success rate, which suggests a degree of automation and differing from some of the Group 11 highly targeted Magecart campaigns of 2018. Adds skimmer capabilities for credential or sensitive information theft. Responsible for DXC perspective December 2018 Vision Direct breach. Visibility and secure configuration in the cloud are essential to mitigating a range of Group 12 threats. For this Magecart threat, simply disabling public access to sensitive cloud Targets third parties to inject card-skimming