June 2019 Threat Intelligence Report - MAN - UFACTUR ING/PUBLIC SECTOR IN THIS ISSUE • New supply chain threats • Ransomware exploits Oracle WebLogic • Hacktivism on the rise • WhatsApp risks to mobile devices • New Lazarus Trojan discovered June 2019 About this report Supply chain vulnerabilities expose critical assets Fusing a range of public and proprietary information feeds, including DXC’s global network of security operations centers and cyber intelligence services, this Mark Hughes report delivers a overview of major Senior Vice President and General Manager of Security incidents, insights into key trends DXC Technology and strategic threat awareness. We’ve seen another active month with third-party security risks playing a role in major breaches, meaning it is more critical than ever to understand supply chain exposure. This report is a part of Ransomware continues to be a growing threat, with an increasing number of attacks DXC Labs | Security, which provides against enterprise environments, often referred to as big game hunting. insights and thought leadership to the security industry. Hacktivist groups are also very active, but the good news is these attacks are becoming Intelligence cutoff date: less effective where proper security controls are in place. I encourage you to read more May 24, 2019 about the latest threats. Table of Contents Threat New ransomware variant exploits Oracle Web- Multi-industry updates Logic vulnerability Hacktivism increases in the first quarter of 2019 Public Sector, but is less effective Healthcare, Educa- tion E-commerce attacks more valuable than ever Retail Nation state Advanced supply-chain attacks attributed to Multi-industry & geopolitical Chinese group dubbed Barium updates Lazarus group develops new Trojan malware Public Sector Manu- dubbed ELECTRICFISH facturing, Technolo- gy & Research Vulnerability WhatsApp vulnerability leads to compromise of Multi-industry updates mobile devices in highly targeted attack 50,000 enterprises may be at risk to potential Multi-industry SAP software vulnerabilities Incidents/ MIRRORTHIEF targets 201 online campus stores Retail Breaches with card-skimming attack Multi-industry Possible MegaCortex ransomware attack disrupts accounting software provider Wolters Kluwer Multi-industry CITYCOMP breach exposes financial data of numerous enterprises June 2019 Attack Threat updates motivations New ransomware variant exploits Oracle WebLogic vulnerability Attackers are using vulnerability CVE-2019-2725 to facilitate the spread of a new ransomware 81% variant dubbed Sodinokibi. Cybercrime Impact 14% The critical vulnerability affects Oracle WebLogic servers, used for building and deploying en- Espionage terprise applications, allows for unauthenticated remote code execution. Attackers require no user interaction to deploy the ransomware. Once installed, the ransomware instructs victims to 3% transfer bitcoin to a specified address in return for the decryptor. Cyberwarfare Notable features of the ransomware include the use of vssadmin.exe to delete automatic sys- 1% tem backups and attackers that follow up the Sodinokibi deployment with attempts to infect Hacktivism the same target with GandCrab ransomware. Industries and organizations targeted remain Source: Hackmageddon out of the public domain, although Cisco Talos suggests there have been numerous victims. Source: Threatpost, Cisco Talos DXC perspective Organizations using Oracle WebLogic are urgently encouraged to patch servers. The flaw was not patched in the standard quarterly update in April. Hacktivism increases in first quarter of 2019 Prominent hacktivist collectives such as Anonymous, LulzSec and various newer groups con- tinue to use relatively low-skill attack vectors — such as distributed denial of service (DDoS), website defacement, and exploitation of misconfigured databases — to gain attention and Most targeted support their various ideologies and causes. industries Impact 1. Multi-industry attacks Attack success rates vary, typically in relation to the cyber defense maturity of the targeted organization. Recent successes have been seen against government departments in Africa, 2. Public Sector where Ghost Squad Hackers continued a campaign against the Sudanese government. In 3. Communications, early April, Ghost Squad and others claimed to be launching DDoS attacks against 260 do- Entertainment & Tech mains a day, leading up to the removal of the autocratic president Omar al-Bashir. Anony- 4. Health & Life Sciences mous launched similar attacks on departments of the Zimbabwe government in late 2018. 5. Banking & Capital Other hacktivist collectives, particularly those operating in high-income countries, have Markets reportedly had more difficultly when targeting government and media interests. Many groups now focus on low-hanging fruit, such as government subsections or universities. Source: Wired DXC perspective Hacktivist campaigns will continue targeting multiple industry verticals with public sector, energy, education and healthcare at heightened risk. The attackers typically will be motivated by political, social and environmental issues. Faced with maturing cyber defenses, hacktivists may seek to increase social engineering activities and use novel methods to disrupt targets. Misinformation campaigns, aimed at dam- aging a target’s “brand,” could further provide hacktivists opportunities to cause 3 disruption outside of the scope of traditional cyber defenses. June 2019 E-commerce attacks more valuable than ever Payment card information stolen from online stores is increasing in value as demand for card verification value (CVV) numbers is outstripping supply. Impact CVV resale prices have now risen to match those of cloned payment cards used at physical point-of-sale (POS) terminals. Previously, data stolen with “card present” — where criminals create physical clones of cards — was considerably more valuable than cards used only online. POS card clones were $15 to $20 a card, whereas CVVs ranged from $2 to $8. However, recent monitoring of dark web marketplaces shows CVVs are now as valuable as POS Barium APT data sets. A single CVV will routinely cost in excess of $20. The principal drivers for this dymanic Who are they? are likely an increased demand for stolen card data on the dark web and increased difficulty in • Advanced adversary that uses cloning physical cards due to wider chip-and-pin adoption in G20 nations. supply chain compromise to enable Source: Gemini Advisory highly focused targeting. Also known as Wicked Panda or Shad- DXC perspective owHammer. This situation may partly explain the increased prevelance of attacks on e-commerce sites in Where do they operate? the last 12 months, with a number of prominent card-skimming campaigns hitting online stores • Intelligence and analysis suggest across various industries. they are likely Chinese-speaking. They target globally. Nation state and geopolitical updates What do they want? • Barium appears to focus on target- Advanced supply chain attacks attributed to Chinese group ed espionage, most likely in support dubbed Barium of Chinese strategic goals. Intellec- The group is believed to be responsible for the significant breaches of ASUS in March 2019 and tual property, sensitive government Avast’s CCleaner software, affecting 500,000 and 700,000, respectively. documents and research are likely objectives. Impact Barium uses supply chain attacks to compromise hosts en masse, but actively exploits only a Do they work alone? small number of preselected targets. Of the half-million devices implicated in the ASUS breach, • Probably not. They have links to the malware activated on only 600, based on predefined MAC addresses written into the exploit state-sponsored Chinese group APT code. Similarly, only 70 of those compromised by CCleaner saw secondary spyware down- 17 and potentially cybercriminal loads. group Winniti. How can I stop them? Features • Defense in depth and mature tech- The group typically exploits trusted models to deploy malware. Notably, it compromises update nology solutions are required. Fun- servers of suppliers and uses them to push out malicious payloads under the guise of being damental security solutions include legitimate updates. The group’s access to the suppliers enables it to use genuine signatures and understanding your supply chain certificates, making detection early in the kill chain extremely challenging. Evidence suggests risk and effective mailbox, endpoint Barium also links supply chain attacks to gain deeper or more advantageous access. The com- and network protections. promise of CCleaner, for example, was used to target ASUS. Though Barium’s ability to compromise major software and hardware suppliers has given it access to more than a million devices, the group appears to show little interest in destructive actions. Instead, it focuses on highly targeted espionage operations. Its targets are not known, but intelligence points toward the group being aligned with Chinese state interests. Barium may 4 also operate as part of a wider collective of advanced adversaries. Its code shares June 2019 fingerprints with code previously used by the state-sponsored Chinese group APT 17, and it shares tooling with cybercriminal group Winnti. Source: Kaspersky, Wired DXC perspective Barium poses a serious and credible risk to public sector, research and technology enterprises holding intellectual property that would be advantageous to Chinese strategic aims. It also poses a serious threat to suppliers