BRAINTRACE THREAT ADVISORY REPORT JANUARY 14, 2021 TABLE OF CONTENTS BACKGROUND ..................................................................................................................................................... 2 NEW BABUK LOCKER RANSOMWARE ............................................................................................................. 2 FILELESS MALWARE ........................................................................................................................................... 3 POSSIBLE CLONING OF YOUR GOOGLE TITAN 2FA SECURITY KEY ............................................................. 3 SWATTING ATTACKS WITH IOT DEVICES. ....................................................................................................... 4 RECENT DEVELOPMENTS OF THE SEARCHDIMENSION MALWARE FAMILY ............................................... 5 NVIDIA PATCHES 16 VULNERABILITIES IN RECENT SECURITY UPDATE ...................................................... 6 NEW QRAT PHISHING ATTACK ......................................................................................................................... 7 BUG IN INTEL X86 BOOT ROMS CAN EXPOSE DATA ..................................................................................... 7 EMISSARY PANDA APT USING RANSOMWARE ............................................................................................... 9 SOFTMAKER OFFICE SOFTWARE UNDER TARGETED ATTACK CAMPAIGN ............................................... 10 NEW PAYPAL PHISHING CAMPAIGN ............................................................................................................... 11 TELEGRAMS “PEOPLE NEARBY” FEATURE. ................................................................................................... 12 NEW ZEND FRAMEWORK RCE VULNERABILITY ........................................................................................... 12 GOOGLE PATCHES ANDROID RCE BUG ......................................................................................................... 13 BRAINTRACE.COM CONFIDENTIAL 1 BACKGROUND This report was created to update our clients on up-and-coming vulnerabilities and exploits that our security experts have discovered. Our team works diligently on researching threats and vulnerabilities to provide you with a safer network. If you have any questions, do not hesitate to contact us. NEW BABUK LOCKER RANSOMWARE The first new ransomware of 2021 is called Babuk Locker. The threat actors target users worldwide and demand a ransom of $60,000 to $85,000 in Bitcoin. Every Babuk Locker executable analyzed has been customized on a per-victim basis to contain a hardcoded extension, ransom note, and a Tor victim URL. Affected Systems ◾ All Systems Vulnerability Overview The threat actors use the Elliptic-curve Diffie–Hellman algorithm to encrypt the victim's files. This algorithm has proven effective in attacking a lot of companies so far. The threat actors use a command- line argument to control if the ransomware encrypts the network or the local files first. Once launched, the ransomware will terminate various Windows services and processes known to keep files open and prevent encryption, such as database servers, mail servers, backup software, mail clients, and web browsers. During encryption, Babuk Locker will use a hardcoded extension and append it to each encrypted file. So far, all of the file extensions have been the same, [.]__NIST_K571__. A ransom note is created with the victim's name and links to images proving that the threat actors stole the files during encryption. The note contains a basic explanation and a link to a Tor site where the victim can negotiate the ransom with the threat actors. A Babuk Locker representative states that they will soon launch a dedicated leak site post the stolen data in a hacker forum. Indicators of Compromise Ransom note: ◾ How To Restore Your Files[.]txt SHA256: ◾ 8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9 MD5: ◾ e10713a4a5f635767dcd54d609bed977 Filename: ◾ ecdh_pub_k[.]bin BRAINTRACE.COM CONFIDENTIAL 2 Recommendation It is recommended to have strong security practices and not download or open any files from a phishing email or unknown source. Reference https://www.bleepingcomputer.com/news/security/babuk-locker-is-the-first-new-enterprise- ransomware-of-2021/ FILELESS MALWARE When computers get infected with malware, a file is usually saved on the culprit's computer. Then antivirus software or other malware removal tools are sent to find the malicious file and remove it. From there, the computer is cleared of this threat. Fileless malware is not saved on the computer, and because of that, it may be able to evade antivirus software and other security monitoring tools if not configured correctly. Affected Systems ◾ All Systems Vulnerability Overview Fileless malware works slightly differently because it sends its malware through a file, but the file is not saved on the computer. Rather it is disguised as a process and running in memory. Even then, there are versions of malware where fileless malware will get on the system through exploitation code execution or abusing a network application's ability to run system commands. Overall, fileless malware is harder to detect and will need various methods to detect, such as evaluating a process's behavior or determining normal traffic. Recommendation Verify that whatever security solution you are using can identify indicators that exist solely in memory. Reference https://www.helpnetsecurity.com/2021/01/04/fileless-malware/?web_view=true POSSIBLE CLONING OF YOUR GOOGLE TITAN 2FA SECURITY KEY Multi-factor authentication is a great layer of defense when it comes to the security of an account. A user needs to know their password, but having something in their possession, whether it is a software token or hardware token, dramatically increases the chance of an account not being accessed without BRAINTRACE.COM CONFIDENTIAL 3 permission. Hardware keys or tokens have been used for some time. In this article, security researchers discuss how threat actors can clone these keys by exploiting an electromagnetic side-channel in the chip embedded in it. Affected Systems ◾ All versions of Google Titan Security Key (all versions), Yubico Yubikey Neo, Feitian FIDO NFC USB-A / K9, Feitian MultiPass FIDO / K13, Feitian ePass FIDO USB-C / K21, and Feitian FIDO NFC USB-C / K40. ◾ NXP JavaCard chips, including NXP J3D081_M59_DF, NXP J3A081, NXP J2E081_M64, NXP J3D145_M59, NXP J3D081_M59, NXP J3E145_M64, and NXP J3E081_M64_DF, and their respective variants. Vulnerability Overview The vulnerability is linked to accounts from a FIDO Universal 2nd Factor device like the Google Titan Key or Yubikey and other keys listed in this report and article. The attacker would need to steal the credentials linked to the key, gain access to the Titan Security key question, and have the skills to write custom software to pull the key linked to the account and $12,000 worth of equipment to accomplish this task. An obtained key would need to be taken apart and then glean the ECDSA encryption key via a side- channel attack in which the electromagnetic radiations are observed coming off of the NXP chip. Recommendation It is still recommended to use the Google security key because of the sophistication of the attack, but to remain aware of your key's physical location. Reference https://thehackernews.com/2021/01/new-attack-could-let-hackers-clone- your.html?&web_view=true SWATTING ATTACKS WITH IOT DEVICES. The FBI sent out an alert earlier this week about hackers being able to hijack smart home systems with stolen email passwords after being reached out by the device manufacturers about these ongoing attacks. VICE reported finding RING credential stuffing for as little as six dollars on hacker forums. RING is also planning to come out with End-to-End encryption by the end of the year to help with security. Affected Systems ◾ RING doorbell, and other Smart devices and surveillance systems. BRAINTRACE.COM CONFIDENTIAL 4 Vulnerability Overview Threat actors hijack a victim’s smart security systems with stolen email passwords to swat the victim’s home. Swatting is a falsely reported emergency to authorities to get swat teams at specific locations where there is no emergency. Swatting is nothing new and has targeted video streamers in the past. However, it’s recently been targeting smart doorbells and smart surveillance cameras. In the past, swatting attacks would make calls appear as if it were coming from the victims by spoofing the phone number, but with threat actors hacking into security devices directly, it makes the calls look more legitimate. Recommendation It is recommended not to use the same credentials for multiple accounts and to make sure you have two-factor authentication enabled where possible. Reference https://threatpost.com/fbi-warn-home-security-devices-swatting/162678/ RECENT DEVELOPMENTS OF THE SEARCHDIMENSION MALWARE FAMILY SearchDimension is a malware family that hijacks browsers to make money through ad clicks. In 2020, SearchDimension expanded its features by obfuscating the process required to remove its malicious browser extensions, malicious web push notifications, complete replacement of your current browser with a compromised version, and overriding the search engine in use in preference of their own. Affected Systems ◾ Windows ◾ macOS Vulnerability Overview The new push notification feature allows SearchDimension to push advertising