Daily Archives: December 20, 2022

Advisories

Threat Actors Abused Signed Microsoft Drivers

Read Time:1 Minute, 5 Second

FortiGuard Labs is aware that Microsoft recently disclosed that threat actors had used Windows drivers certified by Microsoft maliciously, which prompted them to revoke their signing certificates. According to the Microsoft’s advisory, the malicious drivers were used for post-exploitation activities including ransomware deployment to compromised machines. Separate reports indicate malicious signed-driver named “POORTRY” and STONESTOP malware was used to terminate processes belonging to AV and EDR solutions. Why is this Significant?This is significant because malicious drivers legitimately signed by Microsoft are trusted by the operating system and the use of such drivers allows attackers to perform activities with highest privileges on compromised machines. One of the reported activities include the deployment of Cuba ransomware. Other reports indicate threat actors used “POORTRY”, a malicious driver signed by Microsoft, and STONESTOP malware to terminate processes belonging to AV and EDR solutions.Microsoft’s advisory states that they suspended developer accounts that were likely abused by threat actors to get Microsoft to sign malicious files through a legitimate process. Also, Microsoft revoked signing certificates used to sign the malicious files.What is the Status of Coverage?FortiGuard Labs provides the following AV signatures for the reported and available samples involved in the incident:W64/BURNTCIGAR.BQ!trW64/BURNTCIGAR.CA!trW64/BURNTCIGAR.CB!trW64/Agent.ARD!trRiskware/BURNTCIGARW32/PossibleThreat

Read More

Advisories

Mallox Ransomware

Read Time:1 Minute, 41 Second

FortiGuard Labs is aware of recent reports of an uptick of activity in the Mallox ransomware observed in the wild. Reportedly, the Mallox threat actor distributes ransomware via a downloader attached to spam emails by targeting unsecured internet-facing Microsoft SQL servers. Mallox ransomware encrypts files on compromised machines and typically adds a “.mallox” file extension to the affected files.Why is this Significant?This is significant because recent reports highlight an increased uptick of Mallox ransomware activities. Ransomware infection causes disruption, damage to daily operations, potential impact to an organization’s reputation, and the unwanted destruction or release of personally identifiable information (PII), etc.What is Mallox Ransomware?Mallox is a ransomware strain that has been around since 2021 and is also known as Fargo. The ransomware encrypts files on compromised machines and typically adds a “.mallox” file extension to the affected files. Mallox leaves a ransom note titled “FILE RECOVERY.txt” that contains the ransom message, victim’s private key, and a TOR site address where victims can contact the attacker. The TOR site also works as a data leak site where information stolen from the victims will be released if ransom payment is not made. At the time of this writing, the leak site listed one company, however previous victims may have been removed.Ransom note left by Mallox ransomwareMallox ransomware threat actor reportedly distributes the ransomware via downloader malware attached to spam emails. The threat actor also targets unsecured internet-facing Microsoft SQL servers by attempting to log with a list of username and password combinations.What is the Status of Protection?FortiGuard Labs provides the following AV signatures for known Mallox ransomware samples:W32/Filecoder.D181!tr.ransomW32/Filecoder.OJC!tr.ransomW32/Generic.AC.171!tMSIL/Agent.LXR!trMSIL/Agent.LYC!trMSIL/Agent.NLO!tr.dldrMSIL/Agent.NZA!tr.dldrMSIL/Agent.OBD!tr.dldrMSIL/Agent.OEY!tr.dldrMSIL/Agent.OFN!tr.dldrMSIL/Agent.OHG!tr.dldrMSIL/GenKryptik.FMRD!trMSIL/Kryptik.ADHC!trMSIL/Kryptik.AGYT!tr.ransomMSIL/Kryptik.AHJZ!trMSIL/Kryptik.DCC!trPossibleThreat

Read More

News

Hacked Ring Cams Used to Record Swatting Victims

Read Time:4 Minute, 15 Second

Photo: BrandonKleinPhoto / Shutterstock.com

Two U.S. men have been charged with hacking into the Ring home security cameras of a dozen random people and then “swatting” them — falsely reporting a violent incident at the target’s address to trick local police into responding with force. Prosecutors say the duo used the compromised Ring devices to stream live video footage on social media of police raiding their targets’ homes, and to taunt authorities when they arrived.

Prosecutors in Los Angeles allege 20-year-old James Thomas Andrew McCarty, a.k.a. “Aspertaine,” of Charlotte, N.C., and Kya Christian Nelson, a.k.a. “ChumLul,” 22, of Racine, Wisc., conspired to hack into Yahoo email accounts belonging to victims in the United States. From there, the two allegedly would check how many of those Yahoo accounts were associated with Ring accounts, and then target people who used the same password for both accounts.

An indictment unsealed this week says that in the span of just one week in November 2020, McCarty and Nelson identified and swatted at least a dozen different victims across the country.

“The defendants then allegedly accessed without authorization the victims’ Ring devices and transmitted the audio and video from those devices on social media during the police response,” reads a statement from Martin Estrada, the U.S. Attorney for the Central District of California. “They also allegedly verbally taunted responding police officers and victims through the Ring devices during several of the incidents.”

James Thomas Andrew McCarty.

The indictment charges that McCarty continued his swatting spree in 2021 from his hometown in Kayenta, Ariz., where he called in bomb threats or phony hostage situations on more than two dozen occasions.

The Telegram and Discord aliases allegedly used by McCarty — “Aspertaine” and “Couch,” among others — correspond to an identity that was active in certain channels dedicated to SIM-swapping, a crime that involves stealing wireless phone numbers and hijacking the online financial and social media accounts tied to those numbers.

Aspertaine bragged on Discord that he’d amassed more than $330,000 in virtual currency. On Telegram, the Aspertaine/Couch alias frequented several popular SIM-swapping channels, where they initially were active as a “holder” — a low-level but key SIM-swapping group member who agrees to hold stolen cryptocurrency after an account takeover is completed. Aspertaine later claimed more direct involvement in individual SIM-swapping attacks.

In September, KrebsOnSecurity broke the news about a wide-ranging federal investigation into “violence-as-a-service” offerings on Telegram and other social media networks, wherein people can settle scores by hiring total strangers to carry out physical attacks such as brickings, shootings, and firebombings at a target’s address.

The story observed that SIM swappers were especially enamored of these “IRL” or “In Real Life” violence services, which they frequently used to target one another in response to disagreements over how stolen money should be divided amongst themselves. And a number of Aspertaine’s peers on these SIM-swapping channels claimed they’d been ripped off after Aspertaine took more than a fair share from co-conspirators.

On April 30, 2022, a member of a popular SIM-swapping group on Telegram who was slighted by Aspertaine put out the word that he was looking for some physical violence to be visited on McCarty’s address in North Carolina. “Anyone live near here and wants to [do] a job for me,” the job ad with McCarty’s home address read. “Jobs range from $1k-$50k. Payment in BTC [bitcoin].” It’s unclear if anyone responded to that job offer.

In May 2021, KrebsOnSecurity published The Wages of Password ReUse: Your Money or Your Life, which observed that when normal computer users fall into the nasty habit of recycling passwords, the result is most often some type of financial loss. Whereas, when cybercriminals reuse passwords, it often costs them their freedom.

But perhaps that story should be updated, because it’s now clear that password reuse can also put you in mortal danger. Swatting attacks are dangerous, expensive hoaxes that sometimes end in tragedy.

In June 2021, an 18-year-old serial swatter from Tennessee was sentenced to five years in prison for his role in a fraudulent swatting attack that led to the death of a 60-year-old man.

In 2019, prosecutors handed down a 20-year sentence to Tyler Barriss, a then 26-year-old serial swatter from California who admitted making a phony emergency call to police in late 2017 that led to the shooting death of an innocent Kansas man.

McCarty was arrested last week in Arizona, and charged with conspiracy to intentionally access computers without authorization. Prosecutors said Nelson is currently incarcerated in Kentucky in connection with unrelated investigation.

If convicted on the conspiracy charge, both defendants would face a statutory maximum penalty of five years in federal prison. The charge of intentionally accessing without authorization a computer carries a maximum possible sentence of five years. A conviction on the additional charge against Nelson — aggravated identity theft — carries a mandatory two-year consecutive sentence.

Read More