Crypto-Mining, Banking Trojans Top Malware Threats

By: Kacy Zurkus

Crypto-mining malware has again topped the threat index, with Coinhive holding strong in the number one malware threat for the 13th consecutive month, according to the latest Global Threat Index for December 2018, published by Check Point.

The threat index looks at the most common active malware variants and trends as cyber criminals evolve toward crypto-mining and multipurpose malware.

A second-stage downloader, SmokeLoader, first identified back in 2011, jumped to ninth place on the December top-10 list. “After a surge of activity in the Ukraine and Japan, its global impact grew by 20. SmokeLoader is mainly used to load other malware, such as Trickbot Banker, AZORult Infostealer and Panda Banker,” according to a press release.

“December’s report saw SmokeLoader appearing in the top 10 for the first time. Its sudden surge in prevalence reinforces the growing trend towards damaging, multipurpose malware in the Global Threat Index, with the top 10 divided equally between crypto-miners and malware that uses multiple methods to distribute numerous threats,” said Maya Horowitz, threat intelligence and research group manager at Check Point.

“The diversity of the malware in the Index means that it is critical that enterprises employ a multilayered cybersecurity strategy that protects against both established malware families and brand new threats.”


Hundreds of Thousands Download Spyware from Google Play

By: Ionut Arghire

Hundreds of thousands of users ended up with spyware on their devices after downloading seemingly legitimate applications from Google Play, Trend Micro security researchers have discovered. 

Detected as MobSTSPY, the malware, which can gather various information from the victims, isn’t new. For distribution, its operators chose to masquerade the threat as legitimate Android applications and submit them to Google Play.

Trend Micro discovered a total of six such applications, including FlashLight, HZPermis Pro Arabe, Win7imulator, Win7Launcher, Flappy Bird, and Flappy Birr Dog. Available for download in Google Play in 2018, some of these were downloaded over 100,000 times by users from all over the world.

Once one of these applications has been installed on the victim’s device, the spyware can proceed to stealing information such as SMS conversations, call logs, user location, and clipboard items. The malware sends the collected information to the attacker’s server using Firebase Cloud Messaging.

Upon initial execution, the malware checks the device’s network availability, after which it reads and parses an XML configuration file from its command and control (C&C) server. Next, it collects information such as language used on the device, registered country, package name, manufacturer, etc.

The information is then sent to the C&C server for registration purposes. After this step has been completed, the malware waits for the server to send over commands to execute.

Based on the received commands, the spyware can not only steal SMS messages and call logs, but can also retrieve contact lists and files found on the device.

The malware can also perform a phishing attack to gather credentials from the infected device, the security researchers discovered. It can display fake Facebook and Google pop-ups, thus tricking the user into revealing their account details.

After the user provides the credentials, a fake pop-up informs them the log-in was unsuccessful, but at this point the malware has already stolen the credentials.

“Part of what makes this case interesting is how widely its applications have been


Suspected Ransomware Outbreak Disrupts US Newspapers

By: Mathew J. Schwartz


Tribune Media Suspects Ryuk Ransomware Hit Publishing and Production Systems

Production of newspapers owned by Chicago-based Tribune Publishing have been disrupted after malware began infecting the company’s publishing and printing systems.

Multiple sources quoted by Tribune newspapers have suggested that the malware infection, which began late on Thursday, involved ransomware known as Ryuk, which may tie to North Korean operators. But security experts say it’s far too soon to label Tribune’s ransomware outbreak as anything more than an opportunistic infection, and note that anyone can potentially obtain and use malware, irrespective of their identity, political affiliation or other motivations (see Stop the Presses: Don’t Rush Tribune Ransomware Attribution).

Tribune Publishing says the malware infection, which it discovered on Friday, compromised no financial information and had no impact on its websites, but did disrupt systems that it uses to publish and print its newspapers. All of its newspapers were affected.

“This issue has affected the timeliness and in some cases the completeness of our printed newspapers,” Tribune Publishing spokeswoman Marisa Kollias said in a statement released on Saturday, the Chicago Tribune reported. “Our websites and mobile applications however, have not been impacted.”

Kollias said the company is “making progress” with restoring systems. “There is no evidence that customer credit card information or personally identifiable information has been compromised,” she said.

Formerly known as Tronc, Tribune Publishing owns the Chicago Tribune, as well as Chicago suburban newspapers Lake County News-Sun and Post-Tribune; Los Angeles Times; The Baltimore Sun; the New York Daily News; Hartford Courant; Orlando Sentinel; the Capital Gazette in Annapolis, Maryland; The Morning Call in Allentown, Pennsylvania; and in Virginia, the Daily Press in Newport News, and The Virginian-Pilot in Norfolk.


Attackers Connect with Malware via Malicious Memes

By: Kacy Zurkus

A new type of malware has been found listening for commands from malicious memes posted on Twitter, according to new research from Trend Micro.

Cyber-criminals are using the social site as an unwilling conduit in communicating with its mothership through the use of steganography, a tactic that hides a payload inside an image in order to evade detection. The payload also instructs the malware to take a screenshot and collect system information from the infected computer, Aliakbar Zahravi wrote in a recent blog post.

“This new threat (detected as TROJAN.MSIL.BERBOMTHUM.AA) is notable because the malware’s commands are received via a legitimate service (which is also a popular social networking platform), employs the use of benign-looking yet malicious memes, and it cannot be taken down unless the malicious Twitter account is disabled. Twitter has already taken the account offline as of December 13, 2018,” the blog said.

In late October, the malware authors posted malicious memes in two separate tweets. Using a Twitter account run by the malware operator, the malware listens for a command embedded in the memes. Once downloaded from the Twitter account onto the victim’s machine, the malware parses in order to act as the command-and-control (C&C) service for the malware, according to Zahravi.


New Shamoon Malware Variant Targets Italian Oil and Gas Company

By: Swati Khandelwal

Shamoon is back… one of the most destructive malware families that caused damage to Saudi Arabia’s largest oil producer in 2012 and this time it has targeted energy sector organizations primarily operating in the Middle East.

Earlier this week, Italian oil drilling company Saipem was attacked and sensitive files on about 10 percent of its servers were destroyed, mainly in the Middle East, including Saudi Arabia, the United Arab Emirates and Kuwait, but also in India and Scotland.

Saipem admitted Wednesday that the computer virus used in the latest cyber attack against its servers is a variant Shamoon—a disk wiping malware that was used in the most damaging cyber attacks in history against Saudi Aramco and RasGas Co Ltd and destroyed data on more than 30,000 systems.

The cyber attack against Saudi Aramco, who is the biggest customer of Saipem, was attributed to Iran, but it is unclear who is behind the latest cyber attacks against Saipem.

Meanwhile, Chronicle, Google’s cybersecurity subsidiary, has also discovered a file containing Shamoon sample that was uploaded to VirusTotal file analyzing service on 10th December (the very same day Saipem was attacked) from an IP address in Italy, where Saipem is headquartered.

However, the Chronicle was not sure who created the newly discovered Shamoon samples or who uploaded them to the virus scanning site.


América Latina registra 3,7 milhões de ataques de malware por dia, afirma Kaspersky Lab

By: TI Inside Online

A Kaspersky Lab registrou um aumento de 14,5% nos ataques de malware durante os últimos 12 meses na América Latina em relação a 2017– o que significa uma média de 3,7 milhões de ataques diários e mais de 1 bilhão no ano. Entre os países que registraram maior crescimento, a Argentina está no primeiro lugar com um aumento de 62%, seguido pelo Peru (39%) e México (35%). “Os resultados mostram que toda a região tem experimentado uma quantidade considerável de ciberameaças, com a grande maioria concentrada em roubo de dinheiro”, destaca Fabio Assolini, analista sênior de segurança da Kaspersky Lab.

Além dos malware, a Kaspersky Lab bloqueou mais de 70 milhões de ataques de phishing na América Latina entre novembro de 2017 e novembro de 2018; a média de ataques diário é de 192 mil, representando um crescimento de 115% quando comparado com o período anterior (novembro/2016 até novembro/2017). O ranking dos países mais atacados por phishing está diferente neste ano: o Brasil perdeu a liderança e agora figura em terceiro lugar no ranking, com um aumento de 110%. O México (120%) está na primeira posição e a Colômbia (118%) em segundo lugar.

Phishing e vulnerabilidade

O aumento constante dos números de ataques de phishing é uma das principais razões de comprometimento de contas. Isso porque, os usuários que clicam em links suspeitos, por muitas vezes, fornecem informações pessoais e logins de acesso. As violações de dados têm se tornado comuns e preocupantes, já que as pessoas revelam não apenas uma grande quantidade de informações sobre elas mesmas, mas também informam detalhes do cartão de crédito e conta corrente. Em posse destes, violações e acessos não-autorizados são os menores dos problemas, o maior deles serão os danos financeiros, pois a primeira coisa que o cibercriminoso fará será tentar efetuar compras em nome da vítima.

“Tipos de incidentes assim servem como um grande passo para que algumas mudanças importantes nas políticas de privacidade e no comportamento das pessoas sejam feitas em relação aos dados que são compartilhados”, diz Assolini. “É muito comum que os usuários utilizem as mesmas senhas para diferentes sites e o cibercriminoso testará a combinação em todos os serviços e redes sociais mais populares. Ao ter informações vazadas, a primeira e mais importante ação que deve ser feita é a troca das senhas em outros logins – mesmo que este não tenha sido comprometido.”


Por mais que Argentina, Brasil, Chile, Colômbia, México e Peru façam parte da América Latina e sejam visados por diferentes cibercriminosos, é preciso entender que os golpes têm se desenvolvido de maneiras distintas em cada país. Na Argentina, o caso Prilex voltou à tona quando um turista viajou ao Brasil e teve seu cartão de crédito clonado. “A primeira vez que identificamos esse grupo foi em um ataque à caixas eletrônicos direcionado aos bancos, principalmente no território brasileiro. Posteriormente, o grupo migrou seus esforços para sistemas de pontos de venda desenvolvidos por fornecedores brasileiros, clonando cartões de crédito, o que permitia a criação de um novo golpe totalmente funcional, habilitado inclusive para transações protegidas por chip e senha”, explica Assolini.

Redes sociais, nuvem e celulares serão os principais alvos do cibercrime em 2019

By: TI Inside Online

Em seu Relatório de Previsões de Ameaças para 2019, a McAfee, empresa de segurança cibernética, identificou as principais ameaças virtuais para o próximo ano. Os pesquisadores preveem o aumento de malware como serviço, o mercado de terceirização de ataques e a evolução dessas ameaças, cada vez mais inovadoras e ágeis. Além disso, dados corporativos, eletrodomésticos de IoT e a reputação de marcas estarão em risco, já que os criminosos cibernéticos usarão amplamente as redes sociais, a nuvem e celulares como principais focos de ataque.

Confira abaixo as principais previsões para 2019:

Roubo de dados na nuvem

A McAfee prevê um aumento considerável no número de ataques de grandes volumes de dados corporativos, armazenados na nuvem. Até 21% do conteúdo atualmente gerenciado na nuvem inclui materiais confidenciais como propriedade intelectual, dados de clientes e informações pessoais. Os possíveis cenários incluem ataques nativos tendo como alvo APIs vulneráveis ou endpoints de API não governados, roubo em bancos de dados bem como o uso da nuvem como um “trampolim” para ataques de interceptação ou de ransomware ou cryptojacking (mineração de criptomoedas).

Criminosos unidos

Os criminosos, com diferentes experiência e conhecimentos, estão se unindo para vender componentes de ataques modulares, fortalecendo o mercado de malware e realizando ataques bem-sucedidos com maior facilidade. As quadrilhas cibernéticas tendem a se associar com crimes de lavagem de dinheiro, técnicas de evasão e explorações de vulnerabilidades. Deverá haver um aumento no número de malwares móveis, botnets, fraudes bancárias e ransomwares.

 Ataques simplificados

À medida que a segurança vem sendo reforçada, os criminosos precisam ser cada vez mais criativos. A disponibilidade de componentes de ataque modulares no mercado clandestino deverá permitir que os atacantes combinem e readaptem táticas e tecnologias tradicionais para atingir novos objetivos.


Half a million Android users tricked into downloading malware from Google Play

By: Zack Whittaker

More than half a million users have installed Android malware posing as driving games — from Google’s own app store.

Lukas Stefanko, a security researcher at ESET, tweeted details of 13 gaming apps — made by the same developer — which were at the time of his tweet downloadable from Google Play. Two of the apps were trending on the store, he said, giving the apps greater visibility.

Combined, the apps surpassed 580,000 installs before Google pulled the plug.

Anyone downloading the apps were expecting a truck or car driving game. Instead, they got what appeared to be a buggy app that crashed every time it opened.

In reality, the app was downloading a payload from another domain — registered to an app developer in Istanbul — and installed malware behind the scenes, deleting the app’s icon in the process. It’s not clear exactly what the malicious apps do; none of the malware scanners seemed to agree on what the malware does, based on an uploaded sample to VirusTotal. What is clear is that the malware has persistence — launching every time the Android phone or tablet is started up, and has “full access” to its network traffic, which the malware author can use to steal secrets.

We reached out to the Istanbul-based domain owner, Mert Ozek, but he did not respond to our email. (If that changes, we’ll update).

Most Orgs Enabling BYOD Lack Security Controls

By: Kacy Zurkus

A new report looked at the number of companies that allow users to access corporate data on personal devices and found that most organizations enabling BYOD lack proper security controls, according to Bitglass.

With the advent of the cloud, more employees are taking advantage of being able to work from anywhere at anytime on any device, including non-company issued devices. The Bitglass 2018 BYOD report found that 85% of enterprises now allow data access from personal devices for employees, partners, customers, contractors and even suppliers. As a result, more than half (51%) of participating firms report a rise in mobile security threats this year. Based on a survey of nearly 400 enterprise IT professionals, the study also found that 43% of organizations are not able to determine whether the personal devices that are accessing corporate data have actually downloaded malware.

In addition, only 56% of companies use the basic protections of remote wipe and mobile device management tools, though these tools do lead the pack in adoption of companies employing BYOD, according to the report. Only 30% of firms are confident that they are properly defending against malware on personal and mobile devices.

“BYOD increases employee mobility, and consequently, organizational flexibility, efficiency and collaboration,” the report said. Though the main drivers for enabling BYOD are employee mobility (74%), employee satisfaction (54%) and reduction in cost (49%), only 19% of organizations reported enabling BYOD because it reduces security risks. As little as 15% of organizations reported that they do not enable BYOD for any users.


Cyber-Attacks Are Top Business Risk in North America and Europe

By: Phil Muncaster

Cyber-attacks are the number one business risk in the regions of Europe, North America and East Asia and the Pacific, according to a major new study from the World Economic Forum(WEF).

Its Regional Risks for Doing Business report highlights the opinions of 12,000 executives from across the globe.

While “unemployment or underemployment” and “failure of national governance” take first and second place respectively, cyber threats have moved from eighth in last year’s report to fifth this year.

It tended to be viewed as a greater risk in more advanced economies: 19 countries from Europe and North America plus India, Indonesia, Japan, Singapore and the United Arab Emirates ranked it as number one.

In Europe, the UK and Germany both placed cyber-attacks as the number one risk.

Bromium’s EMEA CTO, Fraser Kyne, argued that businesses are still suffering despite spending an estimated $118bn on cybersecurity globally.

“When looking at the causes of breaches, it’s evident that email attachments, links and downloads are the most common methods used by hackers. Be it HR professionals opening infected CVs from unknown sources, or employees clicking links on malware-riddled social media sites on their lunch break, users provide hackers with an easy route to bypass security,” he added.

“These simple attack methods are still effective because the architecture cybersecurity is built on is fundamentally flawed, as it overwhelmingly relies on detecting these threats. We’re increasingly seeing zero-day and other polymorphic malware being used to evade detection. Even the more sophisticated detection-based tools that utilize machine learning, AI and behavioral analytics to identify anomalies and patterns can potentially struggle to determine what is good and what is bad – and are certainly never able to be 100% accurate.”