LOOKBACK — New advanced malware, possibly natio
Post# of 82669
(Total Views: 288)
Posted On: 08/02/2019 10:59:49 AM
LOOKBACK —
New advanced malware, possibly nation sponsored, is targeting US utilities
Dear Engineer. You failed your licensing exam. Open this document to learn more.
DAN GOODIN - 8/2/2019, 3:00 AM
A new piece of advanced espionage malware, possibly developed by a nation-supported attacker, targeted three US companies in the utilities industry last month, researchers from security firm Proofpoint reported on Thursday.
Employees of the three unnamed companies, Proofpoint reported, received emails purporting to come from the National Council of Examiners for Engineering and Surveying. This non-profit group develops, administers, and scores examinations used in granting licenses for US engineers. Using the official NCEES logo and the domain nceess[.]com, the emails said that the recipients failed to achieve a passing score on a recent exam. The attached Word document was titled Result Notice.doc.
Proofpoint
Malicious macros embedded into the document attempted to install a package of full-featured malware Proofpoint calling LookBack. Components included a remote-access trojan written in C++ and a proxy tool for communicating with a command-and-control server. Once LookBack was installed, it gave attackers a full range of capabilities that include:
Get process listing
Kill process
Execute cmd[.] exe commands
Get drive type
Find files
Read files
Delete files
Write to files
Execute files
Enumerate services
Start services
Delete services
Take a screenshot of the desktop
Move/Click Mouse and take a screenshot
Exit
Remove self
Shutdown
Reboot
Beyond its wide-ranging capabilities, LookBack was advanced for other reasons. The command server proxy could impersonate WinGup, an open source updater that's used by Notepad++ in an attempt to camouflage itself. Another way LookBack avoided detection: a dynamic link library appeared to be a legitimate DLL file for the software tool libcurl except for a single exported function. The attackers used the function to extract encrypted data in the DLL to carry out communications and establish persistence on the infected computer.
Sherrod DeGrippo, Proofpoint's senior director of threat research and detection, said his company was able to block all phishing attempts used against the three customers in this campaign. The researcher said it's not clear if there were other targets or if any of them were infected.
Proofpoint said that the macros found in the Word document are similar to ones used in targeted attacks against Japanese businesses last year. Specifically: the macros, written in the Visual Basic for Applications language, used a large number of concatenation commands, possibly in an attempt to evade detection of the malicious macros. The macro pictured immediately below is from 2018. The one below that was used in the attacks from last month.
Proofpoint
According to security firm FireEye, an advanced persistent threat group operating out of China, called APT10 or Menupass, carried out the 2018 attacks against Japanese businesses.
"The macros used in the incident described by Proofpoint are highly similar to the macros used by APT10 in 2018," FireEye Principal Analyst Sarah Jones said in an emailed statement. "We also concur that the malware is, in fact, different than what was used previously in 2018. At this time, we cannot definitively attribute this to APT10 or any other named group."
While it's still not clear precisely who is behind the recent campaign, there's little doubt it poses a significant threat given its target.
"The detection of a new malware family delivered using phishing tactics once used by known APT adversaries highlights a continuing global risk from nation-state actors," Proofpoint researchers Michael Raggi and Dennis Schwarz wrote. "While definitive attribution in this instance requires further study of infrastructure, toolsets, and methodologies, the risk that these campaigns pose to utilities providers is clear. The profile of this campaign is indicative of specific risk to US-based entities in the utilities sector."
The report includes indicators of compromise that other utilities can use to help determine if they have been targeted or infected.
New advanced malware, possibly nation sponsored, is targeting US utilities
Dear Engineer. You failed your licensing exam. Open this document to learn more.
DAN GOODIN - 8/2/2019, 3:00 AM
A new piece of advanced espionage malware, possibly developed by a nation-supported attacker, targeted three US companies in the utilities industry last month, researchers from security firm Proofpoint reported on Thursday.
Employees of the three unnamed companies, Proofpoint reported, received emails purporting to come from the National Council of Examiners for Engineering and Surveying. This non-profit group develops, administers, and scores examinations used in granting licenses for US engineers. Using the official NCEES logo and the domain nceess[.]com, the emails said that the recipients failed to achieve a passing score on a recent exam. The attached Word document was titled Result Notice.doc.
Proofpoint
Malicious macros embedded into the document attempted to install a package of full-featured malware Proofpoint calling LookBack. Components included a remote-access trojan written in C++ and a proxy tool for communicating with a command-and-control server. Once LookBack was installed, it gave attackers a full range of capabilities that include:
Get process listing
Kill process
Execute cmd[.] exe commands
Get drive type
Find files
Read files
Delete files
Write to files
Execute files
Enumerate services
Start services
Delete services
Take a screenshot of the desktop
Move/Click Mouse and take a screenshot
Exit
Remove self
Shutdown
Reboot
Beyond its wide-ranging capabilities, LookBack was advanced for other reasons. The command server proxy could impersonate WinGup, an open source updater that's used by Notepad++ in an attempt to camouflage itself. Another way LookBack avoided detection: a dynamic link library appeared to be a legitimate DLL file for the software tool libcurl except for a single exported function. The attackers used the function to extract encrypted data in the DLL to carry out communications and establish persistence on the infected computer.
Sherrod DeGrippo, Proofpoint's senior director of threat research and detection, said his company was able to block all phishing attempts used against the three customers in this campaign. The researcher said it's not clear if there were other targets or if any of them were infected.
Proofpoint said that the macros found in the Word document are similar to ones used in targeted attacks against Japanese businesses last year. Specifically: the macros, written in the Visual Basic for Applications language, used a large number of concatenation commands, possibly in an attempt to evade detection of the malicious macros. The macro pictured immediately below is from 2018. The one below that was used in the attacks from last month.
Proofpoint
According to security firm FireEye, an advanced persistent threat group operating out of China, called APT10 or Menupass, carried out the 2018 attacks against Japanese businesses.
"The macros used in the incident described by Proofpoint are highly similar to the macros used by APT10 in 2018," FireEye Principal Analyst Sarah Jones said in an emailed statement. "We also concur that the malware is, in fact, different than what was used previously in 2018. At this time, we cannot definitively attribute this to APT10 or any other named group."
While it's still not clear precisely who is behind the recent campaign, there's little doubt it poses a significant threat given its target.
"The detection of a new malware family delivered using phishing tactics once used by known APT adversaries highlights a continuing global risk from nation-state actors," Proofpoint researchers Michael Raggi and Dennis Schwarz wrote. "While definitive attribution in this instance requires further study of infrastructure, toolsets, and methodologies, the risk that these campaigns pose to utilities providers is clear. The profile of this campaign is indicative of specific risk to US-based entities in the utilities sector."
The report includes indicators of compromise that other utilities can use to help determine if they have been targeted or infected.
(0)
(0)Zerify Inc (ZRFY) Stock Research Links
WORDS TO LIVE BY:
Never argue with stupid people, they will drag you down to their level and then beat you with experience.
Get .... PrivacyLok https://cyberidguard.com/
Try SafeVchat: https://cyberidguard.com/
My comments are only my opinion and are not to be used for investment advice.
Please conduct your own due diligence before choosing to buy or sell any stock.
Never argue with stupid people, they will drag you down to their level and then beat you with experience.
Get .... PrivacyLok https://cyberidguard.com/
Try SafeVchat: https://cyberidguard.com/
My comments are only my opinion and are not to be used for investment advice.
Please conduct your own due diligence before choosing to buy or sell any stock.