Wizard Spider returns (and it still uses TrickBot). MuddyWater and Thanos ransomware. EU raises GDPR questions about ad tracker.

Summary

By the CyberWire staff

At a glance.

Wizard Spider: snapshot of a cybercriminal threat group.
MuddyWater deploys Thanos ransomware.
Ad tracker troubles in the EU.

An overview of WIZARD SPIDER’s web of tricks.

Since becoming infamous in 2016 for using Trickbot to hack into banking systems, the Russian cybercriminal group WIZARD SPIDER has expanded its malware toolbox, making it an effective and resilient threat. CrowdStrike offers an analysis of recent updates to the group’s arsenal.

Trickbot remains WIZARD SPIDER’s go-to big game hunting weapon, having already infected over a million systems globally. In September, cybersecurity professionals launched an operation to disrupt the malware’s activity, but so far there has been little success.
There has been an uptick in the use of BazarLoader as an infection vector in WIZARD SPIDER’s spam campaigns. Due to the loader’s unique ability to imitate real software, it is a persistent foe.
Ryuk ransomware has been the group’s weapon of choice for extortion since 2018. After a short lull starting in March, Ryuk has reappeared in recent operations, now using macro-based code obfuscation to decelerate reverse engineering.
Conti ransomware is the newest addition, unique in that it is constantly upgraded to strategically encrypt files, use compiler-based obfuscation, and duck antivirus software. Featuring opportunistic targeting and a data leak site, Conti has compromised over one hundred twenty victims.

MuddyWater deploys Thanos ransomware.

BankInfo Security reports that cybersecurity firm ClearSky has identified a recent operation launched by an Iranian advanced persistent threat group dubbed MuddyWater (aka EMP.Zagros, Static Kitten, Mercury, and Seedworm). In action since 2017, MuddyWater has shifted its modus operandi and is now deploying Thanos ransomware, an unusual choice for a cybercriminal group known for espionage operations with the goal of destruction and not financial gain. The operation begins one of two ways: deploying a phishing email that includes a malicious PDF or Excel document, or taking advantage of a Microsoft Exchange vulnerability. In both cases, the objective is to deliver PowGoop, a malicious uploader that masquerades as a seemingly harmless Google update. And, as is now routinely the case, a ransomware attack should be treated as also tantamount to a data breach.

IAB Europe found flawed by Belgian DPA.

Ad industry body IAB Europe introduced a Transparency and Consent Framework (TCF) in April 2018 as a mechanism for gathering user consent for ad trackers, in order to help online advertisers comply with privacy laws in the EU’s General Data Protection Regulation (GDPR). However, TechCrunch reports, an investigation conducted by the Belgian Data Protection Authority (DPA) has found that the TCF is not so transparent after all, as the authority determined the framework fails to meet the fairness, accountability, and processing standards of the GDPR. Some experts argue that any sort of real-time bidding using behavioral tracking is in itself a privacy breach. The TCF has stated that the Belgian DPA’s interpretation of the GDPR is flawed and will impede the advancement of open-source compliance standards.

Selected Reading

European Regulator Turns Up Heat on Ad Tactics Used by Google and Rivals (Wall Street Journal) Tactics Google and other large online-ad players use in digital ad auctions violate EU privacy law, investigators for Belgium’s privacy regulator wrote in an internal report, a preliminary finding with implications across the continent.

IAB Europe’s ad tracking consent framework found to fail GDPR standard (TechCrunch) A flagship framework for gathering Internet users’ consent for targeting with behavioral ads — which is designed by ad industry body, the IAB Europe — fails to meet the required legal standards of data protection, according to findings by its EU data supervisor. The Belgian DPA&#8…

EU investigating Instagram over potential child data breach (Yahoo Sports) Ireland’s Data Protection Commissioner is looking into complaints that Instagram has made contact information on business accounts publicly available to anyone accessing the app.

Senator Questions US Healthcare Giant Over Cyber-Attack (Infosecurity Magazine) Universal Health Services questioned over cybersecurity after suffering ransomware attack

British Airways hit with UK data watchdog's biggest-ever fine (ETCIO.com) Britain's data protection watchdog said on Friday it has fined British Airways 20 million pounds - its biggest such penalty to date - for failing to p..

()

Irish regulator probes Facebook's handling of children's data on Instagram (Reuters) Ireland's Data Protection Commission (DPC) has launched two inquiries into Facebook Inc <FB.O> after concerns were raised about the social network giant's handling of children's personal data on Instagram.

Report: Iranian hacking group launched concentrated attack on Israeli companies (CTECH) ClearSky and Profero, who identified the attack said hackers launched fake ransomware attacks, aimed at encrypting company data

Wizard Spider Modifies and Expands Toolset [Adversary Update] (CrowdStrike) The CrowdStrike Intelligence team shares its analysis of key observations from WIZARD SPIDER's BazarLoader, Conti and Ryuk operations over recent months.

Iranian Hacking Group Suspected of Deploying Ransomware (BankInfo Security) A hacking group with links to Iran's government is suspected of using ransomware in attempts to damage the systems of organizations in Israel and other countries,

Google details tactics of Chinese hackers who targeted Biden campaign (CyberScoop) Google on Friday offered new details on tactics used by alleged Chinese government-linked hackers who previously targeted Democratic presidential nominee Joe Biden’s campaign, while warning that multiple state-linked hacking groups continue to show an interest in the U.S. election.

Google: Chinese Hackers Are Impersonating McAfee to Phish Victims (Gizmodo) The same Chinese government-linked hackers who targeted the campaigns of both 2020 presidential candidates earlier this year have been trying to trick users into installing malware by posing as the antivirus provider McAfee and using otherwise legitimate online services like GitHub and Dropbox.

How we're tackling evolving online threats (Google) An update on how threat actors are changing their tactics, and how Google’s Threat Analysis Group works to protect our products and the people using them.

Google stops biggest-ever DDoS cyber attack to date (Times Now News) The tech giant revealed that its infrastructure absorbed a massive 2.5Tbps DDoS in September 2017.

Google stops biggest-ever DDoS cyber attack to date (Express Computer) Read Article The cyber security threats such as distributed denial-of-service (DDoS) are growing exponentially, disrupting businesses of all sizes globally, leading to outages and loss of user trust, Google has said. The tech giant revealed that its infrastructure absorbed a massive 2.5Tbps DDoS in September 2017, the highest-bandwidth attack reported to date which was the […]

Hackers are using a severe Windows bug to backdoor unpatched servers (Ars Technica) Attackers are spraying the Internet to backdoor unpatched Active Directory systems.

Hackers now abuse BaseCamp for free malware hosting (BleepingComputer) Phishing campaigns have started to use Basecamp as part of malicious phishing campaigns that distribute malware or steal your login credentials.

Barnes & Noble restores Nook services after notifying customers about cyberattack (TechRepublic) Analysts point to specific clues from the company's response that show it may have been a ransomware attack.

Cyber scammers have conned about $364,000 from St. John's residents since February — here's how they did it (Chronicle Herald) The voice recording could reasonably rattle any unsuspecting person, especially when the call comes from a number legitimately belonging to the Canada Revenue Agency.

Donor data from narendramodi.in stolen and is on sale on dark web, alleges cyber security firm (India Today) A cyber security firm alleges that user and donor data of over five lakh people has been stolen from narendramodi.in, personal website of Prime Minister Modi, and the details are on sale on the dark web.

TPS data breach presents possible risks and dangers for students (13ABC) Local experts explain that personal data posted online could expose students and faculty to identity theft.

Nez Perce Tribe says cyberattack caused casino closures (The Lewiston Tribune) A cyberattack caused the computer disruptions that continue to keep Clearwater River Casino and Lodge near Lewiston and It’se Ye-Ye Casino at Kamiah closed, the Nez Perce Tribe announced Friday.

Nez Perce Tribe Casino's Experience External Cyber Threat, Anticipate Reopening Date of October 19 (Big Country News) LAPWAI - On Thursday, October 8, 2020 the Clearwater River Casino & Lodge and the It’se Ye-Ye Casino announced an immediate business closure caused by a major computer systems disruption

Albion Online game maker discloses data breach (ZDNet) Game maker says intruder gained access to its forum database by exploiting a vulnerability.

Kleenheat customer names and addresses exposed in system breach (ZDNet) The company says residential and email addresses, as well as names of some customers have been exposed.

Foxtons data breach but “no sensitive data compromised” (Estate Agent Today) Foxtons is alleged by a newspaper to have suffered a malware attack and data breach which closed its MyFoxtons client website.

Foxtons hit by cyber attack (Property Industry Eye) The agency tells EYE that it did not lose any personal customer and landlord contact details.

Data breach affects AdventHealth Hendersonville Foundation donors (ABC 13 News) A data breach is affecting one mountain area health care foundation.