New ransomware from Evil Corp. Ripple20 vulnerabilities in IoT supply chains. GuLoader being sold by an Italian front company.

Summary

By the CyberWire staff

At a glance.

New ransomware from Evil Corp.
Ripple20 vulnerabilities in IoT supply chains.
Lazarus Group suspected in LinkedIn phishing campaign.
GuLoader is being sold by an Italian front company.

New ransomware from Evil Corp.

Fox-IT has been tracking a new ransomware strain called "WastedLocker" that's been active since May 2020. The researchers say the malware was developed by Evil Corp, a criminal group best known for creating the Dridex banking Trojan and the BitPaymer ransomware. WastedLocker's emergence appears to be part of Evil Corp's efforts to switch out its TTPs following the indictment of two of the group's leaders by the US Justice Department in December 2019.

WastedLocker is distributed via SocGholish, a JavaScript malware that poses as a fake browser update on a phishing page. In this case, SocGholish is being used to deliver a custom Cobalt Strike loader, which in turn delivers the ransomware. Fox-IT notes that Evil Corp doesn't seem to engage in the type of data theft and extortion that's become a common feature of other targeted ransomware operations. The researchers suspect this is due to the group's desire to avoid attracting undue attention to itself.

Ripple20 vulnerabilities in IoT supply chains.

Researchers at Israeli cybersecurity firm JSOF have discovered nineteen vulnerabilities in a low-level TCP/IP software library used by at least "hundreds of millions" of IoT devices. The code was developed by the Ohio-based company Treck and has been integrated into the IoT supply chain since its release in the late '90s. The set of flaws, dubbed "Ripple20," includes four remote code execution vulnerabilities, two of which received CVSS scores of 10. Treck has developed patches for the flaws and urges its customers to contact them for more information, noting that the level of exposure to the vulnerabilities varies greatly from product to product.

The real challenge, however, is the fact that many IoT vendors likely don't know if their products contain the vulnerable code. JSOF collaborated with CERT/CC and the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) to track down "as many affected vendors as possible before the vulnerabilities became public," but there are many others whose status is still unknown. The researchers explain, "As we traced through the distribution trail of Treck's TCP/IP library, we discovered that over the past two decades this basic piece of networking software has been spreading around the world, through both direct and indirect use. As a dissemination vector, the complex supply chain provides the perfect channel, making it possible for the original vulnerability to infiltrate and camouflage itself almost endlessly."

Complicating matters further is the fact that the vulnerable library was originally developed in collaboration with a Japanese company, Elmic Systems (now called "Zuken Elmic"). Elmic later parted ways with Treck and continued selling the software across Asia under the name "Kasago." JSOF realized this resulted in an entirely separate supply chain managed by a different company throughout another part of the world. Japan's CERT (JPCERT/CC) is currently trying to determine the extent of this side of the issue, but JSOF says "Initial research shows Kasago to be in widespread use."

JSOF gives an idea of the scope of the problem, saying, "Affected vendors range from one-person boutique shops to Fortune 500 multinational corporations, including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, Baxter, as well as many other major international vendors suspected of being of vulnerable in medical, transportation, industrial control, enterprise, energy (oil/gas), telecom, retail and commerce, and other industries." JSOF's report includes links to advisories issued by some of these vendors.

CISA and CERT/CC lay out mitigations to minimize the risk of exploitation, and JSOF is offering a script that can help in some cases to determine whether a device is vulnerable. But despite these efforts, ZDNet concludes that the vulnerabilities "will haunt the IoT landscape for years to come."

Lazarus Group suspected in LinkedIn phishing campaign.

ESET discovered an espionage campaign that targeted aerospace and military companies in Europe and the Middle East between September and December 2019. The researchers call the campaign "Operation In(ter)ception," and they found several hints suggesting the possible involvement of North Korea's Lazarus Group (although they refrain from making a confident attribution).

The attackers sent LinkedIn messages with fake job offers to employees at the targeted organizations to trick them into opening malicious files. These files were RAR archives containing LNK files, which, when opened, would run a command prompt to open a PDF file in the victim's browser. The PDF was a decoy to avoid making the victim suspicious, while custom-made malware was installed in the background. The attackers used a modified version of an open-source command-line client for Dropbox in order to exfiltrate data.

While the primary objective of the campaign was espionage, in one notable incident the attackers opportunistically tried to carry out a business email compromise scam after coming across an email conversation about a pending invoice. The attackers used a spoofed email address in an attempt to trick the customer into sending the money to a different bank account, but the attack failed when the customer contacted the organization's correct email address.

GuLoader is being sold by an Italian front company.

Researchers at Check Point have determined that Italian security firm CloudEyE is actually a front company that's been selling the popular GuLoader network dropper to malware operators. GuLoader is used by a wide variety of threat actors to deliver malware hosted on cloud services like Google Drive or Dropbox. Check Point says "up to 25% of all packed samples are GuLoaders."

Check Point followed clues contained in some GuLoader samples and ended up at the website of CloudEyE, a company that claims to sell security software to protect Windows applications from "cracking, tampering, debugging, disassembling, [and] dumping." The researchers purchased the company's product and used it to encrypt a sample file. They then ran the output through Check Point's threat detection tool, which flagged it as GuLoader with high confidence. The researchers also manually confirmed this by comparing their file to a real GuLoader sample observed in the wild. If CloudEyE's website is to be believed, the company makes more than $500,000 per month through this scheme.

Selected Reading

AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations (Unit42) A new advanced malware, dubbed AcidBox, was discovered being used by an unknown threat actor against Russian organizations in 2017.

Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature (Malwarebytes Labs) A newly discovered APT spear-phishing attack implements several evasion techniques to drop Cobalt Strike toolkit. We go through our analysis here.

WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group (Fox-IT International blog) Authors: Nikolaos Pantazopoulos, Stefano Antenucci (@Antelox) and Michael Sandee 1. Introduction WastedLocker is a new ransomware locker we’ve detected being used since May 2020. We believe i…

IndigoDrop spreads via military-themed lures to deliver Cobalt Strike (Cisco Talos) A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

SSH-Targeting Golang Bots Becoming the New Norm (Bitdefender Labs) Bitdefender researchers have recently found an increasing number of SSH-targeting bots written in Golang. Traditionally, popular malware is written in C, C++ and Perl, and it’s rare that we see attackers creating new malware or bots from scratch, especially using a... #botnet #Golang #golangbotnet

Web skimming with Google Analytics (Securelist) Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is

Targeted Attack Leverages India-China Border Dispute to Lure Victims (Zscaler) The Zscaler ThreatLabZ team came across a targeted attack trying to leverage the India-China border dispute to lure victims to open a malicious document.

Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers (Check Point Research) Introduction Over the last few years, the adoption of Office 365 in the corporate sector has significantly increased. Its popularity has attracted the attention of cybercriminals who launch phishing campaigns specifically to attack the platform. As 90% of cyber-attacks start with a phishing campaign, Office 365 is an attractive target for threat actors who work... Click to Read More

GuLoader? No, CloudEyE (Check Point Research) Revealing the service behind GuLoader: Italian company earned up to $500,000 helping cybercriminals to deliver malware using cloud drives.

Digging up InvisiMole’s hidden arsenal (WeLiveSecurity) ESET researchers describe their findings gleaned during an investigation of attacks that the InvisiMole group conducted against high-profile organizations in Eastern Europe in 2019.

Operation In(ter)ception: Aerospace and military companies in the crosshairs of cyberspies (WeLiveSecurity) ESET research uncovers attacks against several high-profile aerospace and military companies in Europe and the Middle East, with several hints suggesting a possible link to the Lazarus group.

Ripple20: 19 Zero-Day Vulnerabilities Amplified by the Supply Chain (JSOF) The JSOF research lab has discovered a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. The 19 vulnerabilities, given the name Ripple20, affect hundreds of millions of devices (or more) and include multiple remote code execution vulnerabilities.