Anomali Cyber Watch: Active Probing Revealed Cobalt Strike C2s, Black Basta Ransomware Connected to FIN7, Robin Banks Phishing-as-a-Service Became Stealthier, and More

<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>Active scanning, EDR evasion, Infostealers, Phishing,</b> and <b>Typosquatting</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/evc6BeJVSpOqHG66e4ql"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3><a href="https://unit42.paloaltonetworks.com/cobalt-strike-team-server/" target="_blank">Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild</a></h3> <p>(published: November 3, 2022)</p> <p>Cobalt Strike remains a popular post-exploitation tool for threat actors trying to evade threat detection. Cobalt Strike’s Beacons use advanced, flexible command-and-control (C2) communication profiles for stealth communication with an attacker-controlled Linux application called Team Server. Beacon implants can covertly utilize the DNS protocol or communicate via HTTP/HTTPs using the the default Malleable C2 profile or Malleable C2 Gmail profile. Palo Alto researchers probed the Internet for these three types of communication to find previously-unknown active Team Server instances. Researchers were preselecting suspicious IP addresses with Shodan, actively probing them with stager requests and initializing a connection with the netcat tool to test, verify and extract communication profile settings (such as the served stager bytes).<br/> <b>Analyst Comment:</b> Network fingerprinting and active scanning technologies allow for proactive identification of threats such as Cobalt Strike’s C2 IP addresses. Network defenders and intelligence feed providers can get better coverage by improving their collaboration and coverage via threat intelligence platforms such as ThreatStream provided by Anomali.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a><br/> <b>Tags:</b> detection:Cobalt Strike Beacon, detection:Cobalt Strike, detection:Cobalt Strike Team Server, Cobalt Strike stager, Active scanning, Shodan, netcat, Post-exploitation tool, Gmail, DNS, TCP, HTTP, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.avanan.com/blog/abusing-microsoft-customer-voice-to-send-phishing-links" target="_blank">Abusing Microsoft Customer Voice to Send Phishing Links</a></h3> <p>(published: November 3, 2022)</p> <p>Avanan researchers detected a phishing campaign that abuses Microsoft Dynamics 365 Customer Voice since at least September 2022. These phishing emails come from legitimate email address surveys@email.formspro.microsoft.com, and clicking the link opens the Microsoft’s Customer Voice domain on a page with URL starting with: customervoice.microsoft.com/Pages/ResponsePage.aspx?id=... At the same time, a user clicking on the embedded “Play Voicemail” link redirects to an attacker-controlled phishing page asking for Microsoft account login credentials.<br/> <b>Analyst Comment:</b> Organizations can use services like Anomali Digital Risk Protection, which defends your brand against brand abuse and continuously monitors domains for cybersquatters and domain hijacking to prevent phishing and malware attacks. Users are advised to always check the current domain by hovering over the URL, especially before entering credentials.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a><br/> <b>Tags:</b> Customer Voice, Phishing, Microsoft, Forms Pro</p> </div> <div class="trending-threat-article"> <h3><a href="https://assets.sentinelone.com/sentinellabs22/SentinelLabs-BlackBasta" target="_blank">Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor</a></h3> <p>(published: November 3, 2022)</p> <p>Since its first appearance in April 2022, Black Basta ransomware breached over 90 organizations. Sentinel Labs researchers found that this private ransomware group is connected to Carbanak (aka FIN7). The groups use overlapping techniques, IP addresses, and a developer for FIN7 has also authored the EDR (Endpoint Detection and Response) evasion tools used exclusively by Black Basta since June 2022. One of the custom tools is a Visual Basic-compiled and UPX-packed executable showing a fake Windows Security GUI and tray icon with a “healthy” system status.<br/> <b>Analyst Comment:</b> Ransomware is an evolving threat, and the most fundamental defense is having proper backup processes in place. Follow the 1-2-3 rule: 3 copies, 2 devices, and 1 stored in a secure location. Data loss is manageable through segmentation, off-line storage, encrypting data at rest, and limiting the storage of personal and sensitive data.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947138" target="_blank">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/3905778" target="_blank">[MITRE ATT&CK] Impair Defenses - T1562</a> | <a href="https://ui.threatstream.com/ttp/3905359" target="_blank">[MITRE ATT&CK] Proxy - T1090</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a><br/> <b>Tags:</b> actor:Black Basta, detection:Black Basta, actor:Carbanak, actor:FIN7, malware-type:Ransomware, ZeroLogon, CVE-2020-1472, NoPac, CVE-2021-42287, CVE-2021-42278, PrintNightmare, CVE-2021-34527, AdFind, EDR evasion, Windows Security GUI, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://abnormalsecurity.com/blog/crimson-kingsnake-bec-group-attacks" target="_blank">Crimson Kingsnake: BEC Group Impersonates International Law Firms in Blind Third-Party Impersonation Attacks</a></h3> <p>(published: November 3, 2022)</p> <p>A business email compromise (BEC) group dubbed Crimson Kingsnake has recently been typosquatting and impersonating well-known international law firms. The group registered 92 malicious domains related to 19 law firms and debt collection agencies across Australia, the UK, and the US. A typical attack starts with an impersonating email requesting payment, often followed by a different email from the same typosquatted domain impersonating the alleged company executive. Crimson Kingsnake does a deep research on their victims and possibly uses previously-stolen invoices to craft their own.<br/> <b>Analyst Comment:</b> Organizations should train their employees making financial decisions on BEC tactics including the creation of the artificial sense of urgency. It is recommended to proactively identify typosquatted domains targeting your brand with Anomali Premium Digital Risk Protection or similar service.<br/> <b>Tags:</b> actor:Crimson Kingsnake, BEC, Phishing, Typosquatting, Fake invoice, Fraud, target-industry:Law, target-industry:Debt collection, target-country:US, target-country:UK, target-country:AU</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.ironnet.com/blog/robin-banks-still-might-be-robbing-your-bank-part-2" target="_blank">Robin Banks Still Might Be Robbing Your Bank (Part 2)</a></h3> <p>(published: November 3, 2022)</p> <p>The Robin Banks phishing-as-a-service (PhaaS) platform was first described by IronNet analysts in July 2022. It was blacklisted by Cloudflare and disrupted then, but it returned behind DDOS-GUARD, a notorious Russian provider. Robin Banks started using open-source and commodity tools: the Adspect bot filter, the evilginx2 reverse proxy cookie stealer, and the PHP obfuscator. Adspect places a specific PHP file that acts as an entry point for web traffic and is wired to Adspect servers which process clicks and make decisions as to whether to resolve to a phishing or benign site.<br/> <b>Analyst Comment:</b> Despite basing its code on other available tools, Robin Banks is able to find clients for its PhaaS platform. Organizations are advised to require phishing training for employees and partners. Users are advised not to click on links sent through SMS and email, especially if asked to access their account or enter credentials. Using a password manager helps with unique credentials across all accounts.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/3297610" target="_blank">[MITRE ATT&CK] Steal Web Session Cookie - T1539</a><br/> <b>Tags:</b> detection:Robin Banks, Phishing, Phishing-as-a-service, PhaaS, MFA, detection:Adspect, Cloaker, PHP obfuscator, evilginx2, Reverse proxy, Cookie-stealing, 2FA bypass, DDOS-GUARD, Russia</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/" target="_blank">Google Ad for GIMP.org Served Info-Stealing Malware via Lookalike Site</a></h3> <p>(published: November 1, 2022)</p> <p>Actors behind the Vidar infostealer have targeted users of at least 27 software products including Notepad++, Microsoft Visual Studio, and Brave browser. Their latest campaign, discovered on October 29, 2022, is targeting the well-known graphics editor, GNU Image Manipulation Program (GIMP). Threat actors were able to abuse Google Ads to display the legitimate GIMP website (GIMP.org) while forwarding users to typosquatted ones (gilimp[.]org and gimp[.]monster).<br/> <b>Analyst Comment:</b> Users should always check the domain they are on before downloading the alleged application. Consider finding the official site directly instead of clicking on an advertisement.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/3905036" target="_blank">[MITRE ATT&CK] Credentials from Password Stores - T1555</a><br/> <b>Tags:</b> detection:Vidar, Malvertising, Binary padding, malware-type:Infostealer, file-type:EXE, file-type:DLL, GNU, Typosquatting, Google Ads, Windows</p> </div>