Weekly Threat Briefing: Over A Million Android Users Fooled by Fake WhatsApp App in Official Google Play Store

The intelligence in this week’s iteration discuss the following threats: Botnet, Data leak, Email account compromise, Malicious application, Malspam, Phishing, Ransomware, RAT, Spear phishing, Trojan, Targeted attacks, and Vulnerabilities. The IOCs related to these stories are attached to the WTB and can be used to check your logs for potential malicious activity.<h2>Trending Threats</h2><a href="https://www.helpnetsecurity.com/2017/11/06/tor-browser-ip-leak/" target="_blank">Tor Browser Flaw Leaks Users' Real IP Address</a> (November 6, 2017) "We Are Segment" CEO, Filippo Cavallarin, has discovered a vulnerability in the Tor Browser that can reveal a user's real IP address. The vulnerability, dubbed "TorMoil," is only present in macOS and Linux versions of the Tor Browser. Recommendation: Tor Project personnel advise its macOS and Linux users to update to version 7.0.9 or 7.5a7 as soon as possible. The security fix limits some of the browser's functionality, but it also includes a temporary fix to the vulnerability which will likely be addressed further in another security update. Tags: Vulnerability, Data leak, Tor Browser<a href="https://www.theregister.co.uk/2017/11/03/fake_whatsapp_app/" target="_blank">Over A Million Android Users Fooled by Fake WhatsApp App in Official Google Play Store</a> (November 4, 2017) Researchers have found that a fake version of the "WhatsApp" messaging application was present in the Google Play store. The application was observed to have been downloaded approximately one million times. If the application is opened, it appears just like the legitimate WhatsApp application, however, it shows the user advertisements. The showing of advertisements generates revenue for the threat actor(s) behind this malicious application. Recommendation: Google has since removed the malicious application from the Google Play store. If WhatsApp was downloaded recently, showing of advertisements is a sign that the fake version was downloaded; the application should be removed as soon as possible. Users should be wary of downloading applications because as this story portrays, even legitimate stores can sometimes contain malicious applications. Therefore a user should review the permissions an application will request upon download, and looking through user comments can sometimes reveal problems with the application. Users should also check the name of the organization in the Google Play Store when downloading an application, to see if there are any irregularities. For example, recent "WhatsApp" fakes were make by company names "WhatsApp Inc,,;" and "WhatsApp Inc….". Tags: Android, Google Play store, Fake application, WhatsApp<a href="http://www.bbc.com/news/technology-41845965" target="_blank">Art Galleries Targeted by Cyber-Thieves</a> (November 2, 2017) Threat actors are conducting email scams that target art galleries and dealers, and several galleries in the U.S. and U.K. were affected, according to The Art Newspaper. The actors were found to have monitored outgoing email messages from art gallery accounts by compromising them, and then intercepted the invoices and altered them. The scam was discovered when the "Rosenfeld Porcini" gallery in London received an invoice from a buyer that said that the original invoice was in the wrong currency and to make the payment to a different account. At the time of this writing, the gallery is working with the bank to attempt to recover the funds. Recommendation: All business email accounts should have security features to help protect sensitive information and communications. At minimum, two-factor authentication should be applied to email accounts to better protect them against threat actors. Tags: Email account compromise, Scam, Theft<a href="https://www.us-cert.gov/ncas/current-activity/2017/11/01/Cisco-Releases-Security-Updates" target="_blank">Cisco Releases Security Updates</a> (November 1, 2017) The United States Computer Emergency Readiness Team (US-CERT) has issued an alert regarding vulnerabilities in Cisco products. The affected products are: Aironet 1560, 2800, and 3800 Series Access Point Platforms Extensible Authentication Protocol, Application Policy Infrastructure Controller Enterprise Module, Application Collaboration Provisioning, Firepower 4100 Series NGFW and Firepower 9300 Security Appliance, Identity Services Engine, Prime Collaboration Provisioning, Wireless LAN Controller Simple Network Management Protocol, and Wireless LAN Controller 802.11v. Recommendation: The US-CERT and Cisco recommend that users of the products listed in this alert apply the corresponding security updates as soon as possible. Some of these vulnerabilities can be exploited to take control of an affected system, while others can result in Denial-of-Service (DoS) attacks. Tags: Alert, Vulnerabilites, Cisco<a href="https://researchcenter.paloaltonetworks.com/2017/11/unit42-everybody-gets-one-qtbot-used-distribute-trickbot-locky/" target="_blank">Everybody Gets One: QtBot Used to Distribute Trickbot and Locky</a> (November 1, 2017) Unit 42 researchers have discovered that the "Necurs" botnet is being used by threat actors to distribute malspam that can lead to "Locky" ransomware and the "Trickbot" banking trojan. The emails contain malicious Microsoft Office Dynamic Data Exchange (DDE) files. If a user allows DDE to take place after opening the attachment, which the email purports is related to financial services, a new downloader dubbed "QtBot" will download the malware payload. Researchers note that the amalgamation of two separate campaigns in Locky and Trickbot is an interesting tactic, however, the reasons behind the combination are not yet clear. Recommendation: Financially themed malspam emails are a common tactic among threat actors, therefore, it is crucial that your employees are aware of their financial institution's policies regarding electronic communication. If a user is concerned due to the scare tactics often used in such emails, they should contact their financial institution via legitimate email or another form of communication. Requests to open a document in a sense of urgency and poor grammar are often indicative of malspam or phishing attacks. Said emails should be properly avoided and reported to the appropriate personnel. Tags: Malspam, Trojan, Trickbot, Ransomware, Locky, Downloader, QtBot<a href="https://info.phishlabs.com/blog/adwind-remote-access-trojan-still-going-strong" target="_blank">Adwind Remote Access Trojan Still Going Strong</a> (November 1, 2017) The threat actors behind the "Adwind Remote Access Trojan (RAT)" are continuing to distribute the malware via spam emails, according to Phish Labs researchers. The spam emails were observed to have numerous attachment titles such as "DHL Delivery Notice," "Proforma Invoice," "Request for Information," "Transfer Import," and "Swift Copy," among others. The attachments are malicious JAR files. The objective of Adwind is to steal information from an infected machine, and due to the ease of availability of the tools on underground forums, it can be modified to fit both less sophisticated and advanced threat actors. Recommendation: Ensure that your company's firewall blocks all entry points for unauthorized users, and maintain records of how normal traffic appears on your network. Therefore, it will be easier to spot unusual traffic and connections to and from your network to potentially identify malicious activity. Educate your employees on the risks of opening attachments from unknown senders. Furthermore, maintain policies regarding what kind of requests and information your employees can expect to receive from colleagues and management. Anti-spam and antivirus applications provided by trusted vendors should also be employed. Tags: Malspam, RAT, Adwind<a href="https://securelist.com/the-silence/83009/" target="_blank">Silence – A New Trojan Attacking Financial Organizations</a> (November 1, 2017) A campaign has been actively targeting financial institutions since September 2017 with a new trojan called "Silence," according to Kaspersky Lab researchers. This campaign primarily targets Russian banks, however, infected financial institutions were also found in Armenia and Malaysia. The actors behind this campaign send spear phishing emails from a sending address of a financial institution that has already been infected to add "credibility" to the phishing email. The emails come with a malicious .chm attachment, specifically, a "Microsoft Compiled HTML Help" file that is compressed and deployed in a binary format with the .chm (compiled HTML) extension. The file can automatically use JavaScript to download and execute malware from a hardcoded URL. Recommendation: Spear phishing emails represent a significant security risk because the sending email will often appear legitimate to the target; as this story portrays, another organization is compromised to be used to send out the phishing emails. Education is the best defense, inform your employees on what to expect for information requests from their managers and colleagues. Employees should also be aware what sort of requests to expect from business partners to better identify phishing attempts, and whom to contact when they suspect they are the target of a possible spear phishing attack. Tags: Targeted attacks, Spear phishing, Trojan, Silence<a href="https://www.theregister.co.uk/2017/10/31/wordpress_security_fix_4_8_3/" target="_blank">If Your Websites Use WordPress, Put Down That Coffee and Upgrade to 4.8.3 Thank Us Later</a> (October 31, 2017) Engineer, Anthony Ferrara, discovered an SQL injection vulnerability in "WordPress" powered websites. Specifically, WordPress version 4.8.2 and earlier. The vulnerability does not affect the WordPress default core, but rather it resides in a security function provided to the core by plugins and themes. The function lies in the WordPress Database Access Abstraction (wpdb) class called "prepare". The prepare function prepares a SQL query for "safe" execution. This function uses "vsprintf" to replace placeholders with values in the function. This can be abused with an array argument to perform SQL injection. Recommendation: Sometimes webmasters discover that one of their sites has been compromised months after the initial infection. Websites, much like personal workstations, require constant maintenance and upkeep in order to adapt to the latest threats. In addition to keeping server software up to date, it is critical that all external facing assets are monitored and scanned for vulnerabilities. The ability to easily restore from backup, incident response planning, and customer communication channels should all be established before a breach occurs. Site owners should upgrade to version 4.8.3 immediately and update all plugins that override wpdb. If you are a plugin developer for WordPress, ensure that all user input is removed from the string query part of the prepare function and instead build queries and arguments separately. Tags: Vulnerability, SQL Injection, WordPress<a href="https://www.cybereason.com/blog/night-of-the-devil-ransomware-or-wiper-a-look-into-targeted-attacks-in-japan" target="_blank">Night of the Devil: Ransomware or Wiper? A Look Into Targeted Attacks in Japan</a> (October 31, 2017) Cybereason researchers have published information regarding a family of ransomware, dubbed "ONI," and bootkit ransomware, dubbed "MBR-ONI," used in targeted attacks against Japanese companies. Researchers speculate that the ransomware was used to cover up evidence of a more sophisticated attack. Researchers found that the targeted attacks took place between three to nine months and note that the actors took significant attempts to hide their operation. The infections vector for these targeted attacks goes in the following order: spear phishing email, trojanized "Ammyy Admin RAT," reconnaissance and credential theft, lateral movement and DC takeover, log wipers, and ONI distributed via GPO (rogue group policy). The objective of the threat actors appears to be theft of sensitive information. Recommendation: Spear phishing emails represent a significant security risk because the sending email will often appear legitimate to the target; sometimes a target company email is compromised and used for such emails. Education is the best defense, inform your employees on what to expect for information requests from their managers and colleagues. Employees should also be aware of whom to contact when they suspect they are the target of a possible spear phishing attack. The use of a malicious version of a legitimate tool, Ammyy Admin, depicts the dangers of using Remote Access Tools in the workplace. In addition, legitimate tools are often used by threat actors, particularly advanced threat actors, because it assists in concealing malicious activity in the traffic of a legitimate tool. Therefore, only a select few individuals who need to use such tools should have access to them. Tags: Targeted attacks, Spear phishing, Ransomware, Data theft<a href="http://www.malware-traffic-analysis.net/2017/10/30/index.html" target="_blank">Necurs Botnet Malspam Uses DDE Attack to Push Locky</a> (October 30, 2017) The "Locky" ransomware is continuing to be pushed via malspam campaigns via the "Necurs" botnet, according to security researchers. One of the emails used in this campaign was identified to have the subject line "Scanned document from HP ePrint user" and purports to be from the "HP Team" with a spoofed sending address "eprintcenter@hp.com." If the Microsoft Word document is opened, it requests permission to load another Office application, this attack method is called Microsoft "Dynamic Data Exchange" (DDE). If this process is allowed, a user will be infected with the ".asasin" variant of the Locky ransomware. The actors behind this campaign are requesting .025 bitcoins (approximately $158.25 USD) for the decryption key. Recommendation: Educate your employees on the risks of opening attachments from unknown senders. Anti-spam and antivirus applications provided by trusted vendors should also be employed. Emails that are received from unknown senders should be carefully avoided, and attachments from such senders should not be opened. Furthermore, it is important to have a comprehensive and tested backup solution in place, in addition to a business continuity plan for the unfortunate case of ransomware infection. Tags: Malspam, Botnet, Necurs, Ransomware, Locky<a href="http://blog.trendmicro.com/trendlabs-security-intelligence/coin-miner-mobile-malware-returns-hits-google-play/" target="_blank">Coin Miner Mobile Malware Returns, Hits Google Play</a> (October 30, 2017) Trend Micro researchers have discovered three malicious applications that made it into the Google Play store. The applications, "Recitiamo Santo Rosario," "Safety Wireless App," and "Car Wallpaper HD: mercedes, ferrari, bmw and audi," were found to contain malicious cryptocurrency mining capabilities. When started, these applications will load crypto mining JavaScript from "Coinhive" and begin mining with the actor's own Coinhive key. Recommendation: Google has since removed the malicious applications from Google Play. Users should be cautious when downloading applications because as this story portrays, malicious applications sometimes make it into official stores. Therefore, users should carefully review the permissions an application will request prior to installation. While these versions of cryptocurrency malware are not inherently malicious, some have additional functions such as stealing user credentials. Slow response and run time on a device may be an indication of cryptocurrency malware, and installed applications should be reviewed. Tags: Android, Mobile, Cryptocurrency malware<a href="http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10151-4016513.html" target="_blank">Oracle Security Alert Advisory – CVE-2017-10151</a> (October 30, 2017) Oracle Technology network has released a security update that addresses a vulnerability, registered as "CVE-2017-10151," that affects "Oracle Identity Manager." Exploitation of the vulnerability can lead to compromise of Oracle Identity Manager and remote control of the affected system via a network attack. This vulnerability is critical, and Oracle requests that its customers apply the patch as soon as possible. The affected Oracle Identity Manager versions are 11.1.1.7, 11.1.1.9, 11.1.2.1.0, 11.1.2.3.0, and 12.2.1.3.0. Recommendation: The security update should be applied as soon as possible because of the high criticality rating of this vulnerability and the potential for an actor to take control of an affected system. Additionally, your company should have policies in place to review and apply security updates for software in use to protect against known vulnerabilities that threat actors may exploit. Tags: Vulnerability, Alert, Oracle Identity Manager<h2>Observed Threats</h2>This section includes the top threats observed from the Anomali Community user base as well as sensors deployed by Anomali Labs. A ThreatStream account is required to view this section. <a href="https://www.anomali.com/products/threatstream">Click here to request a trial.</a><a href="https://ui.threatstream.com//tip/18477" target="_blank">TrickBot Tool Tip</a> TrickBot is a modular Bot/Loader malware family which is primarily focused on harvesting banking credentials. It shares heavy code, targeting, and configuration data similarities with Dyreza. It was first observed in September 2016 and both the core bot and modules continue to be actively developed. Both x86 and x64 payloads exist. It has been distributed using traditional malvertising and phishing methods. [Flashpoint](https://www.flashpoint-intel.com/blog/trickbot-targets-us-financials/) recently (2017-07-19) observed TrickBot operators leveraging the NECURS Botnet for distribution. Previously, Anomali Labs released a [Threat Bulletin](https://ui.threatstream.com/tip/17137) detailing the unpacking of this malware family. Tags: TrickBot, Family-Trickbot, victim-Financial-Services