@RISK: The Consensus Security Vulnerability Alert
April 02, 2020 – Vol. 20, Num. 14
CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES March 26 – April 2, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Storage devices targeted by new Mirai variant
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Zyxel devices exploited by critical vulnerability, now patched
Description: A variant of the Mirai botnet, known as Mukashi, targeted vulnerable Zyxel network-attached storage devices. CVE-2020-9054 was assigned a critical rating of 9.8 out of 10 and has since been patched. Attackers can exploit this vulnerability to compromise a device and then launch additional distributed denial-of-service attacks and attach the malware to specific TCP ports.
Reference: https://www.cisomag.com/mukashi-malware-exploits-zyxel-nas-device-vulnerabilities/
Snort SIDs: 53495, 53496, 53507 – 53510
Title: Ransomware families launch new sites to publish stolen data
Description: Attackers behind several different ransomware families are creating websites where they say they will publish information stolen in attacks if the victims do not pay the requested extortion payment. Malware like Sodinokibi, Nemty and DoppelPaymer are following the lead of the actors behind the Maze ransomware, who launched a similar site in early March. Cisco Talos released new Snort rules this week to prevent the Sodinokibi ransomware from being downloaded onto targeted machines.
Reference: https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/
Snort SIDs: 53511, 53512
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Democratic Congressional leaders are pushing for more states to move to vote-by-mail, and many governments are planning to use cyber security grants to change their plans.
https://www.cnbc.com/2020/03/31/coronavirus-update-pelosi-says-country-must-move-to-vote-by-mail-taking-aim-at-trump.html
Tech companies are preparing to detect and deflect election meddling efforts similar to those in 2016, but the bad actors are changing their tactics just as quickly.
https://www.nytimes.com/2020/03/29/technology/facebook-google-twitter-november-election.html
A new phishing campaign lures victims in by lying to them that they’ve been exposed to someone infected with the coronavirus.
https://www.bleepingcomputer.com/news/security/phishing-attack-says-youre-exposed-to-coronavirus-spreads-malware/
In another COVID-19 related attack, other attackers are using DNS hijacking to redirect users accessing coronavirus-related mobile apps, eventually taking over their wireless routers.
https://threatpost.com/hackers-hijack-routers-to-spread-malware-via-coronavirus-apps/154170/
So-called “Zoombombers” are taking advantage of the rise in virtual meetings and hangouts, jumping into calls and sharing unwanted vulgar content.
https://www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content
More than 42 million Iranian users of the popular Telegram encrypted messaging app had their user IDs and phone numbers leaked online, as they were stored on an unprotected server.
https://www.comparitech.com/blog/information-security/iranian-telegram-accounts-leaked/
The FBI is holding talks with cybersecurity insurance companies to discuss how they can work together to help companies prevent and recover from ransomware attacks.
https://www.cyberscoop.com/ransomware-fbi-insurance-companies-data/
Saudi Arabia reportedly can track its citizens who travel to the U.S. through a vulnerability in the global messaging system known as SS7.
https://www.theguardian.com/world/2020/mar/29/revealed-saudis-suspected-of-phone-spying-campaign-in-us
A new report from Google’s Threat Analysis Group revealed it alerted 40,000 users of potential state-sponsored attacks against their accounts in 2019.
https://www.forbes.com/sites/daveywinder/2020/03/27/hacker-threat-google-confirms-40000-nation-state-cyber-attack-warnings-issued/#22f789b93b71
MOST PREVALENT MALWARE FILES March 26 – April 2, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: a545df34334b39522b9cc8cc0c11a1591e016539b209ca1d4ab8626d70a54776
MD5: 5d34464531ddbdc7b0a4dba5b4c1cfea
VirusTotal: scan analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::in03.talos
SHA 256: 8e0aea169927ae791dbafe063a567485d33154198cd539ee7efcd81a734ea325
MD5: 5fb477098fc975fd1b314c8fb0e4ec06
VirusTotal: scan analysis
Typical Filename: upxarch.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Ranumbot::in07.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: scan analysis
Typical Filename: Eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.85B936960F.5A5226262.auto.Talos
SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: scan analysis
Typical Filename: myfile.exe
Claimed Product: N/A
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos