@RISK: The Consensus Security Vulnerability Alert
December 19, 2019 – Vol. 19, Num. 51
CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 12 – 19, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: New malware-as-a-service family targets tech, health care companies
Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries’ hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.
Reference: https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html
Snort SIDs: 52451 – 52453 (By Nicholas Mavis)
Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies
Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.
Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf
Snort SIDs: 52445 – 52448 (By Joanne Kim)
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
GSuite users will soon no longer be able to use apps Google considers “less secure,” and only apps with OAuth Tokens will be allowed.
https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/
Congress is close to approving $425 million in spending to improve America’s election security, the largest influx of money to the U.S.’s voting systems since the 2016 presidential election.
https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html
Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.
https://www.forbes.com/sites/kateoflahertyuk/2019/12/16/iran-thwarts-spying-cyberattack-blames-foreign-actor/#64f5099a4d3a
Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.
https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html
The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city’s network.
https://www.pnj.com/story/news/2019/12/16/pensacola-hires-deloitte-140-000-assess-extent-cyberattack/2665576001/
New Orleans was also a victim of a cyberattack, with ransomware bringing down the city’s computer systems for several days. The city says recovery will take a week or longer.
https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html
Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.
https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html
Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company’s security division has investigated five incidents of the sort over the past two months.
https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/
MOST PREVALENT MALWARE FILES December 12 – 19, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201
SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
VirusTotal: virus analysis
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201
SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: virus analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg
SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201