Hello, World!
Hackers have been caught hiding malware in an image taken by the ‘James Webb’ telescope
- that’s the new telescope that NASA recently launched into space.
And, aside from from being the sharpest infrared image of the universe ever taken, it looks
like a regular jpeg - there’s nothing seemingly malicious about it, that is, until you open
it in a text editor - where you’ll find what looks like some kind of cryptographic
certificate.
But, this is just a disguise - in reality it’s actually malware encoded in base64.
And, sorry for the bad resolution by the way, unlike the insane resolution of the ‘James
Webb‘ telescope - the cyber security company behind this research has only given us low
res images.
So, this jpeg can’t act maliciously by itself - it’s only one ingredient in the hackers’
infection chain.
Initially someone becomes a victim in this campaign when they fall for a phishing email
with an attached Microsoft word document.
And, you can probably see where this is going, the word doc contains a malicious visual basic
macro - which, when run by an unwitting victim it’ll download our malicious image from
a URL disguised to look like a legitimate Microsoft domain, then it’ll decode the
base64 from the image into an executable which it’ll then run.
What happens next?
Something bad, I presume - the researchers didn’t explain what the malware actually
does, or who’s behind it - whether that’s an elite threat group, or some random unknown
actor.
Regardless, I imagine using an image like this to hide malware is probably not the best
idea, it’s not every day you find a random picture of the universe hiding on your computer,
and if I came across this picture on my PC it’d definitely make me a lot more suspicious
than if the hackers were using some random image of a UI element or something along those
lines.
Other than hiding the malware’s code within an image, the bad actors had taken other measures
to make analysis difficult.
The malware is written in Golang, a language that is relatively hard to analyse after being
compiled - the miscreants also used a free tool called ‘gobfuscate’ - which obfuscates
Golang source code, making it harder to decipher.
The company behind this research “Securonix” dubbed this whole campaign GO#WEBBFUSCATOR,
you can find their full report in the description.
Next up, a prolific ransomware gang has changed tactics - in addition to encrypting and exfiltrating
their victim’s data, they’ll now DDoS them as well.
This abrupt change, follows a whole load of drama with one of their victims.
That victim being Entrust - it’s a large cyber security company, with thousands of
employees.
These guys offer an array of services, cloud security, encryption, key management.
They do a lot, and have some important customers, including various government departments.
The last thing a company like this needs for their reputation is for themselves to become
a victim of ransomware, but - that’s exactly what happened.
On July 6th, Entrust wrote to their customers - “An unauthorised party accessed certain
parts of our systems used for internal operations” … “We have determined that some files
were taken”.
The ransomware gang behind the intrusion was “LockBit” - right now these guys are the
king pin ransomware group in the cyber crime underworld.
From screenshots of their negotiation with Entrust, Lockbit was after an $8 million dollar
ransom, but Entrust was apparently only willing to offer $1 million, which LockBit just wasn’t
happy with, so the negotiations quickly broke down, with LockBit setting a date on which
they’d publish all of Entrust’s stolen data on their dark web site.
However, just as the deadline approached, LockBit’s site was taken offline in a DDoS
attack.
LockBit quickly blamed Entrust, but that seems a bit far fetched, what evidence is there
that this billion dollar company was launching DDoS attacks?
When asked, LockBit posted this screenshot - showing a bunch of spammy GET requests to
their site, with a very impolite message on the end.
And as you can imagine, Twitter found this very funny.
Though, to me it’s just not believable that the company themself was behind this - they’ll
be well aware that hacking back is very illegal, so perhaps it’s a pissed off employee, or
maybe a rival ransomware gang just looking to create drama.
Regardless, if the intent was to create drama, then I suppose it was successful.
LockBit published an emotional post…
“What doesn’t kill you makes you stronger”, they add “I am looking for DDoSers in the
team, most likely now we will attack targets and provide triple extortion”.
Triple extortion meaning that in addition to the usual ransoming, LockBit is also going
to DDoS victims until they pay up.
You’d think LockBit would be doing this purely for business purposes, to provide victims
some encouragement - instead they say they’re doing this because “I have felt the power
of DDoS and how it invigorates and makes life more interesting” - it’s the kind of thing
an evil mastermind would say, but whether they follow through with it, we’ll just
have to wait and see.
As for Entrust’s data, it’s been published in full on LockBit’s dark web site.
Next up, the small European country of Montenegro has suffered the largest cyber attack it’s
ever experienced…
however all is not as it seems.
The attack targeted the Montenegrin government - and, this wasn’t just a case of a few
government websites being taken offline, although that did happen.
The government warned of disruption to border crossings and telecoms, and the state owned
power company EPCG switched to manual operations - in a bid to prevent the attack from spreading
- they even temporarily disconnected some customers.
As for the technical details of the attack, they aren’t being publicly disclosed, but
the Montenegrin government did identify who they thought was behind the attack, the defence
minister said “there is enough (evidence) to suspect that Russia is behind the attack”.
And, it wouldn’t be the first time, Russia is thought to be responsible for cyber attacks
during the country’s elections in 2016.
But in response to this latest hack, the US embassy in Montenegro even put out a security
alert telling people to “be aware of your surroundings.”, “limit movement and travel
to the necessities”, and “review your personal security plans.”
… It all sounds very serious.
However, far from being a case of state sponsored sabotage, a few days ago the “cuba ransomware
gang” took responsibility for what we know now is a ransomware attack - and by the way
this group has nothing to do with Cuba the country, perhaps these guys are Castro fanboys
or something, but anyway, Cuba demanded a ransom payment of $10 million dollars, but
it wasn’t paid, and so the governments’ files have in the last couple of days been
published on Cuba’s dark web site.
However, this is all rather confusing - so, the ransomware gang exfiltrated the files
on August 19th, and will have spent the next week or so trying to extort the Montenegrin
government.
So why the government publicly claimed this was all perpetrated by Russia, when surely
they would have known a ransomware gang was just behind it, is kind of odd.
Maybe there’s some technical details that show Russian state involvement.
Or maybe this was all a bit of theatre to get support of their allies?
As after Russia was blamed, the FBI announced they were sending a team to investigate.
Next up, cyberespionage in the South China sea.
Companies tasked with maintaining fleets of wind turbines have been the target of an intelligence
gathering operation.
They’ve received a wave of phishing emails - claiming to be from someone conducting ‘user
research’ … “Hello, I’m trying to make a news website, and now I’m doing user
feedback … I hope you’ll take a look at this humble news site and give me some feedback”.
So, “Australian morning news” is a fictional news organisation, hosting content ripped
from actual news websites.
Obviously, there’s more to this website than meets the eye, and that something is
“ScanBox” - it’s a javascript reconnaissance framework which has the aim of learning as
much about the victim PC as possible, things like OS, browser version, timezone, java version,
and so on.
It even has a keylogging feature, but can only log keys typed within the web page itself
- and that’s because ScanBox doesn’t actually install anything on the target PC - it’s
for intelligence gathering only, living in the browser it scoops up data that can be
used by its operator to understand the victim’s available attack surface; useful for launching
targeted follow up attacks.
In fact, the second parameter in the phishing email’s URL is unique for each email sent
out, so the bad actors behind this campaign can link each email address to its corresponding
ScanBox data dump.
But, who’s behind ScanBox?
Well it’s made appearances going back all the way to 2014, on each occasion it’s been
used for pro-Chinese operations, so it’s thought that this tool is shared among Chinese
state backed threat groups.
Proofpoint has attributed this latest use of the tool to “APT40” - a Chinese group
who’s alleged members are actually wanted by the FBI for their other operations.
Why China would want information on companies operating in the South China Sea, is well,
kinda obvious - the area is heavily disputed to the point where it has its own wikipedia
page.
With China claiming to own most of it - it’s no wonder they’d want to keep tabs on who’s
operating within it.
This video was made possible by Octopart - a website I've been relying on over the last
few years in my electronics business.
Octopart.com is essentially your component sourcing swiss army knife - making it simple
to keep tabs on component stock levels in real time throughout a range of distributors
- which is pretty important given the current component supply situation, you can also easily
grab datasheets and cad models for components when you need them.
The best part is it's free to use, and Octopart is integrated right into altium 365, if you
want to give altium a go you can find your free trial link in the description.
As always thanks for watching, sources can of course be found in the video description,
and I’ll see you in the next video, have a good one.