Google exposed Exotic Lily, a group that works with Conti, an ATM rootkit can steal banking data,
and TrickBot targets MikroTik routers! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for March 22
2022 - this is your summary of the threats to our security, privacy and Internet freedom.
We’ve got more leaks about Conti this week, so, onto the first story.
Google’s TAG (aka Threat Analysis Group) has discovered that Exotic Lily is actually an
initial access broker linked to Conti and Diavol ransomware groups. This broker uses
phishing campaigns to access target networks, then sells access to networks to ransomware gangs.
Exotic Lily was sending over 5000 emails a day to over 650 different
organizations, so we know they were very active in their phishing campaigns. They targeted IT,
Cybersecurity, and Healthcare industries though recently their targets have widened.
TAG has been following Exotic Lily activity since September of 2021 when they observed
a 0day in Microsoft MSHTML being exploited by the group. TAG concluded that this is
a broker who works closely with FIN12 and CrowdStrike/Conti/TrickBot hacking groups.
Speaking of Conti, we’re learning more and more about this hacking group every week. Just this
past week, Wired shared an overview of the 60,000 chat messages that were leaked online. This tells
us that the group works like other jobs - with an HR department and salaries. The group just saw
more of their source code leaked, with ContiLeaks on twitter uploading Version 3 of Conti ransomware
along with a decryptor just a couple of days ago. BleepingComputer was able to successfully compile
the source code and was able to use the ransomware locker and the decryptor with no problems.
Thanks to this new leak, it could give researchers and engineers a chance to analyze the malware,
create new defensive techniques, and potentially additional decryption tools.
We haven’t heard about a new ATM banking hack in a while but this one is pretty cool.
Mandiant has been following a group called UNC2891
AKA LightBasin for a couple of years due to their financially motivated
hacks and attacks that have continually targeted telecom companies and managed service providers.
LightBasin has a new Unix rootkit, previously undiscovered, that is being
used to steal ATM data and make fraudulent transactions. The rootkit, dubbed Caketap,
can infect Oracle Solaris servers while adding connections to an attacker-controlled server,
hiding itself by obfuscating network connections, files, and processes,
then stealing banking card and PIN verification data. It looks for messages that are bound for
the Payment Hardware Security Module on these products, which is a hardware chip that manages
cryptographic keys for card signatures like the EMV chip, magnetic stripe or PIN.
Caketap finds those messages and changes fraudulent card information to look legitimate.
Legit data for valid cards is sent through to the HSM like normal,
though still saved, but this keeps it hidden and thus, it doesn’t raise any red flags.
This allows Caketap to authorize a fraudulent card to withdraw money from an ATM.
Often these machines are built on Linux or Unix systems that rely on security through
obscurity. LightBasin takes advantage of this by using easily hidden rootkits to infect machines,
sometimes for years before being discovered. Mandiant also mentioned in their reporting
that there are similarities between UNC 2891 and UNC 1945 but they can’t attribute the attacks
to one single target. They also included indicators of compromise in their report.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support. THANK YOU to Canyon, RJ, and MoltenLlama for joining on Patreon.com/threatwire
and shoutout to everyone who supports the show.
Attackers targeting routers is nothing new, but we do have some updates to a major vulnerability
and attack we’re seeing in the wild. According to Microsoft, MikroTik devices like routers are
being used to spread TrickBot trojans, which are then used to steal banking credentials. TrickBot
was discovered many years ago in 2016 and it has grown into an advanced, modular and multistage
malware product with a whole suite of tools including ransomware used by a variety of groups.
MikroTik routers have been vulnerable to attacks for a long time - with hundreds of thousands still
being vulnerable to infection as recently as December according to a report by Eclypsium.
The MikroTik attacks have been happening for a long time but we never knew exactly why these
specific devices were targets. Microsoft discovered these are targets because they
have a Linux based OS called RouterOS which allows for remotely piping commands
using SSH. MikroTik routers are used as proxies so an attackers sends one command that then
causes a chain reaction with a bunch of devices that is advantageous to the botnet campaign.
MikroTik routers are used to conceal the attackers CNC server. Infected machines don’t send data
or commands straight to the CNC server, they send them through a compromised router first,
then onto the malicious server. That means the infection is obfuscated in a way because
anyone analyzing this data would see an infected machine sending data to the IP
address of a router, but they wouldn’t be able to see the location of the attackers server.
Microsoft just released a new forensics tool used to scan MikroTik products for signs of
infection - that tool is called RouterOS-Scanner. Admins can use this tool to find potential
intrusions, but they also strongly advise changing the default password, blocking port 8291,
changing the SSH port from the default 22, updating and patching your routers,
and using a secure VPN if you need to remotely access your router.
Want to see more tech videos from me? Check out my youtube channel - youtube.com/ShannonMorse
for everything from tech reviews to security tutorials. And with that,
don't forget to like and subscribe to Hak5! I'm Shannon Morse, I'll see you on the Internet!