Hello, World!
Russian state backed hackers are behind a new website promoting a fake DDoSing app.
The apparently "pro Ukrainian" site encourages people to download an Android app which it
claims DDoS's Russian government websites.
When in reality, the App does no such thing and is in fact, malware - this is according
to Google's "Threat Analysis Group".
So, the hackers here are taking advantage of a recent trend, voluntary botnet software.
Ever since the invasion of Ukraine, a bunch of these tools have been popping up, encouraging
people with no technical knowledge to donate their internet bandwidth to help DDoS Russian
websites.
I've talked about this kind of software before, and whilst many of these tools are legit...
as in they do actually DDoS Russian websites, regardless, it's just not a good idea to join
in, for a few reasons, one being that DDoSing is still illegal no matter who you're targeting,
also, DDoSing probably goes against your ISPs terms of service so it could get you disconnected.
But now we have another reason - you could be giving a Russian threat group backdoor
access into your device.
As far as malicious websites go, this one is really quite believable, aside from the
odd grammatical error and strange choice of stock image - like, in the about section,
they've got a hooded guy, hacking...
coronavirus?
But anyway, the site claims it's being run by the Ukrainian military's "Azov regiment".
And it even has a section where you can donate bitcoin - no one has fallen for this though,
as the wallet is thankfully empty.
So, the app itself hasn't been published to the Play store, instead you have to install
it via an '.apk'.
I wasn't very keen on downloading the app myself, though the website says once installed
"The app is very easy to use."
just "press the start button" and the DDoSing will commence.
Google's analysis shows that the app does come bundled with a list of apparent targets,
Russian government websites and those of Russian businesses make the list.
But, this is clearly a decoy as after starting an attack, "the 'DoS' consists only of a single
GET request to the target website, [obviously] not enough to be effective."
So what does the app do behind the scenes?
Nothing, destructive, apparently, it's thought this operation is merely a fact finding mission
to learn about the geographical distribution of people who would want to carry out such
attacks.
The group behind this fake app is thought to be "Turla" - associated with Russia’s
Federal Security Service this group is actually really quite old, having apparently been active
since 1997.
If you wanted some kind of technical explanation as to just how google was able to link this
operation to them - well, there isn't one, Google says "because they have tracked the
group for a long time and have good visibility into their infrastructure" they were able
to link them to the app.
I imagine Google is opting to be quite secretive here because publicly explaining their attribution
method would only help Turla avoid attribution in the future.
Next up, a new ransomware operation "redeemer" is taking a different approach to cybercrime.
Typically, to become a "ransomware affiliate" or in other words, 'someone who spreads ransomware
on behalf of a ransomware gang', an aspiring cyber criminal would have to go through a
kind of application process, just like you would if you were applying for a job.
However, the "redeemer" ransomware is doing things differently, the malware's author who
goes by "Cerebrate" has removed this bureaucracy and has instead has made their ransomware
free to download, so anyone can become an affiliate.
"Cerebrate" made the announcement on Dread - Dread being a website similar to reddit
but on the dark web, so the topics of conversation are a little more...
spicy.
And just like the more organised operations, "redeemer affiliates" receive an 80% cut of
any ransom paid, and getting involved is... unfortunately quite simple, all a wannabe
cyber criminal need to do is download the toolkit, input basic things like somewhere
for the victim to contact them, and a ransomware demand in Monero, click build, you get your
exe - and then you can do some ransoming.
However, I don't think we should be too worried that this new ransomware will cause a tidal
wave of script kiddies holding files hostage - because if that was going to happen, it
probably would have already happened.
This is in fact "redeemer 2.0", version 1.0 was released last year, but it was eventually
open sourced because the developer apparently lost interest, which basically means they
just weren't making enough money to even justify the time spent maintaining the project.
I tried looking for information on "Redeemer 1.0" - but after googling for what felt like
forever, I could barely find anything on it.
So it looks like this was yet another strain of malware that died a silent death, which
shouldn't be surprising, because sure any n00b can send a phishing email - the bar on
convincing phishing emails is quite low - but after gaining an initial infection - enumerating
a target's network and moving within it does take some level of knowledge - something script
kiddies thankfully can't muster.
Nevertheless armed with this ransomware, n00bs could have an effect on small businesses,
as they tend to be unprepared for ransomware - as in having a bunch of important documents
on one single machine, without backups.
Also, this kind of ransomware may find a use in people with a grudge against their employers.
In the past we've seen cyber criminal gangs try to recruit employees to deploy ransomware,
promising to give them a cut of any ransom paid.
But why take the risk of trusting that some random you met on the internet will give you
your cut, when you can just launch the ransomware attack yourself and keep 100% of the takings.
Next up, NeoPets has been hacked, and the personal data of 69 million users, is up for
sale for 4 bitcoins.
Now, I was debating whether or not I should explain what NeoPets is, as whilst it was
quite big when I was younger, it died off pretty quick when online MMORPGs that didn't
look like static websites came along, with my 10 year old self switching to Club Penguin.
But anyway, the data dump was posted for sale on breachforums, which is quickly becoming
the default place to host sales of breached data.
The data dump includes a whole array of personal data such as: real names, addresses, dates
of birth, password hashes and so on, and to sweeten the deal the seller has included 460MB
of stolen neopets' source code.
NeoPets have of course advised users to change their passwords, however it became apparent
that the intruder may have retained access to neopets' database, as they were able to
retrieve details on a new account registered by breachforums' owner.
And there's no update on whether NeoPets has regained control of their systems as after
the initial announcement of the breach on Twitter NeoPets buried the post with pictures
from comicon.
NeoPets is not new to data breaches, in 2016 they publicly acknowledged that they had been
compromised, which led to the leak of their user's data.
And still after this latest leak they still claim on their website that, (and this actually
cracked me up quite a bit the first time I read it) .... "Contrary to what many people
claim, no one has ever "hacked into our site" and accessed user information, accounts or
usernames.", "People like to say they have been hacked, as it makes them feel a little
better than admitting they have fallen for a scam, or just simply given away their password
to the first person that asked them for it."
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, you can of course find all my sources in the description,
stay tuned for more hacking videos and have a good one!