Hello world,
A cybercrime group inspired by Pokemon, is claiming to have hacked a database of 70 million
AT&T customers, and is trying to sell it on the dark web for $1 million US dollars.
And a threat actor has been observed sending fake DDoS accusations in a bid to scare website
owners into installing malware.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news.
A cybercrime group going by the name “Shiny Hunters” is said to be in possession of
a database containing the personal information of 70 million AT&T customers, which they are
trying to sell for 1 million dollars. Shiny hunters’ mascot is a shiny Umbreon Pokemon,
now admittedly it’s been a while since my days of Pokemon Diamond, but if I remember
correctly a shiny pokemon is no different from a normal pokemon, other than being shiny
and rare. Cue the pokemon masters frantically typing away in the comments, telling me how
wrong I am.
This group focuses on data breaches, and as their name “Shiny hunters” suggests, they
aim to go after high quality data sets, which they collect and sell. In light of their recent
escapades, a new report on the group has been written up by Intel471. Shiny hunters “Primarily
operates on Raid Forums” - a forum often used by cybercriminals to sell their wares
and databases they’ve pilfered from victims.
Shiny Hunters was the group behind the hack of Microsoft’s own github account. Remember,
Microsoft owns GitHub, they acquired it in 2018 - so for Microsoft’s own account to
have been hijacked, is a little embarrassing. The group stole 500GB of data, though this
“did not appear to include any critical or sensitive information.”, so instead of
selling the trove they instead made the dump freely available, robin hood style.
After trawling through their operations, they seem to make the majority of their data dumps
freely available, indicating that the databases they exfiltrate usually aren’t of a high
enough quality to sell. Maybe they aren’t so deserving of their “Shiny” accolade
after all...
Last year however they did manage to exfiltrate “personal data and login credentials”
of 91 million users of Tokopedia - which is an Indonesian ecommerce website, though they
sold it on the dark web for just 5000 dollars - in the cybercrime world, a 5000 dollar payday
is tiny.
As intel471 explains, Shiny Hunters’ modus operandi is rather simple. They “try to
obtain legitimate credentials, most likely for a company's cloud services.” - this
is done by sifting through already public password leaks, to try and identify useful
creds. Alternatively they’ll purchase credentials on dark web marketplaces, then just log in,
grab the loot and try to flog it on the interwebs for crypto.
In some cases Shiny Hunters deploys more advanced tactics, Intel471 describes how in the event
of breaching a business’ code repo, “the group will search a company's GitHub repository
source code for vulnerabilities within the code itself.” Those “vulnerabilities are
used in further, more complex, third-party or supply chain attacks.” This suggests
they aren’t as low skilled as they make themselves seem by trawling through password
leaks for credentials.
As for their current antics, that AT&T database - AT&T says “Based on their investigation,
the information does not appear to have come from their systems”. However the group is
adamant the data is genuine and has made public a small sample of the hacked data, the auction
has a starting price of 200 thousands US dollars, with a buy it now price of 1 million.
Brand new, never seen before social engineering tricks are being employed by cybercrooks behind
the bazarloader malware, intent on encouraging victims to run malicious code on their systems,
the cybercriminals have been making false allegations of DDoS attacks in order to scare
victims into submission.
The plan of attack is simple, but clever; a bot built by the miscreants scours the web
looking for websites with embedded contact forms, weaponising them to propagate this
phishing campaign. Contact form submissions are received by website owners which read
as follows “we are currently experiencing serious network problems and we have detected
a DDoS attack on our servers coming from the your website” - the poor grammar should
be a stark red flag, though they proceed to threaten “legal actions'', if the issue
is not resolved within a “24 hour period”. The poorly written email then links a google
drive link, which the miscreants claim contains “DDos Attack evidence and … instructions
to fix the issue”.
It’s foreseeable that an email of this kind will worry many a website owner, with little
hesitation I imagine they’d immediately download the “quote on quote, evidence”
to see what the problem was. The downloaded zip contains a file titled “Evidence.js”
- which is our next red flag. Far from being evidence, this is in reality an obfuscated
javascript shell, which upon execution launches powershell and downloads the bazarloader malware.
Bazarloader provides initial backdoor access to a target pc, and is commonly used to facilitate
the installation of further malware, such as a more fully fledged reconnaissance tool
like cobalt strike. Cobalt strike is a legitimate pentesting tool which had its source code
leaked a while back. Ever since that unfortunate event it’s become the industry standard
RAT or “remote access tool” for cybercrooks. After our miscreants achieve such an infection,
they’d likely regroup and figure out how best to proceed based on the type of the organisation
they had compromised and the privileges of the computer system they had hacked.
These fake DDoS accusations just go to show how much craftier cybercriminals are getting
by the day - who knows, maybe at some point they might even improve on their grammar,
imo that would probably be the best thing they could do to improve their infection rates!
This campaign is a variation of a similar offensive likely run by the same bad actor
which involves fake DMCA claims. In that case, contact forms are similarly weaponised by
a bot to deliver the complaints, but in this case it purports to be from a photographer,
lamenting that some of their images have been used on the victim’s website without permission.
The email reads “It’s illegitimate to use stolen images and it’s so low!” Again,
a google drive link with “evidence” is supplied - and surprise, surprise, this happens
to be our old friend Mr. Javascript Shell.
Malware traffic analysis has inspected this particular example, the network traffic breakdown
shows logs of google unwittingly delivering the malware, then, when executed, right on
cue, the javascript shell retrieves bazarloader - which in turn proceeds to communicate with
the hacker controlled command and control server.
A little while later cobalt strike traffic is observed, this is where our attackers would
evaluate their options in terms of how best to profit off this particular infection.
The easiest way to level up your security is by using a password manager. I recently
surveyed you guys on instagram - make sure to follow me by the way. I found half of you
guys aren’t even using one! Come on! Reusing passwords is obviously an awful idea, but
even storing passwords in your browser is a massive nono - it’s very common for malware
to simply hoover up autofill credentials.
Now, this video is sponsored by RoboForm, I recently switched to their password manager,
setting up was hassle free, importing passwords from chrome and other browsers was super easy.
Then I just downloaded their browser extension and mobile app, which runs on mac, windows,
linux, ios and android, and I was done. Cross platform automatic password syncing, safe
in the knowledge that malware can’t so easily scoop up your credentials if you’re hacked.
Greatly enhance your security today, for the price of a pizza. If you use the link in the
description you’ll get a whole year’s access for just $16, that’s little more
than a dollar a month. And in the unlikely scenario you aren’t happy with Roboform
for any reason they have a 30 day money back guarantee. Roboform, linked in the description.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes and follow my journey in creating products
for my pentester hardware company maltronics, make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
If you’re looking for something to watch next go check out my previous video on how
vulnerabilities found in Apple’s iMessage are being exploited by the infamous spyware
Pegasus to target the mobile phones of activists.
As always sources will be linked in the video description, stay tuned for more hacking videos,
have
a good one.