Internet Storm Center Spotlight


SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: FBI warns of BlackByte ransomware resurgence

Description: The FBI and U.S. Secret Service released a warning early this week that the BlackByte ransomware gang had compromised multiple American and foreign businesses, including three attacks targeting U.S. critical infrastructure. The targets span several industries, including U.S. government facilities, financial services and food and agriculture. BlackByte is a ransomware-as-a-serivce group that sells its ransomware infrastructure to other threat actors. This malware emerged in July 2021, targeting the manufacturing, health care and construction sectors. The group went quiet several months ago when security researchers released a decryptor key for the ransomware, but this recent activity indicates the group is back.

References:

- https://techcrunch.com/2022/02/14/blackbyte-critical-infrastructure-ransomware/

- https://www.ic3.gov/Media/News/2022/220211.pdf

SNORT® SIDs: 58791 - 58794


Title: South Asian APTs sharing VBA code in wave of RAT infections

Description: Cisco Talos recently identified shared VBA code between multiple threat actors in South Asia that are deploying RATs to victims across the globe. The code reuse, which is easily visible to anyone inspecting the code, is confirmed by objective code similarity detection methods. This is also commonly seen with cyber threat actors, with known examples, such as the Olympic Destroyer campaign and it is likely to continue in the future. Code sharing between threat actors is to be expected. Open-source tools are a useful source of functionality and adopting techniques from successful attacks conducted by other groups are likely to be sources of misleading evidence leading to false attribution. We can expect sophisticated threat actors to continue to take advantage of code reuse and false flags, to integrate evidence designed to fool analysts and lead to attribution of their attacks to other groups.

References: https://blog.talosintelligence.com/2022/02/whats-with-shared-vba-code.html

SNORT® SIDs: 57551, 57562, 57842 – 57849

Internet Storm Center Entries


The Internal Revenue Service quickly abandoned a plan to use facial recognition to verify taxpayers’ identities days after pushback from privacy advocates.

https://www.washingtonpost.com/technology/2022/02/07/irs-idme-face-scans/


However, cybersecurity experts are left wondering about the best ways to verify identity, especially with something as sensitive as taxes, given that it’s relatively easy for bad actors to steal the current methods of authentication.

https://www.wired.com/story/face-recognition-irs-verify-identity/


Microsoft will soon block macros by default in most Office applications.

https://www.theverge.com/2022/2/7/22922032/microsoft-block-office-vba-macros-default-change


Two U.S. Senators expressed concerns that the CIA may be conducting warrantless surveillance on American citizens.

https://www.bbc.com/news/world-us-canada-60351768


A decryptor is available for the Maze, Sekhmet and Egregor ransomware.

https://www.zdnet.com/article/decryptor-for-maze-egregor-and-sekhmet-ransomware-strains-released/


Apple is updating its AirTags to alert users if an unidentified tag is near them.

https://www.cnbc.com/2022/02/10/apple-to-update-airtags-to-help-prevent-tracking-of-people.html


The San Francisco 49ers NFL team confirmed they were the victim of a BlackByte ransomware attack.

https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/


CISA added a critical Apple WebKit vulnerability to its list of commonly exploited vulnerabilities, informing federal agencies they needed to patch affected products by Feb. 25.

https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-update-iphones-macs-until-feb-25th/

Recent CVEs


ID: CVE-2021-39616

Title: Privilege escalation vulnerability in Google Android

Description: This vulnerability has been found in Google Android (Smartphone Operating System). This vulnerability requires simple authentication for successful exploitation.

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2021-39658

Title: Incorrect Default Permissions vulnerability in Google Android

Description: ismsEx service is a vendor service in unisoc equipment. ismsEx service is an extension of SMS system service but it does not check the permissions of the caller resulting in permission leaks. Third-party apps can use this service to arbitrarily modify and set system properties.

Product: AndroidVersions: Android SoCAndroid ID: A-207479207

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2021-39635

Title:

Description: ims_ex is a vendor system service used to manage VoLTE in unisoc devices. But it does not verify the caller's permissions so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.

Product: AndroidVersions: Android SoCAndroid ID: A-206492634

CVSS v3.1 Base Score: 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Prevalent Malware Files


COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934

MD5: 93fefc3e88ffb78abb36365fa5cf857c

VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details

Typical Filename: Wextract

Claimed Product: Internet Explorer

Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg


SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0

MD5: b46b60327c12290e13b86e75d53114ae

VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details

Typical Filename: NAPA_HQ_SetW10config.exe

Claimed Product: N/A

Detection Name: W32.File.MalParent


SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645

MD5: 2c8ea737a232fd03ab80db672d50a17a

VirusTotal: https://www.virustotal.com/gui/file/125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645/details

Typical Filename: LwssPlayer.scr

Claimed Product: ?????????

Detection Name: Auto.125E12.241442.in02


SHA 256: 3321b8ee0cafe7d336a93913c455bebbb821622c011ce10a9198a49392a3bb66

MD5: ed249eeca5364b32391801ec5c2d9a33

VirusTotal: https://www.virustotal.com/gui/file/3321b8ee0cafe7d336a93913c455bebbb821622c011ce10a9198a49392a3bb66/details

Typical Filename: Wave Browser.exe

Claimed Product: WaveBrowser

Detection Name: W32.PUA.Wavebrowser.Hunt.Talos


SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa

MD5: df11b3105df8d7c70e7b501e210e3cc3

VirusTotal: https://www.virustotal.com/gui/file/59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa/details

Typical Filename: DOC001.exe

Claimed Product: N/A

Detection Name: Win.Worm.Coinminer::1201