If you’re involved with IT Security at any level and if your network includes Linux servers, keep a watchful eye out for the new Panchan botnet.

It first appeared in the wilds on March of this year (2022) and its main focus seems to be targeting Linux servers in the education sector and enslaving them to mine for cryptocurrency.

Panchan has several wormlike features that allow it to replicate quickly and spread laterally once it gets inside a network.  Additionally, the hackers behind the botnet have given it a raft of detection avoidance capabilities. That includes the fact that it uses memory-mapped miners and dynamic detection capabilities that allows it to stop all mining operations automatically if it detects that anomalous activities are being scanned for.

Panchan was written in Golang, which is both versatile and powerful.  Once it infects a target network, it creates a hidden folder inside itself under the name “xinetd.”

Once that’s done, it initiates an HTTPS POST operation to allow it to communicate with Discord, which is likely how the hackers monitor their new victim.

In terms of communicating back to its command-and-control server, Panchan utilizes port 1919 and note that these communications are not encrypted.

Researchers at Akamai first discovered this new threat and have mapped out its spread to this point.  They have discovered 209 compromised systems with more than 40 currently active infections.  The USA seems to be the botnet’s primary target with China as a distant second. Russia, Japan, India, and Brazil account for most of the rest.

Although the education sector seems to be the group’s primary focus for now, anyone running a Linux server should consider themselves at risk.  While this botnet isn’t as damaging as some, it is nonetheless a threat to be avoided.

These days, companies spend significant sums of money to protect themselves from cyber criminals.  The threat matrix is vast, and attacks can come from almost any quarter. That is why many companies not only spend heavily on antivirus software, but also on a wide range of tools that IT security professionals can leverage to intercept attacks “at the gates” and prevent attackers from ever breaching their defenses.

Further, many companies will engage with third-party specialists to provide round the clock monitoring.  Managers invest even more money to ensure that regular backups are taken. This is so that if the worst happens, the process of recovery will be relatively quick and the company can get back to the business of its business with as little downtime as possible.

All of that is commendable, but the unfortunate reality is that even the most elaborate and expensive systems designed to defend your corporate network can be reduced to nothing by one moment of carelessness by one of your firm’s employees.

If you want to increase the return on your IT Security investment, the very best thing you can do is educate your workforce to the dangers that are lurking on the ‘net.  Teach them security best practices so that they become part of your network security solution rather than being yet another risk factor you have to guard against.

A few examples of the way your employees may be unwittingly putting your firm at risk include the following:

• They use simple, easy to guess passwords that any hacker could guess with minimal effort
• They seldom change their passwords unless forced to
• When traveling, many will connect to your company’s network using free, unsecured WiFi hotspots
• A disturbing percentage of people use the same easily guessed passwords across multiple web properties
• They fail to use multi-factor authentication paradigms, even when and where you make them available
• Far too many people will automatically assume that any attachment that lands in their work email inbox is safe, and will open it without thinking twice
• And there is very little cross-checking done when someone reaches out to them via corporate channels to ensure that the person contacting them is who they claim to be

All of these pose a very real risk to the security of your company.  Make sure your employees get the training they need to keep both themselves and your corporate network safe.

Do you receive healthcare of any kind from Kaiser Permanente?  If so, be aware that they recently published a data breach notification indicating that an unidentified attacker accessed an email account that contained personal health information on April 5th, 2022.

Based on the investigation to this point, it appears that sensitive health information belonging to more than 69,000 individuals was exposed.  For context, Kaiser Permanente provides a wide range of health care services to more than 12.5 million customers spanning eight states, plus the District of Columbia.  While it’s true that a breach of any size is a bad thing, this one only impacted a tiny slice of the company’s patient base.

Kaiser’s breach notification reads in part as follows:

“This notice describes a security incident that may have impacted the protected health information of some Kaiser Permanente patients who may have been affected by an unauthorized access incident on April 5, 2022.

The specifics of the unauthorized access were provided to individuals affected in a letter sent by Kaiser Permanente on June 3, 2022.

Sensitive info exposed in the attack includes:

• The patients’ first and last names
• Medical record numbers
• Dates of service
• Laboratory test result information”

If there’s a silver lining to be found here, it lies in the fact that Kaiser’s notification stressed that no Social Security or credit card numbers were exposed.

While this event will no doubt damage trust, the data that was stolen is not likely to be sufficient to allow the attackers to steal your identity. If you are one of the impacted customers, then you should have already received a notification from the company.

We wish we could say that this will be the last data breach of the year but sadly, that’s not going to be the case.  Stay tuned for the next, and guard your personal data closely!

Tech giant Cisco recently sent out a notification to its vast customer base urging them to apply a recently issued patch that addresses a critical security vulnerability. This vulnerability could allow an attacker to bypass the authentication process entirely and gain access to the web management interface of Cisco email gateway appliances with non-default configurations.

The flaw in question is being tracked as CVE-2022-20798 and is present in the external authentication routines of ESAs (Cisco’s Email Security Appliances) and Cisco Secure Email and Web Manager appliances, both virtual and hardware.

The company had this to say about the flaw:

“An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device.  A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

Oddly enough, this security flaw does not impact appliances with default configurations. That makes this one of the rare times where if an admin had not switched away from the default configs, he’d be safer. That is at least where this flaw is concerned.

In any case, if you have one of the Cisco appliances mentioned above on your network, be sure to apply the patch as soon as possible to minimize your risk.  If you’re unable to apply the patch for one reason or another, there is a workaround you can use in the short run, described below.

You’ll need to disable anonymous binds on the external authentication server, which should give you at least some protection and some additional time to deploy the patch.

Kudos to Cisco for their fast action here.  We can only hope that the next critical security flaw we report on is handled as adroitly by whatever company is at the helm.

Top quality talent can be difficult to find in any field, if you have spent any time looking for and hiring people, you know the challenge can be an especially daunting one.  There’s tremendous competition for talented folks. Given the cost of hiring and training new people, it’s something you want to get right the first time as often as possible.

The question is: how?

The good news is that there are multiple things you can do to take the guesswork out of the equation.

The most pivotal steps are these:

First, if you’re not already plugged into the best online recruiting platforms, that should be your first stop.  This is far and away superior to placing an ad in your local paper or other more traditional means of hiring.

It isn’t that you can’t find plenty of good people in most any good-sized city, but you gain access to a much broader and deeper pool of talent if you shop globally for your new hires.

In the old days, that usually meant paying a premium to try and get a new hire to relocate. However, managers are increasingly embracing the notion of letting many of their staff members work from home, wherever that might be.  If you’re willing to do that, you can find top talent anywhere in the world and put them to work for you in short order.

Second, you’ll want to hold at least three interviews.  One should be over the phone to get a general sense of the employee. Next would be a second interview where you introduce the prospective new hire to the people they’ll actually be working with to ensure that he or she is a good fit. Finally as a last step, do a written or practical interview that serves the same function as a university exam.

This last bit is key, because it gives you a chance to see how they work and how they think. That can generally tell you how efficient and effective they’ll be in the position you have in mind for them.

If you do all of these things every time you hire, you’ll almost never mis-step when bringing a new employee onboard.

According to research conducted by the cybersecurity firm PIXM, there is a massive phishing campaign that peaked in April and May of this year (2022) and it is still ongoing.

The campaign has lured millions of unsuspecting users to phishing pages by abusing Facebook and Facebook Messenger and tricking users into entering their account credentials.

Worse, the hackers then used those credentials to send additional phishing messages to friends of the affected users, luring them in as well and continuing the chain.

All told, the group behind the attack has been able to generate millions of dollars in revenue using these tactics.

Worst of all is that PIXIM’s research shows that this has been a long running campaign.  Although the group has only recently discovered it, the evidence they’ve uncovered shows that the campaign has been ongoing since at least September of 2021.

The group’s research is ongoing but so far they’ve found more than four hundred Facebook accounts tied to the campaign, which contain hooks to phishing pages.  Some of these poisoned profile pages have only been viewed a few thousand times. In other cases, they boast millions of views and of course, each view represents another potential victim.

Based on what the group has been able to piece together, they determined that in 2021 a total of 2.7 million users had visited one of the phishing pages. As of today, more than 8.5 million people have been lured to the phishing pages with no clear end in sight.

While this represents a tiny fraction of the total number of Facebook users on the platform, it is nonetheless a massive campaign.  If you’re a regular Facebook user, stay vigilant.  There are groups out there right now that are actively trying to lure you in and steal your data.  Don’t let that happen to you, your family, friends, or your coworkers.

Are you a Linux user?  If so, be aware that there is a new kind of malware to be concerned about. The BlackBerry Threat Research and Intelligence team, in concert with Joakim Kennedy (an Intezer Analyze security researcher), have announced the discovery of a new strain of malware.

They’ve dubbed it Symbiote, and it was named because of its parasitic nature.

Actual discovery of the strain occurred a few months ago but the team has been studying it since.  It is markedly different from most of the Linux malware you see today, as it acts as a shared object library that is loaded on all running processes via LD_PRELOAD.

Once the malicious code has its hooks in a target machine, it provides the hackers controlling it with rootkit functionality.

The earliest samples of this strain date back to November 2021, and based on an analysis of its code, its primary targets were intended to be financial institutions located in Latin America.

The researchers had this to say about their recent discovery:

“When an administrator starts any packet capture tool on the infected machine, BPF bytecode is injected into the kernel that defines which packets should be captured.  In this process, Symbiote adds its bytecode first so it can filter out network traffic that it doesn’t want the packet-capturing software to see. When we first analyzed the samples with Intezer Analyze, only unique code was detected.  As no code is shared between Symbiote and Ebury/Windigo or any other known [Linux] malware, we can confidently conclude that Symbiote is a new, undiscovered Linux malware.”

The Linux ecosystem isn’t targeted as often as Apple, Windows, or Android. So the fact that this new threat has emerged is noteworthy indeed.  If you have any Linux infrastructure on your network, be sure to stay aware of this new potential threat.

Researchers at HP have discovered a new malware loader that they’ve dubbed SVCReady.  While new malware strains are common, this one is distinct for a couple of different reasons.

Like many malicious programs, this spreads primarily via phishing email campaigns.  One way that this new strain differs however, is the fact that the malware is loaded onto the target machine via specially crafted Word documents attached to the email.

The idea is that these Word documents leverage VBGA macro code to execute shellcode that’s stored in the properties of the Word document.  That’s both new and dangerous.

The HP researchers found evidence that tracks the malicious code back to its origin in April of 2022, with the developers releasing several updates just one month later in May.  The number of updates is suggestive of a large, well-organized team that is committed to continued development of their new toy.

Currently, SVCReady boasts the following capabilities:

• Download a file to the infected client
• Take a screenshot
• Run a shell command
• Check if it is running in a virtual machine
• Collect system information (a short and a “normal” version)
• Check the USB status, i.e., the number of devices plugged-in
• Establish persistence through a scheduled task
• Run a file
• And run a file using RunPeNative in memory

In addition to these capabilities, SVCReady can also fetch additional payloads from the command-and-control server.  While the bullet points above are dangerous in their way, it is the last, recently added capability that makes the new malware strain especially dangerous.  It enables the hackers to tailor the level of destruction for each infected target.

Worse, the new strain contains bits of code that lead the HP researchers to conclude that the threat actor TA551 may be behind it.  This is a large, well-organized group with ties to multiple other hacking organizations and ransomware affiliates. That implies that SVCReady may soon become much more widely available than it is now.

You will want to be sure this one stays on your radar.

Are you excited about Windows 11?  Many people are and in fact there are legions of beta users who are in the Windows Insiders group so they can get a sneak peek at some of the features on deck as updates are released.

One of the coolest new features making its way through the development pipeline is the “Restore Apps” feature the company is working on.

Its development came about from the realization that one of the most time-consuming tasks associated with setting up a new PC with a fresh Windows installation is the process of restoring all your previously installed apps.

This new feature aims to shortcut the process. Unfortunately, it doesn’t work with desktop applications, but any app you’ve downloaded and installed from the Microsoft Store can be put back in place via a single click, and that’s amazing.

Microsoft had this to say about the new feature:

“To make it easier for customers to transition to their new PCs quickly and seamlessly, we will soon test a new feature in the Windows Insider channel that helps customers automatically restore their apps, previously installed from the Microsoft Store, to their new Windows device.  This will also help developers retain their customers without having to remind customers to re-download their app.”

In addition to the “Restore Apps” feature, Microsoft will soon be adding the ability to install apps directly from a search in the Windows 11 Start Menu. Given that many people use the Start Menu’s search function to find new apps, this is a natural fit. By not having to access the Microsoft Store directly, it saves a step while offering a bit of added convenience.

While neither of these are available just yet, they will be soon. So if you’re a Windows Insider, be on the lookout for them.