At least one group of hackers has learned a new trick you need to be aware of. Security researchers at Kapersky Lab have discovered a malicious campaign-in-progress that is using event logs to store malware. That is a technique that has not been seen or documented until now.

This new methodology is designed for maximum stealth, allowing the threat actor to plant fileless malware in the target device's file system.

The dropper used in this case makes a copy of the legitimate OS error handling file called "WerFault.exe." This is placed in C:WindowsTasks, and then it drops an encrypted binary resource to the wer.dll in the same location, which is used for Windows Error Reporting.

DLL hijacking is something that has been seen before. It is a move that allows hackers to exploit a legitimate program that isn't designed with many checks, which allows malicious code to be loaded into memory.

Denis Legezo is the lead security researcher at Kaspersky. Legezo notes that the loader itself is harmless, but the hackers have hidden shellcodes inside the Windows event logs, and that's what allows it all to function.

Legezo's team traced the attack back to its origins in September of 2021 when the victim was tricked into downloading a RAR file from the file sharing service File.io.

It's a scary piece of work. Based on an analysis of the code, it seems clear that the threat actor behind this new technique is highly advanced.

The fear is that the details surrounding this new method will be widely shared on the Dark Web. This would allow other, less technically proficient threat actors to copy it. Given how difficult to detect the method is, it's likely to become incredibly popular very quickly.

All that to say, if you're an IT Security Professional, your life is probably about to get a whole lot harder unfortunately.

The name Kevin Beaumont may not be familiar to you, but if you’re a Linux or Solaris user, he may have just saved you a whole lot of grief.

Recently, Mr. Beaumont discovered a stealthy backdoor malware that has been quietly infecting Linux and Solaris SPARC systems for more than five years.  BPFdoor only parses ICMP, UDP and TCP packets checking them for a specific data value and in the case of UDP and TCP packets, also checking for a password.

It can sit quietly on an infected system for an extended period. However,  once triggered, it allows the hacker who placed it there complete access to a compromised device.  Beaumont found BPDdoor activity on networks all over the world.  It was most notably found in South Korea, Hong Kong, India, Vietnam, Myanmar, Turkey and of course, the United States.

He also discovered eleven different speed test servers infected with BPFdoor. Although he was at a loss to explain how those systems may have been compromised since they run on closed-source software.

A different researcher named Craig Rowland issued a comprehensive technical report on BPFdoor and outlined some of its very clever anti-evasion tactics.

The tactics include the fact that it:

• Resides in system memory and deploys anti-forensics action (wipes the process environment, albeit unsuccessfully as it leaves it empty)
• Loads a Berkeley Packet Filter (BPF) sniffer allowing it to work in front of any locally running firewalls to see packets
• Modifies ‘iptables’ rules when receiving a relevant packet to allow attacker communication through the local firewall
• Masquerades the binary under a name like a common Linux system daemon
• Renames and runs itself as /dev/shm/kdmtmpflush
• Changes the date of the binary (time stamping) to October 30, 2008, before deleting it

Thanks to the research of these two individuals, an incredibly stealthy malware strain that specifically targets Linux and Solaris systems has now been exposed to sunlight.  Although the malware is well-designed and contains several clever anti-evasion tactics, now that the word is out, IT Security professionals know what to look for and can begin the process of purging it from infected systems.  Kudos to both.

How many “smart” devices do you have connected to your home or company network?  It’s probably a higher number than you originally estimated.  However large that number is, it pays to be aware that IoT devices are some of the least secure devices available on the market today, which makes them the weakest link in terms of hackers successfully attacking your network.

In fact, there are millions of IoT devices that are vulnerable to a critical security flaw residing in the DNS component of a C Standard library that all sorts of firmware developers make use of.  That means that right now, there are literally millions of ticking time bombs out there and one or more of them could be connected to your network.

There are two libraries to be aware of here:  uClibc and its fork, developed by the OpenWRT team.  You’ll find major companies like Linksys, Axis, and Netgear making use of both on a regular basis, and you’ll even find it in some Linux distributions.

Unfortunately, at the time this article was written, there are no fixes available from the developer which leaves the products of more than 200 different vendors at risk.

Essentially, the flaw relies on a predictable transaction ID for DNS lookup requests.  It is that predictability that creates the vulnerability and allows a clever hacker to “trick” a vulnerable device into pointing to an arbitrarily defined end point specified by the hacker, which would have the effect of rerouting your network traffic to a server under the control of the hackers.

As you can imagine, that would cause no end of trouble for you and your company. That is because the hackers would then have perfect visibility into everything you do on your network and would be able to inject any sort of malware into any system on your network.

There’s no simple solution here except to disconnect any vulnerable IoT devices from your network and contact the developers who maintain the library and demand immediate action.  A fix is currently in the works, but adding your voice to the rapidly growing chorus can’t hurt.

Hackers around the world are increasingly targeting verified Twitter accounts with emails designed to pilfer your Twitter login credentials.

Verified Twitter accounts differ from standard Twitter accounts in that they sport a large blue check mark next to the user’s name, which indicates that the person who owns the account is someone of considerable influence on the platform.

To be considered for verified status, you must formally apply for verification, which involves sending the company additional information including website references and pictures of your Photo ID.  There’s even an “essay portion” to the process that requires you to tell the company in your own words why your account deserves to be “notable.”

If that all sounds a little over the top to you, you’re not alone and it is one of the reasons why there are comparatively few verified accounts.

Even so, if you decide you just must have one, be aware that hackers are watching. They’ve been increasingly targeting anyone with the big blue check mark because those accounts can be resold for more money.  The accounts typically have lots of followers attached to them, which means that the hackers can potentially get their hooks into even more people.

The latest campaign looks something like this:

You’ll get an email stating that you’ve got a new notification from Twitter Verified, which sounds fairly official.

The email in question contains a button labeled “Check Notifications” but unfortunately, when you do that, you’ll be asked to enter your Twitter login credentials to verify that it’s really you.

Naturally, entering your credentials here has nothing to do with verifying your identity.  What you’re typing in is a simple capture box controlled by the hackers, allowing them to pilfer your login details and then abuse them.

Don’t fall for it.  Your best bet is to assume any email from a company is fraudulent. Instead of clicking on links, surf your way to the company’s website directly.  That’s still not a bullet proof solution, but it will reduce your risk to something pretty close to zero.

The MalwareHunterTeam recently discovered a new ransomware operation that is particularly nasty.  Called Onyx, outwardly, the operation does what most ransomware campaigns do.  It gets inside a corporate network, exfiltrates the data that it wants, then seems to encrypt the rest, and then threatens to release the files to the broader public unless their demands for payment are met.

An additional fee is demanded to unlock the encrypted files, but there’s a catch in this instance.

Any file larger than 2MB in size is deleted and then overwritten before encryption to make it appear that the file is still intact.  Unfortunately, when victims pay the fee to have their files decrypted, they discover that the file is garbage and the actual file they wanted has been deleted.

This is not a flaw in the malicious code but rather an intentional design decision. It is implemented to inflict maximal pain on companies that fall victim to their attack.

The discovery was only recently made. So it’s quite likely that at least some companies have paid the demanded ransom in hopes of getting their files back, only to have those hopes dashed.

Given this fact, if you are hit with an Onyx attack, don’t pay the ransom.  It won’t do you any good, except where your smaller files are concerned.  Your only hope is to restore those files from backup, and you certainly don’t need to pay the ransom to do that.

Malware attacks in general and particularly ransomware attacks are an unfortunate part of corporate life these days.  Whether due to poor planning, faulty backups, or something else, some companies feel the need to pay the ransom and get on with the business of their business. However, in this case, the Onyx campaign proves that there is no honor among thieves.  Be careful out there.

Google SMTP relay service is wildly popular and used every day by legions of users.  Unfortunately, hackers around the world are aware of this and increasingly they’ve begun abusing the SMTP relay service.

The basic idea is as follows. Some clever hackers have figured out that they can bypass email security products and deliver malicious emails to their intended targets if they take advantage of certain weaknesses in Google’s SMTP relay service.

Researchers at the security firm Avanan have been tracking the phenomenon and have confirmed a sudden, dramatic spike in threat actors abusing the SMTP relay service beginning in April of this year (2022).

The relay service is offered by Google as part of Gmail and Google Workspace as a means of routing outgoing user emails.

Use of the SMTP relay is mostly a matter of convenience, as it means that users don’t have to manage an external server for marketing emails. So there’s no worry that their mail server may get added to someone else’s blocked list.

It is very handy but unfortunately, hackers have discovered that they can use the SMTP relay service to spoof other Gmail tenants without being detected, with one very important catch and caveat. If those domains have a DMARC policy configured with the ‘reject’ directive, the game is up, and the hacker’s attempt will fail.

Although this can be a serious problem, it also has a simple solution.  Just set a fairly strict DMARC policy and you’ll minimize your risk of your users falling victim to this type of attack.

As Google indicated on a recent blog post on this very topic:

“We have built-in protections to stop this type of attack. This research speaks to why we recommend users across the ecosystem use the Domain-based Message Authentication, Reporting & Conformance (DMARC) protocol. Doing so will defend against this attack method, which is a well-known industry issue.”

It’s good advice.  If you aren’t sure whether you’ve got a strict DMARC policy set, find out from your IT staff. If not, have them implement one right away.

Google has been making some fantastic changes to bolster user security in recent weeks. That includes changes to their Google Play Store that will require developers to disclose exactly what data they plan to track and collect when users install the apps they create.

In a related vein, the tech giant has also recently added some powerful new security features to Google Docs, Sheets, and Slides that now display warning banners any time users attempt to open a suspicious file on the web.

Too often, users will open a file without giving much thought to who put it before them or where it resides (whether a trusted network drive or somewhere on the cloud, for example).  Unfortunately, hackers are keenly aware of this and will often plant poisoned files that appear to be legitimate work files in places where users are likely to find them. Then, the hackers simply sit back and wait until they reel someone in.

These recent changes to Google Workspace apps are designed with one goal in mind. To help the people using those apps make better decisions bout whether to open a file, even if it looks completely legitimate.

This new warning feature builds on a system the company began implementing for Google Drive files back in January of this year (2022) and uses the same warning banners you’ll find there.  A bright yellow, hard to miss banner appearing at the top of the page after a user has clicked on a link, but before the file is downloaded.

These brightly colored banners display warning messages essentially asking the user if he or she is sure about downloading a file from an untrusted source that may contain malicious code.  Note that Enterprise users were a bit slower than everyone else to get the new functionality because of the way Google organized the rollout. By the time you read this, they should be visible for everyone.

Ask just about any IT security professional and they will tell you that weak user passwords are one of the biggest problems and most persistent threats to corporate networks.

Despite years of training, re-training, and near-constant reminders to strengthen passwords, users keep making the same mistakes.

They’ll re-use the same password across multiple properties. They may use an incredibly weak and easy to guess password that makes it easy for hackers to break in using simple brute force attacks against their accounts.

If passwords were to simply go away and be replaced by something better, legions of IT security folks would breathe a tremendous sigh of relief.

If Apple, Google, and Microsoft have anything to say about the matter, that is soon to be a reality.  All three companies are hard at work on a variety of passwordless schemes. If their plans remain on track, we’ll get to see the fruits of their labor sometime next year.

The three companies are currently working to implement passwordless FIDO sign-in standards across Android, Chrome, iOS, macOS, Safari, Windows, and Edge.  Taken together, those systems and software packages account for some 90 percent of network traffic today. It won’t be long now before the devices users employ will store a FIDO credential, dubbed a passkey, which is used to unlock your device and access all of your online accounts.

The passkey scheme is substantially more secure than a simple password because it’s protected with powerful cryptography and only shown to your online account when you unlock your device.  Contrast that with passwords, which leave users vulnerable to all manner of phishing schemes and are subject to being weakened by bad habits developed by the users themselves.

All of that is good news but it should be noted that we haven’t seen it in action yet. Even after the Big Three finish their work, there’s still the considerable task of implementing the use of the new passkeys into websites and other applications. It will be a while yet, but the good news is change is coming.

Some interesting and disturbing changes are afoot in the hacking world.  It appears that the TrickBot gang is now working for the Conti Syndicate. TrickBot is a well-known group of botnet developers responsible for the creation of the BazarLoader. BazarLoader has been used by Conti in the past as their delivery system of choice when it comes to delivering ransomware as part of one of their sophisticated phishing campaigns.

Now though, the Conti Syndicate has a new tool at their disposal.  A newly developed malware loader dubbed Bumblebee.  Eli Salem is a seasoned malware reverse engineer at Cyberreason. Salem says that the techniques used by Bumblebee are similar to those used by BazarLoader. This suggests that they were developed by the same team, which points the way back to TrickBot.

So TrickBot’s developers made a new toy for the Conti Syndicate. Since Bumblebee became available, security researchers at Proofpoint and other organizations have been seeing evidence that other groups are switching away from BazarLoader and IcedID (also highly similar) in preference for Bumblebee.

Although similar in its overall structure to BazarLoader, Bumblebee appears to be a more advanced version.

It can  support a wide range of commands, including but not limited to:

• Shi: shellcode injection
• Dij: DLL injection in the memory of other processes
• Dex: Download executable
• dl: uninstall loader
• And Ins: enable persistence via a scheduled task for a Visual Basic Script that loads Bumblebee

Worse is that there is clear evidence that Bumblebee is being actively developed and gains new features and capabilities with every update.

As of the update observed on April 19th, for example, the malicious code now supports multiple command-and-control servers. The development team has recently added an encryption layer that makes it more difficult to track communications to and from the command-and-control server.

What this means in terms of the bigger picture is anyone’s guess. It seems clear that there’s a growing level of cooperation and coordination in the hacking world lately, and that should scare just about everyone.