Newsletters

Mandiant cites several reasons for URSNIF's new radical redesign. At least two leaks of its codebase, multiple branches of the same codebase that had slowly diverged and were making it harder to support features across different botnets, but also an ancient codebase that had finally reached the end of the road when IE was removed from Windows.

Honestly, it's a surprise that URSNIF lasted this long still operating on a banking trojan model. It had become obvious in the mid-2010s that the banking malware scene was dying, at least on the desktop.

Banks, tired of a decade of heists from customer accounts, had rolled out advanced multi-factor authentication and transaction verification systems. While not foolproof, these systems did their job and made it more time-consuming for banking malware operators to steal money from compromised accounts.

Being "overemployed" — secretly working multiple full-time jobs — is a trend. Equifax used one of its own products, called The Work Number, to identify employees that had overlapping pay periods from other companies. This information was then combined with other data including VPN usage, manager reports and unexplained absences during the workday to identify 25 employees working multiple full-time jobs. In addition to 25 employees, 283 contractors were also identified as potentially working two jobs, although it is not clear what happened to them.

While The Work Number product has existed since 2007, it has massively grown in scope over the last couple of years. The company's 2021 annual report states The Work Number is now "now receiving records every pay period from 2.5 million companies, up from 1 million when we started 2021 and 27,000 contributors a short two-plus years ago".

The authors of the Business Insider report state:

Kashfi obtained multiple copies of the malware—which he later identified as a version of the L3MON Android remote access trojan—and found that all samples were communicating with a VPS server based in Germany, on which the BSI acted this week.

The researcher is now warning that even if this server is now down, the danger to protesters continues, as IRGC operators are most likely to set up a new one for subsequent deployments.

Iranians detained by the IRCG are advised to reset their smartphones as Kashfi says that the L3MON RAT has no advanced persistence capabilities, and this will remove it from compromised devices.

Tata Power: Tata Power, one of the largest electrical power producers in India, disclosed a security breach in a document [PDF] filed with India's national stock exchange. The company said the incident only impacted its IT systems—which is currently in the process of restoring—and that all other critical systems are operating as normal. [Additional coverage in TechCrunch]

Woolworths breach: Australian retail chain Woolworths said that a threat actor compromised an employee's credentials and accessed the backend of its MyDeal portal. The company is currently sending email notifications to all affected customers. Exposed data includes names, dates of birth, phone numbers, and home addresses, according to a notification seen by ABC.

Advanced incident: Advanced, one of the biggest IT providers for the UK NHS, disclosed a security breach last week, admitting they had their IT network compromised following an infection with the LockBit 3.0 ransomware.

We call it lameness because anyone with a basic understanding and foothold in the cybersecurity industry saw through this in the first five seconds.

Obviously, this disinformation campaign wasn't meant for the big-brains in the infosec industry, but because it was caught on early on and ridiculed into the ground, it was also almost immediately yeeted into the sun by the time of this newsletter, with the vast majority of the participating accounts being wiped clean (see list of accounts here, compiled by Stairwell security researcher Silas Cutler).

All of this fits in some bizarre trend that we've observed this year from the Chinese government, which has been obsessed with painting the US government, and the NSA in particular, as some sort of Dick Dastardly of the cyber-espionage world, responsible for all sorts of bad things, like... spying. Because that's obviously not what an intelligence agency does.

US President Joe Biden signed an executive order last Friday aimed at implementing a new privacy framework for data sharing between the European Union and the US (The EU-US Data Privacy Framework or EU-US DPF). The Executive Order on "Enhancing Safeguards For United States Signals Intelligence Activities" is intended to square the circle and balance US national security requirements for signals intelligence (SIGINT) against European Union human rights protections.

The goal of the privacy framework is to make transatlantic data flows between the EU and US legal and relatively easy by ensuring that EU citizens' user data is appropriately protected when it is transferred to the US. Two previous agreements — Safe Harbor and Privacy Shield — were both struck down by the European Court of Justice in 2015 and 2020 respectively for not adequately protecting users from US intelligence collection practices.

The EO adds new safeguards for US SIGINT activities, including:

STAX Finance hack: DeFi platform STAX Finance said it lost $2.3 million after an attacker exploited a bug in TempleDAO, the backbone of its service.

Forced to delete notebooks and files: Peiter "Mudge" Zatko, Twitter's former head of security, alleged that Twitter management forced him to burn notebooks and delete files in order to get his severance package. According to Bloomberg, citing court documents unsealed this week, this included 10 handwritten notebooks and deleted 100 computer files.

Brute-force protection for local admin accounts now generally available: With yesterday's Patch Tuesday security updates, Microsoft has also enabled a new feature by default for all Windows OS versions that will lock and freeze all local admin accounts for 10 minutes after 10 failed login attempts. The feature is meant to be Microsoft's best protection against brute-force attacks, including those carried out via RDP, that have served as an initial entry for many cybercrime and cyber-espionage operations over the past years. A similar feature to block SMB-based brute-force attacks is also in the works.

But despite their oversized presence on npm, their end goals were not up to par with their determination to infect targets. Checkmarks said that the group used the stolen credentials to merely boost their Discord server. Stolen gaming and streaming account creds were leaked on the Cracked.io hacking forum as a way to draw attention and promote their hacking tools (many of which were widely available via a public GitHub page) and an underground service for selling fake Instagram followers.

Imagine spending all this time flooding the npm portal with fake libraries, compromising developer boxes, and all of it just for some hacker rep.

We often hear about reports of malicious libraries being found on PyPI, npm, or Rubygems, but in recent years, all of these have been linked to teenage hackerism like this or to some lame cryptomining op. For all the hype surrounding supply chain attacks, it appears that threat actors like LofyGang are exhibiting a serious lack of imagination when they manage to land a malicious package on any of these repos for more than a week or two. One reason why these attacks are often spotted early on is because the DevSecOps has quickly matured, and tools to continuously scan public package repos have caught up with attackers' speed.

Prosecutors did add wire fraud charges to Sullivan's case, related to the actual bug bounty payout to the hackers, in December 2021, but the charges were eventually dropped, leaving the core of the case to hinge around the Uber exec's obstruction of justice.

Sullivan, who once used to be a prosecutor in the same office that charged him now, faces up to eight years in prison and $500,000 in fines. His sentencing hearing has not been scheduled yet.

But regardless of the fine minutia of the case, the infosec industry has been seriously rocked by Sullivan's prosecution. Several opinions going online argue that the case will either drive away legitimate professionals from CISO/CSO roles to minor or completely different positions or industries or will drive up position salaries through the stratosphere if security execs are now literally expected to fall on the legal sword following a security breach and all the legal shenanigans that often take place in the backstage of many organizations. Because we know they do.

Google has released a new six-part documentary series profiling various Google security teams including the Threat Analysis Group and Project Zero among others.

We've seen Episode 000 so far and it's great fun. It covers the 2010 "Operation Aurora" hack from Google's perspective (although dozens of other US companies were also affected). This was a watershed moment in cyber security history and it resulted in both a significant change in Google's security posture and its relationship with China. Google's remarkably frank and norm-shattering press release on the hack from back then will get you primed for viewing.

Hacktivist group Guacamaya which we mentioned in late September is having some impact in South America, particularly in Mexico. Despite that, the group told The Record that it was not particularly happy that journalists had focused on Mexican President López Obrador's health rather than on the environmental impacts of Tren Maya, an intercity railway megaproject.