September Patch Tuesday: Windows Fixes ALPC Elevation of Privilege, Remote Code Execution Vulnerabilities

Posted on:September 11, 2018 at 11:25 pm
Posted in:Exploits, Vulnerabilities
Author:
Trend Micro

September’s Patch Tuesday provides a security patch for CVE-2018-8440, an elevation of privilege vulnerability that occurs when Windows incorrectly handles calls to the Advanced Local Procedure Call (ALPC) interface. This bug allows threat actors to run code with administrative privileges, install programs, or even create new accounts with full user rights. This bug’s source code has been publicly disclosed as of August 27 via Twitter and has been seen actively used in malicious campaigns as early as September 5.

Posted on:September 10, 2018 at 5:02 am
Posted in:Ransomware, Spam
Author:
Trend Micro

While ransomware has noticeably plateaued in today’s threat landscape, it’s still a cybercriminal staple. In fact, it saw a slight increase in activity in the first half of 2018, keeping pace by being fine-tuned to evade security solutions, or in the case of PyLocky (detected by Trend Micro as RANSOM_PYLOCKY.A), imitate established ransomware families and ride on their notoriety.

In late July and throughout August, we observed waves of spam email delivering the PyLocky ransomware. Although it tries to pass off as Locky in its ransom note, PyLocky is unrelated to Locky. PyLocky is written in Python, a popular scripting language; and packaged with PyInstaller, a tool used to package Python-based programs as standalone executables.

Posted on:September 7, 2018 at 5:58 am
Posted in:Deep Web
Author:
Trend Micro Forward-Looking Threat Research Team

We uncovered personally identifiable information (PII) stolen from a China-based hotel chain being sold on a deep web forum we were monitoring. Further analysis revealed that the stolen data was not only the PII of Chinese customers, but also included the hotel chain’s customers from Western and East Asian countries. The sample data we saw was unencrypted (in plaintext), some of which were in CSV, SQL, and TXT dumps.

We believe this stolen data is related to the data breach (reported on August 29) that exposed up to 130 million PII. The news that reported the data breach matched with an advertisement we saw in the dark web selling the stolen data for eight bitcoins (equivalent to more than US$58,000 as of September 5, 2018).

Posted on:August 29, 2018 at 6:07 am
Posted in:Mobile, Targeted Attacks
Author:
Trend Micro

In the process of monitoring changes in the threat landscape, we get a clearer insight into the way threat actors work behind the schemes. In this case we dig deeper into the possible connection between cyberattacks by focusing on the similarities an unnamed threat actor shares with Confucius, Patchwork, and another threat actor called Bahamut. For the sake of this report, we will call this unnamed threat actor “Urpage.”

Posted on:August 22, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

Trend Micro recently saw increased abuse of the internet query file IQY, similar to the activity detected in June from a Necurs-distributed spam wave that delivered the FlawedAmmyy RAT. It appears cybercriminals are taking advantage of the simple structure of IQY files because they can be used to evade structure-based detection methods.

Our latest observation found the Cutwail botnet distributing spam mails abusing IQY files. The spam campaign specifically targets users in Japan, delivering either the BEBLOH (detected by Trend Micro as TSPY_BEBLOH.YMNPV) or URSNIF (TSPY_URSNIF.TIBAIDO) malware. The spam mails attempt to trick users into clicking the attachment using conventional social engineering baits such as “payment,” “photos sent,” “photos attached,” and “please confirm,” among others. The campaign’s activity was detected on August 6, 2018, and has managed to distribute approximately 500,000 spam mails. The spam distribution has since died down on August 9.

Page 1 of 75712 › »

2018 Midyear Security Roundup: Unseen Threats, Imminent Losses

Foreshadow/L1TF Intel Processor Vulnerabilities: What You Need to Know

Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts

A Look Into Smart Factories: A Model of IIoT Innovation

Data Breaches Highlight the Need for Managed Detection and Response

September Patch Tuesday: Windows Fixes ALPC Elevation of Privilege, Remote Code Execution Vulnerabilities

A Closer Look at the Locky Poser, PyLocky Ransomware

Stolen Data from Chinese Hotel Chain and Other Illicit Products Sold in Deep Web Forum

The Urpage Connection to Bahamut, Confucius and Patchwork

IQY and PowerShell Abused by Spam Campaign to Infect Users in Japan with BEBLOH and URSNIF

Security Predictions for 2018

Business Process Compromise

Stay Updated

2018 Midyear Security Roundup: Unseen Threats, Imminent Losses

Foreshadow/L1TF Intel Processor Vulnerabilities: What You Need to Know

Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts

A Look Into Smart Factories: A Model of IIoT Innovation

Data Breaches Highlight the Need for Managed Detection and Response

September Patch Tuesday: Windows Fixes ALPC Elevation of Privilege, Remote Code Execution Vulnerabilities

A Closer Look at the Locky Poser, PyLocky Ransomware

Stolen Data from Chinese Hotel Chain and Other Illicit Products Sold in Deep Web Forum

The Urpage Connection to Bahamut, Confucius and Patchwork

IQY and PowerShell Abused by Spam Campaign to Infect Users in Japan with BEBLOH and URSNIF

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated