Home » Malware

IQY and PowerShell Abused by Spam Campaign to Infect Users in Japan with BEBLOH and URSNIF

Posted on:August 22, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

Trend Micro recently saw increased abuse of the internet query file IQY, similar to the activity detected in June from a Necurs-distributed spam wave that delivered the FlawedAmmyy RAT. It appears cybercriminals are taking advantage of the simple structure of IQY files because they can be used to evade structure-based detection methods.

Our latest observation found the Cutwail botnet distributing spam mails abusing IQY files. The spam campaign specifically targets users in Japan, delivering either the BEBLOH (detected by Trend Micro as TSPY_BEBLOH.YMNPV) or URSNIF (TSPY_URSNIF.TIBAIDO) malware. The spam mails attempt to trick users into clicking the attachment using conventional social engineering baits such as “payment,” “photos sent,” “photos attached,” and “please confirm,” among others. The campaign’s activity was detected on August 6, 2018, and has managed to distribute approximately 500,000 spam mails. The spam distribution has since died down on August 9.

Posted on:August 21, 2018 at 6:04 am
Posted in:Malware, Targeted Attacks
Author:
Trend Micro Cyber Safety Solutions Team

Together with our colleagues at IssueMakersLab, we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.

The threat actors compromised the update server of a remote support solutions provider to deliver a remote access tool called 9002 RAT to their targets of interest through the update process. They carried this out by first stealing the company’s certificate then using it to sign the malware. They also configured the update server to only deliver malicious files if the client is located in the range of IP addresses of their target organizations.

9002 RAT also installed additional malicious tools: an exploit tool for Internet Information Services (IIS) 6 WebDav (exploiting CVE-2017-7269) and an SQL database password dumper. These tools hint at how the attackers are also after data stored in their target’s web server and database.

Posted on:August 9, 2018 at 6:01 am
Posted in:Bad Sites, Malware, Ransomware
Author:
Joseph C Chen (Fraud Researcher)

We have been observing a malvertising campaign via Rig exploit kit delivering a cryptocurrency-mining malware and the GandCrab ransomware since July 25. On August 1, we found Rig’s traffic stream dropping a then-unknown ransomware. Delving into this seemingly new ransomware, we checked its ransom payment page in the Tor network and saw it was called Princess Evolution (detected by Trend Micro as RANSOM_PRINCESSLOCKER.B), and was actually a new version of the Princess Locker ransomware that emerged in 2016. Based on its recent advertisement in underground forums, it appears that its operators are peddling Princess Evolution as a ransomware as a service (RaaS) and are looking for affiliates.

Posted on:August 7, 2018 at 5:00 am
Posted in:Deep Web, Malware
Author:
Fernando Mercês (Senior Threat Researcher)

With the increasing popularity and real-world use of cryptocurrencies and the fact that cybercriminals will always try to exploit something that can make money for them, it shouldn’t come as a surprise that malware targeting Bitcoin ATMs have started appearing in underground markets.

Posted on:August 2, 2018 at 5:00 am
Posted in:Machine Learning, Malware
Author:
Weimin Wu (Threat Analyst)

The history of antimalware security solutions has shown that malware detection is like a cat-and-mouse game. For every new detection technique, there’s a new evasion method. When signature detection was invented, cybercriminals used packers, compressors, metamorphism, polymorphism, and obfuscation to evade it. Meanwhile, API hooking and code injection methods were developed to evade behavior detection. By the time security solutions started using machine learning (ML)-based detection technologies, it was already expected that cybercriminals would develop new tricks to evade ML.

To be one step ahead of cybercriminals, one method of enhancing an ML system to counter evasion tactics is generating adversarial samples, which are input data modified to cause an ML system to incorrectly classify it. Interestingly, while adversarial samples can be designed to cause ML systems to malfunction, they can also, as a result, be used to improve the efficiency of ML systems.

Page 1 of 27012 › »

IQY and PowerShell Abused by Spam Campaign to Infect Users in Japan with BEBLOH and URSNIF

Supply Chain Attack Operation Red Signature Targets South Korean Organizations

Ransomware as a Service Princess Evolution Looking for Affiliates

Malware Targeting Bitcoin ATMs Pops Up in the Underground

Adversarial Sample Generation: Making Machine Learning Systems Robust for Security

Security Predictions for 2018

Business Process Compromise

Stay Updated

IQY and PowerShell Abused by Spam Campaign to Infect Users in Japan with BEBLOH and URSNIF

Supply Chain Attack Operation Red Signature Targets South Korean Organizations

Ransomware as a Service Princess Evolution Looking for Affiliates

Malware Targeting Bitcoin ATMs Pops Up in the Underground

Adversarial Sample Generation: Making Machine Learning Systems Robust for Security

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated