APT: Equation

Equation:
STATUS:Active
TYPE:Complex cyberattack platform
DISCOVERY:2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2002
NUMBER OF TARGETS:500-1,000

Top Targeted countries:
Iran, Russia, Pakistan, Afghanistan, India, China, Syria, Mali, Lebanon, Yemen

Special Features:
The ability to infect the hard drive firmware
The use of “interdiction” technique to infect victims
Mimicking to criminal malware.

Targets:
Nanotechnology
Financial institutions
Nuclear industry
Activists
Academia/Research
Government entities
Energy, oil and gas companies
Military
Telecoms
Diplomatic organizations/embassies
Trade and commerce
Aerospace
Mass media and TV
High technology companies
Education
Transportation

APT - Hellsing

Hellsing:
STATUS:Active
TYPE:Remote administration tool
DISCOVERY:Summer 2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2012
NUMBER OF TARGETS:11-100

Top Targeted countries:
Malaysia, Philippines, India, Indonesia, USA

Targets:
Government entities
Diplomatic organizations/embassies

APT: Carbanak

Carbanak:
STATUS:Active
TYPE:Backdoor
DISCOVERY:2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2013
NUMBER OF TARGETS:11-100


Special features:
First ever criminal APT.
Carbanak cybergang was able to steal $1bn from 100 financial institutions worldwide.
The plot marks the beginning of a new stage in the evolution of cybercriminal activity, where malicious users steal money directly from banks, and avoid targeting end users.
The largest sums were grabbed by hacking into banks and stealing up to ten million dollars in each raid.


Top 10 countries:
Russia, USA, Germany, China, Ukraine, Canada, Taiwan, Hong-Kong, United Kingdom, Spain, Norway, India, France, Poland, Pakistan, Nepal, Morocco, The Czech Republic, Switzerland, Bulgaria, Australia, Iceland, Brazil

Targets:
Financial institutions

APT: CosmicDuke

CosmicDuke:
STATUS:Active
TYPE:Backdoor
DISCOVERY:2013
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:April 2012
NUMBER OF TARGETS:101-500

Special features:
The TinyBaron/CosmicDuke custom backdoor is compiled using a customizable framework called "BotGenStudio", which has sufficient flexibility to enable/disable components when the bot is constructed.
The attackers use strong self-protection to prevent antimalware solutions from analyzing the implant and detecting its malicious functionality via an emulator. It also complicates malware analysis.
CosmicDuke targets individuals involved in the traffic and selling of illegal and controlled substances. These victims have been observed only in Russia.

Top 10 countries affected:
 Georgia, Russia, USA, Great Britain, Kazakhstan, India, Belarus, Cyprus, Ukraine, Lithuania. Others include Azerbaijan, Greece and Ukraine.

Targets:
Diplomatic organizations/embassies
Energy, oil and gas companies
Telecoms
Military
Specific individuals

What is persistent in the context of malware or cyber security?

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

Skype worm reloaded:

 Skype worm reloaded again. The same old scenario is used to propagate. It all started with a message from the infected system and posing a legit link and seems to be a funny video. But at the end, it will ask you install add-ons or plugins to play that video.

Once you installed it, that is it. Your skype will send the same kind of message to your friends.

list of malicious domain related with this skype worm:

 please don't visit it: ( #skypeworm )

hxxp://24onlineskyvideo.info
hxxp://24videotur.in.ua
hxxp://deepskype.net
hxxp://factorygood.net
hxxp://ironskype.net
hxxp://letitskype.info
hxxp://letskype.net
hxxp://popskypevideo.net
hxxp://popvideoskype.com
hxxp://popvideoskype.info
hxxp://popvideoskype.net
hxxp://skypepopvideo.net
hxxp://skypepopvideo.net
hxxp://skyvideo24.in.ua
hxxp://skyvideo24online.in.ua
hxxp://skyvideo24online.ru
hxxp://skyvideotape.in.ua
hxxp://skyvideotape.ru
hxxp://someskype.com
hxxp://someskype.net
hxxp://techine.info
hxxp://techine.net
hxxp://videosk.in.ua
hxxp://videosk.info
hxxp://videoskype.ru
hxxp://videoskype24.ru
hxxp://videoss.in.ua

Post by
newWorld

Job Scam Emails: (Infosys JOB)

 Today I want to share a post on job scams via email. Earlier, I posted on nigerian scams or online frauds. 

Let see the scam:

content of the email:

Infosys Recruitment 2015

Kindly send your update Curriculum Vitae/Resume for job description.

James Carrick
Hr Executive


I checked the send address details:

from: Infosys <cardimen@oakland.edu>
reply-to: hr@infosys-tech.co.in

to:
bcc: ******@gmail.com
date: 12 January 2015 at 05:03
subject: Infosys
mailed-by: oakland.edu
Signed by: oakland.edu
- Important mainly because of the people in the conversation.


It looks suspicious to me, because of the send address and the mail formats. So I replied them to look forward any attachments. I received a word doc. Scanned the word doc with officemalscanner for any malicious codes. But, nothing found. Still, I viewed that doc in controlled environment.

Content of the doc:

They also mentioned that salary range is from Rs.98,981.00/- Rs.400982/-. For the interview process, they asked as to pay 26000/-. I am very sure about that no IT company will ask these kind of silly stuffs.

All we need small amount of seriousness and little awareness about the cyber security threats.
Please share this information with your friends and family and stay away from these kinds of scams.

Post made by
newWorld

The Pirate Bay Co-Founder Arrested:

The Pirate Bay is most visited torrent site in the world and it uses bit torrent protocol for peer to peer file sharing.
"Hans Fredrik Lennart Neij, known to hackers as TiAMO, was detained in the north-eastern Thai town of Nong Khai."- BBC

source: BBC

"Another Pirate Bay co-founder, Gottfrid Warg, was arrested in Cambodia in 2012 and sent back to Sweden to serve his sentence for the same conviction, as well as face a separate hacking trial in Denmark." -BBC



Post by
newWorld

Ello Down Due To DDOS Attack:

Ello is an ad free social network. And it is widely dubbed as rivalry for facebook. Imagine a social network site without ad, then you feel like a house in under construction. Ello looks the same but it is promising in social network.

If you read the Ello's privacy report: get clear idea...

"

Your Privacy is Important

As an ad-free network that does not sell data about its users to third parties, Ello has also taken unique steps that help you control how much information about you is shared when you use Ello.

Please read this document in its entirety and take it seriously. It explains Ello's privacy practices, and what information we collect when you use our web site, mobile apps, services, products, and other content; and also how you can opt-out of sharing some of this information."

Ello's privacy reports shows that they are clean and in purpose. Now we see the DDos attack.

Ello site faced a DDOS attack and appeared to be down. Ello takes corrective measures by blocking the Ip. 

In our opinion, Ello is growing more popular, so only it started facing these challenges.

Post made by 

newWorld

A Codeless PE Binary File That Runs!!!

Recently, I came across article written in alex lonescu's blog. Its about the PE tricks that PE binary which having no codes.
As per his words:

the challenge is - "Write a portable executable (PE/EXE) file which can be spawned through a standard CreateProcess call and will result in STATUS_SUCCESS being returned as well as a valid Process Handle, but will not

• Contain any actual x86/x64 assembly code section (i.e.: the whole PE should be read-only, no +X section)
• Run a single instruction of what could be construed as x86 assembly code, which is part of the file itself (i.e.: random R/O data should not somehow be forced into being executed as machine code)
• Crash or make any sort of interactive/visible notice to the user, event log entry, or other error condition."

He did it. 

Check the solution here: http://www.alex-ionescu.com/?cat=2

Post by newWorld

Malicious App - Windseeker (Advanced Injection And Hooking Technique)

 Very recently, our friends in Lacoon mobile security discovered a malicious app which implements the advanced injection and hooking techniques. It rise the eye brows, because they try to make in the same way of malicious routines in the PC based malware for this mobile based malware.


Eavesdrop :

The main function of this windseeker is to eavesdrop on Chinese Instant Messenger (IM) chats. The targeted device is rooted android platforms.


Threats :

Reach of the instant chat in the hand held devices such as Android phones, are now in pinnacle. These threat actors now targeting these device users with instant chat.

Lacoon quoted as follows- 
"Windseeker runs on rooted Android devices and enables the remote monitoring of two popular Instant Messaging (IM) apps, developed by Tencent (one of the largest Chinese Internet service portals):

1. WeChat – A globally-used messaging apps boasting 100,000,000-500,000,000 downloads in the Google’s Play Store.
2.  QQ – Mainly a Chinese-regional messaging app boasting ~800,000,000 users (a total of all mobile platforms, not just Android).

While this tool is intended for use in China due to the intended targets as Chinese instant messaging apps (WeChat and QQ) and monitored chats being in Chinese, it’s important to understand that this type of threat could be implemented anywhere."

 How this windseeker works?                                                                                                     

Using the process monitor threads, it will identify the whether instant messenger is running or not. Then it will indulge in hooking activity by injecting the malicious codes in to the process. Then it starts to spy on the IM chats. An api is called by app, and that api is already hooked which results in the spying. This is the overall picture of this windseeker malicious activity.

All in the hands of the users to aware what they installed in the devices, otherwise their privacy at risk.

                                                                                                                                                       Regards,

newWorld