Eaten by a GRU: Fake ransomware created by Russian GRU Unit 29155 attacked Ukraine and NATO—a month before the full scale invasion.
The post Russian ‘WhisperGate’ Hacks: 5 More Indicted appeared first on Security Boulevard.
You can now test the security of persisted GraphQL Queries with Escape's platform. This new capability enhances our GraphQL API security testing
The post Product Updates: Persisted GraphQL Query Support appeared first on Security Boulevard.
Cryptography and digital certificates form the security backbone of modern digital enterprises. As organizations increasingly adopt multi-cloud strategies to leverage the best services from different cloud providers, they face significant challenges in managing digital certificates. Mismanaged certificates can lead to outages, security breaches, and compliance violations—issues that no organization can afford. This blog provides a […]
The post Navigating Certificate Lifecycle Management in Multi-Cloud Environments appeared first on Security Boulevard.
Reading Time: 3 min Configure BIMI for Zoho Mail and display your brand logo with a verified checkmark! Boost brand trust with Zoho BIMI.
The post BIMI Setup Guide for Zoho Mail – Getting the Blue Verified Checkmark appeared first on Security Boulevard.
NIST has released Version 2.0 of its widely used Cybersecurity Framework (CSF), a guidance document for mitigating cybersecurity risks. This update is not just a revision but a transformative approach to secure digital assets and infrastructures. The new version represents a significant advancement in addressing the evolving and complex cyber threats, offering a forward-looking perspective […]
The post NIST CSF 2.0 Cyber Security Framework appeared first on Kratikal Blogs.
The post NIST CSF 2.0 Cyber Security Framework appeared first on Security Boulevard.
The lifecycle of software inevitably draws to a close, leaving many organizations grappling with the challenges of upgrading legacy systems. For Linux users, particularly those reliant on CentOS 7 and CentOS Stream 8, the recent end-of-life (EOL) dates have presented a daunting dilemma. The end of support means no more security updates, patches, or official […]
The post Beyond End of Life: Securing Legacy Linux Systems Like CentOS 7 appeared first on TuxCare.
The post Beyond End of Life: Securing Legacy Linux Systems Like CentOS 7 appeared first on Security Boulevard.
A healthy approach to GenAI is one in which organizations build security protections from the start. Here are tips on how to integrate security into your organization's GenAI strategy from day zero.
The post Why and How to Secure GenAI Investments From Day Zero appeared first on Security Boulevard.
Zero-trust, rooted in the principle of "never trust, always verify," requires organizations to assume that every access request, whether internal or external, is potentially harmful.
The post Overcoming the Challenges of Zero-Trust appeared first on Security Boulevard.
The inherent limitations of signature-based approaches have often driven practitioners and vendors to shift toward behavioral methods.
The post Is Cloud Security Ready for a Pivot to Behavioral Detection & Response appeared first on Security Boulevard.
In light of recent cybercrime events, details pertaining to the Cisco zero-day flaw that has now been patched have emerged. As per the details, the flaw, if exploited, could allow threat actors to seize control of appliances and aid in evading detection. In the article, we’ll dive deep into the Cisco zero-day flaw and determine […]
The post Velvet Ant Exploits Cisco Zero-Day Flaw For System Control appeared first on TuxCare.
The post Velvet Ant Exploits Cisco Zero-Day Flaw For System Control appeared first on Security Boulevard.
The National Public Data breach has been a nightmare, exposing names, addresses, birthdates, emails, phone numbers, and Social Security Numbers of countless individuals — including mine.
As a California resident, I have the legal right to demand that they delete my personal data to prevent further exploitation. I simply don’t trust them ever having my data. However, my experience with their opt-out process has been incredibly frustrating and disheartening.
I tried to take action. First, I checked whether my data was part of the breach via their lookup page (https://npdbreach.com/). Unfortunately, I was indeed affected.
Next, I followed the instructions on their Opt-Out page (https://nationalpublicdata.com/optout.html). The automated call system repeatedly informed me that no one was available to take my call. It allowed me to leave a voicemail, but I have little faith that this will result in any action — especially considering the sheer scale of this breach, involving billions of exposed records.
Curiously, they also direct privacy requests to their Sales email account ([email protected]). Why is this critical issue routed through their sales department? It doesn’t inspire confidence that my data deletion request will be handled properly or even taken seriously.
I’ve left a voicemail and sent an email, covering all possible bases. Yet, I remain skeptical. My concern is that this difficult, convoluted process further disrespects the privacy rights of many citizens. My guess is that this friction for customers to request data deletion is purposeful and will become a serious liability for National Public Data.
Has anyone else successfully navigated this data-deletion process with this company? And does anyone know if there is a California class action lawsuit related to this breach?
We need to protect ourselves and hold organizations accountable for securing our personal information.
The post Frustration Trying to Opt-Out After the National Public Data Breach appeared first on Security Boulevard.
LoginRadius analyzed data from its Consumer IAM (CIAM) Platform, utilized by over 500 brands globally. The report offers a unique perspective on global consumer identity trends in 2024, delivering insights into consumer behavior regarding digital identities and providing a comprehensive analysis of their behavior patterns and lifecycle.
The post LoginRadius Releases 2024 Consumer Identity Report, Highlights the Shifting Trends in Consumer Preferences appeared first on Security Boulevard.
Axio Senior Cybersecurity Advisor, Richard Caralli’s recent article in Dark Reading, Why Are Organizations Losing the Ransomware Battle? examines the growing problem of ransomware attacks, emphasizing that many organizations are
Read MoreThe post Why Are Organizations Losing the Ransomware Battle? appeared first on Axio.
The post Why Are Organizations Losing the Ransomware Battle? appeared first on Security Boulevard.
Trackers are everywhere and come in many different forms. Some tracking methods are more invasive than others; this post aims to explain what "trackers" are, how they work, and give examples of the data they collect.
TABLE OF CONTENTS
Fingerprinting, tracking, and trackers go hand-in-hand. Generally, fingerprinting focuses on reliably identifying unique users - this identity is often then used by tracking mechanisms.
Fingerprinting uses the information found on/sent by your device to identify you and subsequently track you. Identification by unique properties such as browser settings, device information, and connected networks (to include nearest cell towers) are the building blocks of creating a unique user profile.
Fingerprinting takes into account your entire device and factors directly surrounding it - your browser, connected networks, the operating system (exact build and version), browser settings, browser add-ons/extensions, hardware of the device, and more. Fingerprinting is as invasive as it is accurate; for example, the EFF has estimated that only 1 in 286,777 browsers will share the same fingerprint. Naturally, some fingerprinting techniques are more invasive than others.
Fingerprinting has evolved so much so that it is next to impossible to simply "block all fingerprinting" techniques. In fact, it has been demonstrated that on some devices - such as smartphones - some fingerprinting attacks are not possible to block.
What are trackers?Trackers come in many forms. Generally, regardless of what form of tracking is used, trackers are designed to either 1) track you across different websites, web services, and web apps or 2) collect identifying information about you and your device(s). Frequently, they do both.
Many proponents of tracking say that it is beneficial for users because they can get personalized recommendations. While this is true, it comes at the price of the user's privacy; often times, users don't understand just what this privacy cost entails even if they are aware of it.
Though as we collectively learn of tracking (and fingerprinting) technologies/methods, what data they can capture, and just who that data is shared with - we should strongly consider: Is the price worth it?
Tracking pixelsTracking pixels (also known as web beacons or pixel tags) are 1x1 pixel-sized images typically embedded in web pages, ads, and emails. Though they are images and load like images, they're so small that they're invisible to the human eye.
Once loaded, tracking pixels capture data typically about user activity and engagement. For example, tracking pixels are almost ubiquitously used in emails - particularly, marketing emails - to track if and when a recipient opens an email; tracking pixels embedded in emails can report the exact date and time an email was opened, location of the device used to open the email, and in which email client the email was opened.
Source: IonosTracking pixels are also commonly found in advertisements. Tracking pixels embedded in advertisements are often called "ad trackers" - though this term could also include other tracking methods, such as tracking cookies; they can track views, clicks, referral sources, and conversions in displayed advertisements.
Some websites use tracking pixels as well. They're typically used in combination with analytics software and tracking cookies, though of course this varies immensely between websites. Some may even use multiple tracking pixels, of which are commonly JavaScript code provided by third parties (like the Meta Pixel).
Tracking pixels are versatile and depending on where they are embedded and the entities using them, they can collect many pieces of data such as (but not limited to):
A rather well-known and infamous tracking pixel is the Meta Pixel (formerly: Facebook Pixel). It is embedded on millions of websites and has shown to be ruthlessly efficient in collecting massive amounts of data - including sensitive data such as tax record information, veteran statuses, addresses, and even health information.
The Meta Pixel in recent times has been the subject of privacy litigation in 2022 and 2023 (and likely going forward), mostly due to it facilitating sensitive data and information sharing - especially where the data was not to be shared with third parties "by law" (think: violating HIPAA) without expressed consent from users.
Tracking CookiesCookies are bits of data that get stored on your web browser by websites. You've probably heard of first-party and third-party cookies; first-party cookies are placed by the website itself whereas third-party cookies are placed with a different entity that loads on that same website, such as ads served by an ad network.
Some cookies are essential for certain websites to function. Some websites have many cookies that retain many bits of differing information that could get annoying for users to continuously define on subsequent visits. For example, session cookies may be used to reauthenticate you to a website on a subsequent visit - you don't have to login again. Session cookies may also retain saved preferences (dark mode or light mode?) and other details between visits.
Source: CookieYesOf course, some cookies in your browser may also be tracking cookies. Note that tracking cookies don't do the active tracking themselves, but they store information websites interested in tracking your activity can retrieve and read later, often collecting personal information. Tracking cookies can be first-party or third-party, but are commonly third-party.
For collection by calling websites/hosts, tracking cookies can store:
Once upon a time, due to Safari and Firefox blocking third party cookies by default and laws such as the EU's GDPR coming into effect, third-party cookies were seemingly on their way out. Big Tech companies - such as Google and Microsoft - sought to kill the cookie and rolled out plans to do so. Specifically, the initiative to phase out tracking cookies was spearheaded by Google in anticipation of rolling out their Topics API/Privacy Sandbox (which was initially "FloC").
However, in July 2024, Google announced it was no longer...
The post An Introduction to Trackers and the Data They Collect appeared first on Security Boulevard.
Authors/Presenters:Zheng Li, Ning Yu, Ahmed Salem, Michael Backes, Mario Fritz, Yang Zhang
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – UnGANable: Defending Against GAN-based Face Manipulation appeared first on Security Boulevard.
When Google decided to stop trusting new TLS certificates from Entrust, it didn’t just create a technical challenge—it unleashed an operational crisis for many organizations. If your business uses Entrust TLS certificates, you are facing one of two realities right now. If you are using a certificate lifecycle management (CLM) platform that provides Certificate Authority […]
The post Managing Certificate Chaos After Google’s Entrust Distrust first appeared on Accutive Security.
The post Managing Certificate Chaos After Google’s Entrust Distrust appeared first on Security Boulevard.
via the comic & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Lava Lakes’ appeared first on Security Boulevard.
Post-Quantum Cryptography (PQC) is a new generation of encryption algorithms for protecting data against powerful quantum computers. Quantum computers use quantum mechanics to solve complex problems much faster than traditional computers. With rapid advancements in quantum computing, current encryption algorithms like RSA are at risk of being broken, which would take regular computers hundreds or […]
The post Understanding Quantum Threats and How to Secure Data with Post-Quantum Cryptography appeared first on Security Boulevard.
Customer trust is critical to long-term business success. But it is dramatically undermined when organizations fail to protect their personally identifiable information (PII). One study claims that two-thirds (66%) of US consumers would not trust a previously breached company with their data. And three-quarters (75%) say they’re ready to cut ties with a brand in the aftermath of a cybersecurity incident.
The post Hackers Want Your Customers’ Data: It’s Time to Hit Back appeared first on Security Boulevard.
IntroductionIn June 2024, Zscaler ThreatLabz detected fresh activity from BlindEagle, an advanced persistent threat (APT) actor also identified as AguilaCiega, APT-C-36, and APT-Q-98. BlindEagle predominantly focuses on organizations and individuals from the government and finance sector in South America, particularly in Colombia and Ecuador. BlindEagle’s primary method to gain initial access to the targets’ systems is through phishing emails. Once accessed, the threat actor usually employs commodity .NET Remote Access Trojans (RATs), like AsyncRAT, RemcosRAT, and more, to steal credentials from various banking service providers. BlindEagle is also known for operating repurposed or customized variants of commodity RATs like BlotchyQuasar, a variant of QuasarRAT.In this blog, we focus on BlindEagle’s use of the BlotchyQuasar RAT to target the Colombian insurance sector to steal payment-related data.Key TakeawaysBeginning in June 2024, BlindEagle was observed targeting the Colombian insurance sector.Attacks have originated with phishing emails impersonating the Colombian tax authority.BlindEagle has leveraged a version of BlotchyQuasar for attacks, which is heavily protected by several nested obfuscation layers.Zscaler ThreatLabz uncovered additional malicious domains that are likely used by this threat actor.Technical AnalysisOverviewA BlindEagle attack chain typically originates with a phishing email that contains a PDF attachment and a URL that points to a ZIP archive file. The PDF attachment contains the same URL as the one provided in the email body. In other words, the ZIP file can be either downloaded from the PDF or directly from the email.Upon clicking the URL (in either the email body or PDF), the victim downloads a ZIP archive from a Google Drive folder. This specific folder is under the ownership of a compromised account belonging to a regional government organization in Colombia. The ZIP archive contains a .NET BlotchyQuasar executable.The figure below provides for a high-level overview of the attack chain.Figure 1: A high-level overview of a BlindEagle attack chain, where the initial phishing email includes a download URL for a password-protected compressed archive and the final payload is a packed BlotchyQuasar sample.Phishing email as initial vectorIn the phishing email, the threat actor impersonated the Dirección de Impuestos y Aduanas Nacionales (DIAN), which is the Colombian National Tax and Customs Authority. The lure used by BlindEagle involved sending a notification to the victim, claiming to be a seizure order due to outstanding tax payments. This is intended to create a sense of urgency and pressure the victim into taking immediate action. Our observations indicate that a substantial number of the targeted individuals are employees within the Colombian insurance industry.The figure below shows the phishing email, which includes the PDF and download URL, spoofing the Colombian tax authority. Figure 2: Example BlindEagle phishing email spoofing DIAN with a PDF attachment and malicious link in the email body.The download URL directs the victim to a password-protected ZIP archive. The password necessary to open the archive is provided within the email body. This ZIP archive is hosted on a Google Drive folder, which is associated with a compromised Gmail account owned by a government organization with a ".gov.co" top-level domain. Based on analysis of the phishing email's metadata, the threat actor likely sent the emails from their own infrastructure. Specifically, the first header received in the email indicates that the message originated from the IP address 69.167.8.118, which is associated with Powerhouse Management VPN. Powerhouse Management is a VPN service known to be utilized by BlindEagle to obfuscate the true source of their malicious activities and acquire IP addresses that are geographically close to their intended targets.BlotchyQuasarBlotchyQuasar is a powerful RAT that possesses a wide range of capabilities. It can log keystrokes, execute shell commands, and perform various other functions. Since BlotchyQuasar is a variant of QuasarRAT, we will not delve into a detailed analysis of its functionalities. Instead, in the following sections, we will concentrate on specific aspects that have not been extensively covered in previous publications.LoaderAs shown in the figure below, BlotchyQuasar is concealed within multiple layers of protection. Each layer consists of a .NET executable that has been safeguarded using either commercial or open-source obfuscators like DeepSea or ConfuserEx. These obfuscators are employed to make the code more complex and challenging to analyze, hindering reverse engineering attempts.Figure 3: Nested structure of the BlotchyQuasar sample.Layer 1 is the outer executable file that is contained within the ZIP archive. It decrypts the Layer 2 data that is contained in a resource named vh by utilizing a custom XOR-based algorithm. Layer 2 consists of a DLL with the name SimpleLogin.dll. When executed, SimpleLogin.dll loads and extracts the contents of a GZip-compressed resource named key0. Within this resource lies another DLL, Gamma.dll, which provides a utility for converting integers to Unicode characters. This utility is used to compose the name of a resource within Layer 1, which is subsequently loaded by SimpleLogin.dll. This resource is named HSOm and is stored as a bitmap image that undergoes a transformation process. This transformation involves discarding the last 150 rows and the last 150 columns of the image. Additionally, the row and column pixel coordinates are inverted. The figure below shows the bitmap when rendered.Figure 4: The resource HSOm rendered as a bitmap containing the Layer 3 data.By extracting the ARGB coordinates from each pixel, another DLL named Tyrone.dll is obtained. This DLL represents Layer 3, which decrypts the final payload by loading a resource named SIxfc1 and applying a custom XOR-based algorithm. This produces an executable file named Client.exe, which is a BlotchyQuasar malware sample.Obtaining the C2The installation steps completed by BlotchyQuasar are discussed in a previous publication. In the sample we analyzed, we observed a similar process. However, the procedure employed to obtain the command-and-control (C2) domain has not been previously analyzed.When BlotchyQuasar is executed, the C2 server location is retrieved from Pastebin. The specific URL used to fetch the paste is hXXps://pastebin[.]com/raw/XAfmb6xp. The content of the paste is an encrypted string, as shown in the example below. (The relevant part is highlighted in bold and separated by the two “¡” symbols.)GNNwsubynrt5oCZ+pAP97K9Sizq1eRn8XQQ8yxktdrbYQL263pZf+aQwkap8YEa09tg1w69qsZYEwGWF482CW3WBNKOJESQBz8IXYNzbbf+jrHUcNUEjV0lhaeAINnCtkqrp2l8esXBEB4rFHUqROAAwi¡CllIOSeGR/pSE1OqzWOtN5zIKVp5TOLPJ1rBUGNg5fA=¡GViPOxT6+nDuUYPCfRyIL0TFRvVOl4JGV9SCkyJUZQo06AvBlwsvaGwpLuv2q6UltL3e0awC1mmp0Cpfg7hAAmY4RpG+qIBxOYnqhLSbyuOAaWlMH4PxrqJ6p35T6Xg2+Z8esryidjlXGJVTWLISvofA2+vX4747n1lVUv4030D6Ds6NyAPHk9mRoDDsqRtW9g+xR0r479umTn8nb7wBCx5tOw2zqnWxpdGkyOrDIEcvb+cHDrA0geAclmePsRIi4CYe3ka41EMQMscoQ+2iUa43AMThis encrypted string is divided into three parts, with the symbol "¡" serving as a separator. Of particular interest is the middle part, enclosed by the separators (i.e., CllIOSeGR/pSE1OqzWOtN5zIKVp5TOLPJ1rBUGNg5fA=).This string is Base64 decoded and decrypted using standard 3DES encryption in ECB mode with PKCS7 padding. The 3DES key used is derived from the MD5 hash of the string qualityinfosolutions. In the provided example, the resulting C2 domain is edificiobaldeares.linkpc[.]net. The C2 communication for this sample leveraged the hardcoded port 9057.Monitoring the consumption of banking & payment servicesBlotchyQuasar implements a multitude of features, including the ability to monitor a victim's interactions with specific banking and payment services. In order to identify such events, the malware examines the title of each newly opened window. If the window title contains certain predefined strings associated with the targeted services, BlotchyQuasar logs a reference to indicate the occurrence of the interaction.The figure below shows an example log collected with references to several banking and payment services. In the example provided, websites for Banco Coomeva, Banco of Machala, and PayPal services were accessed. The log, in this case, is a simple XML document that contains all the references within elements labeled as NameCliente. This log file, named settings.xml, is stored on the disk within the startup folder of the compromised system.Figure 5: Example BlotchyQuasar log containing references to the victim’s interaction with specific banking and payment service providers.The table below lists the organizations that BlotchyQuasar targets. Since the list mainly includes Colombian and Ecuadorian banks, the malware was most likely designed to target individuals in those countries.OrganizationLocationBBVAGlobalBanco AV VillasColombiaBanco BolivarianoEcuadorBanco Caja SocialColombiaBanco CoomevaColombiaBanco DavivendaColombiaBanco GuayaquilEcuadorBanco InternacionalEcuadorBanco PichinchaEcuadorBanco Popular ColombiaColombiaBanco de BogotáColombiaBanco de MachalaEcuadorBanco de la ProducciónEcuadorBanco del AustroEcuadorBanco del PacificoEcuadorBancolombiaColombiaPayPalGlobalScotiabank ColpatriaColombiaTransUnionGlobalTable 1: List of banking and payment service providers targeted by BlotchyQuasar.KeyloggingBlotchyQuasar provides keylogging functionality, with the keylogging module set to flush logs every 15 seconds. These logs are stored in the %APPDATA%\GPrets directory with the filename format MM-dd-yyyy (e.g., 06-18-2024). The log file is structured according to the figure below, which details the captured keylogging data.Figure 6: Structure of a BlotchyQuasar key log.The initial 32 bytes of the encrypted log file comprise an HMAC SHA256 hash of the remaining content that is used as an integrity check. The subsequent 16 bytes store an AES initialization vector (IV) that is randomly generated per file. The AES key is hardcoded within the malware's configuration class. In the sample analyzed by ThreatLabz, the AES key was represented by the Base64-encoded string 1WvgEMPjdwfqIMeM9MclyQ==. BlotchyQuasar uses AES in CBC mode (Cipher Block Chaining) with PKCS7 padding. The remaining portion of the file following the IV encompasses the encrypted log data itself. A Python implementation of the BlotchyQuasar keylogging decryption routine is shown in the code sample below.from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
def decrypt(log: bytes, key: bytes) -> bytes:
encrypted_payload = log[48:]
iv = log[32:48]
cypher = AES.new(
key,
AES.MODE_CBC,
iv
)
decrypted_payload = cypher.decrypt(encrypted_payload)
block_size = cypher.block_size
decrypted_payload = unpad(decrypted_payload, block_size, "pkcs7")
return decrypted_payloadAs illustrated in the figure below, the decrypted logs are stored in HTML format.Figure 7: Example decrypted key log data created by BlotchyQuasar.Stealing capabilitiesBlotchyQuasar targets the browser and FTP client applications shown in the table below. ApplicationTypeTargeted DataChromeBrowserSaved passwords CookiesChromiumBrowserSaved passwordsCookiesInternet ExplorerBrowserURL historyFirefoxBrowserSaved passwordsCookiesOperaBrowserSaved passwordsCookiesYandexBrowserSaved passwordsCookiesFileZillaFTP clientSaved passwordsWinSCPFTP clientSaved passwordsTable 2: Applications targeted by BlotchyQuasar for information-stealing purposes.InfrastructureBlotchyQuasar accesses Pastebin to retrieve the current C2 domain. The structure of the Pastebin content and the decryption procedure is unique, which enabled us to identify additional pastes consumed by BlotchyQuasar samples. By successfully decrypting these pastes, we uncovered three more C2 domains:equipo.linkpc[.]netperfect5.publicvm[.]comperfect8.publicvm[.]comAll those domains share a few characteristics:First, these domains are extensions of second-level domains (SLDs) associated with Dynamic DNS service providers. Second, they exhibit a consistent pattern in their resolution history. Specifically, they predominantly resolve to IP addresses that belong to two primary sets. The first set comprises nodes associated with specific VPN services, namely Powerhouse Management, PrivateVPN, and ParadiseNetworks.The second set comprises IP addresses associated with specific Colombian internet service providers (ISPs), namely Colombia Movil, Telmex Colombia, and Tigo. These IP addresses are likely indicative of compromised routers. This information aligns with publicly disclosed findings about the infrastructure under the control of the BlindEagle threat actor.By shifting our focus towards resolving IP addresses, we gained further insights into the infrastructure underpinning operations similar to the one described in this blog. We discovered additional domains that exhibited similar characteristics. While we lack sufficient information to definitively establish that these domains are controlled by the same threat actor, they continue to pose threats to individuals and organizations. Notably, these domains have been utilized, and may still be in use, as C2 servers for various commodity malware families, including njRAT, QuasarRAT, RevengeRAT, and others. It is crucial to remain vigilant as these domains could potentially be employed for malicious activities in the future.As an example, the table below displays the date of first submission on VirusTotal of various QuasarRAT samples communicating with the domain edificiobaldeares.linkpc[.]net. This domain has been utilized as a C2 server since July 2022 and active until March 2024. Since a similar pattern repeats in other domains, we strongly recommend blocking them.First Submission DateMD5Malware Family18-07-2022a73057824a65a5ac982e298a80febf61QuasarRAT21-07-2022bd4505316254f00329431fb8b2888643QuasarRAT22-07-2022d2fc372302180fbabe18c425aa4a0a72QuasarRAT22-07-2022c944cb638364c74431bf1dbe7dd329ffQuasarRAT24-07-202264e6ad512eff12e971efdd8979086c5cQuasarRAT26-07-2022a1f5091ad4e12f922a8e760e0980ab66QuasarRAT29-07-2022ad578125b337168c976ff5e7e1b190b8QuasarRAT01-08-2022e21b4c9d9da81deea2381f9b988b0f99QuasarRAT04-08-202207f661aeeb0774f0cb84b0a5e970c2a5QuasarRAT09-08-2022c4a946903cc9e9a84763ac1731cdd7ddQuasarRAT11-08-202275a40cc019c39e3c2800fb2fe5aba1d3QuasarRAT12-08-20220fa40788b75896a452398b6a49cc62b6QuasarRAT15-08-202259a4f7aed1e3a0718592fb536e987a1dQuasarRAT16-08-2022456211df625002df378cf0f4af9d1a6fQuasarRAT17-08-20220f35306ad4fede9a9ba0276a5e788138QuasarRAT19-08-20226044b126afb86682b4a3440e2924c079QuasarRAT19-08-2022b432e8ff5797fbaf5808d95d46524647QuasarRAT20-08-2022a31ff54f33ced7b4180f87afb18185a7QuasarRAT20-08-2022e3239ac16c6fe9c99d6fac0867121a88QuasarRAT07-07-20232784a9fc64d244b14e7d8e4d03f41265QuasarRAT06-03-20243125ae6b1462b0b48dc06bc47d8ddbc7QuasarRATTable 3: The most recent recorded interactions between various QuasarRAT malware samples and the domain edificiobaldeares.linkpc[.]net.AttributionWe attribute this attack to the threat actor known as BlindEagle with medium to high confidence. Our attribution claim is supported by the following:Spoofing DIAN in the phishing email and using a tax-related lure are both documented characteristics of BlindEagle.BlindEagle is recognized for employing customized or repurposed variants of commodity or open-source malware as their final payload, as mentioned here and here. In this particular case, they utilized BlotchyQuasar, which is a variant of QuasarRAT, an RAT.The extensive usage of Dynamic DNS (DDNS) services to host the C2 domain is another common strategy employed by BlindEagle throughout their operations, as indicated in past documented cases. In this attack, the threat actor utilized linkpc as a DDNS provider, which aligns with their previous choices.BlindEagle typically shields its infrastructure behind a combination of VPN nodes and compromised routers, primarily located in Colombia. This attack demonstrates the continued use of this strategy, with the C2 domains resolving to IP addresses associated with known providers frequently adopted by the threat actor, such as the Powerhouse Management VPN service, which is also used to acquire IP addresses geographically close to the targets. Additionally, the C2 domains sometimes resolve to IP addresses belonging to Colombian ISPs (e.g., Colombia Movil, Telmex, or Trigo), suggesting the involvement of compromised routers.The victims targeted in this attack align with the victimology profile previously established for BlindEagle. The known targets were Colombian individuals employed in organizations operating within the Colombian insurance industry. This nationality and vertical are consistently targeted by the threat actor.ConclusionAs part of our monitoring and research efforts, ThreatLabz discovered a BlindEagle campaign targeting the Colombian insurance sector. The threat actor employed phishing emails that impersonated DIAN (a Colombian tax collection agency) to gain initial access to the victims' systems. These emails contained links and passwords to download and open compressed archive files hosted on compromised Google Drive folders. The contents of these archives were instances of the BlotchyQuasar RAT, which grants the threat actor a wide range of capabilities, including keylogging, monitoring of bank services, and stealing information from various applications.Zscaler ThreatLabz anticipates that BlindEagle will continue launching malware campaigns in the future. We remain vigilant in monitoring the activity of this threat actor to ensure our customers are well-protected against this threat.Zscaler CoverageFigure 8: Zscaler sandbox report for the BlotchyQuasar sample.In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to BlindEagle at various levels with the following threat names:Win32.Trojan.BlindEagleHTML.Malurl.Gen.LZHTML.Malurl.Gen.NCHTML.Malurl.Gen.TTHTML.Phish.Gen.LZWin32.Backdoor.Asyncrat.BSWin32.Backdoor.Bladabindi.LZWin32.Backdoor.Dcrat.BSWin32.Backdoor.Nanocore.BSWin32.Backdoor.Njrat.BSWin32.Backdoor.Quasarrat.LZWin32.Backdoor.Remcosrat.BSWin32.Backdoor.Smokeloader.BSWin32.Trojan.AgentIndicators Of Compromise (IOCs)IndicatorDescriptionb83f6c57aa04dab955fadcef6e1f4139MD5 hash of the BlotchyQuasar sample.a68cac786b47575a0d747282ace9a4c75e73504dSHA1 hash of the BlotchyQuasar sample.ec2dd6753e42f0e0b173a98f074aa41d2640390c163ae77999eb6c10ff7e2ebdSHA256 hash of the BlotchyQuasar sample.hXXps://pastebin[.]com/raw/XAfmb6xpPaste containing the encrypted C2 domain of BlotchyQuasar.edificiobaldeares.linkpc[.]netBlotchyQuasar C2 domain for the analyzed sample.equipo.linkpc[.]netAdditional BlotchyQuasar C2 domain.perfect5.publicvm[.]comAdditional BlotchyQuasar C2 domain.perfect8.publicvm[.]comAdditional BlotchyQuasar C2 domain.In addition to those indicators, we added malicious domains likely belonging to the threat actor to our GitHub repository. MITRE ATT&CK ProfileIDTechniqueAnnotationT1583.001Acquire Infrastructure: DomainsBlindEagle uses DDNS services to create third level domains. Those domains serve as C2.T1586.002Compromise Accounts: Email AccountsBlindEagle controlled a Google Drive folder owned by a Colombian, regional, administration organization.T1587.001Develop Capabilities: MalwareBlindEagle is operating BlotchyQuasar, which may be considered a customized variant of QuasarRAT.T1608.001Stage Capabilities: Upload MalwareBlindEagle staged a BlotchyQuasar sample on a compromised and publicly available Google Drive folder.T1566.002Phishing: Spearphishing LinkBlindEagle attempted to gain initial access to the victim’s system by using a phishing email including a link to download BlotchyQuasar malware.T1204.002User Execution: Malicious FileBlindEagle renamed the BlotchyQuasar sample to be consistent with the phishing email lure and push the victim to manually execute the malware.T1204.001User Execution: Malicious LinkBlindEagle’s attack chain starts with the victim clicking on a link included in the email body and in the attached PDF file. T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderBlotchyQuasar achieves persistence by setting a RunKey.T1053.005Scheduled Task/Job: Scheduled TaskBlotchyQuasar creates a scheduled task that launches itself every 3 minutes.T1562.001Impair Defenses: Disable or Modify ToolsIf executed with elevated privileges, BlotchyQuasar attempts to disable several Defender features.T1564.001Hide Artifacts: Hidden Files and DirectoriesBlotchyQuasar creates hidden directories to store keylogger files.T1027.003Obfuscated Files or Information: SteganographyOne of the protection layers included in the BlotchyQuasar loader is decrypted starting from a Bitmap image included as a .NET-managed resource.T1027.009Obfuscated Files or Information: Embedded PayloadsBlotchyQuasar malware is buried under three layers of encrypted code. Those nested code layers are embedded as .NET-managed resources and decrypted with custom XOR-based algorithms.T1027.013Obfuscated Files or Information: Encrypted/Encoded FileBlotchyQuasar stores the keylogger logs after encrypting them with AES.T1553.005Subvert Trust Controls: Mark-of-the-Web BypassBlotchyQuasar deletes the Zone.Identifier ADS (mark-of-the-web) from the original executable to bypass the MOTW.T1027.002Obfuscated Files or Information: Software PackingSome of the protection layers of the BlotchyQuasar loader are obfuscated with .NET obfuscators, such as DeepSea or ConfuserEx.T1140Deobfuscate/Decode Files or InformationThe BlotchyQuasar C2 domain is decrypted with AES.T1056.001Input Capture: KeyloggingBlotchyQuasar is capable of logging keystrokes.T1539Steal Web Session CookieBlotchyQuasar is capable of stealing cookies and passwords from popular browsers and FTP clients.T1056.002Video CaptureBlotchyQuasar is capable of controlling the webcams of the infected system.T1095Non-Application Layer ProtocolBlotchyQuasar establishes a socket-based C2 channel.T1041Exfiltration Over C2 ChannelBlotchyQuasar is capable of exfiltrating stolen information (keylogs, video recordings, and more) over the C2 channel.T1490Inhibit System RecoveryIf executed with high privileges, BlotchyQuasar deletes the shadow copies with the vssadmin utility.
The post BlindEagle Targets Colombian Insurance Sector with BlotchyQuasar appeared first on Security Boulevard.
