mrmoor/cyber-threat-intelligence huggingface dataset:
DDoS Attacks Impacting Ukrainian Government and Banking Institutions HermeticWiper Malware Website Defacement Rise in Phishing and Scam Attacks Increase in Cybersquatting Trends Fake Donation Websites DoS Attacks on Ukrainian News Sites Distribution of Apps How Palo Alto Networks Is Working to Keep You Safe How You Should Prepare for an Increase in Cyberthreats Such as Wipers, DDoS, Website Defacement and Other Related Attacks How Unit 42 Threat Intelligence and Security Consulting Can Help Additional Cybersecurity Resources Indicators of Compromise
Appendix A: Cortex Xpanse: Identifying Assets That May Be Impacted by CISA’s Known Exploited Vulnerabilities
On Feb. 15, the Cyberpolice of Ukraine reported that residents were actively receiving fake SMS text messages.
These messages were likely intended to cause alarm among the population, as they claimed that ATMs were malfunctioning.
Shortly after the text messages were observed, several DDoS attacks occurred.
These attacks impacted Ukrainian government organizations including the Ministry of Defense, Ministry of Foreign Affairs, Armed Forces of Ukraine and the publicly funded broadcaster Ukrainian Radio.
Additionally, the attacks targeted two banking institutions, PrivatBank and Oschadbank.
An initial investigation into the DDoS attacks suggested that Mirai and Meris bot networks may have been leveraged in the attacks.
On Feb. 18, both the United States and the United Kingdom attributed these DDoS attacks to Russia’s Main Intelligence Directorate (GRU).  Over the past week, Ukraine has continued to observe a relatively constant flow of DDoS attacks targeting its government and financial institutions.
However, at this time, attribution for the ongoing attacks has not been established.
The Ukrainian CERT did identify a post on RaidForums from a user named “Carzita” that suggested that additional actors may also be launching DDoS and defacement attacks for undisclosed reasons.
On Feb. 23, a malicious file named conhosts._exe (SHA256: 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591) was uploaded to a public malware repository from an organization in Kyiv, Ukraine.
This executable is a signed file with a valid signature from an organization named Hermetica Digital Ltd. This signing certificate has since been explicitly revoked by its issuer.
Upon execution, this file enumerates all files on a hard drive, wipes the partition info and then forces a system reboot, which predictably results in the following screen:
Further analysis has confirmed that the malware accepts command-line arguments allowing an attacker to instruct the malware to sleep for a period of time or to shut down the system.
Additionally the kernel module responsible for the actual wiping activity is from a legitimate application called EaseUS Partition Master.
This software is designed as free partition software that can reorganize disk space for better performance.
In tracking this threat, early reports show that the malware has been deployed against a financial institution in Ukraine as well as two contractors in Latvia and Lithuania that provide services to the Ukrainian Government.
Additionally, ESET researchers have warned that they found this malware installed across “hundreds of machines” in Ukraine.
Concurrent with the discovery of wiper malware, we also witnessed a second round of website defacements on Feb. 23.
These attacks appear to have copied the messaging template observed in attacks exploiting the OctoberCMS vulnerability a month earlier on Jan.14, while adding a .onion web address and a message in red font that translates to, “Do you need proof, see the link at the end.”
The .onion site links to an entity calling themselves “Free Civilian” and offering to sell databases containing the personal data of Ukrainian citizens.
Over the past 24 hours, the list of entities on the leaks section has expanded to 48 gov.ua domains and one Ukranian company (motorsich[.]com) that builds engines for airplanes and helicopters.
Our team analyzed the larger trends regarding Ukraine-related phishing and scam URLs detected by Advanced URL Filtering.
We noticed an overall increase in the detection of websites that host phishing and scam URLs on domains using Ukraine-related TLDs such as gov.ua and com.ua, or containing popular Ukraine-related keywords such as "ukraine" and "ukrainian".
This trend correlates with an increase in Google searches for terms like "Ukraine aid."
From January to late February, it appears that the number of Ukraine-related phishing and scam sites largely followed a similar trend as Ukraine-related internet searches; however, the number of phishing and scam sites has continued to rise through mid-late March as the situation remains ongoing.
Figure 8 shows that the number of Ukraine-related phishing/scam sites is currently continuing to rise about a month after the “Ukraine aid” search term started trending in Google search.
Among these phishing and scam URLs, we found a targeted phishing attack.
On March 16 while ingesting a third-party data feed, our in-house machine learning models detected a phishing webpage targeting a Ukrainian state administration employee.
The webpage is imitating a popular cloud file storage site.
Upon visiting the webpage, the “Username” field is pre-
populated with the targeted employee’s email address, and the user is then prompted to enter in their password in order to view a sensitive document as shown in Figure 9.
Figure 9. hxxps://startrackzm[.]com/wap-admin/ONE-DRIVE/one%20d%20%20no%20auto.php?Email=REDACTED@REDACTED.gov.ua.
A phishing webpage targeting a Ukrainian state administration employee, detected by our in-house machine learning models on March 16.Our teams at Palo Alto Networks are actively monitoring the phishing landscape surrounding Ukraine-related URLs and are sharing this threat intelligence with relevant authorities in Ukraine and internationally.
We are also sharing a list of IoCs that were detected as phishing and scam URLs.
Palo Alto Networks customers who subscribe to Advanced URL Filtering are already protected from these IoCs.
We monitored a list of 50 legitimate Ukraine-related domains (e.g., popular news and donation websites) and keywords (e.g., Ukraine, refugee) as targets for cybersquatting.
We detected 11,637 cybersquatting newly registered domains (NRDs) during February and March.
In particular, we noticed a sharp increase in the number of cybersquatting domains that were registered close to Feb. 24, as shown in Figure 10 below.
We manually analyzed a sample set of these cybersquatting domains.
Below we share some interesting case studies.
A detailed analysis of these domains revealed that many of them are fake.
These donation websites provide little to no information about the associated organization and distribution of funds.
Many of these websites use cryptocurrency wallets (e.g., BTC, ETH) to accept payment (likely because these wallets are easy to set up and require no verification).  We also find that some websites are mimicking popular donation websites or organizations to trick users into paying them money.
We show some examples in Figure 11.
For instance, donatetoukraine[.]com is pretending to be associated with the popular Come Back Alive campaign.
While the banking information shared on the donation website matches the original campaign website, we confirmed that the BTC wallet address is different from the actual.
We found a cybersquatting domain – save-russia[.]today – that is launching DoS attacks on Ukrainian news sites.
Once a user opens the website in the browser, it starts making requests to various Ukrainian news sites and lists the number of requests made to each new site on the home page, as shown in Figure 12 below.
Figure 12.
A cybersquatting domain save-russia[.]today is launching DoS attacks on Ukrainian news sites.
We strongly recommend that users be alert to the possibility of cybersquatting domains.
In particular, fake donation websites mimicking popular websites can be misleading, as described earlier.
Before donating money, we recommend checking whether the website is referenced and shared by the official charity or government organization.
Our teams at Palo Alto Networks will continue monitoring domain squatting attacks and work to protect customers against them.
We detected campaigns of fake downloads where threat actors have set up web pages to host malicious binaries.
Most of these web pages show malicious binaries as popular browsers or communication apps in order to deceive users.
For example, we detected a website that was distributing a malicious binary by masquerading as a popular global communication app targeting users in Ukraine.
Note that Palo Alto Networks customers receive protections against such domains from the Next-Generation Firewall via Advanced URL Filtering, DNS Security and WildFire URL Analysis subscriptions.
We also found that these fake download campaigns rotate domains to distribute the same malicious binaries.
For example, we detected two domains distributing the same malicious binary where one domain was impersonating a popular, widely used video conferencing application and the other a widely used internet browser.
Our teams at Palo Alto Networks will continue to monitor and work to protect our customers against such attacks.
Consistent with our previous reporting on the situation, Unit 42 continues to lead a company-wide effort to collect, evaluate and disseminate the latest intelligence on cyber activity related to Russia and Ukraine.
We are actively collaborating with our partners in industry and governments to share our analysis and findings based on our global threat telemetry network.
These efforts have enabled us to make near-daily updates to our platform to ensure our customers have the best protection possible.
This includes blocking hundreds of domain names, IP addresses and URLs for our customers related to newly discovered attacks.
We’ve updated and added signatures to the WildFire analysis and Cortex XDR Prevent and Pro products to block newly discovered vulnerabilities and malware including HermeticWiper.
Read more about Cortex XDR protections.
Our Threat Prevention and Web Application and API Security products added coverage for the OctoberCMS vulnerability exploited in the WhisperGate attacks, and we released an XSOAR Playbook to help organizations hunt for this threat.
Cortex Xpanse can assist with understanding and managing your organization’s attack surface as well as identifying vulnerable resources.
We have released public reports on the WhisperGate attacks and the infrastructure and tactics used by the Gamaredon group.
On the Unit 42 website, you will also find a free ATOM which contains a structured mapping of the Gamaredon group’s tactics aligned to MITRE’s ATT&CK framework.
As the situation continues to develop, we’ll continue to update our blog with the latest information.
There is no single action you can take to protect your organization against this threat.
Unlike a new malware family or vulnerability in the wild, the attacks we expect could come in many forms.
Several western governments have proposed broad recommendations focused on technical hygiene.
We consider these appropriate given the variety of tactics that Russian actors have used in the past.
We recommend organizations prioritize actions in the following four areas:  There is no way to know for certain what shape an attack may take, but taking these steps will help provide broad protection against what we expect to come.
Unit 42, the threat intelligence and security consulting arm of Palo Alto Networks, has a team of experts who can help your organization assess and test your security controls with proactive assessments and incident simulation services.
Because of the likelihood of ransomware attacks – or destructive attacks that pose as ransomware – it may be beneficial to focus on preparing in this area, particularly ensuring backup and recovery plans are in place.
We have distilled the knowledge we’ve gained from responding to hundreds of ransomware incidents into our Ransomware Readiness Assessment offering, which is designed to help organizations strengthen their processes and technology to mitigate threats like the ones we expect in the coming days and weeks.
If you think you may have been compromised by wiper attacks, Gamaredon, DDoS attacks or other cyber activity related to Russia-Ukraine, or have an urgent matter, get in touch with the Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200.
Threat Brief: Ongoing Russia and Ukraine Cyber Conflict (Jan. 20) Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated Feb. 16)
Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot Threat Briefing: Protecting Against Russia-Ukraine Cyber Activity Palo Alto Networks Resource Page: Protect Against Russia-Ukraine Cyber Activity Cortex XDR Protections Against Malware Associated with Ukraine and Russia Cyber Activity
CISA: Shields Up Technical Guidance  1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e 3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767 2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf 06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397 Name
Hermetica Digital Ltd Thumbprint 1AE7556DFACD47D9EFBE79BE974661A5A6D6D923 Serial Number 0C 48 73 28 73 AC 8C CE BA F8 F0 E1 E8 32 9C EC
gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id[.]onion
Please see the IoCs on GitHub.
In Alert AA22-011A (updated March 1, 2022), the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (DHS/CISA) identifies a selection of vulnerabilities that Russian advanced persistent threat (APT) groups are assessed to have exploited in the past, but recommends that users take action against a much broader list of known exploited vulnerabilities (KEVs).
The cited KEVs and their impacted devices – all of which can be identified using Cortex Xpanse – are:   Cortex Xpanse’s ability to index the entire internet helps organizations discover, prioritize, and remediate significant exposures on their attack surfaces – including all of the impacted services listed above.
We routinely observe vulnerable devices across the global internet, despite the fact that most of these CVEs are more than two years old.
Beyond Alert AA22-011A, CISA’s overarching guidance for attack surface reduction includes hardening of forward-facing network services, with prioritized patching of KEVs, as documented in Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (KEV).
This directive requires agencies to remediate all vulnerabilities that CISA includes in their KEV catalog based on an assessment that the vulnerabilities “carry significant risk to the federal enterprise.”
Learn more and see a detailed workflow example on the Palo Alto Networks SecOps blog, “How Xpanse Can Identify CISA-Identified Known Exploited Vulnerabilities.”
Updated April 1, 2022, at 11 a.m. PT.
Recent events continue to highlight the abuse of remote access applications in the enterprise.
Last Tuesday, Trusteer reported that a new variant of Citadel, which has long relied on VNC to give attackers remote control over systems, began adding new credentials to systems it infects and enabling the standard Windows remote desktop application (RDP).
This allows the attacker to maintain control over the system even after the Citadel infection is removed.
As the report indicates, using RDP this way also allows the attackers to “fly under the radar” as RDP is commonly used by administrators and often not treated as a threat.
Later that same week, US-CERT released alert TA14-212A on the Backoff Point of Sale (PoS) malware, which describes how malicious actors used publicly available tools to identify organizations that use remote access applications in an unsafe way.
This reconnaissance was then leveraged in brute force attacks against credentials, toward unauthorized access, implant installation, and subsequent exfiltration of consumer payment data.
As with any tool, remote access applications can be used for good or malicious intent.
It would be inefficient for an administrator to travel to a physical office to make a change on a system, but its critical that organizations take control over these applications.
The first step is identifying them in your network.
Palo Alto Networks currently tracks 90 different remote-access applications in Applipedia.
Examples include Remote Desktop Protocol (RDP), Virtual Network Connection (VNC), TeamViewer, and even Secure Shell (SSH), to name a few.
Once you can identify the traffic, you need to separate the good from the bad.
If your company runs Windows and relies on RDP, you can close off VNC, TeamViewer and the other 87 applications because you don’t need them.
If your administrators and help desk are the only ones who need RDP access to your systems, disable RDP for the rest of your users.
The key is putting a policy in place and making sure your technology is enforcing that policy at the network layer.
The Backoff and Citadel reports from last week highlight how uncontrolled remote access broadens your attack surface and acts as a backdoor for attackers already in your network.
Remote-access abuse is not a new problem.
We’ve been highlighting the importance of controlling this threat since 2009, but five years later it remains an issue for many organizations.
The latest development in the ransomware world is CryptoWall 2.0, a new version of this malware family that uses the Tor network for command and control.
F-Secure was the first to spot this new version on October 1, but since then the attacks have ramped up and new variants of the malware are emerging daily.
Our WildFire analysis platform has picked up 84 CryptoWall 2.0 variants since September 30, delivered primarily through e-mail attachments but also through malicious PDFs and web exploit kits.
CryptoWall 2.0 is similar to other ransomware attacks that have plagued users and businesses for nearly a decade.
Once it is running on a system, CryptoWall 2.0 seeks out document files and encrypts them using the RSA encryption algorithm.
The attacker holds the key necessary to decrypt the files unless the victim agrees to pay a $500 ransom.  Unlike previous versions of CryptoWall, 2.0 communicates with its command and control (C2) server through the Tor anonymization network.
This allows attackers to hide their communications and avoid having their C2 servers shut down, but also makes it easy for organizations to block the threat.
CryptoWall isn’t the only threat that communicates over Tor and if your network doesn’t have an explicit reason to allow anonymization networks, you should consider blocking the application altogether with your firewall.
If your system has already been infected with CryptoWall 2.0, you’ll see a pop-up just like this one shortly after the malware has encrypted your documents.
Note that the attacker has given you a few options for how to pay them the ransom.
The green box contains four links that will work only for your system.
These use four domains registered just today:
All of the domains currently resolve to 151.248.115.146, a Russian IP address and have WhoIs records associated with the e-mail address “ladomfichisi1987@mail.ru”.
This is the same address used to register two other payment domains registered earlier this month:
If these domains are confiscated or otherwise shut down, CryptoWall instructs the user to download the Tor Browser and access a website (paytordmbdekmizq.onion) that is only accessible over the Tor network.  Unlikely some of it’s more flexible competition, CryptoWall only accepts ransom in the form of BitCoin.
To pay the ransom the user will need to acquire 1.33 BitCoins and transfer them to a specific BitCoin wallet that is associated with their specific infection.
History has shown that paying the ransom will likely allow you to retrieve your files, but the best defense against ransomware is having up-to-date back-ups or by preventing the infection all-together.
Since we detected the first CryptoWall 2.0 variant with our WildFire engine on September 29, we’ve seen over 85,000 separate attacks attempting to deliver the malware.
The majority of these have come through e-mails with executable attachments, sometimes contained in .zip files.
Most of the e-mail attacks used fake invoice, fax and voicemail themes with attachments named like the following:
In the last week we’ve seen the attack vectors evolve to contain exploit kits as well.
On October 19, the Kafeine posted a blog discussing the inclusion of CVE-2014-0556 in the Nuclear Pack exploit kit, which was installing CryptoWall 2.0.
Yesterday we picked up an e-mail campaign pretending to be a fax report that carried a .zip attachment with a PDF inside.
The PDF  exploits CVE-2013-2729 to download a binary which also installed CryptoWall 2.0.
The best way to protect yourself against ransomware is to keep up-to-date backups of your important files.
A ransomware infection, which encrypts all of your files, is similar to a drive failure, except that for a small fee you have the chance to get your files back.
To protect against CryptoWall 2.0 we recommend taking the following actions:  Adobe Reader Embedded BMP Parsing Integer Overflow Vulnerability  CVE-2014-0556  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Yesterday, TrustedSec, a security consultancy based on Ohio, wrote that the recent breach at Community Health Systems (CHS) was the result of exploitation of the Heartbleed OpenSSL vulnerability (CVE-2014-0160).
CHS’s 8-K filing on Monday did not reveal how the attackers got into their network, only that the records of approximately 4.5 million patients were stolen in attacks in between April and June of 2014.
TrustedSec reports on how attackers were apparently able to glean user credentials from a certain device via the Heartbleed vulnerability and use them to log in via a VPN.
We need more facts to be sure, but this instance may be the first public breach related to the Heartbleed vulnerability since it was announced in April.
Now, over four months since the Heartbleed disclosure, this attack reminds us of how serious this vulnerability is and how critical protection against it remains.
As Heartbleed allows the attacker to scrape memory from the vulnerable device, they can retrieve significant amounts of secret information.
In this case, that apparently included VPN credentials, which they then used to log into the network and more laterally from system to system until discovering the data they were after.
While most vendors released patches for their products months ago it remains up to the users and administrators to ensure those patches are deployed.
As the OpenSSL library is so widely used, some administrators may be finding unpatched systems for years to come.
While network-based defenses are not a substitute for patching software, Heartbleed is detectable using IPS signatures.
Palo Alto Networks deployed five signatures in April to defend against this threat, 40039, 36420, 36419, 36418 and 36416.
No matter how well patched your systems are, there’s no reason not to deploy IPS signatures like these to detect and block attempted Heartbleed exploits.
If you’ve already deployed signatures and your logs are showing attempted exploits, consider blocking or monitoring the IP addresses sending the requests.
A Heartbleed probe could be evidence of the early stages of an attack on your network, and persistent attackers are unlikely to give up after jiggling the handle on the front door.
This post is also available in:      日本語 (Japanese)  On June 2, Volexity reported that over Memorial Day weekend, they identified suspicious activity on two internet-facing servers running Atlassian’s Confluence Server application.