mrmoor/cyber-threat-intelligence huggingface dataset:
At the time of infection experiments, 1 BTC equaled approximately $54,649, suggesting that the exchange rate in the ransom note is not updated on the fly.
Some Virlock variants ask for more ransom, such as 0.771 BTC, 1.008 BTC or more.
The top three samples we observed spreading in early 2021 were Ryuk, Maze, and Sodinokibi.
These three contribute 7.2% out of the total infected numbers we collected.
Ryuk will change the infected file extension to .RYK, and leave a ransom note called RyukReadMe.html.
One of the reasons Ryuk causes so much damage is because it will scan the local network and try to infect other machines through Server Message Block (SMB) protocols.
Ryuk will even send out Wake-on-LAN packets to wake up systems that have been configured with this feature.
In this research, we discussed ransomware family trends we observed in the first three months of 2021.
First, we reviewed the trends from prevalent ransomware families, then we discussed the most common file types used as attack vectors leveraged by ransomware.
Lastly, we gave an example of ransom operations and updates about top ransomware families.
Ransomware threats are a serious challenge.
Employing effective backup strategies and disaster recovery procedures is important.
Palo Alto Networks customers are further protected from ransomware.
Cortex XSOAR can automatically and instantly coordinate with network security, malware analysis and threat management solutions to ensure customers remain protected.
Cortex XDR endpoint protection stops malware, exploits and ransomware before they can compromise endpoints.
With AI-powered Inline analysis, the Next-Generation Firewall stops exploits that lead to infection, and WildFire’s always up-to-date machine learning models monitor behavior to preemptively detect unknown ransomware.
If you think you may have been impacted by ransomware, please email unit42-investigations@paloaltonetworks.com or call (866) 4-UNIT42 to get in touch with the Unit 42 Incident Response team.
Highlights from the 2021 Unit 42 Ransomware Threat Report  Ransomware Threat Assessments: A Companion to the 2021 Unit 42 Ransomware Threat Report  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
If you need to understand one thing about cybercrime, it’s that it is all about business.
In our latest Unit 42 research on cybercriminals using the Hancitor malware, we show that not only are their attacks about business, we can see these cybercriminals deftly applying some fundamental business principles around timing, specialization, and globalization.
Hancitor is a malware that focuses getting other malware onto the victim’s system.
In the case of Hancitor, it’s typically banking Trojans that steal the victim’s banking information.
In our latest research, we can see the attackers behind Hancitor have been timing their attacks to happen during the busiest time of the global working week, the middle of the week.
And we’ve seen that in adapting their attacks to better evade detection, they’ve specialized their operations around the globe.
Hancitor isn’t particularly advanced in its tactics: it’s ideal target is an old or outdated version of Microsoft Windows like Windows 7 or even Windows XP.
But it’s effective enough that when used in several hundred different spam campaigns every month it pays for the criminals to keep up these attacks against targets around the world.
Timing   In our most recent research, one of the things that jumped out for our researchers is the clear pattern around the timing of the attacks.
As you can see in Figure 1 below, throughout 2017, the Hancitor attacks show clear spikes in their occurrence and these spikes happen during the middle of the week.
Figure 1: Timeline of Hancitor campaign activity since January 2017.
The attackers behind Hancitor aren’t the first to time their spam attacks like this, but it is an effective tactic to try and increase their chances of success, especially when combined with the other innovation that we’ve seen.
Adapting the Attacks
In the past, Hancitor was sent as a malicious attachment in a spam email which would then download and install the attackers’ final malware like a banking Trojan.
When they would do this, the Hancitor attachment would download and install the final malware from a malicious or compromised site.
But as organizations have gotten more effective at blocking malicious attachments like Hancitor, we’ve seen the attackers behind Hancitor adapt to evade detection and prevention.
They’ve done this by moving the Hancitor malware from being a malicious attachment in spam to itself being a malicious download.
The spam the attackers use no long has a malicious attachment but instead a malicious link that downloads the malicious Hancitor attachment.
To do this, they make the spam look like something that requires you to click and download something like and invoice, a message, or a delivery notification.
Figure 2 shows one of these that was made to look like an Amazon shipping notice.
Figure 2: Hancitor malspam example from February 2017.
This means that a Hancitor attack now has two downloads rather than one and what these attackers did around the malicious downloads shows another modern business tactic: globalization.
Globalizing the Attacks  Figure 3 below is a map showing where our Unit 42 researchers have found webistes involved in Hancitor attacks.
Figure 3: Hancitor distribution servers globally thus far in 2017  Table 1 – Number of Distribution Servers by Country
The hot spots in the United States represents distribution servers which are created using fraud based accounts at various hosting providers that are hosting the Hancitor documents while the hotspots in Asia represent legitimate sites for small and medium businesses that have been compromised by the actors behind Hancitor campaign to host the malicious Hancitor documents.
Conclusion  Attackers are always making business decisions to optimize their attacks in ways that are most successful and profitable.
What is most interesting about Hancitor is the way these decisions so clearly reflect an awareness of business realities (by targeting peak working times) and dividing up the “work” of their attacks in a way that so clearly mirrors mainstream business decisions around globalizing operations.
In the end, while Hancitor may not be sophisticated, these steps to adapt and stay effective seem to be succeeding.
And we expect to continue to see Hancitor be a global threat for the foreseeable future.
This post is also available in:      日本語 (Japanese)  This Unit 42 blog provides an update on the threat situation surrounding attacks using the Petya Ransomware which are impacting organizations in Ukraine, Russia and to a lesser extent around the world.
On June 27th, 2017 we became aware of a new variant of the Petya malware which is spreading through multiple lateral movement techniques.
One technique includes  the ETERNALBLUE exploit tool.
This is the same exploit the WanaCrypt0r/WannaCry malware exploited to spread globally in May, 2017.
At least 50 organizations have reported impacts from the malware, including government and critical infrastructure operators.
Palo Alto Networks is documenting our prevention capabilities with regard to this threat in the Palo Alto Networks Protections for Petya Ransomware blog post.
Windows users should take the following general steps to protect themselves:
This is a developing situation, we will update this blog as new information becomes available.
AutoFocus users view samples using the Petya tag.
Petya is a ransomware family that works by modifying the Window’s system’s Master Boot Record (MBR), causing the system to crash.
When the user reboots their PC, the modified MBR prevents Windows from loading and displays a fake “chkdisk” screen which indicates the computer's hard drive is being repaired, but the malware is actually encrypting the user's files.
When this process completes, the malware displays an ASCII Ransom note demanding payment from the victim (Figure 1).  Figure 1: Latest Petya Ransom note displayed on a compromised system.
The latest version of the Petya ransomware is spreading over Windows SMB and is reportedly using the ETERNALBLUE exploit tool, which exploits CVE-2017-0144 and was originally released by the Shadow Brokers group in April 2017.
After the system is compromised the victim is asked to send US $300 in Bitcoin to a specific Bitcoin address and then send an e-mail with the victim’s bitcoin wallet ID to wowsmith123456@posteo[.]net to retrieve their individual decryption key.
Posteo (a free e-mail provider) has already shut down this e-mail address, and as such victims should not even attempt to pay the ransom.
As of 13:00 UTC on June 28thth, approximately 4 Bitcoin have been transferred to the attacker's wallet.
Unit 42 is unaware of ANY successful recovery after paying the ransom.
Additionally, ongoing research by the industry is showing that specific actions this malware takes makes it technically infeasible, if not impossible, for recovery to occur.
This means that even though this malware is functionally ransomware, for threat assessment purposes, it should be functionally considered a “wiper”.
We are aware of the following information about how the Petya attack lifecycle works.
Delivery/Exploitation
We have not yet confirmed the initial infection vector for this new Petya variant.
Previous variants were spread through e-mail, but we have not identified this latest sample carried in any e-mail related attacks.
While we have not been able to directly confirm the source, we have seen evidence that a Ukrainian software application called MEDoc was used by attackers to deliver the Petya DLL.
The software is heavily used in Ukraine it appears the company’s systems may have been compromised and used to issue a malicious update to systems running the program on the morning of Jun 27th.
This variant of Petya is spread as a DLL file, which must be executed by another process before it takes action on the system.
Once executed, it overwrites the Master Boot Record and creates a scheduled task to reboot the system.
Once the system reboots, the malware displays a fake “chkdisk” scan which tricks the victim into believing the program is repairing their hard drive.
In reality, the malware is encrypting the NTFS Master File Table in the background.
Once the fake chkdisk completes, the malware displays a ransom note which demands a payment of $300 in bitcoin.
Command and Control  Petya contains no Command and Control mechanisms that we know of.
After a host is infected, there is no communication from the malware back to the attacker.
Lateral Movement  Petya uses three mechanisms to spread to additional hosts.
Ransomware attacks are very common, but they are rarely coupled with an exploit that allows the malware to spread as a network worm.
The WannaCry attacks in May, 2017 demonstrated that many Windows systems had not been patched for this vulnerability.
The spread of Petya using this vulnerability indicates that many organizations may still be vulnerable, despite the attention WannaCry received.
As always if you have any questions, please come to the Threat & Vulnerability Discussions on our Live Community.  Version Summary  June 27, 2017:  June 27, 2017 – 1:08 PM PT  June 28, 2017 – 8:40 AM PT  June 29, 2017 - 5:00 PM PT  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Nearly all of us have a use for Microsoft Office documents.
Whether they are work documents, e-receipts, or a lease on a new apartment – Office documents are useful to all of us, and this is part of the reason we’re very likely to open an office document we receive as an attachment in e-mail.
Armed with the knowledge that many people will open nearly any document, even those from an untrusted source, adversaries commonly choose these files in attacks to compromise a system.
In this threat brief we show you five different ways that Office documents can be subverted and abused to attack and compromise a Windows endpoint, some we’ve already posted about before, and some are new.
Macros Macros are the most straight-forward way for an attacker to weaponize Office documents.
Office applications have a built-in script engine that can run VBA (Visual Basic for Applications) scripts.
These scripts can execute immediately as the document opens, without any user interaction (assuming the user has previously enabled macros) and run malicious code on the system.
If the user has not enabled macros, a popup window will appear asking the user to click to do so.
The pop-up is one of several security mechanisms added by Microsoft to mitigate the security risk that macros pose.
Microsoft will also force a different file extension (.docm instead of .docx for new documents containing macros).
Despite these measures, users still choose to open these files and enable their content, thus allowing macros to continue be a common attack vector – both in wide and simple attacks to deliver ransomware such as Emotet, as well as for sophisticated attacks like this Sofacy campaign.
The Sofacy document before & after the content is enabled
As you can see in this example, attackers try to convince users to disable the security mechanisms added by Microsoft using social engineering, convincing the user to enable content for them to be able to see the full document.
In the Sofacy example, the attackers had simply made the font color white, so the text was present prior to the user enabling macros, just not clearly visible.
Embedded Flash files  In addition to built-in capabilities, like macros, Office documents can also be embedded with external objects, such as Adobe Flash files.
These objects are passed to the appropriate software for handling, thus any vulnerability that the software has can also be exploited by embedding it within the Adobe Flash content in the Office document.
An example for such attack vector being leveraged by attackers is CVE-2018-4878, an Adobe Flash Player Zero-Day exploited by embedding malicious SWF files in Excel documents.
In these types of attacks, the malicious Excel contains embedded Adobe Flash content which can trigger the Flash vulnerability and execute embedded shellcode.
Microsoft Equation Editor
In a similar way to embedding Adobe Flash files into an Office document, you can also embed equations in documents that will be parsed by Microsoft Equation Editor - a program that lets you easily write mathematical equations: Figure 2.  Microsoft Equation Editor  As in our previous example, vulnerabilities in the equation editor can be exploited by leveraging malicious Office documents.
We’ve seen examples of this just recently, when CVE-2017-11882 was exploited in the wild, paving the way to other exploits like CVE-2018-0802, both of which exploit flaws in the equation editor, enabling attackers to get from the user opening an Office document to remote code execution.
While still not seen in the wild, similar exploits in Microsoft Equation Editor, such as such as CVE-2018-0807 and CVE-2018-0798, were identified by Unit 42 researchers.
Note that since the Microsoft Equation Editor runs as its own process (eqnedt32.exe), protections specific to Microsoft Office such as EMET and Windows Defender Exploit Guard are not effective by default, as they only protect Microsoft Office processes (such as winword.exe).  OLE Objects & HTA Handlers
OLE Objects & HTA Handlers are mechanisms Office documents use to make references to include other documents in their content.
They can be used to compromise an endpoint in the following way:  This functionality was leveraged in exploitation of CVE-2017-0199 - a Microsoft Office/WordPad remote code execution (RCE) vulnerability patched by Microsoft in September 2017, and was used in multiple campaigns, like this OilRig campaign.
RTF files will look exactly like regular Word documents
In addition to the previous OLE & HTA exploit, attackers discovered RTF files can also execute ‘text/html’ mime-type OLE objects using the MSHTML.
This means that RTF documents expose the same attack surface as Internet Explorer!
Leveraging this logical vulnerability, known as CVE-2018-8174, allows attackers to execute arbitrary HTML/JavaScript/VBScript.
While code executed in this way is ‘sandboxed’ (where it cannot run new processes or write to the filesystem etc.), like other code running from Internet Explorer
, this flaw can be used to leverage other vulnerabilities, such as a memory corruption UAF vulnerability in the VBScript engine, to gain arbitrary code execution in the context of the Word application (winword.exe), allowing them to gain control on the system.
While document-based attacks have been a common attack vector for over a decade, we’re seeing a recent rise in their popularity and complexity.
This rise may be a result of browser exploits becoming more difficult to use, due to the hardening done by browser developers.
No matter the reason
, it is important that organizations know how to defend against these common techniques.
Prevention Palo Alto Networks Traps advanced endpoint protection offers multiple methods of malware and exploit prevention to protect against these threats:
This has been a fun week.
We have not had a significant cyber event like this – something that affects just about everybody on the Internet -- since the Kaminsky DNS vulnerability of 2008.
Everybody I know has been scrambling to understand what it means to their organization, to their business and to their immediate family.
Yes, I said family.
I am sure I am not the only one who has answered a question or two from his mother-in-law about how the Internet is melting down based on what she’s been reading in the press.
There’s a lot out there already about what Heartbleed means for the Web and beyond, and I’ll point you to our own analysis written by Scott Simkin or an essay by Dan Goodin over at ars technica for that explanation.
Instead, here are eight things I am doing right now to protect Palo Alto Networks and my home (and mother-in-law) and that you should be doing, too:
If there’s a long-term consideration here, it’s to install perfect forward secrecy, as Twitter did last year.
That ensures that a session key derived from a stolen private key and a collected public key in the future will not be compromised.
For more:  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
This post is also available in:      日本語 (Japanese)  On Aug. 25, 2021, Atlassian released a security advisory for an injection vulnerability in Confluence Server and Data Center, CVE-2021-26084.
Since the release of this advisory, mass scanning activity has started to occur, seeking unpatched systems, and in-the-wild exploitation has begun.
Unit 42 recommends customers upgrade to the latest release of Confluence Server and Data Center.
The Atlassian products vulnerable to CVE-2021-26084 are those using the following versions of Confluence Server and Data Center:  Confluence Cloud customers are not affected by this vulnerability.
We recommend that customers update Atlassian Confluence Server and Data Center to the latest version, 7.13.0 (TLS).
You can find the newest release on Atlassian’s download center.
If you cannot install the latest upgrade, see the Mitigation section on the Atlassian security advisory for information on how to mitigate this vulnerability by running a script for the operating system your Confluence server is hosted on.  Palo Alto Networks provides protection against the exploitation of this vulnerability:  Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available.
writeups/Confluence-RCE.md at main · httpvoid/writeups  Confluence Server Download Archives  Confluence Security Advisory - 2021-08-25 | Confluence Data Center and Server 7.13
This post is also available in:      日本語 (Japanese)  On Sept. 14, 2021, Microsoft’s Security Response Center (MSRC) released security patches detailing the findings of four critical vulnerabilities affecting the Microsoft Azure package Open Management Infrastructure (OMI).
The open-source OMI package is designed to provide a portable infrastructure backbone for web-based management tools, such as diagnostic monitoring, log analytic services and automation functionality within UNIX and Linux systems.
OMI is used by Microsoft Azure to manage UNIX packages within Azure virtual machines (VMs), containers and serverless cloud instances.
According to Microsoft’s security release notes, any system created, or which has updated its OMI package, after Aug. 11, 2021, should automatically be patched.
The four critical vulnerabilities discovered by security researchers from Wiz include one unauthenticated remote code execution (RCE) and three privilege escalation vulnerabilities.  Dubbed OMIGOD, the four vulnerabilities were found to directly affect Azure cloud instances using the following Azure services:  Prisma Cloud Compute Defender agents can detect whether any Azure system is vulnerable to any of the four CVEs.
Additionally, Prisma Cloud users can also build a custom vulnerability detection rule to identify if any system is running an OMI package with a version previous to 1.6.8.1.
To build a custom vulnerability detection rule, open Prisma Cloud and navigate to the following page:  name,type,package,minVersionInclusive,maxVersionInclusive,md5 OMIGOD,package,omi,*,1.6.8.0,  Palo Alto Networks Azure-based VM- and CN-Series Firewall instances do not use the OMI package and are not vulnerable to the OMI critical vulnerabilities.
Prisma Cloud will create an alert for any system which maintains an OMI package vulnerable to the OMI critical vulnerabilities.
Should a system be identified as vulnerable, the following steps should be taken for that Azure Cloud Instance:
On Sept. 14, 2021, security researchers from Wiz released a report detailing the findings of four critical vulnerabilities affecting the Microsoft Azure package OMI.
Dubbed OMIGOD, the four vulnerabilities were found to directly affect Azure Cloud Instances.
Palo Alto Networks Azure-based VM and CN Series Firewall instances do not use the OMI package and are not vulnerable to the OMI critical vulnerabilities.
Customers of Prisma Cloud have the ability to create alerts to detect vulnerabilities.
Use-after-free bugs have affected Internet Explorer for years.
In the past year alone, Microsoft patched 122 IE vulnerabilities, the majority of which were use-after-free bugs.
This year Microsoft has already patched 126 IE vulnerabilities to date.
Of those vulnerabilities, 4 were actively being exploited in the wild.
These 4 exploits (CVE-2014-1815, CVE-2014-1776, CVE-2014-0322, CVE-2014-0324) were all based on use-after-free bugs.
To deal with the increasing number of use-after-free bugs and associated exploits, Microsoft introduced a series of new control mechanisms in the most recent Internet Explorer patches.
In June, Microsoft introduced a new isolated heap mechanism to solve the usage issue of use-after-free exploitation.
They followed that up In July by implementing a deferred free method to solve the freeing issue of use-after-free bugs.
The main concept of an isolated heap is simple.
It allocates a dedicated heap for select critical objects to use that is separate from other heaps that a user can directly access.
The heap block will not be occupied by user-controlled data after the critical objects are freed.
This mechanism prevents precise control of the data of a freed object from further exploitation.
Figure 1. _g_hIsolatedHeap handle used for isolated heap
The isolated heap was applied to many but not all internal objects, leaving some still vulnerable.
To address this, Microsoft introduced another protection method of deferred free named ProtectedFree.
They encapsulate this method and apply it to almost every object in mshtml.dll.
In IE9, for example, it has been applied to every object through MemoryProtection::HeapFree as shown in figure 2.
References of MemoryProtection::HeapFree