mrmoor/cyber-threat-intelligence huggingface dataset:
After analysis of the compromise, Volexity determined the initial foothold was the result of a remote code execution vulnerability in Confluence Server and Data Center.
The details were reported to Atlassian on May 31, and Atlassian has since assigned the issue to CVE-2022-26134.
Based on the security advisory issued by Atlassian, it appears that the exploit is indeed an unauthenticated, remote code execution vulnerability.
If the vulnerability is exploited, threat actors could bypass authentication and run arbitrary code on unpatched systems.
At the time of publication, the Palo Alto Networks attack surface management solution Cortex Xpanse identified 19,707 instances of Confluence Servers that are potentially affected by this CVE.
A patch resolving the issue has been posted by Atlassian.
Palo Alto Networks strongly advises organizations to patch immediately.
Updated June 7 to add additional in-the-wild observations.
Vulnerable Systems CVE-2022-26134 in the Wild Cortex Managed Threat Hunting Detections of CVE-2022-26134
Conclusion Indicators of Compromise
The Palo Alto Networks attack surface management solution Cortex Xpanse found 19,707 instances of Confluence Servers that are potentially affected by this CVE.
Additionally, the Xpanse research team also found 1,251 end-of-life versions of the Confluence Server exposed on the public internet.
Assets running end-of-life software should never be internet-facing.
If an asset cannot be updated to secure versions of software, it should be isolated or decommissioned altogether.
To learn more about the ubiquitous problem of end-of-life software, please refer to the 2022 Cortex Xpanse Attack Surface Threat Report.
Thus far, Unit 42 has noted historical scans being performed by the IP addresses publicly shared by Volexity.
These scans date back as early as May 26, 2022, and target organizations in various industries.
Additionally, a purported proof of concept (PoC) has reached the public domain, increasing the threat this particular vulnerability poses.
The Cortex Managed Threat Hunting team has detected several exploitation attempts.
Among the attempts, we found successful exploitation, which resulted in the Cerber Ransomware attack.
The ransomware was blocked by the Cortex XDR agent.
The Managed Threat Hunting team immediately reported this incident to the customer and continues to monitor our customers using the XQL queries in the following section.
Cortex XDR also includes multiple detections for post-exploitation activities.
Below are details of what was seen in the attempt.
In this case, the process tomcat.exe spawned multiple reconnaissance commands such as: whoami, systeminfo, arp, ipconfig, etc.  On top of that, a Base64-encoded PowerShell command was executed and retrieved a ransomware binary.
In order to confirm the assumption that the above activity is related to CVE-2022-26134, we looked into the Confluence Apache access logs (atlassian-confluence.log) and found the PowerShell execution.  The Cortex Managed Threat Hunting team continues to track any attempts to exploit CVE-2022-26134 across our customers, using Cortex XDR and the XQL queries below.
Palo Alto Networks provides protection against the exploitation of this vulnerability in the following ways:  Additionally, Xpanse has the ability to identify and detect Atlassian Confluence Servers that may be a part of your attack surface or the attack surface of third-party partners connected to your organization.
Xpanse is even able to classify those servers which have not been upgraded to the most recent version.
These abilities will be updated to detect additional instances or versions that are insecure against this CVE.
Existing Xpanse customers can log into Expander and identify their enumerated Atlassian Confluence devices by filtering by “Atlassian Confluence Server” in the Services tab.
As further information emerges or additional detections and protections are put into place, Palo Alto Networks will update this publication accordingly.
During the hunting process, we encountered exploitation attempts that originated from the following IP addresses: Updated June 13, 2022, at 5:30 a.m. PT.
As shoppers and retailers gear up for the 2017 holiday season, they need to be aware of a new kind of cybersecurity threat they may face this year: unauthorized coin mining.
Unauthorized coin mining is a new threat that can affect retailers and shoppers in a way that could impact or even halt their online shopping experience.
A recent Unit 42 threat intelligence posting on the topic showed how 63 percent of the unauthorized coin mining sites we found came online in October 2017.
This surge in unauthorized coin mining is driven, in large part, by the recent skyrocketing in the value of digital currencies like bitcoin.
As that trend shows no sign of slowing down anytime soon, we can expect this to remain a very lucrative avenue for attackers.
Unlike other cybersecurity threats we’re used to bracing for around the holiday season, unauthorized coin mining attacks can affect shoppers who are up-to-date with security patches and even some running some security protections.
And unlike spam or phishing, these attacks also don’t require any lapse in vigilance by the user: they can happen simply by going to websites users know and trust.
The good news for retailers is that these attacks are wholly preventable.
And for shoppers, the impact of a successful attack is minimal: there are no lasting effects or impact, making it an annoyance at worst.  But because of the potential impact on holiday shopping and the ease of attacks, unauthorized coin mining is an attack that retailers need to be aware of and take active steps for prevention this holiday season.
What Is Unauthorized Coin Mining?
The best way to understand the threat of unauthorized coin mining is to first understand its impact.
Unauthorized coin mining is an attack that can cause a user’s system to suddenly and unexpectedly slow down, sometimes significantly, when visiting a website.
In a worst case, the slow-down can be so severe that it can make a website basically unusable.
Obviously, this impact is potentially dire for shoppers and retailers as it directly impacts and harms the online shopping experience.
What causes this impact is when the website the user visits is running “coin miner” code.
“Coin miner” code is code used to “mine” for digital currency like bitcoin.
Mining provides the computing necessary to power the digital currency’s infrastructure.
Mining is also a computationally intensive process, meaning it takes a lot of system resources.
Because of this, people can earn digital currency credit in exchange for the use of their computing resources to power that digital currency’s infrastructure.
There are many kinds of coin mining software.
In this case, we are concerned about coin mining code that’s used on websites.
When the user visits the website, the code runs on their system and “mines” on behalf of others – either the website or someone else.
When this is done with the visitor’s full knowledge and consent, it’s a fair and reasonable exchange.
For instance, there are some websites that now use coin mining as an alternative to digital advertising to generate revenue.
In these cases, the coin mining is authorized; the website informs the user that, while on the site, his or her computing resources will be used to “mine” digital currency, and the site will receive the credits.
While the user will experience a slow-down as the coin mining software is run, it is (or should be) expected, because of the notification, and so done with the site visitor’s consent.
Where this becomes a problem is when coin mining is done without the user’s knowledge and consent.
In this case the coin mining is unauthorized: in essence, it’s an attack against the user’s resources.
How Do Unauthorized Coin Mining Attacks Happen?
Unauthorized coin mining attacks happen very simply: the website the user is visiting has special code on it that performs coin mining operations on the visitor’s computer while they’re on the website.
And, as noted before, this happens without the user’s knowledge or consent.
Because these attacks happen due to code on the website, that code is either there with the site owner’s knowledge and permission or not.
When unauthorized coin mining happens with the site owner’s knowledge and permission, it’s basically a malicious site.
That site’s owner is the attacker.
When we’re talking about online shopping, clearly there’s no threat here to the retailer: they’re the ones doing the attacking.
And for the shopper, it means you’re on an untrustworthy site and so open to all manner of risks beyond just unauthorized coin mining.
The real, significant situation shoppers and retailers need to think about this season is when unauthorized coin mining code is on a site without that site owner’s knowledge and permission.
Here the site itself has been attacked, and the site owners are also victims.
This is an attack against not just shoppers but the retailers operating online shopping sites.
How You Can Prevent Unauthorized Coin Mining Attacks  If you’re a shopper, there are three things you can do to protect yourself against unauthorized coin mining attacks this holiday season:  If you’re a retailer, preventing unauthorized coin mining attacks comes down to focusing on two tasks, both of which you should be doing anyway:  Finally, if you’re a legitimate website that has chosen to implement coin mining to raise funds from your visitors, you can ensure that your visitors don’t think you’re engaged in unauthorized coin mining by doing three things:  Conclusion  Working to prevent cybercrime threats during the holiday season has become a standard part of what shoppers and retailers do every year.
This year, for the first time in many years, shoppers and retailers are facing a new threat, unauthorized coin mining, driven by the surge in digital currency prices.
While this threat can have a clear, negative impact on retailers and shoppers, the good news is that this threat is easily preventable and poses no lasting harm to consumers.
This is a case where forewarned is forearmed, and that forearming can result in effective prevention.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
This post is also available in:      日本語 (Japanese)  Intro
One of the most important “innovations” in malware in the past decade is what’s called a Domain Generation Algorithm (“DGA”)”.
DGA is an automation technique that attackers use to make it harder for defenders to protect against attacks.
While DGA has been in use for over 10 years now, it’s still a potent technique that has been a particular challenge for defenders to counter.
Fortunately, there are emerging technologies now that can better counter DGAs.
A Domain Generation Algorithm is a program that is designed to generate domain names in a particular fashion.
Attackers developed DGAs so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware (usually referred to as “command and control” or C2).
Attackers use DGA so that they can quickly switch the domains that they’re using for the malware attacks.
Attackers do this because security software and vendors act quickly to block and take down malicious domains that malware uses.
Attackers developed DGA specifically to counter these actions.
In the past, attackers would maintain a static list of malicious domains; defenders could easily take that list and start blocking and taking down those sites.
By using an algorithm to build the list of domains, the attackers also make it harder for defenders to know or predict what domains will be used than if they had a simple list of domains.
To get that list of domains that the malware will use, defenders have to decode the algorithm which can be difficult.
Even then, taking down sites that malware using a DGA can be a challenge as defenders have to go through the process of working with ISPs to take down these malicious domains one by one.
Many DGAs are built to use hundreds or even thousands of domains.
And these domains are often up for only limited periods of time.
In this environment blocking and taking down DGA-related domains quickly becomes a game of “whack a mole” that is sometimes futile.
Why should I care, what can it do to me?
DGA by itself can’t harm you.
But it is an important piece that enables modern malware to try and evade security products and countermeasures.
The importance and usefulness of DGA is best shown by the fact that it’s been in regular and constant use since at least 2008.
DGA was a key component in the Conficker attacks in 2008 and 2009 and part of its success.
Because DGA is a technique the fuels malware attacks, the things you can do to help prevent malware can also help prevent DGA-fueled malware attacks:  In addition, new technologies are being developed that can more directly counter DGA-fueled attacks, particularly for organizations.
In particular, security vendors are bringing automation to bear to counter the attackers’ automation.
New anti-DGA technologies that leverage machine learning and big data are capable of countering DGA’s automation with automated prediction of their own that can anticipate, block, assist with malicious site takedowns or even, in some cases, prevent those malicious sites from being used in the first place.
You can also learn more about these new technologies and look at deploying them as an additional layer of protection.
About: Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.
They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.  Got a topic you want us to write about for you, your friends, or your family?
Email us at u42comms@paloaltonetworks.com.
Unit 42 released details about a vulnerability that affects Android devices running operating systems older than 8.0 Oreo.
The vulnerability leaves Android users at risk of falling victim to an Android Toast Overlay attack.
Patches are available that fix this vulnerability, so Android users should get the latest updates as soon as possible.
The vulnerability affects the Toast feature on Android devices, an Android feature that allows display messages and notifications of other applications to “pop up,” and allows an attacker to employ an overlay attack.
An overlay attack happens when an attacker places a window over a legitimate application on the device.
Users will interact with the window, thinking they are performing their intended function, but they are actually engaging with the attackers overlay window and executing the attacker’s desired function.
You can see an example of how this would work in Figure 1.
Figure 1: Bogus patch installer overlying malware requesting administrative permissions  This interaction can install malware or malicious software on the device, grant malware full administrative privileges or lock the user out and render the device unusable.  In the past successful overlay attacks were typically dependent on two conditions:  However, with this particular vulnerability, these conditions are no longer required for a successful attack.
This means that attackers can use this vulnerability in apps users get from places other than Google Play.
And when they install these malicious apps, they don’t have to ask for the “draw on top” permission.
How to Defend Against It  Keeping devices updated is a general security best practice.
The Android Toast Overlay attack specifically targets outdated devices using versions prior to 8.0.
In order to defend against the Android Toast Overlay attack, update all Android devices to the latest version.
Additionally, avoid downloading malicious applications by only downloading from the Google Play store is another best practice you should always follow.
This post is also available in:      日本語 (Japanese)  Ransomware is one of the top threats in cybersecurity and a focus area for Palo Alto Networks.
In the current threat landscape, ransom payments are rising and organizations are seeking to protect themselves from threat actors.
In the 2021 Unit 42 Ransomware Threat Report, we detailed the observations and the trend of top ransomware families from January 2020-January 2021.
This post supplements that information based on observations from the first three months of 2021, and will discuss the propagation of different ransomware families we observed in the wild and the different types of extortion used.
We hope the information will help readers get a clear picture of current directions in ransomware trends.
In the first quarter (Q1) of 2021, Unit 42 detected 113 different ransomware families in the wild.
Based on the statistical data, the top 15 ransomware families only cover 52.3% of total ransomware cases.
This demonstrates the diversity of ransomware and emphasizes how difficult it is to expand ransomware detection coverage with static profiling.
Figure 1 shows the proportion of ransomware sample numbers for different families that Unit 42 detected in the wild.
Among all, 6.7% of the ransomware samples are Virlock, which has been active since 2014.
Virlock has the largest number of variants due to its file-infector-like behavior.
Higher malware variant numbers don't necessarily imply a higher prevalence.
Some ransomware families don’t deliver different variants every time, but the infection ratio per sample is high, meaning attackers delivered the same malware to huge numbers of victims.
Figure 2 shows a completely different result from Figure 1 and stems from only counting ransomware samples from cases in which more than five hosts were infected with the same malware.
From this lens, the top three families observed are Ryuk (31.7%), Sodinokibi (20%) and Maze (15%).  Emails are still the most efficient method to deliver and propagate ransomware.
Figure 3 shows ransomware arrives via different application protocols.
The majority of ransomware is delivered by email.
Web browsing is the second most common entry vector for ransomware infections.
The process of delivering malware by a URL can include various techniques.
For example, the URL links can be posted on forums or chat group software, sent by IM applications, offered via fake freeware for download or attached in emails.
Web hosting ransomware can also be downloaded and successfully installed through a multi-layered infection chain among different file types.
For example, AlumniLocker is first delivered as a phishing PDF.
It leads to downloading a ZIP archive that contains an LNK downloader.
This downloads and executes an obfuscated PowerShell script to finally install the ransomware.
Figure 4 breaks down which file types we saw in the course of ransomware detection and their prevalence.
32-bit EXE is the most common ransomware file type we observed.
Other file types are often used as the first stage of infection or downloaders, such as archives, documents and scripts.
Most ransomware is delivered via email with an attached archive; the ransomware is compressed in the archived files with or without password protection.
“Resume” or “portfolio document” are examples of archive file names, and the archive contains one or more pieces of malware with fake document file icons.
One example here is Makop, contained in a 7z archive along with an infostealer malware (SHA256: DE6DFA018773E07C218EF1DF62CE0D99A708841BF1DDFB4C6AD7E323D5D666A4).
A script file is also used to download or install ransomware.
For example, GandCrab uses JScript as a downloader, leveraging Windows Background Intelligent Transfer Service (BITS) to download the payload in the background (Figure 5).
We also observed that Mailto (AKA NetWalker) tends to deliver ransomware in a highly obfuscated PowerShell script.
Exploit documents are seldom seen for delivering ransomware.
One example is an exploit RTF that led to downloading and installing Makop ransomware remotely.
Besides encrypting files on infected hosts, the main feature of ransomware is, of course, the demand for ransom.
Since ransomware threat actors have had years to evolve their techniques, there are now several different ways for attackers to receive payments and provide the "service" they claim to offer.
Usually, after the ransomware successfully installs, it pops up a message box or leaves text files to explain how to pay the ransom – the ransom note.
Some ransomware locks the victim's screen and only displays the ransom note.
Unit 42 has reviewed ransom notes from different ransomware families.
Most ransom notes request payment in cryptocurrency or mention reaching out via the darknet, though some other contact methods also appear.  In these cases, the ransom note asks victims to pay a specific amount in cryptocurrency – Bitcoin (BTC), Monero (XMR), etc. — to a specific wallet address.
Two ransomware families that utilize these types of ransom notes are Virlock and WanaCrypt0r.
Some ransomware families, including Babuk, Sodinokibi, Cerber, Mailto, Ryuk and others, seldom show the ransom amount or cryptocurrency wallet address.
Instead, they instruct victims to install TOR and reach out to them on the darknet.
Usually, they host a website for victims to input the identification key found in the ransom note, upload encrypted files for decryption – and pay the ransom.
Ransom notes from Makop, Dharma, Ryuk, DearCry and others, sometimes ask victims to reach out to them via email.
The email addresses given are usually from untraceable email accounts.
At other times, a threat actor lets the victim chat with them directly on group chat software.
The victims can find the threat actor’s user name through specific group chat software or follow a chat group link in the ransom note.  Ransom payment operations are complicated and highly automated processes.
Attackers can create a lot of cryptocurrency wallets automatically; they can even make a unique wallet address for each victim.
Once a ransom is received, the ransom will be involved in the multiple transactions that are managed to distribute and aggregate the ransom across thousands of virtual wallets.
For example, the Xorist ransomware (SHA256: 4979A10B81C41ECC0FC3A0F376ADE766CE616D2301639F74E0277047CC40E3D6) demanded £1,000 for a ransom; the bitcoin wallet address was 1BFqrLCDwwrxueY7FFDn8DqeoasPJignxt.
However, this wallet had not really received any ransom payments when the malware was delivered.
The wallet got involved in the operation of mixing and tumbling among several other virtual wallets.
This is a pretty common operation when attackers want to withdraw or disperse currency from ransom payments into other wallets.
During the operation, 25.1 BTC from 538 wallets was sent to 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s (SHA256: CE11703DEF517306326C48A67A7C859A3DE0F18E2451DF226CE171389A5B7953), which is a wallet owned by Binance cryptocurrency exchange.
(ref: Binance on Twitter ).
The 25.1 BTC amount was worth $1.18 million at that time, and now is about $876,000.
Since Virlock only requests a $250 ransom, it does not draw too much public attention.
Other ransomware families, however, target enterprises and ask for multimillion dollar ransoms, which garners much more media attention.
Based on the way Virlock spreads the ransom amount it demands, it is likely designed to target consumers or home users.
After infection, Virlock hides the file extension through modification of the registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = 1, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = 2).
The encrypted file icon will look the same as usual, but after opening the infected file, the ransom note will pop up.
Virlock uses, but isn’t limited to, PDF, DOC, PPT, JPG, BMP,GIF, RAR, 7Zip, Zip and EXE files.
Figure 6 is a screenshot of a recently captured Virlock ransom note.
The attacker asked for $250 and required payment as 0.004 BTC (suggesting that at the time the ransom note was written, 1 BTC equaled approximately $62,500).