mrmoor/cyber-threat-intelligence huggingface dataset:
This post is also available in:      日本語 (Japanese)  CTB-Locker is a well-known ransomware Trojan used by crimeware groups to encrypt files on the victim's endpoints and demand ransom payment to decrypt the files back to their original state, but most antiviruses detect it by mistake as CryptoLocker (only one vendor correctly detects it as CTB-Locker).
The attack vector is very basic and repeats itself: It begins with a spear phishing email sent with SCR attachments (double zipped).
Once executed by the user the first stage malware downloads and executes the ransomware from a fixed hardcoded server list.
The first known campaign was launched by Crimeware on November 2014.
The first stage downloaded the ransomware from these sites:
A very serious campaign was launched between January 19, 2015 and January 20, 2015, and  Palo Alto Networks Enterprise Security Platform has discovered more than 1000 unique attacks since.
The attacker used a polymorphic malware builder to generate malware with a unique hash for each victim, preventing signature-based solutions from detecting the new attacks before it was too late for the victim.
This tactic is a nightmare for legacy security products that are based on legacy techniques such as bytes signatures, since they can only detect attacks after the damage is done instead of preventing it as a true solution should.
Palo Alto Networks Enterprise Security Platform offers multilayer protection to prevent this attack along with other attacks without the need for prior knowledge of the specific attack.
We can see here that server hostnames were changed but they didn’t change the server IP address – see the attached file with results for files from last week’s campaign from VirusTotal.
Most legacy security programs could not detect this malware at the time it was posted.
If you re-test these hashes again from last week you can see an average of 49/57 engines that detect last week’s threat – but that’s too little, too late for anyone who already lost data.
This campaign started earlier today, and the malware uses the same techniques and even the same IOCs:  And only added two new hostnames:
By now you shouldn’t be surprised that one of them is on the same known malicious IP address.
We found 147 new unique pieces of malware today alone, two of them fully undetectable by the legacy security solutions in VirusTotal and most of them barely detected by one vendor (few have 4/57 detection rate).
See below:
So basically you have two choices:
The most surprising fact about this campaign is that almost all the IOCs haven’t been changed:  For those still using legacy solutions we’ve attached two lists of SHA256 hashes in a text file format for reference.
One list shows the new campaign, which continues to progress.
The other list is of last week’s campaign by the same attackers (exhaustive or close to it).  Palo Alto Networks Enterprise Security Platform would have stopped this ransomware attack campaign thanks to the platform’s unique integration between the network, endpoint and the cloud to maximize security.
Attacks aren't getting any less sophisticated, so it is time to leave legacy security solutions behind and upgrade to real, prevention-based security.
Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Please mark, I'm not a robot!
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.
This post is also available in:      日本語 (Japanese)  Over the past six months, we’ve seen a major increase in the number of attack campaigns with the ultimate goal of mining cryptocurrency.
It’s a subject Unit 42 has been tracking in the past year:
So, what is driving a widespread shift from attackers and creating a significant trend in the industry?
There are three factors at work:
To answer the question in more detail, it’s important to put yourself into the criminal’s shoes and consider what alternative routes they have to monetize infections.
In this brief, we’ll share how this trend came to fruition, why it’s so prevalent, and how security professionals and defenders can keep an eye out for this rising type of threat.
How Attacks Monetize Infections
While targeted attacks gain the most attention from researchers and media, the majority of malware infections are untargeted and even indiscriminate.
Instead of seeking out specific targets, many criminals aim to infect as many systems as possible and then turn those infections into cash.
This has been true for over a decade, although the mechanisms available to criminals have shifted in that time.
To understand where we are now, it helps to look at how we got here, and to look at the evolution of common cybercriminal activities.
Back in the early 2000s, some of the earliest “botnet herders” made their income by relaying spam emails through infected computers.
Over time, that business became less profitable due to anti-spam controls and ISPs preventing infected systems from directly relaying emails.
In the mid-2000s, criminals made great profits from using Banking Trojans to steal credentials for online banking websites, and subsequently draining the accounts’ associated funds.
This account takeover activity continues today, but various anti-fraud measures and law enforcement actions have made it less profitable and riskier for criminals.
Another aspect of Banking Trojan infections is that, while the criminal may be infecting hosts indiscriminately, the value of the host greatly depends on the individual who owns it, and the criminals’ ability to “cash out” their bank account.
Figure 1 is a capture from a book I wrote with some colleagues in 2008, “Cyber Fraud: Tactics, Techniques, and Procedures.”
It shows the price that a criminal enterprise called IFRAME DOLLARS was charging to infect computers in various countries at that time.
Figure 1: Capture from Cyber Fraud: Tactics, Techniques, and Procedures showing prices of host infections by country.
In 2007, the infection of a system in Australia went for US$0.60, while an infection in Poland was only a fraction of the cost, at US$0.096.
The difference in price represented the difference in value: criminals were able to make more money through a Banking Trojan account takeover from an Australian infection than they could in Poland.
As anti-fraud protections evolved, so did the criminals.
Fast forward five years to 2013 and the rise of the Ransomware business model
This new way to generate profit had two major advantages over account takeovers:
Put another way, the ransomware model represented both increased efficiency and decreased risk in monetizing the infection.
Anyone who’s been paying attention to cybercrime since 2013 is aware of the ransomware surge, infecting systems throughout the world and plaguing networks’ administrators.
While only a tiny fraction (possibly 1 in 1000) of systems infected with a banking Trojan pay out for attackers, a much higher portion of ransomware victims pay to get their files back.
While US$300 payments are less than a single account takeover could return, ransomware makes greater returns due to the volume and decreased risk in this new business model.
Cybercriminals have become good business people: they saw the benefits and embraced the change.
Enter “The Bubble” – Where We Are Now
In the last two years, but particularly in the last six months, the price of bitcoin and other cryptocurrencies experienced a massive price surge with respect to the U.S. dollar and other fiat currencies.
Here’s the chart for bitcoin over the last two years, showing a rise of 2,000% to 4,000% in the versus the U.S. dollar.
Figure 2: Price of bitcoin in U.S. dollars from CoinMarketCap  While botnets mining cryptocurrency is nothing new, the technique was much less profitable than using ransomware.
In fact, with the rise of specialized bitcoin mining hardware, no regular PC can make any significant amount of money for an attacker.
However, there are many other “crypto coins” in the market today.
The one we see mined most by attackers is called Monero.
In contrast to bitcoin, Monero was designed to enable private transactions using a closed ledger, and its mining algorithm is still mined effectively by both PC CPUs and GPUs.
As the chart below shows, Monero has risen even faster than bitcoin in price in the last two years, with more than a 30,000% gain in U.S. dollars.
Figure 3: Price of Monero in U.S. dollars from CoinMarketCap
A normal PC used to mine Monero can earn around US$0.25 per day at the current prices.
That number is small, but it’s important to note that it doesn’t matter what country or network a Monero miner is part of: computers in Australia and Poland mine at the same speed.
Every infected system is a profit-generating resource when mining Monero, and users are much less likely to identify their infection and remove the mining program than they would be with ransomware.
For context, in January, we found a Monero mining campaign that infected around 15 million systems, largely in the developing world.
If these systems remained infected for at least 24 hours each, the attackers could have earned well over 3 million U.S. dollars in Monero.
Additionally, the risk of arrest and conviction is significantly lower than with ransomware, as mining cryptocurrency is less likely to generate reports to law enforcement than a data-destroying ransomware infection.
What’s Next?
This wave of attacks will continue as long as it maintains a high level of profitability with a low level of risk for cybercriminals.
For defenders, it’s important to note that the techniques used to infect systems with coin mining malware are the same as they were for ransomware.
Infections typically begin with emails carrying malicious macro documents, drive-by exploit kits targeting browsers, or direct attacks on servers running vulnerable software.
There is no single solution to stopping these attacks, but the same technologies and policies you use to prevent other malware infections will be effective.
Across the changing landscape of botnet herders, Banking Trojans, ransomware and coin mining is one constant: the business-savvy drive to maximize profit and reduce risk.
Using these as our guide, we can make sense of where we are today, how we got here, and be prepared for what has yet to develop in the future.
Here are three things to watch for:
1. A marked increase in the price of Monero or other cryptocurrencies will draw even more attackers into this business.
For many users, this could actually be a positive development, as the negative impact of having resources sapped from one’s computer is much less than paying a ransom or restoring your system from a backup due to ransomware.
Conversely, a crash in the price of cryptocurrencies will decrease the profitability and drive criminals back to ransomware.
2. Listen to your fans or keep an eye on your CPU usage.
Many users realize their system is infected with coin mining malware when their laptop fans kick into high-speed mode to keep the overtaxed CPU cool.
Listening to fans won’t work at the enterprise scale, but implementing widespread CPU performance monitoring could be a good way to find compromised devices.
This will also help you identify the coin mining “insider threat,” as misguided administrators may see their organizations’ unused CPU time as a way to generate personal income.
3. Criminals will find ways to target these attacks.
Compromising a user’s browser or a regular home PC will net the criminal an average system for mining coins, but higher-end systems will generate more income.
Attackers will soon begin targeting devices with higher specifications to get more bang for their buck.
Gaming PCs with high-end GPUs and servers with large numbers of processing cores will be prime targets.
Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.
It’s that time of year again – our researchers have analyzed and reviewed the threats and attacks that occurred during the first half of 2021.
Our report, Attacks From All Angles: 2021 Midyear Security Roundup, highlights many of the active attacks we saw, from APTs to ransomware to zero-day exploits.
I’d like to highlight an area where we are seeing increased activity: attacks against cloud infrastructures.
I’ve spoken on this at a few events and asked my audiences how many have active cloud infrastructure projects going on, the answer is always most of them.
In our 1H’ 2021 Cyber Risk Index, we asked organizations what their top infrastructure risks are.
Cloud security has been in the top two for the last few years.
Obviously, many organizations are moving quickly to the cloud and, as such, need to be thinking about how to secure it.
Below is an overview of what we’re seeing in cloud attacks.
Threats Impacting Cloud Environments
In our first half report, we highlight an APT group named TeamTNT that has been targeting clouds for quite a while now.
They have focused most of their efforts on planting crypto-mining malware on cloud servers in an effort to mine Monero coins, but we have also seen them utilize DDoS IRC bots, steal cloud account credentials, and exfil data.
As you can see from the above diagram, all of these are end goals for most attacks.
Speaking of data exfil, in the first half we saw APT actors utilize cloud-based file storage to exfiltrate their stolen data.
For example, we found that Conti operators use the cloud storage synchronization tool Rclone to upload files to the Mega cloud storage service.
Similarly, DarkSide operators used Mega client for exfiltrating files to cloud storage, 7-Zip for archiving, and PuTTY application for network file transfers.
This use of known, legitimate tools is not new; we call that “living off the land” and have seen this tactic pick up recently, including usage by ransomware actors.
Many organizations now need to look at ways of monitoring legitimate tools usage within their networks to identify any malicious uses.
Cloud Security Architecture
When developing your cloud security architecture and strategy, it is important to always keep the ends in mind.
In this case, what are the motivation and end goals of an attacker?
As you see in the image above, most cloud attacks are going to fall into one of these areas.
Depending on what you are doing as part of your cloud infrastructure, you should be able to identify if any or all of these end goals could be targeted in your environment.
From there, you can work backwards to develop your strategy for protecting those initial access areas tied to the different attacks.
A challenge many organizations face is that the cloud isn’t simple, and many of the technologies that make up the cloud are new, with new features being deployed all the time.
Understanding how these work and – more importantly – how to secure them can be very difficult.
Utilizing a security platform approach can help build your cloud to be more secure, but educating your architects and administrators will also help.
One key area is hardening your cloud account credentials, as these will be regularly targeted by malicious actors.
Using multi-factor authentication to access all accounts can minimize this risk tremendously.
Take a look at Trend Micro Cloud One, part of our complete cybersecurity platform, to learn more.
The cloud is only one aspect of our full 1H 2021 report.
To get more details on all the different threats and attacks we observed, download and read the full report here.
Tags  Cloud | Cyber Crime | Expert Perspective | Cyber Threats | APT & Targeted Attacks | Network | Articles, News, Reports
Cybercriminals have embraced the anonymous nature of cryptocurrency as a new preferred method of profit.
Unit 42 released details about attackers hijacking web browsers to mine for compute resources and exchange for cryptocurrency.
With the increasing value of cryptocurrency, such as bitcoin and Ethereum, and a better business model with higher returns than malware- and exploit-type attacks, it’s no surprise these types of attacks are becoming more commonplace.
Cybercriminals will compromise a website and abuse a legitimate tool on that site to gain access to the compute resources of site visitors’ systems.
Using this access, attackers will essentially steal compute resources and exchange them for cryptocurrency credit.
This all occurs without the users’ consent or knowledge throughout the duration of their site visits.
The malicious activity itself doesn’t cause long-term damage to systems, and ends as soon as users leave the malicious or compromised site.
Additionally, the site will still provide users with its normal, intended functionality.
However, users likely experience a noticeable slowdown in system performance.
If you believe your system is being affected by this type of attack, leaving the site or closing your browser will, in most cases, end the attack.
Additionally, you should practice good cybersecurity hygiene.
This means avoiding unfamiliar websites, clicking on links or downloading attachments from unknown email senders, keeping products updated with the latest security patches, enabling multi-factor authentication, and using reputable security products.
Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!
This post is also available in:      日本語 (Japanese)
In our updated report on ransomware from Unit 42, “Ransomware: Unlocking the Lucrative Criminal Business Model,” Unit 42 researcher Bryan Lee notes: “In 2016, it was thought that there were less than one hundred active ransomware variants out in the wild.
Today, the number of total ransomware variants at least over 150, if not hundreds more.”  It’s reasonable to ask why ransomware continues not only to exist but to thrive.
The first answer to this, as we’ve outlined in our report, is that ransomware is a lucrative cybercriminal business model.
However, in addition to the human factor, there are technical reasons.
Specifically, there are three things that combine to make ransomware a particularly potent threat on the technical level:
In some ways, these three points state the obvious.
But the full ramifications and why these make ransomware hard to stop aren’t always discussed.
The way ransomware works is well documented, but let’s recap here.
Ransomware is downloaded to a user’s system and executed on it.
The way the attackers get the ransomware on the system varies: it can be through unpatched vulnerabilities, social engineering or both.
The most common way ransomware operators levy attacks is through email or by web browsing to malicious or compromised sites.
The overwhelming majority of ransomware attacks are against Microsoft Windows systems.
Once malware is running on the user’s system, it seeks out and encrypts files and folders that hold information critical for the user, such as documents, business applications or even database files.
In some cases, the ransomware is sophisticated enough to target specific application files.
Most importantly, because the ransomware is executing with the compromised user’s privileges, any file the legitimate, now-compromised user has access to, including network shares and backups, is fair game for the ransomware.
It’s this last point that gets to the heart of why ransomware is so potent.
From an operating system point of view, the ransomware IS the user.
Even though Microsoft Windows today features a robust user access control system, that system has inherent limitations.
In the early days of Window Vista, Microsoft enabled aggressive security checking to ensure user-initiated actions were legitimate.
This was well-intentioned but ultimately backfired: users got fed up clicking “Are you sure?” dialog boxes and quickly disabled the feature, or just mindlessly clicked “OK” every time they saw it.
Microsoft made reasonable adjustments so that these alerts are now raised sparingly.
Although that feature was never enabled to protect user data files like ransomware targets, there is a clear lesson from the experience: too many security checks on user activity fails in the end.
Bringing that lesson to bear here, the only way the operating system could protect against ransomware would be to raise “Are you sure?” dialog boxes on everyday operations against the kinds of files that ransomware targets.
And this is where the second point comes to bear.
Unlike other forms of malware, ransomware is very specific in its targeting.
It goes after the files users are most likely to care about.
These also happen to be files users are most likely to use on a day-to-day basis or that are critical to an organization’s operations.
Extra layers of protection for those files would be incredibly onerous.
Imagine having to click through “Are you sure?” dialog boxes for every document or picture you opened in a day.
From an engineering point of view, this sole, specific targeting of files that matter significantly increases the chances of ransomware’s success.
This brings us to the third point: there is little attack time wasted on files that don’t matter to the victim.
Even a successful ransomware attack that is halted early by security software will achieve some level of damage – enough to make the victim consider paying the ransom to get the files back.
If user32.dll were encrypted and unusable, it would be a problem.
But when your organization’s overall accounting and audit report is inaccessible right before the big deadline, that’s catastrophic.
The net of these three points is that ransomware is a threat such that focus needs to be placed solely around prevention.
There is no effective solution for ransomware at the operating system level, as outlined above.
And unlike other attacks, ransomware attacks can’t succeed “just a little.”
In some cases, a single file lost is more than enough to count as a fully successful attack.
In some ways, ransomware is a threat unlike any other.
Its impact and scope are both broad and deep in ways that are unique.
Because of that, from a risk assessment point of view, ransomware needs to be put in a class by itself – a class that acknowledges that the risks from a successful attack of any kind are very high.
Over the past several weeks, Russia-Ukraine cyber activity has escalated substantially.
Beginning on Feb. 15, a series of distributed denial of service (DDoS) attacks commenced.
These attacks have continued over the past week, impacting both the Ukrainian government and banking institutions.
On Feb. 23, a new variant of wiper malware named HermeticWiper was discovered in Ukraine.
Shortly after, a new round of website defacement attacks were also observed impacting Ukrainian government organizations.
Consistent with our previous reporting on the topic, several western governments have issued recommendations for their populations to prepare for cyberattacks that could disrupt, disable or destroy critical infrastructure.
We have already observed an increase in Russian cyber activity, which we reported on in our initial Threat Brief published last month and our recent report on the Gamaredon group.
Future attacks may target U.S. and Western European organizations in retaliation for increased sanctions or other political measures against the Russian government.
We recommend that all organizations proactively prepare to defend against this potential threat.
This post was substantially updated on Feb. 24 to add information on the recent DDoS attacks, HermeticWiper malware and website defacement; update our recommendations for how organizations should prepare for potential cyber impact; and provide additional details for our customers and clients on how we can help.
This post was substantially updated March 31 to add information on phishing and scam attacks, cybersquatting trends, fake donation websites, DoS attacks on Ukrainian news sites and distribution of malicious binaries.
Full visualization of the techniques observed, relevant courses of action and indicators of compromise (IoCs) related to this report can be found in the Unit 42 ATOM viewer.  We will continue to provide updates with new information and recommendations as they become available.