mrmoor/cyber-threat-intelligence huggingface dataset:
Patching of internal systems that might support lateral movement and privilege escalation should be prioritized, as well as against known public exploits that these actors might employ.
Although the commodity malware RedLine Stealer has been implicated for credential harvesting in some attacks, it’s unclear if this is first- or third-party, and it cannot be used as a definitive indicator of Lapsus$-specific activity.
Lapsus$ Group has made headlines recently for high-profile attacks, with an apparent goal of gaining notoriety.
They claim in some cases to have targeted organizations with the specific goal of gaining access to customers.
While referred to as a ransomware group in many reports, the Lapsus$ Group is more accurately called an attack group.
Most notably, their focus to date does not appear to have been on extortion and financial gain.
Even without extortion, the group’s attacks and leaks of stolen information can be damaging.
Because the group uses a diversity of techniques for attacks, no single technique can protect against Lapsus$ or detect its attacks.
Because of this, we recommend that organizations focus on observing general information security best practices as described in the Mitigation Actions section above.
Unit 42, together with researchers at Unit 221b, identified the primary actor behind the Lapsus$ Group moniker in 2021, and have been assisting law enforcement in their efforts to prosecute this group.
If you think you may be subject to an active attack or have an urgent matter, get in touch with the Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200.
Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available.  DEV-0537 criminal actor targeting organizations for data exfiltration and destruction A Closer Look
LAPSUS$
Data Extortion Group Lapsus$ Telegram channel: t[.]me/minsaudebr
Email address associated with Lapsus$ Group: saudegroup[at]ctemplar[.]com  Updated March 25, 2022, at 8:30 a.m. PT.
This post is also available in:      日本語 (Japanese)  LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.
Since its inception, the LockBit 2.0 RaaS attracted affiliates via recruitment campaigns in underground forums, and thus became particularly prolific during the third quarter of calendar year 2021.
The LockBit 2.0 operators claimed to have the fastest encryption software of any active ransomware strain as of June 2021, claiming accordingly that this added to its effectiveness and ability to disrupt the ransomware landscape.
While several top-tier RaaS affiliate programs, such as Babuk, DarkSide and REvil (aka Sodinokibi) disappeared from the underground in 2021, LockBit 2.0 continued to operate and gradually became one of the most active ransomware operations.
While Conti was recognized as being the most prolific ransomware deployed in 2021 per our 2022 Unit 42 Ransomware Threat Report, LockBit 2.0 is the most impactful and widely deployed ransomware variant we have observed in all ransomware breaches during the first quarter of 2022, considering both leak site data and data from cases handled by Unit 42 incident responders.
According to data analysis of ransomware groups’ dark web leak sites, LockBit 2.0 was the most impactful RaaS for five consecutive months.
As of May 25, LockBit 2.0 accounted for 46% of all ransomware-related breach events for 2022.
And the LockBit 2.0 RaaS leak site has the most significant number of published victims, with over 850 in total.
Additionally, LockBit 2.0 has affected many companies globally, with top victims based in the U.S., Italy and Germany.
Its most highly targeted industry verticals include professional services, construction, wholesale and retail, and manufacturing.
Palo Alto Networks customers receive protections against LockBit 2.0 attacks from Cortex XDR, as well as from the WildFire cloud-delivered security subscription for the Next-Generation Firewall.
(Please see the Conclusion section for more detail.)  LockBit 2.0 Overview Victimology Leak Site Data Unit 42 Incident Response Data on LockBit 2.0 LockBit 2.0 Tactics, Techniques and Procedures LockBit 2.0 Technical Details LockBit 3.0 Courses of Action Conclusion
Appendix A Additional Resources
LockBit 2.0 is another example of RaaS that leverages double extortion techniques as part of the attack to pressure victims into paying the ransom.
In some cases, LockBit 2.0 operators have performed DDoS attacks on the victims' infrastructure as well as using a leak site.
This practice is known as triple extortion, a tactic observed in groups like BlackCat, Avaddon and SunCrypt in the past.
Like other ransomware families such as BlackByte, LockBit 2.0 avoids systems that use Eastern European languages, including many written with Cyrillic alphabets.
Unlike other RaaS programs that don't require the affiliates to be super technical or savvy, LockBit 2.0 operators allegedly only work with experienced penetration testers, especially those experienced with tools like Metasploit and Cobalt Strike.
Affiliates are tasked with gaining initial access to the victim network, allowing LockBit 2.0 to conduct the rest of the attack.
LockBit 2.0 has been observed changing infected computers’ backgrounds to a ransomware note.
The ransomware note was also used to recruit insiders from victim organizations.
The notes claimed the threat actors would pay “millions of dollars” to insiders who provided access to corporate networks or facilitated a ransomware infection by opening a phishing email and/or launching a payload manually.
The threat actors also expressed interest in other access methods such as RDP, VPN and corporate email credentials.
In exchange, they offer a cut of the paid ransom.
LockBit 2.0 targets organizations opportunistically.
The operators work with initial access brokers to save time and allow for a larger profit potential.
While typically seeking victims of opportunity, LockBit 2.0 does appear to have victim limitations.
The group announced that they would not target healthcare facilities, social services, educational institutions, charitable organizations and other organizations that “contribute to the survival of the human race”.
However, despite these claims, there have been instances of affiliates undermining these guidelines by still opting to attack industry verticals such as healthcare and education.
Organizations in Europe and the U.S. are hit more often by LockBit 2.0 than those in other countries, likely due to the high profitability and insurance payouts.
During the first calendar year quarter of 2022, LockBit 2.0 persisted as the most impactful and the most deployed ransomware variant we observed in all ransomware breaches shared on leak sites.
According to leak site data analysis, LockBit 2.0 was the most impactful RaaS for five consecutive months.
As of May 25, LockBit 2.0 accounted for 46% of all ransomware-related breach events for 2022 shared on leak sites.
Additionally, the LockBit 2.0 RaaS leak site has the most significant number of published victims, with over 850 in total.
The site itself typically features information such as victim domains, a time tracker and measures of how much data was compromised.
LockBit 2.0 claims that they have demanded ransom from at least 12,125 companies, as shown in the figure below.
According to leak site data for LockBit 2.0, since its inception in June 2021, the RaaS has affected many companies globally, with top victims based in the U.S., Italy and Germany.  LockBit 2.0 has also impacted various victims across multiple industry verticals.
Its most highly targeted industry verticals include professional services, construction, wholesale and retail and manufacturing.
When looking at leak site data across all ransomware families, we’ve observed LockBit 2.0 targeting the highest number of organizations in the following regions: JAPAC, EMEA, and LATAM.
Cases handled by Unit 42 security consultants involving LockBit 2.0 since its appearance in June 2021 demonstrate shorter dwell times and less flexibility in negotiation in the beginning of FY 2022 (measured October-September) in comparison to the end of FY 2021.
The following data is broken into fiscal years and quarters based on when the threat actor breached the network, not when the activity was noticed by a client.
LockBit 2.0 has shown a decrease in dwell time in FY 2022.
From the last two quarters of FY 2021 to the first two quarters of FY 2022, there has been an average 37-day difference.
The difference in initial and final ransom demands over the past fiscal year has been converted to percentages and then averaged.
The graph below demonstrates that at the end of FY 2021, threat actors using LockBit 2.0 were much more open to negotiations of ransom amounts; during that time the ransom was dropped approximately 83% from the initial ask on average.
In comparison, we see less flexibility in FY 2022 Q1 and Q3 – threat actors only offered an average of about 30% as a price drop.
FY 2022 Q2 is not included due to lack of sufficient information.
Technically speaking, we have observed LockBit 2.0 affiliates leveraging the following tactics, techniques and procedures:  Windows SysInternals PsExec has been utilized for both persistence and execution purposes.
Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities.
LockBit 2.0 was developed using the Assembly and Origin C programming languages and leverages advanced encryption standard (AES) and elliptic-curve cryptography (ECC) algorithms to encrypt victim data.
It can affect both Windows and Linux OS, as the operator released a Linux version of LockBit 2.0 to target VMware ESXi hypervisor systems in October 2021, coded exclusively in the C programming language.
The LockBit group claimed that LockBit 2.0 is “the fastest encryption software all over the world” and provided a comparative table showing the encryption speed of various ransomware samples.  LockBit 2.0 also contains a self-spreading feature, clears logs and can print the ransom note on network printers until the paper runs out.  A management panel that affiliates can use to manage victims and affiliate accounts, generate new ransomware builds and generate the decryptor if the demanded ransom is paid also exists.
LockBit 2.0 operators also released an information-stealer dubbed StealBit, which was developed to support affiliates of the LockBit 2.0 RaaS when exfiltrating data from breached companies.
StealBit contains the following capabilities:
The operator of LockBit 2.0 has provided a comparative table speed showing the information stealer compared to other tools.
There was a bug that existed in LockBit 2.0 that allowed researchers to revert the encryption process on an MSSQL database.
After the bug’s disclosure, LockBit forum members discussed how the bug will not exist in LockBit’s next iteration.
Moreover, on March 17, LockBit forum members mentioned the release of LockBit’s next version in one or two weeks.
On March 25, VX underground posted a tweet with details of this new version, dubbed LockBit Black.
Several adversarial techniques were observed in this activity and the following measures are suggested within Palo Alto Networks products and services to ensure mitigation of threats related to LockBit 2.0 ransomware, as well as other malware using similar techniques:  Exploit Public-Facing Application [T1190], Command and Scripting Interpreter [T1059], Local Account [T1136.001], Web Shell [T1505.003], Exploitation for Privilege Escalation [T1068], Indicator Removal on Host [T1070], Deobfuscate/Decode Files or Information [T1140], Disable or Modify Tools [T1562.001], Hidden Window [T1564.003], Valid Accounts [T1078], External Remote Services [T1133], Scheduled Task [T1053.005], Bypass User Account Control [T1548.002], Group Policy Modification [T1484.001]  OS Credential Dumping [T1003], Credentials from Password Stores [T1555]  Network Service Scanning [T1046], Process Discovery [T1057], System Location Discovery [T1614], System Information Discovery [T1082]  Remote Services [T1021], SMB/Windows Admin Shares [T1021.002]  Remote Access Software [T1219]  Data Transfer Size Limits [T1030], Exfiltration Over C2 Channel [T1041]  Data Encrypted for Impact [T1486], Service Stop [T1489]  †These capabilities are part of the NGFW security subscriptions service
Note: This is not an all-inclusive list of the protections provided by Palo Alto Networks.
This is a subset of our current Courses of Action initiative and will be updated as the project progresses.
LockBit 2.0 and its evolution over time is a perfect example to illustrate the persistence, increasing complexity and impact brought by the ransomware landscape as a whole.
With claims of this RaaS offering the fastest encryption on the ransomware market, coupled with the fact that it has been delivered in high volume by experienced affiliates, this RaaS poses a significant threat.
LockBit’s continuation with operations and its next iteration coming up on the horizon means that organizations and their security teams need to stay vigilant in the ever-evolving threat landscape.
Palo Alto Networks detects and prevents LockBit 2.0 ransomware in the following ways:
If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:  Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.
In August 2021, a Russian blogger published a 22-minute interview with an alleged representative of the group behind LockBit 2.0 called “LockBitSupp” on a YouTube channel called “Russian-language open source intelligence (OSINT).”
The same Russian blogger previously published interviews with a representative of the group behind the REvil ransomware-as-a-service (RaaS), hackers and security experts.
Some key takeaways from the claims made in the interview were: LockBit 3.0: Another Upgrade to the World’s Most Active Ransomware Ransomware Groups to Watch: Emerging Threats Average Ransom Payment Up 71% This Year, Approaches $1 Million 2022 Unit 42 Ransomware Threat Report Highlights  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
On Saturday, Microsoft disclosed a critical vulnerability in Internet Explorer, CVE-2014-1776, affecting Internet Explorer versions 6 through 11.
The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated.
The vulnerability allows an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
This could be exploited with drive-by downloads or watering-hole attacks, and has been observed being used in attacks in the wild.
The exploit code used in these attacks only targets IE versions 9, 10 and 11, but earlier versions are still vulnerable.
As of this writing, Microsoft has not stated when a patch for the vulnerability will be available, but in its advisory the company provided multiple work-arounds.
Additionally, Windows XP systems running IE 6, 7 and 8 are also vulnerable, but will not receive a patch, as Microsoft no longer supports them.
It is always important to view this type of critical vulnerability in the larger context of the threat landscape.
Attackers identify thousands of critical vulnerabilities in commonly used software each year, such as Internet Explorer.
Once identified, they then craft a seemingly endless supply of exploits that leverage these vulnerabilities to deliver unknown malware and compromise networks and endpoints.
Palo Alto Networks enterprise security platform is focused on providing an integrated approach to detecting and preventing advanced threats across each step in the attack kill-chain.
Bringing together our next-generation firewall – again a Gartner Magic Quadrant Leader – Threat Prevention, URL Filtering, WildFire, and Cyvera’s ability to prevent exploitation of unknown vulnerabilities will allow us to continue offering ground-breaking protection for our customers’ networks and endpoints, including Windows XP clients.
This post is also available in:      日本語 (Japanese)  In March 2020 Microsoft released a security advisory, ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression, for a new remote code execution (RCE) vulnerability.
Shortly after this advisory was released, Microsoft issued an out-of-band patch to protect affected users from CVE-2020-0796.
An out-of-band patch is typically released outside of the expected update period for a vendor.
In this particular case, Microsoft is known to release updates on Patch Tuesday, which was two days prior to this out-of-band update.
This vulnerability exists within the Microsoft Server Message Block 3.0 (SMBv3), specifically regarding malformed compression headers.
Compression headers are a feature that was added to SMBv3 negotiate context request packets in May 2019.
For successful unauthenticated exploitation an attacker would need to craft a SMBv3 packet that contains the malformed compression header to a vulnerable SMBv3 Server.
For SMBv3 clients would require enticing a user to connect to a compromised SMBv3 server that they control.
This vulnerability only affects SMBv3 and the following builds of the Microsoft Windows operating system (OS):  Review the workaround guidance provided by the Microsoft Security Vulnerability.
Upgrade Cortex XDR and Traps agents for protection against this vulnerability regardless of whether your systems have installed the relevant security update from Microsoft.
For client mitigation, recommend creating an outbound firewall rule to block SMB outbound on public and private interfaces.
Palo Alto Networks Cortex XDR and Traps provide protection against this vulnerability regardless of whether they are running on an unpatched instance of Microsoft Windows 10.
Additionally, Palo Alto Networks offers multiple, additional complementary protections for this exploit.
This post is also available in:      日本語 (Japanese)  Around 6:00 am PST on September 24, the details of a vulnerability in the widely used Bourne Again Shell (Bash) were disclosed by multiple Linux vendors.
The vulnerability, assigned CVE-2014-6271 by Mitre, was originally discovered by Stephane Chazelas, a Unix and Linux network and telecom administrator and IT manager at UK robotics company SeeByte, Ltd.
While this vulnerability didn’t come with quite the fanfare or a catchy name like Heartbleed, the security community quickly dubbed it “Shellshock.”
Bash is present in most Linux and Unix distributions as well as Apple’s Mac OS X, and there’s a good chance anyone reading this has a system they need to patch.
Palo Alto Networks initiated an emergency IPS content release to detect this vulnerability last night with Signature ID: 36729 "Bash Remote Code Execution Vulnerability.”
All versions of PAN-OS and Panorama include the vulnerable version of Bash, but we’ve determined the issue is only exploitable by authenticated users.
Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.
We have posted the advisory on our product vulnerability page.
Read on for more details.
Vulnerability Details  CVE-2014-6271 exists in all versions of Bash and is related to how environment variables are processed when the shell starts up.
Environment variables are used by shell software to store pieces of information like the location of the user’s home directory.
In addition to storing variables, Bash allows for storing shell functions in variables that users can call later.
It’s in parsing these functions that the new Bash vulnerability exists, as the shell mistakenly executes code that is added after a function definition.
Here’s an example:  $ env x='() { :;}; echo vulnerable'
bash -c "echo this is a test"
vulnerable  this is a test
Bash should stop processing the environment variable “x” after the closing semicolon for the function, but instead continues to process “echo vulnerable”.
At first glance, this might not seem too dangerous as executing commands is Bash’s primary function, but it’s important to understand that many other programs use Bash to process commands.
While these two scenarios are currently the most-likely vectors for exploiting this vulnerability, it’s likely that other services use Bash in a network-exploitable way.
The only way to fully prevent exploitation is to upgrade Bash on the system to a non-vulnerable version.  Impact
The good news is that this vulnerability was disclosed responsibly and patches are available for most platforms on the day of the public disclosure.
The bad news is that this vulnerability is going to have a very long tail.
Bash is the default shell for the most-popular Linux variants and every version of the software stretching back over two decades is vulnerable.
Well-maintained systems will be patched today, but that dusty old system in the networking closet might never get the update.
Additionally, network devices, embedded systems and Internet-connected devices (like IP Cameras) often run Linux and could be vulnerable.
Fortunately, not every system is remotely exploitable simply because it’s running Bash, it also needs to be running an application which makes Bash accessible over the network.
As described above, the most-common exploit scenario seems like it will be web servers running Apache and using CGI scripts.
Web servers are great resources for attackers.
They can be used to:  These are all likely outcomes from mass scanning of the Internet for vulnerable hosts, which are already underway.
Recommendations  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
On January 2, 2017, one Bitcoin was worth US $985.56.
By October 16, 2017, that same Bitcoin was worth US $ 5,707.40: a 579% increase in value in ten and a half months.
By comparison, Ethereum has gone from US $8.15 per ether on January 2, 2017 to US $342.83 per ether on October 16, 2017: a jump of 4,206%.  Cryptocurrencies are big money these days and seemingly getting bigger by the day.  And if we’ve learned one thing about cybercriminals, they follow the money.
So, it’s not surprising to see that cybercrime is turning its attention to cryptocurrencies.
In our latest research, “Unauthorized Coin Mining in the Browser”, Unit 42 researchers show how cybercriminals have taken an old tactic, hijacking web browsers without the users consent or knowledge (commonly called a “drive -by attack”), and adapted it to make money in the increasingly lucrative cryptocurrencies markets.
Before, drive-by attacks focused on abusing a browser’s legitimate download capabilities to download malware onto the victim’s system without their consent or knowledge.
These new drive-by attacks focus on hijacking the computational resources of the victim’s computer to “mine” cryptocurrency on behalf of the attackers.
The focus of these attacks is to use the victim’s web browser to access the computational resources of their system.
The attackers accomplish this through abuse of a legitimate tool by placing it on malicious or compromised websites and running it in the victim’s browser without his or her consent or knowledge when they visit the site.
The tool is designed to “mine” cryptocurrencies, that is it earns credit in the cryptocurrency in exchange for computing power that is used to power the cryptocurrencies’ digital infrastructure.
This tool has a legitimate use: sites can and do notify users that they’re using the site visitors’ resources in this way to support the site, typically as a substitute for ads on the site.
But in this case, the attacker actually gets the credit that the victim’s computational resources earns without the visitors’ consent or knowledge making it a malicious attack.
Put simply, the net result is that the victim’s computer slows down (sometimes significantly) while on the malicious or compromised website.
And while the computer is impacted like this, the attacker is earning money.