Phishing Campaigns During COVID-19.

During the COVID19 pandemic number of phishing campaigns extremely increased.

Here are the most “popular” email subjects used in phishing campaigns in 2020:

1.     Password change/check required

2.     COVID-19 Awareness/News

3.     Vacation Policy Update

4.     Rescheduled meetings due to COVID-19

5.     Coronavirus Stimulus Checks

6.     Fedex Tracking

7.     Zoom: Restriction Notice Alert

8.     Jira: [JIRA] A task was assigned to you

9.     Your meeting attendees are waiting

10.  Microsoft: Abnormal log in activity on Microsoft account

11.  IT: ATTENTION: Security Violation

Hope you weren’t part of them! Enforce security awareness in your company!

Critical Android Vulnerabilities are Patched by Google.

Few critical remote code execution vulnerabilities are addressed in the July update.

The most severe flaws allow attackers to execute code with high privileges using a special file. One of them is impacting Android 8.0+ (CVE-2020-0224), another affects Android 10(CVE-2020-0225).

Another critical flaw in Android 10(CVE-2020-0107) is an information disclosure vulnerability.

In addition to critical flaws Google is patching bunch of high severity issues, such as privilege escalation in the framework, issues in WLAN and Qualcomm kernel.

Lucifer Malware Targeting Windows Machines.

New self-propagating malware, named Lucifer, was discovered recently. Malware targets Windows machines with cryptojacking and DDoS (distributed denial-of-service) attacks.

Malware is trying to find and exploit unpatched vulnerabilities. Some of them were Microsift Windows (CVE-2017-0144, CVE-2017-0145, CVE-2017-8464), Rejetto HTTP File Server (CVE-2014-6287), ThinkPHP RCE (CVE-2018-20062), Apache Struts (CVE-2017-9791), Lavarel Framework (CVE-2019-9081).

After exploiting, attacker connects to the C2 (command-and-control) server and executes arbitrary commands (TCP, UDP, HTTP DoS attack etc.).

Malware is self-propagating. It uses brute-force technique on the open TCP ports or Remote Procedure Call to get in. When in, Lucifer uses Certutil.exe command-line program to propagate itself.

Over 100 malicious Google Chrome extensions were removed.

111 Google Chrome extensions were identified as malicious by cybersecurity company Awake Security. Awake team said that extensions were able to take screenshots, read the clipboard, steal user’s passwords and authentication cookies bypassing Chrome Web Store. Identified extensions were downloaded more than 32 million times, according to Awake.

Source and developers of these findings are unknown but Awake team assumes they can be developed by the same cybercriminal based on the similarities in the codebase.

Google deactivated 106 malicious extensions in Chrome and warned their customers.

Thanos: Ransomware-as-a-Service.

Thanos, Ransomware-as-a-Service(RaaS), a tool discovered to use RIPIace tactic which allows hackers to bypass anti-ransomware protection, becomes very popular. Appeared as Quimer ransomware in 2019, then Hakbit in 2020, Thanos has being promoted as a RaaS on Russian hacker forums during the last few months. A number of attacks used Thanos increased in 2020 comparing with 2019. Let’s see how it will reflect on security updates from different anti-ransomware vendors.

OSS Vulnerabilities: 2019 vs 2018.

According to the RiskSense report, a number of OSS vulnerabilities increased from 421 CVEs in 2018 to 968 in 2019.  The study also confirmed that it takes much longer to report and add these vulnerabilities to a National Vulnerability Database (NVD). It creates a risk for companies which continue to use the open-source resources.

The most CVEs were found in the Jenkins automation server (646) and MySQL (624).

The most common types of weaknesses are XSS (Cross-Site Scripting) and Input Validation, but much more types were reported as less common, such as Deserialization, Error Handling etc.

The blocklist for more than 26000 COVID-19 threats was released.

COVID-19 Cyber Threat Coalition has released a blocklist of URLs and domains related to coronavirus phishing campaigns, scams and malware threats.

This volunteer organization was created in March 2020 trying to inform about new threats and attacks associated with COVID-19. It contains of cybersecurity professionals, cyber intelligence firms, antivirus vendors and large corporations.

The current URL blocklist contains more than 13000 malicious URLs that and domain blocklist contains more than 12000 malicious domains and hostnames.

Simple users and companies can “feed” these lists to firewalls or secure gateways.

Both lists are refreshed every 10 minutes so users will always stay updated with the latest threats.

COVID-19: Android Device Screen-Locking Malware.

Researchers at Bitdefender discovered that well known Android screen-locking malware SLocker was packaged in the “About Coronavirus” application targeting users in Russia, Ukraine, Kazakhstan, part of North Africa and India.

Downloaded from third-party sites the app locks Android device screen asking for the payment to restore proper functionality. The notification gives victim only 20 min until phone will become unusable.

Previously DomainTools researchers already reported similar scam application offered users a COVID-19 statistics. This malware may be related to SLocker as well.