Month: April 2017
Apr 11, 2017 | Email & Web Spam, Industry News, Internet Security
A new variant of Stampedo ransomware – called Philadelphia ransomware – is being used in targeted attacks on the healthcare sector in the United States. The ransomware variant is being spread using spear phishing emails.
Spear phishing emails have been detected that incorporate the healthcare organization’s logo along with the name of a physician at the organization. The use of a logo and a name adds credibility to the email, increasing the likelihood of the targeted individual clicking the link and downloading the malicious file. Information about organization’s and details of potential targets can easily be found on social media websites such as LinkedIn.
Cyber security firm Forcepoint analyzed Philadelphia ransomware and detected a string called “hospitalspam” in the encrypted JavaScript. A similarly named directory was also found on the ransomware C2, suggesting a campaign is being conducted that specifically targets the healthcare sector. Forcepoint reports that two hospitals – one in Oregon and one in Washington – have already been infected with the ransomware.
In recent months, cybercriminals have favored email attachments for spreading ransomware and malware, with Word documents containing malicious Word macros one of the most popular methods of ransomware and malware infection. The latest campaign, which was identified by Forcepoint, also uses malicious Word documents. However, rather than sending a malicious Word document as an attachment, the emails contain a link to a website where the Word document is automatically downloaded.
As with email attachments, the document must be opened and macros enabled in order for the ransomware to be downloaded.
Philadelphia Ransomware Attacks Likely to Increase
Philadelphia ransomware attacks are likely to increase thanks to a professional affiliate campaign. Would-be attackers are being recruited using a video that highlights the many features of the ransomware. The video calls Philadelphia ransomware “the most advanced and customizable ransomware ever,” and shows just how easy it is for someone with little technical skill to start their own ransomware campaign.
Would-be cybercriminals are able to rent out the ransomware and use it for their own spamming campaigns, provided they pay the author an initial fee of around $400. The one-off payment, so the authors claim, gives a user lifetime use of the ransomware. Affiliates will then be given a cut of any ransom payments they are able to generate.
Affiliate campaigns such as this – known as ransomware-as-a-service – are becoming increasingly popular. They allow non-technical spammers to jump on the ransomware bandwagon and start generating ransom payments. There is likely to be no shortage of takers.
Fortunately, the ransomware is not as advanced as the promotional video makes out. Furthermore, a decryptor for Philadelphia ransomware has been developed and can be downloaded for free via Softpedia. No ransom needs to be paid, although infection with Philadelphia ransomware can still result in considerable disruption. Healthcare organizations should therefore be on their guard.
Apr 6, 2017 | Web Filtering
Anti-pornography legislation in Alabama could be introduced from January 1, 2018, following the introduction of a new bill last month. House Bill 428 was introduced by Jack Williams (R-Montgomery) to prevent state residents from using Internet-enabled devices to view obscene material.
The anti-pornography legislation classes obscene material as material that would, to an average person, appeal to prurient interest. Pornography, child abuse images and child pornography are included in the definition of obscene content, as is any other material that depicts patently offensive sexual conduct or excretory functions, lacks artistic, political or scientific value, or facilitates or promotes prostitution, sexual cyber-harassment or human trafficking.
If the anti-pornography legislation is passed, the sale of any Internet-enabled device without a web filtering solution in place would be classed as a Class A misdemeanour and would be punishable with a maximum fine of $6,000 per incident and up to one year in jail. However, should such a device be sold to a minor, the offense would increase to a Class C misdemeanor for which the fine would rise to a maximum of $30,000 per incident and a jail term of up to 10 years.
While an Internet filtering solution must be in place at the point of sale, it would not be an offence for the purchaser of the device to remove the filter, provided a request is submitted to the seller in writing, proof that the individual is over 18 years old is supplied and a one-time filter deactivation fee of $20 is paid.
The fees will be collected by the Department of Revenue. 60% of the fees will be directed to the Alabama Crime Victims Compensation Fund, 20% will be directed to grants programs which will in part, be devoted to helping victims of human trafficking, with the remaining 20% of fees deposited in the General State Fund.
It is unclear at this stage how vendors of Internet-enabled devices would ensure that their devices are protected. The legislation describes a filter as a hardware or software solution that can be used to block websites, email, chatrooms, or other Internet-based communications based on category, content or site. The type of filter used will be left to the discretion of the seller.
Since there is a possibility that webpages or websites may be incorrectly categorized, the solution would also require a mechanism that allows websites or content to be blocked or unblocked. The vendor would be required to supply a phone number to a call center to allow requests to block/unblock content to be submitted. Failure to act on those requests in a reasonable time frame would be punishable with a $500 fine for each failure to block an obscene website or webpage.
Alabama is not the only state to propose anti-pornography legislation. Similar bills have also been introduced in New Mexico, North Dakota and South Carolina.
Apr 5, 2017 | Cybersecurity News, Email & Web Spam, Network Security, Web Filtering
Researchers have identified changes to the Sundown exploit kit. Sundown is now in transition and is being actively developed. It now poses a significant threat.
Exploit kit activity has fallen over the past year as cybercriminals have turned to other methods of infecting end users. Spam email is now favored by many cybercriminals and exploit kit activity has dropped to next to nothing. However, over the past few weeks there has been an increase in exploit kit activity, with the Sundown exploit kit fast becoming a major threat.
Researchers at Cisco Talos report that the Sundown exploit kit has been upgraded and has now matured. While it was once a relatively unsophisticated exploit kit, that is no longer the case. The researchers point out that Sundown is likely to become one of the most widely used exploit kits, taking the place of the larger exploit kits that were used extensively in early 2016.
A number of upgrades have been made to the Sundown exploit kit in recent weeks. The individuals behind the Sundown exploit kit have removed many of the identifiers previously associated with the exploit kit. The exploit kit is now much harder to identify.
The Sundown exploit kit is one of a very small number that have had new exploits added in recent months. Some of the old exploits have also been removed. The actors behind Sundown have also increased the likelihood of infection. In a recent alert, Cisco Talos researchers explain that the exploit kit does not attempt to gain access to a system via a single exploit, instead the Sundown EK uses an extensive arsenal of malware tools to maximize the chance of compromising a system.
While the payload used to be downloaded via the browser, now the exploit kit uses the command line and wscript. A change has also been made to how the malicious payload is downloaded. The payload is now located on a different server to the landing page and exploit kit. The same root domain is used for both, although the subdomains are different.
The actors behind the kit are also purchasing large numbers of established domains, typically domains that are more than 6 months old. Those domains are used for a short time and are then resold. Using older domains allows the attacker to bypass screening controls that blacklist recently registered domains.
The discovery of major updates made to the Sundown EK could indicate there will soon be a major increase in exploit kit attacks. Angler, Neutrino, and Nuclear may have virtually disappeared, but exploit kits still pose a significant threat.
Businesses can protect their endpoints from malware and ransomware infections via exploit kits by using a web filtering solution. A web filtering solution can be configured to carefully control the websites that can be accessed by end users to reduce the risk of infection, and domains known to host exploit kits can be blocked.
For further information on web filtering and protecting end points from malware and ransomware, contact the TitanHQ team today.
