Australian health insurer Medibank today confirmed that personal data belonging to around 9.7 million of its current and former customers were accessed following a ransomware incident.
The attack, according to the company, was detected in its IT network on October 12 in a manner that it said was “consistent with the precursors to a ransomware event,” prompting it to isolate its systems, but not before the attackers exfiltrated the data.
“This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers, and around 1.8 million international customers,” Medibank noted.
Compromised details include names, dates of birth, addresses, phone numbers, and email addresses, as well as Medicare numbers (but not expiry dates) for ahm customers, and passport numbers (but not expiry dates) and visa details for international student customers.
It further said the incident resulted in the theft of health claims data for about 160,000 Medibank customers, around 300,000 ahm customers, and around 20,000 international customers.
This category comprises service provider name, the locations where customers received certain medical services, and codes associated with diagnosis and procedures that were administered.
Medibank, however, said financial information and identity documents like drivers licenses have not been siphoned as part of the security breach and that no unusual activity was observed since October 12, 2022.
“Given the nature of this crime, unfortunately we now believe that all of the customer data accessed could have been taken by the criminal,” the company said, urging customers to be on the alert for any potential leaks.
In a standalone investor statement, the company also said it will not make any ransom payment to the threat actor, stating doing so will only encourage the attacker to extort its customers and make Australia a bigger target.
Windows and Linux systems are being targeted by a ransomware variant called HelloXD, with the infections also involving the deployment of a backdoor to facilitate persistent remote access to infected hosts.
“Unlike other ransomware groups, this ransomware family doesn’t have an active leak site; instead it prefers to direct the impacted victim to negotiations through Tox chat and onion-based messenger instances,” Daniel Bunce and Doel Santos, security researchers from Palo Alto Networks Unit 42, said in a new write-up.
HelloXD surfaced in the wild on November 30, 2021, and is based off leaked code from Babuk, which was published on a Russian-language cybercrime forum in September 2021.
The ransomware family is no exception to the norm in that the operators follow the tried-and-tested approach of double extortion to demand cryptocurrency payments by exfiltrating a victim’s sensitive data in addition to encrypting it and threatening to publicize the information.
The implant in question, named MicroBackdoor, is an open-source malware that’s used for command-and-control (C2) communications, with its developer Dmytro Oleksiuk calling it a “really minimalistic thing with all of the basic features in less than 5,000 lines of code.”
Notably, different variants of the implant were adopted by the Belarusian threat actor dubbed Ghostwriter (aka UNC1151) in its cyber operations against Ukrainian state organizations in March 2022.
MicroBackdoor’s features allow an attacker to browse the file system, upload and download files, execute commands, and erase evidence of its presence from the compromise machines. It’s suspected that the deployment of the backdoor is carried out to “monitor the progress of the ransomware.”
Unit 42 said it linked the likely Russian developer behind HelloXD — who goes by the online aliases x4k, L4ckyguy, unKn0wn, unk0w, _unkn0wn, and x4kme — to further malicious activities such as selling proof-of-concept (PoC) exploits and custom Kali Linux distributions by piecing together the actor’s digital trail.
“x4k has a very solid online presence, which has enabled us to uncover much of his activity in these last two years,” the researchers said. “This threat actor has done little to hide malicious activity, and is probably going to continue this behavior.”
The findings come as a new study from IBM X-Force revealed that the average duration of an enterprise ransomware attack — i.e., the time between initial access and ransomware deployment — reduced 94.34% between 2019 and 2021 from over two months to a mere 3.85 days.
The increased speed and efficiency trends in the ransomware-as-a-service (RaaS) ecosystem has been attributed to the pivotal role played by initial access brokers (IABs) in obtaining access to victim networks and then selling the access to affiliates, who, in turn, abuse the foothold to deploy ransomware payloads.
“Purchasing access may significantly reduce the amount of time it takes ransomware operators to conduct an attack by enabling reconnaissance of systems and the identification of key data earlier and with greater ease,” Intel 471 said in a report highlighting the close working relationships between IABs and ransomware crews.
“Additionally, as relationships strengthen, ransomware groups may identify a victim who they wish to target and the access merchant could provide them the access once it is available.”
A new covert Linux kernel rootkit named Syslogk has been spotted under development in the wild and cloaking a malicious payload that can be remotely commandeered by an adversary using a magic network traffic packet.
“The Syslogk rootkit is heavily based on Adore-Ng but incorporates new functionalities making the user-mode application and the kernel rootkit hard to detect,” Avast security researchers David Álvarez and Jan Neduchal said in a report published Monday.
Adore-Ng, an open-source rootkit available since 2004, equips the attacker with full control over a compromised system. It also facilitates hiding processes as well as custom malicious artifacts, files, and even the kernel module, making it harder to detect.
“The module starts by hooking itself into various file systems. It digs up the inode for the root filesystem, and replaces that inode’s readdir() function pointer with one of its own,” LWN.net noted at the time. “The Adore version performs like the one it replaces, except that it hides any files owned by a specific user and group ID.”
Besides its capabilities to hide network traffic from utilities like netstat, housed within the rootkit is a payload named “PgSD93ql” that’s nothing but a C-based compiled backdoor trojan named Rekoobe and gets triggered upon receiving a magic packet.
“Rekoobe is a piece of code implanted in legitimate servers,” the researchers said. “In this case it is embedded in a fake SMTP server, which spawns a shell when it receives a specially crafted command.”
Specifically, Syslogk is engineered to inspect TCP packets containing the source port number 59318 to launch the Rekoobe malware. Stopping the payload, on the other hand, requires the TCP packet to meet the following criteria –
Reserved field of the TCP header is set to 0x08
Source port is between 63400 and 63411 (inclusive)
Both the destination port and the source address are the same as that were used when sending the magic packet to start Rekoobe, and
Contains a key (“D9sd87JMaij”) that is hardcoded in the rootkit and located in a variable offset of the magic packet
For its part, Rekoobe masquerades as a seemingly innocuous SMTP server but in reality is based on an open-source project called Tiny SHell and stealthily incorporates a backdoor command for spawning a shell that makes it possible to execute arbitrary commands.
Syslogk adds to a growing list of newly discovered evasive Linux malware such as BPFDoor and Symbiote, highlighting how cyber criminals are increasingly targeting Linux servers and cloud infrastructure to launch ransomware campaigns, cryptojacking attacks, and other illicit activity.
“Rootkits are dangerous pieces of malware,” the researchers said. “Kernel rootkits can be hard to detect and remove because these pieces of malware run in a privileged layer.”
An unpatched security issue in the Travis CI API has left tens of thousands of developers’ user tokens exposed to potential attacks, effectively allowing threat actors to breach cloud infrastructures, make unauthorized code changes, and initiate supply chain attacks.
“More than 770 million logs of free tier users are available, from which you can easily extract tokens, secrets, and other credentials associated with popular cloud service providers such as GitHub, AWS, and Docker Hub,” researchers from cloud security firm Aqua said in a Monday report.
Travis CI is a continuous integration service used to build and test software projects hosted on cloud repository platforms such as GitHub and Bitbucket.
The issue, previously reported in 2015 and 2019, is rooted in the fact that the API permits access to historical logs in cleartext format, enabling a malicious party to even “fetch the logs that were previously unavailable via the API.”
The logs go all the way back to January 2013 and up until May 2022, ranging from log numbers 4,280,000 to 774,807,924, which are used to retrieve a unique cleartext log through the API.
What’s more, further analysis of 20,000 logs revealed as many as 73,000 tokens, access keys, and other credentials associated with various cloud services like GitHub, AWS, and Docker Hub.
This is despite Travis CI’s attempts to rate-limit the API and automatically filter out secure environment variables and tokens from build logs by displaying the string “[secure]” in their place.
One of the critical insights is that while “github_token” was obfuscated, 20 other variations of this token that followed a different naming convention — including github_secret, gh_token, github_api_key, and github_secret — weren’t masked by Travis CI.
“Travis CI slowed down the velocity of API calls, which hinders the ability to query the API,” the researchers said. “In this case however, this was not enough. A skilled threat actor can find a workaround to bypass this.”
“However, combining the ease of accessing the logs via the API, incomplete censoring, accessing ‘restricted’ logs, and a weak process for rate limiting and blocking access to the API, coupled with a large number of potentially exposed logs, results in a critical situation.”
Travis CI, in response to the findings, has said the issue is “by design,” necessitating that users follow best practices to avoid leaking secrets in build logs and periodically rotate tokens and secrets.
The findings are particularly significant in the wake of an April 2022 attack campaign that leveraged stolen OAuth user tokens issued to Heroku and Travis CI to escalate access to NPM infrastructure and clone select private repositories.
Microsoft has incorporated additional improvements to address the recently disclosed SynLapse security vulnerability in order to meet comprehensive tenant isolationrequirements in Azure Data Factory and Azure Synapse Pipelines.
The latest safeguards include moving the shared integration runtimes to sandboxed ephemeral instances and using scoped tokens to prevent adversaries from using a client certificate to access other tenants’ information.
“This means that if an attacker could execute code on the integration runtime, it is never shared between two different tenants, so no sensitive data is in danger,” Orca Security said in a technical report detailing the flaw.
The high-severity issue, tracked as CVE-2022-29972 (CVSS score: 7.8) and disclosed early last month, could have allowed an attacker to perform remote command execution and gain access to another Azure client’s cloud environment.
Originally reported by the cloud security company on January 4, 2022, SynLapse wasn’t fully patched until April 15, a little over 120 days after initial disclosure and two earlier fixes deployed by Microsoft were found to be easily bypassed.
“SynLapse enabled attackers to access Synapse resources belonging to other customers via an internal Azure API server managing the integration runtimes,” the researchers said.
Besides permitting an attacker to obtain credentials to other Azure Synapse customer accounts, the flaw made it possible to sidestep tenant separation and execute code on targeted customer machines as well as control Synapse workspaces and leak sensitive data to other external sources.
At its core, the issue relates to a case of command injection found in the Magnitude Simba Amazon Redshift ODBC connector used in Azure Synapse Pipelines that could be exploited to achieve code execution a user’s integration runtime, or on the shared integration runtime.
With these capabilities in hand, an attacker could have proceeded to dump the memory of the process that handles external connections, thereby leaking credentials to databases, servers, and other Azure services.
Even more concerningly, a client certificate contained in the shared integration runtime and used for authentication to an internal management server could be weaponized to access information pertaining to other customer accounts.
In stringing together the remote code execution bug and access to the control server certificate, the issue effectively opened the door to code execution on any integration runtime without knowing anything but the name of a Synapse workspace.
“It is worth noting that the major security flaw wasn’t so much the ability to execute code in a shared environment but rather the implications of such code execution,” the researchers noted.
“More specifically, the fact that given an RCE on the shared integration runtime let us use a client certificate providing access to a powerful, internal API server. This enabled an attacker to compromise the service and access other customers’ resources.”
SeaFlower targeting Android and iOS users . Backdoored apps drain victims’ funds. Apps mimics official cryptocurrency wallet.
Introduction: A technically sophisticated threat actor known as SeaFlower has been targeting Android and iOS users as part of an extensive campaign that mimics official cryptocurrency wallet websites intending to distribute backdoored apps that drain victims’ funds.
Details: Said to be first discovered in March 2022, the cluster of activity hints to a strong relationship with a Chinese-speaking entity yet to be uncovered, based on the macOS usernames, source code comments in the backdoor code, and its abuse of Alibaba’s Content Delivery Network (CDN). As of today, the main current objective of SeaFlower is to modify Web3 wallets with backdoor code that ultimately exfiltrates the seed phrase.
Currently: Targeted apps include Android and iOS versions of Coinbase Wallet, MetaMask, TokenPocket, and imToken. SeaFlower’s modus operandi involves setting up cloned websites that act as a conduit to download trojanized versions of the wallet apps that are virtually unchanged from their original counterparts except for the addition of new code designed to exfiltrate the seed phrase to a remote domain.
Additional Security Info: The malicious activity is also engineered to target iOS users by means of provisioning profiles that enable the apps to be sideloaded onto the devices. As for how users stumble upon these websites offering fraudulent wallets, the attack leverages SEO poisoning techniques on Chinese search engines like Baidu and Sogou so that searches for terms such as “download MetaMask iOS” are rigged to surface the drive-by download pages on top of the search results page.
Closing: If anything, the disclosure once again highlights how threat actors are increasingly setting their sights on popular Web3 platforms in an attempt to plunder sensitive data and deceptively transfer virtual funds.
Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds.
“As cryptocurrency and non-fungible tokens (NFTs) become more mainstream, and capture headlines for their volatility, there is a greater likelihood of more individuals falling victim to fraud attempting to exploit people for digital currencies,” Proofpoint said in a new report.
“The rise and proliferation of cryptocurrency has also provided attackers with a new method of financial extraction.”
The targeting of sensitive cryptocurrency data by threat actors was recently echoed by the Microsoft 365 Defender Research Team, which warned about the emerging threat of cryware wherein private keys, seed phrases, and wallet addresses are plundered with the goal of siphoning virtual currencies by means of fraudulent transfers.
The swift popularity of Web3 in recent years has caused a shift in the phishing landscape, paving the way for a variety of social engineering and exploitation mechanisms that are aimed at stealing cryptocurrencies in different ways ranging from credential harvesting to the use of commodity stealer malware.
This includes spam emails that contain links to rogue URLs that download malware and redirect users to a credential harvesting landing page or even fake lookalike versions of NFT trading platforms like OpenSea. Other campaigns prompt potential victims to enter their seed phrases.
In a phishing attack detected by the enterprise security firm in February 2022, a Trust Wallet-themed lure was observed nudging email recipients, specifically university students, to verify their wallets by entering the recovery phrases.
A crucial enabler of these tailored campaigns is the relative ease with which counterfeit landing pages can be built using phishing kits, allowing less skilled threat actors to distribute and manage campaigns at a massive scale.
Further incentivizing the cybercriminal scheme are phishing-as-a-service (PHaaS) operators like BulletProofLink that offer phishing templates, spamming services, bulletproof hosting services, and credential collection services, among others.
The kits, which are continually updated and expanded, are designed to mimic different brands such as blockchain[.]com as well as other NFT and other cryptocurrency wallet service providers.
Also prominent are business email compromise (BEC) attempts to facilitate the fraudulent transfer of digital coins through messages that solicit cryptocurrency under the guise of vendor payments and donation requests to support the Ukraine war effort.
The findings come as losses from crypto-related crime jumped 79% year-over-year in 2021, with the U.S. Federal Trade Commission (FTC) noting that more than 46,000 people have reported losing over $1 billion in digital currencies to scams.
What’s more, Blockchain analytics firm Chainalysis found that cryptocurrency-based crime hit a new all-time high in 2021, even as illicit addresses received $14 billion over the course of the year, up from $7.8 billion in 2020.
“Cybercriminal threats to cryptocurrency are not new, however as the general public experiences growing adoption of cryptocurrency, people may be more likely to engage with social engineering lures using such themes,” Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, said.
“Crypto went mainstream with Superbowladsthis year and threat actors have taken note of the opportunity for a quick payday. There is no easier method of financial extraction than the illicit transfer of cryptocurrency.”
State-sponsored group BVP47. Use of TCP SYN packets. Covert communication channel.
Introduction: Common cybercriminals are a menace, there’s no doubt about it. From bedroom hackers through to ransomware groups, cybercriminals are causing a lot of damage. But both the tools used and the threat posed by common cybercriminals pale in comparison to the tools used by more professional groups such as the famous hacking groups and state-sponsored groups. In fact, these tools can prove almost impossible to detect and guard against. BVP47 is a case in point. In this article, we’ll outline how this powerful state-sponsored malware has been quietly circulating for years, how it so cleverly disguises itself, and explain what that means for cybersecurity in the enterprise.
Details: It’s a long story, fit for a spy novel. Earlier this year, a Chinese cybersecurity research group published an in-depth, 56-page report covering a piece of malicious code that the research group decided to call BVP47. The report is truly in-depth with a thorough technical explanation, including a deep dive into the malware code. It reveals that the research group originally found the code during a 2013 investigation into the state of computer security at an organization that was most likely a Chinese government department. As a key factor, the report links BVP47 to the “Equation Group”, which in turn has been tied to the Tailored Access Operations Unit at the United States National Security Agency (the NSA). The research team came to this conclusion because it found a private key that could trigger BVP47 within a set of files published by The Shadow Brokers (TSB) group. TSB attributed that file dump to the Equation Group, which leads us back to the NSA. You just couldn’t make it up, and it’s a story fit for a motion picture film.
Currently: What does BVP47 mean for cybersecurity? In essence, it works as a very clever and very well-hidden back door into the target network system, which enables the party that operates it to gain unauthorized access to data and to do so undetected. The tool has a couple of very sophisticated tricks up its sleeve, in part relying on exploiting behavior that most sysadmins would not look for simply because nobody thought any technology tool would behave like that. It starts its infectious path by setting up a covert communication channel in a place nobody would think to look: TCP SYN packets.
In a particularly insidious turn, BVP47 has the capability to listen on the same network port in use by other services, which is something that’s very difficult to do. In other words, it can be extremely hard to detect because it’s difficult to differentiate between a standard service using a port, and BVP47 using that port. In yet another twist, the tool regularly tests the environment in which it runs and erases its tracks along the way, hiding its own processes and network activity to ensure there are no traces left to find. BVP47 uses multiple encryption methods across multiple encryption layers for communication and data exfiltration. It’s typical of the top-tier tools used by advanced persistent threat groups including the state-sponsored groups. Taken in combination, it amounts to incredibly sophisticated behavior that can evade even the most astute cybersecurity defenses. The most capable mix of firewalls, advanced threat protection and the like can still fail to stop tools such as BVP47. These backdoors are so powerful because of the resources deep-pocketed state actors can throw money at developing them.
Additional Security Info: That doesn’t mean, of course, that cybersecurity teams should just roll over and give up. There is a series of activities that can make it, at the very least, harder for an actor to deploy a tool such as BVP47. Awareness and detection activities are worth pursuing, as tight monitoring may still catch a remote intruder out. Similarly, honeypots can attract attackers to a harmless target where they may well reveal themselves. However, there’s a simple, first-principles approach that delivers a huge amount of protection.
Even sophisticated tools such as BVP47 relies on unpatched software to gain a foothold. Consistently patching the OS and applications you depend on is, therefore, your very first port of call. The act of applying a patch in its own right isn’t the most challenging step to take but as we know, patching rapidly every single time is something most organizations struggle with. And of course, that’s exactly what threat actors such as the team behind BVP47 rely on, as they lie and wait for their target, who would inevitably be too resourced stretched to patch consistently, eventually missing a critical patch. What can pressured teams do? Automated, live patching is one solution as it removes the need to patch manually and eliminates time-consuming restarts and the associated downtime. Where live patching isn’t possible, vulnerability scanning can be used to highlight the most critical patches.
Closing: In-depth reports such as this are important in helping us stay aware of critical threats. BVP47 has been in play for years and years before this public report, and countless systems were attacked in the meantime including high profile targets around the world. We don’t know how many similar tools are out there. We do know what we need to do to maintain a consistently strong cybersecurity posture: monitor, distract and patch. Even if teams can’t mitigate every threat they can at least mount an effective defense, making it as difficult as possible to successfully operate malware.
Rapid Security Response feature. Mirrors a similar approach taken by Google. Supports third-party two-factor authentication apps.
Introduction: Apple has introduced a Rapid Security Response feature in iOS 16 and macOS Ventura that’s designed to deploy security fixes without the need for a full operating system version update. It seems the macOS security will get even stronger with new tools that make the Mac more resistant to attack, including Rapid Security Response. This should work well in between normal updates to easily keep security up to date without a reboot, according the Apple.
Details: The feature, which also works on iOS, aims to separate regular software updates from critical security improvements and are applied automatically so that users are quickly protected against in-the-wild attacks and unexpected threats. It’s worth noting that Apple tested an analogous option in iOS 14.5. Rapid Security Response seems to mirror a similar approach taken by Google through Play Services and Play Protect to secure Android devices from malware and other kinds of fraud.
Currently: Another key security feature announced by Apple at its annual Worldwide Developers Conference (WWDC) includes support for third-party two-factor authentication apps with the built-in Passwords feature in the Settings app. What’s more, iOS 16 will now permit users to edit strong passwords suggested by Safari to adjust for site-specific requirements, not to mention requiring apps to request users’ permission to access the clipboard to paste content from another app.
Additional Security Info: In a similar permissions-related update, USB-C and Thunderbolt accessories barring power adapters and standalone displays will be made to explicitly ask for users’ consent before they can communicate with macOS devices. On portable Mac computers with Apple silicon, new USB and Thunderbolt accessories require user approval before the accessory can communicate with macOS for connections wired directly to the USB-C port. The new macOS safeguard is also identical to the USB Restricted Mode that Apple introduced in iOS 12 four years ago, which prevents unauthorized USB accessories plugged into the Lightning port from accessing the data on iPhones and iPads without the owner’s permission if the device has been locked for over an hour. Apple also confirmed it’s bringing support for passkeys in the Safari web browser, a next-generation passwordless sign-in standard that allows users to log in to websites and apps across platforms using Touch ID or Face ID for biometric verification.
Closing: The mechanism, established by the FIDO Alliance and already backed by Google and Microsoft, aims to supplant standard passwords by providing unique digital keys that are stored locally on the device. Passkeys replace passwords with an easier and safer sign-in method. Passkeys never leave your device and are specific to the site you created them for, making it almost impossible for them to be phished.
639 financial applications targeted. 121 apps are based in the U.S. Designed to carry out on-device fraud.
Introduction: 10 of the most prolific mobile banking trojans have set their eyes on 639 financial applications that are available on the Google Play Store and have been cumulatively downloaded over 1.01 billion times. Some of the most targeted apps include Walmart-backed PhonePe, Binance, Cash App, Garanti BBVA Mobile, La Banque Postale, Ma Banque, Caf – Mon Compte, Postepay, and BBVA M�xico. These apps alone account for more than 260 million downloads from the official app marketplace.
Details: Of the 639 apps tracked, 121 are based in the U.S., followed by the U.K. (55), Italy (43), Turkey (34), Australia (33), France (31), Spain (29), and Portugal (27). TeaBot is targeting 410 of the 639 applications tracked according to a new analysis of Android threats during the first half of 2022. Octo targets 324 of the 639 applications tracked and is the only one targeting popular, non-financial applications for credential theft.
Currently: Aside from TeaBot (Anatsa) and Octo (Exobot), other prominent banking trojans include BianLian, Coper, EventBot, FluBot (Cabassous), Medusa, SharkBot, and Xenomorph. FluBot is also considered to be an aggressive variant of Cabassous, not to mention notorious for hitching its distribution wagon to serve Medusa, another mobile banking trojan that can gain near-complete control over a user’s device. Last week, Europol announced the dismantling of infrastructure behind FluBot.
Additional Security Info: These malicious remote access tools, while hiding behind the cloak of benign-looking apps, are designed to target mobile financial applications in an attempt to carry out on-device fraud and siphon funds directly from the victim’s accounts. In addition, the rogue apps are equipped with the ability to evade detection by often hiding their icons from the home screen and are known to log keystrokes, capture clipboard data, and abuse accessibility services permissions to pursue their objectives such as credential theft. This involves the use of overlay attacks, pointing a victim to a fake banking login page that’s displayed atop legitimate financial apps and can be used to steal the credentials entered.
Closing: Consequences of such attacks can range from data theft and financial fraud to regulatory fines and loss of customer trust. In the past decade, the financial industry moved completely to mobile for its banking and payments service and stock trading. While this transition brings increased convenience and new options to consumers, it also introduces novel fraud risks. Reference link for the full story: 10 Most Prolific Banking Trojans Targeting Hundreds of Financial Apps with Over a Billion Users Again
This information is brought to you by Vectech Solutions, The Gold Standard in Cybersecurity
