Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Microsoft Releases Monthly Patches for May 2017
###Event: The Dark Side of DNS @ OARC 26 (Madrid)
####Date: 2017-05-14 - 2017-05-15
####Speaker: Jaeson Schultz, Technical Leader
Synopsis: Over 90% of malware makes use of the Domain Name System. While many organizations implement strict security protections as it pertains to web traffic, email, etc., they typically have less stringent controls in place to protect against DNS-based threats. Attackers have recognized this fact and are using the DNS for data exfiltration, establishing bi-directional command & control channels, and obtaining bulletproof domain hosting. In this presentation we will discuss creative ways that cyber criminals abuse the DNS along with countermeasures defenders can use to help protect their networks. ####Reference: https://indico.dns-oarc.net/event/26/
###Event: The Modern Reconnaissance Phase by APT – Protection Layer @ nsec
####Date: 2017-05-15 - 2017-05-21
####Speaker: Paul Rascagneres, Threat Researcher
Synopsis: Talos is no stranger to APT attacks. During recent research, we observed how APT actors are evolving and how the reconnaissance phase is changing to protect their valuable 0-day exploit or malware frameworks. During the presentation, we will not speak about a specific malware actor but we will use various different cases to illustrate how the reconnaissance phase is becoming more important and more complex. This talk will mainly focus on the usage of malicious documents (Microsoft Office and Hangul Word Processor) and watering hole attacks designed to establish if the target is the intended one. We will mention campaigns against political or military organizations targeting USA, Europa and Asia. ####Reference: https://www.nsec.io/speakers/
###Event: The Security of the Internet of Things @ IoT World Forums (London, UK)
####Date: 2017-05-22 - 2017-05-24
####Speaker: Martin Lee, Technical Leader
Synopsis: The Internet of Things creates many new opportunities for our personal and professional lives. It also creates new opportunities for criminals to make illicit gain, and for the disaffected to wreak havoc. Recognising that IoT systems will inevitably have vulnerabilities, and will be attacked allows organisations to design systems to be resilient from the beginning rather than to repeat past mistakes and attempt to bolt on security at a later date. In this session, by referring to a simple IoT architecture, we will discuss examples of how attackers have previously attacked systems, and show how good practices can be applied to protect systems. ####Reference: https://www.iotwf.com/
###Event: The History of Ransomware @ TATE IS2 (Prague)
####Date: 2017-05-24 - 2017-05-25
####Speaker: Paul Rascagneres, Threat Researcher
Subject: Invented by an insane criminal in 1989, ransomware has evolved into a major illicit activity. For the criminal, ransomware presents many advantages over trying to make money from selling stolen data, but also presents a number of challenges. In this presentation, I will start by presenting Talos (our activities, organisation and telemetry). Then, I will present how ransomware has developed over the past 28 years, the techniques used by current malware variants and how criminals seek to overcome the difficulties that they face. And finally, and how we can expect ransomware to develop in the near future.
####Reference: https://tate.cz/en/is2
###Event: Talos - Cisco’s Key Into Understanding the Evolving Threat Landscape @ Cisco Security Week (Raleigh, NC)
####Date: 2017-06-07 - 2017-06-08
####Speaker: Alex Chiu, Threat Researcher
Synopsis: Cisco’s Talos Group specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. People responsible for defending networks realize that the security threat landscape is constantly in flux as attackers continuously evolve their techniques. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk/webinar, we will perform deep analysis of recent threats Talos has observed over the past quarter and see how Talos leverages large datasets to deliver product improvements and mitigation strategies. ####Reference: http://www.cisco.com/c/m/digital/usc/securityweek/index.html
###Title: Microsoft Releases Monthly Patches for May 2017
Description: Microsoft has released its monthly set of security updates for Windows, Office, Internet Explorer, and more. This month’s set of updates address 56 vulnerabilities with 15 of them rated critical and 41 rated important. Impacted products include .NET, DirectX, Edge, Internet Explorer, Office, Sharepoint, and Windows. Microsoft has also released a security advisory, separate from the normal Patch Tuesday release, for the MsMpEng Malware Protection Engine vulnerability reported by Natalie Silvanovich and Tavis Ormandy of Google Project Zero.
####Reference:
- https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/bc365363-f51e-e711-80da-000d3a32fc99
- https://technet.microsoft.com/en-us/library/security/4022344
####Snort SID: 42749-42785, 42798-42799, 42811-42812, 42820-42821
###Title: Adobe Releases Security Updates for Flash Player and Experience Manager Forms
Description: Adobe has released security updates for Flash Player and Experience Manager Forms. This latest update for Flash Player resolves seven remote code execution vulnerabilities that manifest as use-after-free and memory corruption vulnerabilities. The security update for Experience Manager Forms resolves an information disclosure vulnerability manifesting in the pre-population service.
####Reference:
- https://helpx.adobe.com/security/products/flash-player/apsb17-15.html
- https://helpx.adobe.com/security/products/aem-forms/apsb17-16.html
####Snort SID: Detection pending release of vulnerability information
OSS-Fuzz: Five months later, and rewarding projects
https://security.googleblog.com/2017/05/oss-fuzz-five-months-later-and.html
HandBrake hacked to drop new variant of Proton malware
https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/05/handbrake-hacked-to-drop-new-variant-of-proton-malware/
Fatboy Ransomware-as-a-Service Emerges on Russian-Language Forum
https://www.recordedfuture.com/fatboy-ransomware-analysis/
Persirai: New Internet of Things (IoT) Botnet Targets IP Cameras
http://blog.trendmicro.com/trendlabs-security-intelligence/persirai-new-internet-things-iot-botnet-targets-ip-cameras/
Rediscovering the Intel AMT Vulnerability
https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
1 Million Gmail Users Impacted by Google Docs Phishing Attack
https://threatpost.com/1-million-gmail-users-impacted-by-google-docs-phishing-attack/125436/
- SHA 256: e071d694eb2e6caa238c5181583dd65030f0cac1eea9c193f59ebbe57e317cb2
- MD5: b7af11eb4dc4af9c2ca5d41d72ecc970
- VirusTotal: https://www.virustotal.com/file/e071d694eb2e6caa238c5181583dd65030f0cac1eea9c193f59ebbe57e317cb2/analysis/#additional-info
- Typical Filename: NOTA FISCAL E BOLETO DE ABRIL.jar
- Claimed Product: N/A
- Detection Name: JAR.E071D694EB.malicious.tht.Talos
- SHA 256: 061cbc0bd6409cb7e385f1a67a8b169a211fb96aff3f7ec15087ef0a2b8ccdd3
- MD5: c3b143c829de9d65c0b7151cdf495209
- VirusTotal: https://www.virustotal.com/file/061cbc0bd6409cb7e385f1a67a8b169a211fb96aff3f7ec15087ef0a2b8ccdd3/analysis/#additional-info
- Typical Filename: helperamc.zip
- Claimed Product: Advanced Mac Cleaner
- Detection Name: Application:ADWARE-tpd
- SHA 256: fff786ec23e6385e1d4f06dcf6859cc2ce0a32cee46d8f2a0c8fd780b3ecf89a
- MD5: d168269c3e7cd006d73c39c2d49106eb
- VirusTotal: https://www.virustotal.com/file/fff786ec23e6385e1d4f06dcf6859cc2ce0a32cee46d8f2a0c8fd780b3ecf89a/analysis/#additional-info
- Typical Filename: Wire_Transfer_rkbecker.doc
- Claimed Product: N/A
- Detection Name: W32.FFF786EC23-100.SBX.TG
- SHA 256: 7e14719467463a4f511333a12b48cb44b998db9a55de2957a10b1200855ed7ec
- MD5: 12bb0faccd1eff006f2515f537d24702
- VirusTotal: https://www.virustotal.com/file/7e14719467463a4f511333a12b48cb44b998db9a55de2957a10b1200855ed7ec/analysis/#additional-info
- Typical Filename: wcbp.exe
- Claimed Product:
- Detection Name: W32.Pr.20gj.1201
- SHA 256: 1561a03bb781015743305e75a5aa4b3d6ff58daa2b293fa0918a41283e333a3c
- MD5: 4b27b8e7055cf30f771601a745caacc3
- VirusTotal: https://www.virustotal.com/file/1561a03bb781015743305e75a5aa4b3d6ff58daa2b293fa0918a41283e333a3c/analysis/#additional-info
- Typical Filename: 02.zip
- Claimed Product: N/A
- Detection Name: Auto.1561A0.201846.in02
####TOP SPAM SUBJECTS OBSERVED
####MOST FREQUENTLY USED ASNs FOR SENDING SPAM