Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Welcome to this week's Threat Source newsletter --- the perfect place to get caught up on all things Talos from the past week.
A group we're calling "SWEED" may be behind years of Agent Tesla attacks. This week, we uncovered everything we know about this actor, and ran down their TTPs and discussed how users can stay safe.
If you didn't get enough of the ransomware debate last week, we have even more talk of extortion payments on the latest Beers with Talos episode, too.
We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we've seen (and blocked) over the past week. Due to the Fourth of July holiday in the U.S., expect our blog and social media to be fairly quiet over the next few days.
============================================================
UPCOMING PUBLIC ENGAGEMENTS WITH TALOS
Event: \"DNS on Fire\" at Black Hat USA\
Location:
Mandalay Bay, Las Vegs, Nevada\
Date: Aug. 7\
Speaker: Warren Mercer\
Synopsis: In this talk, Warren will go over two recent malicious
threat actors targeting DNS protocol along with the methodology used to
target victims, timeline, and technical details. The first is a piece of
malware, \"DNSpionage,\" targeting government agencies in the Middle
East and an airline. The second actor, more advanced and aggressive than
the previous one, is behind the campaign we named "Sea Turtle."
Event: "It's never DNS...It was DNS: How adversaries are abusing
network blind
spots"
at SecTor
Location: Metro Toronto Convention Center, Toronto, Canada
Date: Oct. 7 - 10
Speaker: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network
protocols in most corporate networks, many organizations don't give it
the same level of scrutiny as other network protocols present in their
environments. DNS has become increasingly attractive to both red teams
and malicious attackers alike to easily subvert otherwise solid security
architectures. This presentation will provide several technical
breakdowns of real-world attacks that have been seen leveraging DNS for
a variety of purposes such as DNSMessenger, DNSpionage, and more.
============================================================
CYBER SECURITY WEEK IN REVIEW
Researchers discovered another round of
stalkerware
on the Google Play store that stole users' SMS messages and call
history. Google has since removed these apps, but they were
downloaded a combined 130,000 times.
While the attackers behind the Gandcrab ransomware say they've
retired, new evidence suggest they may still be
active.
A new, more advanced malware known as "REvil" has their fingerprints
all over it.
More than 300 cities in California have access to a surveillance
and data-mining
company\'s
information. And there's evidence to suggest that data is being
shared with the cities' police departments to create "digital
dragnets."
A digital privacy rights group is suing AT&T and two data
aggregation
services
over the sale of cellular device users' location data. The lawsuit
alleges that AT&T sold customers\' real-time location data to credit
agencies, bail bondsmen and other third parties without users'
consent.
Oracle disclosed more than 320
vulnerabilities
as part of its quarterly security update. This released includes
patches for 10 bugs in Java, including nine that are exploitable
without authentication.
The U.S. Federal Trade Commission and Facebook agreed on a \$5
billion
settlement
over the Cambridge Analytica scandal. But some lawmakers and privacy
advocates say the punishment did not go far enough.
Cyber criminals are increasingly turning their attention to
schools in
wealthier cities. Attackers believe they contain large sums of data,
and are more likely to be able to afford potential requested
extortion payments.
Two months after the Windows BlueKeep vulnerability was revealed, it
has yet to be exploited in the
wild.
Researchers are left guessing if attacks are happening quietly, or
if attackers haven't yet been able to figure out how to bypass other
security hurdles.
The image-altering app FaceApp has again exploded in popularity.
However, the app, which shows what users may look like as they age,
comes with some serious privacy
concerns.
Slack is resetting the
passwords
of thousands more users due to new information it discovered about a
data breach in 2015. That number is equivalent to roughly 1 percent
of the software's users at the time of the attack.
A Google employee recently leaked more than a thousand voice
recordings
from Home devices to a Belgian news outlet. The company says human
review is necessary to ensure its products work correctly, and
slammed the leak as a security breach.
============================================================
NOTABLE RECENT SECURITY ISSUES
Title: Vulnerabilities in Zoom meeting software could turn on Mac
cameras
Description: Two vulnerabilities --- CVE-2019-13449 and
CVE-2019-13450 --- in the Zoom remote could allow an attacker to use a
malicious website to automatically start a Zoom meeting and look in on a
user\'s Mac camera. While Zoom says it has mitigated the issue, users
are also encouraged to ensure the Mac Zoom app is up to date and to
disable the setting that allows Zoom to automatically turn on the
machine\'s camera when joining a meeting. New SNORT® rules fire when
they detect a file containing Zoom client information trying to disclose
sensitive information.
Snort SIDs: 50724 - 50729 (Written by Joanne Kim)
Title: Anubis malware returns to haunt Android
users
Description: Researchers at Trend Micro recently discovered more
than 17,400 new samples of the Android malware. Anubis has targeted
several different banking apps on Android stores, installing malicious
espionage and banking trojan capabilities onto users\' mobile devices.
The actor behind Anubis has been active for at least 12 years,
constantly making updates and adding new features. All four of these
rules fire when Anubis attempts to make an outbound connection to a
command and control (C2) server.
Snort SIDs: 50734 -- 50737 (Written by Tim Muniz)
============================================================
MOST PREVALENT MALWARE FILES FROM THIS WEEK
SHA 256:
7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256:
3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256:
46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG
SHA 256:
85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
Typical Filename: Eter.exe
Claimed Product: N/A
Detection Name: W32.WNCryLdrA:Trojan.22ht.1201
SHA 256:
c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename:
c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
============================================================
Keep up with all things Talos by following us on Twitter. Snort, ClamAV and Immunet also have their own accounts you can follow to keep up with their latest updates. You can also subscribe to the Beers with Talos podcast, which comes out bi-weekly, here (as well as on your favorite podcast app). And, if you're not already, you can also subscribe to the weekly Threat Source newsletter here.