Satan ransomware-as-a-service gives malware customising tools to hackers on Dark Web

A new ransomware-as-a-service (RaaS) has reportedly emerged, offering cybercriminals on the dark web the option of using ransomware created by someone else in exchange for subscription payments.

According to a report by ZDNet, independent security researcher going by the Twitter handle Xylitol uncovered the Satan malware as part of the Gen:Trojan.Heur2.FU malware family. Satan now however has been launched as part of a RaaS platform, which allows prospective cyber criminals access to ransomware in exchange for 30% of the revenues generated.

Once a victim has been infected with Satan via either malicious links or phishing campaigns, the victim’s files are encrypted and the attackers instruct the victims about ransom demands. Satan reportedly contains a HTML file that claims that restoring the encrypted files are impossible. According to researchers, this claim is not unfounded, indicating that the only way victims can regain access to their stolen files is by paying up the demanded ransom.

Satan’s ransom note instructs victims to install the Tor browser and then redirected to an .onion link to make the ransom payments. The ransom amount varies according to the specification of the cybercriminals using the RaaS platform.

Cybercriminals who want to use the Satan RaaS platform need to sign up for an account with the ransomware’s domain, which is hosted on the dark web. Those interested in the RaaS’ services must connect a Bitcoin wallet to their account and point out a cost for decryption.

Satan RaaS comes with several features, including fee payment records, transaction tracking, ransomware version releases and more. The platform provides hackers with tips on how to customise ransomware demands. Satan also helps hackers learn how to set up gateway proxies, and how to test their malware on systems. The platform also provides hackers with the option of translating their malware into different languages.

Additionally, Satan RaaS’ creators warn cybercriminals not to upload their ransomware onto VirusTotal or other online scanners, in efforts to ensure that they remain undetectable to security researchers.

A message of Satan RaaS’ sign up page reads, “Now, the most important part: the bitcoin paid by the victim will be credited to your account. We will keep a 30 percent fee of the income, so, if you specified a 1 BTC ransom, you will get 0.7 BTC and we will get 0.3 BTC. The fee will become lower depending on the number of infections and payments you have.”

Unlike some other ransomware authors who either fail to come up with a decryption key or store it in a way that allows security researchers to access it an create decryption tools based off them, Satan’s developers store the decryption keys on a remote server. As of now, there is not decryption tool available.



Windows 10 Blocks Zero-Days Before Patches Arrive: Microsoft

Unknown to vendors but exploited by cybercriminals, zero-day vulnerabilities are the most threatening security issues, but Microsoft’s Windows 10 can block exploitation of these vulnerabilities before they are even patched, Microsoft says.

The mitigation techniques that arrived in August 2016 as part of the Windows 10 Anniversary Update make all this possible. The update was meant to harden the platform to ensure it can stop exploits of newly discovered and even undisclosed vulnerabilities before a patch is released, and Microsoft claims that it already proved to be effective against two exploits associated with well-known threat groups.

More precisely, the deployed mitigation techniques did their job and successfully blocked kernel-level exploits for the CVE-2016-7255 and CVE-2016-7256 vulnerabilities before they were patched in November 2016, the tech behemoth explains. The former is a Win32k Elevation of Privilege Exploit, while the latter is an Open Type Font Exploit.

CVE-2016-7255, a type-confusion vulnerability in win32k.sys, was exploited by the STRONTIUM attack group to gain elevated privileges on compromised systems. To get access to the targeted computers, the group used an Adobe Flash Player vulnerability (tracked as CVE-2016-7855). The two exploits were used in a small spear-phishing campaign targeting think tanks and nongovernmental organizations in the United States.

Also known as Fancy Bear, Pawn Storm, APT28, Sednit, and Sofacy, this threat group was recently officially blamed for last year’s cyber-attacks on U.S. elections, albeit the U.S. government failed to provide proper evidence on attribution.

The STRONTIUM group, Microsoft says, leveraged the Win32k exploit in attacks in October 2016, where they attempted to corrupt the tagWND.strName structure and use SetWindowTextW to write arbitrary content anywhere in kernel memory. Abusing the API call to overwrite data of current processes and copy token privileges of the SYSTEM, the exploit allowed attackers to run victim processes with elevated privileges.

The Windows 10 Anniversary Update includes techniques that prevent abusive use of tagWND.strName, thus mitigating the Win32k exploit and similar exploits. According to the software company, tests have proven that exploits abusing this method are ineffective and instead cause exceptions and subsequent blue screen errors.

The CVE-2016-7256 vulnerability in the Windows font library, on the other hand, was being abused to install a backdoor known as Hankray on targeted computers with older versions of Windows. The backdoor had been previously spotted in low-volume attacks primarily focused on targets in South Korea.

“The font samples found on affected computers were specifically manipulated with hardcoded addresses and data to reflect actual kernel memory layouts. This indicates the likelihood that a secondary tool dynamically generated the exploit code at the time of infiltration,” Microsoft says.

Designed to copy the main body of the shellcode to newly allocated memory and run it, the stage 1 shellcode is very small, the tech giant explains. The main shellcode, which runs after the copy instructions, while also small, performs a token-stealing technique, then copies the token pointer from a SYSTEM process to the target process, achieving privilege escalation.

The Windows 10 Anniversary Update can prevent the exploit because font parsing happens completely in AppContainer instead of the kernel. Because it creates an isolated sandbox, AppContainer can prevent font exploits (among other types of exploits) from achieving privilege escalation. Moreover, the platform includes additional validation for font file parsing.

According to Microsoft, the main idea behind the hardening of Windows 10 is to ensure that mitigation techniques in the platform can tackle multiple exploits instead of focusing on neutralizing a specific bug. These mitigation techniques can either break exploit methods or close entire classes of vulnerabilities, and Microsoft plans on taking this prevention to a new level in Windows 10 Creators Update, which will include generic kernel exploit detection Windows Defender ATP, expected to deliver increased visibility into targeted attacks based on zero-day exploits.

“By delivering these mitigation techniques, we are increasing the cost of exploit development, forcing attackers to find ways around new defense layers. Even the simple tactical mitigation against popular RW primitives forces the exploit authors to spend more time and resources in finding new attack routes. By moving font parsing code to an isolated container, we significantly reduce the likelihood that font bugs are used as vectors for privilege escalation,” Microsoft also says.

By Ionut Arghire


Carbanak Group Used Numerous Tools in Recent Attacks

The infamous Carbanak group of hackers has been using multiple tools in a series of attacks over the past several months, Trustwave security researchers reveal.

Starting in September 2016, the Carbanak hackers began targeting large companies in the hospitality sector in Europe and the United States, in a series of attacks that are now said to have employed different types of malicious software.

In a recent report (PDF), Trustwave researchers revealed details on the malware used, some of the executables were signed with digital certificates issued by Comodo, in an attempt to bypass security controls. Most likely, the certs were acquired using fake identities, all featuring Russian details (city, address etc.).

The Carbanak group, also known as Anunak, was exposed in 2015 after supposedly stealing upwards of $1 billion from more than 100 banks across 30 countries.

Called Grand Mars, after one of the fake company names used to purchase certificates from Comodo, these latest attacks were not aiming at financial gains alone.

“The motivation of this operation appears to be financial gain, total control of the infrastructure and collection of bots within the victim organizations. During the forensics investigation and analysis, we were given the impression that several activities have been performed by different persons or even different groups of people,” Trustwave notes.

Multiple cybercrime organizations might have cooperated in the Grand Mars operation to establish a complex system of network hosts, using numerous malicious files to attack multiple victims. During the campaign, they switched command and control (C&C) servers to ensure they remain undetected, with majority of IP addresses associated with C&Cs located in Europe (UK, France, Sweden, and Germany), but some located in the United States.

Just as with other attacks performed by Carbanak, malicious macros in Microsoft Word documents attached to emails were used as entry points. As soon as the attachment was opened and the included VisualBasic script executed, four files were dropped onto the system, in an attempt to gain some foothold to it.

The dropped files include Starter.vbs, which uses registry Autorun and Task Scheduler to achieve persistence, TransbaseOdbcDriver.js, meant to connect to Google services (Forcepoint described the process earlier this week) and Pastebin for victim ID, tracking, and command retrieval, LanCradDriver.vbs, reads and executes the commands written in a LanCradDriver.ini file, initially created empty but later populated by the previous script, and dttsg.txt.

The attackers used a variety of tools to achieve persistence as well, namely a PowerShell Script (downloaded from Google Docs), Registry Autorun (they create a key in the registry to ensure the payload runs immediately after reboot), and Task Scheduler (a scheduled task is triggered every 30 minutes indefinitely to run starter.vbs and launch the execution chain: Starter.vbs> TransbaseOdbcDriver.js> LanCradDriver.vbs> LanCradDriver.ini).

Other tools used in this campaign and deemed malicious include AdobeUpdateManagementTool.vbs (designed to connect to C&C and perform data exfiltration), UVZHDVlZ.exe (a variant of the Carbanak malware), Update.exe (Cobalt Strike’s post-exploitation tool beacon), and 322.exe (a TCP reverse shell). These files were primarily designed for persistence or data exfiltration.

“Using services such as Google Docs in order to keep track of victims and spreading malicious files becomes a very big challenge for defenders because this way is very difficult to distinguish between good and bad guys using these popular public cloud services,” the report reads.

For lateral movement in the compromised networks, the attackers used pass-the-hash, which allowed them to steal credentials of a domain level, high privileged user, the security researchers reveal. Using this technique, actors steal credential hashes from a compromised system and can expand their foothold in the network if local accounts share the same password within the infrastructure.

“Ultimately this allowed attackers to achieve domain or even enterprise admin access and gain network access by utilizing several resources as Command & Control points in Europe and US. Further investigation of the attacked infrastructure showed that the intruders deployed similar PowerShell scripts or embedded batch files in order to spread within the environment,” Trustwave’s report reads.

While some of the attacks associated with this campaign might have been performed by various malicious groups (sometimes different stages of the same attack might have been performed by different groups, with others carrying later attack stages), “the attack characteristics of this family of malware share several common traits with the, original, well understood Carbanak APT campaign, which has been positively attributed to the Russian underground financial cybercrime network,” Trustwave concludes.

By Ionut Arghire


Chrome Users Targeted in Malware Campaign

A recently observed malware distribution campaign has been specifically devised to target users of the Chrome browser on Windows-based computers, Proofpoint security researchers warn.

The campaign uses the infamous EITest infection chain, which has been previously associated with numerous exploit kit attacks leading to ransomware, information stealers, and other malware. First documented in 2014, EITest has seen numerous changes, and the switch to more targeted attacks instead of relying on exploit kits for infection is one of them.

The newly observed attack change was first noticed in December, when a compromised website was dropping the “Chrome_Font.exe” file onto visitors’ computers. The site, Proofpoint discovered, was EITest-compromised, and was dropping the file only after a series of filtering mechanisms were triggered.

The attack, security researchers found out, was targeting Chrome for Windows users specifically. As soon as the visitor was determined to use this browser, the code injected in the page would make text unreadable, and a fake alert was displayed, prompting the user to download and install a file supposedly containing new fonts.

“The infection is straightforward: if the victim meets the criteria – targeted country, correct User-Agent (Chrome on Windows) and proper referer – the script is inserted in the page and rewrites the compromised website on a potential victim’s browser to make the page unreadable, creating a fake issue for the user to resolve,” Proofpoint researcher Kafeine explains.

The website, however, would attempt to infect Internet Explorer users as well. As long as they met specific criteria, they were exposed to a more “classic” exploit kit attack, the researcher notes.

The attack on Chrome users relied on storing all the data between HTML tags in an array, then replacing them with “&#0”. Because this is not a proper ISO character, the browser would display the replacement character � instead.

A fake alert displayed in the browser would prompt users to install an updated font pack to view the content of the page. The victim was told that the specific font (“HoeflerText,” in Proofpoint’s example) wasn’t found, and that the user should install the update immediately. The fake alert can’t be closed using the “x” button and malware is executed when the user approves the so called update.

Proofpoint suggests that the campaign was launched on December 10, 2016 and says that the “Chrome_Font.exe” file that users are tricked to install is in fact the ad fraud malware known as Fleercivet.

The malware spreads in affiliate mode, with its affiliate initially seen on underground markets as “Simby,” until they disappeared in early 2015, only to reappear later that year as “Clicool.” Upon infection, the malware causes the computer to browse the Internet in the background, on its own.

The new campaign, Kafeine says, is important because the new patch added to the EITest compromise chain combines social engineering with the targeting of Chrome users (different paths have been added to the EITest before, such as the redirection to an Android “Police” Browser locker spotted in December 2014.).

“Because actors are finding it more difficult (and therefore less profitable) to achieve conversions (i.e., malware installations) via exploit kit, they are turning to new strategies. As with other threats, actors are exploiting the human factor and are tricking users into loading the malware themselves, this time via selective injects into websites that create the appearance of problems along with the offer of fake solutions,” Proofpoint’s researcher concludes.

By Ionut Arghire


XSS Found in Silently Installed Acrobat Chrome Extension

Google Project Zero researcher Tavis Ormandy discovered that a Chrome extension installed silently by Adobe last week had been affected by a cross-site scripting (XSS) vulnerability. Adobe quickly patched the flaw after learning of its existence.

The updates released by Adobe on January 10 for Acrobat and Reader addressed 29 vulnerabilities. However, some users were displeased that the updates also automatically installed an Adobe Acrobat Chrome extension designed for converting web pages into PDF files.

The Windows-only extension requires permission to access data on the websites visited by the user, manage downloads, and communicate with cooperating native apps. The tool also collects some information from the system, but Adobe claims no personal information is involved and the “anonymous data will not be meaningful to anyone outside of Adobe.”

After analyzing the extension, which has roughly 30 million installs, Ormandy identified a DOM-based XSS vulnerability that allowed privileged JavaScript code execution. The expert classified the security hole as “critical severity.”

“I think CSP [Content Security Policy] might make it impossible to jump straight to script execution, but you can iframe non web_accessible_resources, and easily pivot that to code execution, or change privacy options via options.html, etc,” the Google researcher explained in an advisory.

The issue was reported to Adobe on January 12 and it was patched a few days later. It is not surprising that the vulnerability was fixed quickly considering that many of the flaws found in Adobe products are reported by Google Project Zero researchers or through the Chromium Vulnerability Rewards Program.

This was not the first time Ormandy identified a vulnerability in a Chrome extension. Roughly one year ago, the expert revealed that an extension automatically installed by AVG AntiVirus exposed users’ browsing history and other personal data.

By Eduard Kovacs


Ransack Campaigns Target Hadoop and CouchDB

Following a series of ransom attacks against MongoDB and Elasticsearch databases in recent weeks, many users of CouchDB and Hadoop are now finding their databases are under attack as well.

With the help of automated tools, attackers have been targeting Internet-acessible databases that haven’t been properly secured and either erasing or stealing data, followed by dropping a note demanding a specific ransom amount in exchange for the stolen data.

Insecure MongoDB installations were targeted first, and over 33,000 databases have already fallen victim to the attacks. However, as more hackers joined the rush, attackers started looking into alternatives, and Elasticsearch databases came into the crosshairs next.

Only several hundred such installations were targeted within the first couple of days, but the number has since grown to over 4,600 as of today, the public spreadsheet security researchers Victor Gevers and Niall Merrigan (who have been keeping an eye on these attacks since the beginning) use to track the campaign shows.

The attacks on MongoDB installations have reportedly slowed down, suggesting that hackers are focusing on Elasticsearch databases (over 30,000 of them are reportedly exposed) or other targets. With one actor actively attempting to sell the ransomware kit for MongoDB and Elasticsearch, it remains to be seen whether more attackers will start targeting these databases as well.

For now, however, it’s certain that Internet-facing CouchDB and Hadoop Distributed File System (HDFS) installations are potential victims to these attacks. The key change, however, is that hackers might no longer steal the data to hold it for ransom, but simply erase everything in an attempt to do harm.

While the number of CouchDB databases that have fallen to the ransom attack is still low, there are around 4,000 exposed instances, and their fate could turn for the worse if admins don’t secure them in a timely manner.

The public spreadsheet tracking attacks on Hadoop servers shows that 126 of them have been already vandalized and that there are three attackers actively pursuing them at the moment. There are between 8,000 and 10,000 HDFS installations out there, which means that attackers have quite the attack surface to enjoy.

Fidelis Cybersecurity Threat Research says that the attacks on HDFS installations (which started ramping up last week) are possible because admins use minimal security and made installations accessible from the Internet, and because denial of service (DoS) attacks have been trending up over the past years, especially in the enterprise segment.

Because HDFS installations using default configurations allow access without authentication, any attacker with basic proficiency in Hadoop can start deleting files. “On or around January 5 to January 6, traffic to port 50070 soared as attackers scanned for open HDFS installations to target,” Fidelis says.

To stay protected, admins need to follow some simple rules that apply to all databases, be them MongoDB, Elasticsearch, CouchDB, or HDFS: avoid exposing them to the Internet unless that is absolutely necessary, and use strong authentication settings (leaving default settings could mean that no authentication is required). Regularly backing up data helps restoration efforts after being hit.

With tens of thousands of databases already hit worldwide, it’s clear that admins need to take stance and up their security. Gevers and Merrigan have already made steps in preventing attacks, such as contacting local GovCERT teams to warn server owners that they are exposed. This reportedly resulted in critical Hadoop servers being pulled off the Internet.

The two security researchers have been hard at work over the past couple of weeks helping victims, and others have already joined their efforts, including Bob Diachenko, Matt Bromiley, and Dylan Katz.

By Ionut Arghire


ProtonMail Launches Tor Hidden Service

Encrypted email provider ProtonMail announced this week the launch of a Tor hidden service whose role is to help combat the censorship and surveillance efforts of totalitarian governments.

ProtonMail developers pointed out that using Tor has several advantages, including extra layers of encryption for communications, protection for the user’s real IP address, and the possibility to bypass censorship mechanisms.

On the downside, accessing the service over Tor will have a negative impact on performance, and the hidden website is still experimental so it may not be as reliable as the regular site.

The new onion website, set up with the aid of the Tor Project, can be accessed at https://protonirockerxow.onion. The URLs of hidden services are encryption key hashes, which makes them appear as a string of 16 random characters. However, ProtonMail hashed millions of encryption keys until it found a hash that made at least some sense in an effort to help users identify phishing attacks.

The hidden service is only accessible over HTTPS and it uses a certificate from Digicert, the company that also issued an onion SSL certificate to Facebook. Detailed instructions on how to access the service over Tor have been made available by ProtonMail.

ProtonMail over Tor

“Since our onion site is still experimental, we are not making any recommendations yet regarding the use of ProtonMail’s onion site,” ProtonMail developers said in a blog post. “Even without using Tor, your ProtonMail inbox is still strongly protected with PGP end-to-end encryption, secure authentication (SRP), and optional two-factor authentication. However, ProtonMail definitely has users in sensitive situations where the extra security and anonymity provided by Tor could literally save lives.”

ProtonMail has been around since 2014, but it only became available to the public in March 2016. The service can be accessed via a desktop web browser or the iOS and Android mobile apps.

ProtonMail is currently the largest encrypted email service, with more than 2 million users. Its popularity continues to increase as governments try to prevent citizens from using encrypted communications tools and attempt to expand their surveillance powers.

By Eduard Kovacs


Ukraine Power Company Confirms Hackers Caused Outage

The investigation is ongoing, but Ukraine’s national power company Ukrenergo has confirmed that the recent electricity outage in the Kiev region was caused by a cyberattack.

In a statement emailed to SecurityWeek on Thursday, Ukrenergo said a preliminary analysis showed that the normal operation of workstations and SCADA servers had been disrupted due to “external influences.”

The analysis indicates that the incident, described as a planned and layered intrusion, involved malware that allowed the attackers to remotely control internal systems. Investigators are in the process of establishing a timeline of events and identifying compromised accounts, points of entry, and devices infected with malware that may be lying dormant.

Ukrenergo is confident that the results of this investigation will help the company implement organizational and technological measures that would help prevent cyber threats and reduce the risk of power failure.

The incident took place on the night between December 17 and 18 at the substation in Pivnichna, causing blackouts in the capital city of Kiev and the Kiev region. Power was fully restored after just over an hour.

Ukrenergo officials immediately suspected external interference and brought in cybersecurity experts to conduct an investigation.

One of the experts involved in the probe told the BBC that the 2016 attacks were more sophisticated and better organized compared to the ones launched in December 2015. It also appears that several threat groups had worked together, and they may have tested techniques that could be used in other campaigns as well.

Russia is again the main suspect, the country being blamed for many of the cyberattacks launched recently against Ukraine.

A report published in October by Booz Allen Hamilton showed that the December 2015 attacks on Ukraine’s electric grid were part of a long-running campaign that also targeted the railway, media, mining and government sectors.

In the meantime, researchers continue to monitor KillDisk, one of the pieces of malware involved in the 2015 attack. They recently discovered that the destructive malware had turned into ransomware and started infecting Linux machines as well.

By Eduard Kovacs