FBI Warns Conti Ransomware Hit 16 U.S. Health and Emergency Services
The adversary behind Conti ransomware targeted no fewer than 16 healthcare and first responder networks in the U. Conti is one of many ransomware strains that have capitulated on that trend, commencing its operations in July 2020 as a private Ransomware-as-a-Service , in addition to jumping on the double extortion bandwagon by launching a data leak site. Based on an analysis published by ransomware recovery firm Coveware last month, Conti was the second most prevalent strain deployed, accounting for 10.2% of all the ransomware attacks in the first quarter of 2021. Infections involving Conti have also breached the networks of Ireland’s Health Service Executive and Department of Health , prompting the National Cyber Security Centre to issue an alert of its own on May 16, stating that «there are serious impacts to health operations and some non-emergency procedures are being postponed as hospitals implement their business continuity plans». Conti operators are known for infiltrating enterprise networks and spreading laterally using Cobalt Strike beacons prior to exploiting compromised user credentials to deploy and execute the ransomware payloads, with the encrypted files renamed with a «. »
Source — https://thehackernews.com/2021/05/fbi-analyst-charged-with-stealing.html
FBI Analyst Charged With Stealing Counterterrorism and Cyber Threat Info
The federal indictment charged Kendra Kingsbury, 48, with two counts of having unauthorized possession of documents relating to the national defense, according to an unsealed indictment that was made public on Friday. Kingsbury worked as an intelligence analyst in the FBI’s Kansas City Division for more than 12 years, until her suspension in 2017. Stating that Kingsbury knew she was not authorized to remove and retain access to these sensitive government materials, the Justice Department charged the defendant with failing to deliver the secret documents to relevant employees who were entitled to receive them. Kingsbury is alleged to have kept a total of 20 documents that cover a wide swathe of classified information spanning across intelligence notes and bulletins, email messages, internal correspondence, and a presentation that delve into different sources and methods the agency uses to defend against counterterrorism and cyber threats as well as details about intelligence gathered on emerging terrorist groups.
Some of the documents unlawfully accessed by Kingsbury also involve specifics about open investigations, human sources, and intelligence gaps pertaining to hostile foreign intelligence services and terrorist outfits, and the technical capabilities the FBI possesses to neutralize counterterrorism targets.
Source — https://thehackernews.com/2021/05/fbi-analyst-charged-with-stealing.html
Magecart Now Hides Malicious PHP Web Shells In Website Favicons
Once again, the Magecart gang has made it to the news owing to a unique attack strategy. As observed in the recent campaigns, Magecart now hides malicious PHP web shells behind website favicons to maintain persistent access. Researchers from Malwarebytes Labs have shared details about the latest Magecart attack strategy in their recent post. Specifically, they observed Magecart web skimmers hiding the malicious PHP web shells in favicons. For this, the attackers tend to replace the legit icons with malicious PNG files. However, the files bear a malicious PHP web shell instead of JavaScript, which doesn’t load properly in this form. Yet, this strategy lets the attackers gain persistent access to the target websites whilst evading detection.
The researchers noticed the new Magecart attack strategy exploiting favicons while scanning websites. They deduced that the campaign is active in the wild that links back to the Magecart Group 12. It is the same group that targeted numerous Magento 1.x websites in the previous year. Currently, preventing this type of attack is difficult from the website admins’ perspective. Yet, vigilant monitoring may help in detecting a malicious code right when it loads.
“The skimmer we showed… dynamically injects code into the merchant site. The request to the malicious domain hosting the skimming code is not made client-side but server-side instead. As such a database blocking approach would not work here unless all compromised stores were blacklisted, which is a catch-22 situation. A more effective, but also more complex and prone to false positives approach, is to inspect the DOM in real-time and detect when malicious code has been loaded. “ However, users can avoid losing their payment details to the attackers. The researchers advise users to use security software and tools that offer protection against malicious websites.
CyberNews researchers found that crooks could abuse cryptocurrency exchange API keys and steal cryptocurrencies.
CyberNews researchers found that cybercriminals are able to abuse cryptocurrency exchange API keys and steal cryptocurrencies from their victims’ accounts without being granted withdrawal rights. At the same time, more than $1,000,000 in cryptocurrency is being held in accounts that have their API keys exposed on public code repositories.
As the cryptocurrency market exploded over the past few years, companies began to offer apps and services to help traders streamline their trading process.To use these services, traders can grant third-party programs access to their personal accounts on cryptocurrency exchanges via API keys that allow these programs to perform actions on their behalf, including opening and executing automatic trade orders without logging into the exchange.
Each set of API keys includes two important elements: the public key and the private key, commonly referred to as the public key and the secret key. The secret key is used by third-party apps to sign operation requests and tells the cryptocurrency exchange that the app is authorized to access a trader’s account and carry out the operations supported by the API key. Naturally, having your API keys exposed or stolen by cybercriminals can result in catastrophic consequences. With that said, even if someone else steals your secret API key, they shouldn’t be able to simply transfer your cryptocurrency balance to their own wallet, as cryptocurrency exchanges disable API withdrawal permissions by default. However, while conducting threat intelligence operations, our researchers found that in recent weeks, the number of trade offers for stolen cryptocurrency exchange API keys appeared to be steadily increasing across hacker forums. Apparently, there’s an emerging criminal business model, with ‘experienced trader’ teams offering to ‘clear out’ crypto exchange accounts by exploiting stolen API keys. Needless to say, this caught our attention. To help cryptocurrency exchange users protect their hard-earned coins, we decided to investigate this emerging trend and learn as much as we can about how these API keys are being exploited by threat actors.
Stay Focused. Stay Vigilant.
Cyber Threat Incident Management Team — Cyber Security Community @ SLIIT