Summary

— Hello, and welcome to Security Soup’s continuing news coverage of highlights from the previous week. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests.

Industry News and Reports

Coinhive to shut down on March 8th
- https://www.welivesecurity.com/2019/02/28/coinhive-cryptocurrency-miner-to-call-it-a-day-next-week/
Microsoft Announces: Azure Sentinel — a cloud-based SIEM
- https://azure.microsoft.com/en-us/services/azure-sentinel/
Alienvault rebrands as AT&T Cybersecurity
- https://www.alienvault.com/blogs/security-essentials/att-cybersecurity-is-born
IBM X-Force 2019 Threat Intelligence Index (email registration required)
- https://newsroom.ibm.com/2019-02-26-IBM-X-Force-Report-Ransomware-Doesnt-Pay-in-2018-as-Cybercriminals-Turn-to-Cryptojacking-for-Profit
How crimeware variants traverse networks
- https://www.gigamon.com/content/dam/gated/eb-most-prolific-malware-2019-atr.pdf?ce-febnewsletter&utm_source=insight-ceemail&utm_medium=email
Bad actors target “people first, not infrastructure”
- https://www.proofpoint.com/us/corporate-blog/post/ten-stats-reveal-how-todays-cyber-attacks-target-people-first-not-infrastructure
After widespread DNS hijacking, ICANN Pushes wider adoption of DNSSEC
- https://www.icann.org/news/announcement-2019-02-22-en
A look at how Geopolitics can influence cyber operations
- https://www.recordedfuture.com/geopolitical-cyber-operations/
Offensive operations against industrial control systems
- https://dragos.com/blog/industry-news/the-complex-world-of-offensive-ics-operations/

Tools and Tips

Resources for deep web Research
- http://whitepapers.virtualprivatelibrary.net/DeepWeb.pdf
Installing MISP-dockerized
- https://blog.dcso.de/part-2-using-misp-dockerized/
Over 100 different #threathunting tips shared by @SBousseaden
- https://mobile.twitter.com/SBousseaden/status/1101451242268753925?s=19
The NSA’s upcoming release at RSA of the Ghidra tool for malware analysis
- https://www.nsa.gov/resources/everyone/ghidra/
How to Identify Cobalt Strike team servers
- https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/
FireEye’s FLARE script series: ironstrings
- https://www.fireeye.com/blog/threat-research/2019/02/recovering-stackstrings-using-emulation-with-ironstrings.html
A list of CyberChef Recipes
- https://github.com/mattnotmax/cyber-chef-recipes
The RDP through SSH Encyclopedia
- https://www.blackhillsinfosec.com/the-rdp-through-ssh-encyclopedia/

Vulnerabilities and Exploits

Thunderclap – a new set of vulnerabilities affecting peripherals using the Thunderbolt interface
- https://www.lightbluetouchpaper.org/2019/02/26/struck-by-a-thunderbolt/

Cisco Fixes a few flaws in VPN/Firewall Routers
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex
SplunkWhisperer2 – Hijacking Splunk Universal forwarders
- https://clement.notin.org/blog/2019/02/25/Splunk-Universal-Forwarder-Hijacking-2-SplunkWhisperer2/
- https://github.com/cnotin/SplunkWhisperer2

“No Place Like Chrome” – Leveraging Chrome extensions to deliver payloads to MacOS
- https://posts.specterops.io/no-place-like-chrome-122e500e421f
First evidence of exploitation for WinRAR ACE vulnerability via malspam
- https://www.bleepingcomputer.com/news/security/malspam-exploits-winrar-ace-vulnerability-to-install-a-backdoor/
OpenSSL Releases Security Update
- https://www.us-cert.gov/ncas/current-activity/2019/02/26/OpenSSL-Releases-Security-Update
- https://www.openssl.org/news/secadv/20190226.txt
Latest Drupal vulnerabilities exploited for RCE and cryptomining
- https://blog.trendmicro.com/trendlabs-security-intelligence/drupal-vulnerability-cve-2019-6340-can-be-exploited-for-remote-code-execution/
- https://www.imperva.com/blog/latest-drupal-rce-flaw-used-by-cryptocurrency-miners-and-other-attackers/

Breaches, Government, and Law Enforcement

Year End QuickView Report highlights vulnerabilities (email registration required for access)
- https://www.riskbasedsecurity.com/2019/02/more-than-22000-vulnerabilities-disclosed-in-2018/
Apex Payroll software company pays ransom to restore data.
- https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/
Credential Stuffing Attack on TurboTax exposes user tax returns
- https://www.bleepingcomputer.com/news/security/tax-returns-exposed-in-turbotax-credential-stuffing-attacks/
Congress exploring new legislation for a national data privacy standard
- https://www.zdnet.com/article/congress-considers-a-national-standard-for-data-privacy/
Former cybersecurity chief of Russian DSA sentenced for treason
- https://www.nbcnews.com/news/world/russian-ex-cyber-security-chief-gets-22-year-sentence-treason-n976191
U.S. Cyber Command’s offensive operation against Russian election meddling
- https://www.washingtonpost.com/world/national-security/us-cyber-command-operation-disrupted-internet-access-of-russian-troll-factory-on-day-of-2018-midterms/2019/02/26/1827fc9e-36d6-11e9-af5b-b51b7ff322e9_story.html?utm_term=.a0e8dac0128f

Threats in the Wild – Malware, Phishing, and other campaigns

A new variant of Qbot banker is spreading
- https://blogvaronis2.wpengine.com/varonis-discovers-global-cyber-campaign-qbot/
GoBrut: A new botnet written in Golang
- https://blog.yoroi.company/research/gobrut-a-new-golang-botnet/
A look at DNS data from sinkholes and DGAs for the Necurs botnet infrastructure
- https://www.netformation.com/our-pov/casting-light-on-the-necurs-shadow/
Analysis of network detections for the LokiBot crimeware
- https://atr-blog.gigamon.com/2019/03/01/revisiting-prolific-crimeware-to-improve-network-detection-lokibot/
A threat group’s tactics for compromising social media profiles
- https://blog.trendmicro.com/trendlabs-security-intelligence/how-a-hacking-group-is-stealing-popular-instagram-profiles/
Researchers vote on Top 10 innovative web hacking techniques of 2018
- https://portswigger.net/blog/top-10-web-hacking-techniques-of-2018
Sextortion scams making it easier to pay with an embedded QR Code
- https://isc.sans.edu/forums/diary/Sextortion+Email+Variant+With+QR+Code/24686/
“Cyax” – the reemergence of a PowerShell-based loader
- https://blog.ensilo.com/cyax-malware-evasive-loader-reemerges
Magecart Group’s continued e-crime operations
- https://www.riskiq.com/blog/labs/magecart-group-4-always-advancing/
Secureworks covers some TTPs of APT 27
- https://www.secureworks.com/blog/state-of-the-bronze-union-snapshot
- https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox
E-commerce sites attacked with Golang brute forcer
- https://blog.malwarebytes.com/threat-analysis/2019/02/new-golang-brute-forcer-discovered-amid-rise-e-commerce-attacks/
Honeypot shows increased attacks on Elasticsearch Clusters
- https://blogs.cisco.com/security/talos/cisco-talos-honeypot-analysis-reveals-rise-in-attacks-on-elasticsearch-clusters

Weekly News Roundup — Feb. 24 to March 2