Weekly News Roundup — March 17 to 23

Summary

— Welcome to Security Soup’s continuing news coverage of highlights from the previous week. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!

General Industry News

Microsoft announces Defender ATP for Mac
- https://www.microsoft.com/security/blog/2019/03/21/microsoft-defender-atp-for-mac-new-threat-and-vulnerability-management-capabilities/
Norwegian aluminum producer Norsk Hydro impacted by ransomware
Dragos announces acquisition of NexDefense
- https://dragos.com/blog/industry-news/nexdefense-joins-dragos-for-community-accessible-tools/

Industry Reports

Trend Micro/Europol Global Telecom Crime Report 2019
- https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/global-telecom-crime-undermining-internet-security-cyber-telecom-crime-report
Spear Phishing: Top Threats and Trends (email registration required for access)
- https://www.barracuda.com/spear-phishing-report?utm_source=blog&utm_medium=35206
The Business of Organized Cybercrime Collaboration in 2018
- https://securityintelligence.com/the-business-of-organized-cybercrime-rising-intergang-collaboration-in-2018/
Positive Technologies: Cybersecurity threatscape 2018
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cybersecurity-threatscape-2018-eng.pdf
Red Canary’s 2019 Threat Detection Report (email registration required for access)
- https://redcanary.com/resources/guides/threat-detection-report/?utm_content=87477603&utm_medium=social&utm_source=twitter&hss_channel=tw-2349092263

Tools and Tips

Introduction to analyzing Go binaries
- https://isc.sans.edu/forums/diary/Introduction+to+analysing+Go+binaries/24770/
SilkETW: Simple interface to record trace data
- https://www.fireeye.com/blog/threat-research/2019/03/silketw-because-free-telemetry-is-free.html
- https://github.com/fireeye/SilkETW
IPv6 unmasking via UPnP
- https://blog.talosintelligence.com/2019/03/ipv6-unmasking-via-upnp.html
BHIS Webcast: Py2k20 – Transitioning from Python2 to Python3
- https://www.blackhillsinfosec.com/bhis-webcast-py2k20-transitioning-from-python2-to-python3/
Attacking an internal network from the public Internet
- https://www.forcepoint.com/blog/security-labs/attacking-internal-network-public-internet-using-browser-proxy
Dragos releases community ICS tools following its acquisition of NexDefense
- https://dragos.com/community-tools/
Google open-sources Sandboxed API
- https://security.googleblog.com/2019/03/open-sourcing-sandboxed-api.html?m=1
Pepper MalwareBlog: a quick analysis of TrickBot with Ghidra
- http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html?m=1
A twitter thread explaining how to extract X.509 certificates from incomplete PCAP
- https://threadreaderapp.com/thread/1106934923968110592.html
Mitre pilots “ATT&CK Sightings”
- https://attack.mitre.org/resources/sightings/
References for FIRST CTI 2019 Symposium presentation
- https://github.com/sfakiana/FIRST-CTI-2019
DOGE: Darknet Osint Graph Explorer
- https://amp.kitploit.com/2019/03/doge-darknet-osint-graph-explorer.html?amp=1
hecfblog: How to stream your own test kitchen
- https://www.hecfblog.com/2019/03/daily-blog-648-how-to-stream-your-own.html?m=1
DFIR Resources from Attackd0gz blog
- https://attackd0gz.com/2019/03/19/dfir-resources/
Red Team Telemetry: Empire Edition
- https://www.lares.com/red-team-telemetry-empire-edition/
Ghidra Online Courses
- http://ghidra.re/online-courses/
Flare-VM: updated to Version 2.0
- https://github.com/fireeye/flare-vm
The Social-Engineer Toolkit v8.0 codename “Maverick” beta released
- https://github.com/TrustedSec/social-engineer-toolkit
ForensicMania S01E02
- https://www.dfir.co.za/2019/03/20/forensicmania-s01e02-misc/
Mordor from @Cyb3rWard0g — “A repo of pre-recorded security events generated by emulated adversarial techniques in the form of JSON files”
- https://twitter.com/Cyb3rWard0g/status/1109270967703011328?s=19
- https://github.com/Cyb3rWard0g/mordor
The OSINT Puppeteer
- https://osintcurio.us/2018/12/27/the-puppeteer/amp/?__twitter_impression=true
The FIRST Cyber Threat Intelligence SIG (CTI-SIG) curriculum
- https://www.first.org/global/sigs/cti/curriculum/

Vulnerabilities and Exploits

Analysis of a Chrome Zero Day: CVE-2019-5786
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/
Top Vulnerabilities in 2018
- https://www.recordedfuture.com/top-vulnerabilities-2018/
Extracting Bitlocker keys from a Trusted Platform Module (TPM)
- https://pulsesecurity.co.nz/articles/TPM-sniffing
PuTTY client patched after key exchange vulnerability was identified
- https://www.theregister.co.uk/2019/03/19/putty_patched_rsa_key_exchange_vuln/

Threats in the Wild – Malware, Phishing, and other campaigns

Phishing Campaign spoffs CDC Warning
- https://cofense.com/phishing-campaign-spoofed-cdc-warning-deliver-latest-gandcrab-ransomware/
More Boeing 737-themed lures push malware
- https://www.bleepingcomputer.com/news/security/spam-warns-about-boeing-737-max-crashes-while-pushing-malware/
US-Cert warned of New Zealand Tragedy-themed campaigns
- https://www.us-cert.gov/ncas/current-activity/2019/03/15/New-Zealand-Related-Scams-and-Malware-Campaigns
AZORult rewritten in C++
- https://securelist.com/azorult-analysis-history/89922/
Fin7 threat group using a new SQLRat malware
- https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/
New Crowdstrike research highlights collaboration between BokBot and TrikBot Operators
- https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/
Spelevo EK: a new Exploit Kit identified using CVE-2018-15982
- https://sensorstechforum.com/spelevo-exploit-kit-cve-2018-15982/
- http://www.malware-traffic-analysis.net/2019/03/20/index.html
The Document that Eluded AppLocker and AMSI
- https://blog.yoroi.company/research/the-document-that-eluded-applocker-and-amsi/
Mirai Botnet Upgraded
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/
Dissecting a NETWIRE Phishing Campaign’s Usage of Process Hollowing
- https://www.fireeye.com/blog/threat-research/2019/03/dissecting-netwire-phishing-campaign-usage-of-process-hollowing.html
BEC fraud goes mobile with SMS
- https://www.agari.com/email-security-blog/bec-goes-mobile/
Enterprise Malware-as-a-Service: Lazarus Group and the Evolution of Ransomware
- https://blog.dcso.de/enterprise-malware-as-a-service/

Breaches, Government, and Law Enforcement

More than 100,000 GitHub repos exposed API tokens and cryptographic keys
- https://cyware.com/news/more-than-100000-github-repos-exposed-api-tokens-and-cryptographic-keys-4d09602e
277,000 Patients Impacted in Medical Device Vendor Breach
- https://healthitsecurity.com/news/277000-patients-impacted-in-medical-device-vendor-breach
Perpetrator of Google and Facebook BEC $100 million BEC scams pleads guitly
- https://www.bleepingcomputer.com/news/security/lithuanian-pleads-guilty-to-stealing-100-million-from-google-facebook/
More credential dumps up for sale from “Gnosticplayers” threat group
- https://www.zdnet.com/article/round-4-hacker-returns-and-puts-26mil-user-records-for-sale-on-the-dark-web/