@RISK: The Consensus Security Vulnerability Alert

February 17, 2022 - Vol. 22, Num. 07

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked

Archived issues may be found at http://www.sans.org/newsletters/at-risk

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES February 10-17, 2022
TOP VULNERABILITY THIS WEEK: BlackByte ransomware actively targeting U.S. critical infrastructure

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: FBI warns of BlackByte ransomware resurgence
Description: The FBI and U.S. Secret Service released a warning early this week that the BlackByte ransomware gang had compromised multiple American and foreign businesses, including three attacks targeting U.S. critical infrastructure. The targets span several industries, including U.S. government facilities, financial services and food and agriculture. BlackByte is a ransomware-as-a-serivce group that sells its ransomware infrastructure to other threat actors. This malware emerged in July 2021, targeting the manufacturing, health care and construction sectors. The group went quiet several months ago when security researchers released a decryptor key for the ransomware, but this recent activity indicates the group is back.
References:

• https://techcrunch.com/2022/02/14/blackbyte-critical-infrastructure-ransomware/
• https://www.ic3.gov/Media/News/2022/220211.pdf

SNORT® SIDs: 58791 - 58794

Title: South Asian APTs sharing VBA code in wave of RAT infections
Description: Cisco Talos recently identified shared VBA code between multiple threat actors in South Asia that are deploying RATs to victims across the globe. The code reuse, which is easily visible to anyone inspecting the code, is confirmed by objective code similarity detection methods. This is also commonly seen with cyber threat actors, with known examples, such as the Olympic Destroyer campaign and it is likely to continue in the future. Code sharing between threat actors is to be expected. Open-source tools are a useful source of functionality and adopting techniques from successful attacks conducted by other groups are likely to be sources of misleading evidence leading to false attribution. We can expect sophisticated threat actors to continue to take advantage of code reuse and false flags, to integrate evidence designed to fool analysts and lead to attribution of their attacks to other groups.
References: https://blog.talosintelligence.com/2022/02/whats-with-shared-vba-code.html
SNORT® SIDs: 57551, 57562, 57842 – 57849

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

The Internal Revenue Service quickly abandoned a plan to use facial recognition to verify taxpayers’ identities days after pushback from privacy advocates.
https://www.washingtonpost.com/technology/2022/02/07/irs-idme-face-scans/

However, cybersecurity experts are left wondering about the best ways to verify identity, especially with something as sensitive as taxes, given that it’s relatively easy for bad actors to steal the current methods of authentication.
https://www.wired.com/story/face-recognition-irs-verify-identity/

Microsoft will soon block macros by default in most Office applications.
https://www.theverge.com/2022/2/7/22922032/microsoft-block-office-vba-macros-default-change

Two U.S. Senators expressed concerns that the CIA may be conducting warrantless surveillance on American citizens.
https://www.bbc.com/news/world-us-canada-60351768

A decryptor is available for the Maze, Sekhmet and Egregor ransomware.
https://www.zdnet.com/article/decryptor-for-maze-egregor-and-sekhmet-ransomware-strains-released/

Apple is updating its AirTags to alert users if an unidentified tag is near them.
https://www.cnbc.com/2022/02/10/apple-to-update-airtags-to-help-prevent-tracking-of-people.html

The San Francisco 49ers NFL team confirmed they were the victim of a BlackByte ransomware attack.
https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/

CISA added a critical Apple WebKit vulnerability to its list of commonly exploited vulnerabilities, informing federal agencies they needed to patch affected products by Feb. 25.
https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-update-iphones-macs-until-feb-25th/

MOST PREVALENT MALWARE FILES February 10-17, 2022
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0
MD5: b46b60327c12290e13b86e75d53114ae
VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details
Typical Filename: NAPA_HQ_SetW10config.exe
Claimed Product: N/A
Detection Name: W32.File.MalParent

SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645
MD5: 2c8ea737a232fd03ab80db672d50a17a
VirusTotal: https://www.virustotal.com/gui/file/125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645/details
Typical Filename: LwssPlayer.scr
Claimed Product: ?????????
Detection Name: Auto.125E12.241442.in02

SHA 256: 3321b8ee0cafe7d336a93913c455bebbb821622c011ce10a9198a49392a3bb66
MD5: ed249eeca5364b32391801ec5c2d9a33
VirusTotal: https://www.virustotal.com/gui/file/3321b8ee0cafe7d336a93913c455bebbb821622c011ce10a9198a49392a3bb66/details
Typical Filename: Wave Browser.exe
Claimed Product: WaveBrowser
Detection Name: W32.PUA.Wavebrowser.Hunt.Talos

SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa
MD5: df11b3105df8d7c70e7b501e210e3cc3
VirusTotal: https://www.virustotal.com/gui/file/59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa/details
Typical Filename: DOC001.exe
Claimed Product: N/A
Detection Name: Win.Worm.Coinminer::1201