FIN7 Cybercrime Gang Evolves with Ransomware and Hacking Tools

0
[ad_1]

FIN7, a notorious cybercrime gang, is back with a new bag of tricks! Learn about FIN7’s evolving tactics, including ransomware and custom EDR bypass tools like AvNeutralizer. Discover how to fortify your defences against FIN7 with expert tips from Sentinel Labs’ research.

Russian hackers are shifting their tactics, now opting for paid tools instead of the custom tools they have traditionally been known for. This trend is evident in the activities of the Russian cybercrime gang FIN7, which has been targeting financial institutions and businesses worldwide for over a decade.

Notorious for its initial focus on point-of-sale (POS) system breaches, FIN7 has continuously evolved its tactics to maximize its gains. Sentinel Labs’ latest report analyzes the gang’s shift towards ransomware attacks, highlighting their preferred weapons and modus operandi.

According to researchers, FIN7 shifted its focus to ransomware operations in 2020, affiliating with RaaS groups like REvil and Conti and launching its own programs under Darkside and BlackMatter. They created fraudulent infosec firms like Combi Security and Bastion Secure to deceive security researchers. Despite setbacks, FIN7’s activities continue. 

Shedding light on FIN7‘s sophisticated toolbox, Sentinel Labs’ found one particularly concerning tool, AvNeutralizer, an EDR impairment tool designed to neutralize security software, rendering systems vulnerable to further attacks.

In November 2022, SentinelLabs reported a connection between FIN7 and the Black Basta group on using AvNeutralizer (AuKill) in ransomware attacks, which they are selling on underground forums now.

Other tools include Powertrash, a heavily obfuscated PowerShell script used by FIN7 to stealthily execute backdoor payloads in their malicious campaigns. Diceloader, aka Lizar or IceBot, is a backdoor that allows attackers to establish a C2 channel, controlling the system by sending position-independent code modules. Diceloader is typically deployed through Powertrash loaders in FIN7 operations.

A helper UI client, the “Remote System Client,” is used to interact with Diceloader C2 servers and control its victims whereas an SSH-based backdoor was found on a server attributed to FIN7, which exposed an open directory web server used as a staging server to serve payloads.

FIN7 uses multiple pseudonyms to hide its identity and sustain its underground criminal operations. Users “goodsoft”, “lefroggy”, and “killerAV” advertised their “PentestSoftware” for $6,500 monthly on the exploitin forum, “Stupor” advertised an AV killer targeting security solutions for $10,000 on the xssis forum. Based on evidence researchers claim that all these users belong to the FIN7 cluster, likely using multiple pseudonyms to maintain their illicit operations.

FIN7 Cybercrime Gang Evolves with Ransomware and Hacking Tools
FIN7 on Exploit Forum (Credit: Sentinel Labs)

Fin7 uses automated SQL injection attacks to exploit public-facing applications. They employ a multi-layered approach, including obfuscating their malware code, leveraging legitimate tools for malicious purposes, and exploiting vulnerabilities in popular software. This constant innovation makes it challenging for cybersecurity researchers to track FIN7’s activities and develop effective defences.

To protect against such threats, businesses should regularly update systems and software, implement a layered security approach, educate employees on cybersecurity best practices, and have a data backup and recovery plan.

  1. TeamViewer Confirms Security Breach by Russian Midnight Blizzard
  2. Russian Midnight Blizzard Hackers Breached Microsoft Source Code
  3. Russian APT28 Exploiting Windows Vulnerability with GooseEgg Tool
  4. Russian Hackers Hit Mail Servers in Europe for Political and Military Intel
  5. Russian Ministry Software Backdoored with North Korean KONNI Malware

[ad_2]
Source link

MacOS Users Beware Of Weaponized Meeting App From North Korean Hackers

0
[ad_1]

Meeting apps are often targeted and turned into weapons by hackers as they are largely employed for communication and collaboration, frequently carrying sensitive data and user groups that are wide. 

Such platforms gain trust among their users as of their pervasiveness as well as high level of acceptance, enabling the hackers to take advantage of such factors and spread malware, steal information, tap conversations, or even break into various organizations. 

Cybersecurity analysts (Patrick Wardle) at Objective-See discovered that North Korean hackers had been actively weaponizing a meeting app, Miro Talk, to target macOS users.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Besides this, the malwarehunterteam also tweeted about this new Mac malware.

Weaponized Meeting App

A malicious disk image (MiroTalk.dmg), undetected by VirusTotal’s AV engines, was analyzed to reveal its capabilities and North Korean (DPRK) attribution. 

The malware, likely part of a job-related phishing campaign, was hosted on a clone of the legitimate Miro Talk site. This tactic aligns with known DPRK hacker methods of targeting victims by posing as job hunters.

The analysis demonstrates how open-source tools like BlockBlock and LuLu can help counter such threats. 

The malware’s connection to a previously documented DPRK campaign by Palo Alto Network’s Unit42 suggests an evolving strategy in North Korean cyber operations.

The analysis result of MiroTalk.dmg file is an unsigned 64-bit Intel Mach-O executable named Jami, which was not detected by VirusTotal. 

The malicious disk image is currently undetected by any of the AV engines on VirusTotal (Source – Objective-See)
The application is not signed (Source – Objective-See)

Symbols and strings embedded inside suggest that it could be used for exfiltration, download, and execution with a possible C2 server at 95.164.17.24:1224. 

The malware may also target crypto-wallet browser extensions, browser data, and the macOS keychain.

It’s likely to be cross-platform (Qt/QMake), written in Python, and contains malicious Python scripts.

Methods of the executable like setBaseBrowserUrl directly reference sensitive browser paths that indicate complex data collection and exfiltration capabilities.

The Jami executable is malware that tries to access the user’s keychain and steal sensitive browser data to a C2 server (95.164.17.24:1224).

Application displays an UI (Source – Objective-See)

Although the initial attempts to exfiltrate failed, the malware API endpoints are similar to those of BeaverTail, which was previously linked with North Korean hackers.

This implies a shift from JavaScript-based threats to native QT variations that have similar targets like cryptocurrency wallets.

The DPRK-linked C2 server also hosts other payloads including client/5346 which is a Python downloader and InvisibleFerret, a cross-platform backdoor.

These findings link this new malware variant with the earlier campaign of BeaverTail indicating the continued maturity of DPRK cyber capabilities.

The analyzed malware, masquerading as MiroTalk, is a new native variant of BeaverTail.

This new variant is capable of stealing information and executing additional Python-based payloads like InvisibleFerret. 

This is evidence of DPRK cyber capability development, as shown by key IoCs like the MiroTalk.dmg file (SHA-256: 0F5F0A3AC843DF675168F82021C24180EA22F764F87F82F9F77FE8F0BA0B7132) C2 server (95.164.17.24).

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Samsung plans slimmer foldables, as thin as Galaxy S models

0
[ad_1]

Samsung plans to make its foldables as thin as its Galaxy S flagship smartphones. TM Roh, the company’s head of mobile division, has reportedly tasked engineers with developing an ultra-thin foldable with a similar thickness as the Galaxy S24 series. It is already readying a 10mm Galaxy Z Fold 6 Ultra/Slim for later this year.

Samsung aims to make foldables as thin as other smartphones

At 12.1mm, Samsung’s new Galaxy Z Fold 6 is substantially thinner than the Fold 5 (13.4mm). It also weighs 14 grams less, down from 253 grams to 239 grams. However, it is still too thick in front of the competition. HONOR recently launched the Magic V3 with a thickness of just 9.2mm, making it the world’s slimmest foldable phone yet. When unfolded, the HONOR foldable is just 4.35mm thick, against Fold 6’s 5.6mm.

Other Chinese companies have also launched slimmer foldables than Samsung. The Korean firm plans to combat those with its Galaxy Z Fold 6 Slim/Ultra. As stated above, it’s expected to measure around 10mm when folded. The company might launch it only in China and its home country South Korea. For the rest of the world, the Fold 6 is its only big foldable this year. Those who prefer a clamshell foldable have the Galaxy Z Flip 6.

Samsung made the Galaxy Z Fold 6 Ultra/Slim slimmer by removing the S Pen digitizer from the display assembly. In other words, it dropped S Pen support. It also made the device wider to fit sizeable batteries and bigger displays. Rumors say the new foldable will feature better cameras too. However, its main USP is its slim profile. The lack of S Pen support is a bummer but Samsung had to make a compromise somewhere.

However, in the future, Samsung’s regular foldables might be as thin as the Chinese versions. According to the Korean media, the company is in talks with component suppliers to slim down everything, from the batteries and cameras to displays and the hinge. The ultimate goal is to reduce the thickness to Galaxy S levels. This year’s Galaxy S24 Ultra is 8.4mm thin, while the Galaxy S24 is 7.6mm and the Galaxy S24+ is 7.7mm thin.

Curated content for foldables, including optimized games

Samsung aims to make foldables mainstream. The foldable category accounted for only 1.6% of the global smartphone market last year, and 16% of the premium segment (priced $600 and higher). The goal is still too far and maybe achievable only with a slimmer design and curated content. Samsung is already working with game publishers to optimize existing games and develop customized games for the Fold and Flip screens. Hopefully, durability improvements are also on its agenda for future foldables.


[ad_2]
Source link

Spotify rolls out beta AI DJ in Spanish for Premium users

0
[ad_1]

Spotify’s AI DJ feature has been available for almost a year in 50 markets across the world, but only in English – that’s set to change! Spotify Premium users around the globe are getting AI DJ in Spanish, the music streaming giant announced.

Launched in 2023, Spotify’s AI DJ is a feature that utilizes artificial intelligence to act like a DJ: it speaks to you between songs, spits out song and favorite artist facts, or evokes a fond memory while listening to a nostalgic track.

The goal is for Spotify users to ditch the habit of replaying the same 12 songs for years; instead, the DJ listeners hear commentary alongside personal music recommendations: thus, they’re more willing to try something new or listen to a song they may have otherwise skipped.
–Spotify Newsroom, July 17, 2024

Who’s Livi?


To create the voice model for the DJ in Spanish, Spotify enlisted their own Senior Music Editor, Olivia “Livi” Quiroz Roa, a Spotify music editor based in Mexico City who has spent her entire career in the music industry.In her day job, Livi curates popular playlists on the platform.

After an extensive international casting call, Livi’s voice resonated the most with users.

How to get started with DJ in Spanish


The Spanish-speaking voice will be available for Premium listeners in markets where DJ is currently available. It is expanding to Premium users in Spain and across select markets in Latin America, including Argentina, Bolivia, Chile, Colombia, Costa Rica, Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Mexico, Nicaragua, Panama, Paraguay, Peru, Uruguay, and Venezuela. As long as you’re using Spotify Premium in a market where DJ is available, here’s how you can find it:
  • Head to the Search tab on Spotify.
  • Search “DJ.”
  • Press play and let your personalized DJ do the rest.
  • To switch languages, simply tap the three-dot menu within the DJ card and choose between English or Spanish.

The new commenting feature


This isn’t the only new feature from Spotify lately.

Less than two weeks ago, the streaming service rolled out Comments for podcasts and a revamped mobile app for podcasters. The new tools aim to deepen engagement between podcasters and listeners and the interactive features like Q&A and polls have seen significant engagement, with over 9 million users participating.


[ad_2]
Source link

MuddyWater Hackers Deploy Legitimate RMM With BugSleep Malware

0
[ad_1]

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has escalated its phishing campaigns in Middle East countries, specifically Israel.

In their approach, they use already compromised email accounts to spread malicious content across various sectors.

Predawn churning of curd formed overnight using fresh cow milk. Made freshly in small batches.

Recent attacks have featured generic, English-language lures such as webinar invitations, which promote reuse on a wider scale.

Cybersecurity researchers at CheckPoint recently identified that MuddyWater hackers have been deploying legitimate RMM with BugSleep malware.

The BugSleep is a custom backdoor that uses legitimate Remote Management Tools (RMMs).

Their strategies are becoming more sophisticated with customized lures for certain industries and Malicious files hosted on legitimate file-sharing services like Egnyte that show how adaptable they can be while keeping their MuddyWater signatures intact.

MuddyWater new infection chain (Source – CheckPoint)

MuddyWater, a hacker group, is said to have been using Egnyte subdomains for cyber attacks involving phishing and aimed at various industries in different countries.

They have also introduced new BugSleep malware to replace certain legal uses of remote monitoring and management (RMM) tools.

Notable phishing campaigns (Source – CheckPoint)

BugSleep applies evasion techniques, encrypts communications, and can carry out multiple commands from its C&C server.

The malware has signs of ongoing development including different versions and some coding inconsistencies while using process injection for persistence, scheduled tasks, and attempts to evade EDR solutions.

Due to these implementation lapses, BugSleep poses a significant threat, especially for organizations based in Israel, Turkey, Saudi Arabia, India, and Portugal, which may have connections to operations conducted in Azerbaijan and Jordan.

Map of targeted countries (Source – CheckPoint)

The group’s enhanced phishing campaigns have been encouraged by the introduction of BugSleep.

Besides this, MuddyWater’s increased activity in the Middle East, especially in Israel, demonstrates their persistence and evolving tactics, researchers said.

Targeting diverse sectors like municipalities, airlines, and media, the group has simplified its lures, shifting from highly customized to generic themes in English. 

This alteration will enable broader regional impact rather than specific targeting with more attacks in volume, indicating their strategy adjustment.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Meta halts AI tools in this country because of “imminent risk of damage” to “fundamental rights”

0
[ad_1]

Brazil and its 200-million population won’t be subjected to some of Meta’s AI tools, after the company decided to pause the use of such generative AI tools there. That’s in response to a government’s objection to Meta’s privacy policy regarding personal data and AI.

In June, Meta held an event in São Paulo to launch its first AI-driven ad targeting program for businesses on WhatsApp. With a population exceeding 200 million, Brazil is a key market for Meta. For example, the country is the second-largest user base for WhatsApp, Meta’s popular messaging service, after India.

Earlier this month, Brazil’s National Data Protection Authority (ANPD) suspended Meta’s new privacy policy for using personal data to train generative AI systems. ANPD ruled that Meta must amend its privacy policy to exclude the processing of personal data for generative AI training.

This decision follows ANPD’s immediate suspension of Meta’s new privacy policy, announced two weeks prior. The suspension, published in Brazil’s official gazette on Tuesday, halts the processing of personal data across all Meta products, affecting even non-users of Meta’s platforms.

ANPD warned of a daily fine of 50,000 reais (approximately $8,836) for non-compliance, citing “imminent risk of serious and irreparable or difficult-to-repair damage to the fundamental rights of affected holders”.

Meta expressed disappointment in ANPD’s decision, calling it a “setback for innovation” that will delay the benefits of AI for Brazilians. Meta is required to revise its privacy policy and officially confirm the suspension of personal data processing for AI training.

In a statement, Meta said it is suspending its AI tools while negotiating with ANPD to resolve concerns about generative AI.


[ad_2]
Source link

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

0
[ad_1]

HTTP Request Smuggling is a flaw in web security that is derived from variations in the way different web servers or intermediaries, such as load balancers and proxies handle HTTP request sequences.

By creating malicious HTTP requests that exploit these inconsistencies, an attacker can control the order in which requests are processed, possibly resulting in unauthorized access, circumvention of security controls, session hijacking, or injection of malicious content into responses meant for other users.

This flaw is based on differences in the interpretation of start and end points for HTTP requests, which helps the server process them incorrectly.

Cybersecurity researchers at BugCrowd recently in a collaborative effort by Paolo Arnolfo (@sw33tLie), a hacking enthusiast passionate about server-side vulnerabilities, Guillermo Gregorio (@bsysop), a dad superhero and skilled hacker, and █████ (@_medusa_1_), a stealthy genius unveiled key insights about HTTP Request Smuggling.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

New TE.0 HTTP Request Smuggling

While cloud hosting offers security benefits, unknown HTTP Request Smuggling vectors can still pose significant threats. 

A recent discovery affected thousands of Google Cloud-hosted websites using their Load Balancer, compromising various services, including Identity-Aware Proxy. 

Researchers employ differential testing tools like http-garden for local servers and “spray-and-pray” techniques on bug bounty programs for cloud infrastructures to uncover such vulnerabilities. 

Tools like bbscope can generate extensive target lists for vulnerability research, highlighting that HTTP Request Smuggling remains a widespread and under-researched security issue.

TE.0, a new HTTP request smuggling variant, was discovered to be affecting Google Cloud’s Load Balancer.

The technique, which is similar to the CL.0 variant but uses Transfer-Encoding, enabled mass 0-click account takeovers on susceptible systems.

Attack flow (Source – BugCrowd)

It affected thousands of targets, including those protected by Google’s Identity-Aware Proxy (IAP), and it was widespread among Google Cloud-hosted websites that were set to default HTTP/1.1 rather than HTTP/2.

This discovery shows how HTTP Request Smuggling techniques keep evolving and why constant security research is crucial in cloud infrastructures.

TE.0 HTTP Request Smuggling vulnerability affected Google’s Load Balancer and compromised Google Identity-Aware Proxy (IAP), a key feature of Google Cloud’s Zero Trust security.

This flaw made it possible to bypass the strict authentication and authorization measures of IAP consequently violating its principle “never trust, always verify.”

The flaw allowed site-wide redirects as well as malicious use of application-specific widgets which could have led to severe security breaches.

All TE.0 attacks were able to evade IAP protection though not all had serious consequences.

Google admitted this after initial reporting challenges, demonstrating that fixing loopholes in cloud infrastructure is a complex problem.

Here below we have mentioned the disclosure timeline:-

Disclosure timeline (Source – BugCrowd)

Google Cloud’s infrastructure was discovered to have a significant vulnerability due to persistent attempts to hack through the web application by using HTTP request smuggling techniques.

Research motivated by curiosity which resulted in a big check and a lesson that cyber security highlighted the value of creative thinking.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

TikTok’s appeal to not be considered ‘gatekeeper’ by the EU gets dismissed

0
[ad_1]

In an attempt to make the internet space more competition-friendly, the EU with the DMA (Digital Markets Act) has established a so-called “gatekeepers” list, and TikTok is one of the companies included in it.

Being listed as a gatekeeper requires you to meet a series of requirements to ensure the space is competition-friendly. TikTok’s parent company, ByteDance, has appealed the inclusion of TikTok in the list. But now, this appeal has been dismissed.

Examples of requirements that ‘gatekeeper’ services need to meet under the DMA are, for example, messaging services to support interoperability with other messaging services. Or, OS developers to let users choose which apps to pre-install, and not to favor their own services and apps over those of third parties.

To be considered a ‘gatekeeper’, the service needs to have a specific number of users, market capitalization, and to be influential among people.

TikTok was one of the first services listed as a ‘gatekeeper’, and ByteDance appealed. However, the General Court of the EU has now ruled that the company meets the conditions for a gatekeeper.

TikTok was arguing that appointing gatekeepers was to protect emerging services from dominant companies but TikTok didn’t have a comparable position to others in the gatekeepers list. The list also includes giants such as Amazon, Alphabet, Apple, ByteDance, Meta, and Microsoft.

The rules from the DMA indicate that services with more than 45 million monthly users and a capitalization of more than 75 billion euros in the EU are to be considered gatekeepers. TikTok meets these conditions, and it also has an influence on people.

ByteDance can still try to defend itself despite its appeal being dismissed. To do so, the company needs to take the case to the Court of Justice of the European Union (CJEU). This will be the last chance for the company to evade the gatekeeper list.


[ad_2]
Source link

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

0
[ad_1]

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet perils that threaten their security and finances.

The latest discovery involves cybercriminals exploiting an alleged assassination attempt on former US President Donald Trump to conduct extensive crypto-doubling schemes.

Stream-Jacking Attacks on YouTube

Stream-jacking attacks on YouTube, where hijacked channels are used to promote fraudulent schemes, are not new. However, cybercriminals continue to refine and adapt their tactics to maximize their reach and success.

In a recent development, threat actors have leveraged the assassination attempt against Donald Trump to lure unsuspecting victims into their crypto-doubling scam.

The Mechanics of the Scam

Bitdefender researchers have identified dozens of hijacked YouTube channels that have been broadcasting deep fake live streams featuring Elon Musk since July 16. These streams purport to reveal insights into the assassination attempt on Trump.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

While the videos do not mention the incident, the channel descriptions provide additional context, falsely linking Elon Musk to political support for Trump.

One such description reads, “Elon Musk plans to provide about $45 million a month to a new political committee supporting former US leader Donald Trump as part of the presidential campaign #Tesla #Musk #Trump.

“Another hijacked channel description states, “Former President Donald Trump was the target of an apparent assassination attempt Saturday at a Pennsylvania rally, just days before he was to accept the Republican nomination for a third time.

Amidst a barrage of gunfire, a bloodied Trump, who reported being shot in the ear, was surrounded by Secret Service and hurried to his SUV, all while defiantly pumping his fist.

Trump’s campaign has since stated that the presumptive GOP nominee is doing ‘fine’ after the shooting, which pierced the upper part of his right ear.

The incident set off panic at the rally, with many attendees seeking cover from the unexpected violence. Billionaire Elon Musk reacted to the incident, stating Saturday evening that he ‘fully’ supports Donald Trump.

Musk’s statement has added a new dimension to the unfolding events, hinting at potential political endorsements in the upcoming election. #Tesla #Musk #Trump.”

Hijacked Channels and Deepfake Videos

Not all hijacked YouTube channels have changed their names, but some have been renamed “Tesla” or “Donald Trump Jr.”

The threat actors have stripped these channels of their original content and begun livestreaming the same deepfake video promoting crypto-doubling offers under titles like “Elon Musk Reveals Insights on Trump Assassination Attempt and Election Support.”

The potential reach of this scam is alarming. One of the hijacked channels has 1.26 million subscribers, while others have subscriber counts ranging from 100,000 to over 700,000.

The broadcasts use looped-deep fake videos of Elon Musk, encouraging viewers to scan a QR code embedded in the video to participate in a crypto giveaway.

Fraudulent Websites and QR Codes

Scanning these QR codes directs users to fraudulent websites hosted on domains resembling the impersonated brand, such as Tesla, or domains that associate Musk’s and Trump’s names.

Examples of these malicious domains include musktrump[.]org, tesla-elon[.]gives, elomusk[.]finance, muskrise[.]io, and taketesla[.]org.

Bitdefender’s anti-phishing and anti-fraud filtering systems have detected and blocked these domains.

Protecting Against Crypto-Doubling Scams

Vigilance and adherence to good cyber practices are crucial to avoid such scams.

Bitdefender researchers recommend the following steps:

  1. Be Wary of Click-Bait Titles: Avoid videos and links with sensational titles related to Tesla or the attack on Donald Trump.
  2. Check for Malicious Domains: Identify malicious domains and ensure your security systems block them.
  3. Secure Your YouTube Account: Follow dedicated guides to keep your YouTube account safe from hijackers.
  4. Scrutinize Crypto Investment Promises: Be skeptical of messages and videos promising double returns on crypto investments.
  5. Avoid Scanning QR Codes in Videos: Do not scan QR codes in YouTube videos that offer too-good-to-be-true crypto giveaways.
  6. Inspect YouTube Channels for Suspicious Activity: Look for signs such as missing or deleted videos and closed comment sections.
  7. Report Suspicious Activity: Notify the platform or other relevant parties about any suspicious activity.
  8. Use Comprehensive Security Solutions: Employ trusted security solutions that can block phishing attempts and fraudulent links.
  9. Utilize Scamio for Verification: When in doubt, use Bitdefender’s Scamio to analyze texts, messages, links, QR codes, or images for potential scams.
  10. Scamio is available on Facebook Messenger, WhatsApp, and web browsers and can be shared with others in various countries.

As cybercriminals continue exploiting high-profile events for their schemes, users must stay informed and vigilant.

Individuals can protect themselves from these sophisticated crypto-doubling scams by following the recommended precautions and utilizing advanced security solutions.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link