X-Industry

All Articles (165)

3572707688?profile=RESIZE_710xOn 6 August 2019, the Government of India struck down “Article 370A and 35A” from its constitution.  Article 370 is a constitutional provision that grants special status and allows the Indian state of Jammu and Kashmir to make its own laws.  The State of Jammu and Kashmir defined these privileges to include the ability to purchase land and unmovable property, the ability to vote and…

In July 2019, Proofpoint reported a new malware campaign named, “Operation Lagtime IT.” The campaign is targeting government agencies in East Asia and leveraging malicious RTF documents to deliver multiple payloads, including a new custom malware payload dubbed, “Cotx RAT.” Based on observed infrastructure and attacker TTPs, analysts have attributed the campaign to a Chinese APT group tracked as TA428.

3516858995?profile=RESIZE_710x

Figure 1. Internet blackout area during Moscow opposition protests 

Governments, especially authoritarian ones, consider cutting the Internet as one of the ways to deal with political opposition and separatists.  Major Internet disruptions were recently detected in India (Kashmir), Indonesia (Papua), Sudan, and, on a smaller scale, in Russia. Severing or completely…

3515788092?profile=RESIZE_710xSUMMARY

Recent Western analysis has identified a new series of military unit cover designators for the new Chinese military entity called the Strategic Support Force (SSF).  Elements of the SSF have reportedly been assigned cover designators in the series 32001-32099 Unit.  Because the SSF is the parent organization for China’s new cyber force,…

SUMMARY

3482291767?profile=RESIZE_710xRecent Western analysis identified a series of Chinese military cover designators, 32001-32099, as belonging to the People’s Liberation Army (PLA) Strategic Support Force (SSF). Using open-source research targeted on the Chinese internet, Wapack Labs has developed some candidates in this series as components of the Network Systems Department, the new…

 

Russian Federal Security Service (FSB) contractor SyTech lost documents in a cyber breach.  One of the exposed secret Russian projects, dubbed Knockout, is targeting Western media in the US, Great Britain, Germany, France, and other countries.  Knockout maps mass media IT infrastructure, extracts media metadata and collects their vulnerabilities.

3441980513?profile=RESIZE_710x Figure 1. SyTech logo…

In August 2019, Wapack Labs observed a significant uptick in malicious emails delivering a malware identified as Cryxos.  The observed malware is currently being delivered to users in Brazil, however thousands of related specimens were observed on Virus Total indicating a widespread campaign affecting multiple countries.  This report provides technical details on the first stage and second stage components of this malware campaign as well as the associated infrastructure, and malware…

3400868861?profile=RESIZE_710xSUMMARY

The recent leakage of millions of resumes from Chinese job sites has provided the opportunity to research, among other things, the work histories and expertise of thousands of Huawei Technologies employees.  Christopher Balding of Fulbright University Vietnam has conducted such a search to determine if Huawei has links to the People’s…

3396768374?profile=RESIZE_710xThe Department of Homeland Security released a National Terrorism Advisory System

Bulletin on 18 July 2019.

It updates The National Terrorism Advisory System, or NTAS, a tool designed to communicate information about terrorist threats by providing timely, detailed information to the public.  There are now three primary notifications:…

TA505 is a prolific Russian threat actor known for attacks against multiple industries with a variety of malware since 2014. In July 2019, Wapack Labs analyzed the intrusion infrastructure associated with TA505’s attacks. The network is comprised of multiple IPs and domains, many of which were spoofed to appear like domains belonging financial institutions. Also hosted were two domains for Royal Dumps, a known carder site. More recently there has been reported upticks in TA505 attacks with…

3385921593?profile=RESIZE_710x

 

 

 

 

 

DNATools Inc. application dnaLIMS is a “state-of-the art web-based laboratory information management system used to track and manage (scientific DNA research)”.  It is commonly used by researchers in labs and universities around the world.  In 2017, multiple vulnerabilities were discovered in this software.  After the vendor was notified,…

Prepared by:  Nicholas Dessanti, UNH Cyber Student Intern

Password security has been a major topic of discussion for all computer and web site users.  Today, hackers are exploiting vulnerabilities within user passwords in many ways.  Brute force attacks are the most common way hackers use to find passwords.  Another common method is called a dictionary attack.  Both brute force and dictionary attacks systematically check all possible passwords until the correct one is…

3320219466?profile=RESIZE_710xMasked demonstrators in Hong Kong; the sign says “Carrie Lam is not my mother”

Hong Kong protests in June 2019 brought as many as two million demonstrators onto the streets to fight a planned extradition law that would allow mainland China’s government to pull dissenters from Hong Kong for charging in Beijing.  These mass…

Figure 1. AS-12/AS-31 Losharik tentative schema.

On 1 July 2019, fourteen Russian sailors died in a fire during the testing of a secret Russian military submarine.   The type of vessel is believed to be an AS-12/AS-31 “Losharik” deep-diving nuclear sub.  While the Russian government insists, they were just surveying the ocean floor for science, the high military ranks of the participating sailors show that the spy capabilities to include taping and severing undersea communication…

In July 2019, Wapack Labs identified a large email campaign using malicious word documents to deliver a variety of malware.  The emails are presumed related by way of similar social engineering, the same URL shortening tactic and shared office exploit for CVE-2018-11882.  In several cases, the emails were sent from legitimate organizations indicating a prior infection was leveraged as a launching point to attack additional entities.…

3193233386?profile=RESIZE_710xThe Hong Kong government’s attempt to enact an extradition agreement with mainland China sparked mass demonstrations in Hong Kong in June 2019.  Protesters took to the streets in record numbers, with as many as two million protesters reported at the peak of the demonstrations.  By 23 June, Hong Kong’s Chief Executive had suspended action on the extradition bill.

The mainland…

3177143787?profile=RESIZE_710xMany liberal leaning foundations in the US overtly support political causes in the name of “philanthropy,” and spend tens of millions of dollars each year pushing an environmentalist agenda; often with the goal of carbon credit taxation.  One of these “green” mega-funders stands out and pushes millions in funds from the relative obscurity of its headquarters in Switzerland; far from…

3049916660?profile=RESIZE_710xSUMMARY

Russian President Vladimir Putin and Chinese President Xi Jinping have met twice already in 2019 for summits on economic cooperation.  A series of agreements has been concluded at these meetings, mostly focused on Russian cooperation on China’s Belt and Road infrastructure construction. Putin had initially been hesitant to join in these…