X-Industry

Russian Federal Security Service (FSB) contractor SyTech lost documents in a cyber breach.  One of the exposed secret Russian projects, dubbed Knockout, is targeting Western media in the US, Great Britain, Germany, France, and other countries.  Knockout maps mass media IT infrastructure, extracts media metadata and collects their vulnerabilities.

 Figure 1. SyTech logo from the leaked Knockout presentation

Details

SyTech/FSB breach materials were exposed in July 2019 and were widely discussed in c

In August 2019, Wapack Labs observed a significant uptick in malicious emails delivering a malware identified as Cryxos.  The observed malware is currently being delivered to users in Brazil, however thousands of related specimens were observed on Virus Total indicating a widespread campaign affecting multiple countries.  This report provides technical details on the first stage and second stage components of this malware campaign as well as the associated infrastructure, and malware attribution

SUMMARY

The recent leakage of millions of resumes from Chinese job sites has provided the opportunity to research, among other things, the work histories and expertise of thousands of Huawei Technologies employees.  Christopher Balding of Fulbright University Vietnam has conducted such a search to determine if Huawei has links to the People’s Liberation Army (PLA) or the Ministry of State Security (MSS).  He recently published his conclusion that, “there is an undeniable relationship between Hua

The Department of Homeland Security released a National Terrorism Advisory System

Bulletin on 18 July 2019.

It updates The National Terrorism Advisory System, or NTAS, a tool designed to communicate information about terrorist threats by providing timely, detailed information to the public.  There are now three primary notifications: Bulletins, Elevated Alerts and Imminent Alerts.  NTAS “Bulletins” provide information describing broader or more general trends and current developments regarding t

TA505 is a prolific Russian threat actor known for attacks against multiple industries with a variety of malware since 2014. In July 2019, Wapack Labs analyzed the intrusion infrastructure associated with TA505’s attacks. The network is comprised of multiple IPs and domains, many of which were spoofed to appear like domains belonging financial institutions. Also hosted were two domains for Royal Dumps, a known carder site. More recently there has been reported upticks in TA505 attacks with targe

DNATools Inc. application dnaLIMS is a “state-of-the art web-based laboratory information management system used to track and manage (scientific DNA research)”.  It is commonly used by researchers in labs and universities around the world.  In 2017, multiple vulnerabilities were discovered in this software.  After the vendor was notified, their response indicates these vulnerabilities will not be fixed.  It has been confirmed that these vulnerabilities still exist in the software and attack

Prepared by:  Nicholas Dessanti, UNH Cyber Student Intern

Password security has been a major topic of discussion for all computer and web site users.  Today, hackers are exploiting vulnerabilities within user passwords in many ways.  Brute force attacks are the most common way hackers use to find passwords.  Another common method is called a dictionary attack.  Both brute force and dictionary attacks systematically check all possible passwords until the correct one is found.  Hashing algorithms a

Masked demonstrators in Hong Kong; the sign says “Carrie Lam is not my mother”

Hong Kong protests in June 2019 brought as many as two million demonstrators onto the streets to fight a planned extradition law that would allow mainland China’s government to pull dissenters from Hong Kong for charging in Beijing.  These mass demonstrations were largely coordinated through Telegram, an app that provides end-to-end encryption and the ability to manage communications for very large groups. 

On 12 June

Figure 1. AS-12/AS-31 Losharik tentative schema.

On 1 July 2019, fourteen Russian sailors died in a fire during the testing of a secret Russian military submarine.   The type of vessel is believed to be an AS-12/AS-31 “Losharik” deep-diving nuclear sub.  While the Russian government insists, they were just surveying the ocean floor for science, the high military ranks of the participating sailors show that the spy capabilities to include taping and severing undersea communication cables are the p

In July 2019, Wapack Labs identified a large email campaign using malicious word documents to deliver a variety of malware.  The emails are presumed related by way of similar social engineering, the same URL shortening tactic and shared office exploit for CVE-2018-11882.  In several cases, the emails were sent from legitimate organizations indicating a prior infection was leveraged as a launching point to attack additional entities.

TIR-19-186-001.pdf

This report provides details on the maliciou

The Hong Kong government’s attempt to enact an extradition agreement with mainland China sparked mass demonstrations in Hong Kong in June 2019.  Protesters took to the streets in record numbers, with as many as two million protesters reported at the peak of the demonstrations.  By 23 June, Hong Kong’s Chief Executive had suspended action on the extradition bill.

The mainland Chinese government’s reaction to these events has been surprisingly weak.  Throughout the month of June, China’s Foreign M

https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/

Our UK partners have share an important report on Ryuk Malware.

Ryuk was first seen in August 2018 and has been responsible for multiple attacks globally. Ryuk is a targeted ransomware where demands are set according to the victim’s perceived ability to pay.

The Ryuk ransomware is often not observed until a period of time after the initial infection – ranging from days to months – which allows the actor time to carry out re

Many liberal leaning foundations in the US overtly support political causes in the name of “philanthropy,” and spend tens of millions of dollars each year pushing an environmentalist agenda; often with the goal of carbon credit taxation.  One of these “green” mega-funders stands out and pushes millions in funds from the relative obscurity of its headquarters in Switzerland; far from prying eyes (like the US IRS disclosure rules).  

The Oak Foundation’s mission statement reads: “[the] Oak Foundat

Vulnerability in Mozilla Firefox Could Allow for Arbitrary Code Execution[1]

A vulnerability has been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR), which could allow for arbitrary code execution.[2]  Mozilla Firefox is a web browser used to access the Internet.  Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.  Successful exploitation of this vulnerability could allow for arbitrary code execution through an explo

SUMMARY

Russian President Vladimir Putin and Chinese President Xi Jinping have met twice already in 2019 for summits on economic cooperation.  A series of agreements has been concluded at these meetings, mostly focused on Russian cooperation on China’s Belt and Road infrastructure construction. Putin had initially been hesitant to join in these projects, probably because he saw them as China extending its influence into Central Asia, traditionally under Russian influence.  Now Putin is speaking

Apple IDs are a popular target for hackers because they can enable theft of financial data and other personally identifiable information (PII). These are often obtained through phishing campaigns intended to trick users into entering their personal data. In June 2019, Wapack Labs identified one such campaign that is leveraging a large infrastructure and a phishing kit dubbed ‘Allantibots’. Allantibots is a sophisticated phishing package and is characterized by its ability to spoof the Apple URL.

Our friends at the US Federal Bureau of Investigation, Office of Private Sector, has recently provided information to private sector partners regarding criminals posing as technology support representatives to obtain personal and financial information. 

The culprits gain the trust from victims by impersonating a representative from a legitimate or an illegitimate technology company. They mislead the victims by offering computer services to resolve a range of computer security and operations issu

The Cyberspace Administration of China (CAC) issued a new draft cybersecurity regulation on 21 May 2019.  This draft is a planned extension of the Cybersecurity Law issued in 2017 that placed greater restrictions on foreign firms operating in China.  The new regulation creates the requirement for review of imported network equipment to determine if such equipment represents a risk to national security.  The vagueness of the language indicates that the new law could be used to block the import of

Huawei CEO, Ren Zhengfei

On 15 May 2019, US President Trump declared a national emergency over the dangers of importing technology from adversary countries, a move universally understood to be targeted at the Chinese corporation Huawei Technologies.  The “ban” on Huawei is being enacted by the US Department of Commerce, charged by the White House with deciding on the mechanisms of blocking Huawei’s connections to the US. The ban hurts Huawei in two ways: by closing the US market to Huawei equipm