Alert Posted

A new critical alert was posted for SLC Security clients in regards to a new unknown APT like activity that was detected by the SOC. This activity has been ongoing for over a year so if you received the bulletin it may be a good time to check your networks and infrastructure.

US Government and Military Hacked by ISIS?

Absolutely. It's the same information I posted yesterday.

See this article - Click Here

Now we have seen information being leaked and cannot name individual companies at this time but they are getting in through Government contractors. Information has been shared to confirm that they have actively stolen information on communications facilities and may have used that information in farther attacks. We have 6 days left in our notification wait period and then we will post the information we received in our Threat Intelligence Platform to our subscribers.

Government contracting companies should start looking through their systems and get real security vendors to help you protect your networks.

Here we go again...

IMPORTANT NOTICE: If your a normal blog subscriber please read

If you would like to continue receiving information on this blog you will need to subscribe to the mailing list (it's free and to your right). We told you that we would be making changes last month and it's time to implement these changes. Below we are outlining exactly what will be changing.

What will be posted to the blog:
1. Breaches (publicly disclosed and available via OSINT)
2. Security Articles of Interest (Things we want to share)

What we will NOT be posting to the blog:
1. Indicators
2. Breaches that have not been acknowledged
3. Special Intelligence Information - Detailed Analysis

What we will post to the Mailing List:
1. Specific Intelligence to include indicators, TIPS, bulletins and similar security products.
2. Users can contribute to the list after approval and we highly encourage the sharing of intelligence information.

Members of the mailing list can import our PGP key and can receive intelligence directly via email (once you have been verified). Verification may take up to 24 hours. 

So basically any meaty items are being moved to the mailing list. Thank you for your support of our efforts to bring awareness and have a great weekend. 

Cedar APT IOC's Added

Cedar APT IOC's Added to the commercial feed.

A total of 6 IOC's related to Cedar have been updated.

UPDATED 3-25-2014: Third US Health Entity Suspected of being Compromised

While we can't name any particular names at this time we have started seeing indicators of another related attack originating out of China aimed at US Healthcare entities. This time another well known affiliate of a previously breached healthcare entity appears to be attacking other Healthcare entities in California and Arizona.

Additional research is being done at this time but it appears as though a new malware variant is being sent via Phishing emails and they are coming from other healthcare entities so it appears as legitimate traffic which may be problematic as they may be assumed to be trusted entities.

The malware is being sent via email and is in zip, exe and also embedded HTML to infected flash websites. UPDATE: And now we are seeing PDF and word document with the same payload.

Updates will be posted here as we can obtain additional information. It appears as though one individual was also socially engineered to get malware inside an organization in Arizona. Additional reports are coming in from Utah and North Dakota as well.

Additional Details:
After researching we have noted that the botnet post from yesterday seems to be directly related to the compromised host.  - Additional IP's (Indicators) can be seen in this post.

After our report yesterday we also noted similar activity to what was seen prior to the Anthem, Community Health Systems and several University breaches we have been tracking.

If you run snort we have sent out the snort signatures (a total of 5 of them via our alert mailing list).

MOVED TO MAILING LIST - In addition another Intel provider may have already leaked the information this past week.... Have a good weekend everybody!

Apple Credential Phishing Attempts - As reported by MalwareBytes

We have been seeing many reports of Apple phishing schemes to include over 100 pages hosted at ovh.net. The scheme starts by emailing users purchase confirmations that look nearly identical to Apples legitimate purchase notifications but the links to cancel or verify the purchase lead to ovh.net and we have also noted xcelwings.com to be hosting similar content.

Ensure that you are verifying that you are connected to Apple to use secure pay or any of the other methods of purchase from the Apple store and be leary of any verification emails received. At a minimum verify that the domain is an actual Apple domain before proceeding.

Original Source: MalwareBytes
Additional Domain Indicator: SLC Security Services LLC

Researched by Analyst

Wall of Shame

Here's some of the latest traffic we are seeing today:

US Traffic
1. Boston University - Compromised System (Infiltrated Blacklist)
2. University of Washington - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
3. Utah State University - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
4. Yale University - Compromised System/SSH Attacks (Infiltrated Blacklist, Private Feed)

Foreign Traffic
No reports today

Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.

In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.

The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services. In addition we have started noting strange traffic on DNS ports specifically UDP 53 from some of these organizations.

Spina & Lavelle Attorneys Trying to Penetrate our Infrastructure

Either these attorneys are owned or they are probing for information. Just letting you know we see you. Have a great day!

ALERT: Whale Phishing Alert

The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.
The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far.

The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims.

Read More from the Original Report:
http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html

Activity: Confirmed
Number of Confirmed Cases Reported: 3

The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.

The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far. The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims. - See more at: http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html#sthash.DRlL878Z.dpuf

First Citizens Bank and Covert Electronic Surveillance

We are seeing indications that this bank is under covert electronic surveillance. This could be auditors hired by the bank, bad actors looking for attack vectors or some other party. We are not sure of the reason but our investigators have noted on several different dates that sophisticated attacks may be taking place at branch locations that are in non heavily populated areas or that these areas are under surveillance.

If you have any additional information on what may be occurring here please contact Kevin Wetzel at (919) 441-7353 or call our TSCM line at (717) 831-TSCM. Reports may remain anonymous if requested. 

Another Round - Compromised Host

We will be publishing another round of compromised host later this evening at approx. 10PM EST.

We are running a batch analytic job in Analytic Desktop as we speak. We will release the results when the job is finished. 

BREACH: Watsons Bay Hotel (watsonsbayhotel.com.au)

The host at watsonsbayhotel.com.au is compromised and is serving up malware. The IP and Domain have been added to our block list.

NEWS: Don't say we didn't warn you about this one

Security researchers have been talking behind the scenes with Microsoft concerning the recent patching efforts on CVE-2014-4114. Apparently we are not the only ones that noticed the problem with the patch last week. McAfee apparently had warned Microsoft that the patch was not 100% effective in stopping attacks that were being seen in the wild.

Microsoft misses Windows bug, hackers slip past patch

We reported last week that we were aware of the zero day being exploited.  See our earlier story. 

We noticed that hackers were largely still performing the attack with a slightly different payload method (as indicated by our distributed IDS system and honeypot indicators). We had several VM images attacked but the exploit still required that an end user to take an action before the payload was delivered. 

At no time were our customers vulnerable to this attack as our SLC Security appliances had signatures to detect the issue last week when we first discovered the problem.

Code appeared on a popular hacker website last Weds concerning the OLE issue and an updated script was uploaded the following day. 

Another Issue

While the issue we reported on is slightly different the premise is the same except that the variant we are seeing only activates during a reboot and not by an infected email attachment. The actual exploit we report on is still exploitable on Windows but is not able to be patched because in order to do so would require individual vendors to patch their products. Utilizing similar vectors allows a malicious attacker to run code through an undisclosed Windows service flaw that is not easily fixable and has been exploitable for several years now. This issue remains unpatched and vulnerable although we have only seen it used by a select few security firms during penetration testing.

Today's Naughty List - 20 Oct 2014

	162.219.179.101	Canada (CAN)	n/a	n/a
	139.0.4.177	Indonesia (IDN)	Jakarta Raya	Jakarta
	65.111.183.31	United States (USA)	Florida	Miami
	139.0.4.177	Indonesia (IDN)	Jakarta Raya	Jakarta

Today's Naughty List - 19 Oct 2014

It appears as though publishing the offenders has had an impact as the number of attempts we are now seeing is diminishing.

	71.6.165.200	United States (USA)	California	San Diego
	77.241.99.130	Norway (NOR)	Rogaland	Sola
	165.165.41.94	South Africa (ZAF)	Gauteng	Johannesburg

Today's Naughty List 17 Oct 2014

	IP	Country	Region	City
	165.165.41.94	South Africa (ZAF)	Gauteng	Johannesburg
	109.202.9.80	Russian Federation (RUS)	Altaisky krai	Barnaul
	122.52.136.58	Philippines (PHL)	n/a	n/a
	165.165.41.94	South Africa (ZAF)	Gauteng	Johannesburg
	62.1.239.200	Greece (GRC)	n/a	n/a
	65.111.183.31	United States (USA)	Florida	Miami
	74.7.105.67	United States (USA)	Texas	Dallas
	78.93.239.190	Saudi Arabia (SAU)	n/a	n/a
	81.198.214.48	Latvia (LVA)	Riga	Riga
	85.52.165.157	Spain (ESP)	n/a	n/a
	88.44.103.177	Italy (ITA)	n/a	n/a
	89.137.17.19	Romania (ROU)	n/a	n/a
	89.137.17.19	Romania (ROU)	n/a	n/a
	91.236.75.99	Poland (POL)	n/a	n/a
	95.97.99.43	Netherlands (NLD)	n/a	n/a

NEWS: FBI: China-backed hackers waging attacks against US businesses via OSINT-X Newswires

The document said the agency recently obtained information regarding "a group of Chinese government affiliated cyber actors who routinely steal high-value information from US commercial and government networks through cyber espionage."

FBI spokesman Josh Campbell confirmed via email that the FBI had released the document, which was obtained by Reuters and described specific mitigation steps that companies should take following attacks.

"The FBI has recently observed online intrusions that we attribute to Chinese government affiliated actors," he said. "Private sector security firms have also identified similar intrusions and have released defensive information related to those intrusions."

The Chinese embassy in Washington fired back by asking "the US side to stop this kind of unfounded accusation," echoing past responses to US allegations of government-backed cyber security breaches.

SOURCE: http://www.themalaymailonline.com/money/article/fbi-china-backed-hackers-waging-attacks-against-us-businesses

ALERT: ZERO DAY NOTICE - Russian Cyberspies Hit Ukrainian, US Targets With Windows Zero-Day Attack via OSINT-X Newswires

The Sandworm cyber espionage gang out of Russia intensifies its attacks in the wake of the Ukrainian conflict and sanctions against Russia with classic zero-day -- plus a popular cybercrime toolkit.

The Russian cyber espionage and cybercrime worlds once again have collided in a newly discovered cyberspying campaign that uses a zero-day flaw found in all supported versions of Microsoft Windows.


CUSTOMER NOTICE:
SLC Security Services LLC is aware of the Zero Day and will be rolling out an IDS signature in the next 4 hours to supported customers via our feeds. If you have a signature subscription your IDS/IPS and firewall alerting will automatically be updated with the updated signatures. We will automatically page your security contacts if any of the signatures trip. We have not seen any commercial vendors roll out signatures for this yet but we will be monitoring and updating this post when the signatures are updated by other security vendors.

UPDATE:
A cyberespionage campaign believed to be based in Russia has been targeting government leaders and institutions for nearly five years, according to researchers with iSight Partners who have examined code used in the attacks.

Also this particular worm is exploiting similar code to another snort rule that we previously released in July so it was already covered by the ruleset. The additional rule today will indicate the variant by the type of payload attached (1 of 3).

This attack was being used since 2009 according to our research and the research posted by other security vendors. The attack would have largely gone undetected if not for a mistake in attacking a honeypot setup at a single location that determined the traffic from the malware was not normal activity.

REFERENCES: 

'Hurricane Panda' hackers used Microsoft zero-day, CrowdStrike says - Link

ALERT: New Zero Day Identified by Vuln Disclosures - Using the OS to infect PC's

Security Researchers at SLC Security Services LLC have discovered a vulnerability in all versions of Windows that allows attackers to take over a machine when an administrator reboots the computer.

In addition to being able to hook a machine during an administrators reboot we have also determined that the same flaw is present with some programs that are called by the operating system during shutdown or reboot.

The details of the exploit will not be released until we have given Microsoft and Antivirus vendors time to test the vulnerability and roll out patches.

Known Vulnerable:
All Versions of Windows
AVG Antivirus
Symantec Antivirus

We have not tested on any other Antivirus products at this time but the code used to test also was not detected by AV and could also unload AV or completely remove it from a Windows system.

Another researcher may have also discovered the exact same issue although we have not verified this at this time. Another article describes a similar problem to what we are now reporting.

Today's Naughty List 10 Oct 2014 11:43PM EST

Some of the worst attackers we have noted today:

64.15.185.89-Unknown
114.125.138.158-Unknown
71.14.255.2-71-14-255-2.static.stls.mo.charter.com
80.25.160.180-180.Red-80-25-160.staticIP.rima-tde.net
109.202.9.80-host-109-202-9-80.avantel.ru
81.198.214.48-Unknown
95.97.99.43-095-097-099-043.static.chello.nl
89.137.17.19-Smart-Taberei.cluj.astral.ro
88.249.121.158-88.249.121.158.dynamic.ttnet.com.tr
95.9.110.101-95.9.110.101.static.ttnet.com.tr

These host are either compromised or are launching attacks on corporate infrastructure.

These IP's are being reported by our customers as attacking or attempting to access accounts on their networks.