MS: ISIS may be targeting US and other Educational Institutions

Some preliminary research today may indicate that ISIS is targeting the educational sector. Several messages in IRC and on Pastebin point to social engineering attempts at educational locations in the US and other friendly countries by purported ISIS members. The information being seen has shown that hackers believed to be associated with ISIS feel that the educational sector may be an easy target and it appears as though they may have already started socially engineering some educational institutions.

One poster states that the attackers have turned the event into a contest to see how many targets can be racked up in the next 24 hours.

It also appears as though the University of Michigan is one of the named targets and has been noted in multiple post. Not surprising with the large Muslim population in that part of the country.

Posted by Kevin Wetzel

Phishing Target: Oregon Health and Science University

Over the past week we have been seeing indications on our system that Oregon Health and Science University may have been the target of a targeted phishing campaign.

Sensors on an upstream ISP network captured the following:
April 28th 2015, 23:21:55.219 iocs-phishing
April 28th 2015, 23:21:51.528 iocs-phishing
April 28th 2015, 23:21:46.435 iocs-phishing
April 28th 2015, 23:21:46.407 iocs-phishing
April 28th 2015, 23:21:45.290 iocs-phishing
April 28th 2015, 23:21:44.085 iocs-phishing
April 28th 2015, 23:21:43.850 iocs-phishing
April 28th 2015, 23:21:40.513 iocs-phishing
April 28th 2015, 23:21:39.931 iocs-phishing
April 28th 2015, 23:21:39.581 iocs-phishing
April 28th 2015, 23:21:37.889 iocs-phishing
April 28th 2015, 23:21:37.877 iocs-phishing
April 28th 2015, 23:21:37.866 iocs-phishing
April 28th 2015, 23:21:35.422 iocs-phishing
April 28th 2015, 23:21:34.757 iocs-phishing
April 28th 2015, 23:21:34.163 iocs-phishing
April 28th 2015, 23:21:32.817 iocs-phishing
April 28th 2015, 23:21:32.813 iocs-phishing
April 28th 2015, 23:21:32.292 iocs-phishing
April 28th 2015, 23:21:31.954 iocs-phishing
April 28th 2015, 23:21:29.227 iocs-phishing
April 28th 2015, 23:21:27.985 iocs-phishing
April 28th 2015, 23:21:25.912 iocs-phishing
April 28th 2015, 23:21:25.370 iocs-phishing
April 28th 2015, 23:21:24.252 iocs-phishing
April 28th 2015, 23:21:16.234 iocs-phishing
April 28th 2015, 23:21:16.223 iocs-phishing
April 27th 2015, 14:18:54.410 iocs-phishing
April 27th 2015, 14:18:51.617 iocs-phishing
April 27th 2015, 14:18:51.601 iocs-phishing
April 27th 2015, 14:18:50.170 iocs-phishing
April 27th 2015, 14:18:49.845 iocs-phishing
April 27th 2015, 14:18:49.483 iocs-phishing
April 27th 2015, 14:18:47.442 iocs-phishing
April 27th 2015, 14:18:46.466 iocs-phishing
April 27th 2015, 14:18:46.004 iocs-phishing
April 27th 2015, 14:18:45.447 iocs-phishing
April 27th 2015, 14:18:45.418 iocs-phishing
April 27th 2015, 14:18:45.385 iocs-phishing
April 27th 2015, 14:18:43.473 iocs-phishing
April 27th 2015, 14:18:43.006 iocs-phishing
April 27th 2015, 14:18:42.687 iocs-phishing
April 27th 2015, 14:18:41.553 iocs-phishing
April 27th 2015, 14:18:41.552 iocs-phishing
April 27th 2015, 14:18:41.400 iocs-phishing
April 27th 2015, 14:18:41.299 iocs-phishing
April 27th 2015, 14:18:40.634 iocs-phishing
April 27th 2015, 14:18:40.509 iocs-phishing
April 27th 2015, 14:18:39.393 iocs-phishing
April 27th 2015, 14:18:39.310 iocs-phishing
April 27th 2015, 14:18:39.185 iocs-phishing
April 27th 2015, 14:18:38.294 iocs-phishing
April 27th 2015, 14:18:38.293 iocs-phishing
April 27th 2015, 14:18:37.323 iocs-phishing
April 27th 2015, 14:18:34.208 iocs-phishing
April 27th 2015, 14:18:34.191 iocs-phishing
April 27th 2015, 14:18:33.046 iocs-phishing
April 27th 2015, 14:18:32.771 iocs-phishing
April 27th 2015, 14:18:31.819 iocs-phishing
April 27th 2015, 14:18:29.084 iocs-phishing
April 27th 2015, 14:18:28.786 iocs-phishing
April 27th 2015, 14:18:28.276 iocs-phishing
April 27th 2015, 14:18:26.891 iocs-phishing
April 27th 2015, 14:18:26.880 iocs-phishing
April 27th 2015, 14:18:26.870 iocs-phishing
April 27th 2015, 14:18:25.522 iocs-phishing
April 27th 2015, 14:18:24.364 iocs-phishing
April 27th 2015, 14:18:24.010 iocs-phishing
April 27th 2015, 14:18:23.471 iocs-phishing
April 27th 2015, 14:18:23.470 iocs-phishing
April 27th 2015, 14:18:23.333 iocs-phishing
April 27th 2015, 14:18:23.244 iocs-phishing
April 27th 2015, 14:18:21.945 iocs-phishing
April 27th 2015, 14:18:21.795 iocs-phishing
April 27th 2015, 14:18:21.525 iocs-phishing
April 27th 2015, 14:18:21.337 iocs-phishing
April 27th 2015, 14:18:21.195 iocs-phishing
April 27th 2015, 14:18:19.650 iocs-phishing
April 27th 2015, 14:18:19.649 iocs-phishing
April 27th 2015, 14:18:19.170 iocs-phishing
April 27th 2015, 14:18:16.608 iocs-phishing
April 27th 2015, 14:18:16.592 iocs-phishing
April 27th 2015, 14:18:16.534 iocs-phishing
April 27th 2015, 14:18:13.092 iocs-phishing
April 27th 2015, 14:18:13.076 iocs-phishing
April 27th 2015, 14:18:11.484 iocs-phishing
April 27th 2015, 14:18:11.217 iocs-phishing
April 27th 2015, 14:18:11.020 iocs-phishing
April 27th 2015, 14:18:08.989 iocs-phishing
April 27th 2015, 14:18:08.820 iocs-phishing
April 27th 2015, 14:18:08.513 iocs-phishing
April 27th 2015, 14:18:07.109 iocs-phishing
April 27th 2015, 14:18:07.097 iocs-phishing
April 27th 2015, 14:18:07.081 iocs-phishing
April 27th 2015, 14:18:05.093 iocs-phishing
April 27th 2015, 14:18:04.694 iocs-phishing
April 27th 2015, 14:18:04.384 iocs-phishing
April 27th 2015, 14:18:03.954 iocs-phishing
April 27th 2015, 14:18:03.953 iocs-phishing
April 27th 2015, 14:18:02.962 iocs-phishing
April 27th 2015, 14:18:02.871 iocs-phishing
April 27th 2015, 14:18:02.312 iocs-phishing
April 27th 2015, 14:18:02.188 iocs-phishing
April 27th 2015, 14:18:01.959 iocs-phishing
April 27th 2015, 14:18:00.890 iocs-phishing
April 27th 2015, 14:18:00.755 iocs-phishing
April 27th 2015, 14:17:59.922 iocs-phishing
April 27th 2015, 14:17:59.919 iocs-phishing
April 27th 2015, 14:17:59.226 iocs-phishing
April 27th 2015, 14:17:55.680 iocs-phishing
April 27th 2015, 14:17:55.663 iocs-phishing
April 27th 2015, 14:17:54.580 iocs-phishing
April 27th 2015, 14:17:54.310 iocs-phishing
April 27th 2015, 14:17:52.798 iocs-phishing
April 27th 2015, 14:17:50.545 iocs-phishing
April 27th 2015, 14:17:50.379 iocs-phishing
April 27th 2015, 14:17:50.057 iocs-phishing
April 27th 2015, 14:17:48.507 iocs-phishing
April 27th 2015, 14:17:48.492 iocs-phishing
April 27th 2015, 14:17:48.482 iocs-phishing
April 27th 2015, 14:17:47.323 iocs-phishing
April 27th 2015, 14:17:46.003 iocs-phishing
April 27th 2015, 14:17:45.691 iocs-phishing
April 27th 2015, 14:17:45.162 iocs-phishing
April 27th 2015, 14:17:45.161 iocs-phishing
April 27th 2015, 14:17:44.919 iocs-phishing
April 27th 2015, 14:17:44.742 iocs-phishing
April 27th 2015, 14:17:43.081 iocs-phishing
April 27th 2015, 14:17:42.565 iocs-phishing
April 27th 2015, 14:17:41.451 iocs-phishing
April 27th 2015, 14:17:40.054 iocs-phishing
April 27th 2015, 14:17:35.364 iocs-phishing
April 27th 2015, 14:17:35.362 iocs-phishing
April 27th 2015, 13:40:17.303 iocs-REDACTED
April 27th 2015, 13:40:16.083 iocs-REDACTED
April 23rd 2015, 03:27:02.867 iocs-phishing
April 23rd 2015, 03:27:00.073 iocs-phishing
April 23rd 2015, 03:27:00.056 iocs-phishing
April 23rd 2015, 03:26:58.395 iocs-phishing
April 23rd 2015, 03:26:58.125 iocs-phishing
April 23rd 2015, 03:26:57.698 iocs-phishing
April 23rd 2015, 03:26:55.767 iocs-phishing
April 23rd 2015, 03:26:55.464 iocs-phishing
April 23rd 2015, 03:26:55.163 iocs-phishing
April 23rd 2015, 03:26:53.844 iocs-phishing
April 23rd 2015, 03:26:53.834 iocs-phishing
April 23rd 2015, 03:26:53.824 iocs-phishing
April 23rd 2015, 03:26:52.639 iocs-phishing
April 23rd 2015, 03:26:51.413 iocs-phishing
April 23rd 2015, 03:26:51.100 iocs-phishing
April 23rd 2015, 03:26:50.634 iocs-phishing
April 23rd 2015, 03:26:50.633 iocs-phishing
April 23rd 2015, 03:26:49.722 iocs-phishing
April 23rd 2015, 03:26:49.634 iocs-phishing
April 23rd 2015, 03:26:48.117 iocs-phishing
April 23rd 2015, 03:26:47.993 iocs-phishing
April 23rd 2015, 03:26:47.755 iocs-phishing
April 23rd 2015, 03:26:47.546 iocs-phishing
April 23rd 2015, 03:26:46.296 iocs-phishing
April 23rd 2015, 03:26:46.264 iocs-phishing
April 23rd 2015, 01:15:22.229 iocs-phishing
April 23rd 2015, 01:15:19.192 iocs-phishing
April 23rd 2015, 01:15:11.223 iocs-phishing
April 23rd 2015, 01:15:11.128 iocs-phishing
April 23rd 2015, 01:15:09.295 iocs-phishing
April 23rd 2015, 01:15:08.315 iocs-phishing
April 23rd 2015, 01:15:06.993 iocs-phishing
April 23rd 2015, 01:15:00.362 iocs-phishing
April 23rd 2015, 01:14:59.399 iocs-phishing
April 23rd 2015, 01:14:58.780 iocs-phishing
April 23rd 2015, 01:14:57.684 iocs-phishing
April 23rd 2015, 01:14:57.598 iocs-phishing
April 23rd 2015, 01:14:57.551 iocs-phishing
April 23rd 2015, 01:14:53.843 iocs-phishing
April 23rd 2015, 01:14:51.402 iocs-phishing
April 23rd 2015, 01:14:49.773 iocs-phishing
April 23rd 2015, 01:14:46.749 iocs-phishing
April 23rd 2015, 01:14:46.747 iocs-phishing
April 23rd 2015, 01:14:46.074 iocs-phishing
April 23rd 2015, 01:14:45.726 iocs-phishing
April 23rd 2015, 01:14:43.551 iocs-phishing
April 23rd 2015, 01:14:42.273 iocs-phishing
April 23rd 2015, 01:14:41.242 iocs-phishing
April 23rd 2015, 01:14:39.119 iocs-phishing
April 23rd 2015, 01:14:32.108 iocs-phishing
April 23rd 2015, 01:14:32.076 iocs-phishing
April 23rd 2015, 01:14:27.795 iocs-phishing
April 23rd 2015, 01:13:58.054 iocs-phishing
April 23rd 2015, 01:13:57.450 iocs-phishing
April 23rd 2015, 01:13:34.367 iocs-phishing
April 21st 2015, 17:02:14.810 iocs-phishing
April 21st 2015, 17:02:13.211 iocs-phishing
April 21st 2015, 17:02:07.059 iocs-phishing
April 21st 2015, 17:02:07.015 iocs-phishing
April 21st 2015, 17:02:05.108 iocs-phishing
April 21st 2015, 17:02:04.261 iocs-phishing
April 21st 2015, 17:02:03.133 iocs-phishing
April 21st 2015, 17:01:57.851 iocs-phishing
April 21st 2015, 17:01:57.689 iocs-phishing
April 21st 2015, 17:01:57.059 iocs-phishing
April 21st 2015, 17:01:54.100 iocs-phishing
April 21st 2015, 17:01:54.081 iocs-phishing
April 21st 2015, 17:01:54.053 iocs-phishing
April 21st 2015, 17:01:45.697 iocs-phishing
April 21st 2015, 17:01:44.394 iocs-phishing
April 21st 2015, 17:01:42.733 iocs-phishing
April 21st 2015, 17:01:41.648 iocs-phishing
April 21st 2015, 17:01:41.643 iocs-phishing
April 21st 2015, 17:01:41.343 iocs-phishing
April 21st 2015, 17:01:41.053 iocs-phishing
April 21st 2015, 17:01:37.309 iocs-phishing
April 21st 2015, 17:01:36.619 iocs-phishing
April 21st 2015, 17:01:36.213 iocs-phishing
April 21st 2015, 17:01:35.790 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:28.544 iocs-phishing
April 21st 2015, 17:01:23.326 iocs-phishing
April 21st 2015, 17:01:05.381 iocs-phishing
April 21st 2015, 17:01:05.050 iocs-phishing
April 21st 2015, 17:00:48.680 iocs-phishing
April 21st 2015, 17:00:43.925 iocs-phishing
April 21st 2015, 17:00:40.598 iocs-phishing
April 21st 2015, 17:00:24.375 iocs-phishing
April 21st 2015, 17:00:22.686 iocs-phishing
April 21st 2015, 17:00:19.869 iocs-phishing
April 21st 2015, 17:00:15.241 iocs-phishing
April 21st 2015, 17:00:15.040 iocs-phishing
April 21st 2015, 17:00:14.924 iocs-phishing
April 21st 2015, 17:00:05.801 iocs-phishing
April 21st 2015, 17:00:01.596 iocs-phishing
April 21st 2015, 16:59:58.323 iocs-phishing
April 21st 2015, 16:59:53.245 iocs-phishing
April 21st 2015, 16:59:53.243 iocs-phishing
April 21st 2015, 16:59:52.242 iocs-phishing
April 21st 2015, 16:59:51.274 iocs-phishing
April 21st 2015, 16:59:43.907 iocs-phishing
April 21st 2015, 16:59:41.274 iocs-phishing
April 21st 2015, 16:59:36.137 iocs-phishing
April 21st 2015, 16:59:30.816 iocs-phishing
April 21st 2015, 16:59:09.740 iocs-phishing
April 21st 2015, 16:59:09.724 iocs-phishing
April 20th 2015, 10:18:29.559 iocs-phishing
April 20th 2015, 10:18:28.220 iocs-phishing
April 20th 2015, 10:18:25.483 iocs-phishing
April 20th 2015, 10:18:25.464 iocs-phishing
April 20th 2015, 10:18:23.755 iocs-phishing
April 20th 2015, 10:18:23.316 iocs-phishing
April 20th 2015, 10:18:22.742 iocs-phishing
April 20th 2015, 10:18:18.217 iocs-phishing
April 20th 2015, 10:18:17.660 iocs-phishing
April 20th 2015, 10:18:15.014 iocs-phishing
April 20th 2015, 10:18:13.012 iocs-phishing
April 20th 2015, 10:18:12.992 iocs-phishing
April 20th 2015, 10:18:12.979 iocs-phishing
April 20th 2015, 10:18:07.924 iocs-phishing
April 20th 2015, 10:18:06.096 iocs-phishing
April 20th 2015, 10:18:03.338 iocs-phishing
April 20th 2015, 10:18:02.131 iocs-phishing
April 20th 2015, 10:18:02.124 iocs-phishing
April 20th 2015, 10:18:01.531 iocs-phishing
April 20th 2015, 10:18:01.131 iocs-phishing
April 20th 2015, 10:17:58.025 iocs-phishing
April 20th 2015, 10:17:57.393 iocs-phishing
April 20th 2015, 10:17:56.176 iocs-phishing
April 20th 2015, 10:17:55.491 iocs-phishing
April 20th 2015, 10:17:51.421 iocs-phishing
April 20th 2015, 10:17:51.412 iocs-phishing
April 20th 2015, 10:17:48.697 iocs-phishing
April 20th 2015, 10:17:43.425 iocs-phishing
April 20th 2015, 10:17:43.378 iocs-phishing
April 20th 2015, 10:17:39.386 iocs-phishing
April 20th 2015, 10:17:37.899 iocs-phishing
April 20th 2015, 10:17:37.286 iocs-phishing
April 20th 2015, 10:17:25.099 iocs-phishing
April 20th 2015, 10:17:23.902 iocs-phishing
April 20th 2015, 10:17:21.439 iocs-phishing
April 20th 2015, 10:17:19.354 iocs-phishing
April 20th 2015, 10:17:19.316 iocs-phishing
April 20th 2015, 10:17:19.196 iocs-phishing
April 20th 2015, 10:17:14.045 iocs-phishing
April 20th 2015, 10:17:11.563 iocs-phishing
April 20th 2015, 10:17:09.678 iocs-phishing
April 20th 2015, 10:17:05.783 iocs-phishing
April 20th 2015, 10:17:05.780 iocs-phishing
April 20th 2015, 10:17:05.472 iocs-phishing
April 20th 2015, 10:17:05.010 iocs-phishing
April 20th 2015, 10:16:58.499 iocs-phishing
April 20th 2015, 10:16:57.521 iocs-phishing
April 20th 2015, 10:16:55.436 iocs-phishing
April 20th 2015, 10:16:53.135 iocs-phishing
April 20th 2015, 10:16:37.603 iocs-phishing
April 20th 2015, 10:16:37.524 iocs-phishing
April 20th 2015, 10:10:01.341 iocs-REDACTED
April 20th 2015, 10:09:58.109 iocs-REDACTED
April 18th 2015, 12:47:14.934 iocs-phishing
April 18th 2015, 12:47:09.531 iocs-phishing
April 18th 2015, 12:46:58.774 iocs-phishing
April 18th 2015, 12:46:58.728 iocs-phishing
April 18th 2015, 12:46:52.673 iocs-phishing
April 18th 2015, 12:46:49.185 iocs-phishing
April 18th 2015, 12:46:46.284 iocs-phishing
April 18th 2015, 12:46:33.325 iocs-phishing
April 18th 2015, 12:46:31.587 iocs-phishing
April 18th 2015, 12:46:28.002 iocs-phishing
April 18th 2015, 12:46:23.507 iocs-phishing
April 18th 2015, 12:46:23.392 iocs-phishing
April 18th 2015, 12:46:23.227 iocs-phishing
April 18th 2015, 12:46:09.755 iocs-phishing
April 18th 2015, 12:46:06.014 iocs-phishing
April 18th 2015, 12:46:02.776 iocs-phishing
April 18th 2015, 12:45:57.440 iocs-phishing
April 18th 2015, 12:45:57.435 iocs-phishing
April 18th 2015, 12:45:56.039 iocs-phishing
April 18th 2015, 12:45:55.198 iocs-phishing
April 18th 2015, 12:45:43.674 iocs-phishing
April 18th 2015, 12:45:40.719 iocs-phishing
April 18th 2015, 12:45:34.053 iocs-phishing
April 18th 2015, 12:45:27.953 iocs-phishing
April 18th 2015, 12:45:03.562 iocs-phishing
April 18th 2015, 12:45:03.541 iocs-phishing
April 17th 2015, 12:42:24.010 iocs-phishing
April 17th 2015, 12:42:20.044 iocs-phishing
April 17th 2015, 12:42:19.018 iocs-phishing
April 17th 2015, 12:42:13.416 iocs-phishing
April 17th 2015, 12:42:13.390 iocs-phishing
April 17th 2015, 12:42:10.828 iocs-phishing
April 17th 2015, 12:42:10.361 iocs-phishing
April 17th 2015, 12:42:10.152 iocs-phishing
April 17th 2015, 12:42:06.901 iocs-phishing
April 17th 2015, 12:42:06.569 iocs-phishing
April 17th 2015, 12:42:05.323 iocs-phishing
April 17th 2015, 12:42:03.745 iocs-phishing
April 17th 2015, 12:42:03.715 iocs-phishing
April 17th 2015, 12:42:03.686 iocs-phishing
April 17th 2015, 12:42:00.112 iocs-phishing
April 17th 2015, 12:41:58.801 iocs-phishing
April 17th 2015, 12:41:57.160 iocs-phishing
April 17th 2015, 12:41:55.086 iocs-phishing
April 17th 2015, 12:41:55.085 iocs-phishing
April 17th 2015, 12:41:54.809 iocs-phishing
April 17th 2015, 12:41:54.658 iocs-phishing
April 17th 2015, 12:41:52.653 iocs-phishing
April 17th 2015, 12:41:52.316 iocs-phishing
April 17th 2015, 12:41:51.756 iocs-phishing
April 17th 2015, 12:41:50.875 iocs-phishing
April 17th 2015, 12:41:48.130 iocs-phishing
April 17th 2015, 12:41:48.127 iocs-phishing
April 17th 2015, 12:41:45.998 iocs-phishing
April 17th 2015, 12:41:41.377 iocs-phishing
April 17th 2015, 12:41:41.356 iocs-phishing
April 17th 2015, 12:41:39.354 iocs-phishing
April 17th 2015, 12:41:37.594 iocs-phishing
April 17th 2015, 12:41:37.056 iocs-phishing
April 17th 2015, 12:41:33.623 iocs-phishing
April 17th 2015, 12:41:33.218 iocs-phishing
April 17th 2015, 12:41:31.984 iocs-phishing
April 17th 2015, 12:41:29.848 iocs-phishing
April 17th 2015, 12:41:29.835 iocs-phishing
April 17th 2015, 12:41:29.820 iocs-phishing
April 17th 2015, 12:41:27.070 iocs-phishing
April 17th 2015, 12:41:25.205 iocs-phishing
April 17th 2015, 12:41:24.201 iocs-phishing
April 17th 2015, 12:41:22.811 iocs-phishing
April 17th 2015, 12:41:22.809 iocs-phishing
April 17th 2015, 12:41:22.503 iocs-phishing
April 17th 2015, 12:41:22.187 iocs-phishing
April 17th 2015, 12:41:18.811 iocs-phishing
April 17th 2015, 12:41:17.700 iocs-phishing
April 17th 2015, 12:41:15.381 iocs-phishing
April 17th 2015, 12:41:12.823 iocs-phishing
April 17th 2015, 12:41:06.318 iocs-phishing
April 17th 2015, 12:41:06.307 iocs-phishing
April 17th 2015, 02:24:11.263 iocs-phishing
April 17th 2015, 02:24:10.062 iocs-phishing
April 17th 2015, 02:24:04.908 iocs-phishing
April 17th 2015, 02:24:04.868 iocs-phishing
April 17th 2015, 02:24:01.659 iocs-phishing
April 17th 2015, 02:24:01.220 iocs-phishing
April 17th 2015, 02:24:00.796 iocs-phishing
April 17th 2015, 02:23:57.325 iocs-phishing
April 17th 2015, 02:23:56.847 iocs-phishing
April 17th 2015, 02:23:55.863 iocs-phishing
April 17th 2015, 02:23:53.581 iocs-phishing
April 17th 2015, 02:23:53.501 iocs-phishing
April 17th 2015, 02:23:53.453 iocs-phishing
April 17th 2015, 02:23:48.102 iocs-phishing
April 17th 2015, 02:23:46.442 iocs-phishing
April 17th 2015, 02:23:45.596 iocs-phishing
April 17th 2015, 02:23:43.982 iocs-phishing
April 17th 2015, 02:23:43.980 iocs-phishing
April 17th 2015, 02:23:43.455 iocs-phishing
April 17th 2015, 02:23:42.589 iocs-phishing
April 17th 2015, 02:23:40.460 iocs-phishing
April 17th 2015, 02:23:39.601 iocs-phishing
April 17th 2015, 02:23:38.820 iocs-phishing
April 17th 2015, 02:23:37.661 iocs-phishing
April 17th 2015, 02:23:34.679 iocs-phishing
April 17th 2015, 02:23:34.677 iocs-phishing
April 17th 2015, 02:23:32.243 iocs-phishing
April 17th 2015, 02:23:23.458 iocs-phishing
April 17th 2015, 02:23:23.418 iocs-phishing
April 17th 2015, 02:23:19.272 iocs-phishing
April 17th 2015, 02:23:17.163 iocs-phishing
April 17th 2015, 02:23:16.374 iocs-phishing
April 17th 2015, 02:23:10.324 iocs-phishing
April 17th 2015, 02:23:09.686 iocs-phishing
April 17th 2015, 02:23:08.307 iocs-phishing
April 17th 2015, 02:23:05.630 iocs-phishing
April 17th 2015, 02:23:05.591 iocs-phishing
April 17th 2015, 02:23:05.554 iocs-phishing
April 17th 2015, 02:23:00.293 iocs-phishing
April 17th 2015, 02:22:57.688 iocs-phishing
April 17th 2015, 02:22:55.637 iocs-phishing
April 17th 2015, 02:22:54.541 iocs-phishing
April 17th 2015, 02:22:54.540 iocs-phishing
April 17th 2015, 02:22:54.015 iocs-phishing
April 17th 2015, 02:22:53.109 iocs-phishing
April 17th 2015, 02:22:49.605 iocs-phishing
April 17th 2015, 02:22:49.108 iocs-phishing
April 17th 2015, 02:22:47.455 iocs-phishing
April 17th 2015, 02:22:46.470 iocs-phishing
April 17th 2015, 02:22:42.024 iocs-phishing
April 17th 2015, 02:22:42.022 iocs-phishing
April 17th 2015, 02:22:38.888 iocs-phishing
April 17th 2015, 02:22:27.403 iocs-phishing
April 17th 2015, 02:22:27.376 iocs-phishing
April 17th 2015, 02:22:24.490 iocs-phishing
April 17th 2015, 02:22:23.023 iocs-phishing
April 17th 2015, 02:22:21.924 iocs-phishing
April 17th 2015, 02:22:16.455 iocs-phishing
April 17th 2015, 02:22:15.606 iocs-phishing
April 17th 2015, 02:22:14.469 iocs-phishing
April 17th 2015, 02:22:11.718 iocs-phishing
April 17th 2015, 02:22:11.691 iocs-phishing
April 17th 2015, 02:22:11.667 iocs-phishing
April 17th 2015, 02:22:01.951 iocs-phishing
April 17th 2015, 02:21:58.485 iocs-phishing
April 17th 2015, 02:21:56.313 iocs-phishing
April 17th 2015, 02:21:53.767 iocs-phishing
April 17th 2015, 02:21:53.764 iocs-phishing
April 17th 2015, 02:21:52.248 iocs-phishing
April 17th 2015, 02:21:51.482 iocs-phishing
April 17th 2015, 02:21:47.088 iocs-phishing
April 17th 2015, 02:21:46.047 iocs-phishing
April 17th 2015, 02:21:45.237 iocs-phishing
April 17th 2015, 02:21:44.008 iocs-phishing
April 17th 2015, 02:21:38.428 iocs-phishing
April 17th 2015, 02:21:38.425 iocs-phishing
April 17th 2015, 02:21:32.649 iocs-phishing
April 17th 2015, 02:21:14.980 iocs-phishing
April 17th 2015, 02:21:14.921 iocs-phishing
April 17th 2015, 02:21:09.377 iocs-phishing
April 17th 2015, 02:21:07.338 iocs-phishing
April 17th 2015, 02:21:05.895 iocs-phishing
April 17th 2015, 02:20:52.442 iocs-phishing
April 17th 2015, 02:20:51.031 iocs-phishing
April 17th 2015, 02:20:45.585 iocs-phishing
April 17th 2015, 02:20:40.146 iocs-phishing
April 17th 2015, 02:20:40.081 iocs-phishing
April 17th 2015, 02:20:39.972 iocs-phishing
April 17th 2015, 02:20:30.182 iocs-phishing
April 17th 2015, 02:20:23.560 iocs-phishing
April 17th 2015, 02:20:13.307 iocs-phishing
April 17th 2015, 02:20:04.801 iocs-phishing
April 17th 2015, 02:20:04.781 iocs-phishing
April 17th 2015, 02:19:59.905 iocs-phishing
April 17th 2015, 02:19:57.242 iocs-phishing
April 17th 2015, 02:19:43.673 iocs-phishing
April 17th 2015, 02:19:38.763 iocs-phishing
April 17th 2015, 02:19:29.139 iocs-phishing
April 17th 2015, 02:19:20.502 iocs-phishing
April 16th 2015, 12:26:16.884 iocs-phishing
April 16th 2015, 12:26:16.848 iocs-phishing
April 14th 2015, 16:01:40.069 iocs-REDACTED
April 14th 2015, 16:00:30.342 iocs-REDACTED
April 14th 2015, 15:58:20.368 iocs-REDACTED
April 14th 2015, 15:54:52.206 iocs-REDACTED
April 14th 2015, 15:52:26.131 iocs-REDACTED
April 14th 2015, 15:50:51.527 iocs-REDACTED
April 14th 2015, 15:49:40.191 iocs-REDACTED
April 13th 2015, 18:46:50.362 iocs-phishing
April 13th 2015, 18:46:39.156 iocs-phishing
April 13th 2015, 18:46:38.954 iocs-phishing
April 13th 2015, 18:46:33.783 iocs-phishing
April 13th 2015, 18:46:31.639 iocs-phishing
April 13th 2015, 18:46:28.755 iocs-phishing
April 13th 2015, 18:46:20.368 iocs-phishing
April 13th 2015, 18:46:19.194 iocs-phishing
April 13th 2015, 18:46:15.986 iocs-phishing
April 13th 2015, 18:46:11.949 iocs-phishing
April 13th 2015, 18:46:11.895 iocs-phishing
April 13th 2015, 18:46:11.853 iocs-phishing
April 13th 2015, 18:46:02.574 iocs-phishing
April 13th 2015, 18:45:56.101 iocs-phishing
April 13th 2015, 18:45:54.437 iocs-phishing
April 13th 2015, 18:45:54.434 iocs-phishing
April 13th 2015, 18:45:53.729 iocs-phishing
April 13th 2015, 18:45:53.293 iocs-phishing
April 13th 2015, 18:45:49.574 iocs-phishing

While we cannot release the actual information because it would expose the actual targets we have also seen specific malware similar to Dyre but modified specifically for this attack. Customers of SLC Security Services LLC have been provided additional information in direct messages to their consoles for review.

It is our policy not to release any identifiable information but we continue to see activity directed at this entity. We will release information to the University if they make a formal request.

BREACH: Ryanair Hacked

Low-cost airline Ryanir has been the victim of a major banking hack, with more than $5 million stolen from its business account last week, reports City AM. 

The company has reported the crime and asked the Criminal Assets Bureau in Dublin to help it recover the money, which is said to have been transferred electronically to a bank in China. It is also working with authorities in Asia. [...]

Source: We Live Security

Pay Attention Open Source Indicators Coming Soon...

We have decided to open up some of our indicators to the public. We know your monitoring our blog because we regularly look at our visitor stats and we run additional reports so there is interest in what we are doing. In addition starting tomorrow our commercial feeds will be available for paid subscribers. Existing customers under contract will be grandfathered for the duration of their contracts.

For subscription information please visit our labs page for additional information.

Today's Mass Activity

redacted-customer 94.43.226.251 system smtp 2015-04-30 13:25:09 2015-04-30 19:25:09 1
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:25:22 2015-04-30 19:25:22 1
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:25:40 2015-04-30 19:25:40 1
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:26:06 2015-04-30 19:26:06 2
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:26:33 2015-04-30 19:26:33 2
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:26:59 2015-04-30 19:26:59 3
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:27:28 2015-04-30 19:27:28 3
redacted-customer 94.43.226.251 system smtp 2015-04-30 13:27:55 2015-04-30 19:27:55 4
test 189.123.80.40 system smtp 2015-04-30 18:21:23 2015-05-01 00:21:23 297
test 189.123.80.40 system smtp 2015-04-30 18:24:43 2015-05-01 00:24:43 300

BREACH: UC Berkeley Breached Again... Or still depending on your perspective...

We are honestly tired of reporting on this one. We let them know about problems at least twice and I'm pretty sure the folks at databreache's have also notified them. It seems they just can't get things in order...

A look at our database shows they have been compromised for AWHILE:

April 28th 2015, 22:07:28.862 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:07:28.696 slcsecurity-iocs UC Berkeley
April 28th 2015, 22:06:03.228 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:06:03.047 slcsecurity-iocs UC Berkeley
April 28th 2015, 22:05:45.521 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:05:45.315 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:12:28.252 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:12:27.279 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:09:34.675 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:09:34.501 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:08:00.276 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:08:00.102 slcsecurity-iocs UC Berkeley
April 22nd 2015, 19:27:10.387 slcsecurity-iocs UC CAMPUS BERKELEY
April 22nd 2015, 19:27:09.456 slcsecurity-iocs UC Berkeley
April 21st 2015, 03:12:13.399 slcsecurity-iocs UC CAMPUS BERKELEY
April 21st 2015, 03:12:13.094 slcsecurity-iocs UC Berkeley
April 21st 2015, 01:48:49.009 slcsecurity-iocs UC CAMPUS BERKELEY
April 21st 2015, 01:48:48.507 slcsecurity-iocs UC Berkeley
April 20th 2015, 13:28:05.076 slcsecurity-iocs UC CAMPUS BERKELEY
April 20th 2015, 13:28:04.916 slcsecurity-iocs UC Berkeley
April 19th 2015, 17:34:39.514 slcsecurity-iocs UC CAMPUS BERKELEY
April 19th 2015, 17:34:37.859 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:18:27.701 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:18:27.536 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:18:09.489 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:18:09.340 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:17:49.376 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:17:49.216 slcsecurity-iocs UC Berkeley
April 16th 2015, 12:06:35.424 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 12:06:35.247 slcsecurity-iocs UC Berkeley
April 16th 2015, 11:58:36.116 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 11:58:33.307 slcsecurity-iocs UC Berkeley
April 16th 2015, 01:34:21.163 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 01:34:20.078 slcsecurity-iocs UC Berkeley
April 14th 2015, 14:44:45.261 slcsecurity-iocs UC CAMPUS BERKELEY
April 14th 2015, 14:44:44.912 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:27:40.384 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:27:39.068 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:14:12.002 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:14:11.830 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:08:50.339 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:08:49.834 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:58:17.976 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:58:17.803 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:57:14.625 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:57:14.390 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:55:54.768 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:55:54.327 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:50:57.217 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:50:55.666 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:50:01.878 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:50:00.428 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:43:28.333 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:43:28.068 slcsecurity-iocs UC Berkeley

This is the latest incident. Previously activity was seen back in January and February but then they were removed due to cleaning the infected systems. Now they are back in the system again...

We will continue to monitor.

BREACH: Partners Healthcare System

Databreaches.net is reporting that Partners Healthcare System has reported that they have been the target of a phishing campaign. For more information see the original post here.

BREACH: DeCicco & Sons grocery store suffers data breach

A popular New York supermarket chain is reporting that customer payment card information has been compromised. Customers began noticing out of state charges on their credit cards shortly after shopping at the chain.

EARLIER REPORT CONFIRMED: See Mailing List for POS Malware Post

Subscribe to our news feeds mailing list for specifics on a new POS Malware variant that we have tied to an earlier attack we detected in late March. The IP of that attack was 80.82.64.201 and since we are noting carding and Point of Sales malware activity to this address.

This is the same post that angered many security professionals but as you can see in a recent Government investigations that the incident has been confirmed. In addition specific IOC's for the POS malware were released and specifically named the IP address listed in our previous post.

Malicious Activity: University of Pennsylvania

On 4/25/2015 SLC Security Services LLC has notified University of Pennsylvania of a security issue with some host on their network. We will advise if we receive any response concerning the issue.

Malicious Activity: Harvard University

On 4/25/2015 SLC Security Services LLC has notified Harvard of a security issue with some host on their network. We will advise if we receive any response concerning the issue.

SLC Security to Open Source ElasticMon

SLC Security Services LLC as part of our security operations model has announced the release of a Windows based console for monitoring elasticsearch instances for relevant security data. The platform will be posted to Github within the next few days and will allow features such as external command processing, plugin integration that will allow security engineers to kick off jobs in analytics products and to pivot and cross reference IOC data in near real time.

As a side benefit to opening up the product to the open source community we are hoping that other users of this technology will also integrate with the platform due to the native support for standards that include CSV, STIX,XML and native nosql blob output as well as SIEM integration. 

Look for it folks we think you'll like it. 

POSSIBLY BREACHED AGAIN: Univ of Utah - Are you guys still owned? Looks like it!

Looks like they still are having issues. While they haven't noted any breaches we are pretty sure from what we have been seeing on our systems and sensors that they have an issue. 

UPDATE: Within minutes of the report the University of Utah has begun the process to research this issue. Apparently this system is a research VM on their campus network. 

ALERT: 43.255.0.0/16 Netblock Extremely Active and Noisy

We wanted to put out an alert that many of our sensors and clients are reporting inbound SMTP infected dyzera and ssh scanning. What's interesting is that the actors appears to not care how noisy they are. We highly recommend blocking the entire /16 netblock.

Dyre Hit - Bowling Green Municipal Utilities

We received several Dyre infected email messages originating from the Bowling Green Municipal Utilities specifically from 208.80.211.35 IP address over the last few days.

BREACH: HSBC Finance Notifies Mortgage Customers of Data Breach

HSBC has informed New Hampshire's Attorney General of a compromise of some records of current and former mortgage customers of its HSBC Finance unit. HSBC Finance is a nonbank lender, formerly known as Household Finance, that HSBC bought in 2003. The bank is in the process of winding it down.

SOURCE: http://www.americanbanker.com/news/bank-technology/hsbc-finance-notifies-mortgage-customers-of-data-breach-1073803-1.html

What we have seen in the last 24 hours

Our analyst have noted the following attacks in the last 24 hours. We are tracking 311,510 attacks on our sensors. Out of our sensors we noted that 6 financial organizations have been compromised, 12 sites were infected with spyware, 4 medical institutions were compromised, 613 banks were attacked but we saw no new compromises in the banking sector, 9 research organizations were seen attacking other infrastructure, there were a total of 57 new attackers identified in the last 24 hours. 

20 Years Later SSH Brute Force Persist

For the past few weeks I have been looking at an old issue. You see in 1995 I started an Internet Service and as soon as I started bringing servers online I noted that there were random ssh login attempts to our systems. Back then it was easy to block IP addresses and be done with it but it's not that cut and dry today. With natting, apache name directives and web server naming conventions a single IP address can host thousands of individual websites and the chances of blocking a legitimate service is pretty high but guess what? We don't care.

We have taken the stance that if we see your boxes behaving badly and your not taking any action to resolve the situation then we will block you from our systems and all systems that we manage. A quick check our our system indicates that we have 57 million indicators of attack or compromise. When we filter with ssh as a keyword we noted that 255,096 host are currently on our blacklist for ssh brute force attempts and another 2.7 million are on the alert list for scanning. The 255,096 number may look small on the scale of things but the originating sources are very interesting in deed.

The majority of the scanning activity being seen is coming from some predictable locations to include Asia/China, Russia and some locations in South America. In fact 79% of the attacks on our sensors are from the listed locations.

Our top 5 locations seen brute forcing ssh accounts this past week:

1. China
2. Russia
3. Amsterdam
4. Valenzuela
5. Turkey

What's interesting is that the attacks are noisy and easily detected yet many network administrators continue to allow traffic from these locations. In an upcoming post we will be sharing a list of country blocks that should eliminate around 95% of the ssh scanning activity you will see on your networks.

One things for sure, ssh scanning will be here for many, many years to come. A solution is to eliminate interactive logins and utilize certificate based login. This method allows you to collect information and be fairly certain that your systems won't be attacked in this manner. Adding 2 factor authentication pretty much ensures that nobody will get by your ssh defense.

Today's Attacks - Note the uptick in attacks from proxy servers

We are seeing a spike in attacks originating from proxy servers today. It seems that some recent post on some vulnerabilities at Universities and Campuses is fueling an attack frenzy. You can read Data Breaches post on the activity here. In addition we are seeing some attacks that are targeting medical facilities as well. This activity started around 4PM EST earlier today. 

Very soon we will be opening up our data sources to researchers so if you are on our research team or a trusted partner look for an email from the SOC with your login instructions. 

Today's Attacks - Here is what we are seeing today

SPECIAL REPORT: The French Espionage Report

A special report is set for release this week. The report is only available to subscribers. We will take a detailed look at recent malware including Casper and some other very interesting findings that were recently discovered.

REPORT: Jefferson County Public Library (Active Hacking)

We have been monitoring activity on our sensors from Jefferson County Public Library from IP 199.117.70.6 most of the evening. The attacks are happening at multiple sensor locations to include Chicago and Texas as well as a sensor in the EU.

We have actively blocked this attacker in our customer systems and will update if we receive any additional information.

BREACH: Hackers who breached White House network allegedly accessed sensitive data

Russian-government hackers who reportedly breached the White House's computer systems late last year gained access to sensitive information, though US officials said at the time that they hadn't, according to a story published Tuesday by CNN.


Sources:
http://www.cnet.com/news/hackers-who-breached-white-house-network-allegedly-accessed-sensitive-data/

Today's Activity - What we have seen today

THEFT OF INFORMATION: UC Riverside

UC Riverside officials are notifying 8,000 graduate students and graduate applicants that their personal identity information is at risk.

A desk-top computer stolen during a break-in at the campus’ graduate division offices March 13, contained the Social Security numbers of the students and potential students. Officials said they had no evidence that the information has been used for identity theft and they have no leads on who stole the computer.

SOURCE: http://www.pe.com/articles/information-764066-computer-lovekin.html

NEWS: FBI investigating two St Louis area attacks as hate crimes

The FBI is investigating whether hate crimes were committed during two St. Louis area attacks where suspects allegedly made reference to Ferguson, including the assault of former St. Louis Cardinals outfielder Curt Ford, investigators said Monday.

Both attacks happened in March, one involving a white victim and black attackers, the other a black victim attacked by a white man. The suspects in both cases allegedly made references to Ferguson, the St. Louis suburb at the center of racial strife since a white police officer in August fatally shot 18-year-old Michael Brown, who was black and unarmed.

FBI spokeswoman Rebecca Wu said the agency is looking into both cases for possible hate crimes. Anyone found guilty of a federal hate crime involving bodily injury could face up to 10 years in prison.

RECENT BRUTE FORCERS: You are blocking these right?!

121.14.5.125,ssh-brute-force,2015-04-06
218.87.111.110,ssh-brute-force,2015-04-06
43.255.191.164,ssh-brute-force,2015-04-06
37.132.67.140,ssh-brute-force,2015-04-06
218.87.111.108,ssh-brute-force,2015-04-06
218.87.111.107,ssh-brute-force,2015-04-06
61.174.49.103,ssh-brute-force,2015-04-06
218.87.111.117,ssh-brute-force,2015-04-06
43.255.190.151,ssh-brute-force,2015-04-06
182.100.67.113,ssh-brute-force,2015-04-06
182.100.67.114,ssh-brute-force,2015-04-06
221.229.160.222,ssh-brute-force,2015-04-06
58.218.204.226,ssh-brute-force,2015-04-06
58.218.199.49,ssh-brute-force,2015-04-06
221.229.166.29,ssh-brute-force,2015-04-06
218.65.30.92,ssh-brute-force,2015-04-06
58.218.204.245,ssh-brute-force,2015-04-06
218.87.109.60,ssh-brute-force,2015-04-06

Colleges check for SQLi on your systems!

Honestly for the past few months we have seen nothing but a rash of colleges and universities getting smacked with SQLi exploits. Test your servers or I'm sure the hackers responsible for these attacks will test it for you.

We have at least 26 confirmed reports of breaches of which some have been reported and some have been brushed under the rug...

BREACH: Linux Australia

Linux Australia, a consortium in charge of organizing Linux conferences Down Under, acknowledged over the weekend it was breached by attackers who were able to secure access to one of its servers, and with it, potential user information.

The Dyre Wolf - IBM Report on Payment System Breach

According to IBM’s Security Intelligence division, a new threat to payments security has been discovered. Called “The Dyre Wolf,” the malware attack has already been used to transfer $1 million into the pockets of cybercriminals.

More information available via mailing list.

BREACH: Recovery Sports Grill

Media is reporting that credit card data has been stolen from Recover Sports Grill. 

BREACH: Biggby Coffee Reports Breach

Biggby Coffee has been seen in media reports as having been breached with customer data theft.

Biggby Coffee announced that personal information from some customers and job applicants might have been accessed after a company database was hacked, according to the Associated Press.

The data might include names, addresses, phone numbers, email addresses and employment history information, the report said. Biggby said no credit card information, bank account numbers, Social Security numbers nor driver's license numbers were accessed, the report said.

Field Report: CVS POS

We are getting reports of issues with CVS POS systems. According to the anonymous report they are having system wide issue. 

Yesterday's Activity

We are testing out some new products. We thought we would share what we are seeing in our platforms.

MALWARE: Bank Credential Stealing via Malware (Subset of Report)

We have seen several reports today for this malware with subjects
claiming to be from Equifax.

Attachment Name: my_new_photo3482374823749823.zip
MD5: 71c6bffc6a959355b5d1fe6ca75fdaf3

This file executed a process and injected code into it while unpacking
The file installs itself as an autorun item at Windows Startup
Generates some ICMP traffic

Targetted Phishing Emails aimed at JP Morgan Customers - Specific details on the mailing list serve

Earlier today we put out some information on some targeted phishing we have been seeing on our network sensors and some mail servers in which we have access to logs.

It seems this is an ongoing issue since at least the 18th of March.

Additional Information:
http://sanesecurity.blogspot.com/2015/03/jp-morgan-access-secure-message-Elwood-Ritter.html

BREACH: FBI, IRS and Bradley University investigating data breach leaving thousands vulnerable

PEORIA, Ill. -- A cyber data breach at Bradley University means thousands of people are vulnerable to identity theft. An investigation by the FBI and IRS is on-going at Bradley University. The data of thousands of employees and their families are at risk.

Bradley University officials say investigators found malware on two university computers. Those computers had access to personal information for about 4700 current and former employees and potentially their families.

Note: This is not surprising given the number of Universities that have been hacked over the last several months mostly with SQL injections from what has been reported on Twitter, reports and disclosures. We have been reporting on some of the ones that we detected as have some other sites.

Cedar APT IOC's Added

Cedar APT IOC's Added to the commercial feed.

A total of 6 IOC's related to Cedar have been updated.

BREACH: Advantage Dental

Advantage Dental ("Advantage"), an Oregon-based dental services provider notified 151,626 patients of a breach of personal patient protected health information (PHI/HIPAA) after its intrusion detection system discovered an internal database at Advantage was illegally accessed.  The unauthorized access occurred between February 23, 2015 and February 26, 2015. The intruder was able to gain access to this database through a computer that had been infected with malware.  Advantage terminated the illegal access immediately upon discovery on February 26, 2015. The intrusion resulted in the unauthorized access to the name, date of birth, phone number, social security number, and home address. No treatment, payment, or any other financial data was accessed.

First reported 16 March 2015. 

Read More: https://secure.advantagedental.com/index.asp?din=598

BREACH: Startup Slack Reports Data Breach

Looks like they have implemented 2 factor authentication. 

http://www.usatoday.com/story/tech/2015/03/27/slack-data-breach/70545436/

Under Attack - This Pattern Looks Familiar

Just like in previous disclosures that we have provided information within a few hours we end up coming under attack and just like the last time we say please by all means hit us so we can map out your networks and infected host...

This is a lesson in how to map out a botnet in real time. Thanks guys!

UPDATED WITH INDICATORS AND NOTES: Large BOTNET exposed

SLC Security Services LLC has discovered a previously unknown BOTNET network. We will be adding the indicators to our paid feeds. We had previously been seeing the nodes responding to various internet host but we couldn't get the host to respond to any of the request we sent. Apparently the bot command and control requires a certain sequence of ports to be queried prior to the C+C actually responding to the infected bot request in a normal fashion.

More information is being sent out via our alert feed to our paid subscribers.

UPDATE: Updated indicators have been rolled out to our client systems. If you see any indicators triggering with "BOTLICK" as the alert type page our on call contact specified in your contract. We would love to catch an active client so we can determine the initial infection vectors.

ADDITIONAL INDICATORS:
If you see encrypted traffic going to any of the following IP addresses please check your source for processes that should not be running. This is affecting Windows 7 and Windows 8 PC's.

179.111.212.221
81.149.12.77
89.156.44.210
38.108.61.227
37.110.214.124
86.126.135.242
112.211.182.241
125.62.97.218
95.31.88.21
112.198.90.89 - Additional C+C Detected
36.79.181.47 - Additional C+C Detected
190.107.244.151 - C+C
80.82.64.201 - C+C

ADDITIONAL DETAILS:
Our security analyst have been able to determine that there are at least 300+ host connected to the last indicator 36.79.171.47. We were able to pull in some additional data from our partners honeypots and network sensors to get a rough count of the activity level going to this system.

UPDATE: We are also seeing large numbers of connections to 80.82.64.201 as well. 

The system appears to be in Indonesia and is connected via cable modem. We are actively working with the ISP to see if they can provide any additional details.

UPDATES MOVED TO MAILING LIST

UPDATED 3-25-2014: Third US Health Entity Suspected of being Compromised

While we can't name any particular names at this time we have started seeing indicators of another related attack originating out of China aimed at US Healthcare entities. This time another well known affiliate of a previously breached healthcare entity appears to be attacking other Healthcare entities in California and Arizona.

Additional research is being done at this time but it appears as though a new malware variant is being sent via Phishing emails and they are coming from other healthcare entities so it appears as legitimate traffic which may be problematic as they may be assumed to be trusted entities.

The malware is being sent via email and is in zip, exe and also embedded HTML to infected flash websites. UPDATE: And now we are seeing PDF and word document with the same payload.

Updates will be posted here as we can obtain additional information. It appears as though one individual was also socially engineered to get malware inside an organization in Arizona. Additional reports are coming in from Utah and North Dakota as well.

Additional Details:
After researching we have noted that the botnet post from yesterday seems to be directly related to the compromised host.  - Additional IP's (Indicators) can be seen in this post.

After our report yesterday we also noted similar activity to what was seen prior to the Anthem, Community Health Systems and several University breaches we have been tracking.

If you run snort we have sent out the snort signatures (a total of 5 of them via our alert mailing list).

MOVED TO MAILING LIST - In addition another Intel provider may have already leaked the information this past week.... Have a good weekend everybody!