Russian Info, Cyber and Disinformation (Catch all till 2017)

[OUTLAW 09]

While this article is from 2015....it concerns the activities of a Russian criminal gang involved in heavy hacking and fraud of banks and lately even the main Oracle MICROS database that handles hundreds of Point of Sales devices....WHICH Oracle has been extremely slow to react to........

http://www.welivesecurity.com/2015/0...king-new-guns/

Amazingly "spearphishing" is the key in many hacking attempts and was the one used to gain entrance into the DNC network....and actually is easy to avoid if the endusers are well trained in spotting the attempts....


The Russian Carbanak gang is back and packing new guns

By Anton Cherepanov posted 8 Sep 2015 - 10:49AM

Cybercrime

The Carbanak financial APT group made the headlines when Group-IB and Fox-IT broke the news in December 2014, followed by the Kaspersky report in February 2015. The two reports describe the same cybercriminal gang which stole up to several hundreds of millions of dollars from various financial institutions.

However, the story is interesting not only because of the large amount of money stolen but also from a technical point of view. The Carbanak team does not just blindly compromise large numbers of computers and try to ‘milk the cow’ as other actors do, instead they act like a mature APT-group. They only compromise specific high-value targets and once inside the company networks, move laterally to hosts that can be monetized.

A few days ago CSIS published details about new Carbanak samples found in the wild.

In this blog we will describe the latest developments in the Carbanak story.

Casino hotel hack

At the end of August, we detected an attempt to compromise the network of a casino hotel in the USA. The infection vector used in this attack may have been a spearphishing e-mail with a malicious attachment using an RTF-exploit or .SCR file. The attackers’ aim was to compromise PoS servers used in payment processing.

The main backdoor used by attackers was the open-source Tiny Meterpreter. In this case, however, the source was modified – the process injection to svchost.exe was added to its functionality.

This Tiny Meterpreter backdoor dropped two different malware families:
•Win32/Spy.Sekur – well known malware used by the Carbanak gang
•Win32/Wemosis – a PoS RAM Scraper backdoor

As mentioned here by our colleagues from TrendMicro, Carbanak malware is capable of targeting Epicor/NSB PoS systems, while Win32/Wemosis is a general-purpose PoS RAM Scraper which targets any PoS that stores card data in the memory. The Wemosis backdoor is written in Delphi and allows the attacker to control an infected computer remotely.

Both executables were digitally signed with the same certificate:

image1

The certificate details:

Company name: Blik
Validity: from 02 October 2014 to 03 October 2015
Thumbprint: ‎0d0971b6735265b28f39c1f015518768e375e2a3
Serial number: ‎00d95d2caa093bf43a029f7e2916eae7fb
Subject: CN = Blik
O = Blik
STREET = Berzarina, 7, 1
L = Moscow
S = Moscow
PostalCode = 123298
C = RU

This certificate was also used in the digital signature of a third malware family used by the same gang: Win32/Spy.Agent.ORM.

Win32/Spy.Agent.ORM – overview

Win32/Spy.Agent.ORM (also known as Win32/Toshliph) is a trojan used as one of their first-stage payloads by the Carbanak gang. The binary of the testing version was signed with a Blik certificate: moreover, Spy.Agent.ORM shares some similarities in the code with “the regular” Carbanak malware.

The Win32/Spy.Agent.ORM malware family is already known in the industry because of two blogposts. In July 2015 security company Cyphort reported the compromise of a news portal and a banking site – rbc.ua and unicredit.ua. It turns out that the compromised sites served Win32/Spy.Agent.ORM. After that, Blue Coat reported a spearphishing attempt targeting Central Bank of Armenia employees, the payload being the same.

This malware appeared on our radar at the beginning of summer 2015, and afterwards we started to track it.

We have seen attempts to attack various companies in Russia and Ukraine using spearphishing e-mails that have malicious attachments consisting of .SCR files or .RTF exploits.

Here is an example of a spearphishing email sent to one of the biggest Forex-trading companies:

image2

Roughly translated from Russian to English, it says:

“Due to the high volatility of the ruble exchange rate the Bank of Russia sends rules of trading on the currency market. Password the attached document: cbr”

Here is another example of a spear phishing attempt. Email with this text was sent to the largest electronic payment service in Russia:

Постановлением Роскомнадзора от 04.08.2015г. Вам необходимо заблокировать материалы попадающие под Федеральный закон от 27.07.2006 N 152-ФЗ (ред. от 21.07.2014) “О персональных данных”. Перечень материалов в документе.

Пароль roscomnadzor

Another rough translation from Russian to English:

“According to Roscomnadzor prescript you should block the materials, which you can find in the attachment. Password is roscomnadzor”

We have seen similar .SCR files with following filenames:
•АО «АЛЬФА-БАНК» ДОГОВОР.scr (Alfabank contract)
•Перечень материалов для блокировки от 04.08.2015г.scr (List to block)
•Postanovlene_ob_ustranenii_18.08.2015.pdf %LOTS_OF_SPACES% ..scr
•Правила Банка России от 06.08.2015.pdf %LOTS_OF_SPACES% .scr (Rules of Bank of Russia)

All these attachments contained a password protected archive with .SCR file. The files had Adobe Acrobat reader icon or MS Word icons.

In other cases attackers used RTF files with different exploits, including an exploit for one of the latest Microsoft Office vulnerabilities, CVE-2015-1770, which was patched by Microsoft in June 2015 in MS15-059.

We have seen RTF files with the following names used in attacks:
•prikaz-451.doc
•REMITTANCE ADVICE ON REJECTION.doc
•PROOF OF REMITTANCE ADVICE .doc
•HDHS739_230715_010711_A17C7148_INTERNAL.doc
•Բանկերի և բանկային գործունեության մասին ՀՀ օրենք 27.07.2015.doc (Armenian: The Law on Banks and Banking 27.07.2015)
•PAYMENT DETAILS.doc
•АО «АЛЬФА-БАНК» ДОГОВОР.doc (Russian: Alpha-bank contract)
•AML REPORTS_20082015_APPLICATION FORM-USD-MR VYDIAR.doc
•Anti-Money Laudering & Suspicious cases.doc
•ApplicationXformXUSDXduplicateXpayment.doc
•AML USD & Suspicious cases.doc
•Amendment inquiry ( reference TF1518869100.doc
•Information 2.doc

Here is example of a spearphishing message that was sent to a bank in the United Arab Emirates:

Continued.....

Why post an article about Russian criminal hacking...this group has made over 1B USDs by hacking banks and now Oracle.....in Russia a gang that makes over 1B USDs and is highly professional will not go unnoticed by the Russian FSB/SVR security services.

The lines between state sponsored hacking and professional criminal hacking are largely fluid in Russia and they share a lot of the more common hacking methods and tools.....

This gang is extremely close to the FSB/SVR and they can provide every effective cover for hacks that might be attributed to them but are really state sponsored hacks.....

[OUTLAW 09]

In April 2016, security firm Trend Micro published a damning report about a Web hosting provider referred to only as a “cyber-attack facilitator in the Netherlands.” If the Trend analysis lacked any real punch that might have been because — shortly after the report was published — names were redacted so that it was no longer immediately clear who the bad hosting provider was. This post aims to shine a bit more light on the individuals apparently behind this mysterious rogue hosting firm — a company called HostSailor[dot]com.

The Trend report observes that the unnamed, Netherlands-based virtual private sever (VPS) hosting provider appears to have few legitimate customers, and that the amount of abuse emanating from it “is so staggering that this company will remain on our watchlist in the next few months.”

What exactly is the awfulness spewing from the company that Trend takes great pains not to name as HostSailor.com? For starters, according to Trend’s data (PDF) HostSailor has long been a home for attacks tied to a Russian cyber espionage campaign dubbed “Pawn Storm.” From the report:

“Apart from Pawn Storm, a less sophisticated group of threat actors called “Pawn Storm seems to feel quite at home. They used the VPS hosting company for at least 80 attacks since May 2015. Their attacks utilized C&C servers, exploit sites, spear-phishing campaigns, free Webmail phishing sites targeting high profile users, and very specific credential phishing sites against Government agencies of countries like Bulgaria, Greece, Malaysia, Montenegro, Poland, Qatar, Romania, Saudi Arabia, Turkey, Ukraine, and United Arab Emirates. Pawn Storm also uses the VPS provider in the Netherlands for domestic espionage in Russia regularly.”

DustySky (PDF link added) is using the VPS provider. These actors target Israel, companies who do business in Israel, Egypt and some other Middle Eastern governments.”

WHO IS HOSTSAILOR?

Trend’s report on HostSailor points to a LinkedIn profile for an Alexander Freeman at HostSailor who lists his location as Dubai. HostSailor’s Web site says the company has servers in The Netherlands and in Romania, and that it is based in Dubai. The company first came online in early 2013.

Related PDFs at these links.......
http://documents.trendmicro.com/asse...etherlands.pdf

http://www.clearskysec.com/wp-conten..._TLP_WHITE.pdf

[OUTLAW 09]

Carbanak Gang Tied to Russian Security Firm?

The Carbanak gang derives its name from the banking malware used in countless high-dollar cyberheists. The gang is perhaps best known for hacking directly into bank networks using poisoned Microsoft Office files, and then using that access to force bank ATMs into dispensing cash. Russian security firm Kaspersky Lab estimates that the Carbanak Gang has likely stolen upwards of USD $1 billion — but mostly from Russian banks.

Carbanak is allegedly tied to a Russian security firm that claims to work with some of the world’s largest brands in cybersecurity.

This company's CEO is....a Mr. Tveritinov is quoted as “the CEO of InfoKub” in a press release from FalconGaze, a Moscow-based data security firm that partnered with the InfoKube to implement “data protection and employee monitoring” at a Russian commercial research institute. InfoKube’s own press releases say the company also has been hired to develop “a system to protect information from unauthorized access” undertaken for the City of Perm, Russia, and for consulting projects relating to “information security” undertaken for and with the State Ministry of Interior of Russia.

The company’s Web site claims that InfoKube partners with a variety of established security firms — including Symantec and Kaspersky. The latter confirmed InfoKube was “a very minor partner” of Kaspersky’s, mostly involved in systems integration. Zyxel, another partner listed on InfoKube’s partners page, said it had no partners named InfoKube. Slovakia-based security firm ESET said “Infokube is not and has never been a partner of ESET in Russia.”

If Mr. Tveritinov, has either knowledge of, or direct involvement in even a fraction of the criminal goings-on within his address block, then the possibility that he may perhaps also have a role in other and additional criminal enterprises… including perhaps even the Carbanak cyber banking heists… becomes all the more plausible and probable,” Guilmette said.

It remains unclear to what extent the Carbanak gang is still active. Last month, authorities in Russia arrested 50 people allegedly tied to the organized cybercrime group, whose members reportedly hail from Russia, China, Ukraine and other parts of Europe. The action was billed as the biggest ever crackdown on financial hackers in Russia.

BUT WAIT there is no history of any Russian court convictions after these arrests and behold they are back in business.....

BTW.......that CEO.....

Cubehost also was the hoster responsible for cryptolocker infrastructure which is the same group as zeusp2p/gameover.

Mr. Tveritinov has been very busy and now is a wealthy ‘business’ man.

[OUTLAW 09]

I will be posting more on the issue of Zero Day Vulnerabliities the key source of virtually all the best hacking going on right now and how that ties back into the latest NSA breach......and the release of their hacking tools into the "wild".....

Got $90,000? A Windows 0-Day Could Be Yours

How much would a cybercriminal, nation state or organized crime group pay for blueprints on how to exploit a serious, currently undocumented, unpatched vulnerability in all versions of Microsoft Windows? That price probably depends on the power of the exploit and what the market will bear at the time, but here’s a look at one convincing recent exploit sales thread from the cybercrime underworld where the current asking price for a Windows-wide bug that allegedly defeats all of Microsoft’s current security defenses is USD $90,000.

So-called “zero-day” vulnerabilities are flaws in software and hardware that even the makers of the product in question do not know about. Zero-days can be used by attackers to remotely and completely compromise a target — such as with a zero-day vulnerability in a browser plugin component like Adobe Flash or Oracle’s Java. These flaws are coveted, prized, and in some cases stockpiled by cybercriminals and nation states alike because they enable very stealthy and targeted attacks.

The $90,000 Windows bug that went on sale at the semi-exclusive Russian language cybercrime forum exploit[dot]in earlier this month is in a slightly less serious class of software vulnerability called a “local privilege escalation” (LPE) bug. This type of flaw is always going to be used in tandem with another vulnerability to successfully deliver and run the attacker’s malicious code.

LPE bugs can help amplify the impact of other exploits. One core tenet of security is limiting the rights or privileges of certain programs so that they run with the rights of a normal user — and not under the all-powerful administrator or “system” user accounts that can delete, modify or read any file on the computer. That way, if a security hole is found in one of these programs, that hole can’t be exploited to worm into files and folders that belong only to the administrator of the system.

This is where a privilege escalation bug can come in handy. An attacker may already have a reliable exploit that works remotely — but the trouble is his exploit only succeeds if the current user is running Windows as an administrator. No problem: Chain that remote exploit with a local privilege escalation bug that can bump up the target’s account privileges to that of an admin, and your remote exploit can work its magic without hindrance.

The seller of this supposed zero-day — someone using the nickname “BuggiCorp” — claims his exploit works on every version of Windows from Windows 2000 on up to Microsoft’s flagship Windows 10 operating system. To support his claims, the seller includes two videos of the exploit in action on what appears to be a system that was patched all the way up through this month’s (May 2016) batch of patches from Microsoft (it’s probably no accident that the video was created on May 10, the same day as Patch Tuesday this month).

A second video appears to show the exploit working even though the test machine in the video is running Microsoft’s Enhanced Mitigation Experience Toolkit (EMET), a free software framework designed to help block or blunt exploits against known and unknown Windows vulnerabilities and flaws in third-party applications that run on top of Windows.

[OUTLAW 09]

Write-up of earlier attacks on Finnish media by Russian hackers. @ShimonPro @evanperez
http://yle.fi/uutiset/russian_cyber-...sanoma/8919118 …

BREAKING @FBI investigating #Russia's intelligence service hack of @nytimes, other papers
http://www.cnn.com/2016/08/23/politi...fbi/index.html …

There'a clear evidence Russian intel has hacked into the most sensitive communications of the US+our closest Allies. http://observer.com/2016/08/the-real...le-inside-nsa/ …

[OUTLAW 09]

Write-up of earlier attacks on Finnish media by Russian hackers. @ShimonPro @evanperez
http://yle.fi/uutiset/russian_cyber-...sanoma/8919118 …

BREAKING @FBI investigating #Russia's intelligence service hack of @nytimes, other papers
http://www.cnn.com/2016/08/23/politi...fbi/index.html …

There'a clear evidence Russian intel has hacked into the most sensitive communications of the US+our closest Allies. http://observer.com/2016/08/the-real...le-inside-nsa/ …

"Most of what Delisle gave Moscow wasn’t Canadian information but belonged 2 Five Eyes, much of which came from NSA"

[OUTLAW 09]

New York Times’s Moscow Bureau Was Targeted by Hackers
http://mobile.nytimes.com/2016/08/24...?_r=0&referer= …

[OUTLAW 09]

Clear evidence on just how Russia blends info/disinfo warfare together with cyber warfare.......

Whoops...got caught..... Russian hackers post same document twice, but with glaring differences
http://www.ottawacitizen.com/News/12147705/story.html …

So with the WikiLeaks announced data dump of Clinton DNC emails....how many are real and how many are "fake"....

[OUTLAW 09]

"NSA Targeted Chinese Firewall Maker Huawei, Leaked Documents Suggest"
http://bit.ly/2bRyWzd
One good turn deserves another

[OUTLAW 09]

Clear evidence on just how Russia blends info/disinfo warfare together with cyber warfare.......

Whoops...got caught..... Russian hackers post same document twice, but with glaring differences
http://www.ottawacitizen.com/News/12147705/story.html …

So with the WikiLeaks announced data dump of Clinton DNC emails....how many are real and how many are "fake"....

Two different versions of hacked documents show up online, suggesting Russians are altering docs

[OUTLAW 09]

BET the NSA and Russians knew about this iPhone hack....they did....

UAE activist @Ahmed_Mansoor discovers iPhone spyware, prompting Apple to release a security update to iOS

The spyware was developed by an Israeli firm that apparently sold the spyware to the Emirati regime

There are deep ties between Russian coders in Israel and Russia.....

[OUTLAW 09]

BET the NSA and Russians knew about this iPhone hack....they did....

UAE activist @Ahmed_Mansoor discovers iPhone spyware, prompting Apple to release a security update to iOS

The spyware was developed by an Israeli firm that apparently sold the spyware to the Emirati regime

There are deep ties between Russian coders in Israel and Russia.....

This company was a recent startup started by former Russian citizens.....

[OUTLAW 09]

AT LAST u can now read @danya_turovsky’s deep dive into the RuNet Deep Web, translated into Eng by @seansrussiablog. https://meduza.io/en/feature/2016/08...ed-underground …

[OUTLAW 09]

Amazing coincidence: After being accused of DNC hack, Russia says spyware found in state computers.

http://reut.rs/2ajZbS2

[SWJ Blog]

A Powerful Russian Weapon: The Spread of False Stories

Entry Excerpt:



--------
Read the full post and make any comments at the SWJ Blog.
This forum is a feed only and is closed to user comments.

[OUTLAW 09]

Reference Russian cyber warfare attacks directed against now Germany.....

Kudos to Germany agency for #attribution work and naming names! Example for US admin, who more often stays quiet.

Germany's BfV again warns against incoming APT28 attacks from "Russian government agencies" via @egflo

German federal police BKA hacked terror suspects' Telegram accounts by intercepting SMS code
http://genius.com/10291651/motherboa...chtigen-knackt …

[OUTLAW 09]

Researchers on Twitter got to the heart of the NSA dump, not cybersecurity corporates
https://motherboard.vice.com/read/wh...t-the-nsa-dump …

Superb story on Shadowbrokers—with much-needed political & historical context, noteworthy anon sources @samgadjones https://www.ft.com/content/d63c5b3a-...#axzz4Hsd6VtuL …

[AdamG]

A Powerful Russian Weapon: The Spread of False Stories

STOCKHOLM — With a vigorous national debate underway on whether Sweden should enter a military partnership with NATO, officials in Stockholm suddenly encountered an unsettling problem: a flood of distorted and outright false information on social media, confusing public perceptions of the issue.

The claims were alarming: If Sweden, a non-NATO member, signed the deal, the alliance would stockpile secret nuclear weapons on Swedish soil; NATO could attack Russia from Sweden without government approval; NATO soldiers, immune from prosecution, could rape Swedish women without fear of criminal charges.

They were all false, but the disinformation had begun spilling into the traditional news media, and as the defense minister, Peter Hultqvist, traveled the country to promote the pact in speeches and town hall meetings, he was repeatedly grilled about the bogus stories.

“People were not used to it, and they got scared, asking what can be believed, what should be believed?” said Marinette Nyh Radebo, Mr. Hultqvist’s spokeswoman.

As often happens in such cases, Swedish officials were never able to pin down the source of the false reports. But they, numerous analysts and experts in American and European intelligence point to Russia as the prime suspect, noting that preventing NATO expansion is a centerpiece of the foreign policy of President Vladimir V. Putin, who invaded Georgia in 2008 largely to forestall that possibility.

http://www.nytimes.com/2016/08/29/wo...formation.html

[AdamG]

Maskirovka’ Is Russian Secret War

Sneaky tactics are an old Russian tradition

The term is maskirovka, which in Russian literally means “something masked.” Maskirovka has its roots in the word “masquerade,” a synonym for “disguise.” It is a tactic as old as the Trojan horse … and a favorite of the Russian military.

“The Russians embrace maskirovka because it works,” said James Miller, managing editor of The Interpreter, a daily online journal that translates media from the Russian press and blogosphere into English for use by analysts and policymakers.

The staff at The Interpreter has tracked numerous examples of what they say are maskirovka tactics, Miller told War is Boring. What’s more, what they have found aligns with intelligence reports that NATO has released.

https://warisboring.com/maskirovka-i...fb6#.da36b23oo

[AdamG]

For those of you that don't remember the Cold War, have a flashback from 1981
http://www.dtic.mil/dtic/tr/fulltext/u2/a112903.pdf