Cyber Intel Brief: April 21-27, 2022

Threat Actors

TeamTNT targeting AWS, Alibaba

Key Points:

• Cisco Talos received several updated versions of scripts used by TeamTNT, a threat group who focuses mainly on cloud and container environments to deploy cryptocurrency mining malware, from a third-party intelligence partner.
• According to analysis of the malware, the scripts primarily target Amazon Web Services but could also work with on-premise, container, or other Linux instances.

Deepwatch Assessment:

To mitigate the risk posed by TeamTNT’s modified scripts, it is recommended that organizations reduce access to credentials with the requisite installation permissions, prevent the use of the account root user account, or provide users console access unless they need it and give high-privileged users the PowerUser policy rather than admin. Additionally, performing routine analytics on CPU usage and implementing measures to alert on excessive CPU usage could indicate cryptomining malware is present on the system.

---

Malware

Prynt Stealer: A New Info Stealer Performing Clipper And Keylogger Activities In The Wild

Key Points:

• A new infostealer, dubbed Prynt Stealer, was discovered being offered by on cybercrime forums for free by Cyble.
• Besides stealing data, the malware can collect and exfiltrate data from over 35 different browsers, VPN, FTP, messaging, and gaming applications.

Deepwatch Assessment:

Recommendations include Implementing cybersecurity awareness training and phishing simulation exercises, enforcing multi-factor authentication, monitoring for the creation and addition of folders and files in the AppData directory, and for the exfiltration of data outside the corporate network, finally, ensuring security protection systems such as Anti-Virus or End-point Detection and Response (EDR), are up to date and functioning properly.

---

Malware

Cisco Talos’ Threat Roundup for April 15 to April 22

Key Points:

• Cisco Talos summarized the most prevalent threats they observed between April 15 – 22, providing a brief description of each threat and their accompanying observables.
• The most prevalent threats covered include Zegost, Formbook, Cerber ransomware, Upatre dropper, Fareit infostealer, Banload trojan, and cryptominers.

Deepwatch Assessment:

Recommendations include, but are not limited to, following cybersecurity best practices like those featured by CISA, auditing logs for the observables provided by Cisco in their accompanying JSON file, and adding evaluated observables to your block list.

---

Malware

Emotet Tests New Delivery Techniques

Key Points:

• Proofpoint observed a low volume of emails distributing Emotet that drastically differed from typical Emotet threat techniques and procedures.
• The email subject lines were simple and contained one word such as “Salary” and the email bodies contained only OneDrive URLs and no other content. The OneDrive URLs contained a zip archive with XLL files. These files used the same lures as the email subjects, such as “Salary_new.zip” and “Salary_and_bonuses-04.01.2022.xll”.

Deepwatch Assessment:

To reduce the risk of future Emotet campaigns that may employ the techniques described by Proofpoint, it is advised to include the techniques observed by Proofpoint in your phishing awareness training and simulation exercises and add evaluated observables to your block list.

---

Ransomware

ALPHV: Breaking Down the Complexity of the Most Sophisticated Ransomware

Key Points:

• Forescout recently released a report detailing their investigation of files and tools utilized by an ALPHV ransomware affiliate during an attack on a VMware ESXi environment.
• Forescout revealed that the ransomware was delivered on March 17, 2022, and that the attack involved two different exploitations: infiltrating an Internet-exposed SonicWall firewall for initial access and encrypting a VMware ESXi virtual farm.

Deepwatch Assessment:

Of note is that the threat actors exploited a vulnerability that had its CVE identifier assigned on February 6, 2019 to gain initial access to the target network and was added to CISA’s Known Exploited Vulnerabilities Catalog on November 03, 2021 (this incident occurred four months after the vulnerability was added to the Catalog). This highlights the importance of updating systems as soon as possible with a focus on those devices that are internet-exposed and known to have been exploited. Additionally, recommendations include those featured in CISA’s Stop Ransomware website.

---

Ransomware

Quantum Ransomware: From Initial Access to Encryption in Under 4 Hours

Key Points:

• The DFIR Report details a ransomware case where the threat actor gained initial access to deploying the Quantum ransomware in under four hours.
• Initial access was gained when a user clicked on a phishing email link containing an ISO image file that dropped the IcedID malware and eventually a Cobalt Strike beacon. The threat actors were able to move laterally within the environment through the use of RDP connections using administrator accounts that were gathered through the dumping of LSASS memory.

Deepwatch Assessment:

Recommendations and guidance include implementing the techniques used in the phishing email in your phishing awareness and simulation exercises. Additionally, limiting Remote Desktop Access within your organizations environment to only source from a few systems rather than allowing Remote Desktop Access from all systems may reduce the risk of the threat actor achieving their objectives.

---

EXPLOITED VULNERABILITIES

CISA Adds 7 Known Exploited Vulnerabilities to Catalog

Key Points:

• CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog based on reliable evidence that these vulnerabilities have been actively exploited in the wild.
• Notable software affected includes WSO2, Microsoft Windows, Linux, and Jenkins.

Deepwatch Assessment:

Deepwatch Threat Intel Team strongly urges all customers to prioritize rapid remediation of vulnerabilities listed in CISA’s Known Exploited Vulnerabilities Catalog, as part of their vulnerability management process.

---

EXPLOITED VULNERABILITIES

2021 Top Routinely Exploited Vulnerabilities

Key Points:

• In a joint Cybersecurity Advisory CISA, along with partner government organizations, identified the top 15 most exploited vulnerabilities observed in 2021.
• Notable software affected includes Log4j, Microsoft Exchange, Zoho ManageEngine, Confluence Server, Accellion File Transfer Appliance (FTA), Windows Print Spooler, and Pulse Secure Pulse Connect Secure.

Deepwatch Assessment:

Deepwatch Threat Intel Team strongly urges all customers to prioritize rapid remediation of vulnerabilities listed in CISA’s “2021 Top Routinely Exploited Vulnerabilities” advisory as part of their vulnerability management process.

---

↑