Last week in security news, researchers unveiled how a malvertising actor known as eGobbler exploited browser bugs to infect more than 1 billion ad impressions over a two-month period. Security experts also analyzed the emergence of a new cryptocurrency stealer and an internet of things (IoT) botnet capable of launching different distributed denial-of-service (DDoS) attacks. In addition, analysts uncovered new attack campaigns for more established threats, including Emotet and Adwind.

Top Story of the Week: eGobbler Abuses Browser Bugs in Malvertising Attacks

In mid-April, Confiant observed eGobbler abusing a Chrome exploit to bypass the browser’s pop-up blocker that came built-in on iOS devices. Researchers reported that vulnerability to the Chromium team, which patched the issue less than two months later.

Shortly thereafter, the security firm came across a similar vulnerability pertaining to WebKit browsers. Confiant informed both the Chrome and Apple teams about the second security issue in early August — both implemented fixes by the end of September. Within that two-month period, however, the malvertising threat managed to infect 1.16 billion ad impressions.

Source: iStock

Also in Security News

• Masad Stealer Replaces Clipboard Info to Steal Cryptocurrency: Researchers at Juniper Labs observed a family of malware called Masad Stealer replacing the clipboard information in victims’ browsers with cryptocurrency wallets under attackers’ control. Juniper Labs also identified the threat’s use of Telegram to steal information, including usernames, passwords and credit card data.
• Gucci IoT Botnet Capable of Launching Different DDoS Attacks: SecNiche Security Labs used automation to authenticate themselves with the command-and-control (C&C) panel for the Gucci IoT botnet. In that panel, researchers found they could command Gucci to perform a variety of DDoS attacks, such as UDP flood, SYN flood and ACK flood.
• Attackers Use FakeUpdates to Push Dridex and Ransomware: Between May and September 2019, researchers at FireEye spotted a campaign bearing similarities to FakeUpdates in that it leveraged compromised web infrastructure to distribute malware such as Dridex and NetSupport. In some cases, these threats then went on to drop BitPaymer or DoppelPaymer ransomware.
• Attackers Use Fake Office Activation Wizard to Spread Emotet: Bleeping Computer reported that Emotet began using a new template that masquerades as a Microsoft Office Activation Wizard. With that new asset, the campaign attempted to trick users into enabling content so it could use malicious macros and a PowerShell command to load Emotet.
• Adwind RAT Campaign Going After U.S. Petroleum Companies: In early September, Netskope discovered a new Adwind remote access Trojan (RAT) campaign targeting the petroleum industry in the U.S. This operation leveraged multiple JAR extractions to unpack its payload, which established persistence by creating a registry and used WMI scripts to disable antivirus services.
• New Reductor Malware Uses Ingenious Method to Mark TLS Traffic: Kaspersky Lab noticed in April 2019 that a new threat called Reductor was infecting popular software distributions and relying on the COMpfun Trojan to make its way onto a host. There, it marked the host’s encrypted Transport Layer Security (TLS) traffic by patching a browser in use by the victim without parsing network packets.
• FBI Urges Ransomware Victims to Not Pay the Ransom: On Oct. 2, the Federal Bureau of Investigation (FBI) released a public service announcement urging ransomware victims to not pay the ransom, because doing so “emboldens criminals to target other organizations.” The agency told organizations to instead use data backups, centralized patch management systems and other security measures to prevent an infection.
• Spam Campaign Targets Italian Users With FTCode Ransomware: Since Sept. 26, Bleeping Computer has tracked several media reports surrounding an old PowerShell-based ransomware called FTCode. Those reports revealed that bad actors were using a new spam campaign to infect Italian users with samples of an FTCode variant dating back to 2013.
• Casbaneiro Targets Banks, Cryptocurrency Services in Latin America: ESET revealed that Casbaneiro malware functions as a typical Latin American Trojan in that it uses fake pop-up windows and backdoor capabilities to target users’ banking information. The security firm also observed the malware hijacking users’ clipboard data to steal their cryptocurrency.

Security Tip of the Week: Create a Comprehensive Vulnerability Management Program

Threat actors such as eGobbler are constantly capitalizing on software vulnerabilities to prey on organizations. That’s why security professionals should turn to connected security solutions that use network topology modeling and security information and event management (SIEM) integration to create a comprehensive vulnerability management program.

Through this framework, researchers should also look for a tool that offers patch posture reporting functionality to confidently defend against security weaknesses.