Last week in security news, researchers unveiled how a malvertising actor known as eGobbler exploited browser bugs to infect more than 1 billion ad impressions over a two-month period. Security experts also analyzed the emergence of a new cryptocurrency stealer and an internet of things (IoT) botnet capable of launching different distributed denial-of-service (DDoS) attacks. In addition, analysts uncovered new attack campaigns for more established threats, including Emotet and Adwind.

Top Story of the Week: eGobbler Abuses Browser Bugs in Malvertising Attacks

In mid-April, Confiant observed eGobbler abusing a Chrome exploit to bypass the browser’s pop-up blocker that came built-in on iOS devices. Researchers reported that vulnerability to the Chromium team, which patched the issue less than two months later.

Shortly thereafter, the security firm came across a similar vulnerability pertaining to WebKit browsers. Confiant informed both the Chrome and Apple teams about the second security issue in early August — both implemented fixes by the end of September. Within that two-month period, however, the malvertising threat managed to infect 1.16 billion ad impressions.

Source: iStock

Also in Security News

  • Masad Stealer Replaces Clipboard Info to Steal Cryptocurrency: Researchers at Juniper Labs observed a family of malware called Masad Stealer replacing the clipboard information in victims’ browsers with cryptocurrency wallets under attackers’ control. Juniper Labs also identified the threat’s use of Telegram to steal information, including usernames, passwords and credit card data.
  • Gucci IoT Botnet Capable of Launching Different DDoS Attacks: SecNiche Security Labs used automation to authenticate themselves with the command-and-control (C&C) panel for the Gucci IoT botnet. In that panel, researchers found they could command Gucci to perform a variety of DDoS attacks, such as UDP flood, SYN flood and ACK flood.
  • Attackers Use FakeUpdates to Push Dridex and Ransomware: Between May and September 2019, researchers at FireEye spotted a campaign bearing similarities to FakeUpdates in that it leveraged compromised web infrastructure to distribute malware such as Dridex and NetSupport. In some cases, these threats then went on to drop BitPaymer or DoppelPaymer ransomware.
  • Attackers Use Fake Office Activation Wizard to Spread Emotet: Bleeping Computer reported that Emotet began using a new template that masquerades as a Microsoft Office Activation Wizard. With that new asset, the campaign attempted to trick users into enabling content so it could use malicious macros and a PowerShell command to load Emotet.
  • Adwind RAT Campaign Going After U.S. Petroleum Companies: In early September, Netskope discovered a new Adwind remote access Trojan (RAT) campaign targeting the petroleum industry in the U.S. This operation leveraged multiple JAR extractions to unpack its payload, which established persistence by creating a registry and used WMI scripts to disable antivirus services.
  • New Reductor Malware Uses Ingenious Method to Mark TLS Traffic: Kaspersky Lab noticed in April 2019 that a new threat called Reductor was infecting popular software distributions and relying on the COMpfun Trojan to make its way onto a host. There, it marked the host’s encrypted Transport Layer Security (TLS) traffic by patching a browser in use by the victim without parsing network packets.
  • FBI Urges Ransomware Victims to Not Pay the Ransom: On Oct. 2, the Federal Bureau of Investigation (FBI) released a public service announcement urging ransomware victims to not pay the ransom, because doing so “emboldens criminals to target other organizations.” The agency told organizations to instead use data backups, centralized patch management systems and other security measures to prevent an infection.
  • Spam Campaign Targets Italian Users With FTCode Ransomware: Since Sept. 26, Bleeping Computer has tracked several media reports surrounding an old PowerShell-based ransomware called FTCode. Those reports revealed that bad actors were using a new spam campaign to infect Italian users with samples of an FTCode variant dating back to 2013.
  • Casbaneiro Targets Banks, Cryptocurrency Services in Latin America: ESET revealed that Casbaneiro malware functions as a typical Latin American Trojan in that it uses fake pop-up windows and backdoor capabilities to target users’ banking information. The security firm also observed the malware hijacking users’ clipboard data to steal their cryptocurrency.

Security Tip of the Week: Create a Comprehensive Vulnerability Management Program

Threat actors such as eGobbler are constantly capitalizing on software vulnerabilities to prey on organizations. That’s why security professionals should turn to connected security solutions that use network topology modeling and security information and event management (SIEM) integration to create a comprehensive vulnerability management program.

Through this framework, researchers should also look for a tool that offers patch posture reporting functionality to confidently defend against security weaknesses.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…