Last week in security news, researchers discovered that the Mirai-inspired “LiquorBot” IoT botnet came equipped with Monero cryptocurrency mining capabilities. They also witnessed digital attackers outfitting their web skimmers with new evasion techniques and using new variants of DeathRansom to properly encrypt victims’ data. On top of all that and more, a town based in Colorado lost more than a million dollars to threat actors after falling for a business email compromise (BEC) scam.

Top Story of the Week: LiquorBot Embraces Monero Cryptomining Capabilities

LiquorBot first attracted the attention of Bitdefender when its samples infected some of the security firm’s honeypots back in May 2019. A subsequent analysis of the threat revealed that the IoT botnet was using the same command-and-control server as a variant of Mirai. Both botnets even came bundled together in certain dropper scripts.

However, LiquorBot set itself apart from Mirai by being written in the Golang (also known as Go) programming language. Bitdefender’s researchers also spotted the in-development threat using cryptocurrency mining capabilities to mine for Monero.

Source: iStock

Also in Security News

• SNAKE Ransomware Targeting Organizations’ Corporate Networks: Security researchers discovered that SNAKE, a previously undocumented ransomware written in Golang, deleted a victim’s Shadow Volume Copies before encrypting a victim’s data. It then dropped a ransom note in which it indicated that it had breached the corporate network, reported Bleeping Computer.
• Unpatched Pulse VPN Servers Susceptible to Sodinokibi Attacks: Security researcher Kevin Beaumont found that attackers had begun abusing a vulnerability in order to remotely view logs and bypass MFA on organizations’ unpatched Pulse VPN servers. They then used those exploits to target organizations with Sodinokibi and other big-game ransomware.
• Browser Scam Used Fake Windows 10 Desktop to Trick Users: Bleeping Computer came across a new police locker scam, a ruse that claims a victim must pay a fine to unlock their computer. This iteration was unique, however, in that it abused a browser’s full-screen mode to display a fake Windows 10 desktop notification indicating that law enforcement had locked their computer.
• Colorado Town Tricked Into Sending $1M to BEC Scammers: Back in mid-October, an individual filed a form on the town of Erie, Colorado’s website to request that a construction company with which the town was working begin receiving electronic payments instead of checks. As a result of the form, Erie officials sent more than $1 million to an attacker-controlled account.
• SideWinder-Linked Attack Actively Exploiting CVE-2019-2215: Trend Micro uncovered a campaign actively exploiting CVE-2019-2215, a use-after-free vulnerability. Upon further analysis, the security firm determined that the SideWinder APT was using three malicious Android apps to abuse the vulnerability and steal unsuspecting users’ device information.
• New Techniques Used by Attackers to Conceal Web Skimmer Activity: On December 26, 2019, Malwarebytes dissected a web skimmer’s use of steganography to conceal malicious JavaScript code that skimmed credit cards’ details upon execution. The security firm also analyzed another skimmer that used WebSockets instead of HTML to conceal its communication.
• Anti-Debug Tricks, Fileless Tactics Added by Predator the Thief: Also in December, Fortinet discovered a new Predator the Thief campaign. This attack used version 3.3.4 of the malware, an iteration which arrived with new anti-debug tricks, more complicated assembly code and fileless techniques for the purpose of evading detection.
• New DeathRansom Samples Capable of Encrypting Users’ Information: Fortinet analyzed a DeathRansom sample with a timestamp of November 16, 2019 and found that the sample encoded but did not encrypt a user’s data upon successful infection. However, an analysis of more recent samples revealed that DeathRansom could now properly encrypt users’ data.
• City of Las Vegas Revealed It Avoided “Devastating Situation” from Cyber Attack: As reported by ZDNet, the city of Las Vegas detected a network intrusion on January 7, 2020. It immediately sprang into action and took down parts of its network, a response which helped the municipality avoid what could have been, in its words, a “devastating situation.”

Security Tip of the Week: Protect Your IoT Devices

Security professionals can help their organizations protect their IoT devices by taking a multilayered management approach to their smart products by prioritizing device interoperability and employee education across their security programs. They should also research IoT vendors carefully so that they can purchase from or even partner with companies that incorporate security by design into their IoT products.