Last week in security news, researchers linked a surge in REvil ransomware activity to a decline in attack campaigns staged by GandCrab. Analysts also spotted some clever phishing attacks, including campaigns that posed as copyright infringement notifications on Instagram or employed URL encoding to evade detection. Finally, we saw several new developments in the malware threat landscape, including one attack that used a fake veteran hiring website to distribute spyware.

Top Story of the Week: GandCrab Gives Way to REvil

In its analysis of REvil ransomware, also known as Sodinokibi, the Secureworks Counter Threat Unit (CTU) found several connections between this emerging threat and GandCrab. Researchers discovered that both malware families used nearly identical functions for decoding strings at runtime. They also saw the two threats using the same logic to build URLs as seen in their respective BuildURL functions.

Beyond that, CTU researchers noted that the two ransomware families could share the same developer. They observed that REvil and GandCrab shared an attack campaign in April 2019, but when GandCrab’s creators announced their retirement in May, REvil activity increased and became more sophisticated.

Source: iStock

Also in Security News

  • Instagram Phish Masquerades as Copyright Infringement Notice: Naked Security researchers came across a phishing campaign that used a fake copyright infringement warning to trick users into clicking on an embedded “Copyright Objection Form” button. This link redirected users to a phishing page designed to steal their Instagram credentials.
  • Formbook Intercepts Web Browser and Other Clients to Harvest Data: Last week, Carbon Black announced that it had detected a new sample of Formbook distributed by a malicious Microsoft Excel document as part of a phishing campaign. This sample intercepted web browser and other clients to steal banking credentials, passwords and other data.
  • Zebrocy Arrives With Updated Components: Back in August, ESET spotted a campaign in which the Sednit group targeted embassies for and ministries of foreign affairs in Eastern European and Central Asian countries. This campaign used phishing emails to distribute samples of Zebrocy malware that arrived with both a downloader and backdoor component newly written in Golang.
  • Threat Actors Create Malicious Sites to Target Google Alert Users: Bleeping Computer spotted bad actors creating malicious sites laden with popular search words. Researchers noted that this technique helped cybercriminals get their sites into the Google search index and, ultimately, a Google Alert that used several redirects leading back to their malicious content.
  • URL Encoding Used by Phishers to Evade Detection: In mid-September, Cofense detected a phishing campaign that originated from a compromised email account at a recognizable American brand. It included a “View Invoice” button containing a link that used percentage-based URL encoding to evade detection and redirect users to a Office 365 phishing page.
  • Malware Disguises Itself as Trading App to Prey on Mac Users: Researchers at Trend Micro came across two variants of a family of Mac malware detected as Trojan.MacOS.GMERA.A. Both variants masqueraded as the Stockfolio trading app, but one of the versions used a more simplified routine than the other and came with the ability to establish persistence.
  • Threat Actor Used Fake Hiring Website to Target Veterans: Cisco Talos recently came across a fake website claiming that it could help connect U.S. military veterans to job opportunities. In actuality, the site attempted to convince users into downloading its app, a program that functioned as a malware downloader.
  • DTrack Malware Samples Highlight Lazarus Group as Serious Threat: Kaspersky Lab analyzed more than 180 samples of DTrack as well as its ATMDtrack subset and spotted several similarities with the Lazarus Group’s DarkSeoul campaign. Those commonalities led the researchers to name Lazarus as one of the most active advanced persistent threat (APT) groups in terms of malware development.
  • Smominru Botnet Registered 90,000 Infections in August: According to Guardicore Labs, the Smominru botnet infected more than 90,000 users and 4,900 networks in August. Researchers noted that the threat actor behind the botnet continues to use EternalBlue and brute forcing to infect an average of 4,700 victims every day.

Security Tip of the Week: Defending Against Ransomware

The connections observed by the Secureworks CTU between REvil and GandCrab highlight the importance of security professionals taking steps to defend their organizations against ransomware. Companies should start by using an endpoint management solution to monitor endpoints for suspicious behavior and conducting security awareness training to teach employees about ransomware and other threats.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…