Last week in security news, researchers linked a surge in REvil ransomware activity to a decline in attack campaigns staged by GandCrab. Analysts also spotted some clever phishing attacks, including campaigns that posed as copyright infringement notifications on Instagram or employed URL encoding to evade detection. Finally, we saw several new developments in the malware threat landscape, including one attack that used a fake veteran hiring website to distribute spyware.

Top Story of the Week: GandCrab Gives Way to REvil

In its analysis of REvil ransomware, also known as Sodinokibi, the Secureworks Counter Threat Unit (CTU) found several connections between this emerging threat and GandCrab. Researchers discovered that both malware families used nearly identical functions for decoding strings at runtime. They also saw the two threats using the same logic to build URLs as seen in their respective BuildURL functions.

Beyond that, CTU researchers noted that the two ransomware families could share the same developer. They observed that REvil and GandCrab shared an attack campaign in April 2019, but when GandCrab’s creators announced their retirement in May, REvil activity increased and became more sophisticated.

Source: iStock

Also in Security News

  • Instagram Phish Masquerades as Copyright Infringement Notice: Naked Security researchers came across a phishing campaign that used a fake copyright infringement warning to trick users into clicking on an embedded “Copyright Objection Form” button. This link redirected users to a phishing page designed to steal their Instagram credentials.
  • Formbook Intercepts Web Browser and Other Clients to Harvest Data: Last week, Carbon Black announced that it had detected a new sample of Formbook distributed by a malicious Microsoft Excel document as part of a phishing campaign. This sample intercepted web browser and other clients to steal banking credentials, passwords and other data.
  • Zebrocy Arrives With Updated Components: Back in August, ESET spotted a campaign in which the Sednit group targeted embassies for and ministries of foreign affairs in Eastern European and Central Asian countries. This campaign used phishing emails to distribute samples of Zebrocy malware that arrived with both a downloader and backdoor component newly written in Golang.
  • Threat Actors Create Malicious Sites to Target Google Alert Users: Bleeping Computer spotted bad actors creating malicious sites laden with popular search words. Researchers noted that this technique helped cybercriminals get their sites into the Google search index and, ultimately, a Google Alert that used several redirects leading back to their malicious content.
  • URL Encoding Used by Phishers to Evade Detection: In mid-September, Cofense detected a phishing campaign that originated from a compromised email account at a recognizable American brand. It included a “View Invoice” button containing a link that used percentage-based URL encoding to evade detection and redirect users to a Office 365 phishing page.
  • Malware Disguises Itself as Trading App to Prey on Mac Users: Researchers at Trend Micro came across two variants of a family of Mac malware detected as Trojan.MacOS.GMERA.A. Both variants masqueraded as the Stockfolio trading app, but one of the versions used a more simplified routine than the other and came with the ability to establish persistence.
  • Threat Actor Used Fake Hiring Website to Target Veterans: Cisco Talos recently came across a fake website claiming that it could help connect U.S. military veterans to job opportunities. In actuality, the site attempted to convince users into downloading its app, a program that functioned as a malware downloader.
  • DTrack Malware Samples Highlight Lazarus Group as Serious Threat: Kaspersky Lab analyzed more than 180 samples of DTrack as well as its ATMDtrack subset and spotted several similarities with the Lazarus Group’s DarkSeoul campaign. Those commonalities led the researchers to name Lazarus as one of the most active advanced persistent threat (APT) groups in terms of malware development.
  • Smominru Botnet Registered 90,000 Infections in August: According to Guardicore Labs, the Smominru botnet infected more than 90,000 users and 4,900 networks in August. Researchers noted that the threat actor behind the botnet continues to use EternalBlue and brute forcing to infect an average of 4,700 victims every day.

Security Tip of the Week: Defending Against Ransomware

The connections observed by the Secureworks CTU between REvil and GandCrab highlight the importance of security professionals taking steps to defend their organizations against ransomware. Companies should start by using an endpoint management solution to monitor endpoints for suspicious behavior and conducting security awareness training to teach employees about ransomware and other threats.

More from

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…