Last week in security news, researchers linked a surge in REvil ransomware activity to a decline in attack campaigns staged by GandCrab. Analysts also spotted some clever phishing attacks, including campaigns that posed as copyright infringement notifications on Instagram or employed URL encoding to evade detection. Finally, we saw several new developments in the malware threat landscape, including one attack that used a fake veteran hiring website to distribute spyware.

Top Story of the Week: GandCrab Gives Way to REvil

In its analysis of REvil ransomware, also known as Sodinokibi, the Secureworks Counter Threat Unit (CTU) found several connections between this emerging threat and GandCrab. Researchers discovered that both malware families used nearly identical functions for decoding strings at runtime. They also saw the two threats using the same logic to build URLs as seen in their respective BuildURL functions.

Beyond that, CTU researchers noted that the two ransomware families could share the same developer. They observed that REvil and GandCrab shared an attack campaign in April 2019, but when GandCrab’s creators announced their retirement in May, REvil activity increased and became more sophisticated.

Source: iStock

Also in Security News

• Instagram Phish Masquerades as Copyright Infringement Notice: Naked Security researchers came across a phishing campaign that used a fake copyright infringement warning to trick users into clicking on an embedded “Copyright Objection Form” button. This link redirected users to a phishing page designed to steal their Instagram credentials.
• Formbook Intercepts Web Browser and Other Clients to Harvest Data: Last week, Carbon Black announced that it had detected a new sample of Formbook distributed by a malicious Microsoft Excel document as part of a phishing campaign. This sample intercepted web browser and other clients to steal banking credentials, passwords and other data.
• Zebrocy Arrives With Updated Components: Back in August, ESET spotted a campaign in which the Sednit group targeted embassies for and ministries of foreign affairs in Eastern European and Central Asian countries. This campaign used phishing emails to distribute samples of Zebrocy malware that arrived with both a downloader and backdoor component newly written in Golang.
• Threat Actors Create Malicious Sites to Target Google Alert Users: Bleeping Computer spotted bad actors creating malicious sites laden with popular search words. Researchers noted that this technique helped cybercriminals get their sites into the Google search index and, ultimately, a Google Alert that used several redirects leading back to their malicious content.
• URL Encoding Used by Phishers to Evade Detection: In mid-September, Cofense detected a phishing campaign that originated from a compromised email account at a recognizable American brand. It included a “View Invoice” button containing a link that used percentage-based URL encoding to evade detection and redirect users to a Office 365 phishing page.
• Malware Disguises Itself as Trading App to Prey on Mac Users: Researchers at Trend Micro came across two variants of a family of Mac malware detected as Trojan.MacOS.GMERA.A. Both variants masqueraded as the Stockfolio trading app, but one of the versions used a more simplified routine than the other and came with the ability to establish persistence.
• Threat Actor Used Fake Hiring Website to Target Veterans: Cisco Talos recently came across a fake website claiming that it could help connect U.S. military veterans to job opportunities. In actuality, the site attempted to convince users into downloading its app, a program that functioned as a malware downloader.
• DTrack Malware Samples Highlight Lazarus Group as Serious Threat: Kaspersky Lab analyzed more than 180 samples of DTrack as well as its ATMDtrack subset and spotted several similarities with the Lazarus Group’s DarkSeoul campaign. Those commonalities led the researchers to name Lazarus as one of the most active advanced persistent threat (APT) groups in terms of malware development.
• Smominru Botnet Registered 90,000 Infections in August: According to Guardicore Labs, the Smominru botnet infected more than 90,000 users and 4,900 networks in August. Researchers noted that the threat actor behind the botnet continues to use EternalBlue and brute forcing to infect an average of 4,700 victims every day.

Security Tip of the Week: Defending Against Ransomware

The connections observed by the Secureworks CTU between REvil and GandCrab highlight the importance of security professionals taking steps to defend their organizations against ransomware. Companies should start by using an endpoint management solution to monitor endpoints for suspicious behavior and conducting security awareness training to teach employees about ransomware and other threats.