Newsletter compiled by Jonathan Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
You never want to fall behind on Beers with Talos. So make sure to listen to the latest episode on your commute home today. This episode — featuring special guest and Talos Threat Research Summit keynote speaker Liz Wharton — was recorded live in San Diego as part of Cisco Live. So yes, there’s audience participation, and no, you are not prepared for it.
We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.
Upcoming public engagements with Talos
Event: “It’s never DNS...It was DNS: How adversaries are abusing network blind spots” at SecTor
Location: Metro Toronto Convention Center, Toronto, Canada
Date: Oct. 7 - 10
Speaker: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Location: Metro Toronto Convention Center, Toronto, Canada
Date: Oct. 7 - 10
Speaker: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Cyber Security Week in Review
- For the second time this month, a Florida city agreed to pay roughly half a million dollars to the hackers behind a ransomware attack. The government of Lake City, Florida agreed to pay $460,000 in exchange for the return of its email services and several servers attackers had seized.
- The U.S. Department of Homeland Security warned American users of an uptick in wiper attacks originating from Iran. The advisory came as military tensions continue to rise between the two countries.
- Dell warned of a critical vulnerability in its pre-installed SupportAssist software on millions of its PCs. The bug could allow an attacker to trick the machine into running a malicious DLL file.
- Hackers stole roughly $4.2 million worth of cryptocurrency from Sigaporean exchange Bitrue. The attackers exploited a vulnerability in the exchange’s site and accessed the personal funds of 90 users.
- Attackers tracked roughly 20 global officials with ties to China by infiltrating 10 cellphone carriers’ networks. A recent report states the attackers stole text messages, location data and call logs.
- The head of the U.S. House Homeland Security cyber subcommittee says he will introduce a bill to create two new security grants. Both funds would grant money to state and local governments to prepare for cyber attacks and secure election technology.
- The European Union plans to run new military exercises to plan for potential major cyber attacks from Russia and China.
Notable recent security issues
Title: Netwire malware delivered through Firefox vulnerability
Description: Attackers are exploiting a now-patched Mozilla Firefox vulnerability to deliver the Netwire malware. At the time of first exploitation, there was no fix for the bug. Netwire uses two separate functions to persist — once as a launch agent and again as a login item. New Snort rules prevent the malware from downloading its final payload.
Snort SIDs: 50498, 50500
Title: Cisco patches critical bugs in DNA Center, SD-WAN
Description: Cisco has patched a slew of critical and high-severity flaws in its DNA Center and SD-WAN. In all, the company issued fixes for 25 vulnerabilities last week across a variety of its products. Two of the most severe bugs exist on access ports necessary for Cisco Digital Network Architecture (DNA) Center. There is another critical vulnerability in SD-WAN's command line interface.
Snort SIDs: 50467, 50469 – 50472, 50485 – 50489, 50492
Description: Attackers are exploiting a now-patched Mozilla Firefox vulnerability to deliver the Netwire malware. At the time of first exploitation, there was no fix for the bug. Netwire uses two separate functions to persist — once as a launch agent and again as a login item. New Snort rules prevent the malware from downloading its final payload.
Snort SIDs: 50498, 50500
Title: Cisco patches critical bugs in DNA Center, SD-WAN
Description: Cisco has patched a slew of critical and high-severity flaws in its DNA Center and SD-WAN. In all, the company issued fixes for 25 vulnerabilities last week across a variety of its products. Two of the most severe bugs exist on access ports necessary for Cisco Digital Network Architecture (DNA) Center. There is another critical vulnerability in SD-WAN's command line interface.
Snort SIDs: 50467, 50469 – 50472, 50485 – 50489, 50492
Most prevalent malware files this week
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
Typical Filename: wup.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: f118e52a73227b85fbb0cb7d202c3753916e518c516286c441a2dc92ede1f023
MD5: 4f551cb9a7c7d24104c19ac85e55defe
Typical Filename: watchdog.exe
Claimed Product: N/A
Detection Name: W32.Trojan:Trojangen.22hu.120
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
Typical Filename: wup.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: f118e52a73227b85fbb0cb7d202c3753916e518c516286c441a2dc92ede1f023
MD5: 4f551cb9a7c7d24104c19ac85e55defe
Typical Filename: watchdog.exe
Claimed Product: N/A
Detection Name: W32.Trojan:Trojangen.22hu.120