by jdpoteet | Apr 3, 2024 | News
by jdpoteet | Apr 1, 2024 | Threat Advisories
Vultur Android Banking Malware
DOWNLOAD PDF
Summary
The Android banking trojan Vultur has resurfaced with enhanced functionalities and advanced methods for evasion, including encrypting its communication channels, using dynamically decrypted payloads and masquerading as legitimate applications. The new version gives operators the ability to remotely manipulate mobile devices and collect user information. This infection still requires at least three (3) victim interactions, including the initial phone call to the threat actors from the initial SMS text, interaction with a subsequent SMS text that contains a link, and installation of the fake McAfee app that has the malware payload.
Technical Details
Vultur’s infection cycle begins with an SMS alert concerning an unauthorized financial transaction and urging the recipient to call a provided number for assistance. If the recipient calls the number, they are coerced into following a link provided in a subsequent SMS, leading to a webpage offering a malicious version of the McAfee Security app that contains the ‘Brunhilda’ malware dropper. Once installed, the app decrypts and executes three Vultur-associated payloads (two APKs and one DEX file), which then exploit Accessibility Services, trigger remote control systems, and establish contact with the command and control (C2) server.
The new Vultur malware retains several capabilities from previous versions, including screen recording, keylogging, and remote access via AlphaVNC and ngrok, enabling real-time surveillance and control for malevolent actors. New functionality adds expanded file management capabilities, including download, upload, deletion, installation, and file reconnaissance on the targeted device; and Accessibility Services to execute various user interactions like clicks, scrolling, and swiping gestures.
Evasion capabilities include stratagems, including blocking specific apps and displaying customized notifications to mislead users; overrides Keyguard to circumvent lock screen security, granting unrestricted access to the device; and encrypted C2 communications (AES + Base64 encryption) and dynamically decrypted payloads.
IOCs
File Hash (SHA-256):
- edef007f1ca60fdf75a7d5c5ffe09f1fc3fb560153633ec18c5ddb46cc75ea21
- 89625cf2caed9028b41121c4589d9e35fa7981a2381aa293d4979b36cf5c8ff2
- 1fc81b03703d64339d1417a079720bf0480fece3d017c303d88d18c70c7aabc3
- 4fed4a42aadea8b3e937856318f9fbd056e2f46c19a6316df0660921dd5ba6c5
- 001fd4af41df8883957c515703e9b6b08e36fde3fd1d127b283ee75a32d575fc
- fc8c69bddd40a24d6d28fbf0c0d43a1a57067b19e6c3cc07e2664ef4879c221b
- 7337a79d832a57531b20b09c2fc17b4257a6d4e93fcaeb961eb7c6a95b071a06
- 7f1a344d8141e75c69a3c5cf61197f1d4b5038053fd777a68589ecdb29168e0c
- 26f9e19c2a82d2ed4d940c2ec535ff2aba8583ae3867502899a7790fe3628400
- 2a97ed20f1ae2ea5ef2b162d61279b2f9b68eba7cf27920e2a82a115fd68e31f
- c0f3cb3d837d39aa3abccada0b4ecdb840621a8539519c104b27e2a646d7d50d
- 92af567452ecd02e48a2ebc762a318ce526ab28e192e89407cac9df3c317e78d
- fa6111216966a98561a2af9e4ac97db036bcd551635be5b230995faad40b7607
- dc4f24f07d99e4e34d1f50de0535f88ea52cc62bfb520452bdd730b94d6d8c0e
- 627529bb010b98511cfa1ad1aaa08760b158f4733e2bbccfd54050838c7b7fa3
- f5ce27a49eaf59292f11af07851383e7d721a4d60019f3aceb8ca914259056af
- 5d86c9afd1d33e4affa9ba61225aded26ecaeb01755eeb861bb4db9bbb39191c
- 5724589c46f3e469dc9f048e1e2601b8d7d1bafcc54e3d9460bc0adeeada022d
- 7f1a344d8141e75c69a3c5cf61197f1d4b5038053fd777a68589ecdb29168e0c
- fd3b36455e58ba3531e8cce0326cce782723cc5d1cc0998b775e07e6c2622160
- 819044d01e8726a47fc5970efc80ceddea0ac9bf7c1c5d08b293f0ae571369a9
- 0f2f8adce0f1e1971cba5851e383846b68e5504679d916d7dad10133cc965851
- fb1e68ee3509993d0fe767b0372752d2fec8f5b0bf03d5c10a30b042a830ae1a
- d3dc4e22611ed20d700b6dd292ffddbc595c42453f18879f2ae4693a4d4d925a
- f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2
- 7ca6989ccfb0ad0571aef7b263125410a5037976f41e17ee7c022097f827bd74
- c646c8e6a632e23a9c2e60590f012c7b5cb40340194cb0a597161676961b4de0
C2 Servers:
- safetyfactor[.]online
- cloudmiracle[.]store
- flandria171[.]appspot[.]com
- newyan-1e09d[.]appspot[.]com
Dropper Distribution URLs:
- mcafee[.]960232[.]com
- mcafee[.]353934[.]com
- mcafee[.]908713[.]com
- mcafee[.]784503[.]com
- mcafee[.]053105[.]com
- mcafee[.]092877[.]com
- mcafee[.]582630[.]com
- mcafee[.]581574[.]com
- mcafee[.]582342[.]com
- mcafee[.]593942[.]com
- mcafee[.]930204[.]com
Recommendations
- Limit mobile application downloads to trusted sources such as the official Google Play Store to minimize the risk of encountering malicious applications.
- Educate users regarding unsolicited SMS alerts or messages, especially those of a financial nature and those containing links.
- Verify the legitimacy of callers and requests for contact, especially in response to alarming or urgent messages.
- Review the permissions requested by applications before and during installation; grant access based on intended purpose.
- Install reputable mobile security software to provide an additional layer of protection against malware and other cyber threats.
References
by jdpoteet | Mar 27, 2024 | Blogs
Author: Tangela Sampson (Intern, Spring 2024)
Introduction to Risk Assessments
A Cybersecurity Risk Assessment is a structured and comprehensive procedure implemented within an organization to identify, evaluate, and manage potential risks, threats, or vulnerabilities originating from the organization’s internal elements. This assessment thoroughly examines various aspects of the organization, including its operations, processes, systems, and activities. The primary objective is to assess the likelihood and potential consequences of internal risks, which can stem from human error, unintentional data leaks, or effective management practices.
In addition to playing a crucial role in promoting a culture of accountability and adopting an all-encompassing approach to risk assessment, risk assessments also contribute to continuous improvement within the organization. Organizations can mitigate risks and enhance operational efficiency and overall performance by recognizing and addressing weaknesses or vulnerabilities in internal processes and controls. This comprehensive approach to risk assessment contributes to the organization’s long-term resilience and ability to adapt to evolving challenges in the dynamic business landscape.
Understanding Risk Assessment Strategies
Grasping risk assessment strategies equips an organization with the tools to effectively detect and manage potential threats. It involves a balanced blend of quantitative analysis, which quantifies risks and their impacts, and qualitative techniques, which provide context and interpret the subtleties behind the numbers. This dual approach enriches an organization’s insight into its risk environment, paving the way for strategic, data-informed decisions that enhance overall security and stability amidst the ever-evolving risks in today’s business world.
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf
Essential Phases in Conducting a Risk Assessment
Practical risk assessment is vital for navigating the uncertainties impacting an organization’s goals. It involves a straightforward process to identify and manage risks that might compromise achieving strategic objectives. By understanding these risks and implementing a solid management process, an organization can minimize potential setbacks and reinforce its effectiveness. This involves developing a systematic approach to identify, prioritize, and address risks to preserve shareholder value and ensure the organization’s success and sustainability.
- Compiling Information Assets
This process ensures that all relevant assets spanning different areas of the organization are accounted for and evaluated. By incorporating input from diverse departments, the assessment becomes more inclusive, capturing a broader spectrum of assets and potential risks. This comprehensive approach helps identify vulnerabilities and threats that may otherwise be overlooked if conducted in isolation.
- Performing Comprehensive Evaluations: Methodically pinpointing all information assets across diverse platforms and storage systems.
- Conducting Consistent Asset Audits: Systematically verifying the asset inventory to correct any inconsistencies or obsolescence.
- Delegating Defined Ownership: Ensuring designated stewards manage and safeguard each asset.
- Applying Categorized Asset Frameworks: Sorting assets into a tiered structure reflective of their value, vulnerability, and legal significance.
- Identifying Threats
In addition to deliberate attacks on firewalls and security systems, organizations must also be vigilant against unintentional actions by employees, such as deleting data or clicking malicious links, as well as hardware or system failures. External events like natural disasters or power outages can further exacerbate threats to information security. Organizations can comprehensively address potential risks to their digital assets and infrastructure by incorporating these considerations into the threat identification process.
Identifying threats involves several key steps to ensure comprehensive coverage:
- Performing Vulnerability Assessments: Assess vulnerabilities in your systems and networks to identify weaknesses attackers could exploit.
- Incident Monitoring: Monitor system logs, network traffic, and security alerts for signs of suspicious activity that may indicate a security breach or ongoing attack.
- Threat Intelligence: Stay informed about emerging threats and attack techniques through threat intelligence sources, including security blogs, forums, and reports from cybersecurity vendors.
- Providing Employee Training: Educate employees about common cybersecurity threats such as phishing emails, social engineering, and malware, and provide training on how to recognize and respond to these threats.
- Determine and Prioritize Risks
This systematic approach ensures that resources are directed towards mitigating risks with the highest potential impact and likelihood of occurrence. Organizations can visually represent and prioritize risks by employing risk matrices, facilitating more precise identification of areas that demand immediate attention.
Credit ( techtarget.com )
- Documentation: Consolidating Findings from the Risk Assessment into a Detailed Report
Ensure that risk assessment findings are effectively communicated through tailored reports, accommodating varying levels of understanding, and emphasize the iterative nature of the process for continual improvement and adaptation within the organization.
- Executive Summary Overview: Start with a concise executive summary that outlines the risk assessment’s goals, methodologies, principal discoveries, and recommended actions. Aim to present a comprehensive snapshot accessible to a broad audience across the organization.
- Detailing Findings: For each identified risk, the report should include a detailed description, the methodology used to assess the risk (quantitative, qualitative, or a combination), and the rationale behind the risk rating. This section should also document the vulnerabilities or threats contributing to the risk and any existing controls or mitigation strategies currently in place.
- Mitigation Recommendations: Based on the assessment outcomes, the report should propose concrete, actionable measures for risk reduction. These suggestions must be ordered by their urgency and impact, considering both the risk’s severity and the mitigation efforts’ practicality.
- Continuous Monitoring and Review: Highlight the importance of regularly reviewing and updating the risk assessment to reflect new threats, changes in the organization’s IT environment, and the effectiveness of implemented controls.
Summary
Conducting and documenting IT risk assessments is indispensable in an organization’s risk management efforts. An effectively organized and thorough report captures the current state of an organization’s risk profile and acts as a guide for risk mitigation efforts. By tailoring the presentation of findings to the audience and emphasizing the continuous nature of risk assessment, organizations can better manage their risk landscape and enhance their overall security posture.
References
Ivanti. (n.d.). What is ITIL? – The Essential Guide to ITIL. Retrieved March 22, 2024, from https://www.ivanti.com/glossary/itil
Archibald, K. (n.d.). 5 IT risk management frameworks to consider for your program. OneTrust. Retrieved March 22, 2024 from https://www.onetrust.com/blog/5-it-risk-management-frameworks-to-consider-for-your-program/
by jdpoteet | Mar 26, 2024 | News
Blackswan Cyber Fusion Center helps organizations to be flexible and scalable — enabling them to leverage a highly effective, 24/7, US-based Security Operations Center (SOC) at a low total cost of ownership (TCO), based on their business needs and risk profile.
From monitoring…to reporting and responding…to log retention…Blackswan’s CFC helps your organization stay secure.
Learn about how Blackswan Cyber Fusion Center can benefit your security posture more than traditional SOCs, while keeping costs manageable: http://www.blackswan-cybersecurity.com/cyber-fusion-center/
by jdpoteet | Mar 25, 2024 | News
PRC STATE-SPONSORED CYBER ACTIVITY: ACTIONS FOR CRITICAL INFRASTRUCTURE LEADERS
DOWNLOAD PDF
SUMMARY
This fact sheet offers executive leaders an overview of the pressing threat posed by state-sponsored cyber actors from the People’s Republic of China (PRC) known as “Volt Typhoon.” In collaboration with the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and various U.S. government and international counterparts, CISA issued a significant advisory on February 7, 2024. This advisory alerts cybersecurity defenders to Volt Typhoon’s activities, highlighting their infiltration of U.S. critical infrastructure networks. Their aim is to disrupt or dismantle critical services in times of heightened geopolitical tensions or potential military conflicts involving the United States and its allies. This poses a significant risk to businesses across the United States and allied nations.
