May 22 2024
Welcome to Gone Phishing, your daily cybersecurity newsletter that’s always fishing, never phishing 🎣🎣🎣
Today’s hottest cybersecurity news stories:
☀️ SolarMarker malware returns thanks to multi-tiered infrastructure 🌐
🌧️ Every cloud… CLOUD#REVERSER targets Google Drive, Dropbox 🎯
🖥️ GitHub Enterprise Server (GHES) flaw allows authentication bypass 🔓
SolarMarker, an information-stealing malware, has built a complex, multi-tiered infrastructure to evade law enforcement takedowns, according to Recorded Future.
Adaptable and Evolving 💻
SolarMarker's layered infrastructure includes two clusters: a primary one for active operations and a secondary one for testing new strategies. This setup makes it hard to eliminate.
Target Sectors 🎯
Active since September 2020, SolarMarker targets sectors like education, government, healthcare, hospitality, and SMEs. Key victims include universities, government departments, and global hotel chains, mostly in the U.S.
Stealth Techniques 🕵️
The malware has evolved to become more stealthy, using larger payloads, valid Authenticode certificates, and novel Windows Registry changes. It runs from memory, avoiding disk detection.
Infection Methods 💉
Infection usually occurs through bogus downloader sites or malicious emails. Initial droppers are EXE and MSI files that deploy a .NET-based backdoor, which then downloads additional payloads for data theft.
New Variants & Techniques 🔄
Recent variants use Inno Setup, PS2EXE tools, and a new PyInstaller version, sometimes hidden in decoy files like a dishwasher manual.
Command-and-Control (C2) Structure 🕸️
The malware's C2 structure includes multiple tiers:
Tier 1: Direct contact with victim machines
Tier 2 & 3: Intermediate communication layers
Tier 4: Central server, managing operations and connecting to an auxiliary server for monitoring.
SolarMarker's sophisticated infrastructure and evolving tactics make it a formidable cyber threat.
A new malware campaign called CLOUD#REVERSER uses legitimate cloud services like Google Drive and Dropbox to stage malicious payloads, according to Securonix researchers.
Phishing Attack 📝
The attack begins with a phishing email containing a ZIP file. This file has an executable disguised as an Excel document using a right-to-left override (RLO) Unicode character to trick victims.
Payload Delivery 📂
The malicious executable drops eight payloads, including:
A decoy Excel file
An obfuscated VBScript to maintain the ruse
Scripts for setting up persistence and downloading more malicious files
Persistence & Obfuscation 🕵️
VB and PowerShell scripts create scheduled tasks disguised as Google Chrome updates to avoid detection. These scripts connect to Dropbox and Google Drive to download further instructions and payloads.
Dynamic & Stealthy 🌐
The PowerShell scripts downloaded on-the-fly can be modified by attackers to change the files fetched and executed. This makes the malware adaptable and difficult to trace.
Stealth Operations 👤
By leveraging cloud services, CLOUD#REVERSER blends into regular network activity, making it hard to detect. It uses these platforms for data exfiltration and command execution.
Ongoing Investigation 🔍
The full scope and targets of this campaign are still unknown as the investigation by the Texas-based cybersecurity firm continues.
This method highlights the increasing misuse of legitimate cloud services by threat actors to evade detection and maintain access to compromised systems.
Stay ahead of the curve with Presspool.ai! 🚀 Subscribe to their newsletter for the latest buzz in the information technology space, with a special focus on AI. Their slogan says it all: "Actionable marketing insights for the visionary AI executive." 🤓💡 That’s us, alright! 🤵 How about you? Visionary AI executive, much? 👀
And if the newsletter gets your motor running then you can take a butchers at their cool AI marketing product too which is sure to help you make the most of our new artificial overlords and put them to work for your business 🤖👩💻🌐
Rest assured, the process is very straightforward.
You simply:
🆕 Sign Up & Create Campaign
📊 Define your audience, budget, and message to captivate your audience.
🚀 Launch your campaign, as Presspool’s AI matches it with ideal newsletter audiences for optimal reach and conversions. 🎯
🕵️ Finally, you leverage real-time analytics to track performance and refine future strategies. 📈 Elevate your marketing game and stay informed with Presspool.ai! 🌟 Simples! 🦦
Presspool.ai 📰🏊🤖 may just have what you need to succeed. And if the product isn’t for you, the newsletter alone is a gamechanger. And we know newsletters 😉
Maximum Severity Flaw Fixed! GitHub has patched a critical vulnerability in GitHub Enterprise Server (GHES), tracked as CVE-2024-4985, which could allow attackers to bypass authentication (CVSS score: 10.0).
Authentication Bypass 🔓
The flaw affects instances using SAML single sign-on (SSO) with encrypted assertions. Attackers could forge a SAML response to gain admin access without prior authentication.
Impact & Versions Affected 📉
Affects all GHES versions prior to 3.13.0.
Fixed in versions: 3.9.15, 3.10.12, 3.11.10, and 3.12.4.
Secure Your Instance ⚙️
GHES users are advised to update to the latest version to mitigate this critical risk.
Encryption Not Default ⚠️
Encrypted assertions are not enabled by default.
Instances not using SAML SSO or using SAML SSO without encrypted assertions are not affected.
Update Recommended 🛡️
Organisations using vulnerable versions should update immediately to protect against potential unauthorised access and secure their software development environments.
🗞️ Extra, Extra! Read all about it! 🗞️
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
🛡️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday 📅
💵 Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for 🆓
📈 Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future 👾
Let us know what you think.
So long and thanks for reading all the phish!
