AZORult Stealer

AZORult is a publicly available information-stealing malware that is popular among hackers. AZORult is delivered via phishing e-mails and with the use of Exploit Kits (EK), most notably the Rig EK. It collects information from victims by targeting a variety of applications for credential harvesting. In January 2018, Wapack Labs started analysis of AZORult nodes in an effort to identify stolen data. As part of this research, Wapack Labs gained insight into AZORult Command and Controls (C2). This report includes details on the AZORult malware and provides trending on the identified infrastructure. Wapack Labs analysts were able to recover over a million AZORult logs, which include data on victim IPs, e-mails, credentials, and attack server data. This information is listed in the Wapack Labs Blacklist Slack channel and searchable via our CTAC tool to provide situational awareness...READ MORE

Wapack Labs has cataloged and reported on AZORult malware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

DiamondFox in the Wild

TLP AMBER ANNOUNCEMENT: 

DiamondFox is a credential stealing multi purpose botnet that is available on the black market as MaaS (Malware as a Service). Also known as Gorynych, DiamondFox is still actively leveraged in the wild with its recent version Crystal available in online marketplaces. This dangerous malware can steal information from PoS (Point of Sale) systems with campaigns targeting multi-state healthcare providers, dental clinics, manufacturers, and technology companies. To get a picture of the current state of DiamondFox botnets, Wapack Labs has collected recent samples and extracted the command and control (C2) information from their configuration files. This report provides technical details on DiamondFox, the Russian botnet infrastructure, and details regarding the domains...READ MORE

Wapack Labs has cataloged and reported extensively on malware and botnets in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

NK Lazarus Threat to the Financial Sector Remains High

Newly discovered Command & Control (C2) Internet Protocols (IPs) confirm the geolocation of North Korean threat actors, Lazarus Group; despite their deliberate attempts at misdirection. They are known for their custom-tailoring and reuse of code between malware families and campaigns. Since 2009, Lazarus Group has targeted Asian-based financial institutions, European and South American financial institutions, and media companies, such as Sony Pictures. Recent financial and trading sanctions, levied on North Korea, will increase the likelihood of attacks on financial sectors; similar to the documented attacks, leveraging the Society for Worldwide Interbank Financial Telecommunications (SWIFT), to compromise central banks...READ MORE

Wapack Labs has cataloged and reported extensively on financial compromise and the Lazarus Group in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

419 Attackers Leveraging New Undetected Pony Infrastructure for Possible Swift Targeting

Wapack labs analyzed two recent Pony/Fareit downloader samples that were submitted to Virus Total in late September.  The samples provided insight into recently registered attacker infrastructure imitating a number of European, US and Bangladeshi companies.  This infrastructure was recently registered and only one domain is currently detected (low detection) as malicious on Virus Total. Further collection identified additional 2015 and 2016 infrastructure registered by 419 actors imitating banking, US Government, military, and oil and gas organizations.  This PIR provides forewarning on infrastructure that will likely be activated as command and control (C2) in the future.

Publication Date: 7 October 2016

Handling requirements: Traffic light protocol (TLP) AMBER

Attribution/Threat Actors: Criminal

Actor type:  Adversary capabilities have been assessed as Tier 1*

Previous reporting: None

*Practitioners who rely on others to develop the malicious code, delivery mechanisms, and execution strategy (use known exploits). 

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

APT Sinkhole Connection Notification

http://www.itbusinessedge.com

Wapack Labs released a report today that identified 17 connections to Advanced Persistent Threat (APT) sinkholes by six corporate networks.  While not a perfect indicator, connections to these sinkholes are indicative of potential compromise by an APT actor.  Wapack Labs recommends that each of the 17 machines be examined by security personnel.

What’s a sinkhole? When a computer is compromised by malware, it often connects to a computer outside of the victim network for instructions.  Wapack Labs purchased these command and control (C2) nodes specifically to identify computers reaching out of their native environment.  As a result, any computer connecting to the Wapack Labs sinkhole should be considered likely compromised, and examined immediately for compromise, data loss, exfiltration or theft.

APT sinkholes indicate potential State Sponsored Espionage attacks against them.

Companies in the following industries are mentioned in this report:

• Fortune 100 Chemical
• Internet Service Provider
• SMB Virtual Server Hosting 
• SMB Onsite managed IT
• Medium sized Defense Industrial Base company
• SMB IT Consulting

Publication Date: 22 August 2016

Handling requirements: Traffic light protocol (TLP) RED - Recipients may not share TLP: RED information with any parties outside of the specific exchange, meeting or conversation in which it is originally disclosed.

Attribution/Threat Actors: Various/Multiple

Actor type:  Adversary capabilities have been assessed as Tier IV and Tier V (Criminal, State Sponsored, Advanced Persistent Threat)

Previous reporting: Multiple

Targeted industries:  Chemical, Defense/Industrial Controls, Internet/Hosting

Victim information will be provided separately to Wapack Labs security partners.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.