Newly Identified Phishing Malware, Allantibots, Can Fool Even The Most Eagle-eyed User.

Apple IDs are a popular target for hackers because they can enable theft of financial data and other personally identifiable information (PII). These are often obtained through phishing campaigns intended to trick users into entering their personal data. In June 2019, Wapack Labs identified one such campaign that is leveraging a large infrastructure and a phishing kit dubbed ‘Allantibots’. Allantibots is a sophisticated phishing package and is characterized by its ability to spoof the Apple URL. This results in a phishing URL that looks completely legitimate, even to a cautious user. To read the article go here: https://redskyalliance.org/finished-analysis/allantibots

To read the full article and find an archive of related cyber reporting, follow this link to  Allantibots Article 

Be sure to check out our cyber portal for other related articles Red Sky Alliance.org

Dead Russian Social Media Accounts Hacked

Social media accounts originally belonging to the deceased were recently observed promoting pro-Putin messages in Russia. The Russian social network, VK (formerly Vkontakte), reported that accounts were hacked. Social media accounts whose owners are no longer living and other abandoned accounts with weak password security were used in this campaign. Because they were deceased or abandoned accounts, account owners could not react to possible security warnings. Social media networks have different processes for deactivating deceased users. Abandoned accounts may be especially vulnerable to brute force attacks and may later be used in malware or disinformation campaigns. This use of hacked accounts poses a risk of international-level account hijacking on a variety of social media networks...READ MORE

Wapack Labs has cataloged and reported on social media hijacking in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Major Underground Carder Utilizes Point of Sale (PoS) Malware

Wapack Labs is researching a major underground carder who solicits on various carding/hacking forums. This actor advertises thousands of stolen credit cards from countless international banks. Actor's activity can be seen on several online shops, as well as many other connection points. The actor is also carding numerous retail stores in international venues with Point of Sale (PoS) malware, or skimmers. Wapack Labs is researching the actor's Tactics, Techniques and Procedures (TTPs).

Wapack Labs has cataloged and reported extensively on carding forums in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Algerian Phishing Attempt

A Red Sky Alliance member is reporting a suspected phishing email to Wapack Labs. Subsequent analysis reveals the campaign was initiated by an Algerian threat actor associated with a known hacking team. This Algerian threat actor compromised a French auto dealership on 19 July 2016 and sent phishing emails to a social group in New England U.S.A from a compromised domain belonging to a pizza shop in South Carolina. This information is offered as a caution; presented for your situational awareness.

• Algerian threat actor associated with known hacking team.
• Previously targeted French organizations for religious/national reasons. Target set and motivations, for the attacks, may have evolved.
• The hacking team's twitter went dormant on 17 Sep 2015 with the message “#Team_Closed Goodbye and Expect Us in 2016”. On 19 December 2016 the group created a new Facebook page and appears active again...READ MORE

Publication Date: 12 January 2017
Handling Requirements: Traffic light protocol (TLP) GREEN
Attribution/Threat Actors: Laakel En Person/Moujahidin Team
Actor Type: Adversary capabilities have been assessed as Tier II
Potential Targets: Worldwide phishing
Past Reporting: N/A

The full report may be viewed in the Red Sky Alliance as DOC-4608. 

Contact Wapack Labs for more information.

Defacement Campaigns: Turkey-based Hacking Group

Wapack Labs has discovered a very active hacking group based in Turkey.  This group appears to be loyal to the Erdogan regime and has attacked, with defacement campaigns, in Western Europe and the U.S.  The group was discovered by Wapack analysts during routine collection efforts. This information is being provided for your situational awareness.

Publication date:                          4 October 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            Turkey-based hacking group

Actor Type:                                   Adversary capabilities have been assessed as Tier IV*

Potential Targets:                          Turkey, Middle East, Western Europe and USA

Past Reporting:                              Red Sky Alliance: DOC-4195

*Criminal or state actors who are organized, highly technical, proficient, well-funded professionals working in teams to discover new vulnerabilities and develop exploits.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Fancy Bear Strikes Again

During September 2017, the increasingly infamous Russian hacking entity known as “Fancy Bear” leaked more personal and confidential data from the World Anti-Doping Agency (WADA) database. This data included more athletes’ medical information – this time from more countries than just the United States. It is widely believed that these cyber-attacks on WADA are in response to the independent investigations that exposed state-sponsored doping in Russia, a claim that Russian officials denied.   Despite Russia’s renunciation, a strong connection appears to be emerging with Russian state-sponsored hacking operations.  This information is being provided for your situational awareness.

Publication date:                  23 September 2016

Handling requirements:        Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:    Fancy Bear, Fancy Bears & Fancy Bears’ Hack Team     

Actor Type:                           Adversary capabilities have been assessed as Tier V*

Potential Targets:                 USA / International

Past Reporting:                     Red Sky Alliance: DOC-2590, DOC-4007, Message-8625/8625

*State actors who create vulnerabilities through an active program to “influence” commercial products and services during design, development or manufacturing, or with the ability to impact products while in the supply chain to enable exploitation of networks and systems of interest.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Hacking the U.S. Elections

www.cnn.com

Last month, Wapack Labs reported on voter fraud issues in the U.S.  This past weekend, our CEO reiterated these same concerns in his blog.  This worry is real and could affect the integrity of the U.S. electoral process; and thus effect any aspects of U.S. and international corporate and government relations.  Though voter fraud has been a reality for many years, the fear of foreign and or domestic IT hacking is a true concern.  A series of data breaches overseas are spurring concerns that hackers could manipulate elections in the United States.  Many U.S. states do not have proper paper backups to properly cross reference voting records if their electronic systems are hacked or fail.  With heightened sensitivity regarding U.S. voter fraud and electronic voting machines, further OSINT research was conducted.   This information is being supplied for your situational awareness. 

Publication date:                          12 September 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            US POTUS Voter Fraud

Actor Type:                                   Tier III to IV          

Potential Targets:                         USA

Past Reporting:                             DOC-4174, DOC-4144, DOC-2145

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Drones Equipped With New Payload: 4G/5G LTE

www.pbs.com

In September 2016, two major communication companies have announced a new partnership where the combined technologies of Unmanned Aerial Vehicle (UAV), or “drones”, and cellular technology are being projected for use in portable 4G-5G LTE reception, which can be used for multiple communication purposes and also for emergency management uses.  In addition to many forward leaning and positive cellular applications, there are negatives; such as Wi-Fi hotspot hacking opportunities which could result in the loss of Personally Identifiable Information (PII) or government and/or corporate breaches.  This information is being supplied for your situational awareness. 

Publication date:                      7 September 2016

Handling requirements:            Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:        Drone use for 4-5 G LTE / Gov. and Corp. data breaches

Actor Type:                               Tier III to IV          

Potential Targets:                     USA / Western Europe

Past Reporting:                         DOC-3636

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Validtools.ru Exposes Compromised Accounts

www.bgr.in

The underground cybercriminal shop, “Validtools.ru”, has advertised the sale of various compromised accounts, hacking and scamming tutorials and credit card data.  Typically, credentials are seen only by the seller and buyer, but Wapack Labs analysts observed three cases where logins and passwords associated with e-mail and major payment processor accounts were exposed. These exposed credentials are assessed as being either a material showcase or an actor’s mistake.

Publication date:                             1 September 2016

Handling requirements:                 Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            Criminal

Actor Type:                                      Tier II                       

Potential Targets:                            Financial, individual users

Past Reporting:                               DOC-4186

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Hacking the Automotive Industry

www.valbonne-consulting.com

Wapack Labs open source collection exposed current concerns with the potential of active hacking into the autonomous vehicle industry.  Due to the fact that automobiles have up to 100 ECUs and more than 100 million lines of code, the Automotive-ISAC, and numerous tech researchers, are issuing cyber awareness regarding this industry’s production future; one which is shared by this lab.  Recently, as a vulnerability demonstration, two white hat hackers gained control of the vehicle's steering and directed it off the road.  We are providing this information for your situational awareness and proposal for future research.

Publication date:                          26 August 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            Autonomous vehicle industry

Actor Type:                                   Tier III or higher

Potential Targets:                         USA / International

Past Reporting:                             DOC-1771, DOC-1652

For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.