DiamondFox in the Wild

TLP AMBER ANNOUNCEMENT: 

DiamondFox is a credential stealing multi purpose botnet that is available on the black market as MaaS (Malware as a Service). Also known as Gorynych, DiamondFox is still actively leveraged in the wild with its recent version Crystal available in online marketplaces. This dangerous malware can steal information from PoS (Point of Sale) systems with campaigns targeting multi-state healthcare providers, dental clinics, manufacturers, and technology companies. To get a picture of the current state of DiamondFox botnets, Wapack Labs has collected recent samples and extracted the command and control (C2) information from their configuration files. This report provides technical details on DiamondFox, the Russian botnet infrastructure, and details regarding the domains...READ MORE

Wapack Labs has cataloged and reported extensively on malware and botnets in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

419 Attackers Leveraging New Undetected Pony Infrastructure for Possible Swift Targeting

Wapack labs analyzed two recent Pony/Fareit downloader samples that were submitted to Virus Total in late September.  The samples provided insight into recently registered attacker infrastructure imitating a number of European, US and Bangladeshi companies.  This infrastructure was recently registered and only one domain is currently detected (low detection) as malicious on Virus Total. Further collection identified additional 2015 and 2016 infrastructure registered by 419 actors imitating banking, US Government, military, and oil and gas organizations.  This PIR provides forewarning on infrastructure that will likely be activated as command and control (C2) in the future.

Publication Date: 7 October 2016

Handling requirements: Traffic light protocol (TLP) AMBER

Attribution/Threat Actors: Criminal

Actor type:  Adversary capabilities have been assessed as Tier 1*

Previous reporting: None

*Practitioners who rely on others to develop the malicious code, delivery mechanisms, and execution strategy (use known exploits). 

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

APT Sinkhole Connection Notification

http://www.itbusinessedge.com

Wapack Labs released a report today that identified 17 connections to Advanced Persistent Threat (APT) sinkholes by six corporate networks.  While not a perfect indicator, connections to these sinkholes are indicative of potential compromise by an APT actor.  Wapack Labs recommends that each of the 17 machines be examined by security personnel.

What’s a sinkhole? When a computer is compromised by malware, it often connects to a computer outside of the victim network for instructions.  Wapack Labs purchased these command and control (C2) nodes specifically to identify computers reaching out of their native environment.  As a result, any computer connecting to the Wapack Labs sinkhole should be considered likely compromised, and examined immediately for compromise, data loss, exfiltration or theft.

APT sinkholes indicate potential State Sponsored Espionage attacks against them.

Companies in the following industries are mentioned in this report:

• Fortune 100 Chemical
• Internet Service Provider
• SMB Virtual Server Hosting 
• SMB Onsite managed IT
• Medium sized Defense Industrial Base company
• SMB IT Consulting

Publication Date: 22 August 2016

Handling requirements: Traffic light protocol (TLP) RED - Recipients may not share TLP: RED information with any parties outside of the specific exchange, meeting or conversation in which it is originally disclosed.

Attribution/Threat Actors: Various/Multiple

Actor type:  Adversary capabilities have been assessed as Tier IV and Tier V (Criminal, State Sponsored, Advanced Persistent Threat)

Previous reporting: Multiple

Targeted industries:  Chemical, Defense/Industrial Controls, Internet/Hosting

Victim information will be provided separately to Wapack Labs security partners.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.