Hacker Shop Selling Exfiltrated Data

TLP AMBER ANNOUNCEMENT:

Wapack labs identified a hacker shop that sells batches of files exfiltrated from computers that belong to companies and corporations from various industries, such as a local law enforcement agency, financial institutions, mining companies, and logistic organizations. The shop's victims are located in several countries, though most are in the United States (US). It sells financial data sources, to include full credit card payment authorization forms. The shop has also exposed online banking check operations without obfuscation...READ MORE

Wapack Labs has cataloged and reported on hacker shops in the past. An archive of related reporting can be found in the Red Sky Alliance portal.  

 WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Recent Chinese Exfiltration Method Observed

Chinese nation state attackers (high confidence) recently used a Java web shell (Chropper.java), against a corporate network’s external web server, to download an unidentified malware payload. The initial breach against the server occurred on 15 December 2017, likely leveraging a Cold Fusion exploit. On 18 December 2017, attackers deployed a modified version of the web shell. The web shell came from a large collection of popular Chinese web shells uploaded to GitHub by a user who follows well-known Chinese security researchers. On 19 to 21 December 2017, the attack sequence took place, and was detected on the 21st. Once connected, the attackers executed a PowerShell script to execute a payload, which was never written to the disk. It established persistence, and injected into legitimate Windows processes, to enumerate all drive letters from C to Z, to identify all the mapped drives on the server...READ MORE

Wapack Labs has cataloged and reported on data exfiltration methods in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

New Threat Group Targeting School Districts

In September and October 2017, a threat actor group began targeting US-based K-12 school districts. The threat group thought to be responsible for the attacks has historically targeted healthcare, defense contractors, and the entertainment industry. However, Wapack Labs believes these are not the same groups based on past targeting and Tactics, Techniques, and Procedures (TTPs). School districts in Wisconsin and Iowa had student’s personal information breached and were threatened with a leak of the student information - if a ransom was not paid. They also direct texted students, threatening them with physical harm. The actors Tweeted, “With the student directory from (local school district) we released, any child predator can now easily acquire new targets and even plan based on grade level.” The Twitter feed threatens victims who do not cooperate. A recent Tweet stated, “To the particular (university): we’re a bit disgruntled. You know who you are. It’s best not to ignore us.” The group responsible for these attacks and threats is a new group with a wide variety of attacks, that appears to focus on only on the US based education sector...READ MORE

Wapack Labs has cataloged and reported on threat actor groups in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

In Search of Router Scanner Used in Cyber Campaign

TLP AMBER ANNOUNCEMENT:  

Wapack Labs has attempted to identify the router scanner used in a cyber campaign conducted by a threat actor group who is believed to be a Chinese hacker group targeting Taiwan and Japan. All of the reports on this group on the Chinese Internet are translations of the June 2017 report by Trend Micro that identified the group. No independent analysis of the group was found, and no references to the name were found that predate the Trend Micro reporting. Searches on the Chinese term for “router vulnerability scanner” all returned the same tool called RouterhunterBR, that was written by a Brazilian security researcher named Jhonathan Davi who lives in Brasilia. Further investigation could confirm this threat actor group's use of this tool by checking whether the targeted routers contained any of the vulnerabilities listed by the tool’s author. The identification of RouterhunterBR as possibly used in this cyber campaign is circumstantial. Further investigation could help confirm the connection if targeted routers were checked for the vulnerabilities that the author stated were searched for by the tool...READ MORE

Wapack Labs has cataloged and reported on Chinese hacking groups in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

  
This TLP AMBER report is available only to Red Sky Alliance members.

Safe Haven: Perfect Money Iceland

On 29 Nov 2016 Wapack Labs identified several threat actors signing up for Perfect Money Iceland accounts. Perfect Money is an online payment service used to exchange many types of digital and conventional currency between accounts. Wapack Labs has previously assessed Iceland’s potential as a data safe haven. The adoption of the Icelandic version of Perfect Money confirms actors are leveraging those privacy protections to launder the profits of their fraud. Wapack Labs is providing this attacker TTP analysis for your situational awareness.

Publication Date: 1 December 2016
Handling Requirements: Traffic light protocol (TLP) AMBER
Attribution/Threat Actors: Known Hacking Group
Actor Type: Adversary capabilities have been assessed as Tier III
Potential Targets: Worldwide (Financial Institutions)
Past Reporting: DOC-3116,4432