Overview

SentinelLabs researchers recently reported that BlackBasta ransomware may have ties to FIN7. The Black Basta ransomware group was first seen on April 2022 and has breached over 90 organizations since then. The assessment came after researchers discovered previously unknown TTPs. FIN7 (also known as Carbanak) is a financially motivated group that has been active since 2012 and targets a variety of industries. This development sheds light on the constantly evolving crime scene. 

(ref. https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/)

Some of the key points of the research according to SentinelLabs are the following:

• SentinelLabs researchers revealed previously unknown tools and techniques.
• Researchers assess it is highly likely the Black Basta ransomware operation has ties with FIN7.
• Black Basta maintains and deploys custom tools, including EDR evasion tools.
• SentinelLabs assess it is likely the developer of these EDR evasion tools is, or was, a developer for FIN7.
• Black Basta attacks use a uniquely obfuscated version of ADFind and exploit PrintNightmare, ZeroLogon and NoPac for privilege escalation.

Difenda is closely watching for new tactics, techniques, and procedures and will provide updates as they become available.

---

Emotet Returned From Hiatus on November 2, 2022, With New Tooling Against FIN7

Overview

Emotet was seen returning from hiatus with new tooling on November 2nd, 2022. Researchers from the Emotet research group Cryptolaemus reported that the Emotet malware operation is again spamming malicious emails after almost a four-month break. Emotet is a malware infection distributed through phishing campaigns containing malicious macros hidden in Excel or Word documents. Considered the most distributed malware in the past, it suddenly stopped spamming on Jule 13, 2022. The recent campaign is notable as it included a new social engineering technique that attempts to convince users to move malicious files to trusted locations. This action ensures that the malicious macros run by bypassing Protected View. The Emotet campaigns drop payloads such as Cobalt Strike that commonly lead to ransomware attacks. 

(ref. https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-again-after-4-month-break/)

Detection Details For FIN7 Activities

Microsoft Defender for Endpoint:

Alerts with the following titles in the security center can indicate threat activity on your network:

              DEV-0201 Ransomware-linked activity group detected

The following alerts might also indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity and are not monitored in the status cards provided with this report.

               Possible initial access via Microsoft Office app – alerts when a malicious Office document creates executable code or spawns processes

             Anomaly detected in ASEP registry – alerts when a malicious program is registered to automatically run at startup

Advanced Hunting:

Identifies emails that match the patterns shown in this campaign

EmailEvents // Identify inbound emails with a reply or forward   

EmailEvents // Identify inbound emails with a reply or forward   
| where Subject has_any('RE:','FW:','FWD:','AW:','WG:','TR:') and EmailDirection == "Inbound"    
// Join when emails have XLS or ZIP file attachments | join kind=inner (EmailAttachmentInfo      
| where FileName has_any('.xls','.zip') ) on NetworkMessageId 

Recommended Actions

Cybersecurity awareness and EDR tools like Defender365 are essential to avoid falling victim to sophisticated phishing campaigns like EMOTET.

---

Two High-Severity OpenSSL Flaws Are Now Patched

Overview

The vulnerabilities tracked as CVE-2022-3602 and CVE-2022-3786 have been addressed in version 3.0.7. These are two high-severity flaws that affect versions 3.0.0 and later. CVE-2022-3602 is an arbitrary 4-byte stack buffer overflow that could trigger crashes or lead to remote code execution (RCE), while CVE-2022-3786 can be exploited by attackers via malicious email addresses to trigger a denial of service state via a buffer overflow. 

(ref. https://www.bleepingcomputer.com/news/security/openssl-fixes-two-high-severity-vulnerabilities-what-you-need-to-know/)

Recommended Actions

It is recommended to apply the latest software versions.

---

Seventh Chrome Zero-Day Fixed This Year

Overview

Chrome version 107.0.5304.87/88 patches the seventh zero-day vulnerability this year. The high-severity vulnerability tracked as CVE-20223723 is a type of confusion bug in the Chrome V8 Javascript engine discovered and reported to Google by analysts at Avast. Google will not provide many details about the vulnerability for security reasons until the majority of the users apply the fix. 

(ref. https://www.bleepingcomputer.com/news/security/google-fixes-seventh-chrome-zero-day-exploited-in-attacks-this-year/)

Recommended Actions

It is recommended to apply the latest software versions.

---

Apple Fixes New Zero-Day iOS Vulnerability

Overview

Apple released a new security update regarding the vulnerability (CVE-2022-42827). Attackers can exploit this flaw to execute arbitrary code with kernel privileges caused by software being able to write data outside the boundaries of the memory buffer. This has as a result data corruption, application crashes, and code execution due to undefined or unexpected results (also known as memory corruption) from subsequent data written to the buffer. This flaw impacts the devices iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation). 

(ref. https://www.bleepingcomputer.com/news/security/apple-fixes-recently-disclosed-zero-day-on-older-iphones-ipads/)

Recommended Actions

CISA added this zero-day to its catalog of known exploited vulnerabilities and recommends that users update immediately. 

(https://www.cisa.gov/uscert/ncas/current-activity/2022/10/25/cisa-has-added-one-known-exploited-vulnerability-catalog)

---

References

• https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
• https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-again-after-4-month-break/ https://www.bleepingcomputer.com/news/security/openssl-fixes-two-high-severity-vulnerabilities-what-you-need-to-know/
• https://www.bleepingcomputer.com/news/security/google-fixes-seventh-chrome-zero-day-exploited-in-attacks-this-year/ https://www.bleepingcomputer.com/news/security/apple-fixes-recently-disclosed-zero-day-on-older-iphones-ipads/
• https://www.cisa.gov/uscert/ncas/current-activity/2022/10/25/cisa-has-added-one-known-exploited-vulnerability-catalog

Difenda Updates

Would you like to share cyber intelligence information with Difenda’s threat intelligence team? Send anything you would like to communicate to the email threatintel@difenda.com!