The Lazarus group has tweaked its loader obfuscation techniques by abusing image files in a recent phishing campaign. 

Lazarus is a state-sponsored advanced persistent threat (APT) group from North Korea.  Known as one of the most prolific and sophisticated APTs out there, Lazarus has been in operation for over a decade and is considered responsible for worldwide attacks including the WannaCry ransomware outbreak, bank thefts, and assaults against cryptocurrency exchanges.  South Korean organizations are consistent targets for Lazarus, although the APT has also been traced back to cyberattacks in the US and, more recently, South Africa.  In a campaign documented by Malwarebytes on April 13, a phishing document attributed to Lazarus revealed the use of an interesting technique designed to obfuscate payloads in image files.  The attack chain begins with a phishing Microsoft Office document (참가신청서양식.doc) and a lure in the Korean language. Intended victims are asked to enable macros in order to view the file’s content, which, in turn, triggers a malicious payload.  The macro brings up a pop-up message which claims to be an old version of Office, but instead, calls an executable HTA file compressed as a zlib file within an overall PNG image file. 

During decompression, the PNG is converted to the BMP format, and once triggered, the HTA drops a loader for a Remote Access Trojan (RAT), stored as “AppStore.exe” on the target machine.   “This is a clever method used by the actor to bypass security mechanisms that can detect embedded objects within images,” the researchers say. “The reason is because the document contains a PNG image that has a compressed zlib malicious object and since it’s compressed it can not be detected by static detections. Then the threat actor just used a simple conversion mechanism to decompress the malicious content.” The RAT is able to link up to a command-and-control (C2) server, receive commands, and drop shellcode. Communication between the malware and C2 is base64 encoded and encrypted using a custom encryption algorithm that has previously been linked to Lazarus’ Bistromath RAT. In related news, Google’s Threat Analysis Group (TAG) warned earlier this month that North Korean threat actors are targeting security researchers across social media. First spotted in January, the scheme now includes a web of sham profiles, browser exploits, and a fake offensive security company.

Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Cybersecurity is on the agenda in boardrooms across Asean, where business leaders discuss plans to plug existing gaps and adopt next-generation capabilities. This focus is necessary as 94% of organisations in the region report a climb in cyberattacks last year, with 24% seeing at least 50% increase in disruptive attacks. The majority, topping 92%, believe cybersecurity was a priority for their business leaders today amidst the ongoing global pandemic, according to a survey by Palo Alto Networks. Conducted in November 2021, the online study polled 500 respondents across five Asean markets, comprising 100 each from Singapore, Indonesia, Malaysia, Thailand, and the Philippines. The IT decision makers and business leaders were from five verticals: financial services, government, retail, telecommunications, and fintech.

Global pandemic opening up can of security worms

Caught by the sudden onslaught of COVID-19, most businesses lacked or had inadequate security systems in place to support remote work and now have to deal with a new reality that includes a much wider attack surface and less secured user devices.

Read More

Some 74% pointed to an increase in focus on cybersecurity within their leadership team, with 46% discussing such issues at the board level every quarter and another 38% doing so every month. With the heightened focus, 68% revealed plans to boost their cybersecurity budgets this year. Some 48% said this was fuelled by the adoption of next-generation security technologies, while 46% pointed to the need to plug existing cybersecurity gaps. Another 44% cited the aim to optimise operations. In particular, hybrid and remote work arrangements had underscored emphasis on personal safety, as 57% of Asean organisations looked to expand their remote workforce and another 57% would widen their network of smart devices. Some 58% also were increasing their investment in mobile apps, as businesses looked to drive their digital transformation, the Palo Alto report noted.Such initiatives had pushed 90% of respondents to evolve their cybersecurity strategy to remain secured. Specifically, 54% pointed to cloud security as the top security measure post-pandemic. Another 46% deployed Internet of Things (IoT) as well as operational technology (OT) security measures, while 45% focused on access management. Furthermore, with 54% reporting a climb in digital transactions with suppliers and third-party providers, 54% cited the need to adopt cybersecurity products and services to safeguard against cyber threats. Another 51% underscored the importance of protecting themselves against unmonitored and unsecured IoT devices connected to the corporate network. Across the region, 45% from the financial services sector and 42% from fintechs saw themselves as most at risk of cyber attacks, with malware attacks topping their concerns. These two market segments, though, were most confident of cybersecurity measures they had put in place to safeguard against attacks. Some 79% from financial services and 76% of fintechs reported a strong focus on cybersecurity amongst their business leaders, slightly above the regional average of 74%. In addition, 81% of financial services companies and 75% of fintechs reported an increase in their cybersecurity budgets, compared to the regional average of 68%.Almost all respondents across the board, at 96%, had a dedicated in-house IT team for managing cyber risks. Palo Alto Networks’ field chief security officer Ian Lim said: “The pandemic has served as a catalyst for Asean business leaders to sit up and pay greater attention to their cybersecurity defence measures, [with] many recognising the deep impact it can have on their business continuity. To manage today’s remote workforce in a digital-first environment, cybersecurity must be integrated horizontally across all facets of the business and considered as part of every corporate action.”RELATED COVERAGE More

At the start of this year, Symphony Technology Group (STG) announced Trellix was the new name for the business unit that resulted from the merger of McAfee Enterprise and FireEye last October.During 2021, STG picked up McAfee Enterprise for $4 billion, before paying $1.2 billion to purchase FireEye. In announcing Trellix, the company detailed the new business would focus on threat detection and response using machine learning and automation. It also said at the time not all of McAfee Enterprise would be bundled into Trellix. The remainder, which is the security service edge portfolio will now come under the newly announced name of Skyhigh Security. This includes cloud access security broker, secure web gateway, and zero trust network access. To be headed by former Cisco security senior VP and general manager Gee Rittenhouse, Skyhigh Security has been created to “satisfy the growing cloud security requirements for lager and small organisations”.”With the majority of data in the cloud and users accessing it from everywhere, a new approach to security is needed,” Rittenhouse said. “Skyhigh Security has created a comprehensive security platform to secure both data access and data use via unified policies and data awareness. Organisations can now have complete visibility and control and seamlessly monitor and mitigate security risks — achieving lower associated costs, driving greater efficiencies and keeping pace with the speed of innovation.” STG added that splitting McAfee Enterprise into two organisations allows it to “better focus on the very distinct markets” of threat detection and response, and the security service edge.  MORE SECURITY NEWS Meta shares how it detects silent data corruptions in its data centresAfter three years of testing, Meta has found its preferred approach for detecting silent data corruptions. Ditching LastPass? Here are some alternatives to tryLastPass changes to the free offering got you down? Not feeling like paying the $36 a year for the premium service. Here are some alternatives. (Updated with reader suggestion). These four types of ransomware make up nearly three-quarters of reported incidentsAny ransomware is a cybersecurity issue, but some strains are having more of an impact than others. Microsoft: Here’s how this notorious botnet used hacked routers for stealthy communicationChange your router’s default password and make it a strong one, warns Microsoft. More

Researchers have provided insight into China Chopper, a web shell used by the state-sponsored Hafnium hacking group.

Hafnium is a group of cyberattackers originating from China. The collective recently came into the spotlight due to Microsoft linking them to recent attacks exploiting four zero-day vulnerabilities — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 — in Microsoft Exchange Server.
Microsoft says that Hafnium tends to strike targets in the United States, focusing on industries including defense, research, law, and higher education. While believed to be based in China, the group uses leased virtual private servers (VPS) in the US.
Due to the renewed interest in Hafnium, on Monday, Trustwave published an analysis of one of the group’s tools, China Chopper, which is a web shell widely used for post-exploitation activities. 
The web shell has been detected in Exchange Server-related attacks alongside DearCry ransomware deployment.
China Chopper is not new and has been in the wild for at least a decade. The tiny web shell — coming in at only four kilobytes (.PDF) — contains two key components; a web shell command-and-control (C2) client binary and a text-based web shell payload, the server component. 
“The text-based payload is so simple and short that an attacker could type it by hand right on the target server — no file transfer needed,” the team notes.

FireEye calls the tool a “slick little web shell that does not get enough exposure and credit for its stealth.”
There are different variants of China Chopper in the wild that are written in different languages — such as ASP, ASPX, PHP, JSP, and CFM — but they all have similar functions. The Active Server Page Extended (ASPX) variety, once it lands on a server already compromised via an exploit, for example, is typically no more than one line of code. 
Red Canary notes that the .aspx web shell names are generally made up of eight random characters. 
Upon examination of a China Chopper sample, Trustwave describes how when an HTTP POST request is made, the script calls the “eval” function to execute the string inside a POST request variable.
“The POST request variable is named “secret,” meaning any JScript contained in the “secret” variable will be executed on the server,” the researchers say. “JScript is implemented as an active scripting engine allowing the language to use ActiveX objects on the client it is running on. This can be and is abused by attackers to achieve reverse shells, file management, process execution, and much more.”
A client component of China Chopper is usually hosted on an attacker’s system to facilitate communication, which can be used for tasks such as running a virtual terminal to launch commands based on cmd.exe, downloading files, and executing other malicious scripts.
The researchers also noted corresponding .NET DLLs to China Chopper generated by ASP.NET runtime on compromised servers. 
TEMP.Periscope/Leviathan, APT41/Double Dragon, and Bronze Union, among other advanced persistent threat (APT) groups, have been connected to the use of this popular web shell in the past.
Red Canary has also identified a cluster of Microsoft Exchange Server attacks building from the use of this backdoor. Dubbed “Sapphire Pigeon,” multiple web shells are being dropped on compromised servers at different times — and in some cases, days before post-exploit activities begin. 
At least 10 APTs are thought to be exploiting the critical Exchange Server vulnerabilities, of which at least 82,000 servers remain unpatched, according to Microsoft. 
Last week, Check Point Research said the rate of attacks leveraging the vulnerabilities was doubling every two to three hours. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Artie Beaty/ZDNETZDNET’s key takeawaysIt’s not the latest model in this series, but the LG G3 More