The SynAck ransomware gang has released decryption keys for victims that were infected between July 2017 and 2021, according to data obtained by The Record. SynAck is in the process of rebranding itself as the El_Cometa ransomware gang and a member of the old group gave the keys to The Record. Emsisoft’s Michael Gillespie confirmed the veracity of the decryption keys and said they are working on their own decryption utility that they believe will be “safer and easier to use” because there are concerns that SynAck victims may damage their files further using the provided keys. Ransomware expert Allan Liska told ZDNet that the SynAck ransomware group started right before Ransomware-as-a-service began to take off in 2018. “So they never outsourced their ransomware activities. While they continued attacks, there weren’t nearly as many as groups like Conti or REvil were able to conduct, so they got lost in the shuffle,” Liska said. “They also didn’t hit any really big targets.”

A Kaspersky Lab report in 2018 said SynAck differentiated itself in 2017 by not using a payment portal and instead demanding victims arrange payment in Bitcoin through email or BitMessage ID. They generally demanded ransoms around $3,000 and gained notoriety for using the Doppelgänging technique, which targets the Microsoft Windows operating system and is designed to circumvent traditional security software and antivirus solutions by exploiting how they interact with memory processes.

There is little data on victims of the ransomware group but Kaspersky Lab researchers said they observed attacks by the gang in the US, Kuwait, Germany and Iran.”The ability of the Process Doppelgänging technique to sneak malware past the latest security measures represents a significant threat; one that has, not surprisingly, quickly been seized upon by attackers,” said Anton Ivanov, lead malware analyst at Kaspersky Lab. “Our research shows how the relatively low profile, targeted ransomware SynAck used the technique to upgrade its stealth and infection capability. Fortunately, the detection logic for this ransomware was implemented before it appeared in the wild.”A SynAck representative told The Record that the group plans to launch a new Ransomware-as-a-service platform and recruit affiliates to help with their work on El_Cometa. Multiple ransomware groups, like Avaddon and Prometheus, have released decryption tools in recent months, either in an effort to rebrand or due to increased law enforcement activity.  More

Image: Soviet Artefacts, ZDNet

A Chinese-speaking hacking group has been observed using a UEFI bootkit to download and install additional malware on targeted computers.
UEFI firmware is a crucial component for every computer. This crucial firmware inside a flash memory bolted to the motherboard and controls all the computer’s hardware components and helps boot the actual user-facing OS (such as Windows, Linux, macOS, etc.).
Attacks on UEFI firmware are the Holy Grail of every hacker group, as planting malicious code here allows it to survive OS reinstalls.
Nonetheless, despite these benefits, UEFI firmware attacks are rare because tampering with this component is particularly hard as attackers either need physical access to the device or they need to compromise targets via complex supply chain attacks where the UEFI firmware or tools that work with UEFI firmware are modified to insert malicious code.
In a talk at the SAS virtual security conference today, security researchers from Kaspersky said they detected the second known instance of a widespread attack leveraging malicious code implanted in the UEFI.
The first, disclosed by ESET in 2018, was supposedly carried out by Fancy Bear, one of Russia’s state-sponsored hacker groups. This second one is the work of Chinese-speaking hackers, according to Kaspersky.
UEFI bootkit used to deploy new MosaicRegressor malware
The company said it discovered these attacks after two computers were flagged by the company’s Firmware Scanner module as suspicious.
In their talk today, Kaspersky malware researchers Mark Lechtik and Igor Kuznetsov said they investigated the flagged systems and found malicious code inside the flagged UEFI firmware. This code, they said, was designed to install a malicious app (as an autorun program) after every computer start.
This initial autorun program acted as a downloader for other malware components, which Kaspersky named the MosaicRegressor malware framework.
Kaspersky said it has yet to obtain and analyze all of MosaicRegressor’s components, but the one that they did look at contained functionality to gather all the documents from the “Recent Documents” folder and putting them in a password-protected archive — most likely preparing the files for exfiltration via another component.
The researchers said they found the UEFI bootkit on only two systems, but they found MosaicRegressor components on a multitude of other computers.
However, the targets of these attacks were all carefully selected. All were diplomatic entities and NGOs in Africa, Asia, and Europe.
“Based on the affiliation of the discovered victims, we could determine that all had some connection to the DPRK [North Korea], be it non-profit activity related to the country or actual presence within it,” Kaspersky said.
Based on leaked HackingTeam malware
But Kasperksy also made another major discovery while analyzing these attacks. The UEFI malicious code wasn’t exactly new. According to their analysis, the code was based on VectorEDK, which is a hacking utility to attack UEFI firmware, created by HackingTeam, a now-defunct Italian vendor of hacking tools, exploits, and surveillance software.
The company was hacked in 2015, and its tools were dumped online, including the VectorEDK toolkit. According to its manual, the tool was designed to be used with physical access to a victim’s computer.
Kaspersky says that based on the similarities between VectorEDK and the modified version used by the Chinese group, the Chinese group most likely deployed their tool using physical access to their targets’ computers as well.
The company’s full report on these attacks is available as a 30-page PDF report here. More

The Justice Department announced charges against four Chinese nationals on Monday, accusing the men of being part of a hacking group that attacked “companies, universities, and government entities in the United States and abroad between 2011 and 2018.”According to a release from the DOJ, a San Diego federal grand jury returned the indictment of all four in May and it was unsealed on Friday.The indictment says Ding Xiaoyang, Cheng Qingmin and Zhu Yunmin were members of the Hainan State Security Department working covertly within a front company called Hainan Xiandun Technology Development Co., Ltd.The goal of the operation, according to the Justice Department, was to steal information from companies that would help enterprises in China. The DOJ said the hackers were specifically looking for “information that would allow the circumvention of lengthy and resource-intensive research and development processes.”Operating out of Haikou, Hainan Province, the three are accused of “coordinating, facilitating, and managing computer hackers and linguists at Hainan Xiandun and other MSS front companies.” Wu Shurong was also indicted for his role as a hacker who created malware, assisted the other three in breaking into computer systems, and allegedly supervised other Hainan Xiandun hackers.The DOJ noted that the group attacked companies across the US, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, UK, Austria, Cambodia, Canada, and Germany. Most of the attacks targeted companies working in the defense, education, healthcare, biopharmaceutical, and aviation sectors. 

“Stolen trade secrets and confidential business information included, among other things, sensitive technologies used for submersibles and autonomous vehicles, specialty chemical formulas, commercial aircraft servicing, proprietary genetic-sequencing technology and data, and foreign information to support China’s efforts to secure contracts for state-owned enterprises within the targeted country (e.g., large-scale high-speed railway development projects),” the Justice Department statement said.  “At research institutes and universities, the conspiracy targeted infectious-disease research related to Ebola, MERS, HIV/AIDS, Marburg, and tularemia.” The indictment also accuses educators at universities in Hainan and across China of working with the country’s Ministry of State Security to help with the attacks. Deputy Attorney General Lisa Monaco said the charges highlight that China continues to use cyber-enabled attacks to steal what other countries make, calling the government’s actions representative of a “flagrant disregard of its bilateral and multilateral commitments.””The breadth and duration of China’s hacking campaigns, including these efforts targeting a dozen countries across sectors ranging from healthcare and biomedical research to aviation and defense, remind us that no country or industry is safe,” Monaco said. The DOJ noted that multiple cybersecurity firms have chronicled the group’s activities, giving them a variety of names over the years including Advanced Persistent Threat (APT) 40, BRONZE, MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, Mudcarp, Periscope, Temp.Periscope, and Temp.Jumper. The indictment lists the variety of hacking methods used to break into companies’ systems, detailing how the group used spearphishing emails, hijacked credentials, and more. “The conspiracy also used multiple and evolving sets of sophisticated malware, including both publicly available and customized malware, to obtain, expand, and maintain unauthorized access to victim computers and networks,” the indictment said. “The conspiracy’s malware included those identified by security researchers as BADFLICK, aka GreenCrash; PHOTO, aka Derusbi; MURKYTOP, aka mt.exe; and HOMEFRY, aka dp.dll. Such malware allowed for initial and continued intrusions into victim systems, lateral movement within a system, and theft of credentials, including administrator passwords.”The indictment notes that the hackers used anonymizer services, Dropbox Application Programming Interface (API) keys, and even GitHub during their attacks. All four defendants have been charged with one count of conspiracy to commit computer fraud and one count of conspiracy to commit economic espionage. Combined, the two charges carry a maximum sentence of 20 years in prison. Acting US Attorney Randy Grossman tied the indictment to the larger announcements that came out on Monday, where dozens of countries accused China of a widespread hacking campaign.  Grossman said the indictment “demonstrates how China’s government made a deliberate choice to cheat and steal instead of innovate,” while also claiming the actions threaten the US economy and national security.The FBI and CISA released an advisory designed to help organizations defend against some of the tactics deployed by the four hackers indicted. The Joint Cybersecurity Advisory has “technical details, indicators of compromise, and mitigation measures.””The charges outlined today demonstrate China’s continued, persistent computer intrusion efforts, which will not be tolerated here or abroad,” said Special Agent in Charge Suzanne Turner of the FBI’s San Diego Field Office. “We stand steadfast with our law enforcement partners in the United States and around the world and will continue to hold accountable those who commit economic espionage and theft of intellectual property.” More

A team of researchers has published details of a new way to reliably create particles that are well-suited to use in quantum communications, which could lead to the unhackable communication protocols that have long been pitched as one of the most useful applications of the technology.  Innovation The scientists generated entangled photons, a method which […] More

Despite it being “really fun”, Labor Senator Jenny McAllister has raised concerns over TikTok, including that the social media platform isn’t entirely transparent about how it approaches Australian privacy laws. “There are some specific concerns that have been raised by credible sources in recent years about TikTok. The first is that they’re not entirely transparent […] More