What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-01 19:46:49 | Attaque "Stream Dirty": découvrir et atténuer un modèle de vulnérabilité commun dans les applications Android “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps (lien direct) |
## Snapshot Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application\'s home directory. The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application\'s implementation. Arbitrary code execution can provide a threat actor with full control over an application\'s behavior. Meanwhile, token theft can provide a threat actor with access to the user\'s accounts and sensitive data. We identified several vulnerable applications in the Google Play Store that represented over four billion installations. We anticipate that the vulnerability pattern could be found in other applications. We\'re sharing this research so developers and publishers can check their apps for similar issues, fix as appropriate, and prevent introducing such vulnerabilities into new apps or releases. As threats across all platforms continue to evolve, industry collaboration among security researchers, security vendors, and the broader security community is essential in improving security for all. Microsoft remains committed to working with the security community to share vulnerability discoveries and threat intelligence to protect users across platforms. After discovering this issue, we identified several vulnerable applications. As part of our responsible disclosure policy, we notified application developers through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR) and worked with them to address the issue. We would like to thank the Xiaomi, Inc. and WPS Office security teams for investigating and fixing the issue. As of February 2024, fixes have been deployed for the aforementioned apps, and users are advised to keep their device and installed applications up to date. Recognizing that more applications could be affected, we acted to increase developer awareness of the issue by collaborating with Google to publish an article on the Android Developers website, providing guidance in a high-visibility location to help developers avoid introducing this vulnerability pattern into their applications. We also wish to thank Google\'s Android Application Security Research team for their partnership in resolving this issue. In this post, we continue to raise developer and user awareness by giving a general overview of the vulnerability pattern, and then focusing on Android share targets, as they are the most prone to these types of attacks. We go through an actual code execution case study where we demonstrate impact that extends beyond the mobile device\'s scope and could even affect a local network. Finally, we provide guidance to users and application developers and illustrate the importance of collaboration to improve security for all. ## Activity Overview ### Data and file sharing on Android The Android operating system enforces isolation by assigning each application its own dedicated data and memory space. To facilitate data and file sharing, Android provides a component called a content provider, which acts as an interface for managing and exposing data to the rest of the installed applications in a secure manner. When used correctly, a content provider provides a reliable solution. However, improper implementation can introduce vulnerabilities that could enable bypassing of read/write restrictions within an application\'s home directory. The Android software development kit (SDK) includes the [FileProvider](https://developer.android.com/reference/androidx/core/content/FileProvider) class, a subclass of ContentProvider that enables file sharing between installed applications. An application that needs to share its files with other applications can declare a FileProvider in its app manifest and declare the specific paths to share. Every file provider has a property called authority, which identifies it system-wide, and can b | Tool Vulnerability Threat Studies Mobile Technical | ★★★ | |
|
2024-04-29 16:05:58 | Faits saillants hebdomadaires, 29 avril 2024 Weekly OSINT Highlights, 29 April 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a diverse range of cyber threats targeting organizations globally. The articles highlight various attack vectors, including phishing emails with malware payloads (SSLoad, [Cobalt Strike](https://security.microsoft.com/intel-profiles/fd8511c1d61e93d39411acf36a31130a6795efe186497098fe0c6f2ccfb920fc)), ransomware variants (KageNoHitobito, DoNex), and mobile banking malware (Brokewell) distributed through fake domain schemes and overlay attacks. Threat actors behind these campaigns range from financially motivated ransomware groups to sophisticated state-sponsored actors like Sandworm ([Seashell Blizzard](https://sip.security.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb)) and UAT4356 ([Storm-1849](https://sip.security.microsoft.com/intel-profiles/f3676211c9f06910f7f1f233d81347c1b837bddd93292c2e8f2eb860a27ad8d5)). Targetted organizations span Europe, Asia, and the Americas and targetted industries include critical infrastructure and IT. ## Description 1. **[Ongoing FROZEN#SHADOW Phishing Campaign](https://security.microsoft.com/intel-explorer/articles/e39d9bb3)**: The FROZEN#SHADOW campaign utilizes phishing emails to distribute SSLoad malware, alongside [Cobalt Strike](https://security.microsoft.com/intel-profiles/fd8511c1d61e93d39411acf36a31130a6795efe186497098fe0c6f2ccfb920fc) and ConnectWise ScreenConnect for extensive persistence and remote access. The victim organizations, predominantly in Europe, Asia, and the Americas, are targeted via JavaScript file downloads and MSI installers connecting to attacker-controlled domains. 2. **[Insights on KageNoHitobito and DoNex Ransomware](https://security.microsoft.com/intel-explorer/articles/ff848e92)**: KageNoHitobito and DoNex are ransomware variants with distinct encryption methods and ransom note presentations. While KageNoHitobito prompts victims to negotiate through a TOR site, DoNex terminates specific services and processes, deletes shadow copies, and may be linked to DarkRace ransomware. 3. **[Brokewell Mobile Banking Malware](https://security.microsoft.com/intel-explorer/articles/99a5deee)**: Brokewell poses a significant threat to the banking industry, utilizing overlay attacks, spyware functionalities, and remote control capabilities to steal credentials and device information. The malware\'s active development and promotion on underground channels indicate a growing interest among cybercriminals targeting different regions. 4. **[Malvertising Campaign Targeting IT Teams with MadMxShell](https://security.microsoft.com/intel-explorer/articles/ffa6ca10)**: A sophisticated threat actor distributes the MadMxShell backdoor through fake domains, using Google Ads to push them to the top of search results. MadMxShell employs complex evasion techniques, including multi-stage injection and DNS tunneling for C2 communication, indicating an interest in targeting IT professionals for unauthorized access. 5. **[ArcaneDoor Campaign by UAT4356 (Storm-1849)](https://security.microsoft.com/intel-explorer/articles/a0cf0328)**: UAT4356 (tracked by Microsoft as [Storm-1949](https://sip.security.microsoft.com/intel-profiles/f3676211c9f06910f7f1f233d81347c1b837bddd93292c2e8f2eb860a27ad8d5)) targets perimeter network devices like Cisco Adaptive Security Appliances (ASA) with backdoors "Line Runner" and "Line Dancer" for reconnaissance and malicious actions. The campaign showcases a state-sponsored actor\'s advanced tradecraft, with deliberate efforts to evade forensics and exploit 0-day vulnerabilities. The initial access vector used in this campaign remains unidentified, but two vulnerabilities ([CVE-2024-20353](https://security.microsoft.com/intel-explorer/cves/CVE-2024-20353/description) and[CVE-2024-20359](https://security.microsoft.com/intel-explorer/cves/CVE-2024-20359/description)) were exploited. 6. **[Kapeka Backdoor Linked to Sandworm (Seashell Blizzard)](https://security.microsoft.com/intel-explorer/articles/364efa92)**: Kapeka (tracked by Microsoft as K | Ransomware Malware Tool Vulnerability Threat Mobile Industrial | ★★★ | |
|
2024-04-25 18:53:33 | Les nouveaux logiciels malveillants Brokewell prennent le contrôle des appareils Android New Brokewell Malware Takes Over Android Devices (lien direct) |
## Instantané
Les analystes de menace de menace ont découvert une nouvelle famille de logiciels malveillants mobiles appelée "Brokewell" qui représente une menace importante pour le secteur bancaire.Le malware est équipé à la fois de capacités de vol de données et de télécommande, permettant aux attaquants d'accéder à une distance à distance à tous les actifs disponibles via les services bancaires mobiles.
## Description
Brokewell utilise des attaques de superposition pour capturer les informations d'identification des utilisateurs et peut voler des cookies en lançant sa propre vue Web.Le malware prend également en charge une variété de fonctionnalités "spyware", notamment la collecte d'informations sur l'appareil, l'historique des appels, la géolocalisation et l'enregistrement de l'audio.Après avoir volé les informations d'identification, les acteurs peuvent lancer une attaque de prise de contrôle de l'appareil à l'aide de capacités de télécommande, ce qui leur donne un contrôle total sur l'appareil infecté.Le malware est en développement actif, avec de nouvelles commandes ajoutées presque quotidiennement.
Les analystes ThreatFabric ont découvert une fausse page de mise à jour du navigateur conçu pour installer une application Android utilisée pour distribuer le malware.Le malware serait promu sur les canaux souterrains en tant que service de location, attirant l'intérêt d'autres cybercriminels et déclenchant de nouvelles campagnes ciblant différentes régions.
## Les références
[https://www.thereatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malwarego-farke-by-new-banking-malware)
[https://www.bleepingcomputer.com/news/security/new-brokewell-malware-takes-over-android-devices-teals-data/-Brokewell-malware-takes-over android-disvices vole-data /)
## Snapshot ThreatFabric analysts have discovered a new mobile malware family called "Brokewell" that poses a significant threat to the banking industry. The malware is equipped with both data-stealing and remote-control capabilities, allowing attackers to gain remote access to all assets available through mobile banking. ## Description Brokewell uses overlay attacks to capture user credentials and can steal cookies by launching its own WebView. The malware also supports a variety of "spyware" functionalities, including collecting information about the device, call history, geolocation, and recording audio. After stealing the credentials, the actors can initiate a Device Takeover attack using remote control capabilities, giving them full control over the infected device. The malware is in active development, with new commands added almost daily. ThreatFabric analysts discovered a fake browser update page designed to install an Android application that was used to distribute the malware. The malware is believed to be promoted on underground channels as a rental service, attracting the interest of other cybercriminals and sparking new campaigns targeting different regions. ## References [https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware](https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware) [https://www.bleepingcomputer.com/news/security/new-brokewell-malware-takes-over-android-devices-steals-data/](https://www.bleepingcomputer.com/news/security/new-brokewell-malware-takes-over-android-devices-steals-data/) |
Malware Threat Mobile | ★★ | |
|
2024-04-01 13:51:22 | Faits saillants hebdomadaires, 1er avril 2024 Weekly OSINT Highlights, 1 April 2024 (lien direct) |
Last week\'s OSINT reporting reveals an array of cyber threats marked by sophisticated attack tactics and diverse targets. From malvertising campaigns deploying stealers like Rhadamanthys to the first known attack campaign targeting AI workloads, threat actors exhibit a range of attack vectors targeting both individuals and organizations. Notably, the evolution of malware such as Vultur and StrelaStealer highlights a continual arms race between attackers and defenders, with adversaries demonstrating adaptability and persistence in their pursuit of data theft and system compromise. The targeting of specific platforms like WordPress sites and email clients underscores the threat to online ecosystems, while the widespread impact across industries emphasizes the need for robust cybersecurity measures and constant vigilance against evolving threats. 1. [Go Malvertising Campaign with Rhadamanthys Stealer](https://security.microsoft.com/intel-explorer/articles/e6d270fc): A malvertising campaign had utilized a Go language loader to deploy the Rhadamanthys stealer, targeting users through a fake PuTTY homepage ad at the top of Google search results. The loader, closely linked to the malvertising infrastructure, had retrieved the payload, Rhadamanthys, which had been executed by the parent process PuTTY.exe, indicating a coordinated attack by the same threat actor. 2. [Active Attack Campaign Exploiting Ray Framework Vulnerability](https://security.microsoft.com/intel-explorer/articles/e4cd5bc2): An ongoing active attack campaign had exploited a critical vulnerability in the Ray open-source AI framework, known as ShadowRay (CVE-2023-48022), impacting thousands of companies globally. Attackers had exploited this vulnerability to take control of computing resources, steal sensitive data, and conduct cryptocurrency mining operations, demonstrating the severity of the issue and its widespread impact across industries. 3. [Evolution of Android Banking Malware Vultur](https://security.microsoft.com/intel-explorer/articles/3f7c3599): Authors behind the Android banking malware Vultur had enhanced its capabilities, including remote interaction with victim devices and encryption of C2 communication, showcasing continual development to evade detection and carry out malicious actions with greater sophistication. 4. [Agent Tesla Phishing Email Infection Chain](https://security.microsoft.com/intel-explorer/articles/5ffaa8a4): SpiderLabs had identified a phishing email leading to an infection chain deploying Agent Tesla, utilizing obfuscation, packing techniques, and polymorphic behavior to evade detection and ensure stealthy execution, posing challenges for traditional antivirus systems. 5. [Sign1 Malware Campaign Exploiting WordPress Sites](https://security.microsoft.com/intel-explorer/articles/063f7fac): Sucuri and GoDaddy Infosec had discovered the Sign1 malware campaign infecting over 2,500 WordPress sites, injecting malicious code into custom HTML widgets to redirect visitors to scam sites, demonstrating the threat to website integrity and visitor security. 6. [StrelaStealer Email Client Targeting Malware](https://security.microsoft.com/intel-explorer/articles/82785858): StrelaStealer, a malware targeting email clients to steal login data, had launched large-scale email campaigns impacting over 100 organizations, particularly targeting high-tech industries. The malware\'s evolving infection chain and updated payloads had underscored its adaptability and the challenge it had posed to security analysts and products. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog). Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this summa | Ransomware Spam Malware Tool Vulnerability Threat Mobile Cloud | ★★ | |
|
2024-03-28 19:11:03 | Android Malware Vultur étend son envergure Android Malware Vultur Expands Its Wingspan (lien direct) |
#### Description
The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim\'s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions.
#### Reference URL(s)
1. https://research.nccgroup.com/2024/03/28/android-malware-vultur-expands-its-wingspan/
#### Publication Date
March 28, 2024
#### Author(s)
Joshua Kamp
#### Description The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim\'s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions. #### Reference URL(s) 1. https://research.nccgroup.com/2024/03/28/android-malware-vultur-expands-its-wingspan/ #### Publication Date March 28, 2024 #### Author(s) Joshua Kamp |
Malware Mobile Technical | ★★★ | |
|
2024-03-06 14:38:08 | Cryptochameleon: de nouvelles tactiques de phishing exposées dans l'attaque ciblée par la FCC CryptoChameleon: New Phishing Tactics Exhibited in FCC-Targeted Attack (lien direct) |
#### Description
Des chercheurs en sécurité de Lookout ont récemment découvert un kit de phishing sophistiqué, connu sous le nom de cryptochameleon, utilisant de nouvelles techniques pour voler des données sensibles des plateformes de crypto-monnaie et de la Federal Communications Commission (FCC).Ce kit utilise des pages de connexion unique (SSO) personnalisées et des leurres téléphoniques / SMS pour extraire les informations d'identification de connexion, les jetons multi-facteurs et les identifiants photo des victimes, principalement sur les appareils mobiles.Notamment, le kit comprend une console administrative pour surveiller les tentatives de phishing et offre des redirections personnalisées basées sur les réponses des victimes, en mettant l'accent sur l'imitation des processus AMF authentiques.Les attaques ont réussi à compromettre des centaines de victimes, principalement aux États-Unis.Alors que les tactiques ressemblent à des acteurs précédents comme [dispersée Spider alias Octo Tempest] (https://ti.defender.microsoft.com/intel-profiles/205381037ed05d275251862061dd923309ac9ecdc2a9951d7c344d890a61101a), infrastructure.
#### URL de référence (s)
1. https://www.lookout.com/Threat-intelligence/article/cryptochameleon-fcc-phishing-kit
#### Date de publication
29 février 2024
#### Auteurs)
David Richardson
Savio Lau
#### Description Security researchers from Lookout recently uncovered a sophisticated phishing kit, known as CryptoChameleon, utilizing novel techniques to steal sensitive data from cryptocurrency platforms and the Federal Communications Commission (FCC). This kit employs custom single sign-on (SSO) pages and phone/SMS lures to extract login credentials, multi-factor tokens, and photo IDs from victims, primarily on mobile devices. Notably, the kit includes an administrative console to monitor phishing attempts and offers customized redirections based on victims\' responses, with an emphasis on mimicking authentic MFA processes. Attacks have successfully compromised hundreds of victims, primarily in the United States. While tactics resemble previous actors like [Scattered Spider AKA Octo Tempest](https://ti.defender.microsoft.com/intel-profiles/205381037ed05d275251862061dd923309ac9ecdc2a9951d7c344d890a61101a), infrastructure differences suggest a distinctly different threat group. #### Reference URL(s) 1. https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit #### Publication Date February 29, 2024 #### Author(s) David Richardson Savio Lau |
Threat Mobile | ★★★ | |
|
2024-03-01 20:49:50 | Les opérateurs de logiciels espions prédateurs reconstruisent l'infrastructure à plusieurs niveaux pour cibler les appareils mobiles Predator Spyware Operators Rebuild Multi-Tier Infrastructure to Target Mobile Devices (lien direct) |
#### Description
Le groupe INSIKT de Future \\ a découvert de nouvelles infrastructures liées aux opérateurs de Predator, un logiciel spymétrique mobile mercenaire.L'infrastructure serait utilisée dans au moins onzepays, dont l'Angola, l'Arménie, le Botswana, l'Égypte, l'Indonésie, le Kazakhstan, la Mongolie, Oman, les Philippines, l'Arabie saoudite,et Trinidad et Tobago.Bien qu'il soit commercialisé pour la lutte contre le terrorisme et les forces de l'ordre, Predator est souvent utilisé contre la société civile, ciblant les journalistes, les politiciens et les militants.
L'utilisation de logiciels espions comme Predator présente des risques importants pour la confidentialité, la légalité et la sécurité physique, en particulier lorsqu'ils sont utilisés en dehors des contextes graves de criminalité et de lutte contre le terrorisme.La recherche du groupe INSIKT \\ a identifié une nouvelle infrastructure de livraison de prédateurs à plusieurs niveaux, avec des preuves de l'analyse du domaine et des données de renseignement du réseau.Malgré les divulgations publiques en septembre 2023, les opérateurs de Predator \\ ont poursuivi leurs opérations avec un minimum de changements.Predator, aux côtés de Pegasus de NSO Group \\, reste un principal fournisseur de logiciels espions mercenaires, avec des tactiques, des techniques et des procédures cohérentes au fil du temps.À mesure que le marché des logiciels espions mercenaires se développe, les risques s'étendent au-delà de la société civile à toute personne intéressée aux entités ayant accès à ces outils.Les innovations dans ce domaine sont susceptibles de conduire à des capacités de logiciels espions plus furtifs et plus complets.
#### URL de référence (s)
1. https://www.recordedfuture.com/predator-spyware-operators-rebuild-multi-tier-infrastructure-target-mobile-devices
#### Date de publication
1er mars 2024
#### Auteurs)
Groupe insikt
#### Description Recorded Future\'s Insikt Group has discovered new infrastructure related to the operators of Predator, a mercenary mobile spyware. The infrastructure is believed to be in use in at least eleven countries, including Angola, Armenia, Botswana, Egypt, Indonesia, Kazakhstan, Mongolia, Oman, the Philippines, Saudi Arabia, and Trinidad and Tobago. Despite being marketed for counterterrorism and law enforcement, Predator is often used against civil society, targeting journalists, politicians, and activists. The use of spyware like Predator poses significant risks to privacy, legality, and physical safety, especially when used outside serious crime and counterterrorism contexts. The Insikt Group\'s research identified a new multi-tiered Predator delivery infrastructure, with evidence from domain analysis and network intelligence data. Despite public disclosures in September 2023, Predator\'s operators have continued their operations with minimal changes. Predator, alongside NSO Group\'s Pegasus, remains a leading provider of mercenary spyware, with consistent tactics, techniques, and procedures over time. As the mercenary spyware market expands, the risks extend beyond civil society to anyone of interest to entities with access to these tools. Innovations in this field are likely to lead to more stealthy and comprehensive spyware capabilities. #### Reference URL(s) 1. https://www.recordedfuture.com/predator-spyware-operators-rebuild-multi-tier-infrastructure-target-mobile-devices #### Publication Date March 1, 2024 #### Author(s) Insikt Group |
Tool Mobile Technical | ★★ | |
|
2024-02-05 21:31:30 | Vajraspy: un patchwork d'applications d'espionnage VajraSpy: A Patchwork of Espionage Apps (lien direct) |
#### Description
Les chercheurs de l'ESET ont découvert une nouvelle campagne de cyber-espionnage qui utilise douze applications Android transportant Vajraspy, un cheval de Troie (rat) d'accès à distance utilisé par le groupe Patchwork Apt.
Six des applications étaient disponibles sur Google Play, et six ont été trouvés sur Virustotal.Les applications ont été annoncées comme des outils de messagerie, et on se faisait passer pour une application d'actualités.Vajraspy possède une gamme de fonctionnalités d'espionnage qui peuvent être élargies en fonction des autorisations accordées à l'application regroupée avec son code.Il vole les contacts, les fichiers, les journaux d'appels et les messages SMS, mais certaines de ses implémentations peuvent même extraire les messages WhatsApp et Signal, enregistrer des appels téléphoniques et prendre des photos avec l'appareil photo.La campagne a ciblé les utilisateurs principalement au Pakistan, et les acteurs de la menace ont probablement utilisé des escroqueries de romantisme ciblées pour attirer leurs victimes dans l'installation du malware.
#### URL de référence (s)
1. https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/
#### Date de publication
1er février 2024
#### Auteurs)
Lukas Stefanko
#### Description ESET researchers have discovered a new cyber espionage campaign that uses twelve Android apps carrying VajraSpy, a remote access trojan (RAT) used by the Patchwork APT group. Six of the apps were available on Google Play, and six were found on VirusTotal. The apps were advertised as messaging tools, and one posed as a news app. VajraSpy has a range of espionage functionalities that can be expanded based on the permissions granted to the app bundled with its code. It steals contacts, files, call logs, and SMS messages, but some of its implementations can even extract WhatsApp and Signal messages, record phone calls, and take pictures with the camera. The campaign targeted users mostly in Pakistan, and the threat actors likely used targeted honey-trap romance scams to lure their victims into installing the malware. #### Reference URL(s) 1. https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/ #### Publication Date February 1, 2024 #### Author(s) Lukas Stefanko |
Malware Tool Threat Mobile | ★★★ | |
|
2023-12-26 20:55:57 | Stealth Backdoor “Android/Xamalicious” Actively Infecting Devices (lien direct) | #### Description
L'équipe de recherche mobile McAfee a découvert une porte arrière Android nommée Android / Xamalicious qui est implémentée avec Xamarin, un cadre open source qui permet de créer des applications Android et iOS avec .NET et C #.
Le malware essaie d'obtenir des privilèges d'accessibilité avec l'ingénierie sociale, puis communique avec le serveur de commandement et de contrôle pour évaluer s'il faut télécharger ou non une charge utile de deuxième étape qui \\ est injectée dynamiquement en tant que DLL d'assemblage au niveau de l'exécution pour prendre pleinementContrôle de l'appareil et potentiellement effectuer des actions frauduleuses telles que cliquer sur les annonces, installer des applications parmi d'autres actions motivées financièrement sans consentement des utilisateurs.La charge utile de la deuxième étape peut prendre le contrôle total de l'appareil infecté en raison des puissants services d'accessibilité qui ont déjà été accordés au cours de la première étape qui contient également des fonctions pour s'auto-mettre à jour le principal APK, ce qui signifie qu'il a le potentiel d'effectuer tout type d'activitécomme un logiciel espion ou un troyen bancaire sans interaction utilisateur.Les auteurs malveillants ont également implémenté différentes techniques d'obscurcissement et cryptage personnalisé pour exfiltrer les données et communiquer avec le serveur de commande et de contrôle.
Le malware a été distribué sur environ 25 applications malveillantes différentes qui portent cette menace.Certaines variantes sont distribuées sur Google Play depuis la mi-2020.Les applications identifiées dans ce rapport ont été supprimées de manière proactive par Google de Google Play avant les rapports.Sur la base du nombre d'installations, ces applications peuvent avoir compromis au moins 327 000 appareils de Google Play plus les installations provenant de marchés tiers qui produisent continuellement de nouvelles infections en fonction de la télémétrie de détection des clients McAfee du monde entier.Le malware est motivé financièrement et entraîne la fraude publicitaire.
#### URL de référence (s)
1. https://www.mcafee.com/blogs/other-logs/mcafee-nabs/stealth-backdoor-android-xamalicious-activetive-infecting-devices/
#### Date de publication
22 décembre 2023
#### Auteurs)
McAfee Labs
#### Description The McAfee Mobile Research Team has discovered an Android backdoor named Android/Xamalicious that is implemented with Xamarin, an open-source framework that allows building Android and iOS apps with .NET and C#. The malware tries to gain accessibility privileges with social engineering and then communicates with the command-and-control server to evaluate whether or not to download a second-stage payload that\'s dynamically injected as an assembly DLL at runtime level to take full control of the device and potentially perform fraudulent actions such as clicking on ads, installing apps among other actions financially motivated without user consent. The second stage payload can take full control of the infected device due to the powerful accessibility services that were already granted during the first stage which also contains functions to self-update the main APK which means that it has the potential to perform any type of activity like a spyware or banking trojan without user interaction. The malware authors also implemented different obfuscation techniques and custom encryption to exfiltrate data and communicate with the command-and-control server. The malware has been distributed through about 25 different malicious apps that carry this threat. Some variants have been distributed on Google Play since mid-2020. The apps identified in this report were proactively removed by Google from Google Play ahead of the reporting. Based on the number of installations these apps may have compromised at least 327,000 devices from Google Play plus the installations coming from thir |
Malware Threat Mobile | ★★★ | |
|
2023-12-12 20:20:56 | Analyse d'une nouvelle macOS Trojan-Proxy Analysis of a New MacOS Trojan-Proxy (lien direct) |
#### Description
Les chercheurs de Kaspersky ont découvert un nouveau Trojan-Proxy qui se reproduit sur des logiciels fissurés pour MacOS.Les versions infectées du logiciel se présentent sous la forme d'installateurs .pkg, qui sont gérés par l'utilitaire d'installation dans MacOS et peuvent exécuter des scripts avant et après l'installation réelle.
Le Trojan crée des fichiers journaux et tente d'obtenir une adresse IP de serveur C&C via DNS-Over-HTTPS (DOH), ce qui rend la demande DNS indiscernable d'une demande HTTPS régulière et la cachant de la surveillance du trafic.Le Troie peut être utilisé pour construire un réseau de serveurs proxy ou pour effectuer des actes criminels au nom de la victime, tels que le lancement d'attaques contre des sites Web, des entreprises et des particuliers, ou l'achat de produits illicites.En plus de l'application macOS, les chercheurs de Kaspersky ont découvert plusieurs spécimens pour Android et Windows connectés au même serveur C&C.Ce sont également des projan-proxies qui se cachent à l'intérieur des logiciels fissurés.
#### URL de référence (s)
1. https://securelist.com/trojan-proxy-for-macos/111325/
#### Date de publication
6 décembre 2023
#### Auteurs)
Sergey Puzan
#### Description Kaspersky researchers have discovered a new Trojan-Proxy that is piggybacking on cracked software for macOS. he infected versions of the software come in the form of .PKG installers, which are handled by the Installer utility in macOS and can run scripts before and after actual installation. The Trojan creates log files and attempts to obtain a C&C server IP address via DNS-over-HTTPS (DoH), thus making the DNS request indistinguishable from a regular HTTPS request and hiding it from traffic monitoring. The Trojan can be used to build a proxy server network or to perform criminal acts on behalf of the victim, such as launching attacks on websites, companies, and individuals, or buying illicit goods. In addition to the macOS application, Kaspersky researchers discovered several specimens for Android and Windows that connected to the same C&C server. These are also Trojan-Proxies that hide inside cracked software. #### Reference URL(s) 1. https://securelist.com/trojan-proxy-for-macos/111325/ #### Publication Date December 6, 2023 #### Author(s) Sergey Puzan |
Mobile | ★★ | |
|
2023-11-08 21:19:17 | Arid Viper | APT\'s Nest of SpyC23 Malware Continues to Target Android Devices (lien direct) | #### Description
Le groupe Arid Viper a une longue histoire d'utilisation de logiciels malveillants mobiles, y compris au moins quatre familles spyware Android et un implant iOS de courte durée, la phénakite.La famille des logiciels malveillants Android Spyc23 existe depuis au moins 2019, bien que le code partagé entre les familles de spyware Arid Viper remonte à 2017. Il a été signalé pour la première fois en 2020 par ESET dans une campagne où l'acteur a utilisé une boutique d'applications tierces pour distribuer des armes à l'armement.Packages Android (APK).Cette campagne comportait plusieurs applications conçues pour imiter les gestionnaires de télégrammes et d'applications Android.
Jusqu'à 2022 et au début de 2023, Arid Viper a développé plusieurs nouvelles versions SPYC23 qui partagent ces thèmes: deux applications imitent Telegram, tandis qu'un autre est appelé en interne, mais est basé sur une application de messagerie sur le thème de la romance appelée Skipped Messenger.Cisco Talos a récemment rendu compte de l'histoire de Sauted Messenger, révélant que l'application de rencontres autrefois-benon a probablement été transmise du développeur d'origine à l'acteur Arid Viper.
#### URL de référence (s)
1.https://www.sentinelone.com/labs/arid-viper-apts-st-of-spyc23-malware-continues-to-target-android-devices/
#### Date de publication
6 novembre 2023
#### Auteurs)
Alex Delamotte
#### Description The Arid Viper group has a long history of using mobile malware, including at least four Android spyware families and one short-lived iOS implant, Phenakite. The SpyC23 Android malware family has existed since at least 2019, though shared code between the Arid Viper spyware families dates back to 2017. It was first reported in 2020 by ESET in a campaign where the actor used a third-party app store to distribute weaponized Android packages (APK). That campaign featured several apps designed to mimic Telegram and Android application update managers. Through 2022 and early 2023, Arid Viper developed several newer SpyC23 versions that share these themes: two apps mimick Telegram, while another is internally called APP-UPGRADE but is based on a romance-themed messaging app called Skipped Messenger. Cisco Talos recently reported on the history of Skipped Messenger, revealing that the once-benign dating application was likely passed from the original developer to the Arid Viper actor. #### Reference URL(s) 1. https://www.sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-malware-continues-to-target-android-devices/ #### Publication Date November 6, 2023 #### Author(s) Alex Delamotte |
Malware Mobile | APT-C-23 APT-C-23 | ★★★ |
1
We have: 11 articles.
We have: 11 articles.
To see everything:
Our RSS (filtrered)
