McAfee Labs Threats Report December 2018

REPORTKEY TOPICRansomware Families Decline in NumberAlthough we have seen a decline in the number of uniquefamilies during recent months, ransomware remainedactive in Q3. The decline in new families may be due tomany ransomware actors switching to a more lucrativebusiness model: cryptomining.One of the most active ransomware families in Q3was GandCrab. Due to its affiliate scheme, severalparticipants launched their campaigns when newversions were released. Many versions appeared as thedevelopers tried to stay ahead of the security industry’sresponses. The sheer volume of GandCrab samplescontributed to the increase in new ransomware in Q3.New ransomware families120100806040200Q3Q4Q1Q220182017Some of the changes we observed: Added to the Fallout exploit kit to boost infectionsUsed the CVE-2018-8440 vulnerability (a patch wasreleased in September) to boost infectionsAdded a random five-character extension toencrypt filesAdded the ability to kill processes related to Word,Excel, SQL Server, Oracle, PowerPoint, Outlook,and othersThe biggest change we noticed was the increase in sizeof the ransom payment. GandCrab Version 5 requiresthe victim to pay US 2,400 for the decryption key. Pastversions required 1,000.Q3Source: McAfee Labs, 2018.New ransomware 0Q42016Q1Q2Q32017Q4Q1Q22018Q3FollowSource: McAfee Labs, 2018.Share8McAfee Labs Threats Report, December 2018

REPORTKEY TOPICSimilarities in Version 5 with previous versions: Does not infect Russian usersContains a hardcoded list of URLs that it contacts tosend the victims’ system informationThe ransom/payment/decryption site is still on thedark web at hxxp://gandcrabmfe6mnef[.]onionUses the hardcoded key “jopochlen” to encrypt victims’information with the RC4 algorithmThe Advanced Threat Research team wrote an extensivereport on GandCrab Version 5 and its changes.Another active ransomware family in Q3 was Scarab,which released six new variants along with numerousupdates to current variants (new extension(s) addedto encrypted files, new ransomware notes, etc.).The ransomware does not appear to target a specificsector or region.New variants in Q3: ulyScarab-CyberGod—AugustUpdated in Q3: istencePrivilegeEscalationDefense EvasionCredential rtup ItemsProcess InjectionProcess InjectionHookingFile and DirectoryDiscoveryHookingScheduled TaskBypass User AccountControlInput CaptureRegistry Run Keys/Startup FolderBypass User AccountControlDisabling SecurityToolsScheduled TaskDLL Search OrderHijackingFile DeletionFigure 4. The Advanced Threat Research team mapped malware and other attacks in Q3 to the MITRE ATT&CK framework. We have removedtechniques that were not present. The darker the background, the more frequently the technique was used.FollowShare9McAfee Labs Threats Report, December 2018

REPORTKEY TOPICCryptomining Boom Times ContinueMining cryptocurrency via malware is one of the bigstories of 2018. Total “coin miner” malware has grownmore than 4,000% in the past year.New coin miner malware4,500,000Cryptominers will take advantage of any reliable scenario.Some security researchers discovered that unofficialrepositories of the open-source media player Kodi haveserved a modified add-on that delivers cryptominermalware. This operation started in 1,500,0001,000,000500,0000to fix crypto problems. The fake software executes witha single line in Bash. The users essentially infected theirown devices instead of falling victim to an unknownexploit or an exploit kit. In execution, OSX.Dummy opensa reverse shell on a malicious server, giving an attackeraccess to the compromised system.Q42016Q1Q2Q32017Q4Q1Q22018Q3Source: McAfee Labs, 2018.Security researcher Remco Verhoef discovered a Mac OSthreat later named OSX.Dummy, which was distributedon cryptomining chat groups. The exploitation is simple,requiring victims to execute a one-line command in theOSX terminal to download and execute the payload.The actor wrote messages on the Slack, Telegram, andDiscord channels suggesting users download softwareAnother campaign takes advantage of the vulnerabilityCVE-2018-14847, exploiting unpatched MikroTik routers.Security researcher Troy Mursch detected more than3,700 compromised devices serving as miners. Thecampaign primarily targeted North America and Brazil.We would not usually think of using routers or IoT devicessuch as IP cameras or videorecorders as cryptominersbecause their CPUs are not as powerful as those indesktop and laptop computers. However, due to thelack of proper security controls, cybercriminals canbenefit from volume over CPU speed. If they can controlthousands of devices that mine for a long time, they canstill make money.ExecutionPersistencePrivilege EscalationDefense EvasionDiscoveryCommand and ControlExecution throughModule LoadRegistry Run Keys/Startup FolderBypass User AccountControlBypass User AccountControlQuery RegistryData ObfuscationLocal Job SchedulingHookingHookingScheduled TaskProcess InjectionThird-Party SoftwareScheduled TaskStartup ItemsFigure 5. MITRE ATT&CK framework. The darker the background, the more frequently the technique was used.10McAfee Labs Threats Report, December 2018Coin miner malware hijackssystems to create (“mine”)cryptocurrency withoutvictims consent or awareness.New coin miner threats havejumped massively in 2018.Uncommonly Used PortFollowShare

REPORTKEY TOPICMobile Threats Fueled by Fake AppsOverall, new mobile malware declined by 24% in Q3, andMcAfee mobile security customers reported 36% fewerinfections in the quarter. In spite of the downward trend,the mobile security landscape detected some unusualthreats in Q3. New threats ranged from a fake “cheats”app for the Fortnite game that installed malware, tomobile banking Trojans and apps that served unwantedadvertisements. We observed an attack targetingmembers of the Israel Defense Forces that installedfake dating apps to infect their devices. The fake appexfiltrated data including location, contact list, listeningto phone calls, and using the camera.Global mobile malware infection rates(Percentage of mobile customers reporting Q22018Q3Source: McAfee Labs, 2018.New mobile malwareRegional mobile malware infection rates(Percentage of mobile customers reporting 32017Q4Q1Q22018Q3Source: McAfee Labs, 2018.11McAfee Labs Threats Report, December 2018AfricaQ4 2017AsiaAustraliaQ1 2018EuropeNorthAmericaQ2 2018SouthAmericaQ3 2018Source: McAfee Labs, 2018.FollowShare

REPORTKEY TOPICIn Q3 the McAfee Mobile Research team detected athreat that infected at least 5,000 devices. Android/TimpDoor spreads via phishing, using text messages totrick victims into downloading and installing a fake voicemessage app that allows cybercriminals to use infecteddevices as network proxies without users’ knowledge.If the fake application is installed, a background servicestarts a Socks proxy that redirects all network trafficfrom a third-party server via an encrypted connectionthrough a secure shell tunnel—allowing potential accessto internal networks and bypassing network securitymechanisms such as firewalls and network monitors.Devices running TimpDoor could serve as mobilebackdoors for stealthy access to corporate and homenetworks because the malicious traffic and payload areencrypted. Worse, a network of compromised devicescould also be used for more profitable purposes such assending spam and phishing emails, performing ad clickfraud, or launching distributed denial-of-service attacks.\Figure 6. The fake voice-message app Android/TimpDoor.The malicious app appears to be a legitimate voiceapplication, but the buttons and functions are fake.Figure 7. One of the most interesting characteristics of Android/Timpdoor is the capability to keep the SSH connection open.FollowShare12McAfee Labs Threats Report, December 2018

REPORTKEY TOPICThe app has an alarm to keep the connection established and constantly upload information regarding the device.Cisco’s Talos group uncovered a campaign that infected 13 iPhones with a malicious mobile device manager.The infection method is still unknown; the attackers would have required physical access or social engineeringtechniques to deploy the device managers. The infection workflow and capabilities:FollowShareFigure 8. Source: Cisco Talos Intelligence Group.13McAfee Labs Threats Report, December 2018

REPORTKEY TOPICThe attackers used BOptions sideloading techniques to inject a dynamic library and add features to installedlegitimate applications. This attack reminds us that development and framework environments are also vulnerableif they are not properly secured.Initial AccessPersistenceSpearphishing AttachmentDylib HijackingSpearphishing LinkDefense EvasionDiscoveryCollectionExfiltrationCommand and ControlAccess Token ManipulationAccount DiscoveryAudio CaptureAutomated ExfiltrationCommonly Used PortCode SigningApplication WindowDiscoveryAutomated CollectionData CompressedRemote File CopyBrowser BookmarkDiscoveryClipboard DataData EncryptedStandard Application LayerProtocolFile and DirectoryDiscoveryData from InformationRepositoriesData Transfer Size LimitsSystem Owner/UserDiscoveryData from Local SystemExfiltration OverAlternative ProtocolSystem Service DiscoveryEmail CollectionExfiltration OverCommand and ControlChannelSystem Time DiscoveryInput CaptureExfiltration Over OtherNetwork MediumScreen CaptureExfiltration Over PhysicalMediumSpearphishing via ServiceScheduled TransferFigure 9. MITRE ATT&CK framework. The darker the background, the more frequently the technique was used.Banking Trojans Turn to Uncommon File TypesBanking malware remained a constant threat during the year due to the effectiveness of campaigns and the profitsthat cybercriminals can enjoy. In Q3 we observed an increase in uncommon file types used in spam campaigns.Those attacks relied on bypassing email protection systems, which are configured to stop and analyze commonOffice, archive, scripting, and other files. This quarter, we observed IQY files (an Excel format) sent in separate wavesthat delivered different malware families to infected devices. These campaigns prompted users to click on emailswhile using conventional social engineering phrases: “photos sent,” “payment,” “please confirm.” These campaignsaccounted for around 500,000 emails sent worldwide.14McAfee Labs Threats Report, December 2018FollowShare

REPORTKEY TOPICSpam CampaignChecks if infectedsystem is in JapanPowerShell usesDDE techniqueTrojan sendsIQY fileIQY filesDownloads andexecutesUrsnif malwareIQY file queries specialURL for script file.Figure 10. The infection chain employs a combination of IQY files plus DDE, and PowerShell to deliver Ursnif or Bleboh malware.In Q3 we observed many campaigns using convincing emails, focused on their selected sectors and enticing users toclick on them.Financial institutions have added protections in recent years to protect their customers. One effective method is twofactor authentication for operations such as transferring funds to other accounts or logging into bank accounts. InQ3, the Advanced Threat Research team observed a well-known banking malware family had updated its “web injects”to include two-factor operations to attack certain financial companies.15McAfee Labs Threats Report, December 2018FollowShare

REPORTKEY TOPICFigure 11. A web inject file for the Zeus Panda malware. Source: Cofense.Zeus Panda often changes its web injects to include new techniques to bypass the latest protections applied by thefinancial sector.In Q3, some well-known malware families updated their versions with slight modifications. The banking TrojanKronos became popular in 2014, when it was discovered. This year, a new version hosted its control server on theTOR network and renamed the banking malware Osiris to sell on the underground market. Another new campaigntargeted users in Germany with malicious .doc files carrying macros that downloaded Kronos. Kronos was alsodelivered in Q3 by the RIG exploit kit, which previously dropped Zeus Panda.Banking malware has long been popular in Brazil. In Q3, McAfee detected a new family targeting the country:CamuBot attempts to camouflage itself as a security module required by the banks it targets. Compared with otherBrazilian malware families, CamuBot shares few similarities. CamuBot has taken on characteristics from non-Brazilianmalware families such as TrickBot, Ursnif, Dridex, and Qakbot. This is a major change in malware targeting Brazilians;most threats are less sophisticated compared with the banking malware affecting other continents. Organized cybergangs in Brazil are very active in targeting their own population. They have learned a lot from their Eastern Europepeers and have adapted their malware to include techniques used elsewhere.FollowShare16McAfee Labs Threats Report, December 2018

REPORTKEY TOPICExecutionPersistenceDefense EvasionCredential Access and andControlExploitation forClient ExecutionBootkitCode SigningHookingApplication WindowDiscoveryDistributedComponent ObjectModelClipboard DataData CompressedData EncodingPowerShellKernel Modules andExtensionsDCShadowInput CaptureFile and DirectoryDiscoveryPass the HashEmail CollectionExfiltration OverAlternative ProtocolUncommonly UsedPortWindowsManagementInstrumentationLocal Job SchedulingFile DeletionNetwork ServiceScanningRemote DesktopProtocolOffice ApplicationStartupModify RegistryPeripheral DeviceDiscoveryRegistry Run Keys/Startup FolderProcess InjectionProcess DiscoveryService RegistryPermissionsWeaknessScriptingQuery RegistrySoftware PackingSecurity SoftwareDiscoverySystem InformationDiscoverySystem TimeDiscoveryFigure 12. MITRE ATT&CK framework. The darker the background, the more frequently the technique was used.Exploit Kits Add Support for Vulnerabilities, RansomwareExploit kits are the delivery vehicles for many cybercrime operations. Some can remain in business, while others aretaken out by law enforcement actions. In Q3 we found two new exploit kits on the scene.Fallout: This exploit kit was discovered in August. It takes advantage of flaws in Adobe Flash Player and MicrosoftWindows. A successful infection will allow an attacker to download malware onto the victim’s computer. Thisexploit kit shares similarities with the Nuclear exploit kit. Fallout was found during an investigation at someJapanese organizations, although it targets no specific region. CVE-2018-4878 and CVE-2018-8174 are the only twovulnerabilities included in this kit, which used the latter flaw to spread GandCrab Version 5.The following chart is based on telemetry from McAfee Global Threat Intelligence. It shows the distribution of foursamples of the GandCrab Version 5 ransomware we measured in late September and early October. These sampleswere most likely spread via the Fallout exploit kit. The chart displays a typical exploit kit infection rate, with a high levelFollow 17McAfee Labs Threats Report, December 2018Share

REPORTKEY TOPICof hits at the beginning and a rapid decrease over a short time. This is a common business model for exploit kits; acustomer pays either by installations or for a fixed time. The September 28 increase was probably due to the releaseof another round of samples by affiliates.McAfee GTI reports of GandCrab ransomware version 5 over 10 b129ce07fadb006486953439ce0092651fd7a624-Sep 25-Sep 26-Sep 27-Sep 28-Sep 29-Sep 30-Sep 01-Oct 02-Oct 03-OctUnderminer: This exploit kit was discovered in July. It protects its own code and control server traffic with RSAencryption and takes advantage of flaws in Microsoft Internet Explorer and Flash Player to infect users with arange of malware, including cryptominers and boot kits. The exploit kit targets users in the Asia-Pacific region.Two vulnerabilities were added to this kit in Q3: CVE-2018-4878 (Adobe Flash Player 28.0.0.137 Use-after-freeRemote Code Execution) and CVE-2018-8174 (Windows VBScript Engine Remote Code Execution Vulnerability;for more, see the next section).Initial AccessExecutionPrivilege EscalationDefense EvasionDrive-By CompromiseExploitation for Client ExecutionExploitation for PrivilegeEscalationBypass User Account ControlExploit Public-Facing ApplicationScriptingExploitation for Defense EvasionFigure 13. MITRE ATT&CK framework. The darker the background, the more frequently the technique was used.18McAfee Labs Threats Report, December 2018FollowShare

REPORTKEY TOPICVulnerabilities Open Door to Shellcode, Privilege EscalationIn Q3 three vulnerabilities stood out for their use of new malware families or campaigns.Windows VBScript Engine Remote Code Execution Vulnerability (CVE-2018-8174). This flaw was patched in Maybut was exploited in Q3 by “Operation Personality Disorder.” The attackers used malicious RTF documents containingVBScript to exploit a flaw in Internet Explorer and launch shellcode. The code dropped a backdoor payload and gavecontrol of the infected systems. The campaign was carried out by the Cobalt Gang, whose alleged leader was arrestedin Spain this year.This vulnerability was added in Q3 to two new exploit kits, Fallout and Underminer. The flaw was also used to infectusers with GandCrab Version 5 via Fallout. The threat actors behind the malvertising campaign used legitimateadvertising sites to redirect victims to a landing page containing the exploit kit. The landing page contained Base64encoded VBScript code that is decoded by a JavaScript function. The decoded code executes shellcode by exploitingthe defect in the VBScript engine. The shellcode then downloads the payload, which loads GandCrab into memory onthe infected system.Windows ALPC Elevation of Privilege Vulnerability (CVE-2018-8440). This was patched in September. The zero-dayflaw made headlines after the security researcher who found the defect posted proof-of-concept details to Twitter andGitHub in late August—causing Microsoft to include a patch in the September updates. The flaw allowed anyone withlocal access rights to gain system privileges. The vulnerability was used to infect users with GandCrab by exploiting aprivilege escalation flaw in Windows, allowing the ransomware to gain elevated privileges

conferences in Las Vegas, Sydney, Tokyo, and Rome. During this quarter, we have stayed busy analyzing threats, welcoming new researchers to the team, and especially publishing our findings. You can read our results on our blogs page and our team's page. We hope you enjoy the new format and we look forward to your reactions.