CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES July 22-29, 2021
TOP VULNERABILITY THIS WEEK: Trickbot malware starts to rebound

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Trickbot trojan re-emerges with a new module for spying
Description: After an attempted takedown attempt, security researchers are seeing increased command and control (C2) traffic around the Trickbot malware. The botnet also has a new version of its “vncDll” module, which is used for monitoring and intelligence gathering. This module appears to be actively updated with bug fixes and additional functionality. Currently, it creates a virtual desktop that mirrors the target’s desktop and steals information by monitoring the screen. Trickbot traditionally downloads new payloads to carry out additional attacks, opens the target’s documents and email and uploads data to the C2.
Reference: https://threatpost.com/trickbot-malware-virtual-desktop-espionage/167789/
Snort SIDs: 57948 - 57950

Title: Shlayer malware still using fake Flash updates
Description: Even though Adobe has discontinued support for Flash Player, attackers are still capitalizing on it. Operators behind the Shlayer malware send macOS users fake Flash Player update notifications, hoping to trick users into clicking on malicious links. The malware completes its install when the user downloads the malicious file. Shlayer is a well-known malware that’s been targeting MacOS users for at least three years. Once installed, Shlayer deploys adware on the affected machine and eventually fetches additional payloads, usually also adware.
Reference: https://www.technadu.com/flash-may-be-dead-shlayer-campaigns-still-using-it-disguise/290573/
Snort SIDs: 57919, 57920

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

The NSO Group has been selling the Pegasus spyware to governments around the globe, some of which have used Pegasus to track dissidents, journalists and more.
https://www.theguardian.com/world/2021/jul/18/revealed-leak-uncovers-global-abuse-of-cyber-surveillance-weapon-nso-group-pegasus

Security researchers released a new open-source tool called Mobile Verification Toolkit for users to check if their devices are infected with Pegasus.
https://github.com/mvt-project/mvt

The U.S. House of Representatives ended a contract with an e-newsletter service because of multiple security incidents.
https://www.zdnet.com/article/us-house-terminates-deal-with-iconstituent-after-multiple-security-incidents/

The Transportation Security Authority released a new round of cybersecurity requirements for US pipeline operators requiring them to implement specific measures to protect against ransomware attacks and other threats to their networks.
https://www.darkreading.com/attacks-breaches/tsa-issues-second-directive-for-pipeline-operators-amid-china-concerns

Only 2.3 percent of Twitter users have enabled multi-factor authentication for their accounts, a surprisingly low rate for one of the most effective ways to defend against malicious logins.
https://www.bleepingcomputer.com/news/security/twitter-reveals-surprisingly-low-two-factor-auth-2fa-adoption-rate/

Google fixed a major bug that bricked some Chrome OS devices. The company said it was only a one-character error in code that caused the issue.
https://arstechnica.com/gadgets/2021/07/google-pushed-a-one-character-typo-to-production-bricking-chrome-os-devices/

Attackers are demanding a $50 million ransom payment from Saudi Arabia’s national oil company after they stole data from a Saudi Aramco contractor.
https://apnews.com/article/technology-middle-east-business-religion-b449557e2db93e9e106cda6c085667e9

State-owned South African port, rail, and pipeline logistics company Transnet has suffered a cyberattack that has significantly disrupted its operations.
https://www.cnbc.com/2021/07/27/transnet-halts-port-operations-in-south-africa-after-major-cyberattack.html

MOST PREVALENT MALWARE FILES July 22-29, 2021
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e
MD5: 9a4b7b0849a274f6f7ac13c7577daad8
VirusTotal: https://www.virustotal.com/gui/file/c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e/details
Typical Filename: ww31.exe
Claimed Product: N/A
Detection Name: W32.GenericKD:Attribute.24ch.1201

SHA 256: 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb
MD5: 6be10a13c17391218704dc24b34cf736
VirusTotal: https://www.virustotal.com/gui/file/9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb/details
Typical Filename: smbscanlocal0906.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Ranumbot::in03.talos

SHA 256: f0a5b257f16c4ccff520365ebc143f09ccf233e642bf540b5b90a2bbdb43d5b4
MD5: 84452e3633c40030e72c9375c8a3cacb
VirusTotal: https://www.virustotal.com/gui/file/f0a5b257f16c4ccff520365ebc143f09ccf233e642bf540b5b90a2bbdb43d5b4/details
Typical Filename: sqhost.exe
Claimed Product: N/A
Detection Name: W32.Auto:f0a5b257f1.in03.Talos

SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9
MD5: 34560233e751b7e95f155b6f61e7419a
VirusTotal: https://www.virustotal.com/gui/file/8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9/details
Typical Filename: SAntivirusService.exe
Claimed Product: A n t i v i r u s S e r v i c e
Detection Name: PUA.Win.Dropper.Segurazo::tpd

SHA 256: 302f58da597128551858e8d53229340941457cad6729af0d306ebfa18a683769
MD5: 39e14b83d48ab362c9a5e03f885f5669
VirusTotal: https://www.virustotal.com/gui/file/302f58da597128551858e8d53229340941457cad6729af0d306ebfa18a683769/details
Typical Filename: SqlServerWorks.Runner.exe
Claimed Product: SqlServerWorks.Runner
Detection Name: W32.302F58DA59-95.SBX.TG