Infrastructure Behind BadRabbit Ransomware Since 2016 Active

The infrastructure used last Tuesday to spread the BadRabbit ransomware has been active since 2016, says Dutch security researcher Yonathan Klijnsma from security company RiskIQ. During the attack the attackers used a large number of hacked websites.

These websites showed a popup to visitors that they needed to install an update for Adobe Flash Player. In fact, it was a Petya ransomware variant that encrypted files on the hard drive and overwritten the Master Boot Record from the hard drive. As a result, the operating system can no longer be started. Furthermore, BadRabbit tries to spread on SMB via a list of commonly used passwords and intercepting login credentials via SMB.

On the hacked websites, code was sent to an injection server that showed the malicious popup on the websites. One of these injection servers was first observed last September. In addition, various hacked websites have been compromised since last year. RiskIQ counted 63 hacked websites where the attackers had access. The security company claims, however, that it can go for more websites.

"The group behind the BadRabbit ransomware has been active for quite some time," said Klijnsma. The researcher speaks of a long-term campaign that could possibly be set up for something other than BadRabbit. "Although the BadRabbit ransomware is brand new, we can track the distribution industry by the beginning of 2016, which shows that victims had been compromised a lot before before the ransomware hit and the news cycle began. The campaign could originally be set up for something other than BadRabbit. " Security company Symantec claims that 86 percent of the infections occurred in Russia and it mainly concerns companies.

Ukraine And Russia Hit By Bad Rabbit Ransomware

Organizations in Ukraine and Russia have been hit by a new ransomware copy called Bad Rabbit, which would be a Petya ransomware variant that spread this summer, reports anti-virus company ESET. The malware would have infected hundreds of systems.

Among the victims are the Kiev metro, the Odessa airport and the Ukrainian ministries, according to the virus fighter. Anti-virus company Kaspersky Lab announces that most victims are in Russia. For example, the Russian press agency Interfax has been hit by the ransomware. The press office reports that the news services are not available because of the attack. "Based on our research, it is a targeted attack on corporate networks through methods similar to the ExPetr attack," said Kaspersky researcher Alex Perekalin. ExPetr is one of the names given to the Petya variant of this summer.

According to Kaspersky Lab, Bad Rabbit ransomware is spread through a number of hacked Russian media websites. ESET researcher Lukas Stefanko , Proofpoint researcher Darien Huss and the known anti-virus veteran Vesselin Vladimirov Bontchev warn that ransomware is on websites as an update for Flash Player . As soon as a user downloads and opens this so-called update, the Bad Rabbit ransomware will be activated on the system. Bad Rabbit tries to spread on the network. To do this, a list of common passwords is used, and Bad Rabbit tries to steal login data through the Mimikatz tool.

Bad Rabbit encrypts files and, like Petya, overwrites the Master Boot Record (MBR) of the hard drive. Therefore, the system becomes unusable. The ransomware claims victims 240 euros for decrypting the files. Whether victims pay the ransom to recover their files is still unknown. Organizations are advised to block executing files c: \ windows \ infpub.dat and c: \ windows \ cscc.dat and, if possible, disable Windows WMI service so that ransomware can not spread further .

Initially, ESET researcher Stefanko reported that the EternalBlue operation was also used. This does not appear to be the case at all. The article has been modified.

The attackers knew to hack several media and news sites. Then there was a malicious code that offered the so-called Flash Player update. Most infections have been observed in Russia, followed by Ukraine, Bulgaria and Turkey. According to ESET, all major companies are affected at the same time. "It is possible that the attackers already had access to the network and launched the attack through the websites at the same time as distraction," said Marc-Etienne M.Léveillé of ESET. He notes that there are no indications that employees of affected organizations have been stepped into the so-called Flash Player update. Anti malware company Malwarebytes announces that the attackers behind Bad Rabbit are likely to be responsible for the Petya / NotPetya variant of last June.

In the meantime, several technical analyzes of Bad Rabbit have appeared online. :

- Bitdefender

- Cisco

- ESET

- Kaspersky Lab

- Malwarebytes

- McAfee

- Qualys

According to Costin Raiu of Kaspersky Lab, the attackers behind Bad Rabbit would have been working on setting up the network of hacked websites since July. The attackers had access to, inter alia, Russian, Turkish, German and Bulgarian websites.

Infected Version TrueCrypt Used For Cyber Spying

A Russian website has years of an infected version of the popular encryption program TrueCrypt offered, which in reality turned out to be a Trojan horse that has been used for cyber-espionage. That leaves the Slovak anti-virus company ESET in a report published today ( pdf ) know.

The website was a truecryptrussia.ru offered in Russian translated version of TrueCrypt. Visitors who met but were offered an infected version specific criteria. What criteria were precisely known. Once installed on the system was also installed a backdoor that allows the attackers had full control over the computer. At least since June 2012 was offered via truecryptrussia.ru malware.

As a select number of victims were attacked in this way, could also backed by long time undetected, according to ESET. The TrueCrypt website also served as Command & Control domain. Communication between the attackers and infected computers ran through the website. Researchers also think the site was managed by the attackers and that it is not a hacked website.

Apart from the TrueCrypt website spread the malware, called Potao, also via e-mail attachments and USB sticks. This was done on a simple but effective way. The malware placed himself on the USB stick and made all other files invisible. In addition, the malware got the name of the USB stick and a disk icon. Users would have thought that it was a disk or shortcut while they opened the malware in reality.

Most targets of the malware were located in the Ukraine. It was among other things the Ukrainian government, the Ukrainian army and a major Ukrainian news agency. Members of the Russian and Ukrainian popular pyramid games were spied by the malware. So were victims of infectious TrueCrypt version mainly in Russia.

SHA1 hashes: Early Potao versions: 

8839D3E213717B88A06FFC48827929891A10059E

5C52996D9F68BA6FD0DA4982F238EC1D279A7F9D 

CE7F96B400ED51F7FAB465DEA26147984F2627BD 

D88C7C1E465BEA7BF7377C08FBA3AAF77CBF485F 

81EFB422ED2631C739CC690D0A9A5EAA07897531 

18DDCD41DCCFBBD904347EA75BC9413FF6DC8786 

E400E1DD983FD94E29345AABC77FADEB3F43C219 

EB86615F539E35A8D3E4838949382D09743502BF 

52E59CD4C864FBFC9902A144ED5E68C9DED45DEB 

642BE4B2A87B47E77814744D154094392E413AB1 

Debug versions: 

BA35EDC3143AD021BB2490A3EB7B50C06F2EA40B 

9D584DE2CCE6B654E62573938C2C824D7CC7D0EB 

73A4A6864EF68C810C7C699ED51B759CF1C4ADFB 

1B3437C06CF917920688B25DA0345749AA1A4A46 

Droppers with decoy documents: 

FBB399568E0A3B2E461A4EB3268ABDF07F3D5764 

4D5E0808A03A75BFE8202E3A6D2920EDDBFC7774 

BCC5A0CE0BCDFEA2FD1D64B5529EAC7309488273 

F8BCDAD02DA2E0223F45F15DA4FBAB053E73CF6E 

2CDD6AABB71FDB244BAA313EBBA13F06BCAD2612 

9BE3800B49E84E0C014852977557F21BCDE2A775 

4AC999A1C54AE6F54803023DC0FCF126CB77C854 

59C07E5D69181E6C3AFA7593E26D33383722D6C5 

E15834263F2A6CCAE07D106A71B99FE80A5F744B 

A62E69EF1E4F4D48E2920572B9176AEDB0EEB1C6 

900AD432B4CB2F2790FFEB0590B0A8348D9E60EB 

856802E0BD4A774CFFFE5134D249508D89DCDA58 

A655020D606CA180E056A5B2C2F72F94E985E9DB 

04DE076ACF5394375B8886868448F63F7E1B4DB9 31 

Droppers from postal websites:

94BBF39FFF09B3A62A583C7D45A00B2492102DD7 

F347DA9AAD52B717641AD3DD96925AB634CEB572 

A4D685FCA8AFE9885DB75282516006F5BC56C098 

CC9BDBE37CBAF0CC634076950FD32D9A377DE650 

B0413EA5C5951C57EA7201DB8BB1D8C5EF42AA1E 

0AE4E6E6FA1B1F8161A74525D4CB5A1808ABFAF4 

EC0563CDE3FFAFF424B97D7EB692847132344127 

639560488A75A9E3D35E4C0D9C4934295072DD89 

USB-spreaders:

850C9F3B14F895AAA97A85AE147F07C9770FB4C7 

BB0500A24853E404AD6CA708813F926B90B38468 

71A5DA3CCB4347FE785C6BFFF7B741AF80B76091 

7664C490160858EC8CFC8203F88D354AEA1CFE43 

92A459E759320447E1FA7B0E48328AB2C20B2C64 

BB7A089BAE3A4AF44FB9B053BB703239E03C036E 

DB966220463DB87C2C51C19303B3A20F4577D632 

37A3E77BFA6CA1AFBD0AF7661655815FB1D3DA83 

181E9BCA23484156CAE005F421629DA56B5CC6B5 

A96B3D31888D267D7488417AFE68671EB4F568BD 

224A07F002E8DFB3F2B615B3FA71166CF1A61B6D 

5D4724FBA02965916A15A50A6937CDB6AB609FDD 

8BE74605D90ED762310241828340900D4B502358 

5BE1AC1515DA2397A7C52A8B1DF384DD938FA714 

56F6AC6197CE9CC774F72DF948B414EED576B6C3 

F6F290A95D68373DA813782EF4723E39524D048B 

48904399F7726B9ADF7F28C07B0599717F741B8B 

791ECF11C04470E9EA881549AEBD1DDED3E4A5CA 

E2B2B2C8FB1996F3A4A4E3CEE09028437A5284AE 

5B30ECFD47988A77556FE6C0C0B950510052C91E 

4EE82934F24E348696F1C813C24797618286A70C 

B80A90B39FBA705F86676C5CC3E0DECA225D57FF 

971A69547C5BC9B711A3BB6F6F2C5E3A46BF7B29 

C1D8BE765ADCF76E5CCB2CF094191C0FEC4BF085 

2531F40A1D9E50793D04D245FD6185AAEBCC54F4

32 Other droppers:

D8837002A04F4C93CC3B857F6A42CED6C9F3B882 

BA5AD566A28D7712E0A64899D4675C06139F3FF0 

FF6F6DCBEDC24D22541013D2273C63B5F0F19FE9 

76DA7B4ABC9B711AB1EF87B97C61DD895E508232 

855CA024AFBA0DC09D336A0896318D5CC47F03A6 

12240271E928979AB2347C29B5599D6AC7CD6B8E 

A9CB079EF49CEE35BF68AC80534CBFB5FA443780 

1B278A1A5E109F32B526660087AEA99FB8D89403 

4332A5AD314616D9319C248D41C7D1A709124DB2 

5BEA9423DB6D0500920578C12CB127CBAFDD125E 

Plugins: 

2341139A0BC4BB80F5EFCE63A97AA9B5E818E79D 

8BD2C45DE1BA7A7FD27E43ABD35AE30E0D5E03BC 

54FEDCDB0D0F47453DD65373378D037844E813D0 

CC3ECFB822D09CBB37916D7087EB032C1EE81AEE 

F1C9BC7B1D3FD3D9D96ECDE3A46DFC3C33BBCD2B 

9654B6EA49B7FEC4F92683863D10C045764CCA86 

526C3263F63F9470D08C6BA23E68F030E76CAAF3 

E6D2EF05CEDCD4ABF1D8E3BCAF48B768EAC598D7 

CEBAB498E6FB1A324C84BA267A7BF5D9DF1CF264 

324B65C4291696D5C6C29B299C2849261F816A08 

C96C29252E24B3EEC5A21C29F7D9D30198F89232 

CDDDE7D44EFE12B7252EA300362CF5898BDC5013 

84A70CDC24B68207F015D6308FE5AD13DDABB771 

Fake TrueCrypt setup: 

82F48D7787BDE5B7DEC046CBEF99963EEEB821A7 

9666AF44FAFC37E074B79455D347C2801218D9EA 

C02878A69EFDE20F049BC380DAE10133C32E9CC9 

7FBABEA446206991945FB4586AEE93B61AF1B341 

Fake TrueCrypt extracted exe: 

DCBD43CFE2F490A569E1C3DD6BCA6546074FD2A1 

422B350371B3666A0BD0D56AEAAD5DEC6BD7C0D0 

88D703ADDB26ACB7FBE35EC04D7B1AA6DE982241 

86E3276B03F9B92B47D441BCFBB913C6C4263BFE

British Spies Transferred Because Snowden Documents

The British government has spies transferred after their method through documents whistleblower Edward Snowden in Russia and China has become known. That report the BBC and Sunday Times today.According to sources, Moscow and Beijing managed to decrypt the encrypted documents Snowden.

Therefore, the method of British spies would now be known and that has led to Britain's "vital information" no longer able to collect, an anonymous government source told the BBC. In addition to Britain were also other Western intelligence personnel have been transferred after Moscow had managed to crack more than a million confidential files Snowden. The whistleblower spent some time in Hong Kong before he eventually received asylum in Russia.

He has always said that nobody has gotten his hands on files, but the Sunday Times says it has learned that Russia and China do have the information by government officials and intelligence agencies. However, there would be no British spies because something happened to them. However, the British government will not comment on the matter, reports the Guardian .

Edward Snowden would like to return to the US

Whistleblower Edward Snowden would return to the United States wants when he gets a fair trial. That his Russian lawyer Anatoly Kucherena leave during a news conference today know as reports AFP. Snowden has since the summer of 2013 political asylum in Russia.

"With a group of lawyers from other countries, we are concerned with the question of his return to America," said Kucherena."Snowden is ready to return to the United States, provided that he gets a fair trial." According to the lawyer Snowden could so far only received the guarantee that he will not get the death penalty. Kucherena also reported that the whistleblower with his Russian residence permit may travel abroad. "But I suspect that if he left Russia, he will be taken to the US Embassy."

Edward Snowden Does Not Use iPhone Because Of Spyware

Edward Snowden used because there is no iPhone spyware would sit in, so has the whistleblower of the lawyer to the Russian news agency RIA Novosti announced. "Edward never used an iPhone, he has a simple phone. The iPhone has special software that can run itself without the owner having to do anything, and may collect information about him. Because security is why he refuses this phone," said Anatoly Kucherena.

The lawyer further added that the decision to use or not iPhone is a personal choice, but Snowden looked at it from a security standpoint. Additionally Kucherena noted that the whistleblower is satisfied with his life in Russia. Snowden has lived since August 1, 2013 in Russia. It is not the first time he warns of the risk of mobile phones. Last year showed Snowden still know that the NSA switched phones can remotely switch on and listen.

For copyright infringement Mail.ru blocked in Italy

Mail.ru and 23 internet hosting infringe copyright bootlegging film production.

Rome prosecutor's office has closed access to the Russian Internet site Mail.ru throughout Italy.According to the newspaper Corriere della Sera, citing a statement the prosecutor's office, the Russian Internet portal is accused of violating copyright law.

Investigation initiated Film Company Eyemoon Pictures.Her representatives said that Mail.ru and 23 internet hosting infringe copyright bootlegging film production.

According Eyemoon Pictures, on the Russian Internet portal Mail.ru illegally providing links to two cartoon studios Fruivtale Station and The Congress, which came on the screen back in 2013.After receiving complaints from Eyemoon Pictures prosecutors Rome start "Operation Eyemoon».An investigation was confirmed copyright infringement online resource Mail.ru and other portals.

Prosecutor's Office of Rome made ​​the "black" list of 24 Internet resource.Besides the Russian Mail.ru resource sharing in list got Kim Dotcom Mega, as well as popular torrent trackers.

At the moment in time in Mail.ru search engine you can find links to cartoons companies Fruivtale Station and The Congress.However, the site now provides only a textual description of the above video.

Hackers attacked government computer in the U.S. and E.U, said the attack came from Russia

Hundreds of government computers in Europe and the USA in silence infected sophisticated malicious applications. According to Reuters, it is one of the most comprehensive programs for cyber espionage, which has so far been discovered. Some security analysts and Western intelligence agencies have concluded that this so-called spyware, known as Turla is the work of the Russian government, and that is related to software used for massive hacking U.S. military, which was unveiled in 2008.

Hackers using Spyware Turla building in the contested networks "focal points", thanks to which the computer searches for data, save your information and, where necessary data to send to their servers. 

"It's sophisticated malware, which is associated with another Russian malicious program. It uses encryption and targeting Western governments.Shows traces of Russian work, "said Jim Lewis, who previously worked in the diplomatic service for the U.S. State Department, and now works at the Center for Strategic and International Studies in Washington.

They watch them in years

Security experts warn that can not be proven truly Russian origin.

Experts from established security companies monitor turly several years. Symantec estimates that malware Turla with relatives Trojan Horse to infect Agent.BTZ thousand networks. Symantec has not communicated the names of the victims, said only that it is mostly a government computer.

Anti-virus firm F-Secure with truly met for the first time last year, when examined contested organization. "Although it looks like the Russians, there is no way to determine with certainty," said Mikko Hypponen of F-Secure. Nor did he mention the names affected.

Reuters addressed this matter in several European governments, many of them, but the malware Turla refused to comment. Government sources from the Czech Republic, Estonia, Poland and Romania, however, indicated that this malicious program were not affected immediately.

The threat of a snake

On the question of public threats in connection with this program came this week when the less well known German company G Data Antivirus published a report on the virus identified as Uroburos.

The name is derived from part of the program code and the ancient symbol that shows a snake or dragon devouring its own tail.

British company BAE Systems Applied Intelligence, formerly known as Detica, which is a cybernetic arm of a prominent British defense contractor, has issued its own report on this malware, which it describes as "a snake". The sheer sophistication of the software goes much further than what we have encountered so far, says a British document without mentioning one's responsibility for the attack.

Detail from BAE System Report is available: Here

Více na: http://e-svet.e15.cz/internet/hackeri-napadli-vladni-pocitace-v-usa-i-eu-utok-pry-prisel-z-ruska-1067660#utm_medium=selfpromo&utm_source=e15&utm_campaign=copylinkVíce na: http://e-svet.e15.cz/internet/hackeri-napadli-vladni-pocitace-v-usa-i-eu-utok-pry-prisel-z-ruska-1067660#utm_medium=selfpromo&utm_source=e15&utm_campaign=copylink

G Data found Russian cyber weapon - rootkit Uroburos

Because of its complexity, Uroburos impossible to detect or destroy conventional methods 

Ouroboros - a classic antique symbol of the serpent devouring its own continuously tail. Like taking off her example, «Uroburos» - a new kind of malware which tends to absorb the network - in this case, perhaps as part of a spyware plan.

According to experts, the rootkit that steals confidential information used by hackers since 2011.

The specialists of the German company G Data found a new malicious program designed to steal confidential information. According to the data of professionals engaged in the development of malware Russian special services. Rootkit Uroburos got its name from a mythical dragon, as well as the sequence of characters within the code of the malware: Ur0bUr () sGotyOu #.

Uroburos steals files from infected computers and intercepts network traffic. A malicious program designed to work in P2P mode to establish communication between the infected systems. This feature allows you to remotely access the same computer with an Internet connection in order to control other PCs on a LAN.

It is interesting that in order to hide their activities rootkit uses two virtual file system - NTFS and FAT, which locally are on the infected machine. These file systems could allow attackers to be stored on the victim's PC party tools, tools for post-operation, temporary files, and binary output. Access to virtual file system can be accessed through the device: Device \ RawDisk1 and Device \ RawDisk2, as well as CDs \ \. \ Hd1 and \ \. \ Hd2.

G Data experts say: "The creation of such structures as Uroburos requires huge investments. The development team of this malware, obviously consists of highly qualified IT-specialists. Such a conclusion can be drawn by analyzing the structure and modern design of the rootkit. We believe that the developers are also improved versions Uroburos, which will appear in the future. "

Finding certain specifications (file name, encryption keys, behavior, etc.), representatives of the G Data suggested that a group of authors Uroburos intruders, which in 2008 carried out an attack on the computer systems of the U.S. with the help of malware Agent.BTZ.

Experts say that before installing the system on its victims Uroburos checks for the presence of Agent.BTZ. If present, the new rootkit remains inactive. Evidence that the creation of Russian Uroburos can stand is that in the code of the malware is present Cyrillic.

Recall that after the attack on the system Agent.BTZ United States banned the use of American military USB-drives and other removable media. While it was assumed that infection of the Ministry of Defence was through USB-drive.

According to statements made by G Data, the authors aim Uroburos are large enterprises, the state intelligence agencies and other organizations. Presumably, the rootkit has been used for three years, as the most long-standing version of the program were written in 2011.

Technical details SHA256: BF1CFC65B78F5222D35DC3BD2F0A87C9798BCE5A48348649DD271CE395656341 MD5: 320F4E6EE421C1616BD058E73CFEA282 Filesize: 210944

Detail from G Data Report is available: Here