Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”,...

25
Malspam 09/17/2020 Report #: 202009171030

Transcript of Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”,...

Page 1: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

Malspam09/17/2020

Report #: 202009171030

Page 2: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

Agenda

TLP: WHITE, ID# 202009171030 2

• Background

• Types of Malspam

• Threat to HPH Sector

• Detection

• Mitigation Strategies

Non-Technical: Managerial, strategic and high-level (general audience)

Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT)

Slides Key:

Page 3: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

3

• Spam:

• Generally defined as “unsolicited bulk email”

• Name comes from a Monty Python comedy sketch referencing the canned meat “SPAM”

• First spam email sent on May 1st, 1978 to several hundred people on ARPANET

• The CAN_SPAM Act of 2003 attempted to address unsolicited email

• Malspam (malicious spam):

• Spam sent with malicious intent

Background

TLP: WHITE, ID# 202009171030

Image Source: Monty Python’s Flying Circus

Image Source: Hormel Foods

Page 4: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

4

• Droppers

• Phishing

• Spear Phishing

• Whaling

• Business Email Compromise

Types of Malspam

TLP: WHITE, ID# 202009171030

Page 5: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

5

• Droppers are initial malware delivered by spam messages that

install, or “drop”, additional malware such as keyloggers or

ransomware

• Malspam messages may have droppers as attachments, or may

contain links to websites hosting the droppers

• Example (Emotet):

(See https://us-cert.cisa.gov/ncas/alerts/TA18-201A)

• Emails claiming to be invoices or receipts

• Contains a malicious download link, a PDF file, or a macro-

enabled Microsoft Word document

• Once a user is infected with Emotet, it can remain persistent

across reboots and spread on the internal network

Types of Malspam – Droppers

TLP: WHITE, ID# 202009171030

https://us-cert.cisa.gov/ncas/alerts/TA18-201A
Page 6: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

6

From FTC website:(https://www.ftc.gov/news-events/media-resources/identity-theft-and-data-security/phishing-scams)

Types of Malspam – Phishing

TLP: WHITE, ID# 202009171030

Phishing is a type of online scam that targets consumers by sending them an e-mail that appears to be from a well-known source – an internet service provider, a bank, or a mortgage company, for example. It asks the consumer to provide personally identifying information. Then a scammer uses that information to open new accounts, or invade the consumer’s existing accounts.

https://www.ftc.gov/news-events/media-resources/identity-theft-and-data-security/phishing-scams
Page 7: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

7

• Spear Phishing:

Sending phishing emails to a small, targeted group of recipients

• Whaling:

Spear phishing that targets executives / upper management

Types of Malspam – Spear Phishing & Whaling

TLP: WHITE, ID# 202009171030

Page 8: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

8

• Targeted emails sent from spoofed or actually compromised organizations or individuals

• The recipient is familiar with the apparent sender

• The sender makes a seemingly legitimate request

Types of Malspam – Business Email Compromise

TLP: WHITE, ID# 202009171030

https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise

https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise
Page 9: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

9

• Healthcare recipients were the most targeted

sector for credential theft in the first half of 2020

• Ransomware attacks against healthcare

increased 350% during Q4 2019, the majority of

which were a result of phishing

Threats to HPH Sector

TLP: WHITE, ID# 202009171030

Page 10: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

10

• SMTP (Simple Mail Transfer Protocol)

• The Internet protocol used to send email

• How email is sent

• Analogy: Postal carriers and the envelopes

they carry

• IMF (Internet Message Format)

• The syntax for email messages

• The actual message which is sent

• Analogy: A letter inside of an envelope

Detection (Definitions)

TLP: WHITE, ID# 202009171030

Page 11: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

11

• DKIM (Domain Keys Identified Mail)

• Email authentication that uses a digital signature

• The sending organization can sign emails

• Receiving organizations can verify the signature

• SPF (Sender Policy Framework)

• Specifies valid SMTP servers for the sender’s domain

• DMARC (Domain-based Message Authentication, Reporting, and

Conformance)

• Extends SPF and DKIM

• Allows admins of sender domains to specify:

• Which SPF and DKIM policies to use

• How recipients can check the “From:” field in the message

• How to handle failures

• How to report actions performed under the policies

Detection (Definitions)

TLP: WHITE, ID# 202009171030

Page 12: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

SMTP Commands

IMF Body

IMF Headers

SMTP Mail Envelope

12

Detection (Example)

TLP: WHITE, ID# 202009171030

HELO mail.evil_sender.localMAIL FROM: <malory.doe@evil_sender.local>RCPT TO: <[email protected]>DATA

Received: from mail.evil_sender.local ([192.168.0.1]) by mail.victim.local; Wed, 9 Sep 2020 17:02:15

+0000Content-Transfer-Encoding: binaryFrom: "Malory Doe" <malory.doe@good_sender.local>Reply-To: <malory.doe@evil_sender.local>To: "Victor Smith" <[email protected]>Subject: Overdue Invoice Date: Wed, 9 Sep 2020 17:02:05 +0000Message-ID: erwitufgj-4875205-8D9ds@evil_sender.local

Please reply to me with your credit card number and expiration date.

QUIT

Page 13: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

IMF Body

SMTP Commands

IMF Headers

SMTP Mail Envelope

13

Detection (Example)

TLP: WHITE, ID# 202009171030

HELO mail.evil_sender.localMAIL FROM: <malory.doe@evil_sender.local>RCPT TO: <[email protected]>DATA

Received: from mail.evil_sender.local ([192.168.0.1])

by mail.victim.local; Wed, 9 Sep 2020 17:02:15 +0000Content-Transfer-Encoding: binaryFrom: "Malory Doe" <malory.doe@good_sender.local>Reply-To: <malory.doe@evil_sender.local>To: "Victor Smith" <[email protected]>Subject: Overdue Invoice Date: Wed, 9 Sep 2020 17:02:05 +0000Message-ID: erwitufgj-4875205-8D9ds@evil_sender.local

Please reply to me with your credit card number and expiration date.

QUIT

Should we accept email from evil_sender.local?

The IMF “From” address does not match the envelope sender address

The “Reply To” address looks suspicious

Is evil_sender supposed to send email for good_sender? (SPF)

Am I expecting an overdue invoice?

There is no DKIM signature

Page 14: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

14

• Keyword Filtering

• Email Blacklists

• Spam Scoring

• DKIM/SPF/DMARC

• User Education

Mitigation Strategies

TLP: WHITE, ID# 202009171030

Page 15: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

15

• Emails can be inspected for certain strings in the subject or body

• Example: Filter all emails for “parcel deliveries failure” in the subject

• Caveats:

• Attackers can easily change their email wording to evade the filters

• Attackers can use different character sets with similar-looking characters

• Be careful to not filter strings used in legitimate emails

Mitigation Strategies – Keyword Filtering

TLP: WHITE, ID# 202009171030

Page 16: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

16

• Bad sender email domains or bad sender email addresses can be used for filtering

• Blacklists can be developed internally or obtained via threat feeds

• Caveats:

• Attackers could spoof legitimate domains

• Attackers could compromise accounts at legitimate organizations

• Attackers can easily change sender accounts or domains, particularly via spoofing

Mitigation Strategies – Email Blacklists

TLP: WHITE, ID# 202009171030

Page 17: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

17

• Multiple factors are taken into account to develop a score as to the likelihood of an email being spam

• Algorithms differ by vendor and configuration

• Emails can be delivered, quarantined, or rejected based on a score threshold

Mitigation Strategies – Spam Scoring

TLP: WHITE, ID# 202009171030

Page 18: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

18

• DKIM:

Handle email differently if it is signed, not signed, or the signature does not match

• SPF:

Handle email differently if the sending mail server is not authorized for the sender domain

• DMARC:

Provides the legitimate domain of the sender granular control of authenticating email, helping to mitigate

spoofing

Mitigation Strategies – DKIM / SPF / DMARC

TLP: WHITE, ID# 202009171030

Page 19: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

19

• The recipient is the last line of defense

• Users need to get in a security mindset, and be

aware that emails can be spoofed and email

accounts can be compromised

• Organizations may implement ethical phishing

campaigns to provide a realistically simulated

phishing attack in order to educate users

Mitigation Strategies – User Education

TLP: WHITE, ID# 202009171030

Page 20: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

Reference Materials

Page 21: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

21

Background:

• https://www.wsj.com/articles/SB1210032792343692

67

• https://www.govinfo.gov/content/pkg/PLAW-

108publ187/html/PLAW-108publ187.htm

Threats to HPH Sector:

• https://healthitsecurity.com/news/ransomware-

attacks-on-healthcare-providers-rose-350-in-q4-

2019

• https://healthitsecurity.com/news/credential-theft-

via-spoofed-login-pages-increase-healthcare-top-

target

Detection (Definitions):

• https://tools.ietf.org/html/rfc5321

• https://tools.ietf.org/html/rfc5322

• https://tools.ietf.org/html/rfc6376

• https://tools.ietf.org/html/rfc7208

• https://tools.ietf.org/html/rfc7489

References

TLP: WHITE, ID# 202009171030

https://www.wsj.com/articles/SB121003279234369267
https://www.govinfo.gov/content/pkg/PLAW-108publ187/html/PLAW-108publ187.htm
https://healthitsecurity.com/news/ransomware-attacks-on-healthcare-providers-rose-350-in-q4-2019
https://healthitsecurity.com/news/credential-theft-via-spoofed-login-pages-increase-healthcare-top-target
https://tools.ietf.org/html/rfc5321
https://tools.ietf.org/html/rfc5322
https://tools.ietf.org/html/rfc6376
https://tools.ietf.org/html/rfc7208
https://tools.ietf.org/html/rfc7489
Page 22: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

? Questions

Page 23: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

23

Questions

Upcoming Briefs

• Netwalker Ransomware – 9/24

Product Evaluations

Recipients of this and other Healthcare Sector Cybersecurity Coordination Center (HC3) Threat Intelligence products are highly encouraged to provide feedback to [email protected].

Requests for Information

Need information on a specific cybersecurity topic? Send your request for information (RFI) to [email protected] or call us Monday–Friday, between 9am–5pm (EST), at (202) 691-2110.

TLP: WHITE, ID# 202009171030

mailto:[email protected]
mailto:[email protected]
Page 24: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

24

About Us

HC3 works with private and public sector partners to improve cybersecurity throughout the Healthcare and Public Health (HPH) Sector

Sector & Victim Notifications White PapersDirected communications to victims or potential victims of compromises, vulnerable equipment or PII/PHI theft and general notifications to the HPH about currently impacting threats via the HHS OIG.

Document that provides in-depth information on a cybersecurity topic to increase comprehensive situational awareness and provide risk recommendations to a wide audience.

Threat Briefings & WebinarBriefing presentation that provides actionable information on health sector cybersecurity threats and mitigations. Analysts present current cybersecurity topics, engage in discussions with participants on current threats, and highlight best practices and mitigation tactics.

Need information on a specific cybersecurity topic, or want to join our Listserv? Send your request for information (RFI) to [email protected] or call us Monday–Friday, between 9am–5pm (EST), at (202) 691-2110.

Products

TLP: WHITE, ID# 202009171030

mailto:[email protected]
Page 25: Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have

Contact

Health Sector Cybersecurity Coordination Center (HC3)

(202) 691-2110 [email protected]


Detectar y Eliminar Keyloggers en Windows

Detectar y Eliminar Keyloggers en Windows

An Introduction To Keyloggers, RATS And Malware · Copyright 2011 Rafay baloch | Page 7 Thanks for downloading this book, by downloading this book you have taken a positive ...

An Introduction To Keyloggers, RATS And Malware · Copyright 2011 Rafay baloch | Page 7 Thanks for downloading this book, by downloading this book you have taken a positive ...

mobile malware alex fortier wk14.ppt - Academics | WPIweb.cs.wpi.edu/.../student_talks/mobile_malware_alex_fortier_wk14.… · Gather data, send premium‐rate SMS messages, ... SMS

mobile malware alex fortier wk14.ppt - Academics | WPIweb.cs.wpi.edu/.../student_talks/mobile_malware_alex_fortier_wk14.… · Gather data, send premium‐rate SMS messages, ... SMS

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

What are keyloggers?

What are keyloggers?

From keyloggers to touchloggers: Take the rough with the smooth

From keyloggers to touchloggers: Take the rough with the smooth

CS526: Information securitycnitarot.github.io/courses/cs526_Spring_2015/s2014_526_malware.pdf · Spyware, keyloggers, screen scrapers ! Malware for profit: ! Dialers, scarewares,

CS526: Information securitycnitarot.github.io/courses/cs526_Spring_2015/s2014_526_malware.pdf · Spyware, keyloggers, screen scrapers ! Malware for profit: ! Dialers, scarewares,

An Introduction To Keyloggers, RATS And Malware - Websmemberfiles.freewebs.com/99/60/67186099/documents/An Introductio… · How does antivirus work? ... Trojan Horse – Trojan virus

An Introduction To Keyloggers, RATS And Malware - Websmemberfiles.freewebs.com/99/60/67186099/documents/An Introductio… · How does antivirus work? ... Trojan Horse – Trojan virus

Information Security CS 526€¦ · Spyware •Malware that collects little bits of information at a time about users without their knowledge –Keyloggers: stealthly tracking and

Information Security CS 526€¦ · Spyware •Malware that collects little bits of information at a time about users without their knowledge –Keyloggers: stealthly tracking and

What are keyloggers

What are keyloggers

Exposing the Money Behind the Malware - sophos.com · The point of nearly all malware is to make money. ... The purpose of phishing spam messages is to convince you they come from

Exposing the Money Behind the Malware - sophos.com · The point of nearly all malware is to make money. ... The purpose of phishing spam messages is to convince you they come from

Detecting Hardware Keyloggers - Hack In The Box Security ...conference.hackinthebox.org/hitbsecconf2010kul/materials/D1T1 - F… · Hardware Keylogger PS/2 USB Hardware Keyloggers

Detecting Hardware Keyloggers - Hack In The Box Security ...conference.hackinthebox.org/hitbsecconf2010kul/materials/D1T1 - F… · Hardware Keylogger PS/2 USB Hardware Keyloggers

Bearly Bytes · that itself was compromised with malware or a keyloggers. Perhaps you used your computer in an open Wifi hotspot, and the connection to your mail service was not encrypted

Bearly Bytes · that itself was compromised with malware or a keyloggers. Perhaps you used your computer in an open Wifi hotspot, and the connection to your mail service was not encrypted

240340 Eng Phishing rev0704purchasing/phishing.pdfSpyware ‘Phishing’ plus Spyware i.e ‘keyloggers’ and ‘trojans’ Use of Spyware – i.e. ‘keyloggers’ and ‘trojans’

240340 Eng Phishing rev0704purchasing/phishing.pdfSpyware ‘Phishing’ plus Spyware i.e ‘keyloggers’ and ‘trojans’ Use of Spyware – i.e. ‘keyloggers’ and ‘trojans’

Cyber crimes, denial of service attacks,virus/worm attacks,trojans and keyloggers, internet time theft

Cyber crimes, denial of service attacks,virus/worm attacks,trojans and keyloggers, internet time theft

Computers, Data Management, and Securityadware, spyware, browser helper objects, keyloggers, browser hijackers,… The Malware Explosion Malware originally was most often propagated

Computers, Data Management, and Securityadware, spyware, browser helper objects, keyloggers, browser hijackers,… The Malware Explosion Malware originally was most often propagated

A Review on The Use of Deep Learning in Android Malware ... · Provider, and Broadcast Receiver These parts carry information through messages called Intents [30]. 2. Android Malware

A Review on The Use of Deep Learning in Android Malware ... · Provider, and Broadcast Receiver These parts carry information through messages called Intents [30]. 2. Android Malware

CLOUD EMAIL SECURITY€¦ · Comprehensive Threat Insight with Talos. 600B. Daily email messages. 1.5M. Daily malware samples. 16B. Daily web requests

CLOUD EMAIL SECURITY€¦ · Comprehensive Threat Insight with Talos. 600B. Daily email messages. 1.5M. Daily malware samples. 16B. Daily web requests

Metamorphic Malware 1 Metamorphic Malware Research.

Metamorphic Malware 1 Metamorphic Malware Research.