company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Bulk IP/Domain Lookup

Threatspy

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Cloud

Outage

loading..
loading..
loading..

Cloudflare R2 Crash Disables Services for 59 Minutes Causing 13.6% Log Loss

Cloudflare R2 crash causes a 59-minute outage, affecting services and leading to up to 13.6% log loss, with swift recovery and key system improvements.

07-Feb-2025
5 min read

No content available.

Related Articles

loading..

SDK

OCR

SparkCat

SparkCat malware steals cryptocurrency wallet recovery phrases, infecting 242K+ ...

A sophisticated malware campaign known as "SparkCat" has recently been uncovered, targeting Android and iOS apps on [Google Play](https://www.secureblink.com/cyber-security-news/11-m-android-devices-infected-with-necro-malware-via-google-play) and the [Apple App](https://www.secureblink.com/cyber-security-news/apple-app-developers-targeted-with-trojanized-xcode-projects-by-hackers) Store. The malicious software development kit (SDK) embedded within these applications is designed to steal cryptocurrency wallet recovery phrases, a move that could lead to devastating losses for unsuspecting users. With the rapid increase in cryptocurrency adoption, this alarming malware campaign highlights the need for heightened vigilance in app security and the safe handling of sensitive data. ### **Rise of SparkCat Malware** The "SparkCat" campaign derives its name from a key component of the malware known as "Spark," which is part of the malicious SDK. The developers of the infected apps are likely unaware of the presence of the malware, making it harder to spot the threat until it’s too late. Kaspersky, a global cybersecurity firm, discovered that the infected apps on Google Play alone were downloaded over 242,000 times, indicating the massive reach and impact of the attack. This malicious SDK operates by leveraging optical character recognition (OCR) technology to extract sensitive information from images stored on a user’s device. Specifically, the malware targets cryptocurrency wallet recovery phrases, which are used to restore access to wallets and their associated funds. If successful, attackers can use these recovery phrases to steal cryptocurrency from compromised wallets. ### **How SparkCat Malware Works** SparkCat malware uses the Google ML Kit OCR tool to extract text from images on the device. Depending on the system language, it loads different OCR models to detect text in various scripts, such as Latin, Korean, Chinese, and Japanese characters. Once activated, the SDK begins searching for images containing sensitive recovery phrases by looking for keywords in multiple languages. These keywords vary depending on the region, with separate keyword sets for regions such as Europe and Asia, to improve the efficiency of the malware in detecting relevant images. When the malware locates a matching image, it sends the information to a remote command server, which in turn sends back instructions to regulate the further operation of the malware. The true danger of this malware lies in its ability to identify wallet recovery phrases stored in screenshots or other image files. Many cryptocurrency users, often with limited security knowledge, make the mistake of storing their recovery phrases in digital formats such as screenshots or photos. The SparkCat malware is specifically designed to target these unprotected images and steal valuable information without alerting the user. ### **Infected Apps from SparkCat Malware** Kaspersky [identified](https://securelist.ru/sparkcat-stealer-in-app-store-and-google-play/111638/) a total of 18 infected Android apps and 10 iOS apps as part of the SparkCat campaign. While some of these apps are no longer available on their respective app stores, many are still active, posing a risk to users who have not yet detected the infection. Among the infected apps, the Android ChatAi app was particularly notable, with over 50,000 installs before it was removed from Google Play. Although no definitive list of affected apps is available, users should remain cautious when installing new applications from lesser-known developers. ### **Recommendations for Protecting Your Cryptocurrency Wallet** If you suspect that your device may be compromised, there are immediate steps you can take to safeguard your cryptocurrency and personal information. The first and most important action is to uninstall any suspicious apps from your device, especially those related to the SparkCat campaign. Next, it’s critical to run a mobile antivirus scan to check for any remaining traces of the malware. For a more thorough approach, consider performing a factory reset on your device. While this will erase all data from your phone, it will also remove any lingering malware, offering you a clean slate. Beyond immediate actions, there are long-term security practices every cryptocurrency user should adopt to protect their sensitive recovery phrases. It’s essential to never store recovery phrases in digital images or screenshots. Instead, use physical offline storage options, such as paper backups, hardware wallets, or encrypted removable storage devices, to secure your recovery phrases. Alternatively, you can store them in password managers with strong encryption that are offline or self-hosted. ### **App Vetting and Mobile Security** The rise of SparkCat malware also underscores the critical importance of app vetting and security hygiene. Despite the Google Play Store and Apple App Store’s efforts to screen apps for malicious behavior, sophisticated SDKs like SparkCat can slip past these defenses. Users should exercise caution when installing apps, particularly those that request unnecessary permissions or come from unverified developers. A careful review of app permissions, along with reading user reviews and researching the developer's background, can help mitigate the risk of falling victim to such malware campaigns.

loading..   06-Feb-2025
loading..   5 min read
loading..

DAGGERFLY

SSH

Chinese hacking group Evasive Panda uses ELF/Sshdin,jector.A!tr malware to hijac...

In a recent surge of cyber-espionage activities, the Chinese hacking group Evasive Panda, also known as DaggerFly, has unleashed a sophisticated malware attack targeting network appliances. The attack, which began in mid-November 2024, leverages a newly discovered attack suite called **ELF/Sshdin.jector.A!tr**, injecting malicious code into the SSH daemon for **persistent access** and **covert operations**. This highly organized breach has sparked significant concerns in the cybersecurity landscape, as it enables the hackers to remain undetected and gain full control over compromised systems. #### **What is ELF/Sshdin.jector.A!tr?** The **ELF/Sshdinjector.A!tr** is a malware component injected directly into the SSH daemon, which is a core process on network appliances that allows secure remote communication. Once installed, it enables attackers to perform an array of covert operations, including **system reconnaissance**, **data exfiltration**, **credential theft**, and remote control of the device. Researchers at **Fortinet's FortiGuard Labs** have disclosed that this malware suite is highly evasive and designed to operate **without detection**, even if the device is actively monitored. The malware acts as a **backdoor**, allowing hackers to execute malicious commands and extract critical data from compromised machines over extended periods. #### **Attack Sequence** The infiltration begins when the attackers deploy a dropper onto the device. This dropper checks if the device is **already infected** and confirms if it is operating with **root privileges**. If the conditions are met, several malicious binaries are dropped onto the target device. Among these, the **SSH library (_li.bs.sdh.so_)** becomes the key backdoor component that facilitates **Command and Control (C2) communications** and **data exfiltration**. ##### **Malicious Binaries Involved:** 1. **lib.s.sdh.so** - Main backdoor for C2 communication. 2. **mainpasteheader** and **selfrecoverheader** - These help in maintaining persistence, ensuring that the malware remains active, even after a reboot or system recovery. #### **Key Malware Functions** Once installed, _ELF/Sshdi.njector.A!tr_ provides a comprehensive toolkit for the attackers, supporting a range of **remote and covert activities**. The malware is capable of executing up to **fifteen distinct commands**, designed to infiltrate deeper into the compromised system and secure sensitive information. Below are the key actions this malware can perform: 1. **System Information Collection:** - Gathers crucial system details like **hostname**, **MAC address**, and other identifying information. - The collected data is then **exfiltrated** to the attacker, which can be used for further exploitation or to identify potential targets. 2. **Service Enumeration:** - Identifies installed services by accessing system files in **_/etc/i.nit.d_**. This information helps attackers understand the vulnerabilities and service configurations present on the system. 3. **Credential Theft:** - The malware can **read sensitive user data** from critical files like **/etc/sha.dow**, which contains hashed user passwords. - Once the credentials are stolen, they can be used to access other systems in the network. 4. **Process Monitoring:** - Retrieves a list of **active processes** running on the system, allowing attackers to monitor and manipulate ongoing operations. 5. **Log File Exfiltration:** - Attempts to access **/ var / log /d.m.esg**_, which contains system logs that may reveal critical vulnerabilities or prior attacks. - The malware can also attempt to read _**/ tmp / fco.ntr.xm.l**_, potentially looking for additional sensitive data. 6. **File Manipulation:** - Allows the attackers to **list contents** of directories, **upload/download files**, **rename files**, **delete specific files**, and even execute **remote commands** on the infected device. 7. **Remote Command Execution:** - The attackers can execute arbitrary commands, enabling them to take full control over the system. 8. **Persistence and Clean-up:** - The malware ensures its **persistence** on the infected device by stopping and removing malicious processes from memory, making it harder for the victim to remove the threat. - It also cleans up traces by deleting logs or other system records that could lead to detection. 9. **Exfiltration of Stolen Data:** - Steals system information, service lists, and user credentials and sends them back to the attackers’ Command and Control servers. 10. **Covert Communication:** - The malware notifies the attacker when it is successfully **activated** and operational. #### **How Does the Malware Operate Unnoticed?** ELF/Ssh.din.ject.or.A!tr is designed for stealth. The process begins by injecting directly into the SSH daemon, the malware operates as part of the legitimate system process, which makes it incredibly difficult to detect through traditional security measures. The use of **binary injection** means the malware exists in the system without alerting security software, allowing it to function covertly for long periods. This method also allows the malware to remain **persistent**, even if the system is rebooted or temporarily patched. Unlike typical malware, which may be removed by rebooting or system scans, this type of injection guarantees that the hacker remains in control of the compromised device. #### **AI in Malware Analysis** In an effort to analyze this malware, FortiGuard researchers leveraged **AI-assisted tools** to reverse-engineer and dissect ELF/Ssh.dinje.ctor.A!tr. While traditional disassemblers and decompilers were used in the past, AI tools proved to be more effective in identifying and tracking the malware’s behavior in real time. These AI tools provided insight into previously undocumented parts of the malware and helped in the **deeper analysis** of its communication patterns and data exfiltration methods. However, Fortinet also highlighted the challenges faced by AI, including issues like **hallucination**, **extrapolation**, and **omissions** in the analysis. Nevertheless, the potential of AI in cybersecurity is clear, offering significant improvements in how malware is detected and neutralized. #### **Who is Behind the Attack?** Evasive Panda (also known as **DaggerFly**) is a Chinese cyber-espionage group that has been active since 2012. This group has been behind a series of **highly targeted attacks**, including **novel macOS backdoor deployments**, **supply chain attacks** via ISPs in Asia, and a four-month-long espionage campaign against U.S. organizations. Their operations typically target organizations with significant geopolitical value, allowing them to conduct long-term intelligence-gathering missions. This attack against SSH daemons marks a new chapter in their sophisticated and evolving tactics. The ability to exploit network appliances for persistent control is a testament to the **advanced capabilities** of this cyber-espionage group. #### **Fortinet’s Protection Against ELF/Sshd.inje.ctor.A!tr** Fortunately, Fortinet's **FortiGuard AntiVirus** service has already implemented defenses against ELF/Ssh;dinjector.A!tr. The threat is detected under the signatures *ELF/Ssh.dinjec.tor.A!tr* and *Linux/Agent.AC;Q!tr*, ensuring that affected users and organizations are already protected against the attack. #### **Mitigation and Recommendations** Organizations are urged to take the following actions to mitigate risks: 1. **Regular Security Audits:** Conduct routine checks on network appliances for unusual behavior or signs of compromise. 2. **Implement SSH Security Best Practices:** Use strong authentication methods, such as **public key authentication**, to prevent unauthorized access to SSH daemons. 3. **Monitor System Processes:** Watch for any anomalous processes running under root privileges that could indicate a malware injection. 4. **Use AI-powered Security Tools:** Leverage AI-assisted tools to detect sophisticated malware that might evade traditional antivirus programs.

loading..   04-Feb-2025
loading..   6 min read
loading..

Data Breach

FOOD

GrubHub has confirmed a significant data breach affecting customers, merchants, ...

GrubHub, one of the leading food delivery platforms in the U.S., has confirmed a data breach that has compromised the personal information of several customers, merchants, and drivers. The breach, which originated through a third-party service provider account, has raised serious concerns about the vulnerability of data in the hands of external partners. This article will break down the details of the breach, GrubHub's [response](https://about.grubhub.com/news/our-response-to-a-third-party-vendor-incident/), and the possible ramifications for affected users. --- ### **1. Background of the Incident: What Happened?** GrubHub, a popular food ordering and delivery service with a nationwide reach, disclosed a data breach on Monday. The company revealed that attackers had exploited a third-party service provider’s account, gaining unauthorized access to a variety of personal and sensitive data. The breach’s root cause was traced back to the compromised account of a third-party provider, which had support access to GrubHub’s systems. #### **1.1. Attack Vector – Third-Party Service Provider** The breach began with a third-party service provider that was responsible for offering certain support services to GrubHub. The attackers exploited the service provider’s access to infiltrate GrubHub’s systems. This highlights a critical vulnerability in relying on external entities for essential business operations, which, if not properly managed, can lead to substantial security risks. #### **1.2. Timeline of the Breach** Upon discovering the breach, GrubHub immediately terminated the compromised account and cut off the service provider’s access. External forensic experts were then brought in to assess the extent of the breach and analyze the compromised data. The company’s investigation also included rotating passwords to further mitigate the risk of unauthorized access. --- ### **2. Data Compromised: What Was Exposed?** The breach exposed a range of personal information from GrubHub’s users, merchants, and drivers. The company confirmed that no full payment card numbers, bank account details, Social Security numbers, or driver’s license numbers were compromised. However, certain personal information was indeed accessed by the attackers. #### **2.1. Personal Information of Customers** GrubHub revealed that attackers gained access to names, email addresses, and phone numbers of customers who had interacted with customer support services. For a select group of users, attackers also accessed partial payment card information, including the last four digits and card type. However, no full card numbers or sensitive financial data were compromised. #### **2.2. Impact on Merchants and Drivers** In addition to customer information, the data of GrubHub’s merchants and drivers were also affected. Like customers, their names, contact details, and partial payment information were exposed. The company noted that no login credentials, passwords, or financial details were accessed for these groups, which is a positive sign in terms of potential financial fraud. #### **2.3. Legacy System Passwords** A more concerning aspect of the breach was the compromise of hashed passwords tied to certain legacy systems. These legacy systems used older password storage methods, which might not have been as secure. GrubHub proactively rotated any passwords that were thought to be at risk to prevent further misuse. --- ### **3. GrubHub’s Response to the Breach** In response to the breach, GrubHub took immediate steps to limit the damage and protect the affected parties. #### **3.1. Termination of Service Provider Access** The first line of defense was the immediate termination of the compromised third-party account’s access. This action prevented further intrusion and helped contain the breach at its source. #### **3.2. Password Rotation and Security Measures** To further protect its systems, GrubHub rotated passwords for all potentially affected accounts. They also implemented additional security protocols, such as enhanced anomaly detection mechanisms across internal services, to monitor for unusual activities that could signal another attack attempt. #### **3.3. Forensic Investigation and Monitoring** GrubHub hired external forensic experts to assess the full scale of the breach and to determine if any other systems or sensitive information had been affected. The company is likely to continue monitoring its systems to ensure no further unauthorized access occurs. --- ### **4. Potential Risks and Consequences** While the breach did not expose the most sensitive data, the compromised information still poses significant risks to affected individuals. Here are some of the potential consequences: #### **4.1. Identity Theft and Phishing Attacks** Although full payment card information was not compromised, the exposure of partial payment data, along with names, emails, and phone numbers, increases the likelihood of identity theft and phishing attacks. Attackers could use this information to craft targeted scams, tricking users into revealing further personal or financial details. #### **4.2. Risk to Customer Trust** For GrubHub, the breach could severely impact customer trust. In the highly competitive food delivery industry, users are increasingly concerned about data security. A compromised service can lead to customers seeking alternatives, which could harm GrubHub's long-term reputation. #### **4.3. Legal & Regulatory Repercussions** Given the nature of the breach, GrubHub may also face legal scrutiny. Earlier this year, the company paid $25 million to settle FTC charges over misleading business practices. If it’s found that GrubHub didn’t meet adequate security standards or failed to notify affected users in time, additional penalties or regulatory actions could follow. --- ### **5. GrubHub’s Recommendations for Users** In the wake of this breach, GrubHub has urged its users, merchants, and drivers to take specific actions to protect themselves. #### **5.1. Change Passwords Regularly** GrubHub strongly recommends that users, especially those who were affected by the breach, change their passwords. It’s also important for users to employ unique passwords for different accounts, reducing the risk of password reuse being exploited across platforms. #### **5.2. Monitor Accounts for Unusual Activity** Affected individuals should actively monitor their financial accounts and be on the lookout for any unusual or unauthorized activity. GrubHub has not disclosed any instances of full financial data being compromised, but monitoring can help catch any discrepancies early. #### **5.3. Be Cautious of Phishing Attempts** With attackers potentially armed with personal information, users should remain vigilant for phishing emails or phone calls that might attempt to extract more sensitive details. GrubHub has warned users to be cautious when receiving unsolicited communication, especially if it involves requests for payment or account credentials. --- ### **6. GrubHub’s Legal & Financial Troubles** This breach is not the first time GrubHub has faced criticism for its business practices. In December 2023, the company settled with the Federal Trade Commission (FTC) for $25 million, addressing charges related to deceptive marketing practices. This settlement included accusations of misleading customers about delivery costs and deceiving drivers about their earnings. #### **6.1. FTC Settlement** The [$25 million settlement](https://www.ftc.gov/business-guidance/blog/2024/12/food-thought-ftcs-proposed-settlement-grubhub) aimed to resolve accusations that GrubHub failed to transparently [disclose total delivery costs](https://www.ftc.gov/system/files/ftc_gov/pdf/Grubhub-Order.pdf), misleading consumers about the real cost of their orders. It also included charges related to listing restaurants on its platform without their consent and misleading drivers about how much money they would earn from delivering orders. #### **6.2. Impact of This Settlement on GrubHub** The ongoing scrutiny around GrubHub’s legal issues, combined with this data breach, could significantly tarnish its reputation. The company now faces dual challenges: rebuilding consumer trust after both deceptive practices and a data breach.

loading..   04-Feb-2025
loading..   7 min read
Company Logo
logo

Secure Blink automates the web application and API security for developers and security teams, helping them to rapidly identify and mitigate vulnerabilities more effectively than they can today.

Find Us Online

LinkedIn Logo
Twitter Logo
Discord Logo
Telegram Logo
YouTube Logo
contact@secureblink.com

contact@secureblink.com

@ Copyright 2025 Secure Blink. All rights reserved.

16192, Coastal Highway, Lewes, Delaware, US-19958