company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Healthcare

loading..
loading..
loading..

Hackers Swipe Files of US Medical Device Giant in Ransomware Attack

Artivion, a US medical device leader, faces a ransomware attack: hackers steal files and disrupt orders and shipping, with no major financial impact

10-Dec-2024
5 min read

Related Articles

loading..

Spyware

DroidBot

Discover DroidBot, an advanced Android malware redefining threats with MaaS tact...

Threat Intelligence and Research (TIR) team has uncovered **DroidBot**, an advanced Android Remote Access Trojan (RAT) leveraging cutting-edge techniques to target financial institutions, cryptocurrency exchanges, and national organizations. Discovered in late October 2024, DroidBot introduces a sinister combination of espionage and fraud capabilities, underscoring the escalating sophistication of mobile malware threats. --- ## **What is DroidBot?** DroidBot is a sophisticated Android RAT that combines traditional techniques like **hidden VNC** and **overlay attacks** with advanced spyware-like functionalities such as: - **Keylogging**: Intercepting sensitive user input such as login credentials. - **User Interface Monitoring**: Monitoring activities on the infected device. - **Dual-Channel Communication**: - Outbound data transmitted through **MQTT** (Message Queuing Telemetry Transport). - Inbound commands received via **HTTPS** for enhanced resilience. Its infrastructure reflects a **Malware-as-a-Service (MaaS)** model, enabling affiliates to customize and deploy the malware easily. This emerging trend poses a substantial threat to cybersecurity globally. --- ## **Key Features of DroidBot** ### 1. **Advanced Capabilities** - **Overlay Attacks**: Displaying fake login screens over legitimate apps to steal user credentials. - **Remote VNC Access**: Periodic screenshots and real-time device control for continuous monitoring. - **Screen Interaction**: Simulates user actions such as form filling and navigation, allowing complete remote device manipulation. ### 2. **Unique Communication Methods** DroidBot employs the **MQTT protocol** for outbound data transmission, a rarity in Android malware. MQTT’s lightweight and efficient design, commonly used in IoT and real-time messaging systems, makes it uniquely suited for malware like DroidBot to achieve seamless and low-profile communication, bypassing traditional detection mechanisms. By dynamically retrieving the MQTT broker’s address via a remote encrypted request, DroidBot achieves stealth and resilience. ### 3. **Inconsistent Development Features** Ongoing development efforts include: - Placeholder functions such as root checks. - Multi-stage unpacking for added obfuscation. - Varying levels of feature implementation across samples. --- ## **Targets and Impact** ### **Affected Regions and Entities** DroidBot’s current campaigns target **77 entities** across: - **United Kingdom** - **France** - **Italy** - **Spain** - **Portugal** ### **Geopolitical Links** Evidence suggests Turkish-speaking developers are behind DroidBot, as revealed through language settings in the malware’s code, environmental metadata from shared screenshots, and operational patterns tied to Turkish domains. These clues collectively highlight the expertise and intent of the developers to extend their geographical reach. Notably, targeted users span languages and regions including English, Italian, Spanish, and Turkish. ### **Noteworthy Metrics** - **Countries Impacted**: UK, France, Turkey, Germany, and Italy. - **Distinct Infected Devices**: Over 776 unique IDs. - **Most Affected Region**: United Kingdom. --- ## **Operational Infrastructure: Malware-as-a-Service (MaaS)** DroidBot’s MaaS model introduces a new dimension in mobile malware: - **Builder Tool**: Facilitates creation of customized malware builds for affiliates. - **Affiliate Network**: 17 distinct botnet operators collaborate through shared MQTT servers. - **Subscription Model**: Offers services via a Telegram channel, priced at $3,000/month. This setup mimics legitimate Software-as-a-Service platforms, enhancing scalability and complicating detection efforts. --- ## **Technical Analysis** ### **Malware Delivery** DroidBot disguises itself as legitimate applications such as: - Google services. - Security tools. - Popular banking apps. **Infection Chain**: - Side-loading via social engineering tactics remains the primary attack vector. ### **Command-and-Control (C2) Communication** DroidBot’s C2 infrastructure leverages encrypted MQTT topics for structured data exchange. Each topic categorizes communication types, ensuring modularity and adaptability for future updates. **Encryption Process**: 1. **Serialisation**: Clear-text message converted to byte array. 2. **XOR Encryption**: Encrypted using a predefined dynamic key. 3. **Compression**: Further obfuscated via zlib. 4. **Transmission**: Sent securely through MQTT. --- ## **Threat Actor Attribution** ### **Turkish Origins** Evidence from Telegram channels, environmental clues, and domain analysis ties DroidBot’s developers to Turkey. An operational slip revealed: - Turkish operating system language settings. - Weather details from Ankara matching specific timeframes. ### **Underground Forums** A prominent Russian-speaking forum post dated October 12, 2024, unveiled DroidBot’s MaaS offering. The post highlighted: - Claims of experienced malware development. - Comprehensive packages including crypters and server access. - No restrictions on targeting CIS regions. --- ## **Implications** DroidBot’s evolution and MaaS model signify: - **Increased Fraud Risks**: Expanding target scope to financial institutions and cryptocurrency exchanges. - **Operational Challenges**: Affiliates’ ability to generate unique builds complicates detection. - **Geographical Expansion**: Emerging threats in Latin America and beyond. --- ## **Recommendations** ### For Financial Institutions: - Enhance monitoring of Accessibility Service abuse. - Deploy proactive detection for overlay attacks and VNC-based exploits. ### For CERTs and Governments: - Strengthen international collaboration to dismantle MaaS networks. - Increase user awareness of side-loading risks. ### For General Users: - Avoid downloading apps from unverified sources. - Regularly review app permissions and revoke unnecessary access. --- ## **Conclusion** DroidBot represents a paradigm shift in mobile malware by merging technical sophistication with a Malware-as-a-Service (MaaS) model, contrasting with earlier threats that were more isolated and lacked scalable affiliate infrastructures. This shift amplifies its reach and impact, complicating detection and defense efforts. Its ability to seamlessly adapt, infiltrate, and exploit underscores the urgent need for enhanced vigilance and coordinated global cybersecurity efforts. As DroidBot continues to evolve, staying ahead of its tactics will be critical to safeguarding digital ecosystems worldwide. --- ### **Appendix: Indicators of Compromise (IOCs)** #### **DroidBot Samples** | Hash | App Name | |----------------------------------------|-------------------| | fe8d76ba13491c952f7dd1399a7ebf3c | Chrome | | 2ce47ed9653a9d1e8ad7174831b3b01b | Chrome | | e6f248c93534d91e51fb079963c4b786 | Google Play Store | #### **C2 Servers** | Domain | |--------------------------------------------------| | dr0id[.]best | | k358a192.ala.dedicated.aws.emqxcloud[.]com | #### **Affiliates/Botnets** | Names | |--------------| | client0 | | zoouzz |

loading..   08-Dec-2024
loading..   5 min read
loading..

TikTok

Cyberattack

Romania faces TikTok manipulation, cyberattacks, and annulled elections amid glo...

Romania’s presidential election has become the focus of alleged foreign interference, cyberattacks, and digital manipulation, leading to its annulment and sparking nationwide concerns, including fears of widespread unrest and a deepening mistrust in democratic institutions. The Constitutional Court’s unprecedented decision to annul the first round of voting has plunged the nation’s democratic institutions into turmoil. Here’s how a NATO member and staunch European Union ally became the latest battleground in the shadowy world of hybrid warfare. --- ## **Election That Wasn’t** It began as a routine exercise in democracy. On **November 24, 2024**, millions of Romanians cast their votes in the first round of the presidential election. The results were startling. An obscure far-right candidate, **Călin Georgescu**, surged ahead, defying polls and political norms. Georgescu, known for his NATO-skeptic stance and previous praise of Vladimir Putin, was catapulted to fame overnight. But was it truly the will of the people? The Constitutional Court thought otherwise. On **December 6, 2024**, citing overwhelming evidence of foreign interference, it annulled the election entirely. The Court’s ruling, based on Article 146(f) of the Constitution, declared the electoral process fatally compromised. A new election must now be scheduled, leaving the nation in a constitutional and political quagmire. --- ## **TikTok: A Weapon of Mass Manipulation?** At the heart of this crisis lies **TikTok**, the social media platform favored by millions of young users and increasingly central to Romania's digital culture. With its massive reach and influence, TikTok has become a critical space for political messaging, making it a potent tool—and target—for manipulation during elections. According to declassified intelligence reports, TikTok was weaponized in a sophisticated campaign to manipulate the election. ### **Playbook** - A **"highly organized guerrilla campaign"** used influencers and coordinated networks to flood TikTok with pro-Georgescu content. - Paid promotions worth **$381,000** were funneled through inauthentic accounts, bypassing transparency rules. - TikTok’s recommender algorithms allegedly amplified this content, creating a digital echo chamber. ### **Breaching the Rules** The revelations point to blatant violations of TikTok’s own policies and Romanian electoral laws. Unlike other candidates’ campaigns, Georgescu’s promotional material went unflagged as political content, granting it undue visibility. ### **TikTok’s Response** Under mounting pressure, TikTok has been ordered by the European Commission to **freeze and preserve all data** linked to the Romanian election. Investigators are scrutinizing the platform’s compliance with the **Digital Services Act (DSA)** amid allegations of systematic inauthentic activity. --- ## **Cyber Storm: 85,000 Attacks and Counting** If TikTok was the front line of manipulation, Romania’s electoral infrastructure faced a full-blown cyber onslaught. Intelligence agencies reported **over 85,000 intrusion attempts**, targeting election websites and systems before and during voting. These attacks: - Originated from platforms linked to **Russian cyber-criminal hubs**. - Used advanced anonymization techniques typical of **state-sponsored actors**. - Sought to steal voter data and manipulate election outcomes. "This was not a random occurrence but a **calculated act of hybrid warfare**," declared the Romanian Intelligence Service (SRI). --- ## **Geopolitical Web** The implications of these attacks stretch far beyond Romania. Intelligence assessments indicate that Moscow has labeled Romania an **"enemy state"**, prioritizing it for destabilization efforts. The stakes are high: - **E.U. Stability**: As a member of the European Union, Romania’s compromised election represents a direct challenge to European democratic values. - **NATO Security**: With Romania’s strategic position on NATO’s eastern flank, destabilization could weaken regional security. - **Hybrid Warfare Escalation**: The combination of disinformation, cyberattacks, and social media manipulation marks an evolution in geopolitical conflict. --- ## **The Fallout** ### **Political Turmoil** Georgescu has denounced the annulment as an **"officialized coup"**, casting himself as a victim of a corrupt system. His rhetoric has energized his supporters, some of whom have taken to social media to decry the decision and accuse the establishment of undermining democracy. This growing polarization has raised fears of potential unrest, with pro-Georgescu groups hinting at nationwide demonstrations. Reformist candidate **Elena Lasconi**, slated to face Georgescu in the second round, called the court’s decision **"illegal and immoral"**, while pledging to fight for Romania’s European future. ### **Public Unrest** Pro-European protests have erupted, calling for transparency and accountability. Meanwhile, Georgescu’s supporters, inflamed by his rhetoric, have hinted at potential unrest. Comparisons to Ukraine’s 2014 Maidan revolution loom ominously. --- ## **E.U. Steps In: Digital Vigilance** In an unprecedented move, the European Commission has intensified its oversight of TikTok and other platforms during the Romanian election. Key actions include: - **Retention Orders**: TikTok must preserve internal data on its recommender systems and monetization practices. - **Rapid Response Systems**: Coordinated efforts with fact-checkers and civil society to identify and neutralize disinformation. - **Cross-Border Cooperation**: Involving Europol, ENISA, and the European Board for Digital Services Coordinators. Henna Virkkunen, E.U. Executive Vice-President for Tech Sovereignty, declared, "We are committed to **diligent and robust enforcement** of the Digital Services Act to protect European democracy." Her statement has received mixed reactions from various stakeholders. Pro-European organizations and civil society groups have lauded the move as a necessary step to safeguard democratic values, while some tech analysts have raised concerns about the potential overreach of regulatory measures. Meanwhile, TikTok has maintained its commitment to compliance, stating that it supports transparency and will cooperate fully with the Commission’s investigations. --- ## **Road Ahead** Romania’s election crisis serves as a wake-up call for democracies worldwide. It highlights the urgent need for: 1. **Strengthened Cybersecurity**: Protecting electoral infrastructure against state-sponsored attacks. 2. **Platform Accountability**: Ensuring social media companies actively mitigate risks of disinformation and manipulation. 3. **Public Awareness**: Educating voters about the dangers of digital interference. 4. **Global Collaboration**: Leveraging international alliances to counter hybrid threats. --- ## **Democracy in the Crosshairs** Romania’s election saga is a stark reminder of the vulnerabilities inherent in the digital age, calling for urgent global action to strengthen safeguards and protect the integrity of democratic processes. Similar challenges have been observed in other nations, such as the 2016 U.S. presidential election, which faced allegations of Russian interference, and Germany’s efforts to combat disinformation campaigns during its 2021 elections. These examples underline the global nature of hybrid threats targeting democracies. As disinformation campaigns and cyberattacks grow more sophisticated, the fight to protect democracy becomes ever more urgent. The eyes of the world are now on Romania, where the lessons learned could shape the global response to the next wave of hybrid warfare.

loading..   07-Dec-2024
loading..   6 min read
loading..

Supply Chain Attack

Learn about the recent supply chain attack on the Solana web3.js npm library, im...

A recent supply chain attack on the [`@solana/web3.js`](https://www.npmjs.com/package/@solana/web3.js)[ library](https://www.npmjs.com/package/@solana/web3.js) has underscored the need for heightened security in software development. This [Threatfeed](https://www.secureblink.com/cyber-security-news) offers a detailed analysis of the incident to help developers, security researchers, and organizations understand the attack and implement preventive measures. ## Background of the Attack On December 2, 2024, versions `1.95.6` and `1.95.7` of the popular `@solana/web3.js` library was compromised by a supply chain attack. A supply chain attack occurs when an attacker compromises a trusted software component at the source, introducing malicious code that gets distributed to end users. This library is a crucial JavaScript client that allows interaction with the Solana blockchain, used extensively by decentralized applications (dApps) to interface with the blockchain network. More information can be found on the [official Solana JavaScript client documentation](https://solana.com/docs/clients/javascript). The incident exposed sensitive private keys to threat actors. In blockchain, private keys are used to authorize transactions and manage cryptocurrency wallets. If compromised, these keys allow attackers to drain funds, creating severe financial risks for developers and organizations. A supply chain attack occurs when a trusted software component is compromised at the source, leading to the introduction of malicious code into the software. In this case, attackers leveraged compromised developer credentials to publish malicious versions of the library. The compromised versions included malicious code designed to steal private keys, enabling attackers to drain cryptocurrency wallets. ### Example of Supply Chain Attack For example, in a typical supply chain attack, an attacker might compromise a developer's credentials or use phishing techniques to gain access to the publishing environment of a popular library. Once they have access, they introduce malicious code that gets distributed to end users who trust the library. This was precisely the scenario that occurred with `@solana/web3.js`, where the malicious versions were able to steal sensitive data from unsuspecting users. ## Affected Versions and Technical Details ### Versions Impacted - **Affected Versions**: `1.95.6` and `1.95.7`. - **Safe Version**: Developers are advised to update to version `1.95.8`, that was released to remove the malicious code. You can find more details in the [official GitHub release notes](https://github.com/solana-labs/solana-web3.js/releases/tag/v1.95.8). - **Vulnerability Detection**: npm swiftly unpublished the compromised versions once the attack was detected. Detailed information on the detection and response can be found in this [Socket.dev blog post](https://socket.dev/blog/supply-chain-attack-solana-web3-js-library). ### Nature of the Malicious Code - The injected code targeted private keys, stealing them and transmitting them to a **hardcoded wallet address**. The data was disguised using legitimate-looking CloudFlare headers, making it difficult to detect, and it was transmitted without encryption, leaving sensitive information vulnerable to interception. - The associated **Solana address** (`FnvLGtucz4E1ppJHRTev6Qv4X7g8Pw6WPStHCcbAKbfx`) received the stolen credentials, putting affected wallets at significant risk. Mentioning the specific address helps in tracking the movement of stolen assets and providing transparency for affected users. ### Attack Timeline - The affected versions were available from **3:20 p.m. UTC to 8:25 p.m. UTC on December 2, 2024**. - The attack targeted projects that directly handled private keys within this narrow timeframe. ## Impact on Developers and Projects ### Who Was Affected? - Projects that **directly handle private keys** and updated to one of the compromised versions during the affected window. - **Non-custodial wallets** were **not affected** as they generally do not expose private keys during transactions, minimizing the risk of compromise. Non-custodial wallets are wallets where users retain full control over their private keys without relying on a third party. ### Scope of the Risk - **Developers and dApps**: Developers who used these versions in their projects faced the risk of having their private keys compromised, leading to a significant security breach. - **Financial Risk**: Exposure of private keys puts connected funds and wallets at risk of being drained by attackers. ## Mitigation Steps for Developers To mitigate the impact of the attack and ensure ongoing security, it is crucial to take immediate action to prevent further risks. The following actions are recommended: ### 1. **Update to Version 1.95.8** - **Upgrade Immediately**: All Solana developers must update to version `1.95.8` immediately to protect against vulnerabilities. Developers with pinned dependencies to `latest` must also ensure their environments are updated. ### 2. **Rotate Compromised Keys** - Developers who suspect compromise should **rotate authority keys** immediately, including: - **Multisignature Keys** (multisigs). - **Program Authorities** (used for smart contracts). - **Server Keypairs** (used for backend operations). - To rotate keys, developers should generate new keypairs and update their configuration files or environments to reflect the new keys. This will prevent attackers from continuing to use compromised credentials. ### 3. **Audit Dependencies** - **Check for Suspicious Code**: Review the `node_modules` directory and dependency trees to ensure no unauthorized modifications were made. - Use **Socket's CLI** (`socket scan create .`) or the **Socket GitHub app** to detect compromised dependencies. ### 4. **Revoke Permissions** - Revoke permissions granted to any compromised authority keys to prevent unauthorized access and minimize potential damage. ## Detailed Analysis of the Malicious Function ### `addToQueue` Function - The attack involved the addition of a **malicious function** named `addToQueue`, as shown in Where  1. - **Purpose**: The function exfiltrated private keys by injecting itself into legitimate code paths that accessed private key data. - **Exfiltration Mechanism**: It used **CloudFlare headers** to disguise the traffic as legitimate, effectively bypassing most security detection systems that might monitor for anomalous behavior. ### Command-and-Control Server - **Domain**: The C2 server (`sol-rpc[.]xyz`) was registered on **November 22, 2024**, via **NameSilo** and was hosted behind **CloudFlare**. - The server was used to collect stolen credentials but is currently **offline**, suggesting ongoing mitigation efforts by security teams. ## Root Cause Analysis and Attack Mechanism ***Figure 2: The 'addToQueue' function repeatedly called with secret key data, exfiltrating sensitive information.*** ### Publish-Access Compromise - The root cause of the attack appears to be a **phishing/social engineering** attack that compromised the **publish-access account** for the `@solana/web3.js` library. Common signs of phishing attacks include unexpected emails or messages asking for sensitive information, suspicious links, and requests for credentials that seem urgent or out of context. For further information on these incidents, refer to [this post by Christophe Tafani-Dereeper on Bluesky](https://bsky.app/profile/did\:plc\:zwlpsxw2udovqf4mbfi4ibqf/post/3lcgt6l7s4c2a). Developers should be vigilant about these warning signs to help prevent similar incidents in the future. - Phishing attacks typically involve tricking the target into revealing sensitive information, such as account credentials, which the attacker then uses to gain unauthorized access, as illustrated in Figure 2. Once the account was compromised, the attacker could publish unauthorized versions, embedding the malicious code. ### Abuse of Open Source Trust - The attack emphasizes the inherent **vulnerabilities of the open-source ecosystem**, which arise from the trust developers place in shared libraries that may not always be securely maintained. Trust in these libraries can be risky because attackers can exploit them by injecting malicious code, as was the case in this incident. - Attackers exploited this trust, embedding backdoors in widely used packages, highlighting the need for **additional security checks** and **code audits**. ## Preventive Strategies for Developers To prevent similar incidents in the future, developers should adopt the following strategies: ### 1. **Implement Secure Key Management** - **Avoid Hardcoding Keys**: Never hardcode private keys directly into your code. Use secure environment variables or external secret management systems. - **Use Hardware Security Modules (HSMs)**: Utilize HSMs or secure key storage services to handle sensitive key material, reducing the chances of exposure. ### 2. **Apply Principle of Least Privilege** - **Limit Access**: Only provide the minimum required access permissions to accounts that interact with publish-access controls. This limits the potential damage if an account is compromised. ### 3. **Conduct Regular Security Audits** - **Static Code Analysis**: Use static code analysis tools to identify vulnerabilities and malicious changes in code dependencies. - **Dependency Monitoring Tools**: Tools such as Dependabot or Snyk can automatically notify developers of vulnerabilities in third-party libraries. Additionally, you can read more about similar malicious packages in this [Socket.dev blog post](https://socket.dev/blog/malicious-npm-packages-threaten-crypto-developers). ### 4. **Use Multi-Factor Authentication (MFA)** - Require **MFA** for all developer accounts that have access to publish or modify packages, adding an extra layer of protection against unauthorized access. ### 5. **Implement Supply Chain Security Tools** - Utilize specialized tools such as **Sigstore** to verify the provenance of open-source packages. Supply chain security tools help ensure that the code being deployed has not been tampered with.

loading..   05-Dec-2024
loading..   8 min read