A coordinated law enforcement effort codenamed Operation Duck Hunt has felled QakBot, a notorious Windows malware family that’s estimated to have compromised over 700,000 computers globally and facilitated financial fraud as well as ransomware.

To that end, the U.S. Justice Department (DoJ) said the malware is “being deleted from victim computers, preventing it from doing any more harm,” adding it seized more than $8.6 million in cryptocurrency in illicit profits.

The cross-border exercise involved the participation of France, Germany, Latvia, Romania, the Netherlands, the U.K., and the U.S., alongside technical assistance from cybersecurity company Zscaler.

The dismantling has been hailed as “the largest U.S.-led financial and technical disruption of a botnet infrastructure leveraged by cybercriminals.” No arrests were announced.

QakBot, also known as QBot and Pinkslipbot, started its life as a banking trojan in 2007 before morphing into a general-purpose Swiss Army knife that acts as a distribution center for malicious code on infected machines, including ransomware, unbeknownst to the victims.

Some of the major ransomware families propagated through QakBot comprise Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta. QakBot administrators are said to have received fees corresponding to approximately $58 million in ransoms paid by victims between October 2021 and April 2023.

“QakBot was a key enabler within the cyber crime ecosystem, facilitating ransomware attacks and other serious threats,” Will Lyne, head of cyber intelligence at the U.K.’s National Crime Agency (NCA), said in a statement.

The counteroffensive against QakBot follows a similar takedown of Emotet in October 2020, which has since resurfaced following a major disruption to its backend infrastructure.

Typically distributed via phishing emails, the modular malware also comes fitted with command execution and information harvesting capabilities. It has seen constant updates during its lifetime, with the actors (codenamed Gold Lagoon or Mallard Spider) known to take extended breaks each summer before resuming their spamming campaigns.

“The victim computers infected with QakBot malware are part of a botnet (a network of compromised computers), meaning the perpetrators can remotely control all the infected computers in a coordinated manner,” the DoJ said.

The joint effort, according to court documents, enabled access to QakBot infrastructure, thereby making it possible to redirect the botnet traffic to and through servers controlled by the U.S. Federal Bureau of Investigation (FBI) with the ultimate goal of neutralizing the “far-reaching criminal supply chain.”

Specifically, the servers instructed the compromised endpoints to download an uninstaller file that’s designed to untether the machines from the QakBot botnet, effectively preventing additional payloads from being delivered.

Image Source: CISA

Secureworks Counter Threat Unit (CTU) said it detected the botnet distributing shellcode to infected devices on August 25, 2023, which “unpacks a custom DLL (dynamic-link library) executable that contains code that can cleanly terminate the running QakBot process on the host” by means of a QPCMD_BOT_SHUTDOWN command.

“The victims [in the U.S.] ranged from financial institutions on the East Coast to a critical infrastructure government contractor in the Midwest to a medical device manufacturer on the West Coast,” FBI Director Christopher Wray said.

QakBot has demonstrated a higher level of complexity over time, rapidly shifting its tactics in response to new security guardrails. For instance, after Microsoft disabled macros by default in all Office applications, it began abusing OneNote files as an infection vector earlier this year.

The sophistication and adaptability is also evident in the operators’ ability to weaponize a wide range of file formats (e.g., PDF, HTML, and ZIP) in its attack chains. A majority of QakBot’s command-and-control (C2) servers are concentrated in the U.S., the U.K., India, Canada, and France (FR). Its backend infrastructure is located in Russia.

QakBot, like Emotet and IcedID, employs a three-tiered system of servers to control and communicate with the malware installed on infected computers. The primary purpose of the Tier 1 and Tier 2 servers is to forward communications containing encrypted data between QakBot-infected computers and the Tier 3 server which controls the botnet.

As of mid-June 2023, 853 Tier 1 servers (aka supernodes) have been identified in 63 countries, with Tier 2 servers functioning as proxies to conceal the main C2 server. Data gathered by Abuse.ch shows that all QakBot servers are currently offline.

“QakBot is a highly sophisticated banking trojan malware, strategically targeting businesses across different countries,” Zscaler researchers noted in an exhaustive analysis published in late July 2023.

“This elusive threat employs multiple file formats and obfuscation methods within its attack chain, enabling it to evade detection from conventional antivirus engines. Through its experimentation with diverse attack chains, it becomes evident that the threat actor behind QakBot is continuously refining its strategies.”

QakBot has also been one of the most active malware families in the second quarter of 2023, per HP Wolf Security, leveraging as many as 18 unique attack chains and clocking 56 campaigns over the time period, underscoring the e-crime group’s penchant for “quickly permuting their tradecraft to exploit gaps in network defenses.”

(c) Thn

Recently disclosed security flaws impacting Juniper firewalls, Openfire, and Apache RocketMQ servers have come under active exploitation in the wild, according to multiple reports.

The Shadowserver Foundation said that it’s “seeing exploitation attempts from multiple IPs for Juniper J-Web CVE-2023-36844 (& friends) targeting /webauth_operation.php endpoint,” the same day a proof-of-concept (PoC) became available.

The issues, tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847, reside in the J-Web component of Junos OS on Juniper SRX and EX Series. They could be chained by an unauthenticated, network-based attacker to execute arbitrary code on susceptible installations.

Patches for the flaw were released on August 17, 2023, a week after which watchTowr Labs published a proof-of-concept (PoC) by combining CVE-2023-36846 and CVE-2023-36845 to execute a PHP file containing malicious shellcode.

Currently, there are more than 8,200 Juniper devices that have their J-Web interfaces exposed to the internet, most of them from South Korea, the U.S., Hong Kong, Indonesia, Turkey, and India.

Kinsing Exploits Openfire Vulnerability

Another vulnerability that has been weaponized by threat actors is CVE-2023-32315, a high-severity path traversal bug in Openfire’s administrative console that could be leveraged for remote code execution.

“This flaw allows an unauthorized user to exploit the unauthenticated Openfire Setup Environment within an established Openfire configuration,” cloud security firm Aqua said.

“As a result, a threat actor gains access to the admin setup files that are typically restricted within the Openfire Admin Console. Next, the threat actor can choose between either adding an admin user to the console or uploading a plugin which will eventually allow full control over the server.”

Threat actors associated with the Kinsing malware botnet have been observed utilizing the flaw to create a new admin user and upload a JAR file, which contains a file named cmd.jsp that acts as a web shell to drop and execute the malware and a cryptocurrency miner.

Aqua said it found 6,419 internet-connected servers with Openfire service running, with a majority of the instances located in China, the U.S., and Brazil.

Apache RocketMQ Vulnerability Targeted by DreamBus Botnet

In a sign that threat actors are always on the lookout for new flaws to exploit, an updated version of the DreamBus botnet malware has been observed taking advantage of a critical-severity remote code execution vulnerability in RocketMQ servers to compromise devices.

CVE-2023-33246, as the issue is cataloged as, is a remote code execution flaw impacting RocketMQ versions 5.1.0 and below that enables an unauthenticated attacker to run commands with the same access level as that of the system user process.

In the attacks detected by Juniper Threat Labs since June 19, 2023, successful exploitation of the flaw paves the way for the deployment of a bash script called “reketed,” which acts as the downloader for the DreamBus botnet from a TOR hidden service.

DreamBus is a Linux-based malware that’s a variant of SystemdMiner and is engineered to mine cryptocurrency on infected systems. Active since early 2019, it’s been known to be propagated by specifically exploiting remote code execution vulnerabilities.

“As part of the installation routine, the malware terminates processes, and eliminates files associated with outdated versions of itself,” security researcher Paul Kimayong said, adding it sets up persistence on the host by means of a cron job.

“However, the presence of a modular bot like the DreamBus malware equipped with the ability to execute bash scripts provides these cybercriminals the potential to diversify their attack repertoire, including the installation of various other forms of malware.”

Exploitation of Cisco ASA SSL VPNs to Deploy Akira Ransomware

The developments come amid cybersecurity firm Rapid7 warning of an uptick in threat activity dating back to March 2023 and targeting Cisco ASA SSL VPN appliances in order to deploy Akira and LockBit ransomware.

While some instances have entailed the use of credential stuffing, activity in others “appears to be the result of targeted brute-force attacks on ASA appliances where multi-factor authentication (MFA) was either not enabled or was not enforced for all users,” the company said.

Cisco has acknowledged the attacks, noting that the threat actors could also be purchasing stolen credentials from the dark web to infiltrate organizations.

This hypothesis is further bolstered by the fact that an initial access broker referred to as Bassterlord was observed selling a guide on breaking into corporate networks in underground forums earlier this February.

“Notably, the author claimed they had compromised 4,865 Cisco SSL VPN services and 9,870 Fortinet VPN services with the username/password combination test:test,” Rapid7 said.

“It’s possible that, given the timing of the dark web discussion and the increased threat activity we observed, the manual’s instruction contributed to the uptick in brute force attacks targeting Cisco ASA VPNs.”

The disclosures also arrive as unpatched Citrix NetScaler ADC and Gateway appliances are at heightened risk of opportunistic attacks by ransomware actors who are making use of a critical flaw in the products to drop web shells and other payloads.

(c) Thn

A hacking outfit nicknamed Earth Estries has been attributed to a new, ongoing cyber espionage campaign targeting government and technology industries based in the Philippines, Taiwan, Malaysia, South Africa, Germany, and the U.S.

“The threat actors behind Earth Estries are working with high-level resources and functioning with sophisticated skills and experience in cyber espionage and illicit activities,” Trend Micro researchers Ted Lee, Lenart Bermejo, Hara Hiroaki, Leon M Chang, and Gilbert Sison said.

Active since at least 2020, Earth Estries is said to share tactical overlaps with another nation-state group tracked as FamousSparrow, which was first exposed by ESET in 2021 as exploiting ProxyLogon flaws in Microsoft Exchange Server to penetrate hospitality, government, engineering, and legal sectors.

It’s worth pointing out that commonalities have also been unearthed between FamousSparrow and UNC4841, a categorized activity cluster held responsible for the weaponization of a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway (ESG) appliances.

Attack chains documented by Trend Micro show that the adversary is leveraging Cobalt Strike to conduct post-exploitation of compromised environments, following which it moves quickly to deploy additional malware and broaden the foothold.

The adversary has been observed employing an arsenal of backdoors and hacking tools, including backdoors, browser data stealers, and port scanners to enhance data collection.

This encompasses Zingdoor, a Go-based implant to capture system information, enumerate and manage files, and run arbitrary commands; TrillClient, a custom stealer written in Go to siphon data from web browsers; and HemiGate, a backdoor that can log keystrokes, take screenshots, perform file operations, and monitor processes.

Further lending legitimacy to the adversary’s espionage motives is its proclivity towards regularly cleaning and redeploying its backdoors on the infected host in an attempt to reduce the risk of exposure and detection.

“Earth Estries relies heavily on DLL side-loading to load various tools within its arsenal,” the researchers said. “To leave as little footprint as possible, they use PowerShell downgrade attacks to avoid detection from Windows Antimalware Scan Interface’s (AMSI) logging mechanism.”

Another significant aspect of the modus operandi is the abuse of public services such as Github, Gmail, AnonFiles, and File.io to exchange or transfer commands and stolen data. A majority of the command-and-control (C2) servers are located in the U.S., India, Australia, Canada, China, Japan, Finland, South Africa, and the U.K.

“By compromising internal servers and valid accounts, the threat actors can perform lateral movement within the victim’s network and carry out their malicious activities covertly,” the researchers said. “They also use techniques like PowerShell downgrade attacks and novel DLL side-loading combinations to evade detection.”

(c) Thn