[![](https://4.bp.blogspot.com/-YLRBgfX54uk/XKYbVrHlGXI/AAAAAAAAFu8/MxjUEd-3hhQTW4tZkat-cLDi8G5tVm6bgCK4BGAYYCw/s1600/threat-source.png)]() _Newsletter compiled by Jonathan Munshaw._ Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. This week, we disclosed [two vulnerabilities in KCodes’]() NetUSB kernel module contains that could allow an attacker to inappropriately access information on some NETGEAR wireless routers. An attacker could send specific packets on the local network to exploit vulnerabilities in NetUSB, forcing the routers to disclose sensitive information and even giving the attacker the ability to remotely execute code. We also have our [weekly Threat Roundup](), which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week. ### Upcoming public engagements with Talos **Event: **[“It’s never DNS...It was DNS: How adversaries are abusing network blind spots” at SecTor]() **Location: **Metro Toronto Convention Center, Toronto, Canada **Date: **Oct. 7 - 10 **Speaker:** Edmund Brumaghin and Earl Carter **Synopsis: **While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more. ### Cyber Security Week in Review * The U.S. is reportedly stepping up its [offensive cyber attacks]() against Russia’s power grid. Sources told the New York Times that the new efforts are a quiet effort to respond to Russia’s meddling in the 2018 midterm elections. * The U.S. Department of Homeland Security released an advisory urging Microsoft users to [patch all of their products](). The government warned users against the potential exploitation of a “wormable” bug Microsoft disclosed in May. * A security researcher was able to access and publicly post [more than seven million Venmo transactions.]() The researcher says it was all done to urge users to set their accounts to private on the money-sending app. * Several malicious Android apps have been able to [bypass two-factor authentication](). Once logging into some other apps installed on the users’ phone, these apps attempt to steal Bitcoin. * Two new class-action lawsuits allege that Amazon’s Alexa devices [unknowingly record small children’s voices](). The suit claims this is illegal because minors cannot consent to having their voices recorded. * Cisco disclosed [several critical vulnerabilities]() this week in a variety of their products, including DNA Center and SD-WAN. * New malware is [targeting cryptocurrency exchange employees]() using Windows and Mac systems. The attacks exploit a zero-day vulnerability in Mozilla Firefox that Mozilla patched earlier this week. * The Florida city of Riviera [paid $600,000 to hackers]() who infected their computer system with ransomware. The attack apparently originated from a phishing email one employee opened. Notable recent security issues ### Notable recent security issues **Title:** [Attackers redirect users to RIG exploit kit, downloads ransomware]() **Description: **A new malvertising campaign in the wild attempts to trick users into clicking on malicious ads, then sending them to a web page containing the RIG exploit kit. Once infected, the kit then downloads the Buran ransomware. Buran is a fairly straightforward ransomware, implementing its encryption process and then displaying a ransom note to the victim. **Snort SIDs: **50424 - 50426 (Additionally, rules 42806, 43187, 43217, 43332, 43729, 45455 and 45527-45532 will protect against the RIG exploit kit) ** ****Title: **[New Linux malware believed to use code from past Chinese malware]() **Description: **A new malware known as “HiddenWasp” has been spotted in the wild targeting Linux machines. HiddenWasp contains several methods to avoid detection by antivirus solutions, and the attackers are still actively deploying it. Researchers discovered that the malware contains code that is copy and pasted from other, past attacks from Chinese actors. **Snort SIDs: **50477,** **50478 ### Most prevalent malware files this week **SHA 256: **[3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3]()** ** **MD5: **47b97de62ae8b2b927542aa5d7f3c858 **Typical Filename: **qmreportupload.exe** ** **Claimed Product: **qmreportupload **Detection Name: **Win.Trojan.Generic::in10.talos ** ****SHA 256: **[7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510 ]() **MD5: **4a50780ddb3db16ebab57b0ca42da0fb **Typical Filename: **wup.exe **Claimed Product: **N/A **Detection Name: **W32.7ACF71AFA8-95.SBX.TG ** ****SHA 256: **[15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b]()** ** **MD5: **799b30f47060ca05d80ece53866e01cc **Typical Filename: **15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin** ** **Claimed Product: **N/A** ** **Detection Name: **W32.Generic:Gen.22fz.1201 ** ****SHA 256: **[c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f ]() **MD5: **e2ea315d9a83e7577053f52c974f6a5a **Typical Filename: **Tempmf582901854.exe **Claimed Product: **N/A **Detection Name: **W32.AgentWDCR:Gen.21gn.1201 ** ****SHA 256: **[46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08]() **MD5: **db69eaaea4d49703f161c81e6fdd036f **Typical Filename: **xme32-2141-gcc.exe **Claimed Product: **N/A **Detection Name: **W32.46B241E3D3-95.SBX.TG ![](http://feeds.feedburner.com/~r/feedburner/Talos/~4/O32p2kTti3M)

Threat Source newsletter (June 20, 2019)