Newsletter compiled by Jonathan Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
A group we’re calling “SWEED” may be behind years of Agent Tesla attacks. This week, we uncovered everything we know about this actor, and ran down their TTPs and discussed how users can stay safe.
If you didn’t get enough of the ransomware debate last week, we have even more talk of extortion payments on the latest Beers with Talos episode, too.
We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week. Due to the Fourth of July holiday in the U.S., expect our blog and social media to be fairly quiet over the next few days.
Event:“DNS on Fire” at Black Hat USA
**Location:**Mandalay Bay, Las Vegs, Nevada
**Date:**Aug. 7
**Speaker:**Warren Mercer
**Synopsis:**In this talk, Warren will go over two recent malicious threat actors targeting DNS protocol along with the methodology used to target victims, timeline, and technical details. The first is a piece of malware, “DNSpionage,” targeting government agencies in the Middle East and an airline. The second actor, more advanced and aggressive than the previous one, is behind the campaign we named “Sea Turtle.”
** **Event: “It’s never DNS…It was DNS: How adversaries are abusing network blind spots” at SecTor **Location: **Metro Toronto Convention Center, Toronto, Canada **Date: **Oct. 7 - 10 **Speaker: **Edmund Brumaghin and Earl Carter **Synopsis: **While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Title:Vulnerabilities in Zoom meeting software could turn on Mac cameras
**Description:**Two vulnerabilities — CVE-2019-13449 and CVE-2019-13450 — in the Zoom remote could allow an attacker to use a malicious website to automatically start a Zoom meeting and look in on a user’s Mac camera. While Zoom says it has mitigated the issue, users are also encouraged to ensure the Mac Zoom app is up to date and to disable the setting that allows Zoom to automatically turn on the machine’s camera when joining a meeting. New SNORT® rules fire when they detect a file containing Zoom client information trying to disclose sensitive information.
**Snort SIDs:**50724 - 50729 (Written by Joanne Kim)
Title:Anubis malware returns to haunt Android users** ** **Description: **Researchers at Trend Micro recently discovered more than 17,400 new samples of the Android malware. Anubis has targeted several different banking apps on Android stores, installing malicious espionage and banking trojan capabilities onto users’ mobile devices. The actor behind Anubis has been active for at least 12 years, constantly making updates and adding new features. All four of these rules fire when Anubis attempts to make an outbound connection to a command and control (C2) server. **Snort SIDs: **50734 – 50737 (Written by Tim Muniz)
SHA 256:7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
**MD5:**4a50780ddb3db16ebab57b0ca42da0fb
**Typical Filename:**xme64-2141.exe
**Claimed Product:**N/A
**Detection Name:**W32.7ACF71AFA8-95.SBX.TG
SHA 256:3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
**MD5:**47b97de62ae8b2b927542aa5d7f3c858
**Typical Filename:**qmreportupload.exe
**Claimed Product:**qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256:46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08 ** **
**MD5:**db69eaaea4d49703f161c81e6fdd036f ** **
**Typical Filename:**xme32-2141-gcc.exe
**Claimed Product:**N/A
**Detection Name:**W32.46B241E3D3-95.SBX.TG
SHA 256:85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
**MD5:**8c80dd97c37525927c1e549cb59bcbf3
**Typical Filename:**Eter.exe
**Claimed Product:**N/A
**Detection Name:**W32.WNCryLdrA:Trojan.22ht.1201
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f** **
**MD5:**e2ea315d9a83e7577053f52c974f6a5a
**Typical Filename:**c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
**Claimed Product:**N/A
**Detection Name:**W32.AgentWDCR:Gen.21gn.1201