The Good | CISA Announces Open Source Software Security Roadmap

Open Source Software (OSS) underpins much of the products and services we all take for granted, including within the federal government and across the critical infrastructure sector. When a vulnerable piece of OSS is exploited by threat actors, supply chain attacks can have widespread and costly consequences, just ask Equifax or SolarWinds customers, or any admin that had to hunt down Log4j in their environments. Good to hear, then, that this week, CISA has announced its Open Source Software Security Roadmap.

The roadmap sets out how CISA will help support the secure use and development of OSS both within and outside the federal government. Identifying the cascading effects of OSS vulnerabilities and the malicious compromise of OSS components to create downstream compromises as the primary threats, CISA has laid out four key objectives in the roadmap published this week.

• Establish CISA’s role in supporting OSS security
• Drive visibility into OSS usage and risks
• Reduce risks to Federal Government
• Harden the OSS ecosystem

Hardening the open security software ecosystem in particular is a goal that can have far-reaching impacts for all. CISA says its goal is to foster security education for OSS developers as well as to coordinate vulnerability disclosure and response. This includes establishing processes to look for upstream issues in open source packages and quickly notify affected users of any identified vulnerabilities.

Over 5000 vulnerabilities have been identified in OSS software in the last 5 years alone and attempts to address the issue have lacked direction. CISA taking an active and prominent role in furthering OSS security, itself an outcome of the National Cybersecurity Strategy announced earlier this year, is a positive step that should be broadly welcomed.

The Bad | Caesars Gambles On Paying Attackers While MGM Battles On

An affiliate of ALPHV/BlackCat ransomware is claiming responsibility for an extortion attempt on MGM Casinos that has caused severe disruption to the company’s outlets, with reports of empty casinos and disconnected slot machines.

Researchers vx-underground broke the story on Monday, sharing on social media that the attackers were claiming they breached the company through social engineering MGM Casino help desk staff.

All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.

A company valued at $33,900,000,000 was defeated by a 10-minute conversation.

— vx-underground (@vxunderground) September 13, 2023

A further statement from the gang claimed that the disruption was caused by MGM Casinos attempt to find and root out the intruders rather than by the detonation of ransomware, but that claim remains unverified at the time of writing.

The gang said that they did launch ransomware attacks against 100 ESXi hypervisors after the company refused to negotiate with them, and that they are threatening to leak stolen data if the company remains unmoved.

Meanwhile, in a separate incident, casino operator Caesars Entertainment has said that intruders stole a database containing personally identifying information of its customers including driving license details and social security numbers. The admission came in a required SEC filing in which Caesars also stated that they had “taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result”.

It is rumored that these “steps” involved paying half of a $30 million ransom initially demanded, an expensive gamble – if true – that MGM rightly seems unwilling to copy.

The Ugly | Threat Actors Exploit Bug in Google’s WebP Library

Vendors Apple, Google, Microsoft, Mozilla and more have been scrambling to patch a critical severity bug in WebP this week that is known to be being actively exploited in the wild.

WebP is used in Chrome, Firefox, Edge, Brave and the Tor Browser. It is also found in many Electron apps like Signal, Telegram, and 1Password. Many Android applications and cross-platform software built with Flutter also use WebP.

The vulnerability is described as a heap buffer overflow which could allow an attacker to perform a memory write outside of its allocated buffer and gain arbitrary code execution.

Tagged as CVE-2023-4863, the bug in the widely used image encoding and compression library was apparently first reported by Citizen Lab to Apple. Regular readers will recall that last week Citizen Lab also identified an Apple zero-click zero day being used to deliver Pegasus malware. It is not clear at this time whether the two reports are linked.

Initial reporting of the vulnerability suggested it was restricted to web browsers, but it quickly became apparent that any software using the libwebp library is affected. libwebp is open source software developed by Google and has been widely adopted in both applications and other third-party libraries.

Details about the bug and exploit are sparse at the time of writing. Google says it is deliberately restricting disclosure until the majority of affected software has been patched. Vendors mentioned in this report have all issued patches this week, but given how widespread the library is, there are likely many others still to come.

In this blog post, we delve into the notable trends that have been shaping the cyber landscape over the past month. From the burgeoning market of bypass services to the alarming criminal activities on Telegram, we provide an update on cybercriminal activity to help defenders, SOC Teams and security leaders stay abreast of the latest developments and fortify their defenses in this ever-evolving battleground.

The AV/EDR/XDR Bypass Market

Threat actors across the cybercrime landscape are interested in anything that will help them bypass security solutions and evade detection, and this has resulted in a busy trade for tools and services which claim to answer this need.

The bypass market is not new but has witnessed an alarming growth in both the sophistication of the tools being offered and the assertiveness of the actors involved. These actors are leveraging unprecedented access to enterprise-level tools, continually testing and refining their malware against these tools, and posing a sophisticated and potent threat in targeted environments.

Bypass tools and services, which are far from being budget-friendly, are becoming a staple in the arsenal of ransomware operators. The bespoke nature of these services, exemplified by vendors such as “r1z,” indicates a burgeoning market where customizations can drive the price upwards from a base of around 3000 USD.

However, modern EDR/XDR technologies are not entirely helpless against these tools, provided they are well-maintained and appropriately configured. Threat actor tools, when successful, are usually deployed against outdated versions- or ill-maintained and misconfigured setups, laying open the vulnerabilities for these AV bypass tools to exploit.

Ransomware | New Threat Actors Ramping Up Attacks

The ransomware threat may be less in the headlines than this time last year, but known and new threat actors continue their activities, exploiting novel techniques and finding overlooked weaknesses in organizations’ security posture, as the ransomware attack on MGM Resorts this week has shown.

All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.

A company valued at $33,900,000,000 was defeated by a 10-minute conversation.

— vx-underground (@vxunderground) September 13, 2023

Elsewhere, new threat actors continue to appear and are ramping up operations. The coming months are expected to be a busy time for new attacks.

INC Ransom

The INC Ransom group emerged on the scene in early August 2023, establishing themselves with a semi-private, affiliate-based operation. A closer look at their operation reveals a penchant for exploiting weaknesses in Remote Desktop Protocols (RDP) and utilizing purchased valid account credentials, typically acquired through Initial Access Brokers (IAB).

Their modus operandi includes leveraging living-off-the-land binaries (LOLBINs) such as WMIC.EXE and MSTC.EXE, among others, aiming to bypass detection technologies embedded in targeted environments. The victims, once infected, are ushered into a negotiation process via a TOR-based portal, with a stringent 72-hour window to comply with the payment demands before their data gets published.

Ransomed.VC

Ransomed.VC burst onto the scene with a well-orchestrated PR campaign, encompassing a clearnet site and multiple communication channels including Telegram and Twitter/X profiles. Their operations are heavily inclined towards exploiting GDPR penalties as a method of extortion, threatening victims with potential legal repercussions in case of data leaks.

Their evolutionary journey can be traced back to the “RANSOMED” forums, with their website undergoing a significant transformation before a highly publicized launch in August 2023. The group has expanded its communication channels, utilizing both clearnet and dark web platforms to circulate news and updates regarding their activities.

Despite facing bans from various social media and communication platforms, they have adapted quickly, shifting their communication hub to other platforms including underground Russian cybercrime forums. Their approach indicates a brazen disregard for the potential humanitarian consequences of their actions, even allowing for attacks on critical infrastructure sectors, provided they get an approval from the “admin”.

Their business model encompasses an affiliate program, providing a platform for like-minded criminals to collaborate and enhance their nefarious activities. The group has also demonstrated their ability to deface websites, including government domains, using them as a billboard to showcase their ransom demands and details of the attacks.

Leveraging GDPR laws, they have positioned themselves as a pure extortion group, operating without deploying any ransomware. This approach complicates the efforts to neutralize and respond to their threats effectively.

Telegram | The “Wild Wild West” of Cybercrime

Since its inception in 2013, Telegram has gradually but steadily morphed into a hub for criminal activities, such that it now resembles the unregulated and chaotic nature of IRC channels and the early days of the internet. From malware distribution to recruitment into criminal organizations, the platform is now a hotbed for various cybercrime ventures.

Telegram’s encrypted environment, coupled with the capability to host large groups and automate processes through “bots,” has facilitated a significant migration of cybercriminal activities from traditional dark web markets to this more secure platform.

As of September 2023, the platform continues to teem with vendors offering custom malware tools and crypters, and it has now become the preferred platform for ransomware groups to disseminate stolen data and recruit affiliates, functioning as a versatile tool in their operations.

Conclusion

As we approach fall of 2023, with businesses returning to offices and schools and colleges opening for the new term, the cybercrime landscape continues to evolve at pace, with new entrants wielding sophisticated tools looking for any avenue of attack. Organizations must be vigilant and prepared, continuously adapting to the ever-changing threats emerging from the digital shadows.

In the face of these emerging trends, employing a comprehensive security solution like Singularity XDR, which leverages AI and automated remediation, can serve as a potent weapon in an organization’s cybersecurity arsenal. It’s more crucial than ever to stay ahead of the curve, adopting proactive measures that help detect and mitigate threats before they can inflict significant damage.

The cybercriminals are not resting, and neither should we. To learn more about how SentinelOne can help defend your organization’s endpoint, cloud, and network assets, contact us or request a free demo.

The clock is ticking, and in case you hadn’t heard, LABScon is back!

Continuing the stellar success of last year’s inaugural event, the SentinelLabs team is once again hosting a bespoke, invite-only conference for the cybersecurity industry’s leading experts, threat investigators, journalists, academics and government partners. The con will meet in Scottsdale, Arizona from 20th September through to 24th and places are limited, but there’s still time to request an invite.

Showcasing cutting-edge research into cyber threat actors, hunting techniques, vulnerabilities, exploits and new tooling, LABScon offers a unique opportunity to interface with leading researchers and journalists without the distractions of vendor halls and product pitching.

This year’s lineup of speakers includes veterans of the cybersecurity landscape from Cisco Talos, ESET, Intezer, Mandiant, Microsoft, Red Canary, SentinelLabs, Sophos and more. In this post, we take another sneak peek into some of the research that will be presented at LABScon23.

For those that can’t make it, don’t forget to bookmark both the LABScon homepage and the SentinelLabs homepage to keep an eye out for the release of video recordings after the event. Many of the talks from last year are available here.

Alex Matrosov | Spectre Strikes Again: Introducing the Firmware Edition

The excitement surrounding speculative execution attacks may have subsided, but sadly, such threats remain. Binarly Research has discovered a vast attack surface still vulnerable to known issues like Spectre v1 and v2 on AMD silicon. Ineffective mitigations and the complexity of validation negatively impact the AMD device ecosystem. While the industry is currently concentrating on constructing confidential computing infrastructure, foundational design problems reveal a lack of basic security at the hardware level. This discovery was made possible due to the asynchronous nature of firmware and hardware security fixes development.

Throughout their lifecycle, devices are susceptible to security issues due to the asynchronous nature of firmware security fixes delivery from multiple parties and the asynchronous nature of the supply chain. The lack of transparency in vendor security advisories results in an opaque channel for informing customers about the criticality of released security fixes and leads to varying approaches to patching widespread vulnerabilities with industry-wide implications. Even major silicon vendors develop mitigations for side-channel attacks differently. This situation presents an opportunity for potential threat actors to exploit known speculative attacks like the 5-year-old Spectre or the 1-year-old Retbleed. A new perspective is needed to construct an attack vector that utilizes speculative attacks to target UEFI-specific firmware vulnerabilities.

In this presentation, we will discuss our research into the potential use of speculative attacks against the System Management Mode (SMM) on AMD-based devices and outline the methodologies we employed throughout our research investigation.

Hakan Tanriverdi | From Vulkan to Ryazan – Investigative Reporting from the Frontlines of Infosec

During the last couple of years, I have reported on several large-scale digital espionage and sabotage campaigns, from hacking groups that were later called out by the Department of Justice to companies targeting critical infrastructure in Germany and across Western Europe. In both cases, mistakes in how the attackers set up their infrastructure enabled our team to follow their tracks, in some cases right back to their employers. The resulting stories revealed the intersection where covert cyberoperations and overt organizational structures meet.

This talk will lay out the types of information we work with, how we follow and fact-check opaque leads, and turn them into portraits of the previously unknown actors pulling the strings in cyberspace.

Martin Wendiggensen | BLACK MAGIC – Influence Operations In The Open And At-Scale In Hungary

Influence operations are often thought of as clandestine meddling in other countries’ affairs. But what if it’s were insidious than that? What if, right in front of our eyes, a NATO ally and EU Member Staate had developed a system to consistently peddle Russian talking points at a large scale within its own borders and beyond? This is what our research uncovered in the case of Hungary.

Hungary’s media ecosystem is controlled by the state. Years of corrupt dealings brought hundreds of news outlets – print, radio, television, and internet – under the control of oligarchs loyal to the state. And the state is very friendly to Russia. In time, the vast majority of these outlets were gifted, free of charge, to a holding controlled by the prime minister’s close confidants.

To prove the existence of an at-scale and continuous influence operation, we collected all coverage of Ukraine from major news outlets and analyzed our dataset with Semi-Supervised Machine Learning. The picture that emerged was stark: an ensemble of striking narratives aligned with Russian interests in denigrating Ukraine and the West. Moreover, these narratives were present well before the start of the war in 2020.

Matching our findings with an archive of Russian media, we were able to how show the narratives aligned topically, tonally, and in bias. Crucially, we should show a clear temporal lag. In other words, vast sections of Hungarian actively pick up Russian narratives and amplify them. The effects of this reach beyond Hungary’s own borders, as hundreds of thousands of ethnic Hungarians live in the “near abroad” (neighboring countries) and in the diaspora, thereby giving the controllers of Hungarian media outsized political influence abroad. This dark alignment of narratives runs deeper than words, leading our investigation to the staged firebombing of a Hungarian cultural center in Ukraine, and an obscure Cold War-era “spy bank” that is actively circumventing sanctions on Russia.

Amitai Ben Shushan Ehrlich | DNS Tunnel Warfare

Tunnels have been utilized in armed conclicts since antiquity. Underground passages, dug beneath the surface, are still utilized to undermine fortifications and slip right into enemy territory. Today, however, underground tunnels are not the only tunnels used in armed conflicts, as new hidden pathways have proved to be quite effective.

DNS tunneling has emerged as a stealthy technique used to covertly transfer data over the DNS protocol, and has been adopted by a wide variety of threats actors, including those involved in ongoing armed conflicts.

In this talk, we will explore various aspects of DNS tunneling, understanding its advantages, drawbacks, and potential for detection. We will immerse ourselves in one particular actor, delving into the analysis of its DNS tunneling infrastructure, tools and targets. As we proceed, we will soon learn how DNS tunnels, much like their physical counterparts, are used to initiate surprise attacks and sabotage enemy infrastructure during times of war.

Boldizsar Bencsath | SIMBIoTA: Implementation of an IoT virus-scanner for limited resources environment

IoT devices flood our lives. There are multi-billion pieces of IoT devices around, and the number grows constantly. Malware problems are not something that can be avoided for these devices. However, anti-virus techniques, especially standalone ones (not cloud based) are currently basically unavailable for these, e.g., for routers, cameras, and Linux-based Raspberry PI devices. A user typically installs a device and does not intend to maintain it, and generally has no ways to find out if the device behaves in a bad way.

Together, CrySyS Lab and Ukatemi planned and developed a possible standalone solution against these threats that cannot be handled by traditional antivirus products due to resource limits. Our SIMBIoTA project aims at taking the advantage of extreme compression: it does not need to store sequences of millions of different binary files, but to accumulate detection based on similarity hashes, and only store minimal basis for the detection. I will show the main benefits of the approach of SIMBIoTA, and also will show how different ways of evasion efforts can be handled and same latest information of the actual implementation.

In addition to the details of the technical methods I’ll try to elaborate on the possible attacks on the method and also show new advancements to mitigate this problem.

Austin Larsen & John Palmisano | Across the Seven Seas: Unmasking a Global Espionage Campaign

In this talk, we unveil the intricacies of a sophisticated 8-month-long global espionage campaign that targeted government agencies and private sector companies across the world. By exploiting widely-used Email Security Gateways (ESG), the campaign left organizations vulnerable to espionage by UNC4841, a suspected Chinese actor operating in support of the People’s Republic of China.

For the first time, we will provide an inside look into the tactics, targeting, and tricks employed by UNC4841 during this espionage operation. Commencing in October 2022, the actor launched targeted attacks utilizing malicious emails cleverly disguised low quality spam emails to exploit a zero-day in ESG appliances. The actor employed These code families deceptively masqueraded as legitimate modules of the Email Security Gateway, enabling UNC4841 to gain initial access and establish a persistent presence on compromised appliances.

Throughout the 8-month duration, UNC4841 showcased remarkable sophistication, adaptability, responsiveness, and understanding of the appliance itself. Their activities leveraging the compromised appliances for extremely targeted data exfiltration, as well as lateral movement into victims networks. As the investigation progressed, the sophistication of UNC4841’s activities necessitated a collaborative effort between our team, the company impacted as well as US law enforcement.

This talk will offer insights into the modus operandi of UNC4841, the far-reaching consequences of the campaign, and the collaborative efforts involved in burning this espionage operation. We will discuss the broader implications of cyber espionage on national security, highlight key findings from the investigation, and provide actionable recommendations for bolstering defenses against similar threats in the future.

Emily Austin | Managed File Transfer or Miscreants’ Favorite Target? An internet-wide study of MFT exposures

Managed file transfer (MFT) tools are a popular, user-friendly evolution of FTP, facilitating data sharing between and within organizations. In 2021, Businesswire reported projected growth of the MFT market to $2.4 billion by 2027, further emphasizing how organizations have come to rely on these tools. While companies of all sizes may have a need for user-friendly file sharing, MFT tools tend to be geared toward enterprise organizations in highly regulated industries (e.g., finance, healthcare).

As the tech industry provides software and tooling to facilitate work, we often inadvertently provide new targets for threat actors, and MFT is no exception. In the first half of 2023 alone, we’ve seen a series of high-profile attacks against file transfer software including GoAnywhere, Faspex, and MOVEit.

In this talk, we’ll begin by exploring a timeline of attacks against file transfer software. We’ll discuss the Clop ransomware and extortion group, along with their attacks against tools like GoAnywhere and MOVEit. Specifically, we’ll examine exposure of these tools prior to and during the attack time frame, along with a look at affected industries and networks.

We’ll then examine the state of additional file transfer tool exposures across the internet to better understand potential impact of attacks against such tools. The recent string of attacks against this category of software, combined with how widespread they are across the internet, suggests that we may see more attacks of this kind in the near future. In closing, we’ll discuss implications of the rise of MFT software for companies and consumers.

Paul Rascagneres | Ongoing EvilEye Campaigns Targeting CCP Adversaries

Volexity has recently uncovered ongoing campaigns by EvilEye, a Chinese state-backed threat actor, targeting three of the five groups the Chinese Communist Party (CCP) refers to as the “Five Poisons”. The targeted groups are members of the Tibetan community, the Uyghur ethnic group, and Taiwanese nationals. Volexity’s research has identified both currently active and historic activity for these campaigns. Volexity also identified related campaigns from this threat actor specifically targeting the Uyghur ethnic group back in 2019 and 2020.

The ongoing campaigns consist of two elements, malicious mobile applications and fake websites, which are created by the attacker to facilitate exploitation of end users by way of zero or n-day exploits. The three Android malware families being deployed include new versions of BADBAZAAR, as well as two previously undocumented families. In addition to these Android malware families, there is compelling evidence that EvilEye has developed an iOS implant and tried to distribute it via the Apple App Store.

This presentation outlines the current, ongoing campaigns; delves into the technical details of the Android malware families involved; discusses the threat actor’s command-and-control (C2) infrastructure and configuration; and reveals how the threat actor builds communities to distribute their malware through trusted platforms. The presentation also explores overlaps between the campaigns and explains links to historic activity.

Nicole Fishbein & Ryan Robinson | Cryptovirology: Second Guessing The Cryptographic Underpinnings of Modern Ransomware

Ransomware has permeated our everyday lives to the point of becoming a household term, featured prominently in news headlines, and even entwined with international politics. However, it is crucial not to overlook the technical intricacies that make ransomware both intriguing and highly effective—the cryptographic foundations that enable attackers to seize files and hold them hostage until a ransom is paid. Surprisingly, implementing cryptography effectively remains a challenging task. In this talk, we will delve into the nitty-gritty details of the cryptographic implementations utilized in modern ransomware and shed light on their inherent flaws.

Through engaging visualizations and occasional explanations in ELI5 terms, we will keep you awake through the math for long enough to discuss the strengths, weaknesses, and, most importantly, the inevitable failures of these implementations. Our focus will center around utilizing the Hybrid Cryptosystem in the context of XData ransomware and the flaws found in the QNAPCrypt key generation algorithm. Furthermore, we will delve into recent ransomware strains, exposing cryptographic flaws that render their effectiveness. Ultimately, we will question whether we can trust these ransomware creators to implement robust cryptography when even we often hesitate to do so ourselves.

Dual Core | Stay Free: Tampering AWS CloudTrail

You have gained access to an AWS account and don’t want to go to prison. The all-seeing eyes of the Blue Team and SOC analysts attempt to monitor your every move via AWS CloudTrail. How can we tamper the defenders’ capabilities to complete our objectives and remain free?

This talk will present a set of techniques for tampering the premier telemetry facility in AWS, accompanied by anecdotes of adventures in cloud security. Attendees will learn new tricks for evasion in AWS environments, along with a methodology for evaluating potential evasion techniques. We will focus on perspectives of offense, defense, and engineering.

Donald McCarthy | Cheap Parking and Express Lanes Through Your Proxy Filters

Infrastructure as a service/code has taken root. With a few API calls and some minor orchestration, almost anyone is able to have a horde of servers at their disposal in seconds. This however doesn’t generally help bypass proxy filters and those looking for new infrastructure.

This presentation will focus on techniques and services that APTs and other cyber criminals are using to turn what used to be a months/years long process into something achievable on short timelines, how and where this has been used in the past, quantification of the problem (although incomplete), and who we need to get engaged in order to solve it.

Sergei Frankoff & Sean Wilson | Exploring the Impact of Dual-Use Obfuscation Libraries on Threat Intelligence

Code similarity analysis is a fundamental and widely used technique for identifying and attributing malware at the binary level. However, the rising prevalence of open source code obfuscation libraries and their adoption by malware developers impose challenges that must be addressed to maintain the reliability and accuracy of this technique and its associated tools.

In 2022, the leaked Conti ransomware developer chat logs and subsequent leak of the Conti source code, confirmed the use of both an open source string protection library (ADVObfuscator) and an open source code obfuscation library (Obfuscator-LLVM). While these obfuscation libraries had been employed in malware previously, the exposed Conti development process emerged as a defining moment in the malware development ecosystem. Subsequently, the use of open source obfuscation libraries has grown with ADVObfuscator and Obfuscator-LLVM becoming common in ransomware code, and the adoption of lesser known obfuscation projects such as xorstr introducing significant challenges when using code similarity analysis tools.

Our research examines the impact of these obfuscation libraries on popular analysis tools (e.g., Lumina, Bindiff, and Binlex) and the resulting challenges faced by the threat intelligence processes that employ them. To address these challenges, we propose the use of ground truth binaries, which can fine-tune existing tools and processes. Using real world case-studies we will work through the challenges posed by these obfuscation libraries and describe how our solution may mitigates the encountered issues.

Greg Lesnewich | Surveying Similarities in macOS Components used in North Korean CryptoHeists

While many state-aligned threats have dipped their toes into macOS Malware, North Korea has invested serious time and effort into compromising that operating system. Their operations in macOS environments include both espionage and financial gain. macOS malware analysis is an exciting space, but most blogs on the subject deal with functionality and capability, rather than how to find more similar samples. Analysts are forced to rely on string searching, based on disassembler output or a strings dump; comparatively, executables for Windows have “easy” pivots such as import hashing or rich headers, to find additional samples without much effort.

This talk will introduce some of those easy pivots for Mach-O files, using North Korean samples as an initial case study; along the way, attendees will get a tour of the North Korean clusters using Mach-O samples, how those clusters intersect, how their families relate to one another, and be shown how some simple pivots can link a group’s families together.

MJ Emanuel | Where have all the APTs gone – a discussion of tradecraft accelerationism or counter-counter-counter

Activity in cyberspace has gone through a massive transformation over the last few decades, with cyber threat intelligence emerging, and then evolving alongside with it. Despite maturing as an industry, it is harder than ever before to consistently detect, track, and cluster known intrusion sets and identify new activity.

This presentation will describe the relationships between actor activity and discuss challenges in maintaining visibility as adversaries have changed their behavior over time. It will also examine the cascading effects of disclosure on adversary activity as a public good, including burning defenders ability to discover new activity as adversary’s reaction times continue to shorten, and strategic consequences on the closing window of our ability to detect the highest tier actors. Deterrence is one of the core tenets of cyber warfare strategy, and publicly outing campaigns to “impost cost” remains high on the list of options for response. However, this presentation will challenge the idea that public dissemination of information will operationally impact the perpetrators, and in fact, may end up harming our overall ability to detect and defend against them.

Filip Jurčacko | Deadglyph: Covertly preying over Middle Eastern skies

The Middle East has been known for years to be a fertile land for APTs. During our routine monitoring of suspicious activities in government entities of the region, we stumbled upon a very sophisticated and unknown backdoor that we have named Deadglyph.

Deadglyph’s main components are protected with encryption using a machine-specific key, which usually prevents further analysis. Its architecture is unusual as it consists of a native x64 and .NET component that cooperate. The traditional backdoor commands are not implemented in the Deadglyph binary; instead, they are dynamically received from its C&C server in the form of additional modules that exist in memory only briefly, to perform the commands. Without the modules, the full capabilities of the backdoor are unknown. Deadglyph also features a number of capabilities to avoid being detected, including the ability to uninstall itself, preventing discovery. After initial investigation, we could not attribute the Deadglyph backdoor to an existing threat actor, but later we found another piece of the puzzle – a multistage shellcode downloader that pointed us in the right direction. Finally, we will describe how we pivoted on various indicators to arrive at attributing Deadglyph backdoor to an existing threat actor, active in the Middle East for years.

Gabriel Bernadett-Shapiro | Demystifying LLMs: Power Plays in Security Automation

As the popularity of Large Language Models (LLMs) continues to grow, there’s a clear divide in perception: some believe LLMs are the solution to everything – a ruthlessly efficient automaton that will take your job and steal your dance partner. Others remain deeply skeptical of their potential – and have strictly forbidden their use in corporate environments.

This presentation seeks to bridge that divide, offering a framework to better understand and incorporate LLMs into the realm of security work. We will delve into the most pertinent capabilities of LLMs for defensive use cases, shedding light on their strengths (and weaknesses) in summarization, data labeling, and decision task automation. Our discourse will also address specific tactics with concrete examples such as ‘direction following’—guiding LLMs to adopt the desired perspective—and the ‘few-shot approach,’ emphasizing the importance of precise prompting to maximize model efficiency. The presentation will also outline the steps to automate tasks and improve analytical processes and provide attendees with access to basic scripts which they can customize and test according to their specific requirements.

And There’s More!

In addition to all the goodness highlighted above and the LABSCon 2023 talks we highlighted last week, this power event will feature presentations by award-winning journalist Kim Zetter, receiver of the Gold Presidential Volunteer Service Award (PVSA) and Senior Director of SentinelLabs, Juan Andres Guerrero-Saade, Automox’s Jason Kitka, Robert Ghilduta from Nuand LLC, and SentinelLabs’ researchers Tom Hegel and Aleksandar Milenkowski.

Request an Invite

We are hugely excited about LABScon 2023, a premier event where the brightest minds in cybersecurity come together to share their insights. It’s still not too late to request an invite. A limited number of tickets remain available, so hurry and click that button if you’d like to come and join us.

This year has seen an explosion of infostealers targeting the macOS platform. Throughout 2023, we have observed a number of new infostealer families including MacStealer, Pureland, Atomic Stealer and RealStealer (aka Realst). Over the last few months, we have also been tracking a family of macOS infostealers we call ‘MetaStealer’. Last week, Apple dropped a new signature for XProtect that detects some (but not all) variants of the MetaStealer family.

In this post, we describe how MetaStealer differs from other recent stealers, as well as indicate some intriguing overlaps with other malware. We highlight how threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads, and we provide a comprehensive list of indicators to help threat hunters and security teams identify MetaStealer in their environments. All SentinelOne customers are automatically protected from macOS MetaStealer.

MetaStealer Droppers Targeting Businesses

Many of the samples of MetaStealer we have observed are distributed in malicious application bundles contained in disk image format (.dmg) with names indicating that the targets were business users of Mac devices.

MetaStealer disk images contain names such as

• “Advertising terms of reference (MacOS presentation).dmg”
• “CONCEPT A3 full menu with dishes and translations to English.dmg”
• “AnimatedPoster.dmg”
• “Brief_Presentation-Task_Overview-(SOW)-PlayersClub.dmg”

Many of the disk image droppers contain names that include the words “Official Brief Description” such as “(Cover references,tasks,logos,brief)YoungSUG_Official_Brief_Description_LucasProd.dmg”, suggesting that these were lures aimed at business users of macOS.

In one case, a malicious version of MetaStealer with the name “Conract for paymen & confidentiality agreement Lucasprod.dmg” was uploaded to VirusTotal with a comment from the victim describing how they were lured.

Other versions of MetaStealer we have seen use names masquerading as Adobe files or software such as “AdobeOfficialBriefDescription.dmg” and “Adobe Photoshop 2023 (with AI) installer.dmg”.

This specific targeting of business users is somewhat unusual for macOS malware, which is more commonly found being distributed via torrent sites or suspicious third-party software distributors as cracked versions of business, productivity or other popular software.

MetaStealer Malicious Application Bundles

The applications inside the MetaStealer disk images contain the minimum required to form a valid macOS bundle, namely an Info.plist file, a Resources folder containing an icon image and a MacOS folder containing the malicious executable.

Although we have seen some versions carrying an Apple Developer ID string embedded in the executable (Bourigaultn Nathan (U5F3ZXR58U)), none of the samples we observed attached a code signature or used ad hoc signing. This means that to gain execution, the threat actor would likely need to guide or persuade the victim to override protections such as Gatekeeper and OCSP.

Interestingly, all the samples we have collected are single architecture Intel x86_64 binaries, meaning that they are unable to run on Apple’s Apple silicon M1 and M2 machines without the help of Rosetta.

Early samples of MetaStealer began appearing on VirusTotal around March 2023 and increased throughout the summer. The most recent sample we are aware of was uploaded to VirusTotal on 27 August. Apple updated its malware blocking tool XProtect to version 2170 in the week commencing 4 September.

However, some of the samples in our collection that appeared in June and July remain undetected by XProtect after this update; these include the following malicious Mach-O executables:

1df8ff1fe464a0d9baaeead3c7158563a60199d4
1e5319969d6a53efc0ec1345414c62c810f95fce
2c567a37c49af5bce4a236be5e060c33835132cf
57c2302c30955527293ed90bfaf627a4132386fb
b51d7482d38dd19b2cb1cd303e39f8bddf5452ac
c37751372bb6c970ab5c447a1043c58ce49e10a5
c5429b9b4d1a8e147f5918667732049f3bd55676
fce7a0c00bfed23d6d70b57395e2ec072c456cba

MetaStealer Obfuscated Go Executable

The main executable in MetaStealer bundles is an Intel x86 Mach-O containing compiled and heavily obfuscated Go source code. The Go Build ID has been stripped and function names obfuscated. The obfuscation method bears similarity to that used in obfuscated Sliver and Poseidon malware binaries, and may be a product of the garble obfuscator or similar.

Despite the obfuscation, some tell-tale signs of the binary’s tasking remain as artifacts. In particular, we can identify functions for exfiltrating the keychain, extracting saved passwords, and grabbing files.

Some, but not all, versions contain methods seemingly targeting Telegram and Meta services.

Samples of MetaStealer have been observed reaching out to one of the following domains:

api.osx-mac[.]com
builder.osx-mac[.]com
db.osx-mac[.]com

MetaStealer has also been observed attempting to open an outgoing TCP connection to either host 13[.]125.88[.]10 or 13[.]114.196[.]60 over port 3000.

Is MetaStealer Related to Atomic Stealer?

Earlier this year we documented how another macOS infostealer, Atomic Stealer, was being offered for rent to threat actors via a Telegram channel. Last week, other researchers noted that a version of Atomic Stealer was being distributed via malvertising through Google Ads using a typosquatting technique to deliver a fake TradingView application. Interestingly, some versions of MetaStealer are also masquerading as TradingView.

However, despite both being Go-based infostealers that also use osascript to display error messages to the user on execution, we see little actual code overlap between MetaStealer and Atomic Stealer. We also note that the network infrastructure and observed method of delivery in MetaStealer campaigns is rather different to that seen in Atomic Stealer.

At this point, we cannot rule out that the same team of malware developers could be behind both stealers and that differences in delivery are due to different buyers of the malware, but it is also equally possible that entirely different individuals or teams are simply using similar techniques to achieve the same objectives.

How to Stay Safe from MetaStealer Malware

The SentinelOne Singularity platform detects these and all other samples of MetaStealer malware both on-write and on execution.

As noted above, Apple’s XProtect update v2170 contains a detection signature for some versions of MetaStealer but not all, so organizations without SentinelOne or other capable security solution are advised to review the indicators below for threat hunting and mitigation.

Conclusion

The appearance of yet another macOS infostealer this year shows the trend towards targeting Mac users for their data continues to rise in popularity among threat actors. What makes MetaStealer notable among this crop of recent malware is the clear targeting of business users and the objective of exfiltrating valuable keychain and other information from these targets. Such high-value data can be used to pursue further cybercriminal activity or gain a foothold in a larger business network.

All Mac users are advised to ensure they have an adequate security solution in place and IT and security teams are encouraged to review the comprehensive list of IoCs below.

Indicators of Compromise

MetaStealer Droppers

AdobeOfficialBriefDescription.dmg
00b92534af61a61923210bfc688c1b2a4fecb1bb

Adobe Photoshop 2023 (with AI) installer.dmg
51e8eaf98b77105b448f4a0649d8f7c98ac8fc66

Advertising terms of reference (MacOS presentation).dmg
14da5241119bf64d9a7ffc2710b3607817c8df2f

AnimatedPoster.dmg
c2cd344fbcd2d356ab8231d4c0a994df20760e3e

CardGame.dmg
5ba3181df053e35011e9ebcc5330034e9e895bfe

Conract for paymen & confidentiality agreement Lucasprod.dmg
dec16514cd256613128b93d340467117faca1534

FreyaVR 1.6.102.dmg
d3fd59bd92ac03bccc11919d25d6bbfc85b440d3

Matrix.dmg
3033c05eec7c7b98d175df2badd3378e5233b5a2

OfficialBriefDescription.app.zip
345d6077bfb9c55e3d89b32c16e409c508626986

P7yersOfficialBriefDescription 1.0.dmg
35bfdb4ad20908ac85d00dcd7389a820f460db51

PDF.app.zip
aa40f3f71039096830f2931ac5df2724b2c628ab

TradingView.dmg
e49c078b3c3f696d004f1a85d731cb9ef8c662f1

YoungClass brief presentation Mac 20OS.zip
3161e6c88a4da5e09193b7aac9aa211a032526b9

YoungSUG(Cover references,tasks,logos,brief)YoungSUG_Official_Brief_Description_LucasProd.dmg
61c3f2f3a7521920ce2db9c9de31d7ce1df9dd44

Mach-O Binaries – Intel x86_64

0edd4b81fa931604040d4c13f9571e01618a4c9c
13249e30a9918168e79cdb0f097e4b34fbbd891f
13bcebdb4721746671e0cbffbeed1d6d92a0cf6c
1424f9245a3325c513a09231168d548337ffd698
148bc97ff873276666e0c114d22011ec042fb9b9
15c377eb5a69f93fa833e845d793691a623f928c
166ff1cd47a45e47721bb497b83cc84d8269b308
1b3ce71fa42f4c0c16af1b8436fa43ac57d74ce9
1cc66e194401f2164ff1cbc8c07121475a570d9f
1df31db0f3e5c381ad73488b4b5ac5552326baac
1df8ff1fe464a0d9baaeead3c7158563a60199d4
1e5319969d6a53efc0ec1345414c62c810f95fce
291011119bc2a777b33cc2b8de3d1509ed31b3da
2c567a37c49af5bce4a236be5e060c33835132cf
33a5043f8894a8525eeb2ba5d80aef80b2a85be8
34c7977e20acc8e64139087bd16f0b0a881b044f
3589dd0d01527ca4e8a2ec55159649083b0c50a8
35c3b735949151aae28ebf16d24fb32c8bcd7e6b
35e14d8375f625b04be43019ccb8be57656b15cf
394501f410bd9cb4f4432a32b17348cdde3d4157
47620d2242dfaf14b7766562e812b7778a342a48
57c2302c30955527293ed90bfaf627a4132386fb
65de53298958b4f137c4bd64f31f550dd2199c36
70625f621f91fd6b1a433a52e57474316e0df662
78e8f9a93b56adc8e030403ba5f10f527941f6ae
80c83e659c63c963f55c8add4bf62f9bec73d44e
816fdf1fd9cf9aff2121d1b59c9cca38b5e4eb9d
86eb7c6a4d4bec5abeb6b44e0506ab0d5a96235d
8dfeda030bd3b38592b29d633c40e041d5f3331d
8ec57c1b1b5409cadb99b050c3c41460d4c7fea8
8f211c0ef570382685d024cc8e6e8acd4a137545
90d7f8acf3524fcb58c7d7874a5b6e8194689b1a
92b178817a6c9ad22f10b52e9a35a925a3dc751b
a54c9906d41b04b9daf89c2e6eb4fdd54d0eae39
a8724eb5f9f8f4607b384154f0c398fce207259e
b51d7482d38dd19b2cb1cd303e39f8bddf5452ac
bd6b87c6f4f256fb2553627003e8bce58689d1d8
bdd4ce8c2622ddcf0888e05690c8b3d1a8c83dae
be1ac5ed5dfd295be15ba5ed9fbb69f10c8ec872
c37751372bb6c970ab5c447a1043c58ce49e10a5
c4d9272ef906c7bf4ccc2a11a7107d6b7071537b
c5429b9b4d1a8e147f5918667732049f3bd55676
caf4fb1077cea9d75c8ae9d88817e66c870383b5
cf467ca23bdb81e008e7333456dfceb1e69e9b8a
cfa56e10c8185792f8a9d1e6d9a7512177044a8b
d7de135a03a2124c6e0dfa831476e4069ebfba24
dbf0983b29a175ebbcf7132089e69b3999adeca7
dfd5adb749cbc5608ca915afed826650fcb0ff05
e5cfc40d04ea5b1dac2d67f8279c1fd5ecf053f6
f6f09ecc920eb694ed91e4ec158a15f1fb09f5dd
f93dd5e3504fe79f7fcd64b55145a6197c84caa2
f97e22bad439d14c053966193fdfdec60b68b786
fce7a0c00bfed23d6d70b57395e2ec072c456cba

Network Communications

IPs
13[.]114.196[.]60
13[.]125.88[.]10

Domains
api.osx-mac[.]com
builder.osx-mac[.]com
db.osx-mac[.]com

URLs

hXXps[:]//api.osx-mac[.]com/api/collections/victims/records
returns:
{"page":1,"perPage":30,"totalItems":0,"totalPages":0,"items":[]}

hXXp[:]//api.osx-mac[.]com/chainbreaker
returns:
{"code":404,"message":"Not Found.","data":{}}

Developer ID
Bourigaultn Nathan (U5F3ZXR58U)