Operation: House of Cards

Article from June 2017

World Wide Risk Update

We are seeing a very advanced intrusion attempt and campaign going on on our website, systems and at some customers and friends (we also assume this is targeting multiple cyber security companies as well). It appears to be at the  Nation-State level and very good tools and attempts are being used that are at the very least coordinated and thought out. We are currently collecting lots of data which is being collected and backed  up for forensics later on. We are seeing IPs from US, India, China, Brasil, Russia, Germany, France in these attacks that are both IP based that target various specific apps and specific attack vectors. The campaign  also includes AWS resources, MSNbot, Googlebot, Yandex and Baidu as well as what looks like coordinated Phishing attempts with multiple payloads as pdf, MSOffice files.

A trend can be seen to how the attackers first map out the target and search for about us and other details of the company members (we don’t publish our team and the listed address is not the actual company / for exactly this reason). We then see attempts to upload various payloads into areas not normally seen in other attacks an then coordinated phishing attempts that also leverage any and all social media and other online resources. Phishing attempts have picked up ever since we started to publish information on recent attacks and have been picking up over the last few days to much higher levels. Many phishing attempts are flagged domains but some are new and fresh. Since most “cyber” security companies keep their suffered attacks secret, we assume this is either targeted at us or at a dedicated group of companies engaged in APT and Risk research. We encourage anyone to come forward with details of similar activities so that we can coordinate with the appropriate teams.

(Update with some more details)

Attacks that we have seen over 7 Days shows a picture of the following IP’s and Countries including nr of attempts:

When we however take a look at the last 24 hours, we see a very different picture:

We are currently tracking more than 3000 new and unique IPs involving various attacks on this website and other sensors are picking up similar traffic for WordPress sites that include some big names:

1. baidu.com / CN
2. yandex.com /RU/USA
3. biz.rr.com
4. linode.com
5. Greendata.pl
6. onmicrosoft.com

We are coordinating additives with Microsoft and currently tracking multiple IPs and collected traffic for forensics. We would like to thank in this case Microsoft Security for reaching out to us so that we can help protect any effected Microsoft customers that are currently using Azure, Outlook, Office 365, etc. (Thanks Guys and Gals!)

What can you do?

We have a few things, this data highlights the reason why we talk about Risk Intelligence all the time and proactive security teams as well as methodologies. We work on data that are indicators of (potential) threats so that teams don’t have to scramble during an attack to find needles in haystacks. We save time, money and a huge amount of costs by using our own dogfood (CyberNSight, NeedleStack -TM HDN2017).

1. If you have domains that send you email that are from onmicrosoft.com or other official looking domains please be careful. Phishing emails with new payloads that are not getting picked up by email security appliances or Firewalls / UTMS are going around. Delete those emails!
2. If you see any DNS or Domains with similar names that yours, flag it, try to register those domains to stop tampering.
3. If you see internal emails going out to “weird IPs or connections” please flag those and block those addresses at your UTM/Firewall.
4. Integrate our Risk Intelligence into your systems for correlation.
5. Capture header information of emails you don’t know, send them to us (if you have no security audit services) We will look through the headers, review our current tracking lists and let you know what to do.

We hope you enjoyed another post, we will do the next one on owning routers and permitter devices using a nice little tool that we found in our darknet searches.

Until the next time, you saw it here first at Hakdefnet!

Mike

(The info, intelligence and any data on this post or website are copyright and TM Hakdefnet 2017, no copying, pictures, etc without referencing us and giving us credit for the data and reports -Please)