Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Microsoft Reveals 3 New Malware Strains Used By SolarWinds Hackers

Microsoft Reveals 3 New Malware Strains Used By SolarWinds Hackers

Microsoft has revealed information on newly found malware the SolarWinds hackers deployed on victims’ networks as second-stage payloads.

The company now tracks the “sophisticated attacker” who used the Sunburst backdoor and Teardrop malware during the SolarWinds supply-chain attack as Nobelium.

Security researchers with the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft 365 Defender Research Team found three new malware strains named GoldMax, Sibot, and GoldFinder.

The Nobelium hackers used these malware strains during late-stage activity between August and September 2020. Still, it is believed that Nobelium dropped them on compromised SolarWinds customers’ systems as early as June 2020.

“Microsoft assesses that the newly surfaced pieces of malware were used by the actor to maintain persistence and perform actions on very specific and targeted networks post-compromise, even evading initial detection during incident response,” the company said.

“They are tailor-made for specific networks and are assessed to be introduced after the actor has gained access through compromised credentials or the SolarWinds binary and after moving laterally with TEARDROP and other hands-on-keyboard actions.”

Also Read: How To Make A PDPC Complaint: With Its Importance And Impact

According to Microsoft, these malware strains come with the following capabilities:

  • GoldMax: Go-based malware used as a command-and-control backdoor for hiding malicious activity and evading detection. It also has a decoy network traffic generator for concealing malicious network traffic with seemingly benign traffic.
  • Sibot: VBScript-based malware used for maintaining persistence and downloading additional malware payloads using a second-stage script
  • GoldFinder: Go-based malware “most likely” used as a custom HTTP tracer tool for detecting servers and redirectors like network security devices between the infected devices and C2 server.

Earlier today, FireEye also shared information on another new second-stage backdoor discovered on the servers of an organization compromised by the SolarWinds hackers.

FireEye researchers believe the new malware dubbed Sunshuttle is linked to the SolarWinds hackers tracked as UNC2452 (FireEye), StellarParticle (CrowdStrike), SolarStorm (Palo Alto Unit 42), Dark Halo (Volexity), and now Nobelium (Microsoft).

While Microsoft and FireEye made no connections between the malware they revealed today, Sunshuttle and GoldMax seem to designate the same malware strain based on a C2 domain they share and their capability to hide C2 traffic.

Also Read: Deemed Consent PDPA: How Do Businesses Comply?

“These capabilities differ from previously known NOBELIUM tools and attack patterns, and reiterate the actor’s sophistication,” Microsoft said.

“In all stages of the attack, the actor demonstrated a deep knowledge of software tools, deployments, security software and systems common in networks, and techniques frequently used by incident response teams.”

Microsoft also said last month that the SolarWinds hackers downloaded source code for a limited number of Azure, Intune, and Exchange components.

On Monday, SolarWinds revealed expenses of roughly $3.5 million through December 2020 from last year’s supply-chain attack. High additional costs are expected throughout the next financial periods.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us