The IT Nerd

Here’s a new one for me. Google is being used to perpetrate an extortion phishing scam. Let me walk you through it. It starts with this email that you get in your inbox:

So I will give the threat actor credit for coming up with an email that looks convincing. But there’s one way to tell that this is not sent by Google. And that’s to check the email address that it was sent from:

By some strange coincidence, it’s the same email address that is referenced in the body of the email. Which shouldn’t be the case as this email should come from Google via a domain like @google.com or @googlemail.com for example. So upon seeing that, most people should immediately hit the delete button on this button. I’m not most people which means we’re going down the rabbit hole on this one. Upon clicking on the words “Disconnect email”, which for the record you should never ever do, I got this:

This is your classic extortion phishing scam. The whole point of the scam is to convince you that your PC has been hacked by some “God Tier” hacker and they’ve caught you “pleasuring yourself.” And to keep the video that he took of you supposedly doing this from getting out, you have to pay them. Usually I have seen the extortion part of this simply delivered by email. But I am guessing that because more and more spam filters on email servers are catching those emails, the threat actors have now resorted to this method to get directly to the user. I’ll admit that it’s crafty. And checking the Bitcoin wallet associated with this scam shows that seven people have fallen for the scam:

Here are the facts behind extortion phishing scams. There’s no way for the scammer to tie you to the money that they could get from you as Bitcoin is anonymous by design. Which means that they have no way to delete the data that they allegedly collected if you pay them. Which by extension means that they’re lying about having data on you. On top of that, the level of skill required to come up with some sort of trojan that is capable of doing the sort of things that they are describing would not be used in a low rent scam like this. They would more likely be used by nation states wanting to spy on people. Think the sort of stuff that the notorious NSO Group does on the iOS side of the fence. All of that should make hitting the delete button on any email that you get that has this type of scam very easy to do. It also makes closing the browser window that has anything like the image above also easy to do.

I will also make this observation. The website that hosts this page is in China. Does that make the threat actor Chinese? Who knows? They may actually be Chinese, or they could be from someplace else and are using a Chinese host to cover their tracks. At the end of the day it doesn’t matter. But it’s worth noting.

Having said all of that, if you’re concerned about this scam actually being real, and if you’re the least bit concerned about whether your system is compromised, consult a computer professional and have them check things over. They likely won’t find anything wrong. But if it gives you peace of mind, it’s worth it.

Elon Musk put this out yesterday. Which is that he’s going to purge accounts that have had zero activity for several years:

As is typical for an Elon Musk Tweet, there’s no detail behind it. Because he likely doesn’t have all the details himself. But this is a really dumb idea for the reason that tech entrepreneur John Carnack noted:

And that doesn’t take into account dead people. I know a widow who looks at her late husband’s Twitter account on an almost daily basis because scrolling through his Tweets gives her a bit of comfort. I don’t even want to bring this up to her as her reaction is just going to be all sorts of bad. Here’s Elon’s answer to that:

Again, there’s zero detail here. But Elon isn’t a detail sort of guy so that’s not a shock. But truly, this is yet another dumb idea from Elon. And I suspect he’s doing this to force more interaction on the platform in general. Or by moving the goalposts at some point so that if you don’t Tweet at a level that he likes, you get zapped. Which would force not only people, but brands who advertise to use the platform more. Maybe I am looking at this wrong. But it sounds like something that he would do. I guess we’ll find out soon enough.

Kroll researchers detail the discovery of a new, unique ransomware operation known as Cactus that has been targeting high-profile commercial entities by exploiting Fortinet VPN vulnerabilities.

In analysis shared with Bleeping Computer, Kroll researchers described how the attackers used a batch script to obtain the encryptor binary using 7-Zip. Once the original ZIP is removed, the binary is deployed with a specific flag that allows it to execute, thereby preventing detection.

The encryption routine in Cactus ransomware attacks is unique with the following procedures after the initial VPN vulnerability exploitation:

• Establishes C2 with SSH
• Scans the network and generate target list for encryption
• Installation of remote access software for persistent access
• Push files to remote machines with RMM software
• Extract credentials from browsers and LSASS
• Install Cobalt Strike and Chisel for C2
• Disable and uninstall antivirus software
• Add administrator accounts
• Conduct exfiltration via Rclone
• TotalExec.ps1 to push and execute ransomware

Currently, there appears to be no leak site and information has not been made public about the ransoms the Cactus group has demanded.

I have three comments on this. The first is from Steve Hahn, Executive VP, BullWall:

   “This is yet another way for Ransomware to completely evade the endpoint security tools such as antivirus and EDR and highlights just how easy it is for the threat actors to kickoff a Ransomware attack despite the most sophisticated detection tools on the planet. Every year Ransomware completely takes down thousands of enterprises. In each such event the impacted companies invested heavily in prevention tools and were given guarantees such as “completely effective against Ransomware”.

   Every Ransomware event found a way to disable or evade those tools. Even the Whitehouse admits that Worsening Ransomware attacks are outpacing our ability to stop them. It’s simply a matter of time before any business is hit, loses their infrastructure for weeks and critical data permanently. We can’t continue to rely on prevention, which requires you being 100% effective 100% of the time. We must also implement Ransomware Containment tools to quickly neutralize the attack and air-gapped backup strategies to get systems restarted with the least amount of disruption. Like severe weather, you can prepare for it, but you can’t stop it.”

The next comment is from Dave Ratner, CEO, HYAS:

   “Visibility into anomalous outbound connections, indicative of communication to command-and-control, continues to grow in priority as a necessity for modern cyber protection.  As attackers find new and innovative ways to infiltrate organizations, the ability to identify the command-and-control communication and stop it before data exfiltration and encryption may be the difference between business resiliency and a significant interruption of business operations.”

The final comment is from Roy Akerman, Co-Founder & CEO, Rezonate:

   “Ransomware groups continue to find stealthy techniques to bypass defenses and be able to remotely control systems. SSH backdoors as in the case of Cactus and other remote access techniques such as webshells, provide the same control and are able to disguise as benign, light weight, traffic. SSH traffic, internal recon, use of LSASS and Cobalt Strike, tampering with security controls configuration are many steps security operations teams can better secure today. Smart security teams must take action to prevent suspicious activity on the endpoint, improve data hygiene and recovery capabilities, and limit spread of attack with least privilege access across their identity controls.”

It’s not even 9AM and already I am writing about a pair of new ransomware operations. That’s not good because it illustrates how profitable ransomware is for gangs like these. The fact that this particular ransomware has a novel way to evade detection is concerning as it also illustrates the need for defenders to come up with ways to stay at worst in lockstep with these ransomware gangs.