Brock Donnelly

Hackers Steal Over $800,000 By Dropping a Malware On Cod Community College Computer Systems

Has anyone noticed the large scale phishing attempt offer the last few months? Here is a story on a successful one. Attackers have tricked Cape Cod Community College via malware ingested through phishing. The malware quickly spread to the systems in the administration building. The malware targeted the college’s financial transactions. It appears as though it overwrote the URL address for the college’s bank, TD Bank, creating a fake site that looked and functioned like the financial institution. The cyber criminals managed to trick employees to approve 12 transactions totaling $807,130 however TD bank did stop three on suspicion. The college is looking into installing next-generation endpoint protection software across the campus.

https://thehackernews.com/2018/12/china-ransomware-wechat.html

This new ransomware has managed to infect 100,000 machines in 4 days and only asked for $14 US. This is an odd ransomware. it doesn’t ask for bitcoin but rather payment via a popular Chinese texting app. It also steals login and password information for such apps on the infected computers. It is an interesting newer take on ransomware. The attacker used a supply chain attack adding his malicious code to legitimate software.
The infection speed did not matter as is seem the author didn’t do a very good job hiding his tracks. He was arrested after 24 hours. Check out the article to see how he lead the authorities right to him.

https://thehackernews.com/2018/12/flash-player-vulnerability.html

Here is a complicated exploit. It starts with phishing and an email attachment. While the vulnerability resides in flash Word is necessary for the exploit and within a word doc you need a payload, in this example it is an image file. Once the document is opened the payload unpacks, uses Flash’s vulnerability and then can:

monitoring user activities (keyboard or moves the mouse)
collecting system information and sending it to a remote command-and-control (C&C) server,
executing shellcode,
loading PE in memory,
downloading files
execute code, and
performing self-destruction.

Adobe has since patch the vulnerability.