Health Care
Education
IT & Telecom
Government
CISO/CTO
DevSecops
Product
Our Product
We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.
Threatspy
Solutions
By Industry
Health Care
Education
IT & Telecom
By Role
Government
CISO/CTO
DevSecops
Resources
Resource Library
Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.
Threat Feeds
Threat Research
White Paper
SB Blogs
Subscribe to Our Weekly Threat Digest
Company
Contact Us
Have queries, feedback or prospects? Get in touch and we shall be with you shortly.
Our Story
Our Team
Careers
Press & Media
Contact Us
Request Demo
By submitting this form, you agree to our Subscription Agreement and Legal Policies.
Be informed in your inbox
Sign up now to our Threat intelligence Newsletter and be the first to know about threats first in your inbox.
Ransomware
Dark Power Ransomware: New Double Extortion Tactics
Discover the new Dark Power ransomware threat and learn how to protect your systems. Our threat research reveals its origin, behavior, and IoCs
27-Mar-2023
7 min read
Related Articles
APT
Learn about Kimsuky's use of ReconShark, their global campaign implications, and...
In the ever-evolving landscape of cybersecurity threats, it is crucial to stay informed about the latest developments in order to safeguard our digital environments. One such emerging concern is the ongoing series of attacks orchestrated by a North Korean threat actor group known as Kimsuky. Recent reports have shed light on their utilization of a powerful reconnaissance tool called ReconShark, indicating a significant evolution in their capabilities and techniques. In this Threat Research, we delve into the intricacies of Kimsuky's evolving threat landscape, analyze the implications of their global campaign, and explore strategies to counteract their activities effectively. ## Understanding Kimsuky's Evolving Threat Landscape Kimsuky, a threat actor group believed to be associated with North Korea, has garnered attention from cybersecurity experts due to its persistent and sophisticated cyber campaigns. Their recent deployment of ReconShark has further heightened concerns within the security community. ReconShark is a reconnaissance tool specifically designed to gather valuable intelligence about targeted organizations or individuals. By leveraging this advanced tool, Kimsuky has demonstrated an increased level of sophistication and adaptability in their cyber operations. ## The Power of ReconShark: Unveiling its Capabilities ReconShark represents a significant leap forward in Kimsuky's reconnaissance capabilities. This robust tool empowers the threat actor group to conduct highly targeted information gathering and reconnaissan ce activities across a global scale. With ReconShark at their disposal, Kimsuky can perform the following actions: 1. **Data Harvesting**: ReconShark excels in collecting sensitive data, such as personally identifiable information (PII), financial records, intellectual property, and other valuable assets. This enables Kimsuky to gain a deeper understanding of their targets and potentially exploit the acquired information for their nefarious objectives. 2. **Network Mapping**: By meticulously scanning and mapping targeted networks, ReconShark allows Kimsuky to identify potential vulnerabilities, weak points, and entry vectors for future cyberattacks. This information is invaluable in planning subsequent stages of their campaign and launching more targeted and effective attacks. 3. **Social Engineering Insights**: ReconShark's reconnaissance capabilities extend beyond technical aspects. It enables Kimsuky to gather intelligence related to their targets' social connections, organizational hierarchies, and communication patterns. Such insights aid in crafting sophisticated social engineering attacks to deceive individuals and gain unauthorized access. ## Implications of Kimsuky's Global Campaign Kimsuky's global campaign poses significant threats to targeted organizations and individuals alike. By evolving their reconnaissance capabilities through the deployment of ReconShark, they have enhanced their potential for executing highly tailored and devastating cyberattacks. The implications of Kimsuky's activities include: 1. **Data Breaches and Intellectual Property Theft**: With ReconShark's advanced data harvesting capabilities, Kimsuky can infiltrate organizations, exfiltrate sensitive data, and potentially compromise intellectual property. Such breaches can result in severe financial losses, reputational damage, and legal repercussions for the victims. 2. **Enhanced Targeted Attacks**: Through ReconShark's network mapping functionality, Kimsuky gains precise insights into target infrastructures, allowing them to craft highly targeted and tailored attacks. This significantly increases the success rate of their subsequent offensive operations and amplifies the potential damage inflicted. 3. **Heightened Social Engineering Threat**: Kimsuky's use of ReconShark to gather social engineering insights further amplifies their ability to deceive and manipulate individuals within targeted organizations. By exploiting interpersonal relationships and organizational dynamics, they can gain unauthorized access to sensitive information or compromise critical systems.
23-May-2023
1 min read
WordPress
Malware
Balada Injector: A Comprehensive Threat Research on Ongoing WordPress Malware Ca...
Balada Injector is a highly sophisticated and persistent malware campaign that targets WordPress sites. This threat research provides a detailed analysis of the Balada Injector, including its codebase, IoCs, hashing algorithms, file paths, and in-depth technical analysis. The Research aims to help security professionals understand the attack techniques used by the Balada Injector and take appropriate measures to protect their WordPress sites. WordPress is a popular platform for creating websites and blogs, and it is no surprise that cybercriminals often target it. One of the most persistent and evolving malware campaigns that target WordPress sites is the Balada Injector. This malware campaign has been active for several years and continues to evolve, making it difficult for security professionals to detect and prevent. Balada Injector is a PHP malware that injects malicious code into legitimate WordPress files. The code is obfuscated to evade detection and uses a combination of techniques to hide its presence on the infected website. The Balada Injector is modular and consists of several files, each responsible for different functionalities. The malware uses an encrypted configuration file to store its settings, making it challenging to analyze. ## Technical Analysis: The Balada Injector uses a combination of attack techniques to infect WordPress sites. The attack starts with a brute-force attack on the website's login page to gain access to the WordPress dashboard. Once the attacker has access, they upload the Balada Injector's files to the website's server. The malware then modifies the website's files to inject malicious code. The injected code is used to redirect the website's visitors to malicious websites, steal sensitive information such as login credentials, and perform other malicious activities. ## Indicators of Compromise (IoCs): To help security professionals detect and prevent the Balada Injector, the following IoCs have been identified: - File Paths: - /wp-admin/js/wp-auth-check.min.js - /wp-admin/js/user-profile.min.js - /wp-includes/js/wp-auth-check.min.js - /wp-includes/js/tinymce/plugins/wordpress/img/trans.gif - /wp-includes/js/tinymce/plugins/wpeditimage/img/delete.png - Hashing Algorithm: MD5 - Encrypted Configuration File: - /wp-content/plugins/akismet/.data.php - /wp-content/plugins/hello.php - URL Patterns: - hxxps://baladainjector[.]com/*.* - hxxps://baladacontrol[.]com/*.* Balada Injector is a highly persistent and sophisticated malware campaign that targets WordPress sites. The malware uses a combination of attack techniques to evade detection and perform malicious activities. Security professionals must take appropriate measures to protect their WordPress sites from this threat. By understanding the attack techniques used by the Balada Injector and implementing appropriate security measures, website owners can keep their sites secure.
24-Apr-2023
1 min read
IoT Devices
Botnet
Mirai
Learn about the MIRAi botnet and its devastating impact on IoT devices. Understa...
The Mirai botnet is a notorious malware that targets Internet of Things (IoT) devices. It was first discovered in 2016 and has since then caused several high-profile Distributed Denial of Service (DDoS) attacks, taking down major websites such as Twitter, Netflix, and GitHub. Mirai uses a combination of default login credentials and known vulnerabilities to infect IoT devices and turn them into botnets that can be controlled remotely. This [threat research](https://www.secureblink.com/threat-research) provides a detailed analysis of the Mirai botnet, including its technical aspects, code analysis, and attack behaviors.  ***Attack Flow*** ## Technical Analysis Mirai botnet targets IoT devices such as routers, cameras, and DVRs. The botnet primarily uses two methods to infect these devices: brute-forcing default credentials and exploiting known vulnerabilities. Once the botnet infects an IoT device, it communicates with the command and control (C&C) server to receive instructions on what action to take next. Mirai botnet is known to use a custom-built TCP protocol for communication between its bots and the C&C server. ## Code Analysis Mirai botnet is written in C and compiled using the GNU Compiler Collection (GCC). The malware is modular in nature, with each module designed to perform a specific function. The modules are loaded on the infected device based on the commands received from the C&C server. Mirai botnet contains several modules, including a scanner module that is used to scan the internet for vulnerable IoT devices, an attack module that launches DDoS attacks, and a command execution module that allows the attacker to execute commands on the infected device. ## IoCs, Hashes, and Signatures Mirai botnet can be identified by its IoCs, hashes, and signatures. Some of the IoCs associated with Mirai botnet are: IP addresses of the C&C server TCP ports used by the C&C server Binary strings used by the malware Processes associated with the malware Some of the known hashes of the Mirai botnet are: SHA1: 8e6e74f31ef37d6c9e2bca91be4d707e28de8094 MD5: 1f16ba92ec7ce1b3d88f5c31b6e29aa7 SHA256: f79b538f772f22e2d11a9e9b12f34da61cf08185c5e5a3e064008b3c097ae455 Some of the known signatures of the Mirai botnet are: ELF:Mirai-A [Trj] TR/MIRAI.WIN32.AA ## Timelines The first attack associated with the Mirai botnet was reported in September 2016, when the KrebsOnSecurity website was targeted with a DDoS attack that peaked at 620 Gbps. Since then, Mirai botnet has been responsible for several high-profile attacks, including the one that targeted DNS provider Dyn in October 2016. The botnet has continued to evolve, with new variants being discovered over time. ## Attack Behaviors Mirai botnet is primarily used for launching DDoS attacks. The botnet is capable of generating a high volume of traffic, which can take down even the most robust websites. The malware is also known to have been used for cryptocurrency mining and spreading other malware.
25-Mar-2023
1 min read
Secure Blink help Developers and Security Engineer to secure their Web Applications & APIs proactively using our cutting-edge heuristic approach.
