Knight ransomware distributed in fake Tripadvisor complaint emails

The Knight ransomware is being distributed in an ongoing spam campaign that pretends to be TripAdvisor complaints.

Knight ransomware is a recent rebrand of the Cyclop Ransomware-as-a-Service, which switched its name at the end of July 2023.

Who is Cyclops and Knight ransomware?

The Cyclops ransomware operation launched in May 2023 when the operators began recruiting affiliates for the new ransomware-as-a-service (RaaS) on the RAMP hacking forum.

A report by Uptycs explains that the operation launched with encryptors for Windows, macOS, and Linux/ESXi. The operation also offers affiliates information-stealing malware for Windows and Linux, which is not normally seen in RaaS operations.

Different Cyclops ransomware encryptors
Source: BleepingComputer

In addition to their normal encryptors, the operation offers a 'lite' version for use in spam and pray-and-spray mass distribution campaigns targeting large numbers of targeted users. This version appears to utilize a fixed ransom amount rather than negotiating with victims.

At the end of July, Cyclops rebranded as Knight, also stating they updated the lite encryptor to support 'batch distribution' and launched a new data leak site.

"We've updated our new panel and officially changed our name to Knight.We are looking for partners (of any kind) that!!!," reads an announcement on the old Cyclops and new Knight data leak sites.

"We have also updated the lite version to support batch distribution."

There are currently no victims or stolen files leaked on the Knight data leak site.

The Knight spam campaign

This week, Sophos researcher Felix spotted a new spam campaign pretending to be TripAdvisor complaints but distribute the Knight ransomware instead.

While the actual emails were not shared, Felix said that the emails include ZIP file attachments named 'TripAdvisorComplaint.zip' that contain an executable named 'TripAdvisor Complaint - Possible Suspension.exe' [VirusTotal].

A newer version of this campaign spotted and analyzed by BleepingComputer now includes an HTML attachment named 'TripAdvisor-Complaint-[random].PDF.htm' [VirusTotal].

When the HTML file is opened, it will use Mr.D0x's Browser-in-the-Browser phishing technique to open what appears to be a browser window to TripAdvisor.

This fake browser window pretends to be a complaint submitted to a restaurant, asking the user to review it. However, clicking the 'Read Complaint' button will download an Excel XLL file named 'TripAdvisor_Complaint-Possible-Suspension.xll' [VirusTotal], as shown below.

Fake Tripadvisor complaint attachment downloading the ransomware
Source: BleepingComputer

This XLL file is created using Excel-DNA, which integrates .NET into Microsoft Excel to execute the malware when it is opened.

When you open the XLL, Microsoft Excel will detect the Mark of the Web (MoTW), added to files downloaded from the Internet, including email. If it detects the MoTW, it will not enable the .NET add-in built into the Excel document, nullifying the attack unless a user unblocks the file.

However, if there is no MoTW flag on the file, Excel will prompt the user as to whether they want to enable the add-in, as shown below.

Excel prompting to load the .NET add-in
Source: BleepingComputer

Enabling the add-in will cause the Knight Lite ransomware encryptor to be injected into a new explorer.exe process and begin to encrypt the files on your computer.

When encrypting files, it will append the .knight_l extension to encrypted files' names, where the 'l' portion likely stands for 'lite.'

Knight encrypted files
Source: BleepingComputer

The ransomware will also create a ransom note named How To Restore Your Files.txt in each folder on the computer. The ransom note in this campaign demands $5,000 be sent to a listed Bitcoin address and also contains a link to the Knight Tor site.

However, every ransom note in this campaign seen by BleepingComputer utilizes the same Bitcoin address of '14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z,' which would make it impossible for the threat actor to determine which victim paid a ransom.

Knight ransom note
Source: BleepingComputer

As this is a Knight Lite campaign, visiting the site does not display a negotiation panel. Instead, it shows a message stating that victims should have paid the ransom demand already and to contact the affiliate at [email protected] then.

Knight ransomware Tor site
Source: BleepingComputer

At this time, it is not known if paying a ransom will result in receiving a decryptor from the Knight affiliate.

Furthermore, all the ransom notes seen by BleepingComputer utilize the same Bitcoin address, making it possible for someone else to claim a payment as theirs, essentially stealing your payment.

Therefore, it is strongly advised to refrain from paying a ransom in this campaign, as there is a good chance you will not receive a decryptor.

Security Affairs newsletter Round 432 by Pierluigi Paganini – International edition

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Police dismantled bulletproof hosting service provider Lolek Hosted Python URL parsing function flaw can enable command execution […]

The post Security Affairs newsletter Round 432 by Pierluigi Paganini – International edition appeared first on Security Affairs.

The DHS’s CSRB to review cloud security practices following the hack of Microsoft Exchange govt email accounts

The DHS’s CSRB will review cloud security practices following recent hacks of Microsoft Exchange accounts used by US govt agencies. The US DHS announced that the Cyber Safety Review Board (CSRB) will review the security measure to protect cloud computing environments following the recent compromise of Microsoft Exchange accounts used by US govt agencies. “The […]

The post The DHS’s CSRB to review cloud security practices following the hack of Microsoft Exchange govt email accounts appeared first on Security Affairs.

Multiple Flaws in CyberPower and Dataprobe Products Put Data Centers at Risk

Multiple security vulnerabilities impacting CyberPower's PowerPanel Enterprise Data Center Infrastructure Management (DCIM) platform and Dataprobe's iBoot Power Distribution Unit (PDU) could be potentially exploited to gain unauthenticated access to these systems and inflict catastrophic damage in target environments. The nine vulnerabilities, from CVE-2023-3259 through CVE-2023-3267, carry

Police dismantled bulletproof hosting service provider Lolek Hosted

A joint operation conducted by European and U.S. law enforcement agencies dismantled the bulletproof hosting service provider Lolek Hosted. Lolek Hosted is a bulletproof hosting service provider used to facilitate the distribution of information-stealing malware, and also to launch DDoS (distributed denial of service) attacks, manage fictitious online shops, manage botnet servers and distribute spam messages […]

The post Police dismantled bulletproof hosting service provider Lolek Hosted appeared first on Security Affairs.

Python URL parsing function flaw can enable command execution

A severe vulnerability in the Python URL parsing function can be exploited to gain arbitrary file reads and command execution. Researchers warn of a high-severity security vulnerability, tracked as CVE-2023-24329 (CVSS score of 7.5), has been disclosed in the Python URL parsing function that could be exploited to bypass blocklisting methods. Successful exploitation of the vulnerability […]

The post Python URL parsing function flaw can enable command execution appeared first on Security Affairs.

How the FBI goes after DDoS cyberattackers

In 2016, hackers using a network of compromised internet-connected devices — vulnerable security cameras and routers — knocked some of the then biggest websites on the internet offline for several hours. Twitter, Reddit, GitHub and Spotify all went down intermittently that day, victims of what was at the time one of the largest distributed denial-of-service […]

CVE-2023-24329: Python urllib.parse Flaw Allows Attackers to Bypass Blocklisting

A vulnerability has been discovered in the Python urllib.parse component that allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. This vulnerability, which has been assigned the identifier...

The post CVE-2023-24329: Python urllib.parse Flaw Allows Attackers to Bypass Blocklisting appeared first on Penetration Testing.

Record Labels Hit Internet Archive With New $400m+ Copyright Lawsuit

Record labels including UMG, Capitol and Sony have filed a copyright infringement lawsuit in the United States targeting Internet Archive and founder Brewster Kale, among others. Filed in Manhattan federal court late Friday, the complaint alleges infringement of 2,749 works, recorded by deceased artists, including Frank Sinatra, Billie Holiday, Louis Armstrong and Bing Crosby.

From: TF, for the latest news on copyright battles, piracy and more.

Zoom ZTP & AudioCodes Phones Flaws Uncovered, Exposing Users to Eavesdropping

Multiple security vulnerabilities have been disclosed in AudioCodes desk phones and Zoom's Zero Touch Provisioning (ZTP) that could be potentially exploited by a malicious attacker to conduct remote attacks. "An external attacker who leverages the vulnerabilities discovered in AudioCodes Ltd.'s desk phones and Zoom's Zero Touch Provisioning feature can gain full remote control of the devices,"

UK govt contractor MPD FM leaks employee passport data

UK govt contractor MPD FM left an open instance that exposed employee passports, visas, and other sensitive data MPD FM, a facility management and security company providing services to various UK government departments, left an open instance that exposed employee passports, visas, and other sensitive data. MPD FM boasts of being the UK’s leading “facility […]

The post UK govt contractor MPD FM leaks employee passport data appeared first on Security Affairs.

Power Generator in South Africa hit with DroxiDat and Cobalt Strike

Threat actors employed a new variant of the SystemBC malware, named DroxiDat, in attacks aimed at African critical infrastructure. Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) reported that an unknown threat actor used a new variant of the SystemBC proxy malware, named DroxiDat, in an attack against a power generation company in southern Africa. SystemBC was […]

The post Power Generator in South Africa hit with DroxiDat and Cobalt Strike appeared first on Security Affairs.

Lolek Bulletproof Hosting Servers Seized, 5 Key Operators Arrested

European and U.S. law enforcement agencies have announced the dismantling of a bulletproof hosting service provider called Lolek Hosted, which cybercriminals have used to launch cyber-attacks across the globe. "Five of its administrators were arrested, and all of its servers seized, rendering LolekHosted.net no longer available," Europol said in a statement. "The service facilitated the

New Python URL Parsing Flaw Enables Command Injection Attacks

A high-severity security flaw has been disclosed in the Python URL parsing function that could be exploited to bypass domain or protocol filtering methods implemented with a blocklist, ultimately resulting in arbitrary file reads and command execution. "urlparse has a parsing problem when the entire URL starts with blank characters," the CERT Coordination Center (CERT/CC) said in a Friday

Hackers Leak PII Data and Photos of Plastic Surgery Patients

By Waqas

The victim of the data breach is the Roberto Polizzi Plastic Surgery Clinic based in Belo Horizonte, Brazil.

This is a post from HackRead.com Read the original post: Hackers Leak PII Data and Photos of Plastic Surgery Patients

The Week in Ransomware - August 11th 2023 - Targeting Healthcare

While some ransomware operations claim not to target hospitals, one relatively new ransomware gang named Rhysida doesn't seem to care.

Rhysida launched in May 2023, when it quickly started to make a name for itself as it made indiscriminate attacks on hospitals, the enterprise, and even government agencies.

The group first came to notoriety after attacking the Chilean Army (Ejército de Chile) and leaking stolen data.

Now the ransomware gang is making the headlines due to its targeting of healthcare, with the group believed to be behind the attacks on Prospect Medical Group, impacting 17 hospitals and 166 clinics across the United States.

This led to a flurry of reports released by the U.S. Department of Health and Human Services, Trend Micro, Cisco Talos, and Check Point Research.

We also saw additional reports on ransomware about TargetCompany, code leaks impacting the RaaS ecosystem, and a new threat actor using a customized version of Yashma ransomware.

In other news, we continue to see the fallout from Clop's MOVEit data-theft attacks, with Missouri's Department of Social Services warning that data was stolen from IBM's MOVEit server.

Finally, Europol and the U.S. Department of Justice announced the takedown of the LOLEKHosted bulletproof hosting provider, saying that one of the arrested admins facilitated Netwalker ransomware attacks by hosting storage servers for the gang.

Contributors and those who provided new ransomware information and stories this week include: @Seifreed, @struppigel, @Ionut_Ilascu, @serghei, @LawrenceAbrams, @malwrhunterteam, @billtoulas, @demonslay335, @BleepinComputer, @HHSGov, @TrendMicro, @TalosSecurity, @_CPResearch_, @IRS_CI, and @pcrisk.

August 7th 2023

New threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware

Talos assesses with high confidence that this threat actor is targeting victims in English-speaking countries, Bulgaria, China and Vietnam, as the actor’s GitHub account, “nguyenvietphat,” has ransomware notes written in these countries’ languages. The presence of an English version could indicate the actor intends to target a wide range of geographic areas.

Code leaks are causing an influx of new ransomware actors

Ransomware gangs are consistently rebranding or merging with other groups, as highlighted in our 2022 Year in Review, or these actors work for multiple ransomware-as-a-service (RaaS) outfits at a time, and new groups are always emerging.

TargetCompany Ransomware Abuses FUD Obfuscator Packers

We found active campaign deployments combining remote access trojan (RAT) Remcos and the TargetCompany ransomware earlier this year. We compared these deployments with previous samples and found that these deployments are implementing fully undetectable (FUD) packers to their binaries. By combining telemetry data and external threat hunting sources, we were able to gather early samples of these in development. Recently, we found a victim on which this technique was deployed and targeted specifically at.

New STOP ransomware variants

PCrisk found new STOP ransomware variants that append the .yyza and .yytw extensions.

New Dharma ransomware variant

PCrisk found a new Dharma variant that appends the .GPT extension.

August 8th 2023

THE RHYSIDA RANSOMWARE: ACTIVITY ANALYSIS AND TIES TO VICE SOCIETY

The Rhysida ransomware group was first revealed in May this year, and since then has been linked to several impactful intrusions, including an attack on the Chilean Army. Recently the group was also tied to an attack against Prospect Medical Holdings, affecting 17 hospitals and 166 clinics across the United States. After this attack, the US Department of Health and Human Services defined Rhysida as a significant threat to the healthcare sector.

What Cisco Talos knows about the Rhysida ransomware

Cisco Talos is aware of the recent advisory published by the U.S. Department of Health and Human Services (HHS) warning the healthcare industry about Rhysida ransomware activity.

New Xorist variant

PCrisk found a new Xorist ransomware variant that appends the .PrOToN extension and drops a ransom note named HOW TO DECRYPT FILES.txt.

August 9th 2023

Missouri warns that health info was stolen in IBM MOVEit data breach

Missouri's Department of Social Services warns that protected Medicaid healthcare information was exposed in a data breach after IBM suffered a MOVEit data theft attack.

Rhysida ransomware behind recent attacks on healthcare

The Rhysida ransomware operation is making a name for itself after a wave of attacks on healthcare organizations has forced government agencies and cybersecurity companies to pay closer attention to its operations.

An Overview of the New Rhysida Ransomware Targeting the Healthcare Sector

On August 4, 2023, the HHS’ Health Sector Cybersecurity Coordination Center (HC3) released a security alert about a relatively new ransomware called Rhysida (detected as Ransom.PS1.RHYSIDA.SM), which has been active since May 2023. In this blog entry, we will provide details on Rhysida, including its targets and what we know about its infection chain.

August 10th 2023

New Harward ransomware

PCrisk found a new ransomware variant that appends the .harward extension.

August 11th 2023

LOLEKHosted admin arrested for aiding Netwalker ransomware gang

Police have taken down the Lolek bulletproof hosting provider, arresting five individuals and seizing servers for allegedly facilitating Netwalker ransomware attacks and other malicious activities.

New MedusaLocker variant

PCrisk found a new ransomware variant that appends the .alock extension.

That's it for this week! Hope everyone has a nice weekend!

Friday Squid Blogging: NIWA Annual Squid Survey

Results from the National Institute of Water and Atmospheric Research Limited annual squid survey:

This year, the team unearthed spectacular large hooked squids, weighing about 15kg and sitting at 2m long, a Taningia—­which has the largest known light organs in the animal kingdom­—and a few species that remain very rare in collections worldwide, such as the “scaled” squid Lepidoteuthis and the Batoteuthis skolops.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Security Pressures Mount Around AI's Promises & Peril

Both threats to enterprises and career opportunities are being created by the escalation of generative AI and ChatGPT, warns Maria 'Azeria' Markstedter.

IP Address Blocking Banned After Anti-Piracy Court Order Hit Cloudflare

In 2022, rightsholders obtained permission in Austria to block several pirate site domains and a list of IP addresses that actually belonged to Cloudflare. ISPs had no choice but to comply with the court's instructions which took out countless Cloudflare customers in Austria. According to reviews conducted by local telecoms regulator TKK, the IP address blocking violated net neutrality regulations and will no longer be allowed.

From: TF, for the latest news on copyright battles, piracy and more.

DARPA Taps RTX to Attune AI Decisions to Human Values

Fortinet Announces Free Security Awareness Curriculum for K-12 Students Tied to White House's Cyber Initiatives

St. Poelten UAS | Multiple Vulnerabilities in Phoenix Contact TC Cloud Client / TC Router / Cloud Client

Posted by Weber Thomas via Fulldisclosure on Aug 11

St. Pölten UAS
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| Phoenix Contact TC Cloud Client 1002-4G*,
| TC Router 3002T-4G, Cloud Client 1101T-TX/TX
vulnerable version| <2.07.2, <2.07.2, <2.06.10
fixed version| 2.07.2, 2.07.2, 2.06.10
CVE number| CVE-2023-3526, CVE-2023-3569
impact|...

St. Poelten UAS | Multiple XSS in Advantech EKI 15XX Series

Posted by Weber Thomas via Fulldisclosure on Aug 11

St. Pölten UAS
-------------------------------------------------------------------------------
title| Multiple XSS in Advantech
product| Advantech EKI-1524-CE series, EKI-1522 series,
| EKI-1521 series
vulnerable version| <=1.21 (CVE-2023-4202), <=1.24 (CVE-2023-4203)
fixed version| 1.26
CVE number| CVE-2023-4202, CVE-2023-4203
impact| Medium...

Qualys mis-uses ssh, fails to scan and protect, facilitates internal attack

Posted by Paul Szabo via Fulldisclosure on Aug 11

=== Introduction ===================================================

My institution uses Qualys

www.qualys.com

to scan for vulnerabilities, including on some Debian Linux machines
that I manage. The scanner does some network scans, and also logs in
to each machine to do "authenticated scans".

=== Discovery ======================================================

When I recently updated my machines from Debian11 to Debian12, the...

MoustachedBouncer Hackers Caught Spying on Embassies

By Deeba Ahmed

MoustachedBouncer is a Belarusian government-backed hacking group that has been active since 2014.

This is a post from HackRead.com Read the original post: MoustachedBouncer Hackers Caught Spying on Embassies