Last week in security news, researchers detected a spate of advanced phishing attacks targeting Android smartphones. They also spotted various malware abusing Cloudflare Workers, new vulnerabilities and attackers using back-to-school season as a means to increase their reach. Finally, analysts discovered a new variant of one ransomware family and observed another ransomware threat leveraging fake forum posts on compromised sites for distribution.

Top Story of the Week: Android Mobile Devices Under Attack

Earlier in 2019, Check Point researchers discovered that Android phones produced by four major tech organizations were susceptible to over-the-air (OTA) provisioning as an attack vector. Specifically, they found that it was possible for users of these companies’ smartphones to receive malicious settings via weakly authenticated provisioning messages. Through those means, bad actors could have tricked users into accepting new settings that would have routed their internet traffic through a proxy under the attackers’ control, for instance.

Check Point shared its findings with the four affected vendors in March. Two of the vendors released fixes, one said it intended to address the issue in the next generation of its smartphones and the last refused to acknowledge the vulnerability with respect to its devices.

Source: iStock

Also in Security News

• Students Targeted With School-Themed Malware: Kaspersky Lab uncovered more than 300,000 attempts to infect its users with school-themed malware. Most of those attempts consisted of malware disguised as academic essays, though a fair portion tricked users into downloading what they thought were school textbooks. With the new school year underway, students and higher education institutions should be on the lookout for malicious files hiding in online resources.
• Cloudflare Workers Abused by Astaroth Threat Actor: Endpoint security and malware researcher Marcel Afrahim spotted the threat actor behind Astaroth using Cloudflare Workers. This technique enabled the actor to escape detection and fool traditional security solutions by hiding from sandboxes and interrupting automated analysis tools, among other tactics.
• Malvertising Campaign Relies on WordPress Plugin Bugs: In August, WordFence observed that a malvertising campaign that it began tracking in July exploited known vulnerabilities affecting WordPress plugins to inject JavaScript into victims’ sites. That script, in turn, redirected victims to fraudulent sites hosting malicious droppers and other threats.
• Sodinokibi Ransomware Spread by Fake Forum Posts on Hacked Sites: Bleeping Computer observed attackers hacking into WordPress websites and abusing that access to inject JavaScript into their HTML. This code displayed a fake forum post to visitors; it contained a URL that, when clicked, redirected them to a compromised website that ultimately loaded Sodinokibi ransomware.
• New Version of JSWorm Ransomware Uncovered: Researchers at Yoroi Security came across the fourth version of JSWorm, a ransomware family that, despite its name, employs neither JavaScript nor wormlike behavior. The security firm found that this version behaves like many other ransomware families by achieving persistence and deleting Shadow Volume Copies.
• Malvertising Campaign Distributes Glupteba Dropper: Trend Micro looked into a malvertising campaign and saw that it distributed a dropper for Glupteba, an older family of malware. A closer look by the researchers revealed that the Glupteba dropper could retrieve the latest command-and-control (C&C) domain from bitcoin transactions.
• Fraudsters Abusing SCA in Phishing Emails: In an analysis of phishing emails targeting European Union (EU) and U.K. banks, Which? observed that fraudsters were abusing strong customer authentication (SCA) to prey upon recipients. Attackers used the premise of these new security checks to trick users into handing over their personal banking credentials.

Security Tip of the Week: Counter Ransomware Using a Layered Approach

In its analysis of Sodinokibi, Bleeping Computer provided a recommendation on how organizations can help defend against ransomware infections borne by a WordPress compromise:

“To protect yourself from an attack like this, be sure to have some sort of security software installed with real-time protection and never execute files that end with the .js extension.”

Security professionals can further help protect their organizations by taking a layered approach to ransomware defense. This strategy should employ anti-spam tools, data backups and security awareness training for all employees. Companies should also look to invest in an integrated solution that streamlines their implementation of key management, access monitoring and other security controls in the face of ransomware.