Threat Intelligence Report June 18 - June 24 2024

Weekly Detected Threats

The following threats were added to Crystal Eye XDR this week:

Known exploited vulnerabilities (Week 3 - June 2024)

For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-3rd-week-of-june-2024/480

Updated Malware Signatures (Week 3 - June 2024)

Qilin Ransomware

Emerging in July 2022, Qilin ransomware, also known as Agenda, has established itself as a formidable threat actor in the cybercrime landscape. This ruthless malware operates using a double extortion model, crippling victims by encrypting their data and threatening to leak it on the dark web if ransom demands aren't met. While the exact origins of Qilin remain unclear, security researchers believe it might be linked to a cybercriminal group operating as as-a-service. This group offers its ransomware tools and expertise to affiliates who launch attacks against various targets.

Tactics, Techniques, and Procedures (TTPs):

Qilin isn't a one-trick pony. It possesses a diverse arsenal of tactics, techniques, and procedures (TTPs) to infiltrate and compromise systems. Here's a glimpse into its malicious toolkit:

• Phishing Attacks: Deceptive emails designed to trick users into clicking malicious links or downloading infected attachments are a common entry point. These emails may appear to be from trusted sources such as delivery companies, financial institutions, or even colleagues.
  
  
• Exploiting Unpatched Vulnerabilities: Qilin actively seeks out unpatched vulnerabilities in software and operating systems to gain unauthorised access to networks. This underscores the importance of keeping all software and systems updated with the latest security patches.
  
  
• Remote Desktop Protocol (RDP) Exploitation: Like other ransomware strains, Qilin can exploit weaknesses in RDP configurations to gain access to a system. RDP allows remote access to a computer, and misconfigured settings can create a vulnerability for attackers.
  
  
• Brute-Force Attacks: In some instances, Qilin may attempt to gain access through brute-force attacks, where it systematically tries different combinations of usernames and passwords until it cracks the login credentials. This highlights the importance of using strong passwords and enabling multi-factor authentication (MFA) where possible.
  
  
• Living-off-the-Land Techniques: Like many malware strains, Qilin can utilise legitimate system administration tools for malicious purposes. This makes detection more challenging as these tools may appear as normal system activity.
  
  Read all about Living-off-the-land techniques and how ATPs use them.
  
  
• Data Exfiltration: Before encryption, Qilin often exfiltrates sensitive data like financial records, personal information, and intellectual property. This stolen data serves as additional leverage in extortion attempts, putting pressure on victims to pay the ransom.
  
  
• Strong Encryption: The malware utilises robust encryption algorithms to render files inaccessible. Decrypting them without the attacker's key is extremely difficult, if not impossible. This effectively cripples a victim's operations until a decision is made.
  
  

A Global Reach with Focused Targets:

Qilin ransomware demonstrates a lack of geographical bias, targeting victims worldwide. Here are some examples of its reach and the damage it has caused:

• Critical Infrastructure: Security researchers have observed that Qilin targets critical infrastructure sectors like power grids and transportation systems. A successful attack on such infrastructure could have devastating consequences.
  
  
• Healthcare Organisations: Hospitals and other healthcare providers have also fallen victim to Qilin attacks. The disruption caused by encrypted medical records and operational systems can severely impact patient care.
  
  
• Educational Institutions: Schools and universities haven't been spared either. Data breaches involving student information or disruption of educational services can have serious consequences.
  
  

Leak Site: Qilin ransomware maintains a leak site on the dark web where they threaten to publish stolen data if the ransom is not paid.

Ransom Note: The Qilin ransomware has many different ransom notes for every victim. One of the ransom notes is given below:

The emergence of Qilin ransomware underscores the ever-evolving threat landscape of cybercrime. Its use of readily available tools combined with its focus on double extortion tactics, highlights the need for organisations to prioritise robust cybersecurity measures. Here are some crucial steps organisations can take to mitigate the risk of Qilin ransomware and similar threats:

• Regular Backups: Maintain secure, offline backups of critical data to facilitate recovery in case of a ransomware attack.
  
  
• Patch Management: Implement a rigorous patch management system to ensure all software and operating systems are updated with the latest security patches.
  
  
• Multi-Factor Authentication (MFA): Enable MFA for all user accounts wherever possible. MFA adds an extra layer of security by requiring a second verification factor beyond just a username and password.
  
  
• Security Awareness Training: Educate employees on identifying phishing attempts and other social engineering tactics used by attackers. Regular training can significantly reduce the risk of human error leading to breaches.
  
  
• Endpoint Security Solutions: Deploy endpoint security solutions that can detect and prevent malware infections at the device level. These solutions can act as a first line of defence against Qilin and other malware threats.

Kill Chain:

Indicators of Compromise (IOCs)