Threat Report

New Zombie Boy Crypto miner Discovered. Security Researcher James Quinn has recently discovered a new monero miner worm that appears to amass $1,000 per month and uses multiple exploits to avoid detection. Unlike MassMiner crypto currency miner, ZombieBoy leverages WinEggDrop instead of MassScan to search for new hosts to infect. Secondly, Security researchers at Check Point have revealed at DefCon 26 that a cyber criminal can infiltrate a network using a vulnerability of a fax machine protocol. Using only a fax number, an all-in-one printer-fax machine can be penetrated through Faxploit and have access to the network. The attackers just needs to send a malicious fax to a vulnerable fax machine to have access. Researchers note that attackers can then steal printed documents, mine Bitcoin, or practically anything the attacker can think of.

Malware: Zombie Boy Crypto

The tool also utilizes DoublePulsar and EternalBlue exploits to remotely install the main dll. Quinn states that the 64.exe module downloaded by ZombieBoy uses the DoublePulsar exploit to install both an SMB backdoor as well as an RDP backdoor. According to Quinn’s findings, ZombieBoy is being updated on a daily basis, and the malware will not run if it detects it is in a virtual machine environment, debilitating researchers’ ability to reverse engineer and analyze it. The miner uses Simplified Chinese language, indicating that the author may be Chinese.

For more information there are a few links below:

Securityaffairs

Spamfighter

Some Mitigation Strategies:

• File Integrity Management (FIM) to monitor for the download of a malicious .dll files
• Intrusion detection systems (IDS) would detect peer to peer communications
• Web Filtration would block or alert on outbound communication to posthash/hashnice.org
• 24x7 Security Monitoring for malicious behavior and immediate incident response

Malware: Vulnerability of a fax machine protocol

All IoT devices connected to the fax-printer such as server, router, workstations, laptops, or mobile devices would be vulnerable to the attack. Check Point collaborated with HP and used an HP Officejet Pro 6830 all-in-one printer as a test case. They were able to use EternalBlue to exploit the PCs connected to the network, and exfiltrated data by sending back a fax. Researchers collaborated with HP to provide a patch and was rolled out as an automatic update to customers. Researchers advises to check for available firmware updates and disconnect the PSTN line from the fax machine if not in use.

Checkpoint

Checkpoint

Some Mitigation Strategies:

• Segment Office Equipment network traffic to a single segment to easily monitor
• Intrusion detection systems (IDS) to monitor for broadcast from the fax machine
• Use netflow to monitor outbound traffic from your office equipment
• 24x7 Security Monitoring to check for GPS consistency with locations of vehicles

We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com

Next: Threat Report Thursday August 9th 2018