Malware on the rise, Evil Corp Malware Gang returns and Major Breach of Police Departments and Fusion Centers

Malware on the rise, Evil Corp Malware Gang returns and Major Breach of Police Departments and Fusion Centers, Info published Online.

Last week was a busy week fighting malware attacks and phishing schemes.  There were plenty of emails forwarded to me to check for validity checks... a client whose credentials were compromised and another where an associate was compromised and for some reason this external associate had my email address and I received the bogus email as well.

The email I received from my compromised client was a first.  It contained an HTML file that deposited itself into my Onedrive.  When I clicked on it, file explorer took me to my OneDrive folder and displayed a photo placed in there by the HTML code.  I never had seen that before, I deleted all instances of the file and scanned the OneDrive folder on my computer with Malwarebytes.  Next I ended up mapping a network drive to the client's online SharePoint folder, deleted all instances of the file and perform a virus scan via the network drive mapping to be certain no other threats existed.

This was an example of Fileless malware.  Many fileless attacks begin by exploiting an existing legitimate program, becoming a newly launched “sub-process,” or by using existing legitimate tools built into the OS (like Microsoft’s PowerShell). The end result is that fileless attacks are harder to detect and stop. If you aren’t already very familiar with common fileless attack techniques and programs, you probably should be if you want a career in computer security.

Be very careful while online and make sure your anti-virus software is current and up to date.  A Firewall should be in place and running.  If a website is compromised and contains code placed there by hackers, it can be downloaded and executed on your computer.  A good firewall can stop many of these attempts at the point of attack.

The following link describes 9 types of malware.

https://www.csoonline.com/article/2615925/security-your-quick-guide-to-malware-types.html

Evil Corp malware gang returns with WastedLocker ransomware

Evil Corp, one of the biggest malware operations on the internet, has slowly returned to life after several of its members were charged by the US Department of Justice in December 2019.

A Ransomware attack is not only difficult to recover from but has caused disruption in services and even caused bankruptcy of companies in the past.  It cost the City of Atlanta over $2.6 million dollars to clean up after one such attack.

  
https://www.wired.com/story/atlanta-spent-26m-recover-from-ransomware-scare/

Now comes news that one of the most successful groups is back in business after the DOJ charged several members in 2019.

https://www.zdnet.com/article/evil-corp-malware-gang-returns-with-wastedlocker-ransomware/

BlueLeaks: Data from 200 US police departments & fusion centers published online

Activist group DDoSecrets published 296 GB of police data on Friday, June 19.

https://www.zdnet.com/article/blueleaks-data-from-200-us-police-departments-fusion-centers-published-online/?ftag=TRE-03-10aaa6b&bhid=2219791&mid=12891070&cid=716603217

The DDoSecrets group has often been categorized as "an alternative to Wikileaks." The group's previous leaks have exposed major government corruption scandals across the world, and DDoSecrets' work has been cited in the New York Times, CNN, The Daily Beast, and other major publications.

DForce Intel based Workstations with SSDs, Solid State Drives.

Windows Update; Should I stay or should I Go.

Windows 10 Update 2004:  when to update.

Tuesday of this past week, 06/09/2020 was the second Tuesday of the month aka in the Microsoft realm as Patch Tuesday.  This update included patches for 129 vulnerabilities.  It was the largest Patch Tuesday ever.

Should you update?  As of June 9th, none of the bugs had been exploited in the "wild", only in lab testing.  However, malware writers are known to dissect Microsoft's monthly updates to select, find and exploit vulnerabilities that are most useful and profitable for them.

So yes it is a good idea to update your machines to keep them safe from the bad guys...  see link below for details about this update.

https://www.zdnet.com/article/microsoft-june-2020-patch-tuesday-fixes-129-vulnerabilities/?ftag=TRE-03-10aaa6b&bhid=27630927001468733386426006914379&mid=12873514&cid=1862926557

So, should you update to Windows 10 2004?

The latest version available is Windows 10 2004.  It has been delayed for 6 months due to extensive testing by Microsoft to attempt to avoid issues caused by the update.  In the Microsoft Universe, there are millions of combinations/permutations of hardware and software.  That's due to the ubiquitous installed base of Windows computers.

Also, manufacturers are always bringing new devices to the table and in many cases refuse to continue to write drivers or provide support for older devices.

After awhile even Microsoft can no longer support 10 year old processors and computers.  This is true in the Apple World as well.  I can't upgrade my old MAC to the latest version of Mac OS.  They stopped supporting it in 2014 with the Yosemite release, 10.10.

Thus far with Windows 10 Ver. 2004 there have been issues resulting in printer bugs, that stopped all print jobs on some printers.  

https://www.zdnet.com/article/windows-10-out-of-band-update-printer-bugs-fixed-as-microsoft-moves-more-of-you-to-2004/

The out-of-band update should fix Ricoh, Canon, Panasonic, and Brother printers that Windows 10 admins reported stopped working after installing the security update. 

I have read about USB ports disappearing and reappearing, BlueTooth devices not working and now there seems to be issues with Chrome and Edge browsers.

https://www.zdnet.com/article/windows-10-2004-issues-now-browser-bugs-hit-edge-startup-launches-chrome-sign-outs/

In conclusion, I would recommend delaying the upgrade to Windows Ver. 2004 until next month's Patch Tuesday, July 14th, 2020.

You can delay updates for up to 35 days by going to Settings, (left click Start Button, and click on Gear Icon), Updates and Security, 

then select Advanced Options and look for Pause Updates

In the meanwhile stay tune to this blog and I will keep you updated as to when it is safe to go back in the water.

This is my current situation;

How to determine your Windows version

When Microsoft introduces a major feature release they use the last 2 digits of the year and 2 digits of the month to define the version, so version 1803 was March 2018 and the latest is April 2020.  This is known as the Version Number.  There is also the Build Number that more precisely defines updates and hotfixes that have been applied since you last upgraded the the latest Version.

You can find this information by using the WINVER command;

• To open Run Command in Windows 10 use the shortcut key Win key+R
• Type the keyword “ winver ” and click OK.
• a Window with your Info will open.

Below is a link to a good article about Window versions and builds.

https://www.anoopcnair.com/windows-10-build-numbers-version-numbers/#Windows_10_2004

DForce Intel based Workstations

If you are running old equipment or an out of date OS, operating system, you could be putting your business and information at risk.  

Starting with the Intel 8th generation of processors, performance took a quantum leap forward, Core i3 processor cores increased from 2 to 4, Core i5 from 4 to 6 single thread cores and the Core i7 6 hyper threading cores.  In addition, SSDs are included in all DForce workstations.  Intel launched 9th generation Coffee Lake Refresh CPUs with up to eight cores.

Get up to speed today and safeguard your business and information.