~Toughbooktalk~ Rob - 630-300-8877

The largest Toughbook discussion site on the net!
It is currently Sun Dec 15, 2019 6:01 pm

All times are UTC-06:00




Post new topic  Reply to topic  [ 2 posts ] 
Author Message
 Post subject: Avalanche
PostPosted: Sun Dec 11, 2016 9:08 am 
Offline
User avatar

Joined: Wed Oct 07, 2009 9:19 pm
Posts: 1514
Location: FL
Probably not news for our most tech-savvy guys, but I was not aware of this wide spread malware crime ring. Apparently the Feds recently brought it down, and are recommending everyone scan their Windoze computers to ensure they're not compromised.

from https://www.us-cert.gov/ncas/alerts/TA16-336A

Quote:
Alert (TA16-336A)
Avalanche (crimeware-as-a-service infrastructure)
Original release date: December 01, 2016 | Last revised: December 02, 2016

Systems Affected
Microsoft Windows

Overview
“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further information about Avalanche.

Description
Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.

The following malware families were hosted on the infrastructure:
Windows-encryption Trojan horse (WVT) (aka Matsnu, Injector,Rannoh,Ransomlock.P)
URLzone (aka Bebloh)
Citadel
VM-ZeuS (aka KINS)
Bugat (aka Feodo, Geodo, Cridex, Dridex, Emotet)
newGOZ (aka GameOverZeuS)
Tinba (aka TinyBanker)
Nymaim/GozNym
Vawtrak (aka Neverquest)
Marcher
Pandabanker
Ranbyus
Smart App
TeslaCrypt
Trusteer App
Xswkit

Avalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets, including the following:
TeslaCrypt
Nymaim
Corebot
GetTiny
Matsnu
Rovnix
Urlzone
QakBot (aka Qbot, PinkSlip Bot)

Impact
A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information. Some of the malware had the capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In addition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected systems could have been used to conduct distributed denial-of-service (DDoS) attacks.

Solution
Users are advised to take the following actions to remediate malware infections associated with Avalanche:
Use and maintain anti-virus software – Anti-virus software recognizes and protects your computer against most known viruses. Even though parts of Avalanche are designed to evade detection, security companies are continuously updating their software to counter these advanced threats. Therefore, it is important to keep your anti-virus software up-to-date. If you suspect you may be a victim of an Avalanche malware, update your anti-virus software definitions and run a full-system scan. (See Understanding Anti-Virus Software for more information.)

Avoid clicking links in email – Attackers have become very skilled at making phishing emails look legitimate. Users should ensure the link is legitimate by typing the link into a new browser (see Avoiding Social Engineering and Phishing Attacks for more information).
Change your passwords – Your original passwords may have been compromised during the infection, so you should change them. (See Choosing and Protecting Passwords for more information.)

Keep your operating system and application software up-to-date – Install software patches so that attackers cannot take advantage of known problems or vulnerabilities. You should enable automatic updates of the operating system if this option is available. (See Understanding Patches for more information.)

Use anti-malware tools – Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool. A non-exhaustive list of examples is provided below. The U.S. Government does not endorse or support any particular product or vendor.
ESET Online Scanner
https://www.eset.com/us/online-scanner/ (link is external)
F-Secure
https://www.f-secure.com/en/web/home_gl ... ne-scanner (link is external)
McAfee Stinger
http://www.mcafee.com/us/downloads/free ... index.aspx (link is external)
Microsoft Safety Scanner
https://www.microsoft.com/security/scan ... fault.aspx (link is external)
Norton Power Eraser
https://norton.com/npe (link is external)
Trend Micro HouseCall
http://housecall.trendmicro.com/ (link is external)

References
https://www.us-cert.gov/sites/default/f ... _mules.pdf
http://www.bankinfosecurity.com/avalanc ... aud-a-2573

_________________
ToughBooks: CF-74 73 53 52 51 31 30 29 28 27 25 19 18 08 07 C1 C2 F9 H1 M32 M33 M34 R2 S10 T8 T5 T4 T2 U1 W2 Y2 VDW07 PDRC ...
GoBooks: VR-2, XR-1, IX-260+, IX-350


Top
   
 Post subject: Re: Avalanche
PostPosted: Sun Dec 11, 2016 2:02 pm 
Offline
Toughbooktalk Founder
User avatar

Joined: Mon Mar 16, 2009 8:23 pm
Posts: 3608
Thanks Ken! Scanned it and I'm good :)

_________________
~Rob - Rugged Depot ~ Cell: (630)/300-8877~

~Fully rugged Toughbook user since April 18th 2005~
~New 3/16/18 - CF-54F0001KM Win10, Intel Core i5 6300U 2.4GHz, 240GB SSD, 12GB, Verizon 4G LTE, Intel 8260 WiFi a/b/g/n/ac, Bluetooth~
~For the wife (New 1/25/18): CF-54F0962KM/i5/128GB SSD/8GB/Win 10~
~Others: CF-52MLBBQ2M (Home Workstation)
~New 11/13/14 Donations thanks to everyone at Toughbooktalk: IBM xSeries 3650/2 x Xeon X5560 2.8GHz/16GB RAM/8 x 600GB 10KRPM SAS RAID 5/3.71TB Space/Win 2008 R2/3000VA + 1250VA Battery Backup~
~AT&T 1GB Fiber 1GB/1GB business static line~
~Gamber & Johnson Platinum Partner~

http://www.toughbooktalk.com
http://www.toughbooktalk.com/public_downloads
http://www.toughwiki.com


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 2 posts ] 

All times are UTC-06:00


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Limited