Tag Archive for: pic

US reveals ‘Target’ pic of Conti man with $10m reward offer • The Register

/in


The US government is putting a face on a claimed member of the infamous Conti ransomware group as part of a $10 million reward for information about five of the gang’s crew.

The State Department announced the reward via the Rewards for Justice program’s Twitter account, saying it is looking for information about cybercriminals associated with Conti, Wizard Spider, or Trickbot. Wizard Spider in May was identified as the Russia-linked group behind Conti and Ryuk (which rebranded as Conti in 2020), as well as the Trickbot botnet.

The reward notice included the aliases of the alleged attackers – “Tramp,” “Dandis,” “Professor,”Reshaev,” and “Target” – and came with a photo of a man and a message underneath it that said, “Is this the Conti associate known as ‘Target’?”

conti

The suspect’s face, terrible dress sense and bottle choice. Click to enlarge

It’s the first time the US government has released a photo of a suspect allegedly connected with Conti, although suspected members of other criminal gangs have been pictured.

“The US Government reveals the face of a Conti associate for the first time!” the Rewards for Justice (which offers counterterrorism rewards for the US government) tweet said. “We’re trying to put a name with the face! To the guy in the photo: Imagine how many cool hats you could buy with $10 million dollars!”

US agencies have been putting a lot of money behind its efforts to dismantle the Conti operation and find the people behind it. In May, the State Department announced a reward of up to $15 million for information about the top leaders behind Conti and individuals that had participated in attacks using a variant of its malware.

At the time, the government agency said Conti was the costliest strain of ransomware on record, saying that as of January, there were more than 1,000 victims of attacks that involved Conti. Payouts from those attacks surpassed $150 million – which adds up to a huge stack of…

Source…

GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic

/in


malware

A new strand of malware uses Word files with macros to download a PowerShell script from GitHub.

This PowerShell script further downloads a legitimate image file from image hosting service Imgur to decode a Cobalt Strike script on Windows systems.

Multiple researchers have linked this strain to MuddyWater (aka SeedWorm and TEMP.Zagros), a government-backed advanced persistent threat (APT) group, first observed in 2017 while mainly targeting Middle Eastern entities.

Word macro spins up PowerShell script hosted on GitHub

This week researcher Arkbird has shared details on a new macro-based malware that is evasive and spawns payload in multifaceted steps.

The malware strand which looks “like MuddyWater,” according to the researcher, ships as an embedded macro within a legacy Microsoft Word (*.doc) file, in the style of the APT group.

In tests by BleepingComputer, when the Word document is opened, it runs the embedded macro. The macro further launches powershell.exe and feeds it the location of a PowerShell script hosted on GitHub.

Word Macro with link to GitHub
Macro script embedded within the malicious Word doc
Source: BleepingComputer 

The single-line PowerShell script has instructions to download a real PNG file (shown below) from the image hosting service Imgur.

While this image itself may be benign, its pixel values are used by the PowerShell script in calculating the next stage payload, a technique known as steganography. 

Malware calculates next stage payload by decoding the image pixel values
Malware calculates the next stage payload by decoding the pixel values within this image
Source: Imgur

As observed by BleepingComputer and shown below, the payload calculation algorithm runs a foreach loop to iterate over a set of pixel values within the PNG image and performs specific arithmetic operations to obtain functional ASCII commands.

imgur payload download
PowerShell script hosted on GitHub downloads PNG from Imgur and uses it to calculate the payload
Source: BleepingComputer

Decoded script executes Cobalt Strike payload

The decoded script obtained from manipulating the PNG’s pixel values is a Cobalt Strike script.

Cobalt Strike is a legitimate penetration testing toolkit that allows attackers to deploy “beacons” on compromised devices to remotely “create shells,…

Source…