Tag Archive for: Version

Hackers Exploit Interest in Criminal Version of ChatGPT to Scam Other Crooks


A malicious version of ChatGPT designed to assist cybercriminals has ended up scamming crooks interested in buying access to the service.

In July, we wrote about WormGPT, a chatbot built from open-source code that promised to help hackers churn out phishing messages and malware in return for a monthly fee. The news set off concerns that generative AI could lower the bar for computer hacking, thus fueling cybercrime.

But in a bit of irony, it looks like the WormGPT brand has become more of a threat to hackers than to the public. Antivirus provider Kaspersky noticed several websites that claim to offer access to WormGPT, but seem designed to scam would-be customers into giving up their funds, without actually getting access to WormGPT.

The sites, which can be found on the open internet and through a Google search, have been dressed up with official-looking information about WormGPT. However, Kaspersky suspects the pages are really just phishing pages, designed to trick users in submitting their credit card information or forking over their cryptocurrency to access the malicious chatbot. 

The websites are also likely fake because the creator of WormGPT apparently abandoned the project last month after his identity was exposed. According to security journalist Brian Krebs, WormGPT’s creator is a 23-year-old Portuguese programmer named Rafael Morais, who has since backtracked on marketing his chatbot for malicious purposes. 

Following the report, the user account promoting WormGPT announced in a hacking forum that their team was bailing on the project. “With great sadness, I come to inform everyone about the end of the WormGPT project. From the beginning, we never thought we would gain this level of visibility, and our intention was never to create something of this magnitude,” the account wrote

Weeks before the shutdown, the official WormGPT account on Telegram also warned about scammers impersonating the chatbot’s brand. “We don’t have any website and either any other groups in any platform,” the post said. “The rest are resellers or scammers!”

“Can’t believe how people still getting scammed in 2023,” the same account later added. 

But even though WormGPT…

Source…

Avast released a free decryptor for Windows version of Akira ransomwareSecurity Affairs


Avast released a free decryptor for the Akira ransomware that can allow victims to recover their data without paying the ransom.

Cybersecurity firm Avast released a free decryptor for the Akira ransomware that can allow victims to recover their data without paying the ransom.

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate,

Akira is a Windows ransomware with a 64-bit Windows binary, it is written in C++ and uses the Boost library to implement the asynchronous encryption code. The authors used Microsoft Linker version 14.35. 

In June 2023, the malware analyst rivitna published a sample of the ransomware that is compiled for Linux. This Linux version is 64-bit and also uses the Boost library, it uses the Crypto++ library instead of Windows CryptoAPI.

“During the run, the ransomware generates a symmetric encryption key using CryptGenRandom(), which is the random number generator implemented by Windows CryptoAPI. Files are encrypted by Chacha 2008 (D. J. Bernstein’s implementation).” reads the report published by Avast.

“The symmetric key is encrypted by the RSA-4096 cipher and appended to the end of the encrypted file. Public key is hardcoded in the ransomware binary and differs per sample.”

The ransomware appends .akira extension to the encrypted files and drops a ransom note named akira_readme.txt in each folder.

Akira ransomware

The researchers discovered a few similarities between the Akira ransomware and the Conti v2 ransomware, a circumstance that suggests the authors may have used the leaked source code of the Conti ransomware.

The list of similarities includes:

  1. List of file type exclusions.
  2. List of directory exclusions.
  3. The structure of the Akira file tail is equal to the file tail appended by Conti.

The first step is to download the decryptor binary. Avast provides a 64-bit decryptor, as the ransomware is also a 64-bit and can’t run on 32-bit Windows. If you have no choice but to use 32-bit applications, you may download 32-bit decryptor here.

Avast released both a 64-bit decryptor and a 32-bit Windows…

Source…

New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide


Mar 10, 2023Ravie LakshmananEndpoint Security / Hacking

Prometei Botnet

An updated version of a botnet malware called Prometei has infected more than 10,000 systems worldwide since November 2022.

The infections are both geographically indiscriminate and opportunistic, with a majority of the victims reported in Brazil, Indonesia, and Turkey.

Prometei, first observed in 2016, is a modular botnet that features a large repertoire of components and several proliferation methods, some of which also include the exploitation of ProxyLogon Microsoft Exchange Server flaws.

It’s also notable for avoiding striking Russia, suggesting that the threat actors behind the operation are likely based in the country.

The cross-platform botnet’s motivations are financial, primarily leveraging its pool of infected hosts to mine cryptocurrency and harvest credentials.

The latest variant of Prometei (called v3) improves upon its existing features to challenge forensic analysis and further burrow its access on victim machines, Cisco Talos said in a report shared with The Hacker News.

Prometei Botnet

The attack sequence proceeds thus: Upon gaining a successful foothold, a PowerShell command is executed to download the botnet malware from a remote server. Prometei’s main module is then used to retrieve the actual crypto-mining payload and other auxiliary components on the system.

Some of these support modules function as spreader programs designed to propagate the malware through Remote Desktop Protocol (RDP), Secure Shell (SSH), and Server Message Block (SMB).

WEBINAR

Discover the Hidden Dangers of Third-Party SaaS Apps

Are you aware of the risks associated with third-party app access to your company’s SaaS apps? Join our webinar to learn about the types of permissions being granted and how to minimize risk.

RESERVE YOUR SEAT

Prometei v3 is also noteworthy for using a domain generation algorithm (DGA) to build out its command-and-control (C2) infrastructure. It further packs in a self-update mechanism and an expanded set of commands to harvest sensitive data and commandeer the host.

Last but not least, the malware deploys an Apache web server that’s bundled with a PHP-based web shell, which is capable of executing Base64-encoded…

Source…

NSA Publishes Internet Protocol Version 6 (IPv6) Security Guidance


The National Security Agency (NSA) published guidance today to help Department of Defense (DoD) and other system administrators identify and mitigate security issues associated with a transition to Internet Protocol version 6 (IPv6).

IPv6 Security Guidance” highlights how several security issues can surface in networks that are new to IPv6, or in early phases of the IPv6 transition. Networks new to IPv6 lack maturity in IPv6 configurations and tools, and dual-stacked networks, which run on IPv4 and IPv6 simultaneously, have an increased attack surface.

“The Department of Defense will incrementally transition from IPv4 to IPv6 over the next few years and many DoD networks will be dual-stacked,” said Neal Ziring, NSA Cybersecurity Technical Director. “It’s important that DoD system admins use this guidance to identify and mitigate potential security issues as they roll out IPv6 support in their networks.”

Read the full report here.

Read more at NSA

Source…