Cyber Training Group International (CTGI)

Tag: cyberattack

  • Beware of Computer Worms

    Beware of Computer Worms

    The first computer worm to spread extensively across the internet was the Morris Worm, released on November 2, 1988.

    This computer worm was created by Robert Tappan Morris, a graduate student at Cornell University, it was originally designed as an experiment to gauge the size of the early internet. However, a design flaw caused it to replicate much faster than intended, leading to the first major cyberattack in history.

    Within 24 hours, it infected approximately 6,000 computers, which was about 10% of the internet at the time. It exploited vulnerabilities in the Unix operating system, specifically in programs like sendmail and the finger service. The worm didn’t delete data, but it reinfected machines multiple times, consuming so much processing power that it caused systems to crash or become unusable.

    SO WHAT IS A COMPUTER WORM?

    A computer worm or digital worm is a standalone malware computer program designed to replicate itself and spread across networks without requiring human interaction.

    However, unlike computer viruses, these digital worms don’t require a host file or program to latch onto. Instead, they exist as self-contained files or scripts.

    While both are types of malicious software (malware) that replicate themselves and damage computer systems, the main difference is how they spread. Computer viruses require a “host” and human interaction to spread, whereas computer worms are standalone programs that spread by themselves across networks.


    WHAT ARE THE MAIN DIFFERENCES BETWEEN A COMPUTER VIRUS AND A
    COMPUTER WORM?

    Computer Virus
    A computer virus attaches itself to a clean computer program or file (host) and hides there. It stays completely still until a user accidentally opens the infected file or runs the program. Once activated, the virus infects other files and spreads when the user shares those files with others. Computer virus takes time to spread because it relies on human movement.


    Computer Worms
    A computer worm is a standalone, independent program. It does not need a host file to exist, nor does it need you to click anything. Once a computer worm gets onto your device (often through a network connection or software loophole), it replicates itself and spread automatically. Computer worms spread rapidly through network connections such as the internet and Local Area Network.

    Internet Image
    Computer Worms can spread across the Internet and Local Area Network.


    Both computer worm and computer virus can harm your device, delete files, or steal personal information.
    To keep your devices and data safe while browsing, you don’t need to be a tech expert—you just need to stay alert. Here are the most effective habits to adopt:

    1. Check for the “Padlock”
    Always look at the address bar for HTTPS (and the padlock icon) before entering any passwords or credit card info. This means your connection is encrypted, making it much harder for hackers to “listen in” on your data.

    2. Be Skeptical of Links and Pop-ups
    Think before you click:     Hover your mouse over a link to see the actual URL destination in the bottom corner of your browser. If it looks gibberish or slightly misspelled (like g00gle.com instead of google.com), stay away.

    Avoid “Free” Traps: Sites offering free movie streams or cracked software are prime breeding grounds for the worms and viruses we discussed.

    3. Use a Password Manager
    Reusing the same password is a huge risk. Use a password manager (like Bitwarden, Google Password Manager or 1Password) to create and store unique, complex passwords for every site. This way, if one site gets hacked, your other accounts stay safe.

    4. Enable Two-Factor Authentication (2FA)
    Even if a hacker gets your password, 2FA acts as a second lock. Always choose an authenticator app or a security key over SMS (text) codes when possible, as they are more secure.

    5. Keep Your Browser Updated
    Those “Update Available” pop-ups are actually critical. They often contain security patches for newly discovered vulnerabilities that hackers are already trying to exploit.

    6. Use an Ad Blocker
    Many malicious scripts (malvertising) are delivered through shady ads. Using an extension like uBlock Origin can stop these scripts from even loading on your page.

    Experts are warning about computer “worms” created with AI that can infect devices and harm users without restraint. University of Toronto professor Nicolas Papernot joins with more. Credits: CBS NEWS

    TYPES OF COMPUTER WORMS

    1) Email Worms
    Also called mass-mailer worms, they propagate by sending copies of themselves (whether as email attachments or malicious links). Upon opening the file or clicking on the link, a worm will activate, and it will have access to contacts of the recipient to continue spreading.


    2) File-sharing Worms
    Since file-sharing worms allow infected users to hide behind the guise of real media files, they are shared in filesharing aids. Once the file is downloaded by a user, the worm turns the device into an evil server that may accumulate personal data or credentials to be used or sold.

    3) Crypto Worms
    Crypto worms are like ransomware. They spread through systems, encrypt files of users, and then request that decryption key be returned by payment, typically in cryptocurrency. These worms can lock down entire networks if not contained.

    4) Internet Worms
    This category of Computer Worms has the specific purpose of targeting widely used websites with weak Cyber Security measures. The goal of these worms is to infiltrate the website’s system, which then allows them to spread to any computer that has accessed the site and infect them as well.

    5) Instant Messaging Worms
    The worms sent by Instant Messaging Worms exploit an instant messaging program and social media by spitting off impersonation links or files sent by a trusted source. They are usually filled with clickbait, making a user unintentionally infect himself or herself and share it with others.

    6) IRC Worms
    Internet Relay Chat (IRC) Worms spread into chat rooms or forums through the vulnerability of IRC clients. They transmit virulent links or move orders to the people and propagate at high-speed using real-time chats.

    7) P2P Worms
    P2P Worms take advantage of peer-to-peer file-sharing programs by assuming the form of desirable downloadable content. After being downloaded, they multiply through shared folders and also linked users, so infection becomes widespread even without the knowledge of the user.


    Computer Worm Examples

    1) Morris (1988)
    Created by Robert Morris, this worm unintentionally overloaded 6,000 UNIX Operating Systems leading to crashes and damages up to £8 million.

    2) Mydoom (2004)
    Targeting Windows systems, Mydoom became one of the fastest-spreading worms, causing an estimated £30 billion in damages. It persists, accounting for a significant portion of malicious emails.

    3) Storm Worm (2007)
    Storm Worm was carried by emails with eye catching headlines like 230 killed as storm swept Europe which even fooled the user into clicking. After activation, it infected systems, making them a botnet to send spam and attack computers with millions of computers.

    4) ILOVEYOU (2020)
    ILOVEYOU was a love letter worm which made itself known as a love letter, also called the Love Bug. It hit more than 50 million devices within two weeks of its outbreak and resulted in clean-up and recovery costs which amount to about 12 billion pounds.

    5) Conficker
    Also referred to as Downup or Kido, Conficker exploited vulnerabilities in Microsoft Windows to spread rapidly. It infected millions of computers across more than 100 countries. It disrupted networks worldwide and demonstrated how unpatched systems can be compromised at a massive scale.

    6) Code Red
    Code Red was a widespread Computer Worm that emerged in 2001, infecting more than 300,000 systems. It targeted Microsoft IIS web servers and generated massive traffic from compromised machines, even overwhelming high-profile websites such as that of the White House.

    How do I know if I have a computer worm?

    Computer worms are a type of self-replicating malware. Because they consume resources and spread without your knowledge, they typically leave behind specific red flags.

    Signs of a Computer Worm Infection

    1. Sudden Performance Drops: Unusually high CPU usage, frequent freezing, or a sluggish system.
    2. Rapidly Disappearing Hard Drive Space: Because worms replicate repeatedly, they can eat up large chunks of your storage.
    3. Network Activity Outburst: Your internet becomes incredibly slow, or you notice unusually high network traffic even when you aren’t browsing.
    4. Unfamiliar Emails: People in your contact list receive strange or spam emails that you never sent.
    5. Missing or Strange Files: System files go missing, or you notice unknown programs/folders suddenly appearing on your hard drive.
    6. Programs Running Automatically: Web browsers or programs launching on their own without you clicking them.

    How to Confirm and Remove the Worm

    Disconnect the Network: Unplug your Ethernet cable or turn off Wi-Fi. This isolates the computer worm so it cannot infect other devices.

    1. Run an Offline Antivirus Scan:
    • Windows: Open the Windows Security app, go to Virus & threat protection > Scan options, and select Microsoft Defender Antivirus offline scan. The PC will restart and perform a deep, 15-minute scan while the malware is inactive.

    2. Check Task Manager:

    • Press Ctrl + Shift + Esc to open Task Manager.
    • Look for any unusual processes taking up massive amounts of
      memory or using unfamiliar names.
    • If you spot a suspicious process, right-click and open its file
      location to delete it.

    3. Use an On-Demand Scanner:

    • Once you have completed the built-in scan, download a reliable
      on-demand tool like Malwarebytes.
    • Free Scan to catch anything the primary antivirus might have
      missed.

  • US Treasury says Chinese hackers stole documents in ‘major incident’

    US Treasury says Chinese hackers stole documents in ‘major incident’

    WASHINGTON (Reuters) -Chinese state-sponsored hackers breached the U.S. Treasury Department’s computer security guardrails this month and stole documents in what Treasury called a “major incident,” according to a letter to lawmakers that Treasury officials provided to Reuters on Monday.

    The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.

    According to the letter, hackers “gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”

    “Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the letter said.

    The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the hack’s impact.

    Treasury officials didn’t immediately respond to an email seeking further details about the hack. The FBI did not immediately respond to Reuters’ requests for comment, while CISA referred questions back to the Treasury Department.

    “China has always opposed all forms of hacker attacks,” Mao Ning, a spokesperson for China’s foreign ministry, told a regular news conference on Tuesday.

    A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing “firmly opposes the U.S.’s smear attacks against China without any factual basis.”

    A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company “previously identified and took measures to address a security incident in early December 2024” involving its remote support product. BeyondTrust “notified the limited number of customers who were involved,” and law enforcement was notified, the spokesperson said. “BeyondTrust has been supporting the investigative efforts.”

    The spokesperson referred to a statement posted on the company’s website on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated on Dec. 18.

    Tom Hegel, a threat researcher at cybersecurity company SentinelOne, said the reported security incident “fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services – a method that has become increasingly prominent in recent years,” he said, using an acronym for the People’s Republic of China.”

    Credit: Reuters

  • New ransomware encrypts files, then steals your Discord account

    New ransomware encrypts files, then steals your Discord account

    The new ‘AXLocker’ ransomware family is not only encrypting victims’ files and demanding a ransom payment but also stealing the Discord accounts of infected users.

    When a user logs into Discord with their credentials, the platform sends back a user authentication token saved on the computer. This token can then be used to log in as the user or to issue API requests that retrieve information about the associated account.

    Threat actors commonly attempt to steal these tokens because they enable them to take over accounts or, even worse, abuse them for further malicious attacks.

    As Discord has become the community of choice for NFT platforms and cryptocurrency groups, stealing a moderator token or other verified community member could allow threat actors to conduct scams and steal funds.

    AxLocker is a two-in-one threat

    Researchers at Cyble recently analyzed a sample of the new AXLocker ransomware and discovered that it not only encrypts files but also steals a victim’s Discord tokens.

    As ransomware, there is nothing particularly sophisticated about the malware or the threat actors who use it.

    When executed, the ransomware will target certain file extensions and exclude specific folders, as shown in the image below.

    Targeted files (left) and excluded directories (right)
    Targeted files (left) and excluded directories (right) (Cyble)

    When encrypting a file, AXLocker uses the AES algorithm, but it does not append a filename extension on the encrypted files, so they appear with their normal names.

    Next, AXLocker sends a victim ID, system details, data stored in browsers, and Discord tokens to the threat actors’ Discord channel using a webhook URL.

    To steal the Discord token, AxLocker will scan the following directories for and extract tokens using regular expressions:

    • Discord\Local Storage\leveldb
    • discordcanary\Local Storage\leveldb
    • discordptb\leveldb
    • Opera Software\Opera Stable\Local Storage\leveldb
    • Google\Chrome\User Data\\Default\Local Storage\leveldb
    • BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb
    • Yandex\YandexBrowser\User Data\Default\Local Storage\leveldb
    AXLocker's grab function
    AXLocker’s grab function (Cyble)

    Eventually, victims are served a pop-up window containing the ransom note, informing them that their data was encrypted and how they contact the threat actor to purchase a decryptor.

    Victims are given 48 hours to contact the attackers with their victim ID, but the ransom amount isn’t mentioned in the note.

    AXLocker ransom note
    AXLocker ransom note (Cyble)

    While this ransomware clearly targets consumers rather than the enterprise, it could still pose a significant threat to large communities.

    Therefore, if you find that AxLocker encrypted your computer, you should immediately change your Discord password, as it will invalidate the token stolen by the ransomware.

    While this may not help recover your files, it will prevent further compromise of your accounts, data, and the communities you are involved in.

    Credits: bleepingcomputer.com

  • FBI warns about ongoing Google Voice authentication scams

    The Federal Bureau of Investigation (FBI) says Americans who share their phone number online are being targeted by Google Voice authentication scams.

    As the federal law enforcement agency explains, the fraudsters are targeting those who have posted their phone number as a form of contact when trying to sell various items on online marketplaces or social media apps.

    “Recently, we have also been getting reports of people who are getting targeted in other locations, including sites where you post about lost pets,” the FBI said.

    If successful, they will set up a Google Voice account in their victims’ names or hijack their Gmail accounts which will later be used in other fraud schemes or in phishing attacks.

    The scammers will reach out to their targets via text messages or email showing their interest in the item put up for sale, asking the seller to verify their offer is legitimate and they’re a real person and not a bot by sharing an authentication code they’ll receive from Google.

    “What he is really doing is setting up a Google Voice account in your name using your real phone number as verification,” the agency added.

    “Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”

    Also Read: MASSIVE ATTACK AGAINST 1.6 MILLION WORDPRESS SITES UNDERWAY

    What to do if you’re the target of an authentication scam

    The FBI advises victims of Google Voice authentication scams to check Google’s support website for information on how to retake control of their Google Voice account and reclaim their Voice number.

    The federal agency also provides the following tips on to avoid getting scammed in the first place if you’re ever targeted:

    • Never share a Google verification code with others.
    • Only deal with buyers, sellers, and Fluffy-finders in person. If money is to exchange hands, make sure you are using legitimate payment processors.
    • Don’t give out your email address to buyers/sellers conducting business via phone.
    • Don’t let someone rush you into a sale. If they are pressuring you to respond, they are likely trying to manipulate you into acting without thinking.

    Those who believe they’ve fallen victim to online scams, are advised to report it to the FBI’s Internet Crime Complaint Center at www.ic3.gov or to call their local FBI office. 

    Credits: bleepingcomputer.com

  • Biden Administration Blames Hackers Tied to China for Microsoft Cyber Attack Spree

    Four Chinese nationals were indicted over separate hacking activity; dozens of nations condemn Beijing’s state-sponsored hacking

    WASHINGTON—The Biden administration publicly blamed hackers affiliated with China’s main intelligence service for a far-reaching cyberattack on Microsoft Corp. email software this year, part of a global effort by dozens of nations to condemn Beijing’s malicious cyber activities.

    The U.S. government has high confidence that hackers tied to the Ministry of State Security, or MSS, carried out the unusually indiscriminate hack of Microsoft Exchange Server software that emerged in March, senior officials said.

    In addition, four Chinese nationals were indicted over a range of separate hacking intrusions dating back a decade that allegedly stole corporate and research secrets from firms and universities around the world. Three of the nationals were described as MSS officers, while a fourth was said to be employed at a Chinese front company that aided the hacking.

    “The United States and countries around the world are holding the People’s Republic of China (PRC) accountable for its pattern of irresponsible, disruptive, and destabilizing behavior in cyberspace, which poses a major threat to our economic and national security,” Secretary of State Antony Blinken said Monday. The MSS, he added, had “fostered an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cybercrime for their own financial gain.”

    The Microsoft hack made an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to cyber intrusion.

    The U.K. and European Union, among others, joined in the attribution of the Microsoft Exchange Server hacking activity, which rendered an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to cyber intrusion. Attributing the Microsoft hack to China was part of a broader global censure Monday of Beijing’s cyberattacks by the U.S., the EU, the U.K., Canada, Australia, New Zealand, Japan and the North Atlantic Treaty Organization, or NATO, a 30-nation alliance.

    Biden administration officials called the collective condemnation the largest international effort yet to criticize Beijing’s state-sponsored hacking. While statements varied, the international cohort generally called out China for engaging in harmful cyber activity, including intellectual property theft.

    The public shaming, however, didn’t include punitive measures, such as sanctions or diplomatic expulsions by the U.S. That stands in contrast with how the administration recently punished Russia for a range of alleged malicious cyber activity, and the discrepancy drew criticism from some cybersecurity specialists.

    The lack of further punishment “looks like a double standard compared with actions against Russian actors. We treat China with kid gloves,” said Dmitri Alperovitch, chairman of Silverado Policy Accelerator, a Washington-based think tank that works to modernize U.S. cybersecurity strategy.

    A senior official that said the administration is aware that no single action is capable of changing the Chinese government’s malicious cyber behavior, and that the focus was on bringing countries together in a unified stance against Beijing. The official said that hackers linked to the MSS were using criminal contractors to conduct “unsanctioned” cyber operations globally.

    Asked by reporters what he believes the difference is between hacking originating in China and Russia, President Biden said, “My understanding is that the Chinese government, not unlike the Russian government, is not doing this themselves, but are protecting those who are doing it, and maybe even accommodating them being able to do it.”

    The U.S.-led announcement is the most significant action from the Biden administration to date concerning China’s yearslong campaign of cyberattacks against the U.S. government and American companies, often involving routine nation-state espionage and the theft of valuable intellectual property such as naval technology and coronavirus-vaccine data.

    The indictment the Justice Department made public Monday alleges that the Chinese government has done little to uphold a 2015 accord between China and the Obama Administration not to direct or support cyberattacks that steal corporate records for economic benefit. The Trump administration had also said Beijing repeatedly violated the accord. The indictment, which dates from May, accuses a regional branch of the MSS of relying on a front company, whose payroll was coordinated through a local university, to continue such attacks after the pact was signed.

    The indictment charges the four men with orchestrating a hacking campaign from 2011 to 2018 intended to benefit China’s companies and commercial sectors by stealing intellectual property and business information. The indictment didn’t appear directly related to the Microsoft Exchange Server breach, but accused the hackers of stealing information from dozens of companies and universities around the world about Ebola virus research, maritime research and other topics.

    U.S. authorities have accused China of widespread hacking targeting American businesses and government agencies for years. China has historically denied the allegations.

    “The U.S. has repeatedly made groundless attacks and malicious smear against China on cybersecurity,” Liu Pengyu, spokesman for the Chinese Embassy in Washington, said late Monday. “This is just another old trick, with nothing new in it.”

    The Exchange Server hack was disclosed by Microsoft in March alongside a software patch to fix the bugs being exploited in the attack. Microsoft at the time identified the culprits as a Chinese cyber-espionage group with state ties that it refers to as Hafnium, an assessment that was supported by other cybersecurity researchers. The Biden administration hadn’t offered attribution until now, and it is essentially agreeing with the conclusions of the private sector and providing a more detailed identification.

    The attack on the Exchange Server systems began slowly and stealthily in early January by hackers who in the past had targeted infectious-disease researchers, law firms and universities, according to cybersecurity officials and analysts. But the operational tempo appeared to intensify as other China-linked hacking groups became involved, infecting thousands of servers as Microsoft worked to send its customers a software patch in early March.

    Microsoft praised Monday’s global action. “Attributions like these will help the international community ensure those behind indiscriminate attacks are held accountable,” said Tom Burt, Microsoft’s vice president of customer security and trust.

    Also on Monday, the National Security Agency, Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency jointly published technical details of more than 50 tactics and techniques favored by hackers linked to the Chinese government. The release of such lists is common when the U.S. exposes or highlights malicious hacking campaigns and is intended to help businesses and critical infrastructure operators better protect their computer systems.

    Cybersecurity experts have been pressing the Biden administration for months to respond to China’s alleged involvement in the Microsoft email hack.

    “The Microsoft Exchange hacks by MSS contractors is the most reckless cyber operation we have yet seen from the Chinese actors—much more dangerous than the Russian SolarWinds hacks,” said Silverado’s Mr. Alperovitch, referring to the widespread cyber-espionage campaign detected last December that, along with other alleged activities, prompted a suite of punitive measures against Moscow.

    Many analysts said the Biden administration broke with years of U.S. foreign policy that tolerated cyber espionage as an acceptable form of 21st century spycraft when it punished Russia earlier this year for SolarWinds.

    Kellen Dwyer, a former career prosecutor who served last year as deputy assistant attorney general in the Justice Department’s national security division, said the SolarWinds attack “was an espionage attack, and one that was relatively cautious about imposing collateral damage.”

    Meanwhile, said Mr. Dwyer, the Chinese actors who allegedly engaged in the Microsoft Exchange hack grabbed vast swaths of data and “indiscriminately scanned the entire internet to find unpatched vulnerabilities.” He said: “That certainly should be a norm that we are willing to define and meet with sanctions.”

    The Chinese defendants charged in the new indictment aren’t in U.S. custody. Some cybersecurity experts have said indictments against foreign state-backed hackers often have little impact, because the accused are rarely brought before an American courtroom. U.S. officials have defended the practice, saying it helps convince allied governments, the private sector and others about the scope of the problem.

    The hackers are accused of breaching dozens of schools, companies, and government agencies around the world, ranging from a research facility in California and Florida focused on virus treatments and vaccines, to a Swiss chemicals company that produces maritime paints, to a Pennsylvania university with a robotics engineering program and the National Institutes of Health, to two Saudi Arabian government ministries. The companies and universities aren’t named in the indictment.

    The hackers allegedly used fake spear-phishing emails and stored stolen data on GitHub, concealing the files in photos of a koala and Donald Trump, the indictment said. They coordinated with professors at a Chinese university, including to identify and recruit hackers for their campaign, and used the address of the university library as the front company’s location, it said.

    Credit: The World Street Journal