Cyber Defense eMagazine December 2019

105
previous two quarters. There was also increasing overlap between the most-widespread malware
detections affecting individual networks and the most prolific malware by volume, with three threats found
in both lists. Finally, multiple popular backdoor shell scripts (including both the Backdoor.Small.DT and
Trojan.GenericKD tools from the Kali Linux penetration testing/ethical hacking suite) appeared for the
first time in the list of top malware attacks, possibly showing that hackers are leveraging Kali Linux more
often.
Network Attacks Explode
Network attacks more than doubled from Q1 to Q2 2019. This was the largest percent increase we’ve
seen since 2017. Two attacks debuted on the top 10 list: EXPLOIT Nodejs js-yaml load() and WEB
Directory Traversal -4. The former accounted for 2.9% of all network attacks by volume and exploits a
vulnerability in the YAML markup language package JS-YAML for Node.js. Specifically, it exploits how
the library parses a custom data type, which results in remote code execution. The latter network attack,
WEB Directory Traversal -4, allows web users to escape a web server’s root directory and potentially
gain access to any file on the computer system. The most common target is the “/etc/passwd” file, which
is the file storing user login credentials. Granted the passwords are normally hashed, but attackers can
still attempt to crack the hashes and obtain legitimate user login credentials. A final startling discovery
was the 1,288.39% increase in WEB SQL injection attempt -33 attacks from Q1. A yearly comparison to
Q2 2018 shows that same attack at an enormous 29,149.23% increase!
DNS-Level Attacks Leverage Legitimate Content Delivery Networks
The Threat Lab’s research found multiple malware campaigns using popular content delivery networks
(CDNs) like CloudFront and CloudFlare to prevent detection by anti-malware services that only look at
the root domain of a questionable URL. These fell into three categories: malware domains, which are
web sites outright hosting malware; compromised domains, which are web sites that threat actors
exploited to host their own malicious JavaScript code; and phishing domains, where threat actors direct
users to spoofed login screens to harvest their credentials. Our research found malware domains at
dc44qjwal3p07[.]cloudfront[.]net and d3i1asoswufp5k[.]cloudfront[.]net. Phishing domains were identified
at ec2-18-224-214-207[.]us-east-2[.] compute[.]amazonaws[.]com and usd383orgmy[.]sharepoint[.]com.
Security Incidents Making Headlines in Q2 2019
On May 7, 2019 the Baltimore Department of Public Works suffered a major ransomware attack. Adding
to the agony, five days into the city’s downtime the alleged threat actor started openly mocking the city
on Twitter! Researchers identified the malware as RobbinHood and the perpetrator set the ransom at
around $75,000. In the end, the City of Baltimore needed to rebuild many critical systems, which had a
major impact on worker productivity. Total estimated damages reached $17 million. This is a prime
example of the importance of deploying and testing backup solutions!