Advisory ID: NCC-CSIRT-081124-013

Summary: 

Andromeda, also known as Gamarue is a modular (can download additional malicious modules or payloads based on the attacker's instructions) malware that spreads through phishing and infected websites, enabling attackers to control systems, steal data, and distribute other malware. Despite being disrupted in 2017, updated versions still appear in cyberattacks, posing an ongoing threat.

Damage/Probability: CRTICAL/HIGH

Platform(s): Windows Operating Systems

Description: 

Andromeda malware spreads through phishing emails, malicious attachments, and compromised websites, disguising itself as legitimate software. Once executed, it installs on the target system, avoiding detection through obfuscation and encryption. The malware then connects to command-and-control servers to receive instructions, allowing it to download additional malicious modules like keyloggers or ransomware. Andromeda ensures persistence by modifying system settings and creating tasks to remain active after reboot. Infected systems become part of a botnet, used for DDoS attacks, data theft, and other malicious activities. Its modular and adaptable nature allows it to evolve and continue operating even after takedown efforts.

Consequences: 

Andromeda malware can cause data theft, system compromise, spread additional malware, and disrupt operations, leading to financial losses and privacy breaches.

Solution: 

To mitigate this threat, you are advise to carry out the following:

• Avoid opening unexpected email attachments and use email filters to block malicious files.
• Keep systems and software patched to prevent Andromeda exploitation.
• Provide regular cybersecurity training to help employees identify and avoid phishing, suspicious downloads, and social engineering tactics.
• Employ comprehensive antivirus or anti-malware software that can detect and remove Andromeda malware and other threats.
• Use advanced email filtering to block phishing emails and attachments, preventing malware delivery.
• Monitor network traffic for unusual activity, particularly communications with suspicious IP addresses or command and control (C&C) servers.
• Disable unnecessary services, ports, and protocols that could be exploited by the malware to maintain communication with its C&C servers.
• Regularly back up important data and systems to ensure recovery in case of malware infection and minimize data loss.
• If a system is suspected of being infected, isolate it from the network to prevent further spread of the malware.
• Deploy End point Detection and Response (EDR) solutions to continuously monitor and analyze endpoint activity for signs of malware infections and suspicious behavior.
• After removing the malware, restore all altered system configurations, tasks, and registry keys to their original state.

References:

• https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Botnetz-Avalanche/Malware/Andromeda/andromeda_node.html

• https://blogs.blackberry.com/en/2020/05/threat-spotlight-andromeda

• https://technologytimes.ng/nigeria-alerts-banks-of-andromeda-malware/

•  https://www.cert.be/en/document/gamarueandromeda

Advisory ID: NCC-CSIRT-311024-012

Summary: 

Zimperium’s zLabs team has discovered a new variant of vishing (voice phishing) malware known as FakeCall. This evolved malware manipulates voice calls by impersonating trusted institutions, tricking users into revealing sensitive information like credit card numbers and banking credentials.

Damage/Probability: CRTICAL/HIGH

Platform(s): Android Operating Systems

Description: 

Researchers report that FakeCall malware infiltrates Android devices by hijacking call functions. The attack typically starts when a user downloads a seemingly harmless APK file (the Android application package format), which acts as a "dropper" to install the main malware. Once active, FakeCall can intercept and manipulate both outgoing and incoming calls, all under the control of a command-and-control (C2) server that covertly directs actions on the device. The malware even mimics a legitimate call interface, making it difficult for users to detect the deception. Moreover, attackers have been known to employ signing keys, allowing the malware to bypass security defenses more effectively.

Consequences: 

The malware exploits mobile-specific features like voice and SMS to gain unauthorized control over the compromised devices. Its advanced tools heighten risks of data theft, privacy breaches, and financial loss, highlighting the need for strong mobile security measures.

Solution: 

To mitigate this threat, you are advise to carry out the following:

• Avoid downloading APKs from unofficial sources.
• Use trusted app stores like the Google Play Store.
• Employ mobile threat detection tools to verify app legitimacy.
• Limit app permissions, especially for call and messaging functions.
• Install and regularly update robust mobile antivirus software.
• Keep Android devices and apps updated to the latest versions.
• Implement network security to monitor and block command-and-control (C2) traffic.
• Conduct regular device audits for suspicious activity.
• Use mobile threat defense solutions to detect and remove malware.
•  Enable multifactor authentication (MFA) for sensitive app access..

References:

• https://www.securityweek.com/fakecall-android-trojan-evolves-with-new-evasion-tactics-and-expanded-espionage-capabilities/

• https://thenimblenerd.com/article/beware-fakecall-malware-wreaks-havoc-with-advanced-mobile-phishing-tactics/

• https://bgr.com/tech/terrifying-android-malware-redirects-your-calls-to-hackers/

• https://www.bleepingcomputer.com/news/security/android-malware-fakecall-now-reroutes-bank-calls-to-attackers/

• https://www.darkreading.com/cyberattacks-data-breaches/vishing-mishing-fakecall-android-malware

• https://www.infosecurity-magazine.com/news/updated-fakecall-malware-targets/

Advisory ID: NCC-CSIRT-170924-010

Summary: 

PlugX is a sophisticated Remote Access Trojan (RAT) known for targeting critical infrastructure, including telecommunications. It enables attackers to remotely control infected systems, infiltrate sensitive data, disrupt network operations, and maintain long-term access to telecom systems. The malware typically spreads through phishing campaigns and exploited vulnerabilities.

Damage/Probability: CRTICAL/HIGH

Platform(s): Windows, Linux, Network Devices, and Telecom Infrastructure systems

Description: 

PlugX malware is typically deployed via phishing emails containing malicious attachments or by exploiting network vulnerabilities. These emails are crafted to deceive users into opening infected files or clicking on links that exploit unpatched vulnerabilities within network systems. In addition to phishing, PlugX can be spread through watering hole attacks, drive-by downloads, or by leveraging network security flaws, making it a versatile and highly adaptable threat.

Once deployed, it allows threat actors to remotely control infected systems, steal data, disrupt services, and create backdoors for future attacks. Its stealth and persistence make it challenging to detect, posing a significant risk to critical telecom infrastructure.

Consequences: 

If the threat occur, the following outcomes may occur:

• Data Exfiltration:Loss of sensitive user and corporate data.
• Service Disruption:Downtime or interruptions to telecom services.
• Network Manipulation: Unauthorized control of network devices and systems.

Solution: 

To mitigate this threat, you are advise to carry out the following:

• Apply security patches to all network devices and systems regularly.
• Enhance endpoint security and network monitoring for suspicious activities.
• Implement email filtering to block phishing emails.
• Conduct regular cybersecurity awareness training for staff.
• Enforce network segmentation and access controls.
• Perform vulnerability assessments and incident response drills.

References:

• https://www.cisa.gov/news-events/alerts/2017/04/27/intrusions-affecting-multiple-victims-across-multiple-sectors

• https://attack.mitre.org/software/S0013/

• https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=27409

• https://darktrace.com/blog/plugx-malware-a-rats-race-to-adapt-and-survive

Advisory ID: ngCERT-2024-0034

Summary: 

ngCERT is issuing an urgent security alert regarding the dangers and risks associated with expired Secure Socket Layer (SSL) certificates, which are increasingly observed within Nigerian cyberspace. SSL is essential for web services as it ensures end-to-end encrypted communication between client and server over the Internet. However, if an SSL certificate on the server side expires, this secure communication is compromised, exposing users to cyber threats. Malicious actors can exploit this vulnerability to execute phishing attacks and Man-in-the-Middle (MitM) attacks, among others, leading to data breaches, data theft, reputational damage, financial losses, and Denial of Service (DoS) attacks. Given these risks, users are advised to renew expired SSL certificates and implement other recommended mitigation steps.

Threat Type(s): Vulnerability

Impact/Vulnerability: CRITICAL/HIGH

Product(s): SSL Certificates

Platform(s): Web Applications

Version(s): All Versions

Description: 

SSL certificates verify the identity of a website owner while enabling secure and encrypted connections for users accessing the server. When an SSL certificate expires, it can no longer ensure a secure connection, exposing organizations to potential attack vectors. Expired SSL certificates are particularly vulnerable to Man-in-the-Middle (MitM) attacks, where an attacker intercepts and eavesdrops on client-server communications, potentially hijacking requests to the web application. This could lead to the theft or alteration of sensitive data. Additionally, cybercriminals might create phishing websites that imitate legitimate sites with expired SSL certificates, using similar URLs to deceive unsuspecting users into divulging sensitive information for malicious purposes.

Consequences: 

Exploitation of the aforesaid flaw could result in:

1. Unauthorized access
2. Data breaches and exfiltration
3. Financial losses
4. Denial of Service (DoS) attack
5. Reputational damage 

Solution:  

To mitigate this risk, the following actions are recommended:

• Immediate Renewal: Renew the expired SSL certificate and install it on the server to re-enable secure communication.
• Implement Certificate Monitoring: Deploy an automated SSL certificate monitoring system that alerts administrators 30, 15, and 7 days before certificate expiration. This ensures ample time for renewal.
• Establish Renewal Procedures: Set up a robust process for SSL certificate management, with clear timelines and ownership to avoid missed renewals in the future. Consider using certificate management tools or platforms that automate renewals.
• Conduct Regular Security Audits: Schedule periodic audits of all SSL certificates across the system to identify any upcoming expirations and ensure all certificates are up to date.
• User Notification and Trust Restoration: Notify affected users of the issue, informing them that the SSL certificate has been renewed and that secure access has been restored.
• Review Compliance Requirements: Verify that the expired SSL certificate did not result in any non-compliance issues with relevant security regulations or industry standards. Update documentation and records as necessary to demonstrate renewed compliance.

References:

• https://www.crowdstrike.com/en-us/blog/the-risks-of-expired-ssl-certificates/

• https://securitytrails.com/blog/risks-expired-ssl-certificates

• https://www.encryptionconsulting.com/why-to-fix-expired-ssl-certificates/

• https://sematext.com/glossary/ssl-certificate-expiration/