Chapter 1 Spotlight on Cyber Threats Featured Topic The Rise of Mobile Malware C&C Servers and Botnet Drones In 2019, CSA detected about 530 unique C&C servers in Singapore, a 73 per cent increase from 2018. On average, about 2,300 botnet drones with Singapore Internet Protocol (IP) addresses were observed daily, a 20 per cent decrease from average daily observations in 2018. Close to 370 malware variants were detected, with the top five malware observed — Mirai, Gamarue, Conficker, Nymaim, and Ranbyus — accounting for over half of all observed infections. These malware are not new, with Ranbyus and Nymaim first detected in 2011 and 2013, respectively. Gamarue — Down but not out On average, five common malware accounted for over half the daily infections of computing devices in 2019. Nymaim — Malware begets more malware Mirai — Internet of (insecure) Things Mirai infected more IP addresses in the first half of 2019 than it had the whole of 2018. In fact, while other malware variants observed decreased in 2019, Mirai variants continued to grow, increasing in tandem with the adoption of Internet of Things (IoT) devices in Singapore. Since its inception in 2016, Mirai has evolved to include more complex attack tools, which take advantage of the weak security that continues to exist in many IoT devices. New exploits in a Mirai variant active since January 2019 targeted vulnerabilities of enterprise IoT devices, in addition to generating novel and unusual combinations of log-in credentials for carrying out brute-force attacks.21 These targeted devices included wireless presentation and display systems, routers, network storage devices and IP cameras, suggesting that While Mirai primarily propagates through infected IoT devices, Gamarue is often unwittingly installed via phishing e-mails containing malicious files, and also propagated through infected USB drives and external hard drives. Despite successful international efforts which took down Gamarue’s infrastructure more than two years ago, the persistent proliferation of Gamarue through phishing e-mails and infected storage media underscores the continued need to emphasise good cyber hygiene among all users. threat actors were looking to leverage bandwidths in organisational networks to build bigger botnets for carrying out large-scale Distributed Denial-ofService (DDoS) attacks. To avoid takedowns and evade detection, threat actors behind another Mirai variant observed in July 2019 hid their C&C server in the Tor anonymity network.22 This prevented the server from being blacklisted upon discovery of its malicious activities, as its network traffic was encrypted and allowed to blend into Tor’s legitimate traffic streams. This tactic could potentially set a trend for other threat actors to follow, and subsequently present new cybersecurity challenges for users. Nymaim was notably used by threat actors for targeting the hospitality sector in North America and Europe in early-2019. In this campaign, malspam was observed distributing and using Nymaim to download and run other ransomware on infected systems.23 The continued observation of Nymaim throughout the year suggests its growing popularity as a downloader which conveniently deploys different malware at the threat actor’s discretion through their C&C servers. 23 24 25 26 21 22 16 Nigam, Ruchna. “New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems,” Palo Alto Networks — Unit 42, 18 March 2019, https://unit42.paloaltonetworks. com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems. Shimamura, Makoto. “Keeping a Hidden Identity: Mirai C&Cs in Tor Network,” Trend Micro Security Intelligence Blog, 31 July 2019, https://blog.trendmicro.com/trendlabssecurity-intelligence/keeping-a-hidden-identity-mirai-ccs-in-tor-network. SINGAPORE CYBER LANDSCAPE 2019 27 28 Cybersecurity researchers Anubis26 and Cerberus27, have noted how malware were easily customisable and types specifically tailored available for sale on the Dark for attacking mobile devices Web, making them attractive have dramatically increased among cybercriminals. These in tandem with the global factors likely contributed to proliferation of mobile a surge in malicious activity devices. Threat actors are targeting mobile devices, as seen exploiting vulnerabilities observed by cybersecurity in popular mobile operating firm Kaspersky. 28 Most systems such as Google’s users freely grant various Android and Apple’s iOS to kinds of permissions to infect mobile devices. They do applications for the first time so primarily by capitalising on they are run, unwittingly unsafe user practices — such as permitting embedded downloading applications from malware to steal data and unofficial application stores — credentials through malicious and disguising mobile malware functionalities. In more as reputable applications24, severe cases, the malware which are often sold at can even siphon funds from cheaper prices than legitimate users’ bank accounts linked applications, thus enticing the to their mobile banking user to download them. 25 applications. Separately, adware spams users with Commonly observed mobile unwanted advertisements, malware in 2019 were and sometimes secretly designed to evade detection clicks on advertisements in while being persistent and the background without the effective, and included users’ knowledge, enriching banking trojans and adware. threat actors financially. Banking trojans, such as Mendoza, Erika, Yaneza, Jay, Sison, Gilbert, Patil, Anjali, Cabuhat, Julie and Soares, Joelson. “Emotet-Distributed Ransomware Loader for Nozelesn Found via Managed Detection and Response,” Trend Micro Security Intelligence Blog, 29 March 2019, https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-distributedransomware-loader-for-nozelesn-found-via-managed-detection-and-response. Herman, Jordan. “The Q2 2019 Mobile Threat Landscape Report,” RiskIQ Research, 2019, https://www.riskiq.com/research/q2-2019-mobile-threat-landscape-report. “The risks of third-party app stores,” NortonLifeLock — Norton Internet Security Center, Retrieved 1 February 2020, https://us.norton.com/internetsecurity-mobile-therisks-of-third-party-app-stores.html. Bao, Tony. “Anubis Android Malware Retuns with Over 17,000 Samples,” Trend Micro Security Intelligence Blog, 8 July 2019, https://blog.trendmicro.com/trendlabssecurity-intelligence/anubis-android-malware-returns-with-over-17000-samples. “Cerberus — A new banking Trojan from the underworld,” ThreatFabric Blog, August 2019, https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-theunderworld.html. Kupreev, Oleg, Sidorina, Tatyana, Chebyshev, Victor, and Kuskov, Vladimir. “Financial threats in H1 2019,” Securelist – Kaspersky’s cyberthreat research and reports, 31 July 2019, https://securelist.com/financial-threats-in-h1-2019/91899. 17