Microsoft’s Edge browser has recently enhanced its ‘Edge Secure Network’ feature, which now offers 5GB of data, significantly increasing from the previously offered 1GB. […] Read More
BleepingComputer
Related Posts
A week in security (April 1 – April 7)
A week in security (April 1 – April 7)
[[{“value”:”
A list of topics we covered in the week of April 1 to April 7 of 2024
Last week on Malwarebytes Labs:
60% of small businesses are concerned about cybersecurity threats
Cookie consent choices are just being ignored by some websites
Bing ad for NordVPN leads to SecTopRAT
Jackson County hit by ransomware, declares state of emergency
Google patches critical vulnerability for Androids with Qualcomm chips
Google Chrome gets ‘Device Bound Session Credentials’ to stop cookie theft
AT&T confirms 73 million people affected by data breach
Trusted Advisor now available for Mac, iOS, and Android
2024 State of Malware in Education report: Top 6 cyberthreats facing K-12 and Higher Ed
Free VPN apps turn Android phones into criminal proxies
Stay safe!
Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.
“}]] Read More
Malwarebytes
Major Cyber Attack Paralyzes Kyivstar – Ukraine’s Largest Telecom Operator
Major Cyber Attack Paralyzes Kyivstar – Ukraine’s Largest Telecom Operator
Ukraine’s biggest telecom operator Kyivstar has become the victim of a cyber attack, disrupting customer access to mobile and internet services.
"The cyberattack on Ukraine’s #Kyivstar telecoms operator has impacted all regions of the country with high impact to the capital, metrics show, with knock-on impacts reported to air raid alert network and banking sector as work continues Read More
The Hacker News | #1 Trusted Cybersecurity News Site
Hackers Launch a Chain of Exploits Via Malicious iMessage Attachments
Hackers Launch a Chain of Exploits Via Malicious iMessage Attachments
In June, a new campaign targeting iPhone and iPad devices was named “TriangleDB.” This malware infection chain consists of a malicious iMessage attachment, which launches a chain of exploits on the affected devices.
Moreover, several modules were found in this malware, which could also execute additional modules. Excluding the infection chain, there were two validators: “JavaScript validator” and “Binary Validator.”
These validators collect multiple information from the targeted devices and transfer them to a C2 server, later used by threat actors to access the compromised devices and detect if the device was a test device or a victim device.
JavaScript Validator
In addition to this, this malware is a zero-click exploit that is executed through invisible iMessage attachments. The main purpose of this JS validator is to stealthily open a unique URL to the domain backuprabbit[.]com.
This website contains an obfuscated JavaScript code of the NaCl cryptography library and an encrypted payload. This JS code performs a Canvas Fingerprinting technique by drawing a yellow triangle on a pink background with WebGL and calculating its checksum.
It finally encrypts and transfers the collected data to the same to receive the next stage of the infection chain.
Binary Validator
This validator is launched before the installation of the TriangleDB implant. The Binary validator is responsible for crash log removal, ids-pub-id.db or knowledge.db removal, turning on personalized ad tracking, and much more.
After collecting all this information, it sends encrypted data (list of processes, user information, etc.) to the C2 server.
Additionally, this malware can record microphones, Keychain exfiltration, steal SQLite, and monitor location.
Log Trace
After the implant establishes communication with its C2, it receives multiple CRXShowTables and CRXFetchRecord commands, which are associated with log retrieving and show traces of the infection. The logs contain Crash log files, Database files, and others.
Microphone Recording
This module is named as “msu3h” and is one of the most invading modules of this malware. However, this module performs more actions only when the charge of the affected device is higher than 10%.
In addition to this, it also contains more parameters like suspendOnDeviceInUse (stop recording remotely) and syslogRelayOverride (if audio should be recorded if system logs are captured).
Keychain Exfiltration
This module was entirely based on the code from the iphone-dataprotection.keychainviewer project, but the information on why the threat actor has implemented this module even in the presence of similar modules is already unknown.
SQLite stealing
Internal data of many iOS apps use SQLite database, so the threat actor has implemented several modules for SQLite DB stealing. All the SQLite DB stealing modules have the same codebase and encrypted configuration.
A complete report about this malware has been published by SecureList, which provides detailed information about this TriangleDB implant.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
The post Hackers Launch a Chain of Exploits Via Malicious iMessage Attachments appeared first on Cyber Security News.
Cyber Security News