This post is also available in:      日本語 (Japanese)  CTB-Locker is a well-known ransomware Trojan used by crimeware groups to encrypt files on the victim's endpoints and demand ransom payment to decrypt the files back to their original state, but most antiviruses detect it by mistake as CryptoLocker (only one vendor correctly detects it as CTB-Locker).


The attack vector is very basic and repeats itself: It begins with a spear phishing email sent with SCR attachments (double zipped).


Once executed by the user the first stage malware downloads and executes the ransomware from a fixed hardcoded server list.


The first known campaign was launched by Crimeware on November 2014.


The first stage downloaded the ransomware from these sites:


A very serious campaign was launched between January 19, 2015 and January 20, 2015, and  Palo Alto Networks Enterprise Security Platform has discovered more than 1000 unique attacks since.


The attacker used a polymorphic malware builder to generate malware with a unique hash for each victim, preventing signature-based solutions from detecting the new attacks before it was too late for the victim.


This tactic is a nightmare for legacy security products that are based on legacy techniques such as bytes signatures, since they can only detect attacks after the damage is done instead of preventing it as a true solution should.


Palo Alto Networks Enterprise Security Platform offers multilayer protection to prevent this attack along with other attacks without the need for prior knowledge of the specific attack.


We can see here that server hostnames were changed but they didn’t change the server IP address – see the attached file with results for files from last week’s campaign from VirusTotal.


Most legacy security programs could not detect this malware at the time it was posted.


If you re-test these hashes again from last week you can see an average of 49/57 engines that detect last week’s threat – but that’s too little, too late for anyone who already lost data.


This campaign started earlier today, and the malware uses the same techniques and even the same IOCs:  And only added two new hostnames:


By now you shouldn’t be surprised that one of them is on the same known malicious IP address.


We found 147 new unique pieces of malware today alone, two of them fully undetectable by the legacy security solutions in VirusTotal and most of them barely detected by one vendor (few have 4/57 detection rate).


See below:


So basically you have two choices:


The most surprising fact about this campaign is that almost all the IOCs haven’t been changed:  For those still using legacy solutions we’ve attached two lists of SHA256 hashes in a text file format for reference.


One list shows the new campaign, which continues to progress.


The other list is of last week’s campaign by the same attackers (exhaustive or close to it).  Palo Alto Networks Enterprise Security Platform would have stopped this ransomware attack campaign thanks to the platform’s unique integration between the network, endpoint and the cloud to maximize security.


Attacks aren't getting any less sophisticated, so it is time to leave legacy security solutions behind and upgrade to real, prevention-based security.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  Over the past six months, we’ve seen a major increase in the number of attack campaigns with the ultimate goal of mining cryptocurrency.


It’s a subject Unit 42 has been tracking in the past year:


So, what is driving a widespread shift from attackers and creating a significant trend in the industry?


There are three factors at work:


To answer the question in more detail, it’s important to put yourself into the criminal’s shoes and consider what alternative routes they have to monetize infections.


In this brief, we’ll share how this trend came to fruition, why it’s so prevalent, and how security professionals and defenders can keep an eye out for this rising type of threat.


How Attacks Monetize Infections


While targeted attacks gain the most attention from researchers and media, the majority of malware infections are untargeted and even indiscriminate.


Instead of seeking out specific targets, many criminals aim to infect as many systems as possible and then turn those infections into cash.


This has been true for over a decade, although the mechanisms available to criminals have shifted in that time.


To understand where we are now, it helps to look at how we got here, and to look at the evolution of common cybercriminal activities.


Back in the early 2000s, some of the earliest “botnet herders” made their income by relaying spam emails through infected computers.


Over time, that business became less profitable due to anti-spam controls and ISPs preventing infected systems from directly relaying emails.


In the mid-2000s, criminals made great profits from using Banking Trojans to steal credentials for online banking websites, and subsequently draining the accounts’ associated funds.


This account takeover activity continues today, but various anti-fraud measures and law enforcement actions have made it less profitable and riskier for criminals.


Another aspect of Banking Trojan infections is that, while the criminal may be infecting hosts indiscriminately, the value of the host greatly depends on the individual who owns it, and the criminals’ ability to “cash out” their bank account.


Figure 1 is a capture from a book I wrote with some colleagues in 2008, “Cyber Fraud: Tactics, Techniques, and Procedures.”


It shows the price that a criminal enterprise called IFRAME DOLLARS was charging to infect computers in various countries at that time.


Figure 1: Capture from Cyber Fraud: Tactics, Techniques, and Procedures showing prices of host infections by country.


In 2007, the infection of a system in Australia went for US$0.60, while an infection in Poland was only a fraction of the cost, at US$0.096.


The difference in price represented the difference in value: criminals were able to make more money through a Banking Trojan account takeover from an Australian infection than they could in Poland.


As anti-fraud protections evolved, so did the criminals.


Fast forward five years to 2013 and the rise of the Ransomware business model


This new way to generate profit had two major advantages over account takeovers:


Put another way, the ransomware model represented both increased efficiency and decreased risk in monetizing the infection.


Anyone who’s been paying attention to cybercrime since 2013 is aware of the ransomware surge, infecting systems throughout the world and plaguing networks’ administrators.


While only a tiny fraction (possibly 1 in 1000) of systems infected with a banking Trojan pay out for attackers, a much higher portion of ransomware victims pay to get their files back.


While US$300 payments are less than a single account takeover could return, ransomware makes greater returns due to the volume and decreased risk in this new business model.


Cybercriminals have become good business people: they saw the benefits and embraced the change.


Enter “The Bubble” – Where We Are Now


In the last two years, but particularly in the last six months, the price of bitcoin and other cryptocurrencies experienced a massive price surge with respect to the U.S. dollar and other fiat currencies.


Here’s the chart for bitcoin over the last two years, showing a rise of 2,000% to 4,000% in the versus the U.S. dollar.


Figure 2: Price of bitcoin in U.S. dollars from CoinMarketCap  While botnets mining cryptocurrency is nothing new, the technique was much less profitable than using ransomware.


In fact, with the rise of specialized bitcoin mining hardware, no regular PC can make any significant amount of money for an attacker.


However, there are many other “crypto coins” in the market today.


The one we see mined most by attackers is called Monero.


In contrast to bitcoin, Monero was designed to enable private transactions using a closed ledger, and its mining algorithm is still mined effectively by both PC CPUs and GPUs.


As the chart below shows, Monero has risen even faster than bitcoin in price in the last two years, with more than a 30,000% gain in U.S. dollars.


Figure 3: Price of Monero in U.S. dollars from CoinMarketCap


A normal PC used to mine Monero can earn around US$0.25 per day at the current prices.


That number is small, but it’s important to note that it doesn’t matter what country or network a Monero miner is part of: computers in Australia and Poland mine at the same speed.


Every infected system is a profit-generating resource when mining Monero, and users are much less likely to identify their infection and remove the mining program than they would be with ransomware.


For context, in January, we found a Monero mining campaign that infected around 15 million systems, largely in the developing world.


If these systems remained infected for at least 24 hours each, the attackers could have earned well over 3 million U.S. dollars in Monero.


Additionally, the risk of arrest and conviction is significantly lower than with ransomware, as mining cryptocurrency is less likely to generate reports to law enforcement than a data-destroying ransomware infection.


What’s Next?


This wave of attacks will continue as long as it maintains a high level of profitability with a low level of risk for cybercriminals.


For defenders, it’s important to note that the techniques used to infect systems with coin mining malware are the same as they were for ransomware.


Infections typically begin with emails carrying malicious macro documents, drive-by exploit kits targeting browsers, or direct attacks on servers running vulnerable software.


There is no single solution to stopping these attacks, but the same technologies and policies you use to prevent other malware infections will be effective.


Across the changing landscape of botnet herders, Banking Trojans, ransomware and coin mining is one constant: the business-savvy drive to maximize profit and reduce risk.


Using these as our guide, we can make sense of where we are today, how we got here, and be prepared for what has yet to develop in the future.


Here are three things to watch for:


1. A marked increase in the price of Monero or other cryptocurrencies will draw even more attackers into this business.


For many users, this could actually be a positive development, as the negative impact of having resources sapped from one’s computer is much less than paying a ransom or restoring your system from a backup due to ransomware.


Conversely, a crash in the price of cryptocurrencies will decrease the profitability and drive criminals back to ransomware.


2. Listen to your fans or keep an eye on your CPU usage.


Many users realize their system is infected with coin mining malware when their laptop fans kick into high-speed mode to keep the overtaxed CPU cool.


Listening to fans won’t work at the enterprise scale, but implementing widespread CPU performance monitoring could be a good way to find compromised devices.


This will also help you identify the coin mining “insider threat,” as misguided administrators may see their organizations’ unused CPU time as a way to generate personal income.


3. Criminals will find ways to target these attacks.


Compromising a user’s browser or a regular home PC will net the criminal an average system for mining coins, but higher-end systems will generate more income.


Attackers will soon begin targeting devices with higher specifications to get more bang for their buck.


Gaming PCs with high-end GPUs and servers with large numbers of processing cores will be prime targets.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


It’s that time of year again – our researchers have analyzed and reviewed the threats and attacks that occurred during the first half of 2021.


Our report, Attacks From All Angles: 2021 Midyear Security Roundup, highlights many of the active attacks we saw, from APTs to ransomware to zero-day exploits.


I’d like to highlight an area where we are seeing increased activity: attacks against cloud infrastructures.


I’ve spoken on this at a few events and asked my audiences how many have active cloud infrastructure projects going on, the answer is always most of them.


In our 1H’ 2021 Cyber Risk Index, we asked organizations what their top infrastructure risks are.


Cloud security has been in the top two for the last few years.


Obviously, many organizations are moving quickly to the cloud and, as such, need to be thinking about how to secure it.


Below is an overview of what we’re seeing in cloud attacks.


Threats Impacting Cloud Environments


In our first half report, we highlight an APT group named TeamTNT that has been targeting clouds for quite a while now.


They have focused most of their efforts on planting crypto-mining malware on cloud servers in an effort to mine Monero coins, but we have also seen them utilize DDoS IRC bots, steal cloud account credentials, and exfil data.


As you can see from the above diagram, all of these are end goals for most attacks.


Speaking of data exfil, in the first half we saw APT actors utilize cloud-based file storage to exfiltrate their stolen data.


For example, we found that Conti operators use the cloud storage synchronization tool Rclone to upload files to the Mega cloud storage service.


Similarly, DarkSide operators used Mega client for exfiltrating files to cloud storage, 7-Zip for archiving, and PuTTY application for network file transfers.


This use of known, legitimate tools is not new; we call that “living off the land” and have seen this tactic pick up recently, including usage by ransomware actors.


Many organizations now need to look at ways of monitoring legitimate tools usage within their networks to identify any malicious uses.


Cloud Security Architecture


When developing your cloud security architecture and strategy, it is important to always keep the ends in mind.


In this case, what are the motivation and end goals of an attacker?


As you see in the image above, most cloud attacks are going to fall into one of these areas.


Depending on what you are doing as part of your cloud infrastructure, you should be able to identify if any or all of these end goals could be targeted in your environment.


From there, you can work backwards to develop your strategy for protecting those initial access areas tied to the different attacks.


A challenge many organizations face is that the cloud isn’t simple, and many of the technologies that make up the cloud are new, with new features being deployed all the time.


Understanding how these work and – more importantly – how to secure them can be very difficult.


Utilizing a security platform approach can help build your cloud to be more secure, but educating your architects and administrators will also help.


One key area is hardening your cloud account credentials, as these will be regularly targeted by malicious actors.


Using multi-factor authentication to access all accounts can minimize this risk tremendously.


Take a look at Trend Micro Cloud One, part of our complete cybersecurity platform, to learn more.


The cloud is only one aspect of our full 1H 2021 report.


To get more details on all the different threats and attacks we observed, download and read the full report here.


Tags  Cloud | Cyber Crime | Expert Perspective | Cyber Threats | APT & Targeted Attacks | Network | Articles, News, Reports


Cybercriminals have embraced the anonymous nature of cryptocurrency as a new preferred method of profit.


Unit 42 released details about attackers hijacking web browsers to mine for compute resources and exchange for cryptocurrency.


With the increasing value of cryptocurrency, such as bitcoin and Ethereum, and a better business model with higher returns than malware- and exploit-type attacks, it’s no surprise these types of attacks are becoming more commonplace.


Cybercriminals will compromise a website and abuse a legitimate tool on that site to gain access to the compute resources of site visitors’ systems.


Using this access, attackers will essentially steal compute resources and exchange them for cryptocurrency credit.


This all occurs without the users’ consent or knowledge throughout the duration of their site visits.


The malicious activity itself doesn’t cause long-term damage to systems, and ends as soon as users leave the malicious or compromised site.


Additionally, the site will still provide users with its normal, intended functionality.


However, users likely experience a noticeable slowdown in system performance.


If you believe your system is being affected by this type of attack, leaving the site or closing your browser will, in most cases, end the attack.


Additionally, you should practice good cybersecurity hygiene.


This means avoiding unfamiliar websites, clicking on links or downloading attachments from unknown email senders, keeping products updated with the latest security patches, enabling multi-factor authentication, and using reputable security products.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)


In our updated report on ransomware from Unit 42, “Ransomware: Unlocking the Lucrative Criminal Business Model,” Unit 42 researcher Bryan Lee notes: “In 2016, it was thought that there were less than one hundred active ransomware variants out in the wild.


Today, the number of total ransomware variants at least over 150, if not hundreds more.”  It’s reasonable to ask why ransomware continues not only to exist but to thrive.


The first answer to this, as we’ve outlined in our report, is that ransomware is a lucrative cybercriminal business model.


However, in addition to the human factor, there are technical reasons.


Specifically, there are three things that combine to make ransomware a particularly potent threat on the technical level:


In some ways, these three points state the obvious.


But the full ramifications and why these make ransomware hard to stop aren’t always discussed.


The way ransomware works is well documented, but let’s recap here.


Ransomware is downloaded to a user’s system and executed on it.


The way the attackers get the ransomware on the system varies: it can be through unpatched vulnerabilities, social engineering or both.


The most common way ransomware operators levy attacks is through email or by web browsing to malicious or compromised sites.


The overwhelming majority of ransomware attacks are against Microsoft Windows systems.


Once malware is running on the user’s system, it seeks out and encrypts files and folders that hold information critical for the user, such as documents, business applications or even database files.


In some cases, the ransomware is sophisticated enough to target specific application files.


Most importantly, because the ransomware is executing with the compromised user’s privileges, any file the legitimate, now-compromised user has access to, including network shares and backups, is fair game for the ransomware.


It’s this last point that gets to the heart of why ransomware is so potent.


From an operating system point of view, the ransomware IS the user.


Even though Microsoft Windows today features a robust user access control system, that system has inherent limitations.


In the early days of Window Vista, Microsoft enabled aggressive security checking to ensure user-initiated actions were legitimate.


This was well-intentioned but ultimately backfired: users got fed up clicking “Are you sure?” dialog boxes and quickly disabled the feature, or just mindlessly clicked “OK” every time they saw it.


Microsoft made reasonable adjustments so that these alerts are now raised sparingly.


Although that feature was never enabled to protect user data files like ransomware targets, there is a clear lesson from the experience: too many security checks on user activity fails in the end.


Bringing that lesson to bear here, the only way the operating system could protect against ransomware would be to raise “Are you sure?” dialog boxes on everyday operations against the kinds of files that ransomware targets.


And this is where the second point comes to bear.


Unlike other forms of malware, ransomware is very specific in its targeting.


It goes after the files users are most likely to care about.


These also happen to be files users are most likely to use on a day-to-day basis or that are critical to an organization’s operations.


Extra layers of protection for those files would be incredibly onerous.


Imagine having to click through “Are you sure?” dialog boxes for every document or picture you opened in a day.


From an engineering point of view, this sole, specific targeting of files that matter significantly increases the chances of ransomware’s success.


This brings us to the third point: there is little attack time wasted on files that don’t matter to the victim.


Even a successful ransomware attack that is halted early by security software will achieve some level of damage – enough to make the victim consider paying the ransom to get the files back.


If user32.dll were encrypted and unusable, it would be a problem.


But when your organization’s overall accounting and audit report is inaccessible right before the big deadline, that’s catastrophic.


The net of these three points is that ransomware is a threat such that focus needs to be placed solely around prevention.


There is no effective solution for ransomware at the operating system level, as outlined above.


And unlike other attacks, ransomware attacks can’t succeed “just a little.”


In some cases, a single file lost is more than enough to count as a fully successful attack.


In some ways, ransomware is a threat unlike any other.


Its impact and scope are both broad and deep in ways that are unique.


Because of that, from a risk assessment point of view, ransomware needs to be put in a class by itself – a class that acknowledges that the risks from a successful attack of any kind are very high.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)


Over the past several weeks, Russia-Ukraine cyber activity has escalated substantially.


Beginning on Feb. 15, a series of distributed denial of service (DDoS) attacks commenced.


These attacks have continued over the past week, impacting both the Ukrainian government and banking institutions.


On Feb. 23, a new variant of wiper malware named HermeticWiper was discovered in Ukraine.


Shortly after, a new round of website defacement attacks were also observed impacting Ukrainian government organizations.


Consistent with our previous reporting on the topic, several western governments have issued recommendations for their populations to prepare for cyberattacks that could disrupt, disable or destroy critical infrastructure.


We have already observed an increase in Russian cyber activity, which we reported on in our initial Threat Brief published last month and our recent report on the Gamaredon group.


Future attacks may target U.S. and Western European organizations in retaliation for increased sanctions or other political measures against the Russian government.


We recommend that all organizations proactively prepare to defend against this potential threat.


This post was substantially updated on Feb. 24 to add information on the recent DDoS attacks, HermeticWiper malware and website defacement; update our recommendations for how organizations should prepare for potential cyber impact; and provide additional details for our customers and clients on how we can help.


This post was substantially updated March 31 to add information on phishing and scam attacks, cybersquatting trends, fake donation websites, DoS attacks on Ukrainian news sites and distribution of malicious binaries.


Full visualization of the techniques observed, relevant courses of action and indicators of compromise (IoCs) related to this report can be found in the Unit 42 ATOM viewer.  We will continue to provide updates with new information and recommendations as they become available.


DDoS Attacks Impacting Ukrainian Government and Banking Institutions HermeticWiper Malware Website Defacement Rise in Phishing and Scam Attacks Increase in Cybersquatting Trends Fake Donation Websites DoS Attacks on Ukrainian News Sites Distribution of Apps How Palo Alto Networks Is Working to Keep You Safe How You Should Prepare for an Increase in Cyberthreats Such as Wipers, DDoS, Website Defacement and Other Related Attacks How Unit 42 Threat Intelligence and Security Consulting Can Help Additional Cybersecurity Resources Indicators of Compromise


Appendix A: Cortex Xpanse: Identifying Assets That May Be Impacted by CISA’s Known Exploited Vulnerabilities


On Feb. 15, the Cyberpolice of Ukraine reported that residents were actively receiving fake SMS text messages.


These messages were likely intended to cause alarm among the population, as they claimed that ATMs were malfunctioning.


Shortly after the text messages were observed, several DDoS attacks occurred.


These attacks impacted Ukrainian government organizations including the Ministry of Defense, Ministry of Foreign Affairs, Armed Forces of Ukraine and the publicly funded broadcaster Ukrainian Radio.


Additionally, the attacks targeted two banking institutions, PrivatBank and Oschadbank.


An initial investigation into the DDoS attacks suggested that Mirai and Meris bot networks may have been leveraged in the attacks.


On Feb. 18, both the United States and the United Kingdom attributed these DDoS attacks to Russia’s Main Intelligence Directorate (GRU).  Over the past week, Ukraine has continued to observe a relatively constant flow of DDoS attacks targeting its government and financial institutions.


However, at this time, attribution for the ongoing attacks has not been established.


The Ukrainian CERT did identify a post on RaidForums from a user named “Carzita” that suggested that additional actors may also be launching DDoS and defacement attacks for undisclosed reasons.


On Feb. 23, a malicious file named conhosts._exe (SHA256: 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591) was uploaded to a public malware repository from an organization in Kyiv, Ukraine.


This executable is a signed file with a valid signature from an organization named Hermetica Digital Ltd. This signing certificate has since been explicitly revoked by its issuer.


Upon execution, this file enumerates all files on a hard drive, wipes the partition info and then forces a system reboot, which predictably results in the following screen:


Further analysis has confirmed that the malware accepts command-line arguments allowing an attacker to instruct the malware to sleep for a period of time or to shut down the system.


Additionally the kernel module responsible for the actual wiping activity is from a legitimate application called EaseUS Partition Master.


This software is designed as free partition software that can reorganize disk space for better performance.


In tracking this threat, early reports show that the malware has been deployed against a financial institution in Ukraine as well as two contractors in Latvia and Lithuania that provide services to the Ukrainian Government.


Additionally, ESET researchers have warned that they found this malware installed across “hundreds of machines” in Ukraine.


Concurrent with the discovery of wiper malware, we also witnessed a second round of website defacements on Feb. 23.


These attacks appear to have copied the messaging template observed in attacks exploiting the OctoberCMS vulnerability a month earlier on Jan.14, while adding a .onion web address and a message in red font that translates to, “Do you need proof, see the link at the end.”


The .onion site links to an entity calling themselves “Free Civilian” and offering to sell databases containing the personal data of Ukrainian citizens.


Over the past 24 hours, the list of entities on the leaks section has expanded to 48 gov.ua domains and one Ukranian company (motorsich[.]com) that builds engines for airplanes and helicopters.


Our team analyzed the larger trends regarding Ukraine-related phishing and scam URLs detected by Advanced URL Filtering.


We noticed an overall increase in the detection of websites that host phishing and scam URLs on domains using Ukraine-related TLDs such as gov.ua and com.ua, or containing popular Ukraine-related keywords such as "ukraine" and "ukrainian".


This trend correlates with an increase in Google searches for terms like "Ukraine aid."


From January to late February, it appears that the number of Ukraine-related phishing and scam sites largely followed a similar trend as Ukraine-related internet searches; however, the number of phishing and scam sites has continued to rise through mid-late March as the situation remains ongoing.


Figure 8 shows that the number of Ukraine-related phishing/scam sites is currently continuing to rise about a month after the “Ukraine aid” search term started trending in Google search.


Among these phishing and scam URLs, we found a targeted phishing attack.


On March 16 while ingesting a third-party data feed, our in-house machine learning models detected a phishing webpage targeting a Ukrainian state administration employee.


The webpage is imitating a popular cloud file storage site.


Upon visiting the webpage, the “Username” field is pre-


populated with the targeted employee’s email address, and the user is then prompted to enter in their password in order to view a sensitive document as shown in Figure 9.


Figure 9. hxxps://startrackzm[.]com/wap-admin/ONE-DRIVE/one%20d%20%20no%20auto.php?Email=REDACTED@REDACTED.gov.ua.


A phishing webpage targeting a Ukrainian state administration employee, detected by our in-house machine learning models on March 16.Our teams at Palo Alto Networks are actively monitoring the phishing landscape surrounding Ukraine-related URLs and are sharing this threat intelligence with relevant authorities in Ukraine and internationally.


We are also sharing a list of IoCs that were detected as phishing and scam URLs.


Palo Alto Networks customers who subscribe to Advanced URL Filtering are already protected from these IoCs.


We monitored a list of 50 legitimate Ukraine-related domains (e.g., popular news and donation websites) and keywords (e.g., Ukraine, refugee) as targets for cybersquatting.


We detected 11,637 cybersquatting newly registered domains (NRDs) during February and March.


In particular, we noticed a sharp increase in the number of cybersquatting domains that were registered close to Feb. 24, as shown in Figure 10 below.


We manually analyzed a sample set of these cybersquatting domains.


Below we share some interesting case studies.


A detailed analysis of these domains revealed that many of them are fake.


These donation websites provide little to no information about the associated organization and distribution of funds.


Many of these websites use cryptocurrency wallets (e.g., BTC, ETH) to accept payment (likely because these wallets are easy to set up and require no verification).  We also find that some websites are mimicking popular donation websites or organizations to trick users into paying them money.


We show some examples in Figure 11.


For instance, donatetoukraine[.]com is pretending to be associated with the popular Come Back Alive campaign.


While the banking information shared on the donation website matches the original campaign website, we confirmed that the BTC wallet address is different from the actual.


We found a cybersquatting domain – save-russia[.]today – that is launching DoS attacks on Ukrainian news sites.


Once a user opens the website in the browser, it starts making requests to various Ukrainian news sites and lists the number of requests made to each new site on the home page, as shown in Figure 12 below.


Figure 12.


A cybersquatting domain save-russia[.]today is launching DoS attacks on Ukrainian news sites.


We strongly recommend that users be alert to the possibility of cybersquatting domains.


In particular, fake donation websites mimicking popular websites can be misleading, as described earlier.


Before donating money, we recommend checking whether the website is referenced and shared by the official charity or government organization.


Our teams at Palo Alto Networks will continue monitoring domain squatting attacks and work to protect customers against them.


We detected campaigns of fake downloads where threat actors have set up web pages to host malicious binaries.


Most of these web pages show malicious binaries as popular browsers or communication apps in order to deceive users.


For example, we detected a website that was distributing a malicious binary by masquerading as a popular global communication app targeting users in Ukraine.


Note that Palo Alto Networks customers receive protections against such domains from the Next-Generation Firewall via Advanced URL Filtering, DNS Security and WildFire URL Analysis subscriptions.


We also found that these fake download campaigns rotate domains to distribute the same malicious binaries.


For example, we detected two domains distributing the same malicious binary where one domain was impersonating a popular, widely used video conferencing application and the other a widely used internet browser.


Our teams at Palo Alto Networks will continue to monitor and work to protect our customers against such attacks.


Consistent with our previous reporting on the situation, Unit 42 continues to lead a company-wide effort to collect, evaluate and disseminate the latest intelligence on cyber activity related to Russia and Ukraine.


We are actively collaborating with our partners in industry and governments to share our analysis and findings based on our global threat telemetry network.


These efforts have enabled us to make near-daily updates to our platform to ensure our customers have the best protection possible.


This includes blocking hundreds of domain names, IP addresses and URLs for our customers related to newly discovered attacks.


We’ve updated and added signatures to the WildFire analysis and Cortex XDR Prevent and Pro products to block newly discovered vulnerabilities and malware including HermeticWiper.


Read more about Cortex XDR protections.


Our Threat Prevention and Web Application and API Security products added coverage for the OctoberCMS vulnerability exploited in the WhisperGate attacks, and we released an XSOAR Playbook to help organizations hunt for this threat.


Cortex Xpanse can assist with understanding and managing your organization’s attack surface as well as identifying vulnerable resources.


We have released public reports on the WhisperGate attacks and the infrastructure and tactics used by the Gamaredon group.


On the Unit 42 website, you will also find a free ATOM which contains a structured mapping of the Gamaredon group’s tactics aligned to MITRE’s ATT&CK framework.


As the situation continues to develop, we’ll continue to update our blog with the latest information.


There is no single action you can take to protect your organization against this threat.


Unlike a new malware family or vulnerability in the wild, the attacks we expect could come in many forms.


Several western governments have proposed broad recommendations focused on technical hygiene.


We consider these appropriate given the variety of tactics that Russian actors have used in the past.


We recommend organizations prioritize actions in the following four areas:  There is no way to know for certain what shape an attack may take, but taking these steps will help provide broad protection against what we expect to come.


Unit 42, the threat intelligence and security consulting arm of Palo Alto Networks, has a team of experts who can help your organization assess and test your security controls with proactive assessments and incident simulation services.


Because of the likelihood of ransomware attacks – or destructive attacks that pose as ransomware – it may be beneficial to focus on preparing in this area, particularly ensuring backup and recovery plans are in place.


We have distilled the knowledge we’ve gained from responding to hundreds of ransomware incidents into our Ransomware Readiness Assessment offering, which is designed to help organizations strengthen their processes and technology to mitigate threats like the ones we expect in the coming days and weeks.


If you think you may have been compromised by wiper attacks, Gamaredon, DDoS attacks or other cyber activity related to Russia-Ukraine, or have an urgent matter, get in touch with the Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200.


Threat Brief: Ongoing Russia and Ukraine Cyber Conflict (Jan. 20) Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated Feb. 16)


Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot Threat Briefing: Protecting Against Russia-Ukraine Cyber Activity Palo Alto Networks Resource Page: Protect Against Russia-Ukraine Cyber Activity Cortex XDR Protections Against Malware Associated with Ukraine and Russia Cyber Activity


CISA: Shields Up Technical Guidance  1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e 3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767 2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf 06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397 Name


Hermetica Digital Ltd Thumbprint 1AE7556DFACD47D9EFBE79BE974661A5A6D6D923 Serial Number 0C 48 73 28 73 AC 8C CE BA F8 F0 E1 E8 32 9C EC


Please see the IoCs on GitHub.


In Alert AA22-011A (updated March 1, 2022), the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (DHS/CISA) identifies a selection of vulnerabilities that Russian advanced persistent threat (APT) groups are assessed to have exploited in the past, but recommends that users take action against a much broader list of known exploited vulnerabilities (KEVs).


The cited KEVs and their impacted devices – all of which can be identified using Cortex Xpanse – are:   Cortex Xpanse’s ability to index the entire internet helps organizations discover, prioritize, and remediate significant exposures on their attack surfaces – including all of the impacted services listed above.


We routinely observe vulnerable devices across the global internet, despite the fact that most of these CVEs are more than two years old.


Beyond Alert AA22-011A, CISA’s overarching guidance for attack surface reduction includes hardening of forward-facing network services, with prioritized patching of KEVs, as documented in Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (KEV).


This directive requires agencies to remediate all vulnerabilities that CISA includes in their KEV catalog based on an assessment that the vulnerabilities “carry significant risk to the federal enterprise.”


Learn more and see a detailed workflow example on the Palo Alto Networks SecOps blog, “How Xpanse Can Identify CISA-Identified Known Exploited Vulnerabilities.”


Updated April 1, 2022, at 11 a.m. PT.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Recent events continue to highlight the abuse of remote access applications in the enterprise.


Last Tuesday, Trusteer reported that a new variant of Citadel, which has long relied on VNC to give attackers remote control over systems, began adding new credentials to systems it infects and enabling the standard Windows remote desktop application (RDP).


This allows the attacker to maintain control over the system even after the Citadel infection is removed.


As the report indicates, using RDP this way also allows the attackers to “fly under the radar” as RDP is commonly used by administrators and often not treated as a threat.


Later that same week, US-CERT released alert TA14-212A on the Backoff Point of Sale (PoS) malware, which describes how malicious actors used publicly available tools to identify organizations that use remote access applications in an unsafe way.


This reconnaissance was then leveraged in brute force attacks against credentials, toward unauthorized access, implant installation, and subsequent exfiltration of consumer payment data.


As with any tool, remote access applications can be used for good or malicious intent.


It would be inefficient for an administrator to travel to a physical office to make a change on a system, but its critical that organizations take control over these applications.


The first step is identifying them in your network.


Palo Alto Networks currently tracks 90 different remote-access applications in Applipedia.


Examples include Remote Desktop Protocol (RDP), Virtual Network Connection (VNC), TeamViewer, and even Secure Shell (SSH), to name a few.


Once you can identify the traffic, you need to separate the good from the bad.


If your company runs Windows and relies on RDP, you can close off VNC, TeamViewer and the other 87 applications because you don’t need them.


If your administrators and help desk are the only ones who need RDP access to your systems, disable RDP for the rest of your users.


The key is putting a policy in place and making sure your technology is enforcing that policy at the network layer.


The Backoff and Citadel reports from last week highlight how uncontrolled remote access broadens your attack surface and acts as a backdoor for attackers already in your network.


Remote-access abuse is not a new problem.


We’ve been highlighting the importance of controlling this threat since 2009, but five years later it remains an issue for many organizations.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


The latest development in the ransomware world is CryptoWall 2.0, a new version of this malware family that uses the Tor network for command and control.


F-Secure was the first to spot this new version on October 1, but since then the attacks have ramped up and new variants of the malware are emerging daily.


Our WildFire analysis platform has picked up 84 CryptoWall 2.0 variants since September 30, delivered primarily through e-mail attachments but also through malicious PDFs and web exploit kits.


CryptoWall 2.0 is similar to other ransomware attacks that have plagued users and businesses for nearly a decade.


Once it is running on a system, CryptoWall 2.0 seeks out document files and encrypts them using the RSA encryption algorithm.


The attacker holds the key necessary to decrypt the files unless the victim agrees to pay a $500 ransom.  Unlike previous versions of CryptoWall, 2.0 communicates with its command and control (C2) server through the Tor anonymization network.


This allows attackers to hide their communications and avoid having their C2 servers shut down, but also makes it easy for organizations to block the threat.


CryptoWall isn’t the only threat that communicates over Tor and if your network doesn’t have an explicit reason to allow anonymization networks, you should consider blocking the application altogether with your firewall.


If your system has already been infected with CryptoWall 2.0, you’ll see a pop-up just like this one shortly after the malware has encrypted your documents.


Note that the attacker has given you a few options for how to pay them the ransom.


The green box contains four links that will work only for your system.


These use four domains registered just today:


All of the domains currently resolve to 151.248.115.146, a Russian IP address and have WhoIs records associated with the e-mail address “ladomfichisi1987@mail.ru”.


This is the same address used to register two other payment domains registered earlier this month:


If these domains are confiscated or otherwise shut down, CryptoWall instructs the user to download the Tor Browser and access a website (paytordmbdekmizq.onion) that is only accessible over the Tor network.  Unlikely some of it’s more flexible competition, CryptoWall only accepts ransom in the form of BitCoin.


To pay the ransom the user will need to acquire 1.33 BitCoins and transfer them to a specific BitCoin wallet that is associated with their specific infection.


History has shown that paying the ransom will likely allow you to retrieve your files, but the best defense against ransomware is having up-to-date back-ups or by preventing the infection all-together.


Since we detected the first CryptoWall 2.0 variant with our WildFire engine on September 29, we’ve seen over 85,000 separate attacks attempting to deliver the malware.


The majority of these have come through e-mails with executable attachments, sometimes contained in .zip files.


Most of the e-mail attacks used fake invoice, fax and voicemail themes with attachments named like the following:


In the last week we’ve seen the attack vectors evolve to contain exploit kits as well.


On October 19, the Kafeine posted a blog discussing the inclusion of CVE-2014-0556 in the Nuclear Pack exploit kit, which was installing CryptoWall 2.0.


Yesterday we picked up an e-mail campaign pretending to be a fax report that carried a .zip attachment with a PDF inside.


The PDF  exploits CVE-2013-2729 to download a binary which also installed CryptoWall 2.0.


The best way to protect yourself against ransomware is to keep up-to-date backups of your important files.


A ransomware infection, which encrypts all of your files, is similar to a drive failure, except that for a small fee you have the chance to get your files back.


To protect against CryptoWall 2.0 we recommend taking the following actions:  Adobe Reader Embedded BMP Parsing Integer Overflow Vulnerability  CVE-2014-0556  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Yesterday, TrustedSec, a security consultancy based on Ohio, wrote that the recent breach at Community Health Systems (CHS) was the result of exploitation of the Heartbleed OpenSSL vulnerability (CVE-2014-0160).


CHS’s 8-K filing on Monday did not reveal how the attackers got into their network, only that the records of approximately 4.5 million patients were stolen in attacks in between April and June of 2014.


TrustedSec reports on how attackers were apparently able to glean user credentials from a certain device via the Heartbleed vulnerability and use them to log in via a VPN.


We need more facts to be sure, but this instance may be the first public breach related to the Heartbleed vulnerability since it was announced in April.


Now, over four months since the Heartbleed disclosure, this attack reminds us of how serious this vulnerability is and how critical protection against it remains.


As Heartbleed allows the attacker to scrape memory from the vulnerable device, they can retrieve significant amounts of secret information.


In this case, that apparently included VPN credentials, which they then used to log into the network and more laterally from system to system until discovering the data they were after.


While most vendors released patches for their products months ago it remains up to the users and administrators to ensure those patches are deployed.


As the OpenSSL library is so widely used, some administrators may be finding unpatched systems for years to come.


While network-based defenses are not a substitute for patching software, Heartbleed is detectable using IPS signatures.


Palo Alto Networks deployed five signatures in April to defend against this threat, 40039, 36420, 36419, 36418 and 36416.


No matter how well patched your systems are, there’s no reason not to deploy IPS signatures like these to detect and block attempted Heartbleed exploits.


If you’ve already deployed signatures and your logs are showing attempted exploits, consider blocking or monitoring the IP addresses sending the requests.


A Heartbleed probe could be evidence of the early stages of an attack on your network, and persistent attackers are unlikely to give up after jiggling the handle on the front door.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  On June 2, Volexity reported that over Memorial Day weekend, they identified suspicious activity on two internet-facing servers running Atlassian’s Confluence Server application.


After analysis of the compromise, Volexity determined the initial foothold was the result of a remote code execution vulnerability in Confluence Server and Data Center.


The details were reported to Atlassian on May 31, and Atlassian has since assigned the issue to CVE-2022-26134.


Based on the security advisory issued by Atlassian, it appears that the exploit is indeed an unauthenticated, remote code execution vulnerability.


If the vulnerability is exploited, threat actors could bypass authentication and run arbitrary code on unpatched systems.


At the time of publication, the Palo Alto Networks attack surface management solution Cortex Xpanse identified 19,707 instances of Confluence Servers that are potentially affected by this CVE.


A patch resolving the issue has been posted by Atlassian.


Palo Alto Networks strongly advises organizations to patch immediately.


Updated June 7 to add additional in-the-wild observations.


Vulnerable Systems CVE-2022-26134 in the Wild Cortex Managed Threat Hunting Detections of CVE-2022-26134


Conclusion Indicators of Compromise


The Palo Alto Networks attack surface management solution Cortex Xpanse found 19,707 instances of Confluence Servers that are potentially affected by this CVE.


Additionally, the Xpanse research team also found 1,251 end-of-life versions of the Confluence Server exposed on the public internet.


Assets running end-of-life software should never be internet-facing.


If an asset cannot be updated to secure versions of software, it should be isolated or decommissioned altogether.


To learn more about the ubiquitous problem of end-of-life software, please refer to the 2022 Cortex Xpanse Attack Surface Threat Report.


Thus far, Unit 42 has noted historical scans being performed by the IP addresses publicly shared by Volexity.


These scans date back as early as May 26, 2022, and target organizations in various industries.


Additionally, a purported proof of concept (PoC) has reached the public domain, increasing the threat this particular vulnerability poses.


The Cortex Managed Threat Hunting team has detected several exploitation attempts.


Among the attempts, we found successful exploitation, which resulted in the Cerber Ransomware attack.


The ransomware was blocked by the Cortex XDR agent.


The Managed Threat Hunting team immediately reported this incident to the customer and continues to monitor our customers using the XQL queries in the following section.


Cortex XDR also includes multiple detections for post-exploitation activities.


Below are details of what was seen in the attempt.


In this case, the process tomcat.exe spawned multiple reconnaissance commands such as: whoami, systeminfo, arp, ipconfig, etc.  On top of that, a Base64-encoded PowerShell command was executed and retrieved a ransomware binary.


In order to confirm the assumption that the above activity is related to CVE-2022-26134, we looked into the Confluence Apache access logs (atlassian-confluence.log) and found the PowerShell execution.  The Cortex Managed Threat Hunting team continues to track any attempts to exploit CVE-2022-26134 across our customers, using Cortex XDR and the XQL queries below.


Palo Alto Networks provides protection against the exploitation of this vulnerability in the following ways:  Additionally, Xpanse has the ability to identify and detect Atlassian Confluence Servers that may be a part of your attack surface or the attack surface of third-party partners connected to your organization.


Xpanse is even able to classify those servers which have not been upgraded to the most recent version.


These abilities will be updated to detect additional instances or versions that are insecure against this CVE.


Existing Xpanse customers can log into Expander and identify their enumerated Atlassian Confluence devices by filtering by “Atlassian Confluence Server” in the Services tab.


As further information emerges or additional detections and protections are put into place, Palo Alto Networks will update this publication accordingly.


During the hunting process, we encountered exploitation attempts that originated from the following IP addresses: Updated June 13, 2022, at 5:30 a.m. PT.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Overview


As shoppers and retailers gear up for the 2017 holiday season, they need to be aware of a new kind of cybersecurity threat they may face this year: unauthorized coin mining.


Unauthorized coin mining is a new threat that can affect retailers and shoppers in a way that could impact or even halt their online shopping experience.


A recent Unit 42 threat intelligence posting on the topic showed how 63 percent of the unauthorized coin mining sites we found came online in October 2017.


This surge in unauthorized coin mining is driven, in large part, by the recent skyrocketing in the value of digital currencies like bitcoin.


As that trend shows no sign of slowing down anytime soon, we can expect this to remain a very lucrative avenue for attackers.


Unlike other cybersecurity threats we’re used to bracing for around the holiday season, unauthorized coin mining attacks can affect shoppers who are up-to-date with security patches and even some running some security protections.


And unlike spam or phishing, these attacks also don’t require any lapse in vigilance by the user: they can happen simply by going to websites users know and trust.


The good news for retailers is that these attacks are wholly preventable.


And for shoppers, the impact of a successful attack is minimal: there are no lasting effects or impact, making it an annoyance at worst.  But because of the potential impact on holiday shopping and the ease of attacks, unauthorized coin mining is an attack that retailers need to be aware of and take active steps for prevention this holiday season.


What Is Unauthorized Coin Mining?


The best way to understand the threat of unauthorized coin mining is to first understand its impact.


Unauthorized coin mining is an attack that can cause a user’s system to suddenly and unexpectedly slow down, sometimes significantly, when visiting a website.


In a worst case, the slow-down can be so severe that it can make a website basically unusable.


Obviously, this impact is potentially dire for shoppers and retailers as it directly impacts and harms the online shopping experience.


What causes this impact is when the website the user visits is running “coin miner” code.


“Coin miner” code is code used to “mine” for digital currency like bitcoin.


Mining provides the computing necessary to power the digital currency’s infrastructure.


Mining is also a computationally intensive process, meaning it takes a lot of system resources.


Because of this, people can earn digital currency credit in exchange for the use of their computing resources to power that digital currency’s infrastructure.


There are many kinds of coin mining software.


In this case, we are concerned about coin mining code that’s used on websites.


When the user visits the website, the code runs on their system and “mines” on behalf of others – either the website or someone else.


When this is done with the visitor’s full knowledge and consent, it’s a fair and reasonable exchange.


For instance, there are some websites that now use coin mining as an alternative to digital advertising to generate revenue.


In these cases, the coin mining is authorized; the website informs the user that, while on the site, his or her computing resources will be used to “mine” digital currency, and the site will receive the credits.


While the user will experience a slow-down as the coin mining software is run, it is (or should be) expected, because of the notification, and so done with the site visitor’s consent.


Where this becomes a problem is when coin mining is done without the user’s knowledge and consent.


In this case the coin mining is unauthorized: in essence, it’s an attack against the user’s resources.


How Do Unauthorized Coin Mining Attacks Happen?


Unauthorized coin mining attacks happen very simply: the website the user is visiting has special code on it that performs coin mining operations on the visitor’s computer while they’re on the website.


And, as noted before, this happens without the user’s knowledge or consent.


Because these attacks happen due to code on the website, that code is either there with the site owner’s knowledge and permission or not.


When unauthorized coin mining happens with the site owner’s knowledge and permission, it’s basically a malicious site.


That site’s owner is the attacker.


When we’re talking about online shopping, clearly there’s no threat here to the retailer: they’re the ones doing the attacking.


And for the shopper, it means you’re on an untrustworthy site and so open to all manner of risks beyond just unauthorized coin mining.


The real, significant situation shoppers and retailers need to think about this season is when unauthorized coin mining code is on a site without that site owner’s knowledge and permission.


Here the site itself has been attacked, and the site owners are also victims.


This is an attack against not just shoppers but the retailers operating online shopping sites.


How You Can Prevent Unauthorized Coin Mining Attacks  If you’re a shopper, there are three things you can do to protect yourself against unauthorized coin mining attacks this holiday season:  If you’re a retailer, preventing unauthorized coin mining attacks comes down to focusing on two tasks, both of which you should be doing anyway:  Finally, if you’re a legitimate website that has chosen to implement coin mining to raise funds from your visitors, you can ensure that your visitors don’t think you’re engaged in unauthorized coin mining by doing three things:  Conclusion  Working to prevent cybercrime threats during the holiday season has become a standard part of what shoppers and retailers do every year.


This year, for the first time in many years, shoppers and retailers are facing a new threat, unauthorized coin mining, driven by the surge in digital currency prices.


While this threat can have a clear, negative impact on retailers and shoppers, the good news is that this threat is easily preventable and poses no lasting harm to consumers.


This is a case where forewarned is forearmed, and that forearming can result in effective prevention.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  Intro


One of the most important “innovations” in malware in the past decade is what’s called a Domain Generation Algorithm (“DGA”)”.


DGA is an automation technique that attackers use to make it harder for defenders to protect against attacks.


While DGA has been in use for over 10 years now, it’s still a potent technique that has been a particular challenge for defenders to counter.


Fortunately, there are emerging technologies now that can better counter DGAs.


What is it?


A Domain Generation Algorithm is a program that is designed to generate domain names in a particular fashion.


Attackers developed DGAs so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware (usually referred to as “command and control” or C2).


Attackers use DGA so that they can quickly switch the domains that they’re using for the malware attacks.


Attackers do this because security software and vendors act quickly to block and take down malicious domains that malware uses.


Attackers developed DGA specifically to counter these actions.


In the past, attackers would maintain a static list of malicious domains; defenders could easily take that list and start blocking and taking down those sites.


By using an algorithm to build the list of domains, the attackers also make it harder for defenders to know or predict what domains will be used than if they had a simple list of domains.


To get that list of domains that the malware will use, defenders have to decode the algorithm which can be difficult.


Even then, taking down sites that malware using a DGA can be a challenge as defenders have to go through the process of working with ISPs to take down these malicious domains one by one.


Many DGAs are built to use hundreds or even thousands of domains.


And these domains are often up for only limited periods of time.


In this environment blocking and taking down DGA-related domains quickly becomes a game of “whack a mole” that is sometimes futile.


Why should I care, what can it do to me?


DGA by itself can’t harm you.