Avengers: Endgame Leaked Online in China

4/26/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s1600/avengers-endgame-full-movie-download.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers-endgame-full-movie-download" border="0" data-original-height="468" data-original-width="1600" height="186" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s640/avengers-endgame-full-movie-download.jpeg" title="avengers-endgame-full-movie-download" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lately as hackers and <a href="https://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercriminals</a> are trying their best to benefit from the movie’s widespread, intense hype.<br />
<br />
Last week, Marvel fans were requested to not use social media after a video made via mobile phone containing movie spoilers was posted online. Now that the movie has been released in China and just a day is left in its US release, reports are rife that a camera version of the movie has been uploaded on various torrent platforms and piracy sites.<br />
<br />
TorrentFreak reveals that copy of Avengers: End Game has been recorded from a cinema in China and initially it exclusively appeared on Chinese torrent sites. It is interesting because the movie’s sponsors and producers chose to release it in China first and it is yet to be released in the US.<br />
<br />
Reportedly, this decision was taken to address the issue of piracy in the region. The movie has so far raked in $90 million in sales, that’s an impressive start for sure but the inevitable has happened as someone was able to record the movie in the cinema and upload it online.<br />
<br />
According to the analysis from <a href="https://torrentfreak.com/avengers-endgame-leaks-online-in-china-begins-to-spread-190424/">TorrentFreak</a>, their system notified about the appearance of a 1.2 GB cammed version of Avengers: End Game between 4:00 pm and 5:00 pm China local time, that’s merely a few hours after the movie was released in China.<br />
<blockquote class="tr_bq">
Don’t spoil the Endgame.</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s1600/avengers-end-game-leaked-online.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game leaked online" border="0" data-original-height="340" data-original-width="600" height="362" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s640/avengers-end-game-leaked-online.jpg" title="avengers end game leaked online" width="640" /></a></div>
As soon as the movie was released online, dozens of users located in <a href="https://www.hackerschronicle.com/search/label/Chinese%20Hackers">China</a> started sharing it on torrent sites. Then came the 2 GB version of the movie and new copies are also emerging at regular intervals. The initial versions were basically different variants of the first torrent shared on Thunder torrent site; it became evident because all the new variants had the same client code starting from 7.10.35.XXX.<br />
<br />
The good news is that the pirated version circulating on torrent sites is of pretty bad quality as the movie continuously flickers, is semi-rotated and there are watermarks of a gambling site visible throughout. TorrentFreak also noted that the pirated version has made it to piracy sites in the UK as well.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s1600/avengers4torrentdata-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game available on torrent" border="0" data-original-height="354" data-original-width="600" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s640/avengers4torrentdata-1.png" title="avengers end game available on torrent" width="640" /></a></div>
<br />
<br />
It is worth mentioning that the initial version of the movie’s copy was dubbed in Chinese but later another version with English audio and Chinese subtitles was released online. Moreover, an improved version of the movie has also been released that has been sponsored by a <a href="https://www.hackerschronicle.com/search/label/Russian%20Hackers">russian</a> betting company 1XBet.<br />
<br />
Avengers: End Game is touted as the final and conclusive chapter of the franchise. So far 22 films have been released since 2008 under the Marvel Cinematic Universe banner. The makers have tried their best to keep the movie’s storyline a secret, so much so that even the journalists weren’t allowed to watch the movie prior to interviewing its star cast. </div>

Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lat...

5 Million Popular Android Phones found with pre-installed malwares

3/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s1600/android-botnet-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Millions of Android infected with RoyyenSys Malware" border="0" data-original-height="380" data-original-width="728" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s640/android-botnet-malware.png" title="Millions of Android infected with RoyyenSys Malware" width="640" /></a></div>
<br />
Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android phones all over the world; almost 5 million android devices in their botnet network.<br />
<br />
<blockquote class="tr_bq">
"The Check Point Mobile Security Team has discovered a new widespread malware family targeting nearly 5 million users for fraudulent ad-revenues. They have named it ‘RottenSys’ for in the sample we encountered it was initially disguised as a System Wi-Fi service." according to checkpoint analysis report.</blockquote>
<br />
Experts found an unusual self-proclaimed system Wi-Fi service (<b>系统WIFI服务</b>) on a Xiaomi Redmi phone ans started their investigation. They found that the application does not provide any secure Wi-Fi related service to users. Instead, it asks for many sensitive Android permissions such as accessibility service permission, user calendar read access and silent download permission, which are not related to Wi-Fi service. Their key findings were: <br />
<ul style="text-align: left;">
<li>RottenSys, a mobile adware, has infected nearly 5 million devices since 2016.</li>
<li>Indications show the malware could have entered earlier in the supplier chain.</li>
<li>The attackers have been testing a new botnet campaign via the same C&C server.</li>
</ul>
<br />
The RottenSys malware implements two evasion techniques:<br />
<br />
<ul style="text-align: left;">
<li>The first technique consists of postponing operations for a set time.</li>
</ul>
<ul style="text-align: left;">
<li>The second technique uses a dropper which does not display any malicious activity at first. Once the device is active and the dropper contacts the Command and Control (C&C) server which sends it a list of additional components required for its activity.</li>
</ul>
<br />
The malicious code relies on two open-source projects:<br />
<br />
<ul style="text-align: left;">
<li>The <a href="https://github.com/wequick/small">Small  virtualization</a> framework. RottenSys uses Small to create virtualized containers for its components, with this trick the malware could run parallel tasks, overwhelming Android OS limitations.</li>
</ul>
<ul style="text-align: left;">
<li>The <a href="https://github.com/Marswin/MarsDaemon">MarsDaemon library</a> that keeps apps “undead.” MarsDaemon is used to keep processes alive, even after users close them. Using it the malware is always able to inject ad.</li>
</ul>
<blockquote class="tr_bq">
“This botnet will have extensive capabilities including silently installing additional apps and UI automation. Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices.” according to the same the analysis.</blockquote>
<br />
According to the findings, the RottenSys malware began propagating in September 2016. By 12 March 2018; 49,64,460 devices were infected by RottenSys. The <b>top impacted mobile devices brands are Honor, Huawei, and Xiaomi</b>.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s1600/android-phones-infected-with-rottebsys-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="316" data-original-width="747" height="268" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s640/android-phones-infected-with-rottebsys-malware.png" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s1600/chinese-phones-infected-with-malwares.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="329" data-original-width="543" height="386" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s640/chinese-phones-infected-with-malwares.png" width="640" /></a></div>
<br />
<br />
RottenSys is totally focusing on aggressive ad network for making huge profits. In the past 10 days alone, it displayed ads 13,250,756 times (commonly called impressions) and out of which 548,822 were converted into ad clicks. We tried to roughly calculate the revenue from these impressions and clicks according to the conservative estimation of 20 cents for each click and 40 cents for each thousand impressions. According to these calculations, <b>the attackers earned over $1,15,000 from their malicious operation in the last ten days alone!</b></div>

5 Million Popular Android Phones found with pre-installed malwares

Botnet Chinese Hackers Hacking News honor huawei Malwares rottensys xiomi 5 Million Popular Android Phones found with pre-installed malwares

Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android...

Chinese Spies using malwares to attack U.K. Government

3/12/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGm8M94_eBC7PlQ8oRsH1Y4aope0ywG21Rrhw4_Fnd_Xnf-7RQqySzE8Vivx_A0XPFFwWxmRAOdOq407qtfp7qrn9QTcDtGaAxHSyjhPgBkCp6g-H6SRtz_K2Ka2VjIXqajXnVBNl0Yd9w/s1600/Chinese-hackers-attacking-UK-Government.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Chinese Hackers Attacking UK Government with Malwares" border="0" data-original-height="667" data-original-width="1000" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGm8M94_eBC7PlQ8oRsH1Y4aope0ywG21Rrhw4_Fnd_Xnf-7RQqySzE8Vivx_A0XPFFwWxmRAOdOq407qtfp7qrn9QTcDtGaAxHSyjhPgBkCp6g-H6SRtz_K2Ka2VjIXqajXnVBNl0Yd9w/s640/Chinese-hackers-attacking-UK-Government.jpg" title="Chinese Hackers Attacking UK Government with Malwares" width="640" /></a></div>
A known cyber espionage group believed to be operating out of <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers">China </a>was last year spotted using new malware in an attack aimed at an organization that provides services to the U.K. government.<br />
<br />
Details about the attack were presented last week at Kaspersky’s Security Analyst Summit (SAS) in Cancun by Ahmed Zaki, senior malware researcher at NCC Group.<br />
<br />
The attack has been attributed to a threat actor known as APT15, Ke3chang, Mirage, Vixen Panda and Playful Dragon. NCC Group started analyzing the group’s recent activities after it targeted one of its customers, a global company that provides a wide range of services to the United Kingdom government.<br />
<br />
Acording to securityweek Researchers believe the <b>attackers had been targeting various U.K. government departments and military technology</b> through its customer. NCC has not made any statements regarding attribution, but Zaki did mention during his presentation at SAS that APT15 was particularly active during hours that correspond to working hours in East Asia.<br />
<br />
APT15 has been active since at least 2010 and it has targeted organizations all around the world using its own malware and Word, Adobe Reader and Java exploits. The group has improved its tools and techniques over the years, and NCC recently spotted two new backdoors it created.<br />
<br />
One of the backdoors has been dubbed RoyalCLI and is considered a successor of BS2005, a piece of malware that is often used by the group. RoyalCLI leverages similar encryption and encoding routines, and they both communicate with command and control (C&C) servers via Internet Explorer using the IWebBrowser2 interface.<br />
<br />
The malware uses the Windows command prompt (cmd.exe) to execute a majority of its commands. It’s designed to copy the cmd.exe file and modify it, which allows it to bypass policies that might prevent the command prompt from running on the targeted device.  <br />
<br />
The second backdoor, named RoyalDNS, uses DNS, specifically TXT records, to communicate with the C&C server. This piece of malware receives commands, executes them, and returns output through DNS.<br />
<br />
In the case of the attack analyzed by NCC, the hackers compromised more than 30 hosts, with forensic artifacts showing that the initial intrusion may have occurred as early as May 2016. NCC was asked by the client to stop its investigation in June 2017, but resumed it in August after the threat actor managed to regain access to the victim’s network. Experts determined that the hackers had stolen a VPN certificate from a compromised host and used it to regain access via the corporate VPN.<br />
<br />
The commands sent by the attackers to the RoyalCLI and BS2005 malware were cached to the disk of compromised devices, allowing researchers to recover over 200 commands. Since one of the commands contained a typo, investigators determined that they were likely sent by a human operative rather than an automated process.<br />
<br />
In addition to BS2005, RoyalCLI and RoyalDNS, APT15 used custom-built keyloggers, and Microsoft SharePoint and Exchange enumeration and data dumping tools. The group’s arsenal also includes widely available tools such as Mimikatz, CSVDE, NetEnum, and RemoteExec.<br />
<br />
Moreover, the attackers relied on various Windows commands to conduct reconnaissance, including tasklist, ping, netstat, net, systeminfo, ipconfig and bcp. For lateral movement they leveraged the net command and manually copied files to and from compromised hosts.<br />
<br />
“Through our investigation we were able to identify and monitor the attack process from start to finish, offering us unique insight into the behaviour of this group,” Zaki said. “It’s clear to see that this is a highly sophisticated threat actor that has no problem writing tools which are specific to its victims.”</div>

APT Chinese Hackers Chinese Spies Hacking News RoyalCLI RoyalDNS Chinese Spies using malwares to attack U.K. Government

A known cyber espionage group believed to be operating out of China was last year spotted using new malware in an attack aimed at an org...

Avengers: Endgame Leaked Online in China

5 Million Popular Android Phones found with pre-installed malwares

Chinese Spies using malwares to attack U.K. Government

Popular

Comments

Archive