BF-SIRT Newsletter 2018-07

NCCGroup rebuilt NotPetya, replacing its destructive payload with telemetry and safeguards to see what the impact could have been. They found the following:

• The customer ran it on one machine in their engineering network with no privileges.
• It found three machines unpatched.
• It exploited those three machines to obtain kernel level access.
• It infected those three machines.
• Within ten minutes it had gone through the entire engineering network using recovered/stolen credentials.
• It then took the domain about two minutes later.
• 107 hosts were owned in roughly 45 minutes before the client initiated the kill and remove switch.

Top 5 Security links
A rebuilt NotPetya gets its first execution outside of the lab
Cryptomining script poisons government websites – What to do
Hackers Exploit ‘Telegram Messenger’ Zero-Day Flaw to Spread Malware
Winter Olympics network outages blamed on unexplained cyberhack
UK names Russia as source of NotPetya, USA follows suit