The original purpose of BitLocker is to address the risks of data theft or exposure from lost, stolen, or improperly decommissioned devices.
Nonetheless, threat actors have found out that this mechanism can be repurposed for malicious ends to great effect. In that incident, the attackers were able to deploy and run an advanced VBS script that took advantage of BitLocker for unauthorized file encryption. We spotted this script and its modified versions in Mexico, Indonesia, and Jordan. In the sections below, we analyze in detail the malicious code obtained during our incident response effort and provide tips for mitigating this kind of threat.
Read more…
Source: Kaspersky
Related:
- WannaCrypt victims paid out over $140k in Bitcoin to get files unscrambled
August 3, 2017
More than $140,000 (£105,000) in Bitcoin has been paid out by victims of the global WannaCrypt ransomware outbreak from May. The money was removed from the online wallets at 4am UTC on Thursday. The Bitcoin activity was noticed by a Twitter bot set up by Quartzjournalist Keith Collins. The attack swept across at least 74 countries, and the UK’s ...
- Hackers Hijacked Chrome Extension for Web Developers With Over 1 Million Users
August 2, 2017
From past few years, spammers and cyber criminals were buying web extensions from their developers and then updating them without informing their users to inject bulk advertisements into every website user visits in order to generate large revenue. But now they have shifted their business model—instead of investing, spammers have started a new wave of phishing ...
- $39 million cyber heist crooks caught by Omani agency
August 2, 2017
Omani forensic specialists helped track down online crooks who stole $39 million from a government bank, the director of the Internet Technology Agency has revealed. A cyber attack on an Oman bank in 2013 sparked a global manhunt across 24 nations that led to the arrests of seven people in the USA, according to Dr Badr ...
- Virgin America Hacked, Employee Passwords and Personal Information Compromised
July 28, 2017
Virgin America has confirmed in a letter sent to employees that its network was compromised by hackers, with data belonging to thousands of workers compromised and possibly stolen by the attackers. While an investigation is already under way, the airline did not provide any specifics about the hackers, saying instead that it’s working with law enforcement ...
- Attack Uses Docker Containers To Hide, Persist, Plant Malware
July 27, 2017
A novel attack vector allows for adversaries to abuse the Docker API to hide malware on targeted systems, and even execute remote code. The proof of concept attack was developed by researchers at Aqua Security, and the technique was first demonstrated today at Black Hat by Sagie Dulce, senior security researcher, with Aqua Security. The attack works ...
- UniCredit Bank Hacked, 400,000 Accounts Exposed
July 26, 2017
UniCredit has just announced in an official statement that its servers were breached by hackers, with details of approximately 400,000 clients said to be exposed. The bank explained that hackers managed to get inside its systems in Italy twice in the last 12 months. The first hack took place in September and October 2016, while the ...