Schließen
Schließen
Ihr Netzwerk von morgen
Ihr Netzwerk von morgen
Planen Sie Ihren Weg zu einem schnelleren, sichereren und widerstandsfähigeren Netzwerk, das auf die von Ihnen unterstützten Anwendungen und Benutzer zugeschnitten ist.
          Erleben Sie Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Netskope debütiert als Leader im Gartner ® Magic Quadrant ™ für Single-Vendor SASE
              Generative KI für Dummies sichern
              Generative KI für Dummies sichern
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Moderne Data Loss Prevention (DLP) für Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modernes SD-WAN für SASE Dummies-Buch
                  Modern SD-WAN for SASE Dummies
                  Hören Sie auf, mit Ihrer Netzwerkarchitektur Schritt zu halten
                    Verstehen, wo die Risiken liegen
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                            Netskope GovCloud
                            Netskope erhält die FedRAMP High Authorization
                            Wählen Sie Netskope GovCloud, um die Transformation Ihrer Agentur zu beschleunigen.
                              Let's Do Great Things Together
                              Die partnerorientierte Markteinführungsstrategie von Netskope ermöglicht es unseren Partnern, ihr Wachstum und ihre Rentabilität zu maximieren und gleichzeitig die Unternehmenssicherheit an neue Anforderungen anzupassen.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Technischer Support von Netskope
                                  Technischer Support von Netskope
                                  Überall auf der Welt sorgen unsere qualifizierten Support-Ingenieure mit verschiedensten Erfahrungen in den Bereichen Cloud-Sicherheit, Netzwerke, Virtualisierung, Content Delivery und Software-Entwicklung für zeitnahen und qualitativ hochwertigen technischen Support.
                                    Netskope-Video
                                    Netskope-Schulung
                                    Netskope-Schulungen helfen Ihnen, ein Experte für Cloud-Sicherheit zu werden. Wir sind hier, um Ihnen zu helfen, Ihre digitale Transformation abzusichern und das Beste aus Ihrer Cloud, dem Web und Ihren privaten Anwendungen zu machen.

                                      CloudFanta Pops with the Cloud using SugarSync

                                      Oct 18 2016
                                      Tags
                                      Cloud Best Practices
                                      Cloud Malware
                                      Cloud Security
                                      Netskope Threat Research Labs
                                      Tools and Tips

                                      Netskope Threat Research Labs has discovered a new malware campaign, which we suspect stole more than 26,000 email credentials and also monitors online banking activities. The malware, which we have named “CloudFanta,” has been in operation since July 2016 and primarily targets Brazilian users.

                                      This blog provides a preliminary overview of CloudFanta while we wait on the command and control hosts and cloud vendor to take down the malware and servers containing the email credentials.

                                      Similar to the CloudSquirrel malware campaign that we uncovered in July 2016, CloudFanta arrives as an attachment or a link in a spearphishing email that lures the victim to execute the file or click the link. We observed the CloudFanta malware using the SugarSync cloud storage app for delivering a JAR file that functions as a downloader. The downloader JAR file again uses SugarSync for downloading Dynamic Linked Library (DLL) files with a “.png” extension. These DLL files, which are later renamed to the extension “.twerk,” are responsible for stealing the victim’s email credentials, sending malicious emails on behalf of the victim, and also for monitoring victims’ online banking activities.

                                      Summary Observations

                                      A high-level visual depiction of the CloudFanta malware infection is shown in Figure 1. The CloudFanta malware campaign highlighted the use of the cloud storage app, SugarSync for hosting drive-by-download files. Using tactics like the delivery of DLL files with the “.png” extension and the use of SSL/HTTPS communication with SugarSync allow CloudFanta to stay under the radar of a number of traditional, network-based security solutions. This clearly demonstrates the effective use of cloud services for hosting malware by malicious threat actors. The use of cloud services makes the delivery of malware very easy, effectively making it easier to compromise and gain access to users’ data. This clearly signifies an urgent need for enterprises to employ a multi-layered security approach with a strong focus on cloud services.

                                      fig1

                                      Figure 1: Visual depiction of CloudFanta malware infection

                                      Netskope Detection and Remediation

                                      The visual depiction of protection from CloudFanta malware with Netskope Threat Protection is shown in Figure 3. Netskope Threat Protection detects the files retrieved from the JAR downloader as Backdoor.Generckd.3549404, Backdoor.Generckd.3540808, Backdoor.Generckd.18673650, Backdoor.Generckd.3542220 and Gen:Variant.Symm.60013. Customers with the Netskope Active Platform and Netskope Introspection can set the respective malware and threat protection policies to detect and remediate against this malware. In addition to the above, Netskope Active platform customers can also block the DLL files with “.png” extension from being downloaded using a custom rule as shown in Figure 2.

                                      fig2

                                      Figure 2: Block policy alert for portable executable files with “.png” extensions
                                      fig3

                                      Figure 3: Visual depiction of protection from CloudFanta malware with Netskope Threat Protection

                                      General Recommendations

                                      Netskope recommends the following to combat cloud malware and threats:

                                      • Detect and remediate all malware in sanctioned cloud services using a threat-aware solution like Netskope Introspection.
                                      • Detect and remediate all malware being downloaded from unsanctioned cloud services using a threat-aware solution like the Netskope Active Platform.
                                      • Actively track usage of unsanctioned cloud services and enforce DLP policies to control files and data entering and leaving your corporate environment.
                                      • Create a security policy to block portable executable files with content type “image/png.”
                                      • Regularly back up and turn on versioning for critical content in cloud services.
                                      • Enable “view known file extension” options in Windows and avoid executing any file with dual extensions unless you are sure they are benign.
                                      • Warn users to avoid opening untrusted attachments regardless of their extension or file name.
                                      • Enable two-factor authentication for email and banking accounts as a safety measure to prevent attackers from accessing the email account even if they know the password.
                                      • Keep systems and antivirus updated with the latest releases and patches.

                                      We will be publishing a detailed technical blog on CloudFanta soon.

                                      Bleiben Sie informiert!

                                      Abonnieren Sie den Netskope-Blog