{"id":470647,"date":"2021-04-05T07:58:25","date_gmt":"2021-04-05T11:58:25","guid":{"rendered":"http:\/\/www.marketnewsdesk.com\/?p=470647"},"modified":"2021-04-05T07:58:25","modified_gmt":"2021-04-05T11:58:25","slug":"black-lotus-labs-releases-threat-intelligence-report-showing-newly-discovered-watering-hole-attack-that-targeted-ukrainian-canadian-organizations","status":"publish","type":"post","link":"https:\/\/www.marketnewsdesk.com\/index.php\/black-lotus-labs-releases-threat-intelligence-report-showing-newly-discovered-watering-hole-attack-that-targeted-ukrainian-canadian-organizations\/","title":{"rendered":"Black Lotus Labs\u00ae releases threat intelligence report showing newly discovered watering hole attack that targeted Ukrainian, Canadian organizations"},"content":{"rendered":"
\n

Attackers’ tradecraft mimics that of recent hack of San Francisco International Airport websites<\/h2>\n

PR Newswire<\/p>\n<\/p><\/div>\n

\n

\n DENVER<\/span>, April 5, 2021<\/span> \/PRNewswire\/ —\u00a0Black\u00a0Lotus Labs<\/a>, the threat intelligence arm of Lumen Technologies<\/a> (NYSE: LUMN), <\/b>today announced<\/a> it has uncovered a cluster of compromised websites previously used in a series of watering hole attacks. Any visitors who browsed to one of the sites would unknowingly be infected and vulnerable to the threat actor stealing a copy of their Windows authentication credentials, which could be used to impersonate them. The activity, which was only recently discovered, was identified on several Ukrainian websites and one Canadian website in 2019 and 2020. <\/p>\n

\n

\n
\n \"Black
\n <\/a>\n <\/p>\n<\/p><\/div>\n

Watering hole attacks target websites by injecting a malicious function into the site’s code, which the victims’ machine then executes. These types of attacks have been used for years, including in a high-profile compromise that was detected on the San Francisco<\/span> International Airport’s (SFO) website<\/a> in April 2020<\/span>.<\/p>\n

In its analysis of the attacks in Ukraine<\/span> and Canada<\/span>, Black Lotus Labs observed malicious activity that appeared to exhibit the same tradecraft as the San Francisco<\/span> airport attack. As a result, the team has clustered the activity to the same actor. <\/p>\n

To disrupt the attacks in Ukraine<\/span> and Canada<\/span>, Black Lotus Labs notified the owners of the compromised websites of these findings. <\/p>\n

\n How the Attacks Were Executed<\/b>\n <\/p>\n

In the case of the Ukranian, Canadian, and San Francisco<\/span> airport websites, malicious JavaScript prompted the victims’ devices to send their New Technology LAN Manager (NTLM)<\/a> hashes to an actor-controlled server using Server Message Block (SMB), a communications protocol that enables shared access to system resources such as printers and files. In this type of attack, once the threat actor obtains the hashes they can, in some cases, be cracked offline to reveal usernames and passwords.<\/p>\n

“Our mission is to leverage our network visibility to help protect our customers and keep the internet clean, so we will continue to monitor this actor and this type of watering hole activity,” said Mike Benjamin<\/span>, head of Black Lotus Labs. “To protect against this type of attack, organizations should configure their firewalls to prevent outbound SMB-based communications from leaving the network, or consider turning off or limiting SMB<\/a> in the corporate environment.” <\/p>\n

\n Additional Information:<\/b>\n <\/p>\n