Executive Summary
Summary | |
---|---|
Title | Avalanche (crimeware-as-a-service infrastructure) |
Informations | |||
---|---|---|---|
Name | TA16-336A | First vendor Publication | 2016-12-01 |
Vendor | US-CERT | Last vendor Modification | 2016-12-01 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : | |||
---|---|---|---|
Cvss Base Score | N/A | Attack Range | N/A |
Cvss Impact Score | N/A | Attack Complexity | N/A |
Cvss Expoit Score | N/A | Authentication | N/A |
Calculate full CVSS 2.0 Vectors scores |
Detail
“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further information about Avalanche. Description Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers. In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise. Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies. The following malware families were hosted on the infrastructure: * Windows-encryption Trojan horse (WVT) (aka Matsnu, Injector,Rannoh,Ransomlock.P) Avalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets, including the following:        * TeslaCrypt Impact A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information. Some of the malware had the capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In addition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected systems could have been used to conduct distributed denial-of-service (DDoS) attacks. Solution Users are advised to take the following actions to remediate malware infections associated with Avalanche: * "Use and maintain anti-virus software" – Anti-virus software recognizes and protects your computer against most known viruses. Even though parts of Avalanche are designed to evade detection, security companies are continuously updating their software to counter these advanced threats. Therefore, it is important to keep your anti-virus software up-to-date. If you suspect you may be a victim of an Avalanche malware, update your anti-virus software definitions and run a full-system scan. (See Understanding Anti-Virus Software [ http://www.us-cert.gov/ncas/tips/ST04-005 ] for more information.)          *ESET Online Scanner*          https://www.eset.com/us/online-scanner/ [ https://www.eset.com/us/online-scanner/ ]           *F-Secure*          https://www.f-secure.com/en/web/home_global/online-scanner [ https://www.f-secure.com/en/web/home_global/online-scanner ]          *McAfee Stinger*          http://www.mcafee.com/us/downloads/free-tools/index.aspx [ http://www.mcafee.com/us/downloads/free-tools/index.aspx ]          *Microsoft Safety Scanner*          https://www.microsoft.com/security/scanner/en-us/default.aspx [ https://www.microsoft.com/security/scanner/en-us/default.aspx ]          *Norton Power Eraser*          https://norton.com/npe [ https://norton.com/npe ] |
Original Source
Url : http://www.us-cert.gov/ncas/alerts/TA16-336A |
Alert History
Date | Informations |
---|---|
2016-12-01 21:23:10 |
|