By Caique Barqueta: Brazil is among the countries that suffer the most cyber attacks in the world, a scenario that has worsened after the pandemic and the global moment related to the armed conflict between Ukraine and Russia.

Being up to date on the main threats in Brazil is becoming increasingly important and can allow you to stay one step ahead of potential attacks, as well as acting more quickly and efficiently in order to detect these threats and avoid impacts and incidents that could result in damage and loss.

Below, we list the most recurrent cyber threats identified by ISH's Intelligence team, Heimdall.  

Cobalt Strike

We detected 1768 servers making malicious use of Cobalt Strike. They use a toolkit that allows attackers to implant "beacons" in compromised devices to carry out remote network surveillance or execute commands.

Below, you can see the distribution on the map:

SSH Brute Force

In the same period, we detected 2180 threats of the type SSH Brute Force. SSH is used for remote logins, command execution, file transfers and more. The SSH brute force attack is carried out by a threat agent that tries to log in with a common username and password on several servers, until it has obtained a positive result.  

Below, you can see the distribution on the map:

IP addresses

Another main trace that threat actors leave behind and help identify is the IP address, which is considered very valuable information for tracking and studying threat actors in order to protect themselves from the domain and IP address considered malicious.

ISH collects and analyzes the malicious activity of these main offenders on a daily basis according to the printout below, where from 01/10 to 01/11 we collected and analyzed 52,667 malicious IP addresses that were promptly shared with customers via MISP.  

After presenting the main threats, vulnerabilities and malicious addresses, we at ISH are going to talk about yet another threat that has returned, this time as post-payment malware: Prilex.

Prilex malware

The threat actors known as Prilex have been active since mid-2014, whose malicious samples and artifacts were aimed at carrying out credit card fraud. However, in 2016, a campaign targeting ATMs was identified and linked here in Brazil.

In 2017, this threat actor changed its ATM attacks to attacks on Point of Sale (PoS) devices, i.e. the machines used to receive payments via credit and debit cards.  

Top stories

The agents' first identified campaign was in 2014, when they hit hundreds of ATMs across Brazil. The agents used a blackbox device configured with a 4G USB modem to remotely control the machine. This black box was physically attached to the ATM and its real purpose was to serve as a backdoor in order to hijack the machine's wireless connection and target other ATMs that were on the same network segment.

In 2017, another campaign was identified, this time not at ATMs, but at point-of-sale systems. The agents intercepted transactions in order to capture the cryptogram used in the EMV transaction and carry out a replay attack. The malware was able to capture Track 2 data and card details which were then forwarded to the group's C2 servers.

In mid-July 2020, another campaign by the group was spotted aimed at supplying the malicious POS software to other malicious actors, who bought the malware and used it as a kind of MaaS(Malware-as-a-Service).

How the group operates

With regard to Prilex's modus operandi for ATM-type devices, the use of a "blackbox" connected to the network was identified, which allowed the attacker to install the malware on the computers remotely. In this type of attack, the agents knew the administrator's login credentials, suggesting a possible "insider" within the affected financial institutions.

With the new attack method, using post-payment(PoS) malware, the malicious agents contact the companies using a particular service claiming to be software support and ask the victims to install a critical update on the system.

The installed update is a remote connection/administration software, such as Team Viewer or AnyDesk, aiding the malicious agent's ability to remotely control the system.

They then use the hooking functions used by the software responsible for managing card transactions to capture and modify the data being transferred between the software and the pinpad. This type of attack has two versions with different fraud methods:

• Collect the transaction cryptogram to carry out replay attacks.
• Generate new card cryptograms that will later be used by attackers.

The affiliates of this threat agent, after collecting the information, receive the information through an application tool called "Daphne", used to clone cards, and receive access to a database containing card numbers.

The threat actors have a website to sell the malware on the Deep Web, as shown in the image below.

In the description of the malware offered by the group, they claim that the one developed by the agents can clone cards, which can be used for cash withdrawals and various purchases.

Another type of threat disseminated by the group is the sale of compromised POS machines, i.e. those used to read credit and debit cards by means of "shimmers", which are inserted into the machines. They have a built-in microchip that ends up stealing and storing credit and debit card data every time a person uses their card to make a payment or withdraw money.

The data from the card chip is stored in the device and then sent directly via SMS, so it can be controlled remotely.

DDoS attack service

The Prilex threat agent also offers on its website the availability and sale of DDoS attack services, i.e. the user can buy the order of DDoS (Distributed Denial of Service) attacks, where it is necessary to contact the agents in order to use the service.

How POS devices work

A POS device is connected to a computer - which can be an ordinary computer or one with a POS-specific operating system - and has POS software installed on it, which can be from the vendor who created the device. The machine's software can read the information from the payment card swiped at the POS device, extracting information such as the card number, expiry date and so on, and can even validate the card by connecting to the payment processing server.

This means that information is stored on our payment cards in a specific way. The payment card has a magnetic strip divided into three: 1, 2 and 3. These strips contain various types of information, such as the main account number, the cardholder's name, the expiry date and other data needed to make the payment.  

For example, track 1 of the card has the format illustrated below:

For a better understanding, we have created a table so that you can identify the data passed on: