By Caique Barqueta: Brazil is among the countries that suffer the most cyber attacks in the world, a scenario that has worsened after the pandemic and the global moment related to the armed conflict between Ukraine and Russia.

Being updated on the main threats in Brazil becomes increasingly important and can allow you to stay one step ahead of potential attacks, as well as to act more quickly and efficiently in order to detect such threats and avoid impacts and incidents that could result in damage and loss.

Below, we list the top recurring cyber threats identified by ISH's Heimdall Intelligence team.  

Cobalt Strike

We have detected 1768 servers making malicious use of Cobalt Strike. They use toolkits that allow attackers to deploy "beacons" on compromised devices to perform remote network surveillance or execute commands.

Below you can see the distribution on the map:

SSH Brute Force

We detected, in the same period, 2180 threats of type SSH Brute Force. SSH is used for remote logins, command execution, file transfers, and more. The SSH brute force attack is performed by a threat actor that tries to log in with a common username and password on multiple servers until it has obtained a positive result.  

Below you can see the distribution on the map:

IP Addresses

Another main trail that threat actors leave behind that helps identify is the IP address, which is considered very valuable information for tracking and studying threat actors in order to protect yourself from the domain and IP address that is considered malicious.

ISH collects and analyzes the malicious activity of these top offenders on a daily basis according to the printout below, where from 10/01 to 11/01 we collected and analyzed 52,667 malicious IP addresses that were readily shared with customers via MISP.  

After presenting the main threats, vulnerabilities and malicious addresses, we at ISH are going to address one more threat that has returned, this time as post-payment type malware: Prilex.

Prilex Malware

Threat actors known as Prilex have been active since mid-2014, whose malicious samples and artifacts were aimed at performing credit card fraud. However, in 2016, the campaign targeting ATMs here in Brazil was identified and linked.

In the year 2017, this threat actor changed its ATM attacks to attacks on Point of Sale (PoS) devices, i.e., the machines used to perform payment receipt via credit and debit cards.  

Top News

The agents' first identified campaign was in 2014, when they hit hundreds of ATMs across Brazil. The agents used a blackbox device configured with a 4G USB modem to remotely control the machine. This blackbox was physically attached to the ATM and its real purpose was to serve as a backdoor with an intent to hijack the machine's wireless connection and target the other ATMs that were on the same network segment.

In 2017, another campaign was identified, this time not on ATMs, but on point-of-sale systems. Agents intercepted transactions to capture the cryptogram used in the EMV transaction and perform a replay attack. The malware was able to capture Track 2 data and card details that were later forwarded to the group's C2 servers.

In mid-July 2020, another campaign by the group was located aimed at providing the malicious POS software to other malicious actors, who purchased the malware and used it as a kind of MaaS(Malware-as-a-Service).

How the group operates

Regarding Prilex's modus operandi for ATM-type devices, the use of a network-connected "blackbox" was identified that allowed the attacker to install the malware on computers remotely. In this type of attack, the agents knew the administrator login credentials, suggesting a possible "Insider" within the affected financial institutions.

With the new attack method, using malicious post-payment(PoS) software, malicious actors contact the companies that use a certain service claiming to be software support and ask the victims to install a critical update on the system.

The installed update is remote connection/administration software, such as Team Viewer or AnyDesk, assisting the malicious agent in the ability to remotely control the system.

After that, they use hooking functions used by software responsible for managing card transactions to capture and modify the data being transferred between the software and the pinpad. This type of attack has two versions with different fraud methods:

• Collect the transaction cryptogram to perform replay attacks.
• Generate new card cryptograms that will be used later by the attackers.

The affiliates of this threat actor, after collecting the information, receive the information through an application tool called "Daphne," used to clone cards, and are also given access to a database containing card numbers.

The threat actors have a site to sell the malware on the Deep Web, as shown in the image below of the site.

In the description of the malware offered by the group, they state that the one developed by the agents can perform card cloning, which can be used for cash withdrawals and various purchases.

Another type of threat spread by the group is the sale of compromised POS Machines, i.e. used to read credit and debit cards inserted through "shimmers", which are inserted into the machines. They have an embedded microchip that ends up stealing and storing credit and debit card data every time a person uses his or her card to make a payment or withdraw money.

The data from the card chip is stored in the device, and then the data is sent directly via SMS, so it can be controlled remotely.

DDoS attack service

The threat agent Prilex, also offers on its site the availability and sale of DDoS attack service, i.e., the user can buy the order of DDoS attacks (Distributed Denial of Service), where it is necessary to make contact with the agents to use the service.

How "POS" devices work

A POS device is connected to a computer - which can be an ordinary computer or one that has a POS-specific operating system, and has POS software installed on it, which may be from the vendor that created the device. The machine software can read the information from the payment card swiped at the POS device, being able to extract information such as card number, validity and so on, and can even validate the card by connecting to the payment processing server.

This means that information is stored on our payment cards in a specific way. The payment card has a magnetic strip divided into three: 1, 2, and 3. These strips contain various types of information such as the main account number, cardholder name, expiration date, and other data necessary to make the payment form.  

For example, track 1 on the card has the format illustrated below:

For better understanding, we have created a table so that it is possible to identify the data passed on: