Quarter Three Report 2021

In most cases it can enter your computer system or device through a malicious download or attachment, a local network or an infected portable media device like a USB drive.

Attackers use different types of malware to get access and control of a computer system usually with the aim of stealing data and money.

There have been a number of malware variants reported to CERT NZ, many of which are one or more of these common types of malware.

Worms are a self-propagating malware. This means once they’re in your system they can move quickly and easily spread through systems and networks. Worms can also damage your files and programs, leaving you vulnerable to other forms of attack.

An example of a worm is the self-propagating function of the FluBot malware. 

Trojans function by hiding malware inside legitimate files, like Word documents or PDFs. When someone opens an infected file, the malware gets into the system. The malware can often go undetected because the file has a legitimate purpose. Once infected, it can give attackers access to your computer without your knowledge. Attackers can then use this access to carry out other malicious activity.

An example of a trojan is a downloadable document on a legitimate website, like a PDF menu on a restaurant website.

Ransomware is a type of malware that attackers use to encrypt and steal data from an infected system, and then demand the recipient to make a payment to have the data recovered.

Protecting from ransomware 

Spyware works by tracking online behaviour and information entered into websites and within an infected system. This information can include web browsing habits, information about installed software, personal information and even logging keystrokes that are typed on the device. This means if you are infected by spyware and log into your internet banking, the spyware can record your login credentials and access your accounts without your knowledge.

FluBot is a self-propagating malicious application which uses text messages to target mobile phones and spread across devices quickly. The texts can be received by all types of phones, however FluBot can only infect Android phones.

The text message attempts to appear as a legitimate message and contains a URL. For example, it may look like a pending parcel delivery and prompt the recipient to click the URL to download a delivery app. However, the link is not to a legitimate delivery app and if downloaded, it infects the device.

Once the malicious application is installed it can extract data from the phone, like credit card and banking details. It also automatically redistributes the text message to contacts it has stolen from other infected devices.

Once the message is sent, the phone blocks the number so the recipient cannot respond to avoid raising any with the sender.

Like many cyber security threats, FluBot is constantly changing to try and trick more people into downloading it. The attackers operating this malware evolve it by changing the subject matter of the text and what the URL links to. Recent examples include texts about parcel deliveries, shared photo albums and voicemail.

We worked collaboratively with New Zealand ISPs to protect as many people as possible from the malware. This included close to 1,200 requests to take down malicious websites linked to FluBot. Our response also included supporting more than 700 New Zealanders who called CERT NZ with concerns about being affected.

CERT NZ released an advisory on FluBot, and regularly updated New Zealanders on the incident as the campaign evolved.

As this incident crosses quarter three and quarter four, we’ll include updated data on FluBot in the next report.

Advisory: FluBot malware infecting Android phones

• Do not restore from backups created after installing the app. Seek the services of a qualified IT professional if you require assistance.
• Change the passwords to all of your online accounts. As FluBot is designed to steal banking details, immediately change the passwords to your online bank accounts. If you have concerns that your accounts may have been accessed by unauthorised people, contact your bank immediately

DoS attacks frequently use multiple sources to send internet traffic to the target. This is referred to as a distributed-denial-of-service (DDoS) attack.

DDoS attacks can result in the targeted organisation’s website and services being taken offline. Alongside these impacts, the attacks can cause reputational damage and loss of revenue. Although the targeted system is disrupted or inaccessible, there isn’t any risk to the system data or threat to users trying to access the service.

Number of DDoS attacks in Q3 2021

• July 2021: 601 attacks
• August 2021: 1530 attacks
• September 2021: 2307

In Q3, these attacks continued to affect New Zealand organisations. Data shared by The Shadowserver Foundation shows a total of 4,438 DDoS attacks, varying in size and impact, targeting New Zealand networks.

With these insights, CERT NZ’s incident response team can determine what kind of DoS attack is occurring, what mitigations the organisation has in place that could be activated, as well as any gaps in their current response plan.

As part of the response, CERT NZ analyses the incident information and identifies other organisations and stakeholders that could also be at risk. Once notified, the Incident Response team advises them of the possible cyber security threat and works to provide relevant information and advice so they’re prepared for and can protect against a possible attack.

Once an IoT device is infected, it can become part of a large, interconnected network of devices called an IoT botnet (‘robot network’) which is under the control of an attacker—often without the owner’s knowledge. Because botnets work by spreading the malware from device to device, it can rapidly grow its network while remaining hidden.

With control of the devices within the botnet, an attacker can carry out a DDoS attack by commanding the botnet to send traffic to a target or online services. This large network creates a simultaneous high volume of traffic to the target in an attempt to overwhelm it and try to disrupt its services or take it offline.

Outlined in the diagram below is a common way botnets operate to infect devices to carry out a DDoS attack.

This is a common scam reported to CERT NZ and happens when scammers call people at home pretending to be from a well-known tech company like Microsoft. They often request remote access to a PC or device claiming they need to repair an issue or install a software update. They do this to try and gain access to your private and financial information.

In Q3, an individual reported to CERT NZ that they had received a call about a potential technical issue with their computer. Believing the caller was legitimate, they gave them remote access to their computer. However, the caller was instead an attacker who was attempting to trick the recipient into sharing access to their computer.

Once the attacker had remote access, they opened the recipient’s bank account and transferred large sums of money.

The recipient quickly became aware that funds had been taken from their account and reported to CERT NZ. In response, CERT NZ provided advice on how the attack had happened and what to do next. This included alerting the recipient’s bank about the scam.

and the funds withdrawn as soon as possible so the attacker’s account could be traced.

Because the recipient had reported the incident quickly, most of the funds were recovered and their bank account was secured with a new password and a new credit card issued. The recipient also stated that they felt better placed to identify any future scam calls.

NZ Police were also advised of the scam for their investigation into the malicious actors.