Hello, welcome to the Friday, September 22nd, 2017 edition of the Santernut Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

We did to receive more emails that claim to launch DDoS attacks unless the recipient is going to pay some Bitcoins. Well, at this point, we don't see

any evidence that these threats materialize if you're not paying. The latest wave of these

emails appear to be or claim to be associated with the Phantom Squad.

This particular group did launch some successful denial of service attack against Xbox

Life and Steam back in late 2015 and 2016.

But again, there is no evidence here that these new emails are at all associated with Fandom Squad, and at this point, it looks rather unlikely.

Nevertheless, in a couple of the Bitcoin accounts that were set up in order to receive payments, there are some Bitcoins, so it looks like they're

at least partially successful. Just as a reminder, there's absolutely no reason to give in and

pay off these ransom demands, even if you pay off. Really, the only thing you're signaling here is that you're an

easy target and they'll come back for more shortly. And one of the vulnerabilities that I told

you is must fix last week when Microsoft released its patch Tuesday was CVE 2017-8759. This was the RTF slash dot net vulnerability

in dot net that's typically exploited via RTF documents that are sent as email attachments.

Well, Fire Eye has blocked at length about this vulnerability and how it has been used in targeted attacks. Now, this week, Brad spotted it

in more widespread cybercrime attacks. In this particular case, Argentinian citizens were targeted. The email claimed to

come from the Argentinian tax authority, and it included an attachment that had a dot-doc extension.

So it looked like avert document, but was actually an RTF document that then used this vulnerability in order to execute

arbitrary code.

In Brad's case, the victim ended up with a version of Betabot and it was made persistence

via the Windows registry.

And then we got an update from Cisco regarding the sea cleaner malware that happened early this week.

...