Hello, welcome to the Tuesday, November 10th, 2020 edition of the Santernat Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Savier ran into an interesting set of malicious scripts on Virus Total that kind of show the progression of the script

as whoever is writing is continuously improving the script and adding new features or making

it more difficult to detect for antivirus. Interestingly, the attacked system is apparently

a macOS because it uses OSA script as part of the commands. It's executing. Also, the file itself

was submitted to virus total from a US IP address, but some of the references,

in particular, the name of the worksheets, is in French.

Some of it also looks more like the attacker is really just bling around with things like,

for example, using the macOS say command that can be used to speak text over

the system's speakers. Not clear if this was an actual attack or really part of a red team exercise

can really tell based on the relatively brief snippet that was submitted to VirusTorl. Most

the hackers stay away from VirusTorl because they know that their scripts will be shared

and Xavier will write them up. They typically use sort of their own similar systems that do not share results with antivirus vendors.

Let me have a good reminder from Kerski that Ransomware is still very much a thing for Linux systems.

I believe actually some of the early ransomware was really more targeting Linux than Windows. The particular

example that Kaspersky is looking at here is Ransom EXX. This particular ransomware does

show up on Windows and originally did focus on Windows but can now also be found used against Linux.

Of course, with many organizations using Linux systems, for example, for backups and as

file servers, it makes perfect sense for an attacker to go after these systems as well.

And Bleeping Computer is reporting that Microsoft is apparently warning select customers about fake advertisements for malicious Microsoft Teams updates.

These ads apparently are focusing on educational institutions currently, but have also targeted

other institutions in the past. And once installed, Cobalt Strike and also InfoSteelers are installed

...