RiskIQ Looks at sites Targeting Ukraine

 Examining targeted Threat Intelligence

RiskIQ Threat Intelligence Roundup: Trickbot, Magecart, and More Fake Sites Targeting Ukraine 

APRIL 07, 2022,     BY TEAM RISKIQ

Threat intelligence is more crucial than ever to attack surface management and cyber resilience in today's volatile threat landscape. RiskIQ continues to leverage our global telemetry to develop relevant, actionable intelligence that gives security teams line-of-sight to attackers and threat systems and infrastructure.

This week's roundup again builds on powerful research published by the cybersecurity community about cyberattacks against Ukrainian citizens, refugees, and armed forces, including fraudulent sites attempting to fool people that want to donate money. It also breaks down new research in collaboration with the Microsoft Defender for IoT Section 52 research team about Trickbot malware targeting Mikrotik routers, updates with Magecart, and additional insight into nation-state activity targeting Chinese casinos.

What's New in C2

Trickbot Abuse of Compromised MikroTik Routers for Command and Control: In collaboration with Section 52, RiskIQ researchers investigated MikroTik routers acting as reverse proxies for Trickbot command and control (C2). Section 52's article details how threat actors compromise MikroTik devices and configure them to work as C2 reverse-proxies for Trickbot malware. We analyzed examples of compromised MikroTik routers in RiskIQ data and document indicators that can help identify devices under threat actor control.

Based on new findings, indicators surfaced by Section 52, and previous third-party research, RiskIQ created detection logic that enables our systems to flag compromised MikroTik routers working as communication channels for Trickbot C2. Be sure to read more about our findings and access the more than 70 new indicators in our Threat Intelligence Portal (TIP).

Recent Magecart-Injected URLs and C2 Domains: Today, digital credit skimming malware like Magecart affects hundreds of e-commerce sites and shouldn't be overlooked. February saw a wave of attacks, which showed "low-hanging fruit" is still available for these actors, which take advantage of new vulnerabilities and issues with plugins and other third-party code. Between March 15th and 21st, RiskIQ detected 149 Magecart and skimmer-injected URLs and 186 unique C2 domains used by known Magecart operatives.

A Closer Look at Campaigns Targeting Ukraine   (See remainder of article at link) 

Facebook's Tools can Target a Single User

Well I would think the title above is clearly true, but the question is how effective is it in a useful context? And is that ethically more powerful than a typical ad?  

Researchers Show Facebook's Ad Tools Can Target Single Users

TechCrunch, Natasha Lomas, October 15, 2021

Spanish and Austrian researchers have showed that Facebook can target ads to a single individual, given sufficient knowledge of that person’s assigned interests. The researchers described a data-driven model that characterizes a metric indicating the likelihood a Facebook user can be identified based on interests attached to them by the social media giant's ad platform. The model found that "the four rarest interests or 22 random interests from the interests set FB assigns to a user make them unique on FB with a 90% probability," the researchers wrote. These findings raise issues about potentially harmful uses of Facebook's ad-targeting tools, and about the legality of the platform's personal data processing system. ...

P&G and Apple Examining Fingerprinting

Some of my former colleagues at work.    But is it narrowing our privacy further?

P&G Is Looking for Ways Around Apple's New Privacy Rules  in TheStreet

Procter & Gamble is testing an advertising technique that would allow for targeted ads, which Apple is looking to limit with its latest software update.

P&G is preparing for an era in which new tools and customer preferences limit the amount of data available to marketers, Dow Jones reported, citing sources.

The Cincinnati company is partnering with dozens of Chinese trade groups and tech firms working with the state-backed China Advertising Association to develop the new technique, which would use a technology called device fingerprinting. 

Dubbed CAID, the new advertising method is being tested via apps and gathers iPhone user data in order to target ads. 

The move is in response to a software update Apple is planning to roll out in the coming weeks that will require app users to opt in to whether they want their activity to be tracked across other companies' apps and websites.      ... ' 

Microsoft Plans a Re-Skilling with Linkedin

An interesting approach of Microsoft to use their data and marketing capabilities via Linkedin to target jobsand job markets.    Makes the assumption that Microsoft will be making the right calls with their forecasts.  

Microsoft Targets 50,000 Jobs with LinkedIn 'Re-skilling' Effort

In Reuters, Stephen Nellis,  March 30, 2021

Microsoft announced its intent to hire 50,000 people for jobs requiring technology skills over the next three years, as part of a broader campaign with professional networking site LinkedIn to re-skill workers affected by the pandemic for new fields. Microsoft said the placements will be within its "ecosystem" of companies that utilize or help sell its products. The push began late last year as pandemic-related business closures had a greater impact on service workers than on technology and other white-collar employees who could work from home. LinkedIn offered many paid digital skills training courses for free, ranging from software development to data analysis to financial analysis. The site said it will extend the free courses until year's end, while Microsoft and LinkedIn estimate that total enrollees have reached 30.7 million, up from an expected 25 million. ... ' 

Refining Audience Advertising Context Mixing

 Interesting method altering acquired video and mixing it to change advertising context.  Would seem the same method could be used for advertising with augmented reality contexts in goggles or smart glasses.    Uses AI, they say,  to recalculate perspective angles and distortions to provide realistic views.

Press Release, Sport and advertising

Refined audience targeting for perimeter advertisements during live TV events

Research News / March 01, 2021

Researchers at the Fraunhofer-Gesellschaft have developed an AI-driven technology that allows the perimeter advertisements shown during live broadcasts of soccer games or other events to be changed without viewers noticing. This means every TV station can show its own content on the boards. The Swiss company ViboTec AG is bringing this technology to the market.

Researchers at the Fraunhofer-Gesellschaft have developed an AI-driven technology that allows the perimeter advertisements shown during live broadcasts of soccer games or other events to be changed without viewers noticing. This means every TV station can show its own content on the boards. The Swiss company ViboTec AG is bringing this technology to the market.

For sports fans who regularly tune in to track and field sports, soccer, or other events on their TVs, the long advertising boards on the sidelines are a familiar sight. These earn good money for sports event organizers and media rights distributors, and allow advertisers to reach an audience of millions. However, in the age of digitalized advertising with precise audience targeting, this format has its drawbacks: All viewers see the same advertisements, regardless of which country or region they are in.

Now, the Fraunhofer Institute for Intelligent Analysis and Information Systems IAIS has developed a technology that makes it possible to adjust the content on the perimeter advertising boards to suit each target group. Then TV stations will be able to use the boards to show content that advertisers have tailored to a certain audience or content focused on a specific country. When a soccer game is broadcast worldwide, millions of viewers will see the same perimeter advertising boards, but each with different content. ....'