As part of Google Cloud, Mandiant now has a far greater capability to close the security gap created by a growing number of adversaries. In my 29 years on the front lines of securing networks, I have seen criminals, nation states, and plain bad actors bring harm to good people. By combining our expertise and intelligence with the scale and resources of Google Cloud, we can make a far greater difference in preventing and countering cyber attacks, while pinpointing new ways to hold adversaries accountable.
When I founded Mandiant Corporation in 2004, we set out to change how businesses protected themselves from cyber threats. We felt the technologies people depended on to defend ultimately failed to innovate at the pace of the attackers. In order to deliver cyber defenses as dynamic as the threats, we believed you had to have your finger on the pulse of adversaries around the world. To address this need, we set out to respond to as many cyber security breaches as possible. We wanted to learn first-hand how adversaries were circumventing common safeguards with new and novel attacks; monitor the development and deployment of attacker tools, their infrastructure, and their underground economies; and study the attacker’s targeting trends.
Armed with this knowledge and experience, we felt we were best positioned to close the gap between the offense and the defense in the security arms race.
As we investigated thousands of security incidents over the years, we honed the deep expertise required to find the proverbial needle in the haystack: the trace evidence that something unlawful, unauthorized, or simply unacceptable had occurred. We believed this skill was the foundation to automating security operations through software, so that organizations and governments around the world could easily implement effective security capabilities.
By joining forces with Google Cloud, we can accelerate this vision. I am very excited that Mandiant and Google Cloud can now work together to leverage our frontline intelligence and security expertise to address a common goal: to relentlessly protect organizations against cyber attacks and provide solutions that allow defenders to operate with confidence in their cyber security posture. More specifically, we can leverage our intelligence differentiator to automate security operations and validate security effectiveness.
Mandiant Remains Relentless
While we are now part of Google Cloud, Mandiant is not going away—in fact, it’s getting stronger. We will maintain our focus on knowing the most about threat actors and extend our reputation for delivering world-class threat intelligence, consulting services, and security solutions.
Automating Security Operations
Today’s announcement should be welcome news to organizations facing cyber security challenges that have accelerated in frequency, severity, and diversity. I have always believed that organizations can remain resilient in the fight against cyber threats if they have the right combination of expertise, intelligence, and adaptive technology.
This is why I am a proponent of Google Cloud’s shared fate model. By taking an active stake in the security posture of customers, we can help organizations find and validate potential security issues before they become an incident. Google Cloud and Mandiant have the knowledge and skills to provide an incredibly efficient and effective security operations platform. We are building a “security brain” that scales our team to address the expertise shortage.
Validating Security Effectiveness
Google Cloud’s reach, resources, and focus will accelerate another Mandiant imperative: validating security effectiveness. Organizations today lack the tools needed to validate the effectiveness of security, quantify risk, and exhibit operational competency. Mandiant is working to provide visibility and evidence on the status of how effective security controls are against adversary threats. With this data, organizations have a clear line of sight into optimizing their individual environment against relevant threats.
Advancing Our Mission
Google Cloud has made security the cornerstone of its commitment to users around the world, and the Mandiant acquisition underscores that focus.
We are thrilled to continue moving our mission forward alongside the Google Cloud team. Together, I believe Mandiant and Google Cloud will help reinvent how organizations protect, detect, and respond to threats. This will benefit not only a growing base of customers and partners, but the security community at large.
A new attack technique called ‘GIFShell’ allows threat actors to abuse Microsoft Teams for novel phishing attacks and covertly executing commands to steal data using … GIFs.
The new attack scenario, shared exclusively with BleepingComputer, illustrates how attackers can string together numerous Microsoft Teams vulnerabilities and flaws to abuse legitimate Microsoft infrastructure to deliver malicious files, commands, and perform exfiltrating data via GIFs.
As the data exfiltration is done through Microsoft’s own servers, the traffic will be harder to detect by security software that sees it as legitimate Microsoft Team’s traffic.
Overall, the attack technique utilizes a variety of Microsoft Teams flaws and vulnerabilities:
Bypassing Microsoft Teams security controls allows external users to send attachments to Microsoft Teams users.
Modify sent attachments to have users download files from an external URL rather than the generated SharePoint link.
Spoof Microsoft teams attachments to appear as harmless files but download a malicious executable or document.
Insecure URI schemes to allow SMB NTLM hash theft or NTLM Relay attacks.
Microsoft supports sending HTML base64 encoded GIFs, but does not scan the byte content of those GIFs. This allows malicious commands to be delivered within a normal-looking GIF.
Microsoft stores Teams messages in a parsable log file, located locally on the victim’s machine, and accessible by a low-privileged user.
Microsoft servers retrieve GIFs from remote servers, allowing data exfiltration via GIF filenames.
GIFShell – a reverse shell via GIFs
The new attack chain was discovered by cybersecurity consultant and pentester Bobby Rauch, who found numerous vulnerabilities, or flaws, in Microsoft Teams that can be chained together for command execution, data exfiltration, security control bypasses, and phishing attacks.
The main component of this attack is called ‘GIFShell,’ which allows an attacker to create a reverse shell that delivers malicious commands via base64 encoded GIFs in Teams, and exfiltrates the output through GIFs retrieved by Microsoft’s own infrastructure.
To create this reverse shell, the attacker must first convince a user to install a malicious stager that executes commands, and uploads command output via a GIF url to a Microsoft Teams web hook. However, as we know, phishing attacks work well in infecting devices, Rauch came up with a novel phishing attack in Microsoft Teams to aid in this, which we describe in the next section.
GIFShell works by tricking a user into loading a malware executable called the “stager” on their device that will continuously scan the Microsoft Teams logs located at $HOME\AppData\Roaming\Microsoft\Teams\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\*.log.
Microsoft Teams log folder Source: BleepingComputer
All received messages are saved to these logs and are readable by all Windows user groups, meaning any malware on the device can access them.
Once the stager is in place, a threat actor would create their own Microsoft Teams tenant and contact other Microsoft Teams users outside of their organization. Attackers can easily achieve this as Microsoft allows external communication by default in Microsoft Teams.
To initiate the attack, the threat actor can use Rauch’s GIFShell Python script to send a message to a Microsoft Teams user that contains a specially crafted GIF. This legitimate GIF image has been modified to include commands to execute on a target’s machine.
When the target receives the message, the message and the GIF will be stored in Microsoft Team’s logs, which the malicious stager monitors.
When the stager detects a message with a GIF, it will extract the base64 encoded commands and execute them on the device. The GIFShell PoC will then take the output of the executed command and convert it to base64 text.
This base64 text is used as the filename for a remote GIF embedded in a Microsoft Teams Survey Card that the stager submits to the attacker’s public Microsoft Teams webhook.
As Microsoft Teams renders flash cards for the user, Microsoft’s servers will connect back to the attacker’s server URL to retrieve the GIF, which is named using the base64 encoded output of the executed command.
The GIFShell server running on the attacker’s server will receive this request and automatically decode the filename allowing the attackers to see the output of the command run on the victim’s device, as shown below.
For example, a retrieved GIF file named ‘dGhlIHVzZXIgaXM6IA0KYm9iYnlyYXVjaDYyNzRcYm9iYnlyYXVJa0K.gif’ would decode to the output from the ‘whoami’ command executed on the infected device:
the user is:
bobbyrauch6274\bobbyrauIkBáë
The threat actors can continue using the GIFShell server to send more GIFs, with further embedded commands to execute, and continue to receive the output when Microsoft attempts to retrieve the GIFs.
As these requests are made by the Microsoft website, urlp.asm.skype.com, used for regular Microsoft Teams communication, the traffic will be seen as legitimate and not detected by security software.
This allows the GIFShell attack to covertly exfiltrate data by mixing the output of their commands with legitimate Microsoft Teams network communication.
Even worse, as Microsoft Teams runs as a background process, it does not even need to be opened by the user to receive the attacker’s commands to execute.
The Microsoft Teams logs folder have also been found accessed by other programs, including business monitoring software, such as Veriato, and potentially malware.
Microsoft acknowledged the research but said it would not be fixed as no security boundaries were bypassed.
“For this case, 72412, while this is great research and the engineering team will endeavor to improve these areas over time, these all are post exploitation and rely on a target already being compromised,” Microsoft told Rauch in an email shared with BleepingComputer.
“No security boundary appears to be bypassed. The product team will review the issue for potential future design changes, but this would not be tracked by the security team.”
Abusing Microsoft teams for phishing attacks
As we previously said, the GIFShell attack requires the installation of an executable that executes commands received within the GIFs.
To aid in this, Rauch discovered Microsoft Teams flaws that allowed him to send malicious files to Teams users but spoof them to look as harmless images in phishing attacks.
“This research demonstrates how it is possible to send highly convincing phishing attachments to victims through Microsoft Teams, without any way for a user to pre-screen whether the linked attachment is malicious or not,” explains Rauch in his writeup on the phishing method.
As we previously said in our discussion about GIFShell, Microsoft Teams allows Microsoft Teams users to message users in other Tenants by default.
However, to prevent attackers from using Microsoft Teams in malware phishing attacks, Microsoft does not allow external users to send attachments to members of another tenant.
While playing with attachments in Microsoft Teams, Rauch discovered that when someone sends a file to another user in the same tenant, Microsoft generates a Sharepoint link that is embedded in a JSON POST request to the Teams endpoint.
This JSON message, though, can then be modified to include any download link an attacker wants, even external links. Even worse, when the JSON is sent to a user via Teams’ conversation endpoint, it can also be used to send attachments as an external user, bypassing Microsoft Teams’ security restrictions.
For example, the JSON below has been modified to show a file name of Christmas_Party_Photo.jpeg but actually delivers a remote Christmas_Party_Photo.jpeg………….exe executable.
Microsoft Teams JSON to spoof an attachment Source: Bobby Rauch
When the attachment is rendered in Teams, it is displayed as Christmas_Party_Photo.jpeg, and when highlighting it, it will continue to show that name, as shown below.
Spoofing a JPEG file Source: Bobby Rauch
However, when the user clicks on the link, the attachment will download the executable from the attacker’s server.
In addition to using this Microsoft Teams spoofing phishing attack to send malicious files to external users, attackers can also modify the JSON to use Windows URIs, such as ms-excel:, to automatically launch an application to retrieve a document.
Rauch says this would allow attackers to trick users into connecting to a remote network share, letting threat actors steal NTLM hashes, or local attackers perform an NTLM relay attack to elevate privileges.
“These allowed, potentially unsafe URI schemes, combined with the lack of permissions enforcement and attachment spoofing vulnerabilities, can allow for a One Click RCE via NTLM relay in Microsoft Teams,” Rauch explains in his report on the spoofing attack.
Microsoft not immediately fixing bugs
Rauch told BleepingComputer that he disclosed the flaws to Microsoft in May and June of 2022, and despite Microsoft saying they were valid issues, they decided not to fix them immediately.
When BleepingComputer contacted Microsoft about why the bugs were not fixed, we were not surprised by their response regarding the GIFShell attack technique, as it requires the device to already be compromised with malware.
“This type of phishing is important to be aware of and as always, we recommend that users practice good computing habits online, including exercising caution when clicking on links to web pages, opening unknown files, or accepting file transfers.
We’ve assessed the techniques reported by this researcher and have determined that the two mentioned do not meet the bar for an urgent security fix. We’re constantly looking at new ways to better resist phishing to help ensure customer security and may take action in a future release to help mitigate this technique.” – a Microsoft spokesperson.
However, we were surprised that Microsoft did not consider the ability of external attackers to bypass security controls and send attachments to another tenant as not something that should be immediately fixed.
Furthermore, not immediately fixing the ability to modify JSON attachment cards so that Microsoft Teams recipients could be tricked to download files from remote URLs was also surprising.
However, Microsoft has left the door open to resolving these issues, telling BleepingComputer that they may be serviced in future versions.
“Some lower severity vulnerabilities that don’t pose an immediate risk to customers are not prioritized for an immediate security update, but will be considered for the next version or release of Windows,” explained Microsoft in a statement to BleepingComputer.
A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system.This vulnerability exists because the messaging server container ports on an affected system lack sufficient protection mechanisms. An attacker could exploit this vulnerability by connecting to the messaging service ports of the affected system. To exploit this vulnerability, the attacker must be able to send network traffic to interfaces within the VPN0 logical network. This network may be restricted to protect logical or physical adjacent networks, depending on device deployment configuration. A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-msg-serv-AqTup7vs
Affected Products
Vulnerable ProductsThis vulnerability affects Cisco devices if they are running a vulnerable release of Cisco SD-WAN vManage Software.For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.Products Confirmed Not VulnerableOnly products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.Cisco has confirmed that this vulnerability does not affect the following Cisco products:
IOS XE SD-WAN Software
SD-WAN vBond Orchestrator Software
SD-WAN vEdge Cloud Routers
SD-WAN vEdge Routers
SD-WAN vSmart Controller Software
Workarounds
There is a workaround that addresses this vulnerability.Administrators can use access control lists (ACLs) to block ports 4222, 6222, and 8222, which are used by Cisco SD-WAN vManage Software messaging services. They may be configured in the following ways depending on deployment:
Cisco Cloud Controllers ACLs (Inbound Rules allowed list) are managed through the Self-Service Portal. Customers will have to review their ACL configurations on the Self-Service Portal to ensure that they are correct. This does not involve updating the controller version. By default, Cisco-hosted devices are protected against the issue described in the advisory unless the customer has explicitly allowed access. For more information, see Cisco SD-WAN Cloud Hosted Controllers Provisioning.
While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Fixed Software
Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.Customers Without Service ContractsCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.htmlCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.Fixed ReleasesCustomers are advised to upgrade to an appropriate fixed software release as indicated in the following table(s):Cisco SD-WAN vManage Software ReleaseFirst Fixed ReleaseEarlier than 20.3Migrate to a fixed release.20.3Migrate to a fixed release.20.620.6.420.7Migrate to a fixed release.20.8Migrate to a fixed release.20.920.9.1Note: It is the customer’s responsibility to upgrade their cloud controllers to the latest version in which this vulnerability is fixed.The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Source
Cisco would like to thank Orange Business for reporting this vulnerability.
VersionDescriptionSectionStatusDate1.1Added cloud information.Workarounds and Fixed SoftwareFinal2022-SEP-091.0Initial public release.-Final2022-SEP-07
It is necessary to use content optimization tools to rank higher on SERPs. Optimizing your blog content and web pages using the SEO content optimizer is vital to the success of your content SEO strategy because you need to keep an eye on your competitors. In this post, let’s learn with seobase what content optimization is and what the best content optimization tools are.
What Is Content Optimization?
Understanding and improving content performance to interact with audience intentions is crucial to getting the number of clicks and traffic you aim for. Getting a higher ranking in search engine results pages (SERPs) and improving the readability of the content is not a simple process but is also not impossible. Now, many content optimization tools facilitate the content optimization process.
Here are some things that you need to optimize your content to address them:
Customer Needs: your content needs to adapt to the customer’s changed needs.
Search Intent: your content should be optimized to meet user intent
Competitors: it’s a risk of falling behind if your content is not optimized.
Search Engine Updates: static content will lose relevance as search engine updates make a piece of content irrelevant.
Market Trends: your content needs to stay current if you want to rank above your competitors.
Top 10 Content Optimization Tools For SEO
Searching for specific content may take a long time to arrive at valuable and helpful content. Here comes your role; you have to work to benefit your audience and not make them spend a lot of time getting some information. Dozens of content optimization tools are available on the market to help you write quality content on your blog or landing pages. seobase listed the 5 best content optimization tools you can use to research, identify, and optimize content for your blog or web pages right now.
Sign up to our blog to stay tuned about the latest industry news.Subscribe
Google Search Console
Google Search Console (GSC) is a great free tool to analyze SERPs performance of your site and content. Moreover, it contains cutting-edge features helping you know page speed, and structured data could impact your online performance. Furthermore, you can define the user intent and be aware of the organic traffic with impression and click data of specific queries.
However, you can’t filter multiple search query terms to determine keyword cannibalization or misspellings quickly. In addition, it doesn’t display a complete SEO backlink profile. Here are a few says GSC to optimize your content marketing strategy:
Keyword For Each Page.
Content Popularity.
Find Content Gaps.
Customer Search Intent.
seobase SEO Tools
seobase serves 15,000+ satisfied customers globally. Leaders of many industries rely on seobase for rank tracking and SERPs analysis. You can create your search tracking in seconds and get daily updates on how your website performs across search engines.
Furthermore, you can track desktop and mobile platforms to get a full picture of your site’s performance. All of seobase SEO tools will allow you to create a quality piece of content. You can explore your target keywords and use them to optimize your content to meet the audience’s needs. Here are some of the seobase SEO content tools and features:
Keyword explorer tool
SERP checker tool
Rank Tracker tool
Site profiler tool
Backlink checker tool
Grammarly
Content marketers need to create a quality piece of content to drive organic traffic and rank high on SERPs. However, that content must be readable to engage with the target audience, Grammarly offers this.
Grammarly is one of the most critical content optimization solutions. Grammarly makes content optimization much more manageable by offering detailed, real-time suggestions for improving content quality. The content optimizer doesn’t miss any spelling or grammar errors unless it fixes them immediately.
It offers you edits and suggestions using AI support to improve your choice of words and the context and tone of the content. As a content optimizer for search engine algorithms, Grammarly uses contextual cues and typing tone as ranking factors.
Hemingway Editor
Hemingway Editor helps you write better content and drive traffic and more website visitors. It is a free online tool to see if it has everything you need to make high-quality content.
The tool allows you to find the common grammatical issues and sentence structure that can distract your readers. In addition, it enhances the readability level.
The Hemingway Editor is such an efficient content optimization tool. However, it lacks a widget for Chrome and Safari. As a result, you must copy/paste your content manually to the online or desktop program to check it.
The Editor tool is AI-powered, but it only uses a handful of grammar choices when grading your content, so you could be missing other mistakes if you depend only on this tool. The tool doesn’t offer suggestions on how to fix the problem for the errors highlighted by the tool. This can be disturbing when you need to resolve issues quickly.
Google Docs
Google Docs is not the first content optimization tool that comes to your mind when you think about content optimization solutions. However, it offers features like a word processor, spreadsheets, and forms so you can communicate with your team and keep your projects on track.
Content marketers always seek the easiest way to manage multiple projects at once. Sometimes the content creators need to keep a list of dozens of topics to expand or manage writers. Google Docs gives content writers what they need exactly to help them and their teams to produce optimized content.
Conclusion
Choosing the best content optimization tools suitable for growing your business and making the most of your marketing budget is not impossible, but it is challenging. You can always stay informed of previously published content by using Google Search Console and other tools to get actual performance metrics. seobase provides you with the necessary SEO content optimization solutions to improve the content that you publish on your website.
SEO Niche keywords research is your way to attract your audience. The niche keywords are the particular long-tail keywords related to a specific industry. You can find your best niche keywords list using the best online SEO niche search tool. Do you know how valuable for your SEO plan to tailor your pay-per-click campaigns to niche keywords list and not just general and trending terms? It is challenging for general or short tail keywords to rank on the first page on search engines such as Google, especially on a new site.
When starting to manage a new venture, it can be challenging to predict the impact of a new research campaign on your industry niche. As a result, searching niche keywords is the perfect solution to avoid any risks that may occur and affect your growth.
In this post, seobase presents how to research keywords for a niche using the niche research tools and how to find a niche keywords list.
Use a seobase Keyword Research Tool to Find Niche Keywords
Choosing an adequate and effective niche search tool is just as important and valuable as determining and choosing your SEO niche. Let’s say you decided to create a site that provides SEO services like seobase. In this case, you may have already decided that your website targets the SEO niche.
It may not matter much how much you know about the SEO industry, whether with a high level of experience or a lack of knowledge. This means that understanding which keywords will be profitable for you early on can be quite a challenge.
Since your website is a rookie site, you don’t have much historical data to use as an indicator of future performance. The seobase Keyword Explorer Tool is the ideal and most effective niche search tool for the initial niche keywords research and creating a niche keywords list.
Take advantage of the seobase Keyword Explorer Tool features, learn how to find niche keywords, and try to create an extensive niche keywords list. It may include forms of SEO niche keywords that you may not be able to come up with on your own, but the tool does.
Refine Your Niche Keyword List
You need to realize that the niche keywords list you take from niche research tools is just suggestions. So it’s critical to find a compelling way to refine your niche keyword research list. There are several ways to refine your SEO niche keywords list when adding a keyword or URL:
Your keyword list should be as specific to your website’s SEO niche.
Sign up to our blog to stay tuned about the latest industry news.Subscribe
Determine How Competitive Your Keywords Are
As we mentioned in the previous step, you have to know how difficult it is for niche keywords to SEO. Analyze how competitive each keyword you have in the niche keywords list.
Don’t choose the most difficult niche keywords because they have a high volume. If you think about it this way, it can be difficult if not impossible to arrange.
If you choose less difficult niche keywords, even if they are only at volume 10, the ten visits you will get per month and counting all the keywords you will use over the month, the total clicks and visits will ultimately be rewarding.
Niche Keyword Research: Conclusion
Successful keyword targeting requires constant monitoring and modification, especially niche keyword research. It is essential to know that niche research tools return a keyword does not mean that you will be able to rank on search engines necessarily.
The traffic you send from search engines will not end up converting just because you used the niche keywords list. However, SEO checkpoints are well implemented to get optimum results. Moreover, you can use the SEO services of the seobase platform.
How to promote your blog without social media? The best way to boost your blog traffic is by using SEO (search engine optimization) techniques. This includes writing great content that people will want to read, creating high-quality images for your posts, and making sure your site loads quickly. However, you need to prompt your blog to attract more visitors and increase the traffic and clicks. Most webmasters ask themselves, how do I get people to read my blog? The answer is straightforward: you can follow the next few tips and get a boosted blog. In this post, seobase will explain how to promote your blog without social media, how to get your blog noticed, and how to get traffic to your website without social media.
Comment and Engage With Other Blogs.
There are compelling methods to get boosted blogs without using social media. Commenting and engaging with other blogs is key to getting your blog noticed. Some web admins create their website blogs and overlook that community is essential to achieve their goals from this post.
One of the most effective ways to promote your blog without social media you can do is to visit and read other bloggers’ content, and to boost your blog’s traffic is to comment and engage with other blogs. In this step all you need to do in this step is to visit other blogs and comment. As a result, your fellow bloggers might also return the favor to your blog website. You can do this through commenting on other blogs, sharing links to them on social media, or even asking questions on forums.
Write Authentic Blog Content.
To promote your blog posts without social media, you need to know some more creative ideas; one of them is unique content. Writing unique and authentic content will attract the readers. Catchy headlines and optimized blogging content will attract the most readers to your blog. Attracting more readers increases traffic, clicks, and converts to customers. Also, do not overlook including the right keywords. Learn how to set a successful SEO keyword strategy.
If you want to write authentic blog content, you need to think about what you would say to a friend who was writing a similar post. This will help you avoid sounding too much like everyone else. When you start writing, build the content structure so that readers can find answers to their queries and do not have to leave your site quickly or look for another blog that answers their queries and questions. To learn how to promote your blog without social media with unique content, check the new content ideas.
Sign up to our blog to stay tuned about the latest industry news.Subscribe
Share Your Blog Posts on Pinterest.
Suppose you don’t use the social media platforms or even if you don’t have social media yet to support your content promotion. Here’s a vital and valuable tip to follow regarding how to get traffic to your website without social media; you can share your posts on Pinterest to get boosted blog.
Just make sure you use the right hashtags and keywords so people can find your content easily. On Pinterest, users engage in niche topics; this will help you to get your blog noticed to increase your website position and rank #1 on Google SERPs. No worries, there are plenty of places to promote your blog without social media.
Write Guest Posts.
If you write guest posts to get boosted blog, you will not only gain exposure for your own website, but you will also help others by sharing their work. This is one of the easiest ways to generate new business leads and get people to read my blog. As a result, you will get traffic to your website without social media.
If you’re following the guest post way to get your blog noticed and promote your blog without social media, you may face only one problem; getting people from your guest post to your website is a bit challenging. According to Backlinko, one industry study found that the average guest post brings in only 50 visitors. To solve this problem, you need to use the Guest Post Bonuses. With a Guest Post Bonus, you give the readers and webmasters motivation to make them visit your website. Read Why Everyone Ignores Your Guest Post Outreach Email.
Start a Podcast.
A podcast is an audio show that usually records interviews with experts in various fields. You can record these yourself or use services such as Blubrry.com. Once your episodes are ready, you need to find a platform to host them. Several options are available, including iTunes, SoundCloud, Stitcher, Google Play Music, and more.
The podcast may be one of the best places to promote your blog. The podcast bonus strategy is similar to the Guest Post Bonus strategy discussed above. Instead of creating a reward for each guest post, you can create a set of bonuses for each podcast you go to as a guest.
Furthermore, you can inform about these rewards through email campaigns. But how does this strategy start? Follow these steps to implement a successful podcast strategy:
First, create content that your podcast listeners will care about.
Then, assign podcast rewards to what you’ll talk about in the podcast.
After that, play it by the podcast host.
Finally, host your rewards section landing page at a URL that’s easy to remember and write.
How to Promote Your Blog Without Social Media: Conclusion.
Blogging without social media is not very popular, and not many bloggers follow it. However, it is a very successful strategy by which you can get a boosted blog. There are a lot of places to promote your blog that no one has visited yet. The competition in blogging social media marketing is tough and fierce. Despite its outstanding results, it takes a lot of time and effort to get a high ranking on Google.
The SEO checkpoints best practices are crucial for your website’s ranking on SERPs. Implementing this blog post SEO checklist wouldn’t take so much time; however, it would lead you to achieve your SEO goals. 15 min SEO daily to make sure you are on the right track is your best option to get a higher rank. First, let’s refresh our memory with the SEO meaning, then we can discuss the best practices of the SEO checkpoints in detail.
SEO is an acronym for (Search engine optimization), a set of activities we do to create good content and design the website. It also includes defining the business strategy and how to produce content to gain a better position in Google search results and attract more visitors to the site.
The term SEO may broaden to include another definition: Search Engine Optimization (SEO) is optimizing your online content so that a search engine likes to display it as a higher result for searches around a particular keyword. In this post, seobase will explain SEO checklist best practices in simplified detail to the most critical SEO checkpoints, daily SEO tracking, monthly SEO tasks and show you some ideal ways to achieve advanced results in search engines.
How to Use This SEO Checklist?
We have divided the SEO checkpoints best practices into main points to facilitate their explanation. Therefore, we will separately focus on each SEO component in the following few lines. Here are the leading SEO components checkpoints:
Basic SEO Checklist
Technical SEO Checklist
Keyword Research Checklist
Content Checklist
On-page SEO Checklist
Link Building Checklist
To set a successful SEO strategy, you should focus on the above SEO checkpoints best practices and carefully apply them to your website. This SEO checklist best practices work for e-commerce stores, local businesses, and affiliate sites.
Basic SEO Checkpoints Best Practices
Set up Google Search Console.
Google offers free Google Search Console services to track your site’s organic search performance. The importance of this tool is that it shows you the effectiveness of the detailed SEO plan, and it is a reliable service since the Google search engine provides it.
You can find on GSC:
The keywords you rank for,
Your ranking positions,
Your website errors.
In addition, you can submit your sitemaps successfully to get the best and most accurate results.
Sign up to our blog to stay tuned about the latest industry news.Subscribe
Set up Bing Webmaster Tools.
This step is similar to what is applied to Google, but this time to Bing. Setting up the Bing Webmaster Tools is essential for implementing a successful SEO plan.
Set up seobase online SEO Tools.
You can use seobase best online SEO tool to get the best results on search engines and improve your rankings. seobase provides webmasters with the most powerful SEO tools to facilitate the implantation of their SEO strategy and make it easier to achieve their SEO goals in the long term. Here are a few key SEO tools from seobase:
Rank Tracker Tool: it keeps you up-to-date with your Google positions and ranking on other search engines.
SERP Checker Tool: a cloud-based tool that allows you to check your SERPs on Google and other search engines.
Set up Google Analytics.
Also, Google offers an additional free service, Google Analytics, which is essential because it shows how many people visit your site, how they found it, and how they interact with it.
You can link Google Search Console with Google Analytics to see Search Console data in Analytics.
Install an SEO plugin.
You can skip this step if you’re using a different website platform like Shopify. This step is for WordPress users. If you are using WordPress, you should install an additional SEO plugin. These plugins help you organize your sitemaps and place the proper meta tags. Despite the importance of these tools, you do not need more than one tool only.
Here are some tools you can choose from to install in WordPress:
We’ve already mentioned that the GSC tool enables you to set your sitemaps to get accurate data. In addition, it is essential to fine-tune your Sitemaps because they are the link between search engines and the main content on your site. Sitemaps tell search engines where to find content on your website so that their spiders can easily crawl and index your pages. You can use the seobase Site Profiler tool to get a certain answer confirming that your website can be crawled and indexed.
Usually, you can find your sitemap at one of these URLs:
Creating a robots.txt file is an essential step on your SEO checklist; if checks, you can improve your SEO performance. But what is a robots.txt file? Robots.txt is a text file; its job is to direct search engines to where they can crawl and where they are not allowed to.
A robots.txt file may be necessary if you do not want search engines to crawl a specific section of your website that does not have the required SEO factors, to not affect the SEO checklist of your website.
You can check your robots.txt file; all you have to do is write your domain name and robots.txt like this; yourdomain.com/robots.txt.
If you see a text file, you already have a robots.txt file. If not, search Google for “robots.txt generator” to create one, or you can ask for help from a professional SEO company.
Now, after performing all of the above steps, you just got the basic SEO checklist best practices done. Let’s move to the next level of your SEO strategy, the technical SEO checklist.
Technical SEO Checkpoints Best Practices
Implementing technical SEO checkpoints best practices helps you create reliable bases and ensure your site can be crawled and indexed. As a result, your website will rank higher than any other website in your industry on SERPs.
Here are the primary and most common technical SEO checkpoints best practices to follow.
Make sure your site is crawlable and indexable.
Google does not index any page or content its spiders have not crawled. So it is crucial to check that Google spiders have accessed your content constantly. You can do this through Google Search Console to search for any warnings or exceptions related to robots.txt files.
Many webmasters confuse indexing and crawling, although they are two completely different processes. The crawled pages do not have to be indexed by Google. If you found a ‘noindex’ meta tag for bots or an x-robots tag on the page, indexing will not be possible. You can conduct a live test on GSC to find your indexing issues. If during live testing, indexing issues were detected with the URL, then you can request indexing from Google. Also, Google will inform you about noindexed URLs in the Coverage report.
The good news is that you also can get this information using the seobase Site Profiler tool. The tool will give you a detailed report for your site audit, including this information.
Make sure you’re using HTTPs.
It is important to use HTTPS as it is an exemplary security standard and will protect the data of your visitors. This is even more important if you require passwords or payment information, then using HTTPS is a must.
If you don’t use HTTPS, it’s time to migrate now. First, ensure your site sits on HTTPS by checking your browser’s URL bar. If you see a “padlock” sign on the left side of the URL, then you’re using HTTPS. If you don’t see this sign, you are not.
Check for duplicate versions of your site in Google’s Index.
You may face a severe SEO issue if you allow Google to index more than one version of your website.
For example, you see that these links listed below are all the same and will not make a big difference or cause a glitch, but it is entirely different from the point of view of search engines:
https://www.domain.com
https://domain.com
http://www.domain.com
https://domain.com
Don’t let Google get distracted by all those links, and make sure only one format is indexed. It can lead to crawling, indexing, and security issues.
All other versions should redirect 301 to your main domain, and you can check for duplicate versions of your site in Google’s index by entering each variant into your browser bar. If you’ve set up redirects without issue, you’re good. But if you still find that you can access many versions, you must redirect immediately.
Check your site speed.
Since 2010, PageSpeed has been an important ranking factor on search engines for desktop. Since 2018, it has been included as a vital ranking factor on search engines for mobile.
If you think of it from the user’s point of view, it is tedious and frustrating if you go to a site to search for the information you need and it takes you a lot of time to load; Google also adopts this point of view. Therefore, if you slow site speed, Google does not consider this site worthy of ranking on the first page because it does not improve the user experience.
You can use tools like PageSpeed Insights. Also, you can use the seobase Site Profiler tool to give you deep insights about your PageSpeed and a whole site audit report to see how fast your web page loads.
Make sure your site is mobile-friendly.
There is no doubt that we are in a speedy era; many searches are done through mobile. So having a mobile-friendly website is more important than ever; it is no longer optional.
Check your site’s mobile-friendliness by using Google’s mobile-friendly testing tool. seobase Site Profiler tool gives you an excellent chance to check if your website is mobile-friendly.
Install an image compression plugin.
One of the most underrated factors on the SEO checklist is images. Compressing images and reducing the size of image files improves page speed. As a result, it will enhance your chances of ranking high on search engines.
For WordPress users, there are plenty of plugins available for that. For example, you can use one of the best free WordPress SEO tools, ShortPixel. It allows you to compress up to 100 images/month for free.
Furthermore, you can use Tinypng to compress images in general and use them on other platforms.
Fix broken pages (Broken Internal and Outbound Links.)
Broken links do not provide the best user experience and break the transfer of the domain authority DA to your site. The best way to find broken links on your website is to conduct a backlink audit or audit your site thoroughly. You can use Site Profiler and Backlink Checker tools from seobase to get the best results.
Fix duplicate content issues.
If you’re targeting e-commerce SEO, probably you’ll find duplicated content issues; it is very common in e-commerce SEO because of the faceted navigation. Make sure you don’t have any duplicate content on your website.
You can fix this SEO issue by canonicalizing the affected URLs where necessary.
Keyword Research SEO Checkpoints Best Practices
This part of the seobase SEO checklist guide is primarily directed at SEO content writers. Applying the following SEO checkpoints to your content will boost your search engine rankings. Choosing the right keyword is your key to reaching the audience, but all your efforts will be in vain if your content is not SEO-equipped. Follow the next few tips to get your website at the top of the first search engine results pages (SERPs).
Explore your primary keyword.
The right keywords allow you to reach your goal easily. However, using improper or consistent SEO keywords with your content may be reason enough to distract search engines. In addition, the main keyword will refer to different subjects; thus, the search engine will see that your site is not trustworthy enough to appear on the first page because it does not provide a good user experience.
How do you know the best keyword to focus on?
Do frequent keyword research to target the main keywords you can rank by on the SERPs, but you should also ensure that you target the best keyword each time you post new content. Also, you can find the right keywords using the seobase keyword explorer tool.
Assess search intent.
If your page doesn’t align with the search intent, your chances of ranking are tiny to none.
So how do you assess search intent?
After finding the primary keyword, look at the ranked pages on Google SERPs for your primary keyword.
Check the URLs and titles of the top-ranking results, for example, if a user searches for “SEO checkpoints best practices.” Given the researcher’s intention, it is clear that he wants to know the primary points that must be applied to obtain the best SEO results. If the user searches for “SEO,” it is likely that he wants to get an SEO service provider.
Assess your chances of ranking on Google to enhance your SEO checkpoints best practices.
Investigating the difficulty of the keywords you use helps you prioritize your chances of ranking on search engines. Use the seobse keyword explorer tool to find out the SEO difficulty of keywords. If you are a beginner, you can use low or medium-difficulty keywords to be able to compete.
Also, check the results for the things that may suggest a hard keyword to crack, like high-quality backlinks and high topical relevance of the top-ranking sites, etc.
Research what people want to know.
Suppose a user searches for an “SEO Checklist.” You can see from analyzing search intent that people are looking for specific practical steps to implement. However, you should ask yourself a couple of vital questions;
What other questions do they have?
What other information fits your content to include?
You can find the answer to your questions in Google’s “People Also Ask” box.
Also, you can use a content ideas generator to find new subjects to write about. Finally, using the keywords explorer tool gives you a good insight into your query.
Hardening changes in DCOM were required for CVE-2021-26414. Therefore, we recommended that you verify if client or server applications in your environment that use DCOM or RPC work as expected with the hardening changes enabled.
To address the vulnerability described in CVE-2021-26414, you must install updates released September 14, 2021 or later and enable the registry key described below in your environment. We recommended that you complete testing in your environment and enable these hardening changes as soon as possible. If you find issues during testing, you must contact the vendor for the affected client or server software for an update or workaround before early 2022.
Note We recommend that you update your devices to the latest security update available to take advantage of the advanced protections from the latest security threats.
Timeline
Update release
Behavior change
June 8, 2021
Hardening changes disabled by default but with the ability to enable them using a registry key.
June 14, 2022
Hardening changes enabled by default but with the ability to disable them using a registry key.
March 14, 2023
Hardening changes enabled by default with no ability to disable them. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment.
Registry setting to enable or disable the hardening changes
During the timeline phases in which you can enable or disable the hardening changes for CVE-2021-26414, you can use the following registry key:
Value Name: “RequireIntegrityActivationAuthenticationLevel”
Type: dword
Value Data: default = 0x00000000 means disabled. 0x00000001 means enabled. If this value is not defined, it will default to enabled.
Note You must enter Value Data in hexadecimal format.
Important You must restart your device after setting this registry key for it to take effect.
Note Enabling the registry key above will make DCOM servers enforce an Authentication-Level of RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or higher for activation.
Note This registry value does not exist by default; you must create it. Windows will read it if it exists and will not overwrite it.
New DCOM error events
To help you identify the applications that might have compatibility issues after we enable DCOM security hardening changes, we added new DCOM error events in the System log; see the tables below. The system will log these events if it detects that a DCOM client application is trying to activate a DCOM server using an authentication level that is less than RPC_C_AUTHN_LEVEL_PKT_INTEGRITY. You can trace to the client device from the server-side event log and use client-side event logs to find the application.
Server events
Event ID
Message
10036
“The server-side authentication level policy does not allow the user %1\%2 SID (%3) from address %4 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.”(%1 – domain, %2 – user name, %3 – User SID, %4 – Client IP Address)
Client events
Event ID
Message
10037
“Application %1 with PID %2 is requesting to activate CLSID %3 on computer %4 with explicitly set authentication level at %5. The lowest activation authentication level required by DCOM is 5(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY). To raise the activation authentication level, please contact the application vendor.”
10038
“Application %1 with PID %2 is requesting to activate CLSID %3 on computer %4 with default activation authentication level at %5. The lowest activation authentication level required by DCOM is 5(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY). To raise the activation authentication level, please contact the application vendor.”(%1 – Application Path, %2 – Application PID, %3 – CLSID of the COM class the application is requesting to activate, %4 – Computer Name, %5 – Value of Authentication Level)
Availability
These error events are only available for a subset of Windows versions; see the table below.
Late evening, on September 6, 2022, the Wordfence Threat Intelligence team was alerted to the presence of a vulnerability being actively exploited in BackupBuddy, a WordPress plugin we estimate has around 140,000 active installations. This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information.
After reviewing historical data, we determined that attackers started targeting this vulnerability on August 26, 2022, and that we have blocked 4,948,926 attacks targeting this vulnerability since that time.
The vulnerability affects versions 8.5.8.0 to 8.7.4.1, and has been fully patched as of September 2, 2022 in version 8.7.5. Due to the fact that this is an actively exploited vulnerability, we strongly encourage you to ensure your site has been updated to the latest patched version 8.7.5 which iThemes has made available to all site owners running a vulnerable version regardless of licensing status.
All Wordfence customers, including Wordfence Premium, Wordfence Care, Wordfence Response, and Wordfence Free users, have been, and will continue to be, protected against any attackers trying to exploit this vulnerability due to the Wordfence firewall’s built-in directory traversal and file inclusion firewall rules. Wordfence Premium, Care, & Response, customers receive enhanced protection as attackers heavily targeting the vulnerability are blocked by the IP Blocklist.
The BackupBuddy plugin for WordPress is designed to make back-up management easy for WordPress site owners. One of the features in the plugin is to store back-up files in multiple different locations, known as Destinations, which includes Google Drive, OneDrive, and AWS just to name a few. There is also the ability to store back-up downloads locally via the ‘Local Directory Copy’ option. Unfortunately, the method to download these locally stored files was insecurely implemented making it possible for unauthenticated users to download any file stored on the server.
More specifically the plugin registers an admin_init hook for the function intended to download local back-up files and the function itself did not have any capability checks nor any nonce validation. This means that the function could be triggered via any administrative page, including those that can be called without authentication (admin-post.php), making it possible for unauthenticated users to call the function. The back-up path is not validated and therefore an arbitrary file could be supplied and subsequently downloaded.
Due to this vulnerability being actively exploited, and its ease of exploitation, we are sharing minimal details about this vulnerability.
Indicators of Compromise
The Wordfence firewall has blocked over 4.9 million exploit attempts targeting this vulnerability since August 26, 2022, which is the first indication we have that this vulnerability was being exploited. We are seeing attackers attempting to retrieve sensitive files such as the /wp-config.php and /etc/passwd file which can be used to further compromise a victim.
The top 10 Attacking IP Addresses are as follows:
195.178.120.89 with 1,960,065 attacks blocked
51.142.90.255 with 482,604 attacks blocked
51.142.185.212 with 366770 attacks blocked
52.229.102.181 with 344604 attacks blocked
20.10.168.93 with 341,309 attacks blocked
20.91.192.253 with 320,187 attacks blocked
23.100.57.101 with 303,844 attacks blocked
20.38.8.68 with 302,136 attacks blocked
20.229.10.195 with 277,545 attacks blocked
20.108.248.76 with 211,924 attacks blocked
A majority of the attacks we have observed are attempting to read the following files:
/etc/passwd
/wp-config.php
.my.cnf
.accesshash
We recommend checking for the ‘local-download’ and/or the ‘local-destination-id’ parameter value when reviewing requests in your access logs. Presence of these parameters along with a full path to a file or the presence of ../../ to a file indicates the site may have been targeted for exploitation by this vulnerability. If the site is compromised, this can suggest that the BackupBuddy plugin was likely the source of compromise.
Conclusion
In today’s post, we detailed a zero-day vulnerability being actively exploited in the BackupBuddy plugin that makes it possible for unauthenticated attackers to steal sensitive files from an affected site and use the information obtained in those files to further infect a victim. This vulnerability was patched yesterday and we strongly recommend updating to the latest version of the plugin, currently version 8.7.5, right now since this is an actively exploited vulnerability.
All Wordfence customers, including Wordfence Premium, Wordfence Care, Wordfence Response, and Wordfence Free users, have been, and will continue to be, protected against any attackers trying to exploit this vulnerability due to the Wordfence firewall’s built-in directory traversal and file inclusion firewall rules.
If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.
If you know a friend or colleague who is using this plugin on their site, we highly recommend forwarding this advisory to them to help keep their sites protected, as this is a serious vulnerability that is actively being exploited in the wild.
We will continue to monitor the situation and follow up as more information becomes available.
Actions to take today to mitigate cyber threats from ransomware:
• Prioritize and remediate known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce multifactor authentication.
Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA to disseminate IOCs and TTPs associated with Vice Society actors identified through FBI investigations as recently as September 2022. The FBI, CISA, and the MS-ISAC have recently observed Vice Society actors disproportionately targeting the education sector with ransomware attacks.
Over the past several years, the education sector, especially kindergarten through twelfth grade (K-12) institutions, have been a frequent target of ransomware attacks. Impacts from these attacks have ranged from restricted access to networks and data, delayed exams, canceled school days, and unauthorized access to and theft of personal information regarding students and staff. The FBI, CISA, and the MS-ISAC anticipate attacks may increase as the 2022/2023 school year begins and criminal ransomware groups perceive opportunities for successful attacks. School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable; however, the opportunistic targeting often seen with cyber criminals can still put school districts with robust cybersecurity programs at risk. K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.
The FBI, CISA, and the MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.
Download the PDF version of this report: pdf, 521 KB
Technical Details
Note:This advisory uses the MITRE ATT&CK® for Enterprise framework, version 11. See MITRE ATT&CK for Enterprise for all referenced tactics and techniques.
Vice Society is an intrusion, exfiltration, and extortion hacking group that first appeared in summer 2021. Vice Society actors do not use a ransomware variant of unique origin. Instead, the actors have deployed versions of Hello Kitty/Five Hands and Zeppelin ransomware, but may deploy other variants in the future.
Vice Society actors likely obtain initial network access through compromised credentials by exploiting internet-facing applications [T1190]. Prior to deploying ransomware, the actors spend time exploring the network, identifying opportunities to increase accesses, and exfiltrating data [TA0010] for double extortion–a tactic whereby actors threaten to publicly release sensitive data unless a victim pays a ransom. Vice Society actors have been observed using a variety of tools, including SystemBC, PowerShell Empire, and Cobalt Strike to move laterally. They have also used “living off the land” techniques targeting the legitimate Windows Management Instrumentation (WMI) service [T1047] and tainting shared content [T1080].
Vice Society actors have been observed exploiting the PrintNightmare vulnerability (CVE-2021-1675 and CVE-2021-34527 ) to escalate privileges [T1068]. To maintain persistence, the criminal actors have been observed leveraging scheduled tasks [T1053], creating undocumented autostart Registry keys [T1547.001], and pointing legitimate services to their custom malicious dynamic link libraries (DLLs) through a tactic known as DLL side-loading [T1574.002]. Vice Society actors attempt to evade detection through masquerading their malware and tools as legitimate files [T1036], using process injection [T1055], and likely use evasion techniques to defeat automated dynamic analysis [T1497]. Vice Society actors have been observed escalating privileges, then gaining access to domain administrator accounts, and running scripts to change the passwords of victims’ network accounts to prevent the victim from remediating.
Indicators of Compromise (IOCs)
Email Addresses
v-society.official@onionmail[.]org
ViceSociety@onionmail[.]org
OnionMail email accounts in the format of [First Name][Last Name]@onionmail[.]org
Vice Society have used malicious files that create component task schedule objects, which are often mean to register a specific task to autostart on system boot. This facilitates recurring execution of their code.
Vice Society actors may directly side-load their payloads by planting their own DLL then invoking a legitimate application that executes the payload within that DLL. This serves as both a persistence mechanism and a means to masquerade actions under legitimate programs.
Vice Society actors may attempt to manipulate features of the files they drop in a victim’s environment to mask the files or make the files appear legitimate.
Vice Society artifacts have been analyzed to reveal the ability to inject code into legitimate processes for evading process-based defenses. This tactic has other potential impacts, including the ability to escalate privileges or gain additional accesses.
Vice Society actors are known for double extortion, which is a second attempt to force a victim to pay by threatening to expose sensitive information if the victim does not pay a ransom.
Vice Society actors have encrypted data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Vice Society actors run a script to change passwords of victims’ email accounts.
Mitigations
The FBI and CISA recommend organizations, particularly the education sector, establish and maintain strong liaison relationships with the FBI Field Office in their region and their regional CISA Cybersecurity Advisor. The location and contact information for FBI Field Offices and CISA Regional Offices can be located at www.fbi.gov/contact-us/field-offices and www.cisa.gov/cisa-regions, respectively. Through these partnerships, the FBI and CISA can assist with identifying vulnerabilities to academia and mitigating potential threat activity. The FBI and CISA further recommend that academic entities review and, if needed, update incident response and communication plans that list actions an organization will take if impacted by a cyber incident.
The FBI, CISA, and the MS-ISAC recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by Vice Society actors:
Preparing for Cyber Incidents
Maintain offline backups of data, and regularly maintain backup and restoration. By instituting this practice, the organization ensures they will not be severely interrupted, and/or only have irretrievable data.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure. Ensure your backup data is not already infected.
Review the security posture of third-party vendors and those interconnected with your organization. Ensure all connections between third-party vendors and outside software or hardware are monitored and reviewed for suspicious activity.
Implement listing policies for applications and remote access that only allow systems to execute known and permitted programs under an established security policy.
Document and monitor external remote connections. Organizations should document approved solutions for remote management and maintenance, and immediately investigate if an unapproved solution is installed on a workstation.
Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).
Refrain from requiring password changes more frequently than once per year unless a password is known or suspected to be compromised. Note: NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.
Require administrator credentials to install software.
Require phishing-resistant multifactor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.
Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege.
Implement time-based access for accounts set at the admin level and higher. For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
Protective Controls and Architecture
Segment networks to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.
Install, regularly update, and enable real time detection for antivirus software on all hosts.
Secure and closely monitor remote desktop protocol (RDP) use.
Limit access to resources over internal networks, especially by restricting RDP and using virtual desktop infrastructure. If RDP is deemed operationally necessary, restrict the originating sources and require MFA to mitigate credential theft and reuse. If RDP must be available externally, use a VPN, virtual desktop infrastructure, or other means to authenticate and secure the connection before allowing RDP to connect to internal devices. Monitor remote access/RDP logs, enforce account lockouts after a specified number of attempts to block brute force campaigns, log RDP login attempts, and disable unused remote access/RDP ports.
Vulnerability and Configuration Management
Keep all operating systems, software, and firmware up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Organizations should prioritize patching of vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog.
Disable unusedports.
Consider adding an email banner to emails received from outside your organization.
Disable hyperlinks in received emails.
Disable command-line and scripting activities and permissions. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally.
Ensure devices are properly configured and that security features are enabled.
Disable ports and protocols that are not being used for a business purpose (e.g., RDP Transmission Control Protocol Port 3389).
Restrict Server Message Block (SMB) Protocol within the network to only access servers that are necessary, and remove or disable outdated versions of SMB (i.e., SMB version 1). Threat actors use SMB to propagate malware across organizations.
REFERENCES
Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts.
The FBI is seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with Vice Society actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.
The FBI, CISA, and the MS-ISAC strongly discourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to a local FBI Field Office, or to CISA at report@cisa.gov or (888) 282-0870. SLTT government entities can also report to the MS-ISAC (SOC@cisecurity.org or 866-787-4722).
DISCLAIMER
The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, and the MS-ISAC do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or the MS-ISAC.
