In the ever-evolving cyber battlefield, attackers are refining their tactics, blending ransomware with espionage to strike at the heart of global organizations. Pioneer Kitten has breached U.S. networks, partnering with ransomware affiliates to extort victims across multiple sectors.

Meanwhile, Proofpoint uncovered a mysterious espionage campaign, dubbed Voldemort, where attackers masqueraded as tax authorities to infiltrate over 70 organizations. This digital dark wizard has been using Google Sheets for command and control.

Adding to the geopolitical tension, APT29 has been linked to a series of cyberattacks on Mongolian government websites. The Russian-backed group exploited vulnerabilities in iOS and Android devices through sophisticated watering hole attacks.

Top Malware Reported in the Last 24 Hours

Iranian Pioneer Kitten aids ransomware attacks

The CISA, the FBI, and the DC3 identified an Iranian hacking group, Pioneer Kitten, as being responsible for breaching organizations in the U.S. and other countries. This group, connected to the government of Iran, has been enabling ransomware attacks and collaborating with affiliate actors to extort victims. Some of the ransomware affiliates include NoEscape, BlackCat, and RansomHouse. They have targeted various sectors including education, finance, healthcare, and defense.

SLOW#TEMPEST campaign strikes with Cobalt Strike

Securonix discovered a sophisticated campaign, named SLOW#TEMPEST, targeting Chinese-speaking users with Cobalt Strike payloads delivered through phishing emails. The attackers were able to evade detection for over two weeks by using malicious ZIP files, DLL hijacking, and Cobalt Strike implants. They established persistence, escalated privileges, moved laterally, and engaged in extensive post-exploitation activities, including network reconnaissance, credential harvesting, and running various tools. The attackers also demonstrated operational security failures, providing insights into their infrastructure.

**The malware that shouldn’t be named! **

Proofpoint researchers discovered an unusual malware campaign called Voldemort, indicating a likely goal of conducting espionage. The campaign impersonated tax authorities from various countries, targeting over 70 organizations globally. The attack chain used Google Sheets for command and control and employed the use of unusual functionality, showing interest in intelligence gathering rather than financial gain. The backdoor malware used in the campaign can steal information and deliver additional payloads. The campaign employed a mix of techniques aligned with both cybercrime and espionage activity, making attribution complex.

North Korean hackers and malicious npm packages

Phylum noted a recent surge in malicious activity targeting the npm ecosystem by groups aligned with North Korea. Multiple packages containing malware have been published, each exhibiting distinct tactics and attack types. These attacks involve obfuscated JavaScript that downloads additional malware components, Python scripts, and even a full Python interpreter to exfiltrate sensitive data from cryptocurrency wallet browser extensions. The coordinated campaign aims to compromise developers and infiltrate companies in order to steal cryptocurrency and other assets.

Top Vulnerabilities Reported in the Last 24 Hours

Exploiting the same old bug!

Google’s TAG analyzed a series of cyberattacks on Mongolian government websites using n-day exploits, with evidence pointing to the involvement of the Russian government-backed APT29 group. The attacks targeted both iOS and Android devices, exploiting vulnerabilities in iOS WebKit and Google Chrome. The attackers employed watering hole attacks to deliver the exploits, which showed similarities to those previously used by commercial surveillance vendors.

Godzilla fileless backdoor targets Confluence flaw

Trend Micro revealed a new attack vector targeting the Atlassian Confluence vulnerability CVE-2023-22527, using an in-memory fileless backdoor known as the Godzilla webshell. This backdoor, developed in Chinese, employs AES encryption to avoid detection and enables remote code execution on compromised servers. The attackers exploit the vulnerability by executing malicious JavaScript code and dynamically loading and defining classes in memory.