The Stargazer Goblin threat group found a new way to abuse GitHub for its nefarious intentions. The group formed a malware distribution-as-a-service, using more than 3,000 fake accounts. The operation usually deployed info-stealers.

Concurrently, in the dark recesses of the web, a new malware loader named Krampus has surfaced, gaining notoriety for its adaptability and user-friendliness. Krampus boasts of multiple functionalities like sideloading crypto miners and delivering PowerShell scripts, while evading traditional security defenses.

In another significant revelation, researchers have uncovered a privilege escalation vulnerability in Google Cloud Platform's Cloud Functions service, dubbed ConfusedFunction. This flaw permits attackers to exploit the Default Cloud Build Service Account's excessive permissions to access other services and sensitive data.

Top Malware Reported in the Last 24 Hours

Malware delivery network on GitHub

The threat actor known as Stargazer Goblin has developed a malware Distribution-as-a-Service (DaaS) on GitHub, using over 3,000 fake accounts to push information-stealing malware. This service, called Stargazers Ghost Network, distributes password-protected archives containing malware through GitHub repositories and compromised WordPress sites. The operation targets specific interests like cryptocurrency and gaming, using phishing templates to lure victims. The malware set includes RedLine, Lumma Stealer, Rhadamanthys, RisePro, and Atlantida Stealer.

New malware surfaces

A threat actor announced the launch of a new malware loader, named Krampus, on the dark web. Krampus is gaining popularity owing to its versatile capabilities and ease of use. Its ability to handle archive and PowerShell scripts, sideload crypto miners, embed itself within archives, and install legitimate software makes it difficult to detect and mitigate using traditional security measures. One concerning aspect is that the file is unsigned and lacks encryption, making it harder to detect. Cybersecurity experts advise organizations to update their security protocols in order to combat such sophisticated threats.

Malware exploit evades SEGs

Threat actors bypassed Secure Email Gateways (SEGs) by disguising malicious HTML files as .Mpeg video files within .zip archives, enabling the delivery of FormBook malware. The malicious .zip file content was inaccurately identified as .Mpeg by common archive extraction tools and SEGs, allowing the obfuscated HTML file to evade detection. Upon opening the disguised HTML file, victims were led to download a second .zip archive containing a disguised .cmd file, ultimately leading to the execution of FormBook malware capable of information theft and other malicious activities.

Top Vulnerabilities Reported in the Last 24 Hours

Docker patches critical bug

Docker has issued an urgent security advisory for a critical vulnerability in certain versions of Docker Engine, allowing attackers to bypass authorization plugins. The vulnerability, tagged as CVE-2024-41110, was originally fixed in 2018 but resurfaced due to a missed patch. Specifically, an attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly. Affected versions include <= v19.03.15, <= v20.10.27, and <= v27.1.0, with patches available for certain versions.

ConfusedFunction flaw in Google Cloud Platform

Researchers have disclosed a privilege escalation vulnerability, named ConfusedFunction, in Google Cloud Platform's Cloud Functions service. This vulnerability allows an attacker to access other services and sensitive data by exploiting the Default Cloud Build Service Account's excessive permissions. Google has updated the default behavior to prevent misuse, but existing instances remain unaffected. This issue highlights the potential risks of software complexity and inter-service communication in cloud providers' services.

Malware attacks abuse PHP vulnerability

Threat actors have been found exploiting a critical PHP vulnerability, CVE-2024-4577, to deliver crypto miners, DDoS botnets, and remote access trojans. The vulnerability allows remote execution of malicious commands on Windows systems and was initially discovered in June. Cybersecurity researchers observed active exploits, including the delivery of malicious malware, within 24 hours of public disclosure.