Cyware Monthly Threat Intelligence

Monthly Threat Briefing • September 2, 2022
Monthly Threat Briefing • September 2, 2022
Small and medium-sized enterprises (SMEs) are just as exposed to the risk of cyberattacks as larger organizations. The Ransomware Task Force (RTF) has released a new blueprint—containing over 40 recommendations—to help SMEs defend against growing ransomware threats. The number of autonomous (unmanned) vehicles is growing and so is the concern for their safety. A cybersecurity company has been roped in to study threats and outline cybersecurity standards for the same. Also, read about the new Traffic Light Protocol standard (TLP 2.0) for information disclosure, introduced after five long years.
The month of August witnessed the first known phishing attack against PyPI; it included a message about implementing a validation process in the targeted package repository but contained a link to a fraudulent site. Threat groups from China, such as APT41 and RedAlpha, were also in the spotlight for claiming victims in the government and private sectors. Attacks on crypto and other blockchain-based platforms continued with adversaries swiping $200 million from Nomad and another group draining nearly $6 million from the Solana network.
Let’s now learn about the new threat developments in the cybercrime world over the past month. At least two separate campaigns were linked to the infamous North threat group, Lazarus. In one of the campaigns, it distributed a stealthy macOS malware disguised as a job description for Coinbase. In other news, criminals impersonated Atomic Wallet to try and distribute the Mars Stealer malware. Meanwhile, cybercriminals are dumping Cobalt Strike for Sliver to make their attacks even more destructive.
A new class of HTTP request smuggling attacks can enable threat actors to compromise multiple popular websites. Named browser-powered desync, the attack can be used to compromise Amazon sites and those using the AWS Application Load Balancer, Cisco ASA WebVPN, Akamai, Varnish Cache servers, and Apache HTTP Server 2.4.52.
Andariel, a subgroup of Lazarus, uses Maui ransomware and DTrack spyware, to carry out financially motivated attacks on companies. Reports suggest that multiple organizations located in India, Vietnam, and Russia were the target of such attacks in 2021.
DeathStalker APT has upgraded the capabilities of VileRAT to perform more sophisticated attacks on foreign exchange and cryptocurrency trading companies. Researchers have observed multiple samples of the malware in the wild, with the latest sample identified in June.
A new signed macOS malware sample developed by Lazarus APT group is being distributed via fake job offer emails from Coinbase. It is linked to the infamous ‘Operation Interception’ campaign that had earlier targeted high-profile aerospace and military organizations.
A new RAT called Escanor is being advertised on the dark web and Telegram by attackers who go by the same name. The malware is delivered via weaponized Microsoft Office documents. The malware can target Android phones and computers.
Hackers are adopting the Sliver toolkit as an alternative for Cobalt Strike to launch a variety of attacks, including ransomware operations. One group that adopted Sliver is tracked as DEV-0237. However, the use of Sliver by cybercriminals isn’t new. Russian APT29 has also used Sliver to keep access to compromised environments.
A dodgy Chrome extension called ‘Internet Download Manager’ installed by more than 200,000 users was found to be adware in disguise. Once installed, it exhibited unwanted behavior such as opening links to spammy sites, changing the default search engine browser, and showing pop-ups about patches and unwanted programs.
A new data extortion group named Donut Leaks was linked to recent cyberattacks on various organizations including DESFA, Sheppard Robson, and Sando. The hacker group is likely a pentester or an affiliate for Hive, Ragnar, and possibly other ransomware groups.
A new ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. Dubbed Agenda, the ransomware can be customized and shares similarities with the BlackBast, BlackMatter, and REvil ransomware.
Researchers have documented PoC exploits for Evil PLC attacks against seven ICS manufacturers: Rockwell Automation, Schneider Electric, GE, B&R, Xinje, OVARRO, and Emerson. A hijacked PLC can be used to compromise engineering workstations, which in turn, can open doors to other potential cyberattacks.
Security researchers discovered a new vulnerability called ParseThru affecting Golang-based applications. The issue stems from changes introduced to Golang's URL parsing logic that's implemented in the "net/url" library. It could be abused to gain unauthorized access to cloud-based applications.
A new malware called Woody RAT has been in the wild for at least one year. This advanced custom trojan is used to target Russian entities by using lures in the form of archive files and, more recently, Office documents leveraging the Follina vulnerability.
A fake website masquerading as the official Atomic Wallet website was found spreading copies of Mars infostealer. The website was promoted on social media, with direct messages on various platforms, SEO poisoning, and spam emails. The fake site even featured a contact form, email address, and FAQ section.