Cyware Monthly Threat Intelligence
Monthly Threat Briefing • July 1, 2021
The Good
As the world inches toward more secured communication, a group of academic researchers devised a system that could enable smart home systems to respond to audio commands without invading users' privacy. A joint law enforcement operation by the U.S., European, and other national authorities resulted in a major crackdown on organized crime activities through the use of an encrypted chat platform. Meanwhile, the NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.
- Researchers at the University of Michigan developed a system called PrivacyMic that can filter out audible sounds, thereby offering more security and privacy to users of smart home systems.
- According to Europol, law enforcement authorities made more than 800 arrests in raids at 700 locations worldwide under Operation Trojan Shield, wherein the police followed upon criminals’ activities via AN0M, an encrypted chat platform.
- Researchers at the University of Rochester devised an approach called TimeCache that protects against side-channel attacks like evict+reload and Spectre, with a tiny performance impact.
- Google introduced a vulnerability interchange schema with the aim of fortifying open-source security. This new schema will address some major problems with managing open-source vulnerabilities.
- The NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.
- The DoJ announced that law enforcement agencies from the U.S., Germany, the Netherlands, and Romania took down Slillpp, the largest online marketplace for stolen credentials. The multinational operation seized the servers that hosted Slillpp’s infrastructure and domain names.
The Bad
Further, ransomware threats, malware operators, and misconfigured databases remained the top threats in the cybersecurity space in June. For instance, a Brazilian medical lab firm and a French fashion label were targeted by a notorious ransomware group. In other news, scammers were sending fake replacement devices to Ledger customers, whereas Crackonosh malware operators reportedly made at least $2 million in illegal Monero mining.
- REvil ransomware was held responsible for the attacks on Brazil-based Grupo Fleury and France-based FCUK. The group has asked for $5 million in ransom if the victim wishes to receive a decryptor and avoid data leak.
- Following the ransomware attack on the City of Tulsa in May, the attackers posted more than 18,000 stolen files, including police citations and internal department files on the dark web. These files included names, dates of birth, addresses, and driver’s license numbers.
- The operator of a malware, named Crackonosh, was discovered to have made more than 9,000 Monero coins after compromising 222,000 Windows computers since 2018. The malware was hidden inside pirated and cracked copies of popular software.
- The South Korean Atomic Energy Research Institute (KAERI) has confirmed a cyberattack by the Kimsuky threat actor group. The adversary had exploited a vulnerability in the VPN system used within the research institute’s environment to enter into the network.
- Ragnar Locker ransomware group hit Taiwan-based memory and storage manufacturer ADATA and made more than 700GB of archived stolen data public in an attempt to pressurize and extort from the victim.
- DirtyMoe, known for cryptomining and DDoS attacks, infected over 100,000 Windows systems, according to researchers. The initial infection process relies on spam emails to lure users to malicious sites hosting an exploit kit named PurpleFox.
- Around 20GB of confidential files containing personal information of retail customers was exposed due to an unprotected Amazon AWS bucket. In the same vein, a misconfigured database belonging to Cognyte had exposed more than 5 billion records for three days before security professionals secured it.
- An online database containing 204GB of data belonging to CVS Health disclosed over a billion records owing to a misconfiguration issue. The data includes production records of visitor IDs, session IDs, and device access information.
- UF Health Central Florida witnessed a blow to its IT network caused due to a ransomware attack. UF Health The Village Hospital and UF Health Leesburg Hospital were incapable of accessing their computer systems and email because of the attack.
- Scammers were spotted sending fake replacement devices to Ledger customers affected in a recent data breach in an attempt to steal from their cryptocurrency wallets. Although the device looked legitimate, the printed circuit board was modified.
- NFT creators and digital artists were targeted in a Redline malware campaign, enabling the threat actor to swipe the former’s profits. According to reports, the attacker impersonated NFT creators and approached Twitter users with business deals that tricked them into downloading and running a malware-laced file.
- Around 8.4 billion entries of passwords were disclosed on a popular hacker forum. The compilation—comprises a 100GB TXT file and goes by the name RockYou2021—was stored in plain text.
- Ukrainian public and private sectors were targeted in a massive spear-phishing attack carried out by Russian threat actors. The attack was conducted via emails claiming to be from representatives for the Kyiv Patrol Police Department.
New Threats
A new cyberattack occurs every few seconds and the following incidents are just a glimpse of the evil creations of cybercriminals. Security researchers uncovered new ransomware operations, such as Ever101, DarkRadiation, and EpsilonRed, targeting various sectors worldwide. Cybercriminals launched a new Mirai variant that milks Tenda router bugs. Also, now we have the first-ever malware pervading through Kubernetes environments via Windows containers.
- A new Ursnif trojan variant is being used in the wild to target online banking users in Italy. As a part of the attack, the trojan infects mobile devices with the Cerberus malware.
- A new strain of REvil ransomware called LV ransomware was spotted in the wild. Experts believe it to be a work of GOLD NORTHFIELD and uses CRC32 hash to encrypt files. Three ransom payment Tor domains used by the LV gang have been discovered by security experts.
- A new ChaChi trojan was being used as a critical part of ransomware operations targeting government organizations and schools in the U.S. The trojan was associated with the operations of the PYSA ransomware gang.
- A newly discovered Ever101 ransomware targeted an Israeli computer firm and encrypted its devices. When encrypting files, the ransomware appends the .ever101 extension and later drops a ransom note named !=READMY=!.txt.
- The new DarkRadiation ransomware was found targeting Linux and Docker cloud containers, while banking on Telegram messaging service for C2 communications.
- A new SEO poisoning tactic is propagating the SolarMaker malware via PDF documents filled with keywords and malicious links. The backdoor malware is capable of stealing data and credentials from browsers.
- A Mirai variant Moobot was discovered scanning Tenda routers for known but uncommon vulnerabilities. This malware strain primarily targets exposed and vulnerable Docker APIs to include them in its DDoS botnet.
- A faux DarkSide threat actor has been sending threatening emails to several organizations in the energy and food sector, claiming to have breached their network. The actor is demanding a ransom of 100 BTC in lieu of public disclosure of sensitive data.
- Experts discovered new Vigilante malware that aims at piracy by preventing unauthorized downloading of pirated software or games. It also tries modifying the victims’ computers so that they can’t access pirate sites.
- Siloscape became the first known malware targeting Kubernetes clusters through Windows containers. This heavily obfuscated malware opens a backdoor into poorly configured clusters to launch malware.
- A new attack technique dubbed Cut-and-Mouse and Ghost Control can be used to bypass ransomware defense in antivirus solutions. Researchers demonstrated that these twin attacks leverage security weaknesses in popular software applications and can enable attackers to take over applications.
- A new backdoor dubbed Facefish was reported by security analysts at Qihoo 360 NETLAB. It allows attackers to take over Linux systems and steal sensitive data. It targets Linux x64 systems and capable of dropping multiple rootkits at different times.
- A new ransomware named Epsilon Red, which shares similarities with the REvil gang, targeted a U.S. company in the hospitality sector. Written in Golang, the ransomware is distributed via unpatched Microsoft Exchange servers.