Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing December 3, 2021

The Good

As we wrapped up the month with the celebration of National Computer Security Day, here are some new security initiatives that were also ramped up last month. The CISA formulated playbooks on how to respond to cybersecurity incidents and vulnerabilities. In another streak, the U.S. and Israel announced to combat ransomware threats together. Meanwhile, the DHS set up a website to acquire and retain cybersecurity talent.

  • The CISA released a set of playbooks that contain standardized response procedures for U.S. federal agencies to mitigate cybersecurity incidents and vulnerabilities. The playbooks include how agencies should manage cybersecurity incidents and vulnerabilities and manage related processes such as preparation, investigation, containment, reporting, and remediation.

  • New guidance was released by Health-ISAC to support healthcare providers in the process of adopting an identity-centered approach to data sharing. This is the fourth installment of the H-ISAC series that assists CISOs with an improved comprehension of such an approach in data sharing processes under the 21st Century Cures Act. In addition, providers would be able to execute robust identity solutions to keep electronic health info secure.

  • The DHS launched a new portal to hire and retain cybersecurity professionals, with an aim to recruit 150 employees into priority roles over 2022. The DHS Cyber Talent Management System redefines the way the agency recruits, develops, and retains top-notch and diverse talents.

  • The U.S. Treasury Department announced to partner with Israel and launch a joint task force to better deal with ransomware attacks. The task force aims to design a memorandum of understanding that would support information sharing related to the financial sector.

  • The Conti ransomware group suffered a security breach temporarily after researchers tracked down the real IP address of one of its most sensitive servers. This was possible by exploiting a vulnerability in the recovery servers that Conti used. As a result, researchers were able to gain access to the gang’s payment portal, the site used for negotiating ransom payments.

The Bad

With cybercriminals launching massive ransomware attacks and a De-Fi firm losing millions in cryptocurrency, the need for implementing robust cyber defenses can’t get graver. Furthermore, millions of customers of GoDaddy and an American financial services firm suffered data exposure this month. In one recent incident, 125 large TikTok accounts were hacked; it is not yet known who was behind the incident.

  • New Mexico-based True Health suffered a breach that affected the personal information of over 62,000 U.S. citizens. The incident occurred after attackers gained unauthorized access to the organization’s IT systems in October. The stolen documents may contain information such as policyholders’ names, Social Security numbers, dates of birth, home and email addresses, medical data, and insurance details.

  • The Cronin digital marketing agency suffered a major data leak due to an unprotected database worth 26.43GB containing 92 million records. The exposed records include Google analytics data, internally logged client ad campaigns, keywords, session ID, client ID, and device data, among other key identifying information. Moreover, usernames, hashed passwords, and emails of internal Cronin employees can possibly be used for phishing attacks in the future or gaining access to restricted areas.

  • A hacker stole an estimated $55 million worth of cryptocurrency assets from a decentralized finance (DeFi) platform, bZx, by sending a phishing email to one of its employees. The email contained a malicious macro in a Word document and ran a script on the employee’s computer that compromised his mnemonic wallet phrase. The attacker stole two private keys used by bZx for its integration with Polygon and Binance Smart Chain (BSC) blockchains.

  • The Cl0p ransomware gang claimed Asia Pacific-based Swire Pacific Offshore as its latest victim. The firm is located in Singapore and has revenues of $3 billion, making it a lucrative target for extortion. The gang has published screenshots of passports, employee personal details, folder lists, and sensitive company documents on its extortion site.

  • During an investigation, researchers from Palo Alto Networks found that cybercriminals have sped up the process of compromising poorly configured cloud services. Out of 320 honeypots set up by the researchers, malicious actors had compromised around 256 of the servers that included ones with RDP, SSH, SMB, and Postgres database services. One such attacker compromised 96% of the Postgres honeypots within 30 seconds.

  • GoDaddy has disclosed a data breach that exposed the data of 1.2 million customers. The incident occurred after attackers used compromised passwords to access the company’s Managed WordPress hosting environment. The attack is believed to have taken place on September 6.

  • Ransomware gangs are showing interest in purchasing zero-day exploits that are available on dark forums. They are ready to offer up to $10 million to compete with state-backed actors, who are the traditional buyers of zero-day exploits. Moreover, instead of selling the vulnerability, the attacker can lease it out to less sophisticated attackers - bringing exploit-as-a-service to the cybercriminal ecosystem.

  • The data of almost 7 million Robinhood customers are being sold on a popular hacking forum. The data includes email addresses of 5 million customers; full names of the remaining 2 million; name, zip code, and dates of birth of 300 people; and extensive account details of 10 customers. In a post, the adversary posted that the data is selling for at least five figures.

  • StripChat, an adult cam site, underwent a breach in which the personal data of millions of adult models and users was leaked. The breach was caused due to a passwordless Elasticsearch database left exposed between November 4 and 7. Data of 65 million registered users, 421,000 models broadcasting on the site, 134 million transactions, and 719,000 chat messages were leaked.

  • Researchers from various firms revealed that TrickBot is aiding Emotet to get back into the swing of things by installing the latter into compromised systems. The campaign has been dubbed Operation Reacharound to reconstruct Emotet by using TrickBot’s infrastructure. Moreover, the new Emotet comes with an updated command buffer and can execute binaries in multiple ways.

  • A phishing campaign targeted more than 125 large TikTok accounts across the world. Besides individual account holders, the campaign targeted talent agencies, social media production studios, brand-consultant agencies, and influencer management companies. The accounts had tens of millions of followers and the perpetrators remain unknown.

  • A Hive ransomware attack hobbled 3,100 servers of MediaMarkt firm and knocked its IT infrastructure offline in Germany and the Netherlands. The attackers encrypted servers and workstations and demanded $240 million in ransom. Online sales are functional, however, cash registers at affected stores are unable to accept credit cards or print receipts.

New threats

Threats targeting the cryptocurrency community shot to a new peak last month with the discovery of Babadeda and Sharkbot malware. Additionally, BIO-ISAC disclosed a new malware strain targeting Windows systems in the biotech industry. That’s not it. A new Pegasus-like spyware was also spotted.

  • Malware authors targeted cryptocurrency enthusiasts using a new crypter dubbed Babadeda. The crypter has been active since May in multiple campaigns targeting crypto, NFT, and DeFi-related communities on Discord. It can bypass signature-based antivirus solutions.
  • A newly discovered Iranian threat actor was found exploiting the Microsoft MSHTML RCE bug (CVE-2021-40444) to propagate a PowerShell-based stealer dubbed PowerShortShell. The infostealer pilfers Google and Instagram credentials from Farsi-speaking targets. It is also used for Telegram surveillance and collecting system information from compromised devices, most of which are located in the U.S.
  • Dr.Web disclosed that Cynos mobile trojan, which disguises itself as games on Huawei’s AppGallery marketplace, infected at least 9.3 million Android devices to steal data. This new class of malware was found in 190 games—platformers, arcades, simulators, shooters, and strategies—on AppGallery.
  • A highly skilled group of threat actors—RedCurl—attacked a large Russian wholesale company for the second time this year. The group focuses on cyberespionage and is responsible for at least 30 attacks in Russia, the U.K, Germany, and Norway, among others. Prior to exfiltrating corporate data, the gang stays undetected for a period of two to six months.
  • BIO-ISAC warned of cyberattacks against biomanufacturing facilities. The campaign is launched using a new malware dubbed Tardigrade. It bears resemblance to Smoke Loader and is capable of downloading payloads, including ransomware, and manipulating files on compromised systems.
  • Moses Staff, a new politically-motivated threat group, was found targeting Israeli organizations since September, with an aim to leak sensitive data and no ransom demand. First discovered in October, the threat actor followed in the footsteps of Pay2Key and Black Shadow groups. The gang breaches networks by abusing old, unpatched vulnerabilities.
  • A new Android banking trojan, dubbed SharkBot, was discovered by Cleafy and ThreatFabric. Active at least since October, the malware has targeted users of 27 banking and cryptocurrency apps in the U.K, the U.S., and Italy to exfiltrate funds. SharkBot exploits Accessibility Services to pilfer login credentials, current account balance, and personal information.
  • Researchers demonstrated a set of three new attacks, dubbed Printjack, that can be launched against printers. The attack includes turning printers into an army of botnets to launch DDoS attacks, impose a paper DoS state, and perform MiTM attacks. One of these attack types can be launched by exploiting CVE-2014-3741 RCE vulnerability affecting printers.
  • In a new malware campaign, GravityRAT targeted high-profile Indian individuals, disguised as an end-to-end encrypted chat application, dubbed SoSafe Chat. The malware requests 42 permissions, out of which, 13 can be exploited to conduct malicious activities such as reading mobile data and obtaining device location. Earlier reports suggest that GravityRAT previously targeted Windows machines.
  • New spyware called PhoneSpy surfaced to infiltrate Android phones. Experts found 23 malicious apps disguised as legitimate ones to give attackers complete control over the targeted devices. The campaign has already claimed more than 1,000 victims in South Korea and gained access to the entire communications, services, and data on the victims’ devices.
  • MasterFred, a newly discovered Android trojan, uses fake login overlays to steal card data of Netflix, Instagram, Twitter, and banking individuals. The malware was used against Android users in Poland and Turkey. What makes MasterFred unique is that one of the malicious apps also bundles HTML overlays that exhibit the fake login forms and exfiltrate victims’ login details.
  • New BotenaGo botnet targets routers and IoT devices using over 30 different exploits. It is written in Golang and is believed to be used by Mirai operators. The botnet is still under development. It builds a backdoor, waits for the target, and attacks it via port 19412.

Related Threat Briefings

Mar 4, 2025

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.