Cyware Monthly Threat Intelligence
Monthly Threat Briefing • November 1, 2021
The Good
Continuous cybersecurity innovation has indeed become the backbone of cyber resilience for organizations globally. As of recently, researchers at Purdue University developed an AI-based system that can prevent hacking attempts. Meanwhile, the U.S. officials addressed security concerns around 5G technology by outlining best safety practices. Also, there’s a new directive to further secure railroad and airline industries from cyberattacks.
- Researchers at Purdue University created a self-aware algorithm that can fend off hacking attempts. This model sends one-time signals to each component and converts them into active monitoring systems.
- The CISA and NSA released guidance for service providers and system integrators about how they can secure cloud-native 5G networks from attacks. Released as a four-part series, the guidance can be used by cloud service providers, mobile network operators, and core network equipment vendors.
- Avast released free decryption utilities to recover files encrypted by three ransomware strains - AtomSilo, Babuk, and LockFile. The decryptors for AtomSilo and LockFile are the same because they share similarities. Emsisoft released a free decryption key for victims affected by BlackMatter ransomware.
- In light of high-profile cyberattacks on transportation firms, the Transportation Security Administration announced plans to roll out a new cybersecurity directive on the railroad and airline industries by the end of the year.
- MITRE Corporation announced the release of the tenth version of the ATT&CK framework. This version of ATT&CK for Enterprise contains 14 Tactics, 188 Techniques, 379 Sub-techniques, 129 Groups, and 638 Pieces of Software. It also includes a new set of Data Source and Data Component objects in Enterprise ATT&CK.
The Bad
Weeks after the U.S. Treasury Department warned against rising attacks against the crypto industry, a De-Fi protocol suffered its third attack of the year. In a different streak, a cybercriminal group was found extorting money by compromising over 150 apps and making users of those apps subscribe to premium SMS services. Multiple security incidents were disclosed in the healthcare sector, including insurance firms.
- An estimated $130 million worth of cryptocurrency assets was pilfered from Cream Finance. This is the third cyberattack against the firm this year. The attackers allegedly abused a vulnerability in the Flash Loaning platform. Earlier attacks led to a loss of $37 million and $29 million.
- The FBI warned against Ranzy Locker ransomware operators who crippled the networks of at least 30 U.S. organizations, mostly via brute-force attacks. The attacks targeted critical manufacturing, government facilities, transportation, and IT sectors. The stolen files include customer details, PII, and financial records.
- Microsoft revealed that the Russia-backed Nobelium threat group has targeted at least 140 organizations via 14 cloud service providers, MSPs, and IT services. The attack indicated a shift of interest to supply chain attacks. The attacks were being conducted in the U.S. and Europe since May.
- Researchers uncovered an unsecured database of 63.58GB belonging to Deep 6 AI that contained more than 880 million medical records of U.S. citizens. The records contained complete physician notes, including patient illness, treatment, medication, and emotional issue details. The dataset could have fallen prey to a ransomware attack and could have been accessed by anybody with an internet connection.
- The Grief ransomware group allegedly targeted the National Rifle Association (NRA) and leaked the screenshots of U.S. tax information and investment amounts as proof of the hack. It has also leaked an archive—National Grants.zip—of 2.7MB, which reportedly contains NRA grant applications. The threat actor is linked to the Russia-based Evil Corp.
- Avast unearthed UltimaSMS, a fraud campaign that involves at least 151 malicious Android apps with over 10.5 million downloads. Targeted countries include Egypt, Saudi Arabia, the UAE, and Pakistan, accounting for more than a million victims. The apps were promoted via TikTok, Instagram, and Facebook.
- Large-scale DDoS attacks plundered at least eight email service providers, including Fastmail, Runbox, Posteo, TheXYZ, Guerilla Mail, Mailfence, Kolab Now, and RiseUp. The ransom demand was for 0.06 BTC and the victims were provided only three days to pay up. Attacks at Runbox and TheXYZ peaked at 50Gbps and 256Gbps, respectively.
- LightBasin, an alleged Chinese hacker group, infiltrated at least 13 telecommunication companies around the globe and accessed call records and messages.
- Data pertaining to at least one million users of Quickfox VPN was left open to the internet due to an unprotected Elasticsearch storage blob. The 100GB data trove contained 500 million sensitive records, including system data on 300,000 customers and the PII of a million users.
- The Argentinian Interior Ministry was targeted by a cybercriminal who pilfered ID card details for the entire population, including the country’s President and other political figures, journalists, and soccer personalities Lionel Messi and Sergio Aguero.
- Japan-based electronics JVCKenwood disclosed being hit by a $7 million ransomware attack by the Conti actors, who allegedly exfiltrated around 1.7TB of data. Hackers stole customer and suppliers’ legal, financial, HR, IT, and compliance audit functions-related information.
- Thingiverse, a platform for sharing user-created digital design files, exposed a 36GB MySQL database containing 228,000 unique email addresses and user PII. But, there’s been an ongoing discussion regarding the scope of the breach and the amount of compromised user data.
- A ransomware attack against the Hillel Yaffe Medical Center in Israel. Health Insurance company Anthem’s vendor PracticeMax and UMass Memorial Health disclosed the PHI and other data of its members and employees. University Hospital Newark disclosed the sensitive personal and medical records of 9,329 individuals. Two Indiana hospitals, Johnson Memorial Health and Schneck Medical Center suspended access to their IT systems after being targeted by cybercriminals.
New Threats
As digital infrastructure continues to gain more adoption, bad actors are adjusting to the status quo with new attack vectors. Cybercriminals introduced new malware, such as SquirrelWaffle, MirrorBlast, and a UEFI bootkit. In another series of attacks, new cyberespionage operations by Balikbayan Foxes, SnapMC, Dev-0343, and MalKamak were observed disrupting business processes across the globe. Also, learn about ransomware that achieves its encryption goal in a record three hours.
- A highly active, new threat actor named Balikbayan Foxes aka TA2722 was found impersonating the Philippine government entities such as the Department of Health, the Bureau of Customs, and the Philippine Overseas Employment Administration. The messages targeted shipping, manufacturing, finance, pharmaceutical, energy, business services, and logistics industries in North America, Southeast Asia, and Europe.
- Cisco Talos warned against SquirrelWaffle, a new malware disseminating quickly via spam campaigns. Experts believe it has the potential to become the next big threat in the spam space. The malware enables threat actors to gain an initial foothold into systems and conduct further compromise or deploy more malware. The campaigns leverage stolen email threads containing hyperlinks to malicious ZIP archives hosted on web servers controlled by the attackers.
- DECAF is new ransomware written in Go 1.17. The malware variant appeared in late September and has been under development through October. DECAF uses the AES-CBS-128 algorithm to encrypt the files and subsequently creates a README.txt file inside each directory. Golang 1.17 complicates the analysis of the application flow, allowing attackers greater agility with the latest technology.
- The new MirrorBlast malware was spotted in a phishing campaign linked with the TA505 and PYSA groups. The campaign, which started in early September, targeted financial services organizations across Canada, the U.S., Europe, Hong Kong, and others.
- A couple of new espionage campaigns hit Southeast Asian countries. The first one began in September 2020 and ran at least until May targeted defense, healthcare, and ICT sectors. Another campaign was launched by a hitherto unknown nation-state actor, Harvester, whose target remained South Asian telecom providers, IT firms, and government entities.
- A new attack technique demonstrated on weak WiFi passwords can allow attackers to take control of devices. The attack leverages a security flaw to retrieve PMKID hashes and crack network passwords. A researcher was able to crack more than 3,500 WiFi networks, among a sample of 5,000 networks, within a short time.
- Cryptojacking group TeamTNT was spotted hosting malicious container images in Docker Hub to install basic utilities and scanning tools Zgrab and Masscan to target more machines for cryptomining.
- NCC Group observed a new threat actor, dubbed SnapMC, that steals data for carrying out data extortion attacks. Hackers use the Acunetix vulnerability scanner to hunt for flaws in VPN solutions and webserver apps.
- Kaspersky unearthed a cyberespionage campaign exploiting a zero-day flaw in Windows to deliver MysterySnail malware and steal data. A connection to a Chinese-speaking APT IronHusky was also established.
- Iran-linked hackers, DEV-0343, were found conducting extensive password spraying attacks against Office 365 accounts for defense technology and global maritime firms in the U.S. and Israel.
- MalKamak, a cyberespionage operation by an Iran-based hacker group, reportedly targeted aerospace and telecom firms in Western Countries with previously undocumented ShellClient trojan. Developers deploy various tools for reconnaissance, lateral movement, and collection and exfiltration of sensitive data.
- A previously undocumented UEFI bootkit, ESPecter, was found to be in use by attackers since 2012. The bootkit enabled threat actors to deploy backdoor on Windows systems by hijacking the Windows Boot Manager. The bootkit can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates the attackers to carry on with their espionage activities.
- Sophos laid bare new ransomware written in Python language that has the capability to encrypt virtual machines hosted on VMware ESXi servers in record time. It works by shutting down the virtual machines, overwriting the original files stored on the datastore volumes, and later encrypting files.