Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Oct 3, 2022

The Good

Governments worldwide continue to ramp up security measures across Internet of Things (IoT) products. The European Union, last month, outlined new cyber regulations regarding IoT products. Under the new rule, the European Commission will have the power to recall and ban non-compliant cyber products and services. Along the same lines, the NSA becomes the latest U.S. federal agency to kick off its digital migration to quantum-resistant networks; sets 2035 as the deadline.

  • The European Union started working on a set of new cybersecurity rules for IoT vendors that are expected to come into effect by 2024. Some of the rules mandate frequent testing of devices for vulnerabilities, encryption of confidential data, and application of security updates regularly. Companies failing to comply with the rules may risk fines of 2.5% of their annual turnover or €15 million (~$15.07 million).

  • The NSA published requirements for quantum-resistant algorithms that need to be implemented by vendors and operators of national security systems. The process aims to secure the classified information that is critical for military and intelligence activities.

  • The CISA announced the release of its 2023–2025 strategic plan that aims to focus on reducing risk and building resilience to cyber threats to the nation’s infrastructure. The plan is built on the foundation of CISA Strategic Intent, published in 2019.

  • The Biden Administration launched a cyber grant program of up to $1 billion for state and local governments to fortify their digital defenses. The program will be administered by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA).

The Bad

The FBI has raised an alarm about cyberattacks against healthcare payment processors. Such escalation in attacks has resulted in significant monetary losses to the sector. The DeFi sector continues to serve as a hotbed for cybercriminals as cryptocurrency firm Wintermute reported millions in losses. In another update, NATO documents were dumped on the dark web for sale. It contained hundreds of secrets and confidential documents that were sent to the Portugal government.

  • The FBI issued an alert about hackers targeting healthcare payment processors to route payments to their bank accounts. This year, threat actors have stolen more than $4.6 million from healthcare companies. In another alert, the agency warned the sector that threat actors are continuing to exploit unpatched and outdated medical devices.

  • Threat actors were found leveraging hacked Facebook business pages to spread RedLine Stealer. These accounts belonged to a Brazilian ISP, Mexican sporting goods store, a mountain tourism site in Slovakia, and a computer repair shop in the Philippines. The malware is available on dark web forums for about $100 to $150.

  • Around 20,000 accounts associated with The North Face outdoor apparel brand were compromised in a credential stuffing attack. These accounts included personal information, such as full names, billing addresses, shipping addresses, telephone numbers, and XPLR Pass reward records of users.

  • Cryptocurrency market maker Wintermute was breached, with attackers stealing $162.5 million worth of cryptocurrency from the company’s DeFi business. The hackers exploited a privileged function with the private key leak to replace a swap contract with their contract. This is the fifth largest cryptocurrency theft, so far, this year.

  • A hacker claimed to have pilfered 2 billion TikTok records, including 760GB of user data. While security analysts confirmed the breach, the social media platform denied any such incident. Meanwhile, TikTok shot back at reports of the breach.

  • Researchers at Mandiant and Microsoft have linked a series of cyberespionage attacks targeted against the Albanian government. Microsoft reported four different Iranian APTs—DEV-0842, DEV-0861, DEV0166, and DEV-0133—were involved in these attacks that were believed to be active since 2021.

  • Lorenz ransomware group exploited a flaw in MiVoice Connect’s Mitel Service Appliance component to gain access to a corporate network. The attackers waited for a month after gaining initial access and then performed lateral movement. They utilized FileZilla for data exfiltration and performed encryption through BitLocker.

  • Classified NATO documents belonging to the Armed Forces General Staff agency of Portugal (EMGFA) were put on sale on the dark web. The stolen documents were spotted by the U.S. Information Services, after which it alerted the Portuguese authorities by informing the U.S. embassy in Lisbon.

  • Threat actors exploited an unauthorized access vulnerability to target over 39000 Redis servers to deploy XMRig cryptominer. Most of the vulnerable Redis servers were located in China, followed by Germany and Singapore.

  • Australia-based telecommunications provider Optus notified that it is dealing with a cyberattack that affected customers’ personal data. The information exposed include names, dates of birth, phone numbers, ID document numbers, and email addresses of customers.

  • Hive ransomware claimed an attack on the New York Racing Association (NYRA). The attack took place on June 30, and resulted in the exfiltration of customers’ data such as their Social Security Numbers, health records, and health insurance information.

  • Multiple npm packages published by crypto exchange dYdX, and used by at least 44 cryptocurrency projects, were compromised to run infostealers on systems. The infostealer was used to steal AWS IAM credentials, SSH keys, and GitHub tokens.

  • DeFi cryptocurrency platform BXH suffered a loss of around $40,000 due to a flash loan attack. This is the second time that the organization was attacked after losing an amount of nearly $2.5 million in a hack that occurred on September 23.

New Threats

Witchetty emerged as a new hacking group using a steganographic technique to target Middle Eastern governments. Coincidentally, the threat landscape saw another malware threat targeting the Middle East and Africa, dubbed Metador. Meanwhile, the effect of the leaked Lockbit 3.0 builder became visible last month; Bl00dy ransomware group was found using it to target Ukrainian organizations.

  • A newly found NullMixer malware dropper is being used to drop a variety of malware such as RedLine Stealer, Vidar, SmokeLoader, PsuedoManuscrypt, and Danbot. The malware dropper spreads via malicious websites found on search engines. These websites are related to cracks, keygens, and activators for downloading software illegally.
  • Black Lotus Labs detected a multifunctional Go-based malware, dubbed Chaos, purposed to target a wide range of devices, including small office/home office (SOHO) routers and enterprise servers. The malware samples were likely written by Chinese actors, and rely on a China-based C2 infrastructure, with key attack features being DDoS and cryptomining. Most of its bot infections were located in Europe, specifically Italy.
  • Sucuri discovered a campaign using fake Cloudflare CAPTCHA dialog boxes to trick users into downloading and installing malware on their devices. The malware used in the attack enabled threat actors to gain full access to systems, paving the way for a ransomware infection or banking trojan attack.
  • The Witchetty espionage group has been progressively updating its toolset to target government sectors in the Middle East and Africa. Among the new tools used by the group is a backdoor named Stegmap. The malware is distributed via the rarely used steganography technique.
  • Fancy Bear hacking group used a new code execution technique that exploits mouse movement in PowerPoint files to distribute the Graphite malware. The group leveraged the SyncAppvPublishingServer utility for this purpose.
  • The builder for the LockBit 3.0 ransomware was leaked on Twitter, which will likely lead to a rise in other threat actors using it to launch their own attacks. The builder can allow anyone to quickly build the executables required to launch their own ransomware operation, including an encryptor, decryptor, and specialized tools to launch the decryptor in certain ways. The recently formed Bl00Dy ransomware group was found using the leaked builder in its recent attacks.
  • A new APT group called Metador has been found targeting telcos, internet service providers, and universities across the Middle East and Africa. The threat actor uses two malware platforms to target Windows systems, along with at least one Linux implant.
  • OriginLogger, also known as Agent Tesla v3, is a new variant of the Agent Tesla keylogger malware. It is distributed via a Microsoft Word document containing a passport-size photo, along with a credit card.
  • A new self-spreading malware bundle has been promoted in the form of fake cheat codes and cracks for popular games like FIFA, Final Fantasy, Forza Horizon, Lego Star Wars, and Spider-Man. These cheat codes and cracks are advertised via YouTube videos.
  • Malicious actors were found exploiting both old and new Oracle WebLogic Server vulnerabilities to deliver different malware families, with Kinsing being one of them. One of these vulnerabilities is tracked as CVE-2020-14882.
  • SharkBot Android trojan disguised as fake updates for antivirus was used to infect users across the U.S., Spain, Poland, Austria, Germany, and Australia in a new campaign. The apps were distributed through Google Play Store.
  • A new version of Bumblebee malware loader has been spotted in the wild. It features a new infection method that uses the PowerSploit post-exploitation framework for stealthy reflective injection of a DLL payload into memory.
  • Attackers behind Qyick, Agenda, BlackCat, Black Basta, and PLAY ransomware strains are leveraging a new Intermittent encryption approach to accelerate the encryption process and evade detection on victims’ systems. The tactic is being intensively advertised to attract buyers and affiliates.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.