Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Cyber Threat Intelligence April 23- 27, 2018

Cyware Weekly Cyber Threat Intelligence April 23- 27, 2018 - Featured Image

Weekly Threat Briefing Apr 27, 2018

The Good

The week witnessed some high points in cybersecurity with government agencies and firms making good strides towards addressing cyber threats. The Europol succeeded in dismantling the ‘Webstresser’ which it claimed to be a hotspot for the sale of DDoS attacks. Microsoft has launched 'Windows Defender System Guard' to mitigate attacks in software. On the other hand, researchers at New Zealand have invented the first ever quantum blockchain.

  • Europol has successfully dismantled the Webstresser website. As per claims by the police, the website sold Distributed Denial of Service (DDoS) attacks and helped launch up to 6 million of them for as many as 136,000 registered users. The investigation was led by the Dutch National High Tech Crime Unit and the UK National Crime Agency (NCA), and assisted by Europol. Four alleged administrators of the site were arrested, the site was shut down and its infrastructure was seized.

  • A new Windows platform security technology, meant to mitigate attacks in software, has been released by Microsoft. The company announced Windows Defender System Guard runtime attestation that can provide signals for Endpoint Detection and Response (EDR) and antivirus vendors. The security technology is also capable of detecting kernel tampering, rootkits, and exploits.

  • A study by researchers in New Zealand found out that the newly proposed quantum blockchain can result in blockchain systems that are unaffected by quantum-computer hacking. This is considered to be the first ever fully quantum blockchain. This new quantum blockchain functions by interpreting its mistakes and influencing its own past.

The Bad

Along with the favorable news, the week noticed some disappointing breaches and attacks. While Dubai-based ‘Careem’ app was affected by a data breach which resulted in data theft of 14 million users; ‘MyEtherWallet’, a web-based Ether wallet service suffered from the loss of cryptocurrencies due to DNS hijack. An unsecured Mongo database led to the data leak of 25,000 Bezop’s investors and 2 million UK bank customer faced trouble due to a faulty IT upgrade.

  • Dubai-based ride sharing platform Careem became a victim of data breach after a cyber attack resulted in the theft of personal data of up to 14 million people in the Middle East, North Africa, Pakistan and Turkey. The company announced that the breach was detected on January 14, post which, a thorough investigation was launched and leading security experts were engaged to strengthen security systems.

  • The DNS server of MyEtherWallet, a web-based Ether wallet service, was hijacked by unknown hackers in order to redirect users to a fake version of the website and steal their wallet private keys. Using these keys, hackers managed to steal close to 215 Ether (about $160,000 at the time of the transaction). Hackers could hijack the DNS entries by executing a BGP route hijack that redirected traffic meant for Amazon servers to systems they controlled.

  • Hackers managed to redirect Amazon traffic to rogue destinations for two hours by exploiting the Internet-protocol weakness. Roughly 1,300 IP addresses were hijacked in this charade. Attackers also masqueraded as cryptocurrency website MyEtherWallet.com and stole about $150,000.

  • Around 25,000 investors and potential investors linked with Bezop.io, the organization behind the Bezop cryptocurrency, had their personal details leaked due to an unsecured Mongo database. The personal information included names, addresses, encrypted passwords, wallet information, scanned passports, and copies of driver’s license. Bezop immediately secured the data after being notified.

  • Around two million UK banking customers experienced trouble using their accounts after an IT upgrade went wrong. Customers were also able to access other users’ savings and business accounts. The Financial Conduct Authority (FCA) and the Information Commissioner’s Office(ICO) are said to be investigating the incident.

New Threats

Talking about threats, researchers found Operation GhostSecret targeting global facilities and Rubella Macro Builder crimeware kit being used for campaign attacks. In other news, researchers unearthed Crossrider Variant and a new botnet family known as SquirtDanger was discovered.

  • Dubbed Operation GhostSecret, a global data-stealing campaign has been discovered by McAfee security researchers, targeting several industries including critical infrastructure, entertainment, finance, health care, and telecommunications. The campaign leverages various tools, implants and malware variants associated with the Hidden Cobra hacker group.
  • A new variant of the Crossrider variant has been spotted attacking Mac devices disguising itself as a fake Adobe Flash Player installer. The configuration of the variant forces Safari and Chrome to redirect users to a page on chumsearch[dot]com. Unfortunately, this cannot be changed in the browser settings. The profile can be found by opening System Preferences, then clicking the Profiles icon.
  • Unit 42, Palo Alto Networks' threat research arm has discovered the author behind the new botnet malware family SquirtDanger. The Russian hacker, TheBottle, is found to be associated with these attacks. The malware is capable of conducting several actions including taking screenshots, clearing browsing cookies, steal stored information, upload/download files etc.
  • Three new malware variants associated with the APT34 hacker group have been discovered by a threat hunt team. The hacker group is believed to be operating since at least 2014, and uses BONDUPTATER (used to download software) and POWRUNER (used as a backdoor to exploit software vulnerabilities).
  • A new and advanced phishing kit, currently available in Brazil, is being analyzed by Check Point Researchers and a cyber intelligence company, CyberInt. The new kit is believed to be an epitome of the next generation in phishing architecture, as it makes for an even easier set-up and a more convincing fake website. The phishing kit generally targets online shoppers and aims at stealing users’ personal details and credit card information.
  • Members of the top-tier Russian hacking forum have started using the crimeware kit, dubbed the Rubella Macro Builder. The kit is cheap, fast and can bypass basic antivirus detections. The crimeware kit is being distributed via Microsoft Word or Excel email attachments.

Related Threat Briefings

Feb 14, 2025

Cyware Weekly Threat Intelligence, February 10–14, 2025

Cyber defenders are sharpening their tools, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. India is taking digital banking security up a notch. The RBI is launching a dedicated domain to curb financial fraud and enhance trust in online banking. Starting April 2025, financial institutions will register under this domain. China’s RedMike hackers are dialing into telecom networks - literally. Between December 2024 and January 2025, they targeted over 1,000 unpatched Cisco devices. Their primary focus? Global telecoms and university networks in Argentina, Bangladesh, and the U.S. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. Love is in the air, but so are phishing scams. In late January, cybercriminals launched a Valentine’s-themed phishing campaign, offering fake gift baskets in exchange for stolen credentials. Cybercriminals are upping their game with Astaroth, a phishing kit that doesn’t just steal credentials but also hijacks entire sessions. By using a reverse proxy, Astaroth intercepts logins and 2FA tokens in real time, allowing attackers to bypass security measures undetected. South America’s foreign ministry was caught in the crosshairs of an advanced cyber-espionage campaign. In November 2024, attackers linked to REF7707 deployed the PATHLOADER and FINALDRAFT malware to infiltrate diplomatic networks. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script.

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.