Cyware Weekly Threat Intelligence - April 03–07

The Good

This week, law enforcement agencies made some significant advancements in combating the malicious activities of cybercriminals. One such action was taken against a massive pig butchering scam that swindled over $112 million in cryptocurrency. The operations of the infamous Genesis Market were also disrupted in a coordinated effort, saving millions of computers from being further used by attackers. These computers were compromised using DanaBot and other malware.

• The U.S. DoJ seized six virtual currency accounts containing over $112 million in funds stolen in multiple pig-butchering finance scams. The criminals behind these scams approached victims via various dating platforms, messaging apps, or social media platforms. Once confidence was gained, the scammers introduced investment schemes and eventually stole funds from victims’ crypto wallets.
• The infamous cybercrime forum Genesis Market was taken down in a coordinated operation that was carried out by law enforcement agencies from 17 countries. The marketplace was selling access to millions of computers that were compromised using DanaBot and other malware. The illegal forum also provided access to browser fingerprints, cookies, autofills, and other credentials.
• The DOD launched a new website, www.hackthepentagon[.]mil, to enhance and support the Hack the Pentagon program that was launched in 2016. The website includes educational materials that can be used as a foundation step for launching a bug bounty program. The platform will also enable the engagement and recruitment of technical talents.

The Bad

While Genesis is no longer active, a new dark web market called Styx has emerged to fill the void, offering cybercriminals a wide range of illegal services for identity theft, DDoS attacks, and financial fraud. In the latest update on the recent 3CX supply chain attack, a small number of cryptocurrency firms were affected in the incident that was pulled off by North Korea’s Lazarus group. In separate news, a new ransomware group has demanded $4 million in ransom to prevent the leak of over 1.5TB of sensitive data it allegedly stole from a Taiwan PC hardware vendor.

• Taiwanese PC parts maker MSI has five days' time to pay a hefty ransom of $4 million demanded by a newly-formed ransomware group called Money Message. If payment is not received, the threat actors have threatened to publish 1.5 TB of data stolen from the firm. To claim the attack, the group has posted screenshots of the hardware vendor’s CTMS and ERP databases containing software source code, private keys, and BIOS firmware.

• YouTube warned users of a new phishing scam that tricked users into sharing their login credentials. Scammers impersonated the video-sharing platform to send out a phishing email that asked recipients to provide their details owing to the changes in YouTube rules and policies.

• A hacker group that goes by the name of TACTICAL#OCTOPUS used tax-related themes to lure U.S. taxpayers into downloading a malicious zip file that installed malware onto their systems. The malware enabled hackers to gain access to victims’ systems and capture clipboard data and track keystrokes.

• New updates on the 3CX supply chain attack reveal that a small number of cryptocurrency companies were also impacted by the attack conducted by the Lazarus threat group. A majority of the attack attempts have been registered in Australia, the U.S., and the U.K, with healthcare, pharma, IT, and finance emerging as the top targeted sectors.

• Sensitive details of several banks, including QBANK, Defence Bank, Bloom Money, Admiral Money, MA Money, Reed, HSBC, and Westpac, were leaked due to a misconfiguration issue in a digital identification tool provided by OCR Labs. The leaked data included access credentials to AWS, application tokens, and various API keys.

• A new dark web marketplace identified as Styx is gaining popularity among cybercriminals for providing access to a wide range of illegal services such as DDoS attacks, banking trojans, stolen IDs, and 2FA/MFA bypass solutions. These services can be used to launch identity theft, financial fraud, and malware attacks. The marketplace is also being used to sell the PII of victims based in the U.S., the U.K, Canada, and the Netherlands.

• A massive WordPress infection campaign, that leverages well-known vulnerabilities in plugins and themes, was found to be active since 2017. The attackers could manage to stay under the radar by using different domain names that hosted sites for tech support scams, push notification scams, and fraudulent lottery wins. It is estimated that over one million WordPress websites have been infected by this campaign.

• The Medusa ransomware group added the Open University of Cyprus to its data leak site, giving the institute 14 days time to respond to its ransom demands. The hackers have asked for $100,000 in ransom to prevent the further leak of data that includes the PII of students, and the financial details of research contractors.

• The U.K’s Criminal Records Office (ACRO) confirmed that its website was disrupted in a cybersecurity incident on January 17. The announcement comes after the applicants were unable to download their police certificates from the website.

• An online marketplace Z2U was found exposing 600,000 customer support attachments due to an unprotected database. The attachments included images of individuals holding credit cards, passports, and other ID documents. Other exposed information were email addresses, passwords, and IBAN numbers of users.

New Threats

Moving on, cryptocurrency investors are at more risk of cyberattacks as threat actors added two new cryptocurrency-stealing malware to their arsenal. Named Rilide and CryptoClippy, the malware are distributed via SEO poisoning attacks and can withdraw digital assets from victims’ wallets without their knowledge. Several new ransomware families were also spotted this week, with Rorschach being detected as the fastest ransomware to encrypt files in just over four minutes.

• Google’s TAG linked a North Korean threat cluster, named ARCHIPELAGO, with attacks targeting government and military personnel, think tanks, policymakers, academics, and researchers in South Korea and the U.S. The group’s tactics broadly overlap with Kimsuky APT.
• A newly discovered CryptoClippy clipper malware was found targeting Portuguese cryptocurrency users. The attack leverages SEO poisoning techniques to entice users searching for ‘WhatsApp web’ to rogue domains hosting the malware. The malware monitors a victim’s clipboard to replace the actual wallet address with a wallet address controlled by threat actors.
• A new malware strain named Rilide used Chromium-based browsers to steal cryptocurrency assets. The malware is disguised as a Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities such as taking screenshots and monitoring browsing history.
• A new affiliate of the ALPHV/BlackCat ransomware, dubbed UNC4466, is exploiting vulnerabilities in the Veritas Backup Exec software to gain initial access to the targeted network. The threat group is active since October 2022 and uses Mimikatz, RCLONE, LAZAGNE, WINSW, and LIGOLO to compromise systems.
• Researchers uncovered a new form of attack, dubbed Proxyjacking, that exploited the Log4Shell vulnerability to gain access to victims’ systems before selling the IP address to legitimate proxyware services. The attack is launched by installing an agent that turns the compromised accounts into proxy servers.
• Arid Viper threat actor has been observed using new variants of Micropsia, ViperRAT, and FrozenCell to target Palestinian entities. The attacks were first observed in September 2022 and continued till February 2023.
• Automotive security experts discovered a new CAN injection attack that results in car theft. Once the thieves gain direct access to a vehicle’s system bus via a smart headlamp wiring, they introduce bogus messages that cause the security system to unlock the vehicle and disable the engine immobilizer.