Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence, April 06 - April 10, 2020

Cyware Weekly Threat Intelligence, April 06 - April 10, 2020 - Featured Image

Weekly Threat Briefing Apr 10, 2020

The Good

As the COVID-19 pandemic has forced a massive adoption of remote working, numerous organizations now need to secure their extended threat environment. To aid organizations in this transition, Microsoft this week released new security guidance detailing the various attack vectors and tactics used by threat actors to leverage the pandemic to target employees working from home. On the other hand, the Canadian Internet Registration Authority (CIRA) launched a country-wide Domain Name System (DNS) filtering service to protect critical infrastructure and organizations from malware and phishing threats.

  • Microsoft published new threat intel and security guidance for individuals and organizations in the wake of rising incidents of phishing and social engineering attacks that have hit every country during the coronavirus pandemic.

  • Canadian Internet Registration Authority (CIRA) launched a country-wide DNS filtering service to block malware and phishing threats, with early access given to healthcare workers, small businesses, and educational institutions.

  • The Commonwealth Scientific and Industrial Research Organisation (CSIRO), an Australian federal agency, announced the creation of the seL4 Foundation, a not-for-profit organization, to accelerate the development of the seL4 microkernel and related technologies. The seL4 project is designed to be the world’s first operating system (OS) kernel that is mathematically proved secure.

  • Google released a free software security book, titled 'Building Secure and Reliable Systems', that provides first-hand lessons in avoiding and responding to failures caused by attackers or small internal changes. The book provides valuable insights into how security teams can improve their site reliability engineering (SRE) practices.

  • Nominet, a UK-based domain name registrar, blocked 600 coronavirus-themed websites that were found scamming the public by selling fake vaccines, protective equipment, and fraud remedies.

The Bad

The week saw a number of significant data leaks and other noteworthy incidents. The email marketing firm, Maropost, exposed an unsecured database containing 95 million records with information on its numerous clients. Meanwhile, researchers also reported a massive BGP hijacking attack by the Russian state-owned telecom provider that redirected the web traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers. The affected companies included the likes of Google, Amazon, Facebook, Akamai, and Cloudflare.

  • An unsecured database owned by the email delivery and marketing firm, Maropost, exposed about 95 million email records and email logs. The leaked email logs contained relevant metadata, such as the exact date and time the emails were sent. The database, which is hosted on the Google cloud server, was taken offline on April 1, 2020.

  • Bisq Bitcoin exchange temporarily disabled trading after the discovery of a critical vulnerability in its platform. The firm plans to release v1.3.0 soon to fix the issue. Until then, users are asked not to send any funds to and from Bisq.

  • Hammersmith Medicines Research Ltd. (HMR) suffered an attack from Maze ransomware. The incident had occurred on March 14, 2020, following which the ransomware operators had stolen the data hosted on HMR’s network. The attackers had eventually released the data on their ‘News’ site on March 21 when the research company denied paying the ransom. The stolen records contained the personal information for volunteers whose surnames began with D, G, I, J.

  • Researchers at Microsoft noted that cybercriminals have adopted COVID-19 phishing lures to target individuals and organizations across 241 nations and territories. The tech giant also detected a massive campaign using 2,300 different webpages attached to phishing emails disguised as COVID-19 financial compensation information. The spoofed pages were designed to capture users’ Office 365 credentials.

  • The data of more than 600,000 Email.it users was put up for sale on the dark web forum. The incident came to light on April 5, 2020, when the hackers - going by the name of NN - went on Twitter to promote a website that was used to sell the company’s data. They claimed that the actual intrusion took place more than two years ago, in January 2018. The selling price of the data varies between 0.5 and 3 bitcoin.

  • Berkine, a subsidiary of a US-based firm, previously known as Anadarko Petroleum Corp., was hit by the Maze ransomware. The attackers have managed to steal an entire database containing over 500 MB of confidential documents related to budgets, organizational strategies, and production quantities.

  • The traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers, was redirected by Rostelecom in a BGP hijacking attack last week. The attack lasted for about an hour and affected over 8,800 internet traffic routes. The impacted companies included Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Hetzner, and Linode.

  • The US Small Business Administration (SBA) revealed that the personally identifiable information (PII) for some of the financial relief loan applicants may have been exposed to other applicants online. The incident occurred due to a security flaw in the loan application site. The issue was immediately resolved and the application portal was relaunched to avoid exposure of sensitive data.

  • Microsoft shared details of an Emotet attack on an organization named Fabrikam (a placeholder name given by Microsoft in its case study). The attack relied on a phishing message that was opened by an internal employee. This unleashed the malware, which later infected the organization’s systems and halted core services by saturating the CPU usage on Windows devices.

  • A new attack campaign linked to the DarkHotel APT group targeted more than 200 Sangfor SSL VPN servers by exploiting a zero-day vulnerability. 174 of these servers were located on the networks of government agencies in Beijing and Shanghai, and the networks of Chinese diplomatic missions operating abroad. This included countries like Italy, Pakistan, Indonesia, Thailand, the UAE, Israel, Malaysia, Iran, Ethiopia, and India.

  • The personal information of around 45,000 Iranian individuals, totaling to 8.17 GB, was put up for sale on the dark web for an amount of $200 in BTC. The stolen data appeared to have come from several sites including Niazpardaz[.]ir, an online advertising platform, and Arzi24[.]com, a website owned by Farhad Exchange. Security researchers also found another trove of leaked data for sale, including 52,000 ID cards along with selfies of their respective owners.

  • IBM X-Force researchers discovered a SMiShing campaign designed to unlock the phone for resale on the black market. The phishing campaign was found to be operating over 600 phishing domains designed to steal iCloud credentials from Apple users. The attackers behind the campaign were found focusing on cybersecurity and tech conferences to steal iPhones belonging to influential company executives, only to later target them with the SMShing campaign to extract their credentials and private data.

  • Two school districts in the US state of California suffered cybersecurity breaches due to security issues plaguing the video conferencing platform, Zoom. In one incident, the school administrators mistakenly posted hundreds of meeting access codes and passwords on a publicly accessible webpage.

  • In an internal memo sent to all its personnel, NASA warned of an exponential increase in malware attacks and a doubling of targeted phishing attacks as employees started working from home during the COVID-19 pandemic.

  • Security researchers at BlackBerry reported that state-linked Chinese APT groups have targeted US firms for over a decade to steal intellectual property and other sensitive business data. The hackers especially targeted the Linux-based backend servers as they lacked adequate security compared to other key infrastructure.

New Threats

Despite a lockdown across many countries, hackers continue to evolve their malicious exploits and attack techniques. This week, researchers came across two new advanced botnets, namely Dark Nexus and DDG. While Dark Nexus is capable of performing DDoS attacks on various IoT devices, DDG is a sophisticated cryptomining botnet that is capable of functioning independently of its C2 servers, using its proprietary P2P protocol. A new ‘Mouse-Over’ attack technique affecting Microsoft PowerPoint was also discovered this week. The technique can allow attackers to bypass security restrictions and manipulate user files on targeted devices.

  • Researchers detected a new ransomware called L4NC34 that appends .crypt extension after encrypting files on a victim’s machine. Later, it drops a ransom note which is actually located within a PHP file. The ransomware demands a ransom of $10 in bitcoin to decrypt the files. Since the ransomware uses the base64 algorithm to encrypt files, researchers have managed to retrieve a decryption key by decoding the algorithm.
  • A new campaign that spreads the notorious Ursnif trojan was observed recently. The trojan is delivered via document files, titled ‘info_03_24.doc’. These documents leverage malicious Visual Basic for Applications (VBA) macro code that is used to call the main routine. The campaign is executed in three different stages to evade detection by antivirus software.
  • The cryptomining botnet called DDG was updated by its authors to adopt a proprietary peer-to-peer (P2P) mechanism. The botnet, first reported by Netlab 360 researchers in January 2018, has undergone 16 different updates over the past three months to become a highly sophisticated and seemingly unstoppable threat, according to the researchers. The botnet can fully function using its P2P protocol as a failsafe, even if its C2 servers are taken down.
  • Researchers demonstrated a new attack technique that leverages weaknesses in a PowerPoint’s Open XML Slide Show (PPSX) files to install malware. Termed as ‘Mouse-Over’ attack, the method allows threat actors to bypass restrictions in PowerPoint and manipulate users’ files.
  • Researchers found that 3D printing technology can be used to bypass most fingerprint scanners used by mobile devices from Apple, Samsung, and Microsoft. The technology has also been successfully tested on laptops and smart padlocks.
  • Researchers came across a new botnet named Dark Nexus, that shares similarities with Qbot and Mirai botnets. The botnet is capable of performing DDoS attacks and launching credential stuffing attacks against a broad range of IoT devices, video recorders, and thermal cameras. There are three different versions of the Dark Nexus botnet which has been around for three months.
  • FIN6 APT group and the operators of the Trickbot malware paired up together to target several organizations with Anchor backdoor malware. The attack campaign, which has been active for the past six months, is initiated through malspam. Most of the enterprises that include Point of Sale (PoS) systems have fallen victim to the campaign.
  • xHelper trojan, which has been around since March 2019, reportedly infected at least 55,000 devices across the globe. The malicious payload connects with the C2 server of attackers after scanning and sending device information, including OS firmware version, manufacturer name, and model. Later, it fetches another payload, the Triada trojan, which uses a set of exploits to obtain device root privileges.
  • The government of Colombia sanctioned CoronApp-Colombia app was found containing serious vulnerabilities. The app has over 100,000 users and their details are exposed due to the underlying security flaws. The exposed data includes passport numbers, passwords, and self-disclosed health information of users.
  • Over 350,000 of all Microsoft Exchange servers were found to be still affected by the CVE-2020-0688 post-auth remote code execution vulnerability. The flaw is present in the Exchange Control Panel (ECP) component and can allow attackers to take over Microsoft Exchange servers using previously stolen valid email credentials.
  • Unpatched flaws existing in the authentication mechanisms of PayPal and Venmo websites could allow attackers to reset passwords via text messages and take control of a victim’s cellphone number. The flaws were detected earlier this year and affected several other major companies like Amazon, Blizzard, Adobe, eBay, Snapchat, and Yahoo. While some of these companies have plugged the security hole, others are yet to do it.
  • Researchers observed a new bitcoin-mining campaign, targeting misconfigured open Docker Daemon API ports. It has been found that thousands of attempts are being made every day to compromise such containers as part of the campaign. The purpose of these attacks is to deploy Kinsing malware in the final stage of the infection to run cryptominers.
  • Threat actors compromised legitimate installers of the video conferencing app, Zoom, to distribute a Coinminer dubbed Trojan.Win32.MOOZ.THCCABO. The compromised installers are available for download from fraudulent websites. The Coinminer is capable of collecting system information such as Graphics Processing Unit (GPU), operating system version, video controllers and processors, and more.
  • Researchers uncovered thousands of Android apps containing hidden backdoors and blacklists. This discovery was made using a tool named INPUTSCOPE. The research involved more than 150,000 applications, out of which 30,000 were pre-installed apps extracted from Samsung smartphones’ firmware. Nearly 12,706 apps were found containing some sort of backdoors and some 4,028 apps included blacklist secrets.
  • Ten critical vulnerabilities found in HP Support Assistant could expose Windows computers to remote code execution attacks. This can allow attackers to elevate privileges or to delete arbitrary files. The flaws include five local privilege escalation flaws, two arbitrary file deletion vulnerabilities, and three remote code execution vulnerabilities. HP has patched some of these vulnerabilities, while the remaining are yet to be patched.
  • Several vulnerabilities found in B&R Automation software could allow attackers to launch attacks inside operational technology networks. The security holes are related to Automation Studio’s update service and are tracked as privilege escalation flaws, incomplete encryption & validation issues, and path traversal flaws.

Related Threat Briefings

Feb 14, 2025

Cyware Weekly Threat Intelligence, February 10–14, 2025

Cyber defenders are sharpening their tools, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. India is taking digital banking security up a notch. The RBI is launching a dedicated domain to curb financial fraud and enhance trust in online banking. Starting April 2025, financial institutions will register under this domain. China’s RedMike hackers are dialing into telecom networks - literally. Between December 2024 and January 2025, they targeted over 1,000 unpatched Cisco devices. Their primary focus? Global telecoms and university networks in Argentina, Bangladesh, and the U.S. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. Love is in the air, but so are phishing scams. In late January, cybercriminals launched a Valentine’s-themed phishing campaign, offering fake gift baskets in exchange for stolen credentials. Cybercriminals are upping their game with Astaroth, a phishing kit that doesn’t just steal credentials but also hijacks entire sessions. By using a reverse proxy, Astaroth intercepts logins and 2FA tokens in real time, allowing attackers to bypass security measures undetected. South America’s foreign ministry was caught in the crosshairs of an advanced cyber-espionage campaign. In November 2024, attackers linked to REF7707 deployed the PATHLOADER and FINALDRAFT malware to infiltrate diplomatic networks. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script.

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.