Cyware Weekly Threat Intelligence - April 10–14

The Good

Traditional security models are no longer enough to protect systems, networks, and data from advanced and sophisticated cyber threats. Organizations should adopt better security practices and guidelines that are built on observations and experiences from past security incidents. Keeping this in mind, the CISA has issued an updated version of the Zero Trust Maturity Model for public and private sectors, based on suggestions from the public on the previous version. Besides this, the agency has published a separate guideline to enhance the security of technology products shipped to customers.

• The CISA released an updated version of the Zero Trust Maturity Model to assist law enforcement agencies and organizations in the development and implementation of zero trust strategies. The latest version (2.0) is built on the public feedback of version 1.0 and includes the implementation of the zero trust strategy across five pillars - identity, devices, networks, data and applications, and workloads.
• Google collaborated with several other companies to form a new group, called the Hacking Policy Council, that will advocate better regulations and policies for vulnerability management and disclosure. The council is an initiative of the Center for Cybersecurity Policy and Law.
• A new guidance to enhance the security of software and technology products has been issued by the CISA in collaboration with the FBI, the NSA, and security agencies from the Five Eyes Intelligence Alliance. The authorities urged manufacturers to ship only those products to customers that follow secure-by-design and secure-by-default approaches.

The Bad

Despite these positive developments, several organizations fell victim to different security incidents that either led to the exposure of sensitive data or the loss of funds. While a cryptocurrency firm announced a loss of $23 million worth of cryptocurrencies in a hack, a security lapse at a Canada-based cloud accounting startup caused the leakage of personal details of over 30 million users online. In other news, threat actors have dumped the personal data of over 400,000 Kodi users on underground forums, thus increasing the risk of identity theft.

• FreshBooks, a Canadian unicorn startup building cloud accounting software, had left exposed the sensitive data of over 30 million users due to a misconfigured AWS bucket. The exposed database was first discovered in January 2023 and included login details and hash passwords of users.
• Hackers hacked South Korea-based GDAC and stole nearly $13 million worth of Bitcoin, Ethereum, and Wemix tokens from the firm. GDAC said it notified the authorities and is working to recover the funds.
• Crypto exchange Bitrue spotted a brief exploit of one of its hot wallets, which resulted in the theft of $23 million worth of ETH, GALA, QNT, SHIB, MATIC, and HOT. The firm has temporarily suspended its operations, including withdrawals.
• Yum! Brands began notifying users that the personal information of an undisclosed number of individuals was stolen in a ransomware attack that occurred in January. This included names, driver’s license numbers, and other ID card numbers of users.
• A cyberattack at Belgian HR and payroll giant SD Worx caused the shutdown of all IT systems for its U.K and Ireland services. The security advisory from the firm disclosed that it observed malicious activities in the hosted data center, following which it took immediate mitigation measures.
• Several controllers operated by the Galil Sewage Corporation, Jordan Valley, were paralyzed following a cyberattack. While the source of the attack is unknown, the company experts spent an entire day recovering the operations.
• In the latest update on the 3CX supply chain attack, Mandiant determined that the attackers infected 3CX systems with TAXHAUL aka TxRLoader malware. When executed on Windows systems, the malware uses the Windows CryptUnprotectData API to decrypt the shellcode with a cryptographic key unique to each compromised host.
• A new advisory from the FBI warned that scammers are impersonating Chinese government officials in an attempt to pilfer sensitive details from Chinese nationals based in the U.S. The scam creates a sense of urgency and threatens targets by showing them fake documents, like warrants, to prove their accusations. In another advisory, the FCC warned users against Juice Jacking attacks that enabled attackers to install malware or malicious software on their phones, tablets, or computers by hijacking public charging stations.
• An investigation into the 2021 ransomware attack on Suffolk County, New York, revealed that hackers spent eight months inside the systems before launching the attack. They exploited the Log4j vulnerability to break into the county clerk’s office, established persistence, installed Bitcoin mining software, and harvested credentials.
• The Lürssen shipyard group, Germany, suffered a ransomware attack over the Easter holiday. Not many details are available presently; however, it is reported that the company has initiated an investigation to understand the scope and impact of the attack. Furthermore, the company has taken necessary security measures to prevent the ransomware from spreading further.
• Hackers dumped the private data of around 400,000 Kodi users on several hacking forums. The media player maker suffered a data breach on February 16 and 21 after threat actors compromised the account of an inactive administrator and accessed the web-based MyBB admin console.

New Threats

Coming to threats, QBot returned in a fresh attack campaign that targeted Korean users. A new RaaS gang was also discovered by researchers this week. Tracked as Read The Manual (RTM) Locker, the group is skilled in launching ransomware attacks against high-value organizations and later uses affiliates to initiate ransom negotiations. There were also reports of misuse of well-known ChatGPT and Chrome browser apps to propagate RedLine stealer and Monero mining malware, respectively.

• Microsoft shared technical details of a new campaign that exploited a Secure Boot security feature bypass vulnerability (CVE-2022-21894) via a UEFI bootkit called BlackLotus. After execution, the bootkit writes malicious bootloader files to the EFI system partition and subsequently locks them to protect them from deletion or tampering.
• A new commercial spyware, dubbed KingsPawn, was used to compromise the iPhones of high-profile individuals. The spyware was distributed using a zero-click exploit, named ENDOFDAYS, that targeted a zero-day flaw affecting iPhones running iOS 1.4 up to 14.4.2. The targeted victims include journalists, political opposition figures, and NGO workers in North America, Central Asia, Southeast Asia, Europe, and the Middle East have been targeted in the campaign.
• Researchers encountered a new email phishing campaign that spoofed a Ukraine company, Energoatom, to distribute the Havoc Demon backdoor. The phishing email included a macro-enabled document that contained a list of people supposedly approved to receive protective equipment. The malware is capable of executing PowerShell commands, manipulating processes, taking screenshots, manipulating files and directories, and executing malicious commands.
• Kaspersky shared details of a Nokoyawa ransomware campaign that exploited a zero-day privilege escalation flaw (CVE-2023-28252) in Windows to gain initial access. The vulnerability was triggered by manipulating the base log file. The campaign is believed to be part of a large attack framework called Devil Shadow Botnet.
• An NTT security analyst spotted a campaign that exploited a fake Google Chrome update error screen to distribute Monero mining malware. The malware used the BYOVD technique to abuse a bug in WinRing0x64.sys to gain system privilege access.
• The CISA updated its Known Exploited Vulnerabilities (KEV) catalog with two new security flaws affecting iPads, iPhones, and Macs. The agency warned that these flaws are being actively exploited in the wild and can allow attackers to launch arbitrary code attacks.
• A new RedLine stealer attack campaign was spotted leveraging the rising popularity of AI platforms for propagation. The malware disguised as free downloads for the ChatGPT or Google Bard files to evade detection. These files were promoted through compromised Facebook business or community accounts.
• Qakbot (aka Qbot) was found leveraging hijacked email chains to infect users in Korea. The malware disguised as PDF files attached to the email to hide its identity. The recipient addresses were obtained from the original email's recipients and CC list.
• Researchers shared details of a new RaaS group called RTM Locker that provides and carries out opportunistic ransomware attacks to generate illicit profit. The group uses affiliates to extort the targeted victims.