Cyware Weekly Threat Intelligence - April 24–28

The Good

This week, cyber defenders displayed some notable advances in the battle against malware threats. Google announced the disruption of CryptBot malware operations that infected over 670,000 computers worldwide. In another incident, eSentire’s Threat Response Unit launched a multi-pronged offensive against Gootloader, saving 12 different organizations from being targeted. The act was pulled off after researchers gained access to the malware code and infrastructure.

• The NIST released a new post-quantum cryptography guidance draft that is open for public comments until June 8. The document is meant to help organizations understand the security architecture in their networks and implement post-quantum security measures where it is necessary. The new draft follows NIST’s ongoing effort to finalize quantum-resistant algorithms in 2024 after identifying other encryption algorithms in 2022.
• Google disrupted the massive CryptBot info-stealing malware operation that infected over 670,000 computers last year. The development comes after Google filed litigation against several major distributors of CryptoBot infecting Chrome users to steal their data. Most of these attackers were believed to be operating in Pakistan. In another significant development, researchers at eSentire discovered a way to deal with Gootloader attacks after gaining access to the malware’s infrastructure. This enabled the researchers to thwart attacks on 12 organizations.
• The Health 3rd Party Trust (Health3PT) council announced its first significant initiative to tackle third-party risks in the healthcare sector. As a part of this development, over 15,000 third-party vendors associated with medical firms were contacted to encourage them to follow standardized HITRUST risk assessment methods. The council has also introduced the Health3PT Vendor Directory, which includes a list of reliable vendors who have obtained HITRUST e1, i1, or r2 certifications.

The Bad

Despite all the good efforts, multiple organizations were found using misconfigured cloud assets that exposed them to a variety of cyberattacks. In one study, researchers found that several Fortune 500 companies using poorly secured repositories and registries were at risk of supply chain attacks as they leaked millions of software artifacts and container images online. Besides this, over 2000 organizations are vulnerable to massive DoS amplification attacks owing to a high-severity flaw discovered in the Service Location Protocol (SLP). In other news, a massive phishing attack impersonating 3,200 Meta support staff was also detected stealing login credentials from Facebook users.

• Around 250 million software artifacts and over 65,000 container images were found to be exposed via thousands of internet-facing registries and repositories. Some 1400 hosts also allowed access to secret keys, passwords, and other sensitive information that could enable attackers to mount a supply chain attack or poison a software development environment. These hosts were linked to addresses of several Fortune 500 companies such as Siemens, Cisco, Alibaba, and IBM.
• Yellow Pages Group, a Canadian directory publisher, confirmed that it was hit by a ransomware attack. Meanwhile, the Black Basta group has claimed responsibility for the attack by posting sensitive documents and data stolen from the firm on its leaked website.
• Between February and March, Group-IB researchers detected a massive phishing campaign that impersonated over 3,200 Meta support staff to steal login credentials from Facebook users. Scammers created fake profiles of the Meta staff and posted links that redirected victims to over 220 phishing sites carrying Meta or Facebook’s brand.
• Security researchers uncovered more than 2,000 organizations that are at risk of massive DoS amplification attacks due to a high-severity vulnerability discovered in the Service Location Protocol (SLP). This flaw impacts devices such as VMware ESXi hypervisors, Konica Minolta printers, Planex routers, Supermicro IPMI servers, and a ton of IBM gear. Over 70,000 servers were found exposing their SLP ports on the internet.
• The Medusa ransomware gang leaked the sensitive information of children and teachers that was stolen from Minneapolis Public Schools earlier this year. The leaked data included some 200,000 files containing dates of birth, names, ethnicity, ID numbers, and behavioral issue details of students.
• A supply chain attack campaign has been found infecting Tencent QQ users with MgBot malware. Launched by the Evasive Panda APT group, the campaign has been active since 2020 and the malware is delivered via fake Tencent QQ software updates. Other victims of the campaign are members of an NGO located in the Chinese provinces of Gansu, Guangdong, and Jiangsu.
• The city of Lowell, Massachusetts, suffered a ransomware attack that disrupted its computer systems. Servers, networks, phones, and other systems were also inaccessible throughout the city. Upon discovering the incident, the city’s MIS department isolated the impacted networks and systems.
• An environment file hosted on the Peugeot site leaked access to its user data in Peru. The exposed file contained Symfony application secret, Uniform Resource Identifier (URI), usernames, passwords, and locations of private and public keys. An attacker could use this data to log in or modify the dataset’s contents.

New Threats

Coming to new threats, cybercriminals were found upgrading their arsenal with new malware. While the North Korean BlueNoroff group added a new malware, dubbed RustBucket, to target macOS systems, the Russia-based Evil Corp gang enhanced its crypto-stealing ability using a malware called LOBSHOT. A new attack method was also discovered this week, enabling threat actors to launch cryptojacking attacks on Kubernetes clusters.

• Threat actors have devised a new attack method to abuse Kubernetes role-based access control (RBAC) to deploy backdoors for persistence. Dubbed RBAC Buster, the attack method can also enable attackers to launch cryptojacking attacks on targeted Kubernetes clusters by exploiting misconfigured API servers linked to the clusters.

• North Korea-based BlueNoroff threat actor added a new macOS malware called RustBucket to its malware arsenal. The malware masquerades as a legitimate Apple bundle identifier that helps the attackers to override Gatekeeper on Mac. Written in Rust language, it is capable of gathering system information.

• More than 1,000 Windows and macOS systems are still vulnerable to the PaperCut installation flaw that was patched in March 2023. Attackers can exploit the flaw to bypass authentication and execute arbitrary code remotely. The vulnerability has been patched with the release of PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, and 22.0.9. In another update, Microsoft has attributed recent attacks on PaperCut servers to the Clop and LockBit ransomware groups.

• ViperSoftX, a cryptocurrency and info-stealer malware, has been updated to include more sophisticated encryption and data-stealing methods. So far, the variant has infected a significant number of victims in consumer and enterprise sectors across Australia, Japan, the U.S., India, Taiwan, Malaysia, France, and Italy.

• Certain attacks previously correlated with the Turla group were carried out by Tomiris APT, according to researchers. It was found that the cybercriminal group made use of KopiLuwak and TunnusSched (malicious tools that are also associated with Turla) to launch attacks between 2021 and 2023.

• Multiple generations of Intel CPUs are vulnerable to a new side-channel attack that allows the leak of data through the EFLAGS register. The new attack relies on a flaw in transient execution that affects the timing of Jump on Condition Code (JCC) instructions.

• LOBSHOT is a new malware that is being used by the TA505 threat actor to steal cryptocurrencies and private information from users. The malware targets 32 Chrome extensions, nine Edge wallet extensions, and 11 Firefox wallet extensions, enabling threat actors to steal cryptocurrency asssets.

• Charming Kitten APT was observed using a previously unseen custom dropper malware, BellaCiao, to target users located in the U.S., Turkey, India, Europe, and the Middle East. The attackers possibly exploited known vulnerabilities in internet-exposed applications such as Zoho ManageEngine or Microsoft Exchange Server to drop the malware.

• An ongoing attack campaign, tracked as OCX#HARVESTER, has been found distributing More-eggs backdoor, along with other malicious payloads. The More-eggs backdoor was observed in the wild from December 2022 through March 2023. The attack chain leveraged specially crafted phishing emails to lure victims in the financial sector, especially those organizations involved with cryptocurrencies.

• CheckPoint researchers shared new findings on Educated Manticore which is a sub-group of the Iranian cyberespionage group known as Phosphorous. The attackers have significantly improved their toolset which uses a mixture of .NET and C++ code. The final executed payload is an updated version of the Powerless malware which is also tied to some Phosphorous ransomware operations.

• A new macOS info-stealing malware named Atomic (aka AMOS) is being sold on private Telegram channels for a subscription of $1,000/month. The malware steals keychain passwords, files from local filesystems, passwords, cookies, and credit card details stored in browsers. It also attempts to steal data from 50 cryptocurrency extensions.

• China-based Alloy Taurus APT was spotted using a Linux variant of PingPull malware, along with a backdoor named Sword2033, to target organizations in South Africa and Nepal. Upon execution, the malware variant uses the OpenSSL library and HTTP POST request to interact with C2 servers handled by attackers.