Cyware Weekly Threat Intelligence - August 07–11

The Good

This week, federal authorities scored a big win against phishing threats. Interpol took down the 16shop PhaaS platform that fueled attacks impacting at least 70,000 users across 43 countries. In parallel, the FBI, the IRS, and authorities in Poland dismantled the bulletproof hosting platform, Lolek. Thus, preventing fraudsters from accessing anonymous tools that could be used to launch malware and botnet attacks.

• The NIST released the first draft of Cybersecurity Framework 2.0 that provides guidance to the private sector, government agencies, and other organizations. It also addresses the role of corporate governance and the growing risks to digital networks via third-party relationships. The framework includes guidelines to identify, detect, respond, and recover from cyberattacks or data breaches.
• Interpol successfully took down the 16shop PhaaS platform that was responsible for creating 150,000 phishing pages impacting at least 70,000 users from 43 countries. The platform provided phishing kits that targeted Apple, PayPal, American Express, Amazon, and Cash App accounts, among others. The data stolen in these attacks included personal details, account emails, passwords, ID cards, credit card numbers, and telephone numbers.
• IRS confirmed the takedown of bulletproof hosting provider Lolek that provided anonymity to threat actors. It was used to rent out IP addresses, servers, and domains to criminals who used them to spread malware, build botnet armies, and do other activities connected to fraud and cyberattacks.

The Bad

The aftermath of the MOVEit hack is larger than expected. In the latest update, a state healthcare authority disclosed that its protected Medicaid healthcare information was compromised in the attack. Moreover, the gang behind this sophisticated attack has evolved its extortion strategy by adding victims to torrent sites that are easily accessible by anyone. In different news, a sophisticated campaign exploiting the Log4Shell flaw that went undetected for three years was found impacting several academia, aerospace, government, media, telecommunications, and research institutions.

• The LockBit ransomware group has added Varian Medical Systems to its list of victim organizations and threatened to leak the medical data of cancer patients if the firm fails to pay the ransom by August 17. While the group has not disclosed the amount of data stolen, the firm is yet to confirm the attack.
• The personal data, including names and home addresses, of millions of British voters got exposed due to a cyberattack at the U.K’s Electoral Commission. The incident primarily affects the individuals who registered to vote between 2014 and 2022. According to a notification published on August 8, the attackers first accessed the servers in August 2021.
• Around 60% of Kubernetes clusters belonging to more than 350 organizations were targets of an active cryptomining campaign. These clusters belonged to small to medium-sized organizations, with a smaller subset tied to bigger companies in the financial, aerospace, automotive, industrial, and security sectors. A pro-Russian hacking group, NoName057, listed the Dutch public transport website, local bank SNS, the Groningen seaport, and the website of the municipality of Vlardingen among its targets. These websites were taken down in DDoS attacks, making them unreachable.
• A threat actor group tracked as RedHotel has been associated with a three-year-long cyber campaign that targeted 17 different countries in Asia, Europe, and North America. The prominent sectors targeted include those in academia, aerospace, government, media, telecommunications, and research. A majority of these attacks were launched by exploiting Log4Shell flaws.
• The Police Service of Northern Ireland inadvertently shared sensitive information about 10,000 serving police officers in response to a FOI request. The data was leaked in a spreadsheet and remained accessible for more than two hours before being taken down.
• The Cl0p ransomware gang yet again changed its extortion strategy within a span of two weeks to put more pressure on victims targeted in the MOVEit hack. The notorious gang has begun using torrent sites to leak data easily. Torrents have been created for 20 victims, including Aon, K&L Gates, Putnam, Delaware Life, Zurich Brazil, and Heidelberg.
• Missouri's Department of Social Services confirmed that its protected Medicaid healthcare information was affected in the MOVEit hack at IBM. The information involved names, department client numbers, dates of birth, possible benefit eligibility status or coverage, and medical claims information of patients.

New Threats

This week, new variants of SkidMap, Yashma, and SystemBC malware have also been identified in the wild. While the new SkidMap variant was observed targeting a wide range of Linux distributions, the Yashma ransomware variant targeted organizations worldwide by encrypting the files and altering the wallpaper to notify about the attack. The variant of SystemBC, DroxiDat, was used in a ransomware attack launched against a power generation company in South Africa.

• QakBot malware operators have added 15 new servers in an attempt to expand their C2 network. A majority of these inbound servers, that communicate with the victim hosts, are located in India and the U.S. The outbound connections are based in the U.S., India, Mexico, and Venezuela.
• Billions of Intel CPUs are at risk due to a Downfall vulnerability in Intel’s x86 chips. The flaw can be abused to steal sensitive data, including encryption keys fromcomputers. A malicious tab on the browser can use this flaw to steal a banking password from another tab.
• Researchers at ETH Zurich discovered a new type of side-channel attack, called Inception, that shares similarities with the 2018 Spectre attack. Tracked as CVE-2023-20569, the exploit can leak sensitive from any AMD Zen CPU. The attack can bypass mitigations for all known speculative execution attacks that have been applied so far.
• The latest findings reveal a clear correlation between the emergence of Rhysida and the disappearance of Vice Society ransomware. This includes the use of NTDSUtil, the creation of local firewall rules to enable C2 communications via SystemBC, and the utilization of a commodity tool called PortStarter. The other major indicator is the commonality in their victimology footprints.
• Researchers recently uncovered a multilingual attack campaign using a Yashma ransomware variant against organizations globally. The campaign, allegedly launched by Vietnamese threat actors, was believed to have commenced in the first week of June. Upon infecting victim systems, the malware encrypted files and altered the wallpaper with a notification claiming the encryption of all files.
• A new variant of the SkidMap malware is being used in a new campaign targeting a wide range of Linux distributions, including Alibaba, Anolis, openEuler, EulerOS, Steam, CentOS, RedHat, and Rock. The attack chain begins with attackers logging into unsecured Redis instances via brute-force attacks and setting up variables containing cron tasks under a base64 string.
• CERT-UA issued a warning on a phishing effort using open-source malware called MerlinAgent to target Ukrainian government entities. According to the agency, an unnamed threat actor tracked as UAC-0154 sent malicious emails to targets with the subject line - CERT-UA suggestions on MS Office program settings.
• The TargetCompany ransomware abused a variation of the FUD obfuscator engine BatCloak to infect vulnerable systems. The infection chain began with the exploitation of vulnerable SQL servers to persistently deploy its first stage.
• Researchers observed a surge in EvilProxy phishing attacks in the last five months. The campaign utilized brand impersonation, bot detection evasion, and open redirection methods. If victims click on the embedded links in the phishing emails, they are redirected to various websites before landing on an EvilProxy phishing page that mimics the Microsoft 365 login page.
• A newFreeze.rs injector, written in Rust, was found injecting shellcode and XWorm into a victim’s system. The injector was distributed via phishing email containing a malicious PDF file. This file redirects to an HTML file and utilizes the “search-ms” protocol to access an LNK file on a remote server.
• The CISA released a report on SEASPY and WHIRLPOOL, new backdoors found deployed on hacked Barracuda email security gateways. While SEASPY masqueraded as a legitimate Barracuda email service that allows the threat actors to execute arbitrary commands on the ESG appliance, WHIRLPOOL establishes a Transport Layer Security (TLS) reverse shell to the C2 server.
• Zscaler identified a new info-stealer, named Statc Stealer, used in the wild via malvertising and SEO poisoning campaigns. It exhibits a broad range of information stealing capabilities including login data, cookies, and web data. Additionally, it targets cryptocurrency wallets, credentials, passwords, and even data from messaging apps like Telegram.
• A new variant of SystemBC called DroxiDat was used as a precursor to a suspected ransomware attack launched against a power generation company in South Africa. It provides no download-and-execute capabilities but can connect with remote listeners and pass data back and forth, and modify the system registry.
• Multiple zero-day vulnerabilities, dubbed BitForge, have been found affecting major cryptocurrency wallet providers like Coinbase, Zengo, and Binance. These vulnerabilities exist in the cryptographic multi-party computation (MPC) protocols and can be abused to steal coins and other digital assets.