Cyware Weekly Threat Intelligence - August 12–16

The Good

In a landmark move, the UN has unanimously passed its first-ever cybercrime treaty, laying the groundwork for a unified global response to cyber threats. This historic treaty, now headed to the General Assembly for final approval, empowers authorities to access electronic evidence across borders, marking a significant step toward enhanced international cybersecurity collaboration. NIST has set a new milestone by formalizing the world’s first post-quantum cryptography standards. Designed to protect against the impending quantum computing era, these standards ensure data integrity in the face of future quantum threats.

• NIST formalized the world's first post-quantum cryptography standards to protect systems and data from future quantum threats. The new NIST standards aim to help organizations transition to quantum-secure encryption before this occurs. Three post-quantum cryptography standards have been finalized by NIST after public consultation. These include a key-encapsulation mechanism standard, a lattice-based digital signature standard, and a stateless hash-based digital signature standard. These standards contain the computer code for encryption algorithms and instructions for implementation on various devices.
• The FBI announced the dismantling of the Radar/Dispossessor ransomware operation, which targeted small to mid-sized businesses and organizations across the U.S., Europe, and other regions. The group, possibly formed by former LockBit affiliates, used similar tactics and infrastructure. Law enforcement agencies in the U.S., the U.K, and Germany collaborated to take down servers and domains associated with the group.
• The White House and the DHS are teaming up on an $11 million initiative to understand the use of open-source software in critical infrastructure and enhance its security. The effort, known as the Open-Source Software Prevalence Initiative, aims to identify open-source software components in areas like healthcare, transportation, and energy production for better national cybersecurity. Recommendations from the cybersecurity community include securing package repositories, strengthening the software supply chain, increasing education initiatives, and replacing legacy software.

The Bad

FortiGuard Labs uncovered a persistent ValleyRAT malware campaign specifically targeting Chinese-speaking users. Researchers detected a new variant of the Gafgyt botnet, which exploits machines with weak SSH passwords to expand its network and mine cryptocurrency using GPU power. Google’s Pixel devices were found to have shipped with a dormant app called Showcase.apk, which exposes them to potential security risks.

• FortiGuard Labs discovered an ongoing ValleyRAT campaign targeting Chinese speakers. ValleyRAT is a multi-stage malware that uses various techniques to monitor and control victims' machines. The campaign involves several components, including RemoteShellCode, RuntimeBroker, Payload Downloader, and ValleyRAT. The malware loads these components and executes them to achieve its malicious intent. ValleyRAT, furthermore, is capable of graphically monitoring user activities, delivering arbitrary plugins, and executing arbitrary commands, posing a serious threat to Windows users.
• Researchers at Aqua Nautilus have identified a new variant of the Gafgyt botnet that targets machines with weak SSH passwords to expand the botnet network and mine cryptocurrency using GPU power. The attack flow begins with a successful brute force attempt on an SSH server with a weak password. The attacking server, part of the botnet, executes shell commands via the SSH connection and transfers the main payloads for crypto mining. The infected device scans the internet for other vulnerable machines to launch similar attacks.
• Google's own Pixel devices shipped with a dormant app called Showcase.apk, exposing them to potential attacks and malware. The software, developed by Smith Micro for Verizon, has excessive system privileges and downloads a configuration file over unsecure HTTP, making the device vulnerable to potential attacks. While Google claims it's not a platform or Pixel vulnerability and the app is no longer being used, they plan to remove it from supported devices. However, the app's presence on the devices requires physical access and user password for exploitation.
• Two Russia-aligned phishing campaigns targeted human rights organizations, independent media, and civil society members from Eastern Europe and the U.S. The campaigns, attributed to groups named Coldriver and Coldwastrel, utilized malicious emails with fake PDF attachments to collect victims' passwords and authentication codes. While no malware was deployed, unauthorized access to email accounts may have occurred. The phishing activities were highly personalized and tailored to deceive targets.
• FortiGuard Labs discovered a recent phishing campaign targeting employees, tricking them into opening a malicious attachment by posing as a customer. Once a victim clicked on the malicious attachment, it initiated a multi-stage attack chain resulting in the deployment of multiple malware families, including XWorm, Venom RAT, AsyncRAT, and PureHVNC. Notably, the PureHVNC malware targets specific applications and can carry out further attacks using its plugins.
• X is facing a rise in scams exploiting the Ukraine war and earthquake in Japan to lure users into clicking on fake content that leads to scam adult sites, harmful browser extensions, and suspicious affiliate sites. These scams involve posts that initially appear to be pornographic videos but actually redirect users to fake adult sites. Scammers are now also sharing posts claiming to have information about Ukrainian forces invading Kursk or earthquake warnings in Japan. These posts contain fake content warnings that, when clicked, connect to URLs that ultimately lead to scam sites.

New Threats

In the realm of new threats, Sophos identified the new EDRKillShifter tool being used by cybercriminals in a recent attempted ransomware attack. This tool is engineered to disable endpoint protection software by exploiting vulnerable drivers. Microsoft's August 2024 Patch Tuesday update addressed 90 vulnerabilities across various products, with seven classified as critical. CERT-UA issued a warning about a new phishing campaign that impersonates the Security Service of Ukraine to distribute the ANONVNC malware, enabling unauthorized access to infected computers.

• Sophos analysts discovered a new tool called EDRKillShifter being used by cybercriminals in an attempted ransomware attack. This tool is designed to disable endpoint protection software and is delivered through a multi-step process. It is used to deploy various EDR killer variants that exploit vulnerable drivers to disable endpoint security. The attackers may have acquired the loader tool from the dark net, and the final payloads are developed separately.
• The August 2024 Patch Tuesday from Microsoft addressed a total of 90 vulnerabilities in various products, with seven being rated as critical. Among the vulnerabilities, six are actively exploited, including remote code execution flaws in Windows components. The most severe vulnerabilities allow unauthenticated attackers to execute code remotely through specially crafted packets, posing a significant security risk. Microsoft has released security updates to address these issues and recommends disabling IPv6 as a precautionary measure.
• CERT-UA warned of a new phishing campaign impersonating the Security Service of Ukraine to distribute malware called ANONVNC, which allows for unauthorized access to infected computers. More than 100 computers, including those belonging to government bodies, have been infected since July 2024. The agency also noted an increase in campaigns distributing the PicassoLoader malware to deploy Cobalt Strike Beacon, with a threat actor tracked as UAC-0057.
• A new Ransomware-as-a-Service (RaaS) called DeathGrip has appeared in the ransomware landscape. It is being promoted on underground forums and offers aspiring threat actors sophisticated ransomware tools. The emergence of DeathGrip ransomware highlights the evolving threat landscape, emphasizing the importance of robust cybersecurity measures to safeguard against ransomware attacks.
• A new cyber threat called Banshee Stealer targets macOS systems, posing a significant risk to users. This malicious software can extract sensitive information like passwords from Keychain, system data, and browser details. It also targets cryptocurrency wallets and plugins, making it a comprehensive tool for cybercriminals.