Cyware Weekly Threat Intelligence - August 14–18

The Good

Obsolete systems are more vulnerable to cyberattacks if they are not taken care of at the right time. Taking a constructive approach in this line, the White House has begun working on a modernization plan to replace outdated systems, posing security risks, across the federal government. In another significant move, the CISA has released a joint cyber defense plan to address risks associated with RMM software that is widely used to infiltrate MSSPs.

• The White House is working on a plan to replace vulnerable and outdated IT systems across federal civilian agencies in an effort to bolster the nation’s cyber posture. The Office of Management and Budget has been assigned the job to develop a multi-year lifecycle plan that includes migrating to cloud-based services and mitigating risks associated with older systems. This development comes after the GAO found in May that 10 critical federal agencies had failed to take proper security measures to secure their legacy systems.
• On August 16, the CISA released the Remote Monitoring and Management (RMM) Cyber Defense Plan to help government organizations mitigate the risk of deploying and using RMM software in their environments. Built upon the JCDC 2023 Planning Agenda, the new guideline will also be useful for SMBs that are MSP/MSSP customers, as threat actors can gain footholds into MSPs/MSSPs via RMM software.

The Bad

Meanwhile, MOVEit breach notifications continue to roll on. This week, a state healthcare department in Colorado emerged as the latest victim as it notified over 4 million individuals that their personal information was impacted in the attack. In another concerning matter, IABs were found selling illegal network access to more than 100 companies, with the price for network access to a major auction house set at $120,000. Besides, a scam campaign is doing the rounds on the internet, compromising the websites of well-known universities and U.S. government agencies to push fake promotions and surveys.

• The Colorado Department of Health Care Policy & Financing (HCPF) revealed that the personal and health information of more than four million individuals has been impacted by the MOVEit attack on IBM. The exfiltrated files contained full names, Social Security numbers, Medicaid ID numbers, dates of birth, home addresses, and health insurance details of patients.
• The personal information of 1.5 million individuals was compromised in a ransomware attack at Canada’s Alberta Dental Service Corporation (ADSC). The attack occurred last month, and according to ADSC, the attackers had access to its network for more than two months before deploying the ransomware. The compromised systems contained the personal and banking information of the users.
• A threat actor named Akhirah offered a Discord[.]io database for sale on the new Breached hacking forum. The database contains personal information such as usernames, email addresses, billing addresses, and Discord IDs of 760,000 users. Meanwhile, the firm confirmed the breach in a notice and shut down its services in response.
• Researchers uncovered a large email phishing campaign using malicious QR codes to target several companies. These emails were sent to organizations in the manufacturing, insurance, technology, and financial industries. These emails used fake account security updates as a lure and asked victims to scan QR codes that redirected them to a fake Microsoft page asking for credentials.
• Thousands of websites belonging to well-known universities, U.S. government agencies, and private organizations have been compromised in an ongoing scam campaign to push fake offers and promotions. Active for more than five years, the campaign primarily targets children by tricking them into downloading apps, malware, or sharing personal information in exchange for bogus rewards from Fortnite and Roblox.
• Cyberint spotted an ongoing and successful hacking campaign targeting LinkedIn accounts, resulting in victims losing access and facing ransom demands or account deletion. The attackers leveraged leaked login information or brute-force attack methods to hijack a significant number of LinkedIn accounts.
• Threat actors hijacked a wallet’s private key to steal $860,000 worth of 472 ETH from the RocketSwap cryptocurrency platform. The firm apologized to users for the loss and reported that a brute force hack on the server was detected.
• The New Haven Public Schools district in Connecticut disclosed losing more than $6 million in a BEC scam that took place in June. While more than $3.6 million of the stolen funds have been recovered so far, the FBI is working to understand the scope of the incident to recover the remaining amount.
• SentinelOne researchers revealed that the Chinese APT group, Bronze Starlight, was involved in an espionage campaign targeting the gambling sector across Southeast Asia. The attack was orchestrated via trojanized executables for Adobe Creative Cloud, Microsoft Edge, and McAfee VirusScan, causing the delivery of malware onto victims’ systems.
• A K-12 school district in Cleveland, is dealing with a ransomware attack that affected around 5% of all devices connected to the network. The school officials claimed that no student or faculty data was compromised in the incident and are working with DHS for remediation.
• Initial Access Brokers (IABs) were found advertising the network access to a major auction house for a price of $120,000. Among the other organizations for which backend access credentials have been put on auction include several entities in the U.S. and the U.K. These network access are for organizations in healthcare, financial services, and manufacturing sectors.
• The New York City Department of Finance inadvertently shared the personal information, including home addresses, cellphone numbers, and email addresses, of more than 1,700 workers with other employees over an email. The agency is investigating the matters and working with legal partners to determine the best course of action.
• A tech support scam, dubbed WoofLocker, has evolved over three years to include sophisticated traffic redirection schemes, laying its foundation for a persistent and evolving threat. It uses multiple tactics such as steganography and fingerprinting checks to stay undetected.

New Threats

Raccoon Stealer is back again on the scene, with new tactics to launch stealthy attacks. The operators have rolled out version 2.3.0 of the malware that is being actively promoted on hacker forums. Talking along the same line, the group behind the BlackCat ransomware has evolved its evasion capabilities to move silently and laterally across breached networks. In another threat update, Knight ransomware, a recycled version of Cyclops ransomware, appeared in a new campaign that targeted TripAdvisor users.

• The cybercrime group behind Raccoon Stealer announced its return after a hiatus of six months with a new version of the malware. Tracked as version 2.3.0, the info-stealer includes multiple evasion capabilities and is being distributed to threat actors via hacker forums. These include an advanced admin panel, a system, a new Log Stats panel, and a reporting system to detect and block unusual activity.

• An ongoing spam campaign has been found distributing the Knight ransomware strain packaged in a file impersonating fake TripAdvisor complaints. The campaign uses an HTML attachment named ‘TripAdvisor-Complaint-[random].PDF.htm that redirects users to a fake browser window for TripAdvisor.

• Banking users across Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android malware called Gigabud RAT. The malware primarily uses a screen recording feature on the target’s phone to gather sensitive information from Android phones. It comes under the guise of a loan application and lures users to fill out a bank card application form to obtain a low-interest loan.

• A newly discovered QwixxRAT (aka TelegramRAT) is being advertised on Telegram and Discord platforms, boasting the ability to collect and exfiltrate a wide range of sensitive information. This includes data from browser histories, credit card details, FTP credentials, screenshots, and keystrokes. Written in C#, it includes a clipper code to capture cryptocurrency wallet information. To avoid detection by antivirus software, the RAT employs C2 functionality through a Telegram bot. This allows the attackers to remotely control the RAT and manage its operations.

• ESET Researchers observed a new phishing campaign, aimed at collecting Zimbra account users’ credentials. Active since April, the campaign is carried out via phishing emails notifying recipients about an email server update and deceiving them by redirecting them to a fake Zimbra web login page that steals their credentials.

• Microsoft discovered a new version of the BlackCat ransomware (version 2.0) that includes the Impacket networking framework and the Remcom hacking tool to facilitate lateral movement for attackers in target environments. Adding these tools only makes it harder for defenders to detect the ransomware.

• Several unpatched flaws discovered in Microsoft’s PowerShell Gallery code repository can be abused to spoof popular packages and perform typosquatting and supply chain attacks. AquaSec reported all flaws on September 27, 2022, following which Microsoft took remedial actions to fix them. However, on December 26, 2022, AquaSec was able to replicate the flaws, indicating the issues still persisted.

• Sysdig researchers unveiled a new financially-motivated campaign, dubbed LABRAT, that exploited an unpatched GitLab flaw (CVE-2021-22205) to launch cryptojacking and proxyjacking attacks. Furthermore, the attackers abused a legitimate TryCloudflare service to obfuscate their C2 network.