Cyware Weekly Threat Intelligence, August 15 - 19, 2022

The Good

Federal authorities and cybersecurity leaders are always on their toes to find ways to tackle rising cyber threats. This week, the U.S. Cyber Command’s Cyber National Mission Force completed the 35th Hunt Forward operations wherein it helped over 18 countries by discovering advanced malware threats. In parallel, Microsoft took action on the SEABORGIUM threat actor by dismantling a massive phishing campaign that was active for more than six months.

• The U.S Department of Energy (DOE) has announced that it will direct $45 million to support next-generation cybersecurity research, development, and demonstration projects that will help protect the power grid from cyberattacks.
• The U.S. Cyber Command’s Cyber National Mission Force has successfully concluded 35th ‘Hunt Forward’ operations in 18 countries, including Estonia, Lithuania, Montenegro, North Macedonia, and Ukraine. The last one took place in Croatia. These operations are carried out to help countries across the globe to uncover advanced malware and defend against incoming cyberattacks.
• The Microsoft Threat Intelligence Center (MSTIC) dismantled a massive phishing campaign launched by a highly-persistent threat actor named SEABORGIUM. The campaign was active since the beginning of 2022 and had targeted over 30 organizations across the U.S and the U.K.

The Bad

Attackers had a field day using a PLAY extension, which is associated with the lesser-known ransomware that goes by the same name. The ransomware was reportedly used to encrypt files after stealing them from the Judiciary Court of Córdoba. Meanwhile, the Cl0p ransomware gang made a mix-up by targeting the wrong U.K water company, believing it to be Thames Water. It claimed that more than 5TB of data was stolen in the incident.

• Group-IB researchers estimate that the state-sponsored APT41 hacker group had targeted at least 13 organizations worldwide in 2021. The targeted organizations included the public sector, manufacturing, healthcare, logistics, hospitality, and media. In the campaigns, the group used tools such as Acunetix, Nmap, SQLmap, subdomain3, subDomainsBrute, and Sublist3r for reconnaissance.
• In a mix-up, the Cl0p ransomware gang claimed attacks and stole data belonging to South Staffs Water believing it to be for Thames Water. The attackers had stolen more than 5TB of data from the organization and also asserted that they had access to some SCADA systems.
• Argentina’s Judiciary of Córdoba was reportedly hit by lesser-known ransomware dubbed PLAY. This forced the court to shut down IT systems and their online portal. The officials were forced to use pen and paper for submitting official documents.
• Hospitality and travel industries located in Latin America, North America, and Western Europe are under attack from TA558 threat actors. The actors are using phishing emails to pivot the campaign that has been ongoing since the beginning of the year.
• A Google Cloud Armor customer was targeted with a series of HTTPS DDoS attacks which peaked at 46 million requests per second. The attacks were mitigated soon after they were detected by Google.
• For the past three years, the China-based cyberespionage group RedAlpha aka Deepcliff and Red Dev 3 has been observed targeting numerous government organizations, humanitarian entities, and think tanks. The purpose of these campaigns is to harvest credentials from the targeted individuals and organizations.
• More than 20 malicious PyPI packages designed to steal passwords and other sensitive information from victims’ machines were uncovered in a new software supply chain attack. Two of these packages are tracked as ‘ultrarequests’ and ‘pyquest.’
• The LockBit ransomware gang claimed responsibility for the cyberattack on digital security giant Entrust. The attack had caused the loss of some sensitive data from internal systems.
• DigitalOcean revealed that a recent security breach at MailChimp had exposed the email addresses of some of its customers. Password reset notifications and alerts have been sent to customers.
• A hack on CS:MONEY, one of the largest platforms for trading CS:GO skins, enabled hackers to steal 20,000 items worth approximately $6 million. As a result, the firm was forced to take down its website for recovery.
• In a new update, Signal shared that a security breach at Twilio had affected 1900 of its users. Due to the breach, the phone numbers of these users were exposed.

New Threats

Threat actors show no signs of slowing down as they continue to implement faster and more complex techniques to launch cyberattacks. While the BlackByte group is back with a new extortion technique borrowed from LockBit, Cozy Bear (aka APT29) has found a way to disable the Purview Audit in licensing models to target Microsoft Office 365 users. The ill-famed Lazarus group has also added a new signed macOS malware to continue its ‘Operation In(ter)ception’ campaign that makes fake job offers.

• New activities associated with Bumblebee loader have come to light this week. It is believed that the transition from BazarLoader, TrickBot, and IcedID to Bumblebee is under active development. Additionally, the malware loader is used to compromise Active Directory services.

• Researchers have documented PoC for Evil PLC Attacks against seven ICS manufacturers: Rockwell Automation, Schneider Electric, GE, B&R, Xinje, OVARRO, and Emerson. A hijacked PLC can be used to compromise engineering workstations, which in turn, can open doors to other potential cyberattacks.

• Mandiant researchers have been tracking a cluster of espionage activity associated with UNC3890 threat actors. The campaign has been active since 2020 and uses watering hole attacks to target organizations in the shipping, government, energy, and healthcare in Israel.

• In another report from Mandiant, APT29 (also called Cozy Bear) has been found updating TTPs to target Microsoft 365 users. One of the tactics includes disabling the Purview Audit in licensing models of Microsoft 365.

• Around 93 unique DarkTortilla samples have been identified between January 2021 and May 2022. The malware samples are delivered via phishing emails that typically use a logistic lure and include an attachment with file types such as .iso, .img, .dmg, and .tar.

• A new signed macOS malware sample developed by Lazarus APT group is being distributed via fake job offer emails from Coinbase. It is linked to the infamous ‘Operation Interception’ campaign that had earlier targeted high-profile aerospace and military organizations.

• Janet Jackson’s Rhythm Nation music video of 1989 has officially been declared a security vulnerability as it freezes some models of hard drives on older computers. The vulnerability in question is tracked as CVE-2022-38392 and can lead to DoS attacks.

• Around 35 malicious applications on Google Play Store have over two million downloads. These applications use icons and names of legit apps such as GPS Location Maps to bypass security checks.

• Microsoft reported detecting hundreds of thousands of cryptojacking attacks every month. The researchers highlighted that the attackers have evolved their evasion tactics such as leveraging LOLBins to launch the attacks.

• After a brief gap, the BlackByte group has reappeared with a new extortion tactic borrowed from LockBit. The attackers are calling this new iteration as BlackByte version 2.0. A brand new Tor data leak site has been launched as part of this operation.

• Researchers have linked the ATMZOW hacker group behind both the JS sniffer campaign and the Hancitor malware downloader. The group has infected at least 483 websites across Italy, Germany, France, U.K., Australia, India, and Brazil, since the beginning of 2019.