Cyware Weekly Threat Intelligence - December 18–22

The Good

Law enforcement agencies globally are actively engaged in disrupting cybercriminal infrastructure to safeguard digital ecosystems. In the latest events, the DOJ disrupted the BlackCat ransomware group's server infrastructure and provided a decryption tool to over 500 victims. In another development, nearly 3,500 cybercriminals were arrested, and $300 million in illegal assets from various scams were seized as part of an operation involving agencies from 34 countries.

• The US Department of Justice (DOJ) successfully disrupted the infrastructure of the BlackCat ransomware group and offered a decryption tool to more than 500 victims around the world, thus saving more than $68 million in ransom payments. The threat group has targeted over 1,000 computer networks and extorted millions of dollars from victims. With the decryption tool provided by the FBI, businesses and schools were able to reopen, and health care and emergency services were able to come back online. The current status and capacity of AlphV’s operations are unclear.
• In a coordinated operation codenamed Operation HAECHI IV, law enforcement agencies from 34 countries arrested nearly 3,500 cybercriminals and seized about $300 million worth of digital assets. The six-month operation targeted seven types of scams, including voice phishing, romance scams, online sextortion, investment fraud, money laundering associated with illegal online gambling, business email compromise fraud, and e-commerce fraud.
• The NIST released two draft publications to guide entities aiming to shift their encryption schemes to ones designed to thwart attacks from a potential quantum computer. The documents, named Quantum Readiness: Cryptographic Discovery and Quantum Readiness: Testing Draft Standards for Interoperability and Performance, are open for public comment until Feb. 20, 2024. The first guide outlines a functional test plan for cryptographic tools to identify security configuration issues and offers use case scenarios for successful post-quantum system migrations. The second guide focuses on harmonizing quantum-resilient algorithms with existing network infrastructure and addresses compatibility issues in a controlled, non-production environment.

The Bad

Database misconfiguration mayhem continues. Blink Mobility and Real Estate Wealth Network left their unprotected databases open to the public, exposing the valuable data of their customers. Database provider MongoDB was also under fire after the data of its customers was stolen.

• Database provider MongoDB alerted customers to a data breach in which some customer account metadata and contact information were compromised. The incident was detected on December 13, following which the firm activated its incident response processes to mitigate it. The firm also warned its customers to activate MFA and be wary of phishing attempts that may use stolen data.

• Apparel giant VF Corporation reported a cyberattack that forced it to shut down its systems. In the filing, the firm disclosed that the attackers disrupted its business operations, encrypted some IT systems, and stole data, including personal information. Federal law enforcement was notified and is working with cybersecurity experts to investigate the incident.

• Bitdefender Labs researchers warned users of ‘get paid scams’ that make false promises of payments for liking videos on YouTube. The scam started with potential victims receiving a message from an unknown number and asking them to like the video or subscribe to a YouTube channel in exchange for money. The scams were primarily designed to target part-time job seekers looking for an opportunity to earn extra cash.

• Comcast Cable Communications, doing business as Xfinity, disclosed that attackers who breached one of its Citrix servers in October also gained unauthorized access to and extracted sensitive customer information from its systems. Previously, the firm revealed that the incident affected the data of about 36 million people. However, the latest review reveals that usernames and hashed passwords are also part of the stolen details.

• Iran confirmed a nationwide cyberattack that disrupted the operations of 70% of gas stations. An Israel-linked hacking group called Predatroy Sparrow claimed responsibility for the attacks while adding that it breached the central servers of gas stations, gaining access to specific station information, payment system details, and management systems.

• HCLTech disclosed the discovery of a ransomware incident within an isolated cloud environment associated with one of its projects. While an investigation is underway to understand the scope of the attack, the company currently has confirmed that the event has not caused a significant impact on the network.

• In an update, Austin-based ESO Solution revealed that the information of nearly three million people was affected in the October ransomware attack. The impacted data includes names, dates of birth, injury type, injury date, treatment date, treatment type, and, in some cases, Social Security numbers. The data was stolen from hospitals associated with ESO solution, including Mississippi Baptist Medical Center, Forrest General Hospital, Providence Alaska Medical Center, Manatee Memorial Hospital, and Desert View Hospital.

• Los Angeles-based electric car-sharing provider Blink Mobility left a misconfigured MongoDB database open to the public, exposing the personal data of more than 22,000 users. The database contained around 181,000 records that included phone numbers, email addresses, encrypted passwords, and registration dates of customers and administrators.

• An unprotected database with a size of 1.16 TB, leaked the real estate records of several people, including major celebrities. The database belonged to Real Estate Wealth Network and contained 1.5 billion records spanning from April 2022 to October 2023. It is unclear how long the database was exposed or who else may have accessed the data but researchers reported that user names, phone numbers, emails, and device information were among the leaked data.

• A phishing email pretending to be a copyright infringement complaint was found prompting users to resolve the issue by clicking on an appeal form. This redirected them to a phishing site impersonating Meta’s actual violation portal that asked them to share their username and password. After siphoning these details, the phishing site asks the target if their account is protected by 2FA and, upon confirmation, requests the 8-digit backup code. The ultimate goal of the attack is to steal the backup codes that can be used to hijack Instagram accounts.

• Scammers were found abusing a feature in X (formerly known as Twitter) to promote fake giveaway scams and fraudulent Telegram channels to steal cryptocurrency and NFTs from users. As part of it, the scammers took a URL for a tweet and modified the account name, while keeping the status ID unchanged, to trick users into believing that the tweet was from a legitimate organization. Some of the scam accounts were found to be mimicking cryptocurrency firms such as Binance, Ethereum Foundation, zkSync, and Chainlink.

• Australia’s largest not-for-profit health and aged care provider, St Vincent’s Health, fell victim to a cyberattack that impacted some of its data. An investigation is underway to understand the nature and scope of the attack. Meanwhile, the healthcare provider has confirmed that the ability to deliver services to patients, residents, and the broader community is not affected.

• A passwordless MongoDB database belonging to Goyzer was found leaking details of around 690,000 customers before it was secured. The exposed details included names, email addresses, phone numbers, and scanned copies of receipts, checks, contracts, and IDs. According to security researchers, the specific database was populated with data about customers from Dubai.

New Threats

New malware families with abilities to target cross-platform software were also observed in the wild. A new information stealer named JaskaGo was found targeting Windows and Apple macOS systems to steal victims’ information. Separately, a data wiper malware was used against Windows and Linux systems, under the pretext of a security update for a zero-day flaw. There’s also a report on the comeback of QakBot trojan.

• The QakBot trojan was observed in a new phishing campaign pretending to be an email from an IRS employee. The attack was first observed on December 11, targeting the hospitality industry. Attached to the email was a PDF file pretending to be a guest list, prompting recipients to download it to view it properly. However, clicking on the download button caused the execution of the malware on the system.
• A new Go-based information stealer named JaskaGo emerged in the threat landscape, targeting both Windows and Apple macOS systems. The malware is capable of harvesting information from the victim system, performing cryptocurrency theft, and stealing files and data from web browsers. It's currently not known how the malware is distributed.
• Researchers shared details of a new attack technique named SMTP Smuggling that can allow malicious actors to spoof millions of domains and bypass the SPF, DKIM, and DMARC email authentication mechanisms. The attack can be used to impersonate high-profile brands such as Microsoft, Amazon, PayPal, eBay, GitHub, Outlook, Office365, Tesla, and Mastercard.
• Malwarebytes researchers observed a new malvertising campaign that leveraged ads for Notepad++ and AnyDesk to distribute the MetaStealer malware. These fake ads were shown on Google searches for these software. According to the Google Ads Transparency Center, one of the campaigns ran in November and December. Users who clicked on the ad were redirected to a landing page that caused the download of the malware.
• NSFOCUS Research Labs discovered a new stealthy botnet, named xorbot, that uses multiple rounds of xor operations in encryption and decryption algorithms to evade detection. So far, two variants of the botnet have been observed, with the latest version using _libc_connect() and _libc_recv() series functions for communications. Although there is no built-in propagation module, the current version targets CPU architectures such as x86, MIPS, Renesas SH, and ARM.
• A new stealthy campaign was found using web injection attacks to steal the banking data of over 50,000 users associated with 40 banks across North America, South America, Europe, and Japan. As part of the campaign, attackers use compromised sites and distribute them via malvertising and phishing. Once the victim visits the malicious sites, the malicious obfuscated script is loaded on the victim's browser to modify webpage content, capture login credentials, and intercept one-time passcodes.
• The Israel National Cyber Directorate warned of a new phishing attack that deployed a new data wiper through emails pretending to be the security update for an F5 BIG-IP zero-day vulnerability. The data wiper is capable of wiping data from Windows and Linux systems through its two variants, Hamsa and Hatef, respectively. When launched, both the Windows and Linux versions attempt to impersonate a security update for F5 by displaying the company's logo on the screen. The commands are executed and received through a Telegram channel controlled by the attackers.
• McAfee shared details of a banking trojan, named Android/Banker.AFX, designed to steal victims’ banking account details. The trojan is distributed via WhatsApp messages, enticing users to install a seemingly legitimate app serving as a verification tool. Once installed, the trojan collects personal and financial data, intercepts SMS messages, and steals one-time passwords.
• A Russian agro-industrial enterprise and a state-owned research company were targeted in a new espionage campaign by the Cloud Atlas group. As part of the infection chain, the attackers sent their victims phishing emails with malicious attachments that deployed an exploit for CVE-2017-11882, a vulnerability affecting Microsoft Office. Successful exploitation of this bug allows attackers to execute arbitrary code with user privileges.
• An updated version of an Android banking malware called Chameleon has expanded its targeting to include users in the U.K and Italy. The new variant is delivered via Zombinder DaaS. It is capable of disabling fingerprint and face unlock authentication to steal device PINs by abusing Android’s Accessibility Service.
• The threat actor known as UAC-0099 has been found delivering a malware strain, named LONEPAGE, by exploiting a high-severity flaw in WinRAR. The attack was aimed at Ukrainian employees working for companies outside of Ukraine. LONEPAGE is a VBS malware capable of deploying additional payloads to record keystrokes, steal victims’ information, and capture screenshots.
• A never-seen-before backdoor called FalseFont was used in a campaign to target organizations in the defense industrial base sector. The malware comes with a wide range of functionalities that allow operators to remotely access an infected system, launch additional files, and send information to its C2 servers. The malware is believed to be a work of APT33 (aka Refined Kitten).