The Good

It has been a good week for cybersecurity. The future of quantum key distribution for secure cryptography is here as researchers from three organizations developed a novel technique that can fight against quantum computing attacks. In a welcome move, the U.S. Postal Service (USPS) is extending its Emergency Management System to bolster ransomware and breach response.

• Researchers from JPMorgan Chase, Ciena, and Toshiba developed a unique Quantum Key Distribution (QKD) network for metropolitans, which is resistant to quantum computing attacks. The QKD network sustains encryption of 800Gbps under real-world conditions and can rapidly identify and defend against quantum computing threats.

• Singapore to design a quantum-safe network to display crypto-agile connectivity and encourage trials with private and public firms. The initiative is driven by the Quantum Engineering Program (QEP) and includes a quantum security lab for vulnerability research. The project is supported by the National Research Foundation, along with 15 partners from both public and private sectors. The three-year program aims to conduct an extensive analysis of security systems and design guidelines to support organizations adopting quantum-safe technologies.

• The U.S. Postal Service announced to expand its Emergency Management System to include ransomware attacks and exploitation of computer vulnerabilities. The new project would put the professional and personal data of the employees and contractors into the federal information ecosystem.

The Bad

Coming to the noteworthy security incidents this week, Ukraine is undergoing a major cybersecurity crisis as several government websites were knocked offline due to a series of massive DDoS attacks. The SquirrelWaffle backdoor is back and is now abusing Microsoft Exchange Server bugs to perform financial fraud. A mysterious threat actor, TA2541, was found staying under the radar since 2017. It has been targeting the aviation sector via off-the-shelf malware.

• A new update on the cyberattack at the International Committee of the Red Cross (ICRC) revealed that the hackers had accessed the networks 70 days before the attack. They exploited a critical severity authentication bypass flaw, tracked as CVE-2021-40539, in Zoho’s ManageEngine AdSelfService Plus to breach the network. The attackers had impersonated legitimate users to hide their presence in the environment.

• A statement released by the CISA reveals that Russian state-sponsored operatives are targeting U.S. cleared defense contractor networks to obtain sensitive information. Some of these attacks have been ongoing for at least six months. According to the agency, threat actors are using tactics such as spear-phishing and brute-force attacks to breach networks.

• The FBI is warning about the rise in BEC scams against U.S. organizations and individuals. The agency shared that the scammers had lately turned to virtual meeting platforms to match the overall trend of businesses moving to remote work during the pandemic.

• A series of DDoS attacks knocked off several government and banking websites in Ukraine. This included the websites of the defense ministry, foreign and culture ministry, and the two largest state-owned banks - Privatbank and Sberbank. Meanwhile, the banks have managed to restore their operations and websites following the attacks.

• The Internet Society (ISOC) has inadvertently exposed the personal data of more than 80,000 members due to an unprotected Microsoft Azure cloud repository. The misconfigured repository contained millions of JSON files, including full names, email addresses, mailing addresses, and login details of members.

• SquirrelWaffle backdoor is targeting Microsoft Exchange servers vulnerable to ProxyLogon and ProxyShell vulnerabilities. While the malware initially targeted the servers to distribute Cobalt Strike beacons through hijacked email threads, researchers uncovered one email thread conversation that conducts financial fraud.

• The CISA has added a list of nine bugs to its Known Exploited Vulnerabilities catalog. Two of these are related to Chrome and Magento. The flaws are an improper input validation flaw in Adobe Commerce and a use-after-free vulnerability in Google Chrome.

• A low-lying threat actor tracked as TA2541 is believed to have been targeting entities in the aviation sector since 2017. The attacker used off-the-shelf malware and relied on malicious Microsoft Word documents to deliver trojans such as AsyncRAT, NetWire, WSH RAT, and Parallax. Most of the themes included transportation-related terms such as flight, aircraft, fuel, yacht, charter, etc.

• New South Wales Premier Dominic Perrottet has admitted a data leak due to a misconfigured NSW government website. This affected more than 500,000 addresses, including defense sites, a missile maintenance unit, and domestic violence shelters, among others.

• The U.S Federal Bureau of Investigation (FBI) has issued an advisory to warn about recent breaches involving the BlackByte ransomware group. The gang has targeted at least three critical infrastructure organizations in the U.S in the last three months. The advisory focuses on providing IoCs that organizations can use to detect and defend against BlackByte’s attacks.

• The San Francisco 49ers NFL team confirmed a ransomware attack that encrypted the files on its corporate IT network. The attack is the work of the BlackByte ransomware gang which also claimed responsibility by leaking some stolen files on its site. The firm added that it has taken mitigation steps to contain the attack and has also informed the law enforcement agencies.

• A New York-based fertility clinic, Extend Fertility, is notifying patients about a recent security breach that compromised their personal details. The incident was discovered on December 20, 2021, and the compromised data includes dates of birth, user names, dates of service, medical account number, medical history, and treatment information of patients.

New Threats

Ice ice everywhere and cybercriminals are grabbing chunks of it. Not actual ice but ice phishing - Microsoft discovered this new campaign targeting blockchain and web3. Multiple times a month. Horrendous! While we are on the topic of crypto, a new scam is targeting NFT buyers. One of the scams has been associated with the Babadeda crypter. The Iran-linked Moses Staff actor was found leveraging StrifeWater RAT. This previously undocumented malware comes with multiple functionalities.

• A newly found Goland-based Kraken botnet is under active development. Different from the one discovered in 2008, the botnet features an array of backdoor capabilities to pilfer sensitive information from compromised Windows hosts. It makes use of SmokeLoader to spread quickly, gaining control over hundreds of devices each time.
• Microsoft has warned about a new ice phishing attack that poses a threat to blockchain and Defi networks. This can enable threat actors to obtain private cryptographic keys to access digital wallets.
• A new phishing email attack campaign was found distributing the Emotet trojan. The campaign leveraged stolen email threads to bypass security systems. It included a zip file that resulted in the execution of Excel 4.0 macros.
• Threat actors are leveraging NFT-related information to lure users into downloading the BitRAT malware. The campaign makes use of malicious Excel files named ‘NFT_Items’ to attract targets. These files are hosted on the Discord app and appear to contain names of NFTs, forecasts for potential investment returns, and selling quantities.
• Researchers found a new version of MyloBot that includes several anti-debugging and anti-VM techniques. One of the techniques adopted by the botnet includes a process hollowing technique that allows attackers to replace the process’s code with the malicious one to evade detection.
• Researchers have hinted about the rise in crypto scams targeting NFT buyers. One such new scam has been associated with the Babadeda crypter, a new threat aimed at blockchain investors on the Discord app. Scammers are using malicious Discord bots operating with NFT and crypto communities to redirect users to phishing websites that prompt them to download fake desktop applications.
• In its attacks against Israeli firms, the alleged Iranian actor Moses Staff was found distributing previously undocumented StrifeWater RAT that emulates the Windows Calculator app to avoid detection.
• In a significant revelation, researchers found that numerous Windows machines located in South Korea have been targeted by the PseudoManuscrypt botnet since at least May 2021. The botnet employs the same tactics as CryptBot. It is distributed in the form of an installer or via cracked software.
• Researchers have tracked a new campaign in the wild that exploits the Log4j vulnerability. The campaign is linked with the Iran-based TunnelVision APT group and is being used to deploy ransomware on machines running vulnerable VMware Horizon instances.
• In January, researchers identified a scam, dubbed ‘FreeCryptoScam’, that targeted cryptocurrency users. The scam lured users into downloading Dark Crystal RAT by luring them into an offer of free cryptocurrency. The Dark Crystal RAT further downloaded Redline and TVRat for the further infection process.