Cyware Weekly Threat Intelligence, January 06–10, 2025

The Good

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes.

• The U.K government announced a new scheme called "Cyber Local" to enhance the nation's cyber resilience. It involves £1.9 million ($2.3 million) in funding for 30 projects across England and Northern Ireland, aiming to address cyber skills shortages and protect the digital economy. The initiatives will focus on bolstering local business resilience, promoting cybersecurity careers for young people, supporting neurodiverse talent, and upskilling small business workers. Additionally, a project in the West Midlands aims to protect women and girls from cyber-related violence. 
• The White House launched the "U.S. Cyber Trust Mark," a voluntary cybersecurity labeling program for internet-connected devices. Administered by the FCC, the program aims to help American consumers make informed decisions about the cybersecurity of products they bring into their homes, such as baby monitors and security systems. The program involves testing products against cybersecurity criteria and awarding a distinct label to those that meet the standards.
• The Indian government released a draft Digital Personal Data Protection Rules, aiming to give citizens greater control over their personal data. The rules require companies to provide clear information on data processing, implement security measures, and comply with various provisions, including breach reporting and data erasure. There are also guidelines for processing data of children and persons with disabilities, as well as requirements for cross-border data transfers. Violations can result in substantial penalties. 

The Bad

China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner.

• Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia have been targeted by a China-linked threat actor called RedDelta to deliver a modified version of the PlugX backdoor between July 2023 and December 2024. RedDelta reportedly compromised the Mongolian Ministry of Defense in August 2024 and the Communist Party of Vietnam in November 2024. They also targeted victims in Malaysia, Japan, the U.S., Ethiopia, Brazil, Australia, and India from September to December 2024. Known for refining its infection methods, RedDelta has used Windows files as part of spear-phishing attacks to deploy PlugX through various techniques.
• Threat actors have developed a fake PoC exploit targeting a critical Microsoft vulnerability to trick security researchers into downloading information stealing malware. This fake PoC is linked to a vulnerability in Microsoft’s Windows LDAP, which was patched in December 2024. Attackers created a malicious repository hosting the fake PoC, which, when run, drops a PowerShell script that creates a Scheduled Job, collects computer information, and uploads data to an external FTP server.
• CrowdStrike has detected a phishing campaign impersonating the company with fake job offer emails. The emails direct targets to download a fake "employee CRM application" from a malicious website designed to look like CrowdStrike's portal. If the target passes sandbox checks, the application tricks them into installing a Monero cryptocurrency miner. The miner runs in the background to avoid detection, and persistence is achieved through a startup script and registry entry.
• Socket discovered malicious npm packages designed to steal Solana private keys and transfer them via Gmail. The packages masquerade as legitimate tools to avoid detection, but actually function as malware. Two threat actors are involved in this scheme, using overlapping tactics to steal and exfiltrate private keys, while also draining victims' Solana wallets. The attackers use Gmail to send the stolen keys, making it harder to detect the exfiltration attempts. They also published malicious code on GitHub repositories to amplify their malware campaign.
• The CISA added three vulnerabilities affecting Mitel MiCollab and Oracle WebLogic Server to its KEV catalog, noting evidence of active exploitation. The vulnerabilities include CVE-2024-41713 (CVSS score: 9.1), allowing unauthorized access to Mitel MiCollab and CVE-2024-55550 (CVSS score: 4.4), enabling authenticated administrators to read local files. CVE-2020-2883 (CVSS score: 9.8) could be exploited by unauthenticated attackers on Oracle WebLogic Server. Federal agencies must apply necessary updates by January 28.
• Researchers at Socket have found malicious campaigns using Out-of-Band Application Security Testing (OAST) techniques. While OAST is meant for ethical hackers to find vulnerabilities, it is now exploited by threat actors to steal sensitive data and set up C2 channels. OAST tools like Burp Collaborator and interact.sh are being misused for malicious purposes. Socket's report mentions threats involving JavaScript, Python, and Ruby packages that send data to attacker-controlled sites.

New Threats

A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection. 

• A new Mirai-based botnet, named Gayfemboy, has become more advanced, using zero-day exploits for security flaws in industrial routers and smart home devices. One notable vulnerability is CVE-2024-12856, found in Four-Faith industrial routers, with exploitation efforts spotted around December 20. It has about 15,000 active bot nodes daily, primarily in countries like China, the U.S., Russia, Turkey, and Iran. The botnet's main aim is to carry out distributed DDoS attacks for profit, with activity spiking in October and November 2024. The botnet leverages a mix of public and private exploits for over 20 vulnerabilities and is capable of high-intensity DDoS attacks exceeding 100 Gbps.
• A sophisticated social engineering scheme is targeting customers in the Middle East, where fraudsters impersonate government officials to gain trust and use remote access software to steal credit card details. The victims are typically individuals who have lodged complaints with the government about unsatisfactory purchases. The fraudsters exploit this by posing as government representatives offering assistance with the complaints and then tricking victims into installing remote access software. Once the software is installed, the fraudsters steal credit card information and intercept OTPs to make fraudulent transactions. The scheme involves the use of RedLine Stealer malware to acquire victims' personal data.
• Cybercriminals have been found using a new WordPress plugin called PhishWP to create fake payment pages resembling trusted services like Stripe. The plugin tricks users into entering their payment details, including one-time passwords, and then sends the stolen information to attackers, often in real time. PhishWP also sends fake confirmation emails to victims to delay detection. It offers a range of advanced features, such as customizable checkout pages, 3DS code harvesting, real-time data transfer, browser profiling, fake confirmation emails, multi-language support, and obfuscation options.
• BARWM is a new backdoor attack method for deep learning models used in mobile devices. It utilizes DNN-based steganography to create imperceptible and unique triggers for each input, enhancing the stealthiness of the attack. The approach outperforms existing methods in terms of attack success rate and stealthiness, while maintaining normal model performance.
• A new online scam is targeting people through direct messages on Discord, asking if they would like to beta test a new videogame. The message often pretends to come from the game's developer. If someone shows interest, they receive a download link and a password for an installer. Various types of installers, like NSIS and MSI, are used to spread different malware, including the Nova Stealer, Ageo Stealer, and Hexon Stealer.
• The Fancy Product Designer plugin for WordPress is vulnerable to two critical security flaws. CVE-2024-51919 allows unauthenticated users to upload harmful files due to insecure file upload functions. CVE-2024-51818 is an SQL injection issue from improper user input handling that can compromise databases. Despite being notified about the issues, Radykal has not responded or released a security update, leaving over 20,000 users at risk.
• The Illumina iSeq 100 DNA sequencing instrument has been found to have firmware security vulnerabilities, allowing potential attackers to brick the device or plant persistent malware. The outdated BIOS firmware lacks standard protections such as Secure Boot, making it susceptible to malicious firmware modifications. Illumina has released a fix after responsible disclosure.