Cyware Weekly Threat Intelligence - January 08–12

The Good

In the evolving tech landscape, it is imperative to understand and mitigate risks arising from AI technologies. A think tank has envisioned AI-related threats and compiled a list of cybersecurity recommendations for public and private organizations. In another aspect, the NCSC has issued a guideline for SMBs about how to use online services more securely.

• The NCSC-U.K released a guideline, named Using Online Services Safely, to help SMBs reduce the likelihood of cyberattacks when using cloud services. Some of the recommendations include having a backup for critical data and protecting admin accounts. The guidelines aim to protect organizations’ data, assets, and reputations from rising cybercrimes.
• Amidst the surge in the adoption of AI technologies across the globe, the Aspen Institute, in collaboration with Global Cybersecurity Working Groups, has released a list of cybersecurity recommendations for government and industries to mitigate the security risks related to AI. Some of these recommendations include ensuring rules of engagement, reviewing logs, and improving understanding of AI software.
• Cisco Talos, in collaboration with Dutch Police and Avast, successfully recovered a decryptor for files affected by a Babuk ransomware variant called Tortilla. The collaborative effort led to the identification, arrest, and prosecution of the Babuk Tortilla threat actor by Dutch Police. Users affected by Babuk ransomware can access the decryptor through NoMoreRansom or Avast.

The Bad

The healthcare sector suffered relentless breaches this week with HMG Healthcare and Midwives of Windsor Clinic disclosing their sensitive data being compromised. Apart from these, the Lutheran World Federation (LWF) and Swiss Air Force were targeted in different ransomware attacks.

• The LockBit ransomware group added Capital Health to its extortion website and threatened to leak 7TB of stolen data. The attack occurred in November 2023 and disrupted multiple facilities in New Jersey and Pennsylvania. Meanwhile, the organization notified law enforcement agencies and hired third-party forensic experts to investigate the incident as well as restore the affected systems.
• Halara, a popular clothing brand, initiated an investigation after the data of almost 950,000 customers was leaked on a hacking forum. Report suggests that a threat actor named 'Sanggiero' has leaked data, which includes one million unique address Ids, first names, last names, phone numbers, country, home addresses, and zip codes.
• loanDepot, one of the largest non-bank retail mortgage lenders in the U.S., suffered a cyberattack that led to the company taking IT systems offline. The attack affected the company's phone lines and online payment portal, preventing customers from accessing services. The company assured customers that recurring automatic payments would continue to be processed but advised using the contact center for new payments. The nature of the attack has not been disclosed yet.
• Bit24[.]cash, an over-the-counter crypto exchange in Iran, disclosed a data leak due to a misconfigured MinIO instance. Researchers discovered that the misconfiguration granted unauthorized access to S3 buckets containing the exchange's Know Your Customer data. Approximately 230,000 Iranian citizens were affected, with exposed data including written consent to regulations, passports, IDs, and credit cards.
• A data breach at the Midwives of Windsor clinic, in Canada, impacted patients’ sensitive information, including names, addresses, medical details, and insurance information. The breach occurred in April 2023. Concerns arose over the delayed notification, potentially allowing for identity theft or scams. While Midwives of Windsor claims no data misuse, affected patients are advised to remain vigilant for suspicious communications.
• Documents belonging to the Swiss Air Force were leaked on the dark web following a data breach at U.S. security company Ultra Intelligence & Communications. The breach, attributed to the BlackCat ransomware group, exposed approximately 30GB of sensitive data, including a $5 million contract between the Swiss Department of Defence and Ultra Intelligence & Communications for encrypted communication technology.
• The official Twitter accounts of Mandiant, Netgear, and Hyundai MEA were hijacked in a recent wave of attacks to promote cryptocurrency scams. The account of Mandiant was hacked to send phishing links to 123,5000 followers. In the case of Netgear and Hyundai, the attackers targeted over 160,000 followers with malicious tweets and links to fraudulent websites promising financial rewards.
• HMG Healthcare disclosed a data breach that affected 40 affiliated nursing facilities, exposing the PHI of residents and employees. The stolen information likely includes medical treatment information, SSNs, and more. An investigation revealed that threat actors gained unauthorized access to a company server and stole unencrypted files.
• Scammers were found impersonating security researchers to contact organizations that have fallen victim to ransomware attacks. The scammers offered to hack into the ransomware groups' servers to delete exfiltrated data for a fee. They used the names "Ethical Side Group" and "xanonymoux" and claimed proof of access to the stolen data. They threatened the organizations, insinuating they risk future attacks if the stolen data is not deleted.
• The Rhysida ransomware group reportedly targeted the Lutheran World Federation (LWF), a member of the World Council of Churches (WCC). WCC confirmed the ransomware attack on December 28, 2023, reporting that hackers demanded a ransom. The Rhysida group demanded 6 BTC (approximately $280,000) for the stolen information, within seven days before public release.
• Framework Computer disclosed a third-party data breach impacting the personal information of an undisclosed number of customers. The incident occurred after its accounting service provider, Keating Consulting Group, fell victim to a phishing attack on January 11. A threat actor impersonated Framework’s CEO and tricked an accountant of Keating Consulting Group into sharing a spreadsheet containing customers’ PII.
• Email addresses and other details of nearly 119,000 users associated with Liquipedia, an online e-sports platform, were exposed to the public due to a misconfigured MongoDB database. In addition to user information, administrator-level details, such as social media secrets, and private RSA keys, were also present in the “clients” collection.
• The Ministry of Foreign Affairs for the Kingdom of Saudi Arabia suffered a massive data breach that exposed the personal information of more than 1.4 million employees. The incident came to light after a threat actor named Zelda shared details of the data breach on a dark web forum, along with a 600MB file containing records of ID, GUID, Arabic names, display names, full names, associated departments, and job titles of employees.

New Threats

Coming to new threats, several malware families ringed in the new year with updated versions. Atomic Stealer was upgraded with payload encryption capabilities to bypass detections, whereas a new variant of the Mirai botnet was found compromising SSH servers for cryptomining. In other news, the CISA updated its KEV catalog by adding six new vulnerabilities that were under attack.

• FortiGuard Labs discovered an attack campaign involving the Lumma Stealer malware spreading through hijacked YouTube channels. Threat actors compromised YouTube accounts, uploaded videos disguised as legitimate cracked software, and redirected users to malicious URLs via installation guides. Unique to this campaign was the use of GitHub and MediaFire to evade traditional web filter blacklists.
• A new Python-based hacking called FBot was found targeting web servers, cloud services, CMS, and SaaS platforms such as AWS, Microsoft 365, PayPal, Sendgrid, and Twilio. The end goal of the tool is to hijack these services as well as harvest credentials to obtain initial access and monetize it by selling the access to other actors. Besides, the tool contains multiple utilities, such as an IP address generator and port scanner.
• Researchers identified a new attack campaign that exploited misconfigured Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. As part of the campaign, the attackers also leveraged packers and rootkits to conceal the malware. The misconfigurations can be exploited using a specially crafted HTTP request.
• Malwarebytes shared details of an updated version of Atomic Stealer (AMOS), indicating that threat actors behind the malware are actively enhancing its capabilities. According to researchers, the malware was updated with payload encryption capabilities in late December 2023 in an attempt to bypass detection rules. Moreover, the latest analysis revealed that the stealer malware is being sold in underground forums.
• A new Mirai-based botnet called NoaBot emerged in the threat landscape, targeting SSH servers for cryptomining. The botnet includes the self-propagation ability and targets Linux-based IoT devices. According to Akamai, the botnet has been used against more than different IP addresses in 2023, spread across the world.
• The CISA flagged six security vulnerabilities that were under attack and added them to its KEV catalog. These include two insecure deserialization vulnerabilities (CVE-2023-38203 and CVE-2023-29300) in Adobe ColdFusion, a code execution vulnerability (CVE-2023-41990) in multiple products from Apple, a command injection vulnerability (CVE-2016-20017) affecting D-Link DSL-2750B, and an improper access control vulnerability (CVE-2023-23752) in Joomla CMS.
• Around 150,000 websites are at risk of attacks following the discovery of two vulnerabilities impacting the POST SMTP Mailer WordPress plugin One of these flaws (CVE-2023-6875) is a critical authorization bypass flaw arising from a type-juggling issue on the connect-app REST endpoint. The second vulnerability is a cross-site scripting problem (CVE-2023-7027) that arises from insufficient input sanitization and output escaping.
• A threat actor known as Sea Turtle, with a Türkiye nexus, launched a series of cyberattacks targeting telecommunication, media, ISPs, IT service providers, and Kurdish websites in the Netherlands. The group aims to collect politically motivated information, including personal details of minority groups and potential political dissidents. The stolen information is likely to be used for surveillance and intelligence gathering.