Cyware Weekly Threat Intelligence - January 30–03

Weekly Threat Briefing • Feb 3, 2023
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Feb 3, 2023
The U.S. government is leaving no stone unturned to protect critical infrastructures from the risk of cyber attacks. In the latest development, the CISA is establishing a new office to tackle supply chain security issues. The task force will be composed of the federal government and industry representatives from the Information and Communications Technology (ICT) sector. Meanwhile, Singapore and European Union have signed an agreement to drive collaboration across different digital platforms, including improving their cybersecurity standards.
Beware! Emails and SMS messages that convincingly look like communications from well-known brands are being sent to users in a widespread BEC campaign that is active since April 2021. Attributed to a newly found threat actor called Firebrick Ostrich, the campaign is primarily focused on organizations in the U.S. That’s not all. Another BEC campaign is underway that redirects users to a fraudulent Microsoft phishing page. In other news, a car retailer and a school in Guildford County in the U.K. were targets of separate ransomware attacks that impacted the sensitive information of individuals.
Proofpoint researchers uncovered a malicious OAuth app campaign that leveraged Microsoft's "verified publisher" status to meet some of its OAuth app distribution requirements. The victims mainly appear to be U.K.-based organizations and individuals, including marketing and financial personnel and high-profile users.
Users looking for password managers were targeted in a malvertising campaign that leveraged Google Ads. The users were redirected to fake sponsored sites exhibited on the top results in an attempt to steal their login credentials.
British car retailer Arnold Clark was targeted by the Play ransomware group that stole personal data such as names, contact details, dates of birth, vehicle information, and bank account details of customers. The investigation is ongoing to understand the precise extent and nature of the compromised data.
North Korean Lazarus hacking group has been associated with the new ‘No Pineapple!’ cyberespionage campaign that targeted organizations in research, healthcare, chemical engineering, energy, and defense sectors. The attackers stole around 100GB of data from one of the victims.
Google Fi informed its customers that their personal details were impacted by a data breach, which is believed to be connected to a recent leak at T-Mobile. The exposed data included phone numbers, SIM card serial numbers, account status, account activation data, and mobile service plan details.
A new DDoS-as-a-Service (DDoSaaS) platform named Passion was seen used in recent attacks targeting medical institutions in the United States and Europe. Although its origins are unknown, the operation has distinctive ties with Russian hacking groups, such as Killnet, Mirai, Venom, and Anonymous Russia.
The Vice Society ransomware group claimed to have stolen sensitive data from the Guildford County School, the U.K. Post attack, the gang posted several files containing sensitive information belonging to teachers and students. Meanwhile, the school is yet to determine the full extent of the attack.
The U.K-based Planet Ice suffered a data breach that exposed the personal details of over 240,000 customers. The breach occurred after hackers gained unauthorized access to its Ice Account system.
The LockBit ransomware gang claimed responsibility for the cyberattack on ION Group. On January 31, the firm disclosed the incident by revealing that the incident impacted ION Cleared Derivatives, a division of ION Markets.
More than 350 BEC campaigns impersonating 151 organizations have been identified since April 2021. These campaigns were launched by a financially motivated threat actor, called Firebrick Ostrich, who utilized 212 malicious domains in the process.
Trend Micro researchers also observed a BEC campaign that is believed to have been running since April 2022. Linked to the Water Dybbuk threat actor, the campaign used a malicious JavaScript attachment that redirected users to a fraudulent Microsoft phishing page.
A series of new data-wiping malware such as SwiftSlicer and Nikowiper came to light this week as researchers unveiled the recent activities of the Russia-based Sandworm APT group. Variants of several known malware threats also emerged, with one of them coming from the LockBit ransomware operators. Called LockBit Green, the ransomware is designed to target cloud-based services. Three new variants of the Prilex PoS malware were also found using sophisticated methods to steal credit card information.