Cyware Weekly Threat Intelligence - July 10–14

The Good

In a constantly evolving cyber threat environment, the White House dropped the long-awaited plan for executing the National Cybersecurity Strategy that aims to protect critical infrastructure and disrupt cyber operations against public and private sector organizations. Consisting of 69 key initiatives, the implementation of the strategy will be monitored by different agencies, including the CISA. Moving to another piece of good news, a new version of the CVSS standard is set to be a game-changer in the vulnerability assessment process for both private and public organizations.

• A new version of the Common Vulnerability Scoring System (CVSS 4.0), which solves the loopholes discovered in CVSS version 3.1, has been unveiled publicly by the Forum of Incident Response and Security Teams (FIRST). Some of the improvements include addition of new base metrics, a focus on OT/ICS/safety systems, and enhanced disclosure of impact metrics.
• The Office of the National Cyber Director unveiled a roadmap for national cyber security strategy, setting a deadline for 18 different government agencies to bolster and streamline their cybersecurity regulations. The strategy also includes 68 other initiatives that need to be monitored by different agencies, including the CISA. Some of these initiatives focus on expanding threat intelligence and security collaboration to better combat cybercrime.
• New regulations were proposed by the U.S. Federal Communications Commission to safeguard customer accounts from SIM switching and port-out scams. Under the proposed rules, wireless operators would have to deploy secure methods of user authentication before moving a SIM card to a new device or a phone number to a different network.
• A group of House and Senate members has proposed to reform the two-decade-old law governing federal agency information security under the Federal Information Security Modernization Act of 2023. Under the new proposal, coordination between the Office of Management and Budget, the CISA, the Office of the National Cyber Director, and other federal agencies and contractors, is required to coordinate in the event of a cyberattack.

The Bad

Amidst the positive strides, the cyber landscape also witnessed some devastating cyberattacks. To start with, operations and services in cities in North Carolina and Delaware came to a halt following a series of cyberattacks. The investigations are underway and respective officials are working on restoring the affected systems. The Norwegian Refugee Council (NRC) also notified a security incident that resulted in the compromise of personal information of some people.

• The Norwegian Refugee Council (NRC) came across a cyberattack targeting an online database that stores the personal information of project participants. The NRC immediately suspended the website to contain the attack and an investigation is underway. The attackers remain unknown.
• The Bangladeshi CIRT took immediate action to fix a government website that accidentally leaked the personal data of 50 million citizens. The leak occurred due to a vulnerability in the IT infrastructure of the country’s Birth and Death Registration Information System. The leaked data included names, phone numbers, birth certificates, and national ID numbers of citizens.
• The town of Cornelius, North Carolina, is dealing with a ransomware attack that occurred earlier this week. The attack has disrupted or delayed multiple services, including those delivered over the phone or those requiring staff to access files located on servers.
• Google security researchers discovered a Zimbra zero-day vulnerability that is being exploited in the wild. The vulnerability appears to be a cross-site scripting (XSS) bug impacting Zimbra Collaboration Suite 8.8.15. While a security update to address the flaw is awaited, users are advised to manually patch their installations.
• Researchers at Mandiant found a three-fold increase in malware attacks via USB drives to steal secrets in the first half of 2023, with two notable campaigns delivering Sogu and SnowyDrive malware across different organizations located in various countries.
• A threat actor stole $1.53 million worth of crypto assets from the Rodeo Finance DeFi platform. The attacker used an Oracle manipulation attack to steal over 810 Ethereum coins and later swapped 285 ETH for unshETH.
• Trustwave researchers observed a phishing campaign that abused Cloudflare's workers [.]dev and pages [.]dev domains. More than 3,000 phishing emails containing phishing URLs from these domains were used to trick users into opening scam sites.
• The Cl0p ransomware added 62 clients of EY to its leak site, including 3TB of critical information such as client folders, passport scans, visa scans, risk and asset management documents, contracts, and agreements. Air Canada, Altus, Amdocs, Constellation Software, Laurentian Bank of Canada, LendLease, Sierra Wireless, SSC Fraud Risk Assessment, and St. Mary's General Hospital Surgical Services Review are among the new victims affected in the massive MOVEit Transfer hack.
• Municipal services in Kent County, Delaware, were disrupted following a cyberattack. However, critical services such as 911 dispatch remained functional and the local officials worked together with other regional authorities to restore the disrupted services.

New Threats

Fileless malware attacks are back in the picture making their place in the headlines. Days after experts reported a 1400% YoY spike in fileless malware attacks, a new fileless threat named PyLoose was spotted disseminating XMRig miner into targeted systems. Talking of comebacks, LokiBot and Scarleteel actors were also detected in new campaigns. While LokiBot was exploiting two previously well-known vulnerabilities in Word documents, the Scarleteel 2.0 campaign expanded its attack scope to new cloud environments such as AWS Fargate.

• A new malware, called AVrecon, infected around 70,000 Linux-based routers to build a botnet. The attack has been active for more than two years, targeting devices across 20 countries. It primarily targeted routers running on MIPS, ARM, and MIPSEL architectures. Some evidence revealed that the infected machines were used to click on various Facebook and Google ads and to interact with Microsoft Outlook.
• A fake PoC for a recently discovered Linux kernel vulnerability (CVE-2023-35829) was discovered on GitHub, concealing a backdoor with a crafty persistence method. Three repositories were found hosting the fake PoC exploit, with two of them removed from GitHub and one still live. The backdoor malware came with a wide range of information-stealing capabilities.
• FortiGuard Labs recently came across a new LokiBot campaign that exploited a pair of well-known vulnerabilities in Microsoft Office. The campaign first came to light in May, while researchers were investigating two types of malicious Word documents. The flaws in question were two remote code execution vulnerabilities, tracked as CVE-2021-40444 and CVE-2022-30190.
• Researchers at Wiz detected a new fileless malware dubbed PyLoose that targets cloud workloads. Evidence showed that the malware was spotted in 200 different instances of cryptojacking attacks. It includes a compressed and encoded precompiled XMRig miner that is dropped directly into memory using a known Linux fileless technique.
• Sysdig researchers reported a sophisticated hacking operation, dubbed Scarleteel 2.0, targeting AWS Fargate environments. Threat actors exploited a minor mistake in AWS policy to gain control over a Fargate account. Some Jupyter Notebook containers deployed in a Kubernetes cluster have also been abused, allowing actors to proceed with different types of attacks to steal AWS credentials.
• Researchers observed a rising trend in the use of specialized Android OS device spoofing tools to defraud the users of online baking, advertising networks, and e-commerce portals, worldwide. One such tool, named Enclave Service, is gaining popularity among cybercriminals. These tools were also sold on several private Telegram and dark web forums.
• Cisco Talos discovered an undocumented malicious driver called RedDriver that targets Chinese-speaking users and hijacks browser traffic. The attack leveraged a malicious file named DNFClient, named after the popular game Dungeon Fighter Online in China. The attacks have not yet been attributed to any cybercrime group.
• A malicious campaign targeting government, military, and civilian entities in Ukraine and Poland was unfolded by researchers this week. Ukraine’s Computer Emergency Response Team (CERT-UA) attributed the campaign to GhostWriter operational activities, and claims it has been active from July 2022. The final payloads include Agent Tesla RAT, Cobalt Strike Beacon, and njRAT.