Cyware Weekly Threat Intelligence - July 22–26

The Good

In a decisive strike against cybercrime, Meta has eradicated 63,000 Instagram accounts connected to the Nigerian cybercrime group known as Yahoo Boys. Furthermore, it has purged 1,300 Facebook accounts, 200 Pages, and 5,700 Groups that were disseminating scamming tips and materials. Along the same lines, international agencies collaborated to disrupt DigitalStress, a massive DDoS-for-hire service. The takedown was a part of Operation Power Off.

• Meta eliminated 63,000 Instagram accounts linked to a Nigerian cybercrime group known as Yahoo Boys. These accounts were involved in sextortion scams, including a network of 2,500 accounts targeting adult men in the U.S. Meta also deleted 1,300 Facebook accounts, 200 Pages, and 5,700 Groups that provided scamming tips and materials. The company has implemented measures to block scammers from creating new accounts.
• The French police and Europol are pushing out a disinfection solution to remove the PlugX malware from infected devices in France, Malta, Portugal, Croatia, Slovakia, and Austria. The operation is conducted by the Center for the Fight Against Digital Crime (C3N) of the National Gendarmerie with assistance from Sekoia. The ANSSI will individually notify victims in France about the cleanup process and how it affects them.
• The NCA, in collaboration with the FBI and PSNI, disrupted the DDoS-for-hire service DigitalStress. The authorities seized the service's domain and arrested one of its suspected administrators. The NCA has warned users that their data has been collected and will be analyzed to identify them. This action was part of Operation Power Off, an international effort to disrupt DDoS-for-hire services.

The Bad

In the ever-evolving battleground of cybersecurity, the LummaC2 info-stealer has emerged as a formidable threat, disseminated via SEO poisoning, search engine ads, and platforms like Steam, under the guise of illegal software and legitimate installers. In another front of cyber warfare, the Belarusian state-sponsored hacker group GhostWriter has unleashed PicassoLoader malware against Ukrainian organizations and local government agencies. Meanwhile, the FBI, CISA, NSA, and other agencies have issued a joint advisory warning of imminent cyberattacks on critical U.S. infrastructure by the North Korean Andariel group. This group is primarily focused on defense, aerospace, nuclear, and engineering sectors in the U.S., Japan, South Korea, and India.

• The LummaC2 info-stealer is actively distributed via SEO poisoning, search engine ads, and various platforms like Steam, posing as illegal programs and legitimate software installers. It has evolved in its execution methods, including using a DLL side-loading technique and abusing legitimate platforms like Steam to acquire C2 domains. The malware targets a wide range of programs for stealing information, including wallets, browsers, FTP clients, VPN programs, and more.
• A Belarusian state-sponsored hacker group known as GhostWriter targeted Ukrainian organizations and local government agencies with PicassoLoader malware. The group used phishing emails related to USAID's Hoverla project to infect victims and is suspected of being involved in cyber espionage, particularly focusing on Ukraine's financial, economic, and governance indicators. GhostWriter has a history of targeting Ukrainian entities, as well as allies of Kyiv such as Lithuania, Latvia, and Poland.
• The FBI, the CISA, the NSA, and others published a joint advisory, warning of cyberattacks on critical U.S. infrastructure by the North Korean Andariel group. The group, known as Andariel, Silent Chollima, Onyx Sleet, and Stonefly, is primarily targeting defense, aerospace, nuclear, and engineering organizations in the US, Japan, South Korea, and India. It is using ransomware attacks on U.S. healthcare entities to fund the campaign.The information that Andariel is pursuing includes data on heavy and light tanks, fighter aircraft, missiles, and missile defense systems, and more.
• The threat actor known as Stargazer Goblin developed a malware Distribution-as-a-Service (DaaS) on GitHub, using over 3,000 fake accounts to push information-stealing malware. This service, called Stargazers Ghost Network, distributes password-protected archives containing malware through GitHub repositories and compromised WordPress sites. The operation targets specific interests like cryptocurrency and gaming, using phishing templates to lure victims. The malware set includes RedLine, Lumma Stealer, Rhadamanthys, RisePro, and Atlantida Stealer.
• In a recent development, threat actors are targeting the 250 million players of the popular mobile game Hamster Kombat with malware. The game, which is not available on any official channels but Telegram, has become a breeding ground for cybercriminals due to its massive popularity. ESET has found a malicious APK distributed on Telegram that is named 'Hamster.apk', which is actually Ratel Android spyware. The spyware can steal sensitive data from the device, such as contacts, messages, call logs, and location data. The researchers also found fake Hamster Kombat apps on Windows that are distributed through various channels.
• Threat actors are exploiting the hype around the upcoming Grand Theft Auto VI release by creating malicious Facebook ads promising a GTA VI beta version for download. These ads are designed to lure unsuspecting gamers into downloading malware instead of a legitimate game. The malicious ads lead users to download a fake GTA VI installer, which is actually a form of FakeBat loader malware. FakeBat can, in turn, deploy next-stage malware like info-stealers and RATs.

New Threats

Threat actors have been exploiting unpatched vulnerabilities in ServiceNow, including a critical RCE flaw, to pilfer credentials from government agencies and private firms. These vulnerabilities, patched by ServiceNow on July 10, have been actively exploited for at least a week. Wiz flagged an ongoing campaign dubbed SeleniumGreed, which exploits publicly exposed Selenium Grid services for illicit cryptocurrency mining. Adding to the cyber woes, a new malware loader named Krampus has emerged on the dark web, gaining traction for its versatile capabilities and ease of use. Krampus can handle archive and PowerShell scripts, sideload crypto miners, and more.

• Threat actors are exploiting unpatched ServiceNow flaws, including a critical RCE vulnerability, to steal credentials from government agencies and private firms. The exploitation of these flaws, which ServiceNow patched on July 10, 2024, has been observed for at least a week, according to Resecurity. The flaws, CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, can be chained together for full database access, and attackers are using readily available exploits and network scanners to target the nearly 300,000 internet-exposed instances of ServiceNow.
• Wiz warned about an ongoing campaign that exploits internet-exposed Selenium Grid services for illicit cryptocurrency mining. The campaign, called SeleniumGreed, has been active since at least April 2023 and targets older versions of Selenium (3.141.59 and prior). The attack involves the threat actor targeting publicly exposed instances of Selenium Grid and making use of the WebDriver API to run Python code responsible for downloading and running an XMRig miner. Researchers identified more than 30,000 instances exposed to remote command execution, making it imperative that users take steps to close the misconfiguration.
• A threat actor announced the launch of a new malware loader, named Krampus, on the dark web. Krampus is gaining popularity owing to its versatile capabilities and ease of use. Its ability to handle archive and PowerShell scripts, sideload crypto miners, embed itself within archives, and install legitimate software makes it difficult to detect and mitigate using traditional security measures. One concerning aspect is that the file is unsigned and lacks encryption, making it harder to detect. Cybersecurity experts advise organizations to update their security protocols in order to combat such sophisticated threats.
• Researchers disclosed a privilege escalation vulnerability, named ConfusedFunction, in Google Cloud Platform's Cloud Functions service. This vulnerability allows an attacker to access other services and sensitive data by exploiting the Default Cloud Build Service Account's excessive permissions. Google has updated the default behavior to prevent misuse, but existing instances remain unaffected. This issue highlights the potential risks of software complexity and inter-service communication in cloud providers' services.
• A previously unseen malware called FrostyGoop was used in a cyberattack against a district energy company in Ukraine last winter. The attack targeted temperature controllers, disrupting the central heating system and leaving over 600 apartment buildings without heat for two days during sub-zero temperatures. FrostyGoop is able to disrupt industrial processes by altering values on ICS devices. The malware exploited the Modbus protocol to directly tamper with industrial control systems, posing a significant threat to OT environments globally.
• The espionage outfit Daggerfly updated its malware arsenal, releasing new versions in reaction to previously unknown varieties becoming public. A new iteration of the Macma macOS backdoor and a new malware family built on the MgBot modular malware framework have also been unveiled by the group. Recent iterations of Macma demonstrate continuous development; one has a new core module, while another has small enhancements to the functionality that already exists. More significant changes were also seen in the main module, which now included new logic to gather a file's system listing.
• ESET researchers discovered a zero-day exploit targeting Telegram for Android, called EvilVideo. This exploit allowed attackers to send malicious Android payloads disguised as video files in unpatched versions of Telegram. The exploit relied on tricking users into installing a malicious app disguised as a multimedia file. Telegram fixed the issue in version 10.14.5, and the exploit no longer works in patched versions. The threat actor also advertised an Android cryptor-as-a-service on the same underground forum. The exploit did not work on Telegram Web or Desktop clients.