The Good

Amidst the evolving cyber threat landscape and technological advancements, a robust cybersecurity workforce is essential to combat cybercriminals and their tactics effectively. In a major move, the U.S. introduces a new strategy focused on fostering diverse talent to pursue cybersecurity careers and meet the challenges of the digital age. Separately, the CISA, along with three other agencies, has been tasked to set a roadmap for implementing secured multi-cloud software technologies within federal networks by January 2025.

• The U.S. rolled out the National Cyber Workforce and Education Strategy (NCWES), aimed at addressing immediate and long-term cyber workforce challenges. The strategy follows the National Cybersecurity Strategy (NCS) issued in March and is divided into four parts. It equips every American with foundational cyber skills, transforming cyber education, enhancing the national cyber workforce, and strengthening the federal cyber workforce.

• A newly introduced Multi-Cloud Innovation and Advancement Act will require the GSA, the CISA, the NIST, and the USDS to craft guidelines to ensure data interoperability and security across multi-cloud systems used by federal agencies. The guidance will also include the step-by-step process of deploying multi-cloud technologies for applications, data, and programs, which agencies are required to implement by no later than January 1, 2025.

• A team of academics and researchers at Tohoku University, Ruhr University Bochum, and NTT Social Informatics Laboratories have developed a new standard to address the threat of cache side-channel attacks. Dubbed Secure CAche Randomization Function (SCARF), the technique is compatible with different computer architectures, bolstering widespread applicability and computer security.

The Bad

While cybersecurity capabilities keep improving, there were reports of financial and operational damages from across the globe due to cyberattacks. A leading marine parts manufacturer disclosed a loss of $85 million, owing to the downtime in a cyberattack. A series of DDoS attacks, which is underway, have impacted several Italian entities, including a water supply company, a national business newspaper, and a public transport website. Besides, vulnerable Citrix servers are being weaponized to deploy backdoors and target organizations in Germany, France, Switzerland, Italy, Sweden, Spain, and Austria.

• Brunswick Corporation, one of the leading marine parts manufacturers, suffered a financial loss of $85 million due to the downtime following a cyberattack. The incident affected its IT systems and other facilities, forcing the firm to partially halt its operations and businesses for almost nine days. No hacking group has claimed responsibility for the attack.

• Threat actors exploited a vulnerability in Vyper to steal millions of dollars in cryptocurrency from several platforms such as Ellipsis, Alchemix, and MetronomeDAO. The issue affects versions 0.2.15, 0.2.16, and 0.3.0 of the programming language. The investigation into the incident is ongoing.

• Tempur Sealy, one of the largest mattress sellers, is dealing with a cyberattack that forced it to shut down parts of its IT systems. While no ransomware gang or hacking group has taken credit for the attack, the company has notified law enforcement agencies. It is unclear where customer or employee information was compromised in the attack.

• There has been an increase in phishing activity abusing Google Accelerated Mobile Pages (AMP) to target employees. This enables threat actors to bypass email security measures and redirect recipients to malicious phishing sites mimicking well-known companies such as Microsoft. To make it more convincing, the attackers employed Cloudflare’s CAPTCHA services to trick automated analysis of the phishing pages by security bots.

• A fake Flipper Zero site promised free devices by misleading users to shady browser extensions, scam sites, and surveys. The main goal of scammers was to collect personal information, such as names, addresses, and email addresses, that can be used in other malicious activities.

• Over 640 Citrix servers impacted by a critical remote code execution vulnerability (CVE-2023-3519) are being used to deploy backdoors in ongoing attacks, revealed security experts. The largest number of impacted IP addresses are based in Germany, followed by France, Switzerland, Italy, Sweden, Spain, Japan, China, Austria, and Brazil.

• Microsoft identified Cozy Bear (aka APT29) using compromised Microsoft 365 tenants owned by small businesses and the Teams chat app to phish for credentials from government, IT, manufacturing, and media organizations. So far, 40 organizations across the U.S. and Europe have been hit in the campaign.

• Allegheny County in Pennsylvania announced falling victim to the MOVEit Transfer hack, enabling cybercriminals to gain unauthorized access to county files and personal information, such as driver’s license numbers and Social Security numbers, of 689,686 individuals. According to officials, the cybercriminals had access to county files on May 28-29.

• Italy’s cybersecurity agency identified a series of DDoS attacks against Italian banks, businesses, and government agencies. One of the impacted victims included Intesa Sanapaolo. Additionally, a water supply company, a national business newspaper, and a public transport website were impacted by the attacks. The attacks are ongoing and launched by a pro-Russian hacking group NoName057(16).

• Since June 2022, a Bangladeshi hacktivist group, Mysterious Team Bangladesh, has launched over 750 DDoS attacks against government, financial, and transportation entities in India and Israel. The group most often exploits an open-source administration tool called PHPMyAdmin and the WordPress website builder to launch attacks.

• Serco Inc, the American division of Serco Group, is another new victim of the MOVEit Transfer hacks, affecting the personal information of over 10,000 individuals. The personal information compromised in the attack includes any combination of the following: name, Social Security number, date of birth, home mailing address, and Serco and/or personal email address.

• A zero-day vulnerability in SalesForce’s email services and SMTP servers, dubbed PhishForce, was exploited to launch a phishing campaign against Facebook users. The flaw allowed attackers to bypass Salesforce’s sender verification safeguards and legacy quirks in Facebook’s web games platform.

• Travel giant Mondee inadvertently exposed more than 1.7TB of customers’ data due to a vulnerable database hosted on Oracle’s cloud. The exposed information included names, gender, dates of birth, home addresses, flight information, and passport numbers of customers.

New Threats

In new threats, the Meow attack has taken a concerning turn, now targeting vulnerable Jupyter Notebooks. The attackers are employing Python scripts to exploit databases, highlighting an unconventional approach. Additionally, there has been a notable surge in Ursnif activity, with the appearance of the new WikiLoader as a malware distribution method. Meanwhile, Russian hacker forums have been observed promoting a new hVNC malware tool that poses a significant threat to macOS systems.

• Researchers identified a new phishing campaign from December 2022 that distributed two new variants of NodeStealer malware. Written in Python, these variants are equipped with cryptocurrency stealing and downloader capabilities and can take full control over Facebook business accounts. They include several anti-analysis capabilities such as disabling Windows Defender to stay under the radar during the infection process.
• There has been an increase in SpyNote malware infections in recent months. The spyware is currently being used to perform bank frauds against European banking customers. The infection chain usually starts with a fake SMS message where the user is asked to install a new certified banking app. Once the app is installed,SpyNote abuses the Accessibility Services permission granted by the victim to collect GPS location, record private conversations, and capture keylogging activities.
• Iranian hacking group Bahamut was found using a fake Android app named SafeChat to infect devices with a variant of Coverlm spyware that steals data from communication apps such as Telegram, Signal, WhatsApp, Viber, and Facebook Messenger. The variant pilfers data such as call logs, text messages, and GPS locations from phones. The stolen data is encrypted using RSA, ECBm, and OAEPPadding algorithms before it is transmitted to C2 servers.
• Researchers exposed Space Pirates' activity by revealing that the attackers employed novel tactics and new cyber weapons to target 16 organizations in Russia and Serbia in 2022. While the main goals—espionage and theft of confidential information—remain the same, the group has expanded its focus to other countries. Targeted companies include government agencies, agricultural producers, aerospace manufacturers, defense, energy, and healthcare firms.
• According to researchers at Aquasec, the Meow attack campaign has been revamped to target misconfigured Jupyter notebooks. Interestingly, the attackers use Python scripts to target databases, maintaining an unusual modus operandi. While the infrastructure of the attackers is still under investigation, a total of 1,283 distinct IP addresses have been targeted by them.
• A new malware, called WikiLoader, has been discovered in at least eight campaigns targeting Italian organizations since December 2022. These campaigns leveraged emails containing either Microsoft Excel attachments, Microsoft OneNote attachments, or PDF attachments, causing the download of Ursnif as a follow-on payload. A majority of these campaigns have been linked to the TA544 APT group.
• A threat actor named RastaFarEye is advertising a new hvNC macOS malware on a Russian cybercrime forum for a price of $60,000. The malware is capable of providing persistent access to compromised systems and stealing sensitive information. It only works on macOS versions 10 to 13.2 and can run without user permission.
• Threat actors are leveraging a technique called versioning to bypass security checks on the Google Play Store and target Android users to steal their credentials, data, and financial information. The attack is achieved by pushing malicious code from an attacker-controlled server to an end user device, effectively turning the app into a backdoor.
• A new version of Rilide info-stealer is targeting Chromium-based web browsers to steal sensitive information and cryptocurrency from users. The updated version overlaps with a malware tracked as CookieGenesis, and includes modules for infecting Chrome Extension Manifest V3 and code obfuscation.