Cyware Weekly Threat Intelligence - May 09–13

The Good

Several big strides were taken in the cybersecurity space this week. Cybersecurity authorities from various countries noticed an increase in cyberattacks targeting MSPs and published a joint cybersecurity advisory to help them overcome the same. As user security still remains a point of concern, Yahoo Japan Corporation implemented biometric authentication to the Android version of Yahoo!

• Researchers devised a tool called Cooper that identifies flaws in the fashion of how apps such as Microsoft Word and Adobe Acrobat process JavaScript. They reported 134 bugs in total.
• To improve users’ security, Yahoo Japan announced its plans to go passwordless to significantly reduce the damage to users in the event of unauthorized access.
• According to NCSC, it mitigated record-high internet scams in 2021 by interrupting 2.7 million attempted frauds, under its active cyberdefence programme.
• The NCSC has released updated guidance to cater to everyone—from small businesses to large enterprises—with tools to ensure appropriate cybersecurity measures for cloud-computing users.
• The NCSC-UK, ACSC, CCCS, NCSC-NZ, CISA, NSA, AND FBI issued a joint advisory that recommends actions MSPs and their customers should take to minimize the risks of falling prey to a cyber incident.

The Bad

Threat actors are more relentless than ever. Modern-day cyberattacks have become so taxing that they are forcing institutions to shut down. This is what happened with the 150-year-old Lincoln College as it suffered a ransomware attack in December 2021. In a similar vein, Conti ransomware brought about a state of emergency in Costa Rica. WordPress sites are once again under attack as a campaign has affected around 6,000 sites.

• The Oklahoma City Indian Clinic (OKCIC) has disclosed a data breach that exposed the personal details of nearly 40,000 individuals. The data compromised in the incident include full names, birth dates, medical records, physician information, phone numbers, social security numbers, and driver’s license numbers of customers.

• Researchers have come across an ongoing campaign responsible for injecting malicious scripts into compromised WordPress sites. The campaign leverages known vulnerabilities in WordPress themes and plugins. As per researchers, the campaign had affected nearly 6,000 websites in April alone.

• Microsoft revealed that it discovered over 35 unique ransomware families and 250 unique threat actors last year. Most of these ransomware leveraged Cobalt Strike and several legitimate enterprise tools ( AnyDesk, Splashtop, and Teamviewer) to gain initial access and persistence on networks. Upon gaining access, most of the attackers create new backdoor user accounts to proceed with the infection chain process.

• A data breach at a third-party service provider exposed the data of over 3.6 million South African users associated with the Dis-Chem retail giant. The compromised data includes the full names, email addresses, and phone numbers of users. The retail giant became aware of the incident on or about April 28.

• A web hosting provider, Opus Interactive, suffered a ransomware attack that compromised some voters’ data in Oregon. It is estimated that around 1,100 users’ data is impacted by the attack. As a part of a precautionary measure, the State’s office has urged the users to reset their passwords.

• A misconfigured database had exposed around 10GB of data comprising 21 million unique records in a Telegram group. The unprotected database contained the personal data of VPN users from SuperVPN, GeckoVPN, and ChatVPN.

• Researchers have observed a noticeable rise in the number of attacks that exploited the previously disclosed PrintNightmare flaw in Windows Print Spooler. In the last 12 months, cybercriminals had conducted approximately 65,000 attacks through the Windows Print Spooler application. Out of this, 31,000 were recorded in the first quarter of 2022.

• Lincoln College is on the brink of closure amid efforts to recover from a ransomware attack that occurred in December 2021. The 150-year-old college was hit by ransomware on December 19 and this affected its IT systems from recruitment, retention, and fundraising departments. The system outage lasted for one and a half months.

• Hackers hacked and defaced Russian TV to show pro-Ukrainian messages. Additionally, RuTube video streaming site announced that its site went offline after suffering a cyberattack. Visitors were shown a message stating that the ‘site is undergoing technical work.’ However, the service says that all user content and data remain untouched by the attackers.

• The recent Conti ransomware attack spurred a state of emergency in Costa Rica. Following the attack, the threat actors leaked the data that they claimed to have stolen in the breach. The incident has impacted the Ministry of Labor and Social Security, the Ministry of Science, Innovation, Technology and Telecommunications, and the National Meteorological Institute, among others.

• Several German organizations in the automotive sector were targeted in a month-long phishing campaign. The attacks were designed to deploy various types of info-stealing malware. The threat actors behind the operation registered multiple lookalike domains so that they can be used later to send phishing emails.

• Agricultural equipment giant AGCO was forced to halt its business operations after it fell victim to a ransomware attack last week. The firm is still investigating the extent of the attack. In parallel, it has begun the recovery process to reinstate the affected facilities and systems.

• CERT-UA has warned of phishing attacks that deploy an information-stealing malware called Jester Stealer on compromised systems. The phishing emails carry the subject line ‘chemical attack’ and contain a link to a macro-enabled Microsoft Excel file.

• Malware authors have been found selling a powerful trojan named DCRat on underground forums. The malware, which is still being redesigned, comes equipped with a variety of information-stealing abilities. It can steal usernames, passwords, credit card details, browser history, Telegram login credentials, Steam accounts, Discord tokens, and more.

• The Conti ransomware gang allegedly stole 9.41 GB of sensitive data from the Peru MOF – Dirección General de Inteligencia (DIGIMIN).

• Kaspersky researchers uncovered some Joker-laced trojanized apps on the Google Play Store, which are used for billing and SMS fraud while also stealing text messages, contact lists, and device information.

• The Drug Enforcement Administration is reportedly investigating an unauthorized network intrusion into an agency portal that is somehow linked with 16 different federal law enforcement databases.

• At Black Hat Asia, Kaspersky noted that SideWinder APT launched over 1,000 attacks in the last two years against military and law enforcement agencies in Bangladesh, Pakistan, and other South Asian nations.

New Threats

Iranian hackers are on the prowl, attempting to defeat their targets like one punch man. OilRig APT was found dropping the new Saitama backdoor in a new campaign against Jordan. Another lesser-known Iranian actor—Cobalt Mirage—was discovered launching new ransomware attacks in the U.S. FluBot is back with another campaign using SMS and MMS, warned NCSC-FI.

• A new password-stealing malware builder is being sold on the Discord platform by a user who goes by the name ‘Portu’. Security experts have observed the first Portu-inspired malware sample, dubbed KurayStealer, in the wild. It is being used to target Discord users. Besides, it makes use of webhooks to steal passwords, tokens, and IP addresses from 18 other apps.
• A new Linux malware, dubbed BPFdoor, has been identified targeting Linux and Solaris systems. The malware can bypass firewalls, making it an ideal tool for corporate espionage and persistent attacks. It uses a Berkeley Packet Filter sniffer to parse ICMP, UDP, and TCP packets. Researchers have detected BPFdoor activity on networks of organizations in the U.S., South Korea, Hong Kong, Turkey, India, Vietnam, and Myanmar.
• A new cybercrime service, named Eternity Project, has emerged on Telegram and dark web marketplaces. The malware toolkit offers a variety of malware such as an info-stealer, a coinminer, a clipper, ransomware, a worm, and a DDoS-based bot. According to researchers, low-skilled threat actors can leverage the service to build their own malware.
• OilRig APT group was sighted in a new attack campaign that targeted a government official from Jordan’s foreign ministry. The campaign leveraged phishing emails and malicious Excel documents to drop a new backdoor, named Saitama. The malware is written in .NET and uses the Base32 algorithm to encrypt data before sending it to C2 servers.
• Researchers have shared new details about a lesser-known COBALT MIRAGE threat actor group. The gang has been held responsible for launching ransomware attacks across the U.S. The ransomware used in the campaign are BitLocker and DiskCryptor.
• Finland’s National Cyber Security Center (NCSC-FI) has issued a warning about a new Flubot malware campaign that relies on SMS and MMS for distribution. The messages claim to contain fake links to voicemail, missed call notifications, or alerts about a transaction. Once the malware is executed, it accesses SMS data and phone calls and monitors notifications to snatch temporary authentication codes like OTP.
• Security researchers have uncovered a new exploit kit that is being widely deployed on vulnerable Microsoft Exchange servers. Named IceApple, the framework first appeared in late 2021 and is still under active development. According to researchers, threat actors are currently using the exploit kit to obtain initial access to the networks belonging to organizations in the technology, academic, and government sectors.
• A newly discovered Nerbian RAT leveraging COVID-19-themed messages to target organizations worldwide. Written in the Go language, the trojan uses significant anti-analysis and anti-reversing capabilities to conduct malicious activities. The first attack attempt distributing the malware was observed on April 26.
• New research reveals that the Bitter APT group has added a new malware to target government organizations in Bangladesh. The campaign has been active since August 2021 and leverages spoofed email addresses to trick victims. The phishing emails appear to come from government organizations in Pakistan.
• A new credit card stealing service, called Caramel, is growing in popularity. Operated by a Russian cybercrime organization named ‘CaramelCorp,’ the skimmer-as-a-service can allow any low-skilled threat actors to get started with financial fraud. The skimmer service is capable of stealing credit card details and sending them back to remote servers to be collected by threat actors.
• Researchers discovered a new campaign running an NFT scam via a series of YouTube videos. Cybercriminals would append malicious links in a video’s description that lead victims to download RedLine Stealer from a GitHub link.