Cyware Weekly Threat Intelligence - May 12–16

The Good

Enhancing the security of devices is one of the most efficient ways to protect against cyber attacks. Keeping this in mind, the CISA issued two separate advisories to improve the security of BMCs and internet-exposed networked management interfaces. Moreover, the FCC is also in the process of establishing a data protection task force to address data privacy threats and SIM swapping attacks.

• The CISA, along with the NSA, published new guidelines to help organizations bolster the security of baseboard management controllers (BMCs). This comes in the wake of many organizations failing to take minimum actions to secure and maintain BMCs. This can enable malicious actors to employ tactics such as establishing beachhead with pre-boot execution potential.
• In a different advisory, the CISA urged federal agencies to safeguard devices using remote management protocols as an apparent uptick in attacks against misconfigured network gear was reported. This applies to devices like routers, switches, firewalls, and load balancers that can be abused by threat actors to gain unrestricted access to organization networks.
• The FCC will launch its first-ever privacy and data protection task force with an aim to address SIM swapping attacks and thwart threats concerning data privacy. The creation of the task force comes in the wake of the rising number of data protection issues faced by customers of U.S. telecom providers. The force will coordinate with the FCC and create authentication-related standards for carriers transferring a number to a new device or a new carrier.

The Bad

Despite the good developments, the widescale exploitation of a now patched zero-day flaw in MOVEit file transfer software has reportedly led to the compromise of networks of over 100 organizations. Shell, Ofcom, and the Minnesota Department of Education (MDE) were the target of these attacks. In other news, over 100 well-known brand names were used in a massive impersonation attack that was active since 2022. Some of the major targets included brands such as Nike, Puma, Clarks, Crocs, Caterpillar, Fila, and Vans.

• A misconfigured database containing the personal information of more than 8.8 million Zacks Investment Research users has been dumped on a hacking forum. The compromised information includes names, addresses, phone numbers, email addresses, usernames, and passwords stored as unsalted SHA-256 hashes. The oldest entry in the database dates back to May 2020.
• The Development Bank of Southern Africa suffered an Akira ransomware attack that encrypted servers, log files, and documents. The bank conducted an investigation and determined that business names, names of directors and shareholders, addresses, identification documents, contact information, and phone numbers were accessed by attackers.
• Hackers breached the computer network at a Scranton, Pennsylvania-based cardiology group and potentially obtained the private data of over 181,000 patients. The information exposed included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, and passport numbers.
• U.K.’s communication regulator Ofcom disclosed a data breach after Cl0p ransomware exploited the zero-day flaw (CVE-2023-34362) in MOVEit Transfer and accessed the infrastructure of the regulator. Among the other latest victims that are impacted by the exploitation of MOVEit zero-day flaw are the Illinois Department of Innovation & Technology (DoIT) and the Minnesota Department of Education (MDE). Top U.S. cybersecurity officials and Oil and gas giant Shell also confirmed being impacted by cyberattacks on the widely used MOVEit file transfer tool. Meanwhile, researchers have released a PoC exploit code for the flaw.
• A widespread brand impersonation scam campaign has been discovered targeting over 100 popular clothing, footwear, and apparel brands. The campaign has been active since 2022 and peaked between November 2022 and February 2023. Scammers have set up more than 3,000 domains impersonating major brands such as Nike, Puma, Clarks, Crocs, Caterpillar, Fila, and Vans. SEO poisoning tactic is used to dupe unsuspecting users.
• A large number of Discord and Twitter platforms, including Evomos, Pika Protocol, OpenAI CTO, and Orbiter Finance, were hacked to steal over $3 million in assets from almost 1,932 victims. The incident has been associated with a group called Pink Drainer that pulled off the act by impersonating journalists from well-known media outlets, such as Decrypto and Cointelegraph.
• A newly observed Rhysida ransomware gang leaked 30% of documents stolen from the network of the Chilean Army. So far, the group has already added eight victims to its leak site and has published all stolen files for five of them. It breached the targets’ networks via phishing attacks.
• North Korea created a fake version of South Korea’s largest internet portal, Naver, in a large-scale phishing attack to obtain the login credentials of users. Upon being made aware of it, Seoul’s National Intelligence Service (NIS) shut down the phishing website.

New Threats

Moving on to new threats, a new variant of ChromeLoader malicious extension has been found targeting users visiting warez and pirated movie sites. The campaign has been underway since March. In another threat campaign, the DoubleFinger malware loader was found deploying the GreetingGhoul stealer to target entities in Europe, the U.S., and Latin America. Researchers also shared details of a modular Pikabot trojan that is capable of executing a range of malicious commands onto victims’ systems.

• According to HP Wolf Security, the Shampoo ChromeLoader extension is being used in a new campaign that is active since March. It is distributed as malicious VBScripts masquerading as free movies, video games, or content hosted on illegal websites. The new variant includes many anti-debugging and anti-analysis techniques to make detection challenging.
• Threat actors were found creating fake accounts of security researchers on Twitter and GitHub to distribute malware disguised as zero-day exploit code for popular software such as WhatsApp, Chrome, Discord, and Microsoft Exchange. The campaign has been underway since May and is being used to target Windows and Linux systems.
• Researchers uncovered a new malware loader, dubbed DoubleFinger, deploying GreetingGhoul cryptocurrency stealer on victims’ machines. The multi-stage campaign appears to be primarily targeting entities in Europe, the U.S., and Latin America. In some cases, the malware loader was found deploying Remcos RAT alongside DoubleFinger using multiple evasion tactics, including steganography.
• A new Golang infostealer, known as Skuld, has been found compromising systems worldwide. The malware is capable of stealing sensitive data from victims. It also includes modules to steal cryptocurrency assets. To accomplish this task, the malware searches for data stored in applications such as Discord and web browsers.
• A newly discovered Pikabot trojan is capable of executing a range of malicious commands, including running arbitrary shellcode, DLLs, and distributing malicious tools such as Cobalt Strike. The trojan is modular in nature, comprising a loader and a core module. It shares similarities with the QakBot trojan.
• Researchers linked the recent attacks exploiting a zero-day vulnerability in a Barracuda Networks email security appliance to a cyberespionage group operating in China. The flaw, tracked as CVE-2023-2868, could lead to a remote command injection attack by sending a specially crafted TAR file as an attachment.
• A new version of the Android GravityRAT spyware was observed being distributed via trojanized versions of BingeChat and Chatico apps. The malware came with two new capabilities such as receiving commands to delete files and exfiltrating WhatsApp backup files. The campaign was attributed to the group named SpaceCobra.
• Microsoft Threat Intelligence shared details of a novel threat actor called Cadet Blizzard, which is associated with the Russian General Staff Main Intelligence Directorate (GRU). The prolific threat actor targets government organizations and IT providers in Ukraine, with some places in Europe and Latin America.
• A phishing campaign leveraged a fake website hosting an Enlisted game installer containing a ransomware that impersonates the infamous WannaCry ransomware (although it is not a genuine variant of WannaCry). Named WannaCry 3.0, the ransomware used the .wncry file extension to encrypt files.
• A third flaw impacting MOVEit Transfer software came to light as the Cl0p ransomware gang exploited the recently patched zero-day flaw in the software to target several companies. The flaw is associated with an SQL injection vulnerability and can lead to escalated privileges and unauthorized access to the environment.
• The Russian Shuckworm (aka Gamaredon) espionage group is continuously mounting cyberattacks against Ukraine, with organizations in security services, military, and government sectors being the latest victims. In a bid to evade detection, the group has repeatedly updated its toolset and rolled out new versions of known tools and short-lived infrastructure.