Cyware Weekly Threat Intelligence - November 08–12

The Good

The biggest news of the week comes in the form of law enforcement busting REvil. Five individuals were arrested on different charges related to REvil and millions of dollars of ransom payments were seized. In another such bold move, the U.S. Treasury announced sanctions on the Chatex cryptocurrency exchange for aiding and abetting ransom payments.

• Zero Networks open-sourced a ransomware kill switch software to offer better control over Microsoft’s Remote Procedure Call (RPC) protocol, which hinders the use of lateral movement hacker tools and blocks almost all ransomware. While this RPC Firewall may not be able to prevent all attacks, it can block lateral movement tools and stop network takeover.
• Police in Romania and South Korea have arrested five individuals linked with REvil ransomware. In addition to that, more than $6 million of ransom payments were seized. The arrests were built on an international investigation, dubbed GoldDust, which contained law enforcement agencies from 17 countries.
• The Chatex cryptocurrency exchange was sanctioned by the U.S. Treasury Department for assisting multiple ransomware gangs in soliciting and procuring illicit transactions. On examining Chatex’s transactions, almost half of them were linked to illegal activities.
• The Spanish police arrested 45 people, reportedly, associated with an online fraud group that operated 20 different fraudulent websites to defraud at least 200 people for $1.73 million. The threat actors offered various consumer electronic products at low prices on the fraudulent web portals. The investigation had started in July 2019.
• The Department of Veterans Affairs issued a new cybersecurity strategy to better safeguard the personal information of U.S. veterans and prevent the exploitation of critical data. The strategy also includes ways to protect information assets and systems, implement innovative policies to fortify the organization’s cybersecurity posture, and use risk management frameworks.

The Bad

No matter how much joy these developments have brought us this week, it is time to face the music. In a new wave of assaults, Cl0p ransomware has started making headlines by abusing an RCE flaw in a software made by SolarWinds. Ransomware gangs have become extremely sophisticated and relentless. After attacking thousands of systems of MediaMarkt, the Hive ransomware gang has demanded a whopping $240 million in ransom. This week, another DeFi platform fell victim to a crypto theft incident. The firm lost around $55 million worth of assets.

• Robinhood suffered a data breach on November 3 after attackers gained unauthorized access to a limited amount of personal information of around 7 million customers. The compromised data included Social Security numbers, bank account numbers, and debit card numbers. However, there has been no financial loss to any customers.
• The Cl0p ransomware gang has begun exploiting a SolarWinds Serv-U vulnerability to breach corporate networks. The flaw is tracked as CVE-2021-35211 and is associated with remote code execution. It affects only customers who have enabled the SSH feature.
• The TeamTNT group continues to target Docker servers exposing Docker REST APIs for cryptomining purposes, under the campaign that was set off in October. Compromised Docker Hub registry accounts, such as alpineos, belonging to the attackers were used to host malicious images.
• A Hive ransomware attack hobbled 3,100 servers of MediaMarkt firm and knocked its IT infrastructure offline in Germany and the Netherlands. The attackers encrypted servers and workstations and demanded $240 million in ransom. Online sales are functional, however, cash registers at affected stores are unable to accept credit cards or print receipts.
• BlackBerry discovered that actors behind MountLocker, Phobos, and the StrongPity APT are dependent on a common initial access broker, dubbed Zebra2104, for their malware campaigns. The broker has aided the gangs enter the networks of several companies in Turkey and Australia.
• In a series of attacks, Lyceum APT targeted ISPs and telecommunication operators in Israel, Tunisia, Morocco, and Saudi Arabia, as well as a ministry of foreign affairs in Africa. The threat actor launched multiple politically motivated attacks between July and October, with an active focus on cyberespionage. The initial attack vectors were credential stuffing and brute-force attacks.
• A hacker stole an estimated $55 million worth of cryptocurrency assets from a decentralized finance (DeFi) platform, bZx, by sending a phishing email to one of its employees. The email contained a malicious macro in a Word document and ran a script on the employee’s computer that compromised his mnemonic wallet phrase. The attacker stole two private keys used by bZx for its integration with Polygon and Binance Smart Chain (BSC) blockchains.
• In a supply chain attack targeting open-source software repositories, two popular NPM packages—with cumulative weekly downloads of nearly 22 million—were compromised with malicious code. The two libraries “coa,” a parser for command-line options and “rc,” a configuration loader were tampered with by an unidentified threat actor to add an identical password-stealing malware. Both packages were compromised at the same time, as stated by researchers.
• A hacker-for-hire group called Void Balaur has been stealing emails and confidential information for more than five years. The stolen data is sold by the threat actors for both financial and espionage goals. So far, the gang has targeted more than 3,500 organizations across all continents. The affected organizations are from the telecom, retail, financial, and healthcare sectors.
• Google TAG spotted significant watering hole attacks that targeted users visiting Hong Kong websites for a media outlet and prominent pro-democracy labor and political group. Conducted in August, the attacks were carried out by leveraging an XNU privilege escalation vulnerability (CVE-2021-30869) in macOS Catalina. While the researchers could not get the complete exploit chain, they found that a framework based on the Ironsquirrel browser exploit delivery chain.

New Threats

Is SquirrelWaffle going to be the new Emotet? Researchers say so, as akin to Emotet, SquirrelWaffle is being used to launch huge malspam campaigns. One of those campaigns was found deploying Qakbot. With courage running in their evil veins, hackers spoofed Proofpoint to lure targets into giving up their Office 365 and Gmail credentials. In other news, BazarBackdoor was revealed targeting Windows 10 in a new phishing campaign.

• SquirrelWaffle malware dropper has reappeared in a new malspam campaign that delivers Qakbot. SquirrelWaffle also infects targets via a malspam campaign and enables threat actors to gain an initial foothold onto victims’ network environments. Subsequently, this can result in further compromises or more malware deployment, depending on the way attackers want to monetize the attacks.
• New spyware called PhoneSpy has surfaced to infiltrate Android phones. Experts found 23 malicious apps disguised as legitimate ones to give attackers complete control over the targeted devices. The campaign has already claimed more than 1,000 victims in South Korea and gained access to the entire communications, services, and data on the victims’ devices.
• Unit 42 observed an attack campaign in which APT groups gained initial access to targeted organizations by exploiting a patched vulnerability, tracked as CVE-2021-40539, in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution. The malicious actors were observed deploying Godzilla webshell, NGLite Trojan, and KdcSponge Stealer, compromising at least nine entities across the defense, technology, healthcare, education, and energy industries in the attack campaign.
• Hackers impersonated the cybersecurity firm Proofpoint and used mortgage payments as a lure to trick unsuspecting users into revealing their Office 365 and Gmail credentials. The bad actors used social engineering, account takeover, brand impersonation, and duplicate existing workflows.
• MasterFred is a newly discovered Android trojan that makes use of false login overlays to Netflix, Instagram, Twitter, and bank users. The ultimate goal of the trojan is to steal credit card information. The malware is currently being used against Android users in Poland and Turkey. What makes MasterFred unique is that one of the malicious apps also bundles HTML overlays that exhibit the fake login forms and exfiltrate victims’ login details.
• BotenaGo is a newly found botnet that has more than 30 different exploits to target routers and IoT devices. It is written in Golang and is believed to be used by Mirai operators. The botnet is still under development. It builds a backdoor, waits for the target, and attacks it via port 19412.
• A new zero-day vulnerability disclosed in Palo Alto Networks GlobalProtect VPN can be abused to execute arbitrary code on affected devices. The flaw is tracked as CVE-2021-3064 and has a CVSS score of 9.8. It affects versions earlier than PAN-OS 8.1.17. The security bug stems from a buffer overflow that occurs while parsing user-supplied input.
• A new phishing campaign is disseminating the BazarBackdoor malware by abusing a feature in Windows 10 app. The malware can pilfer system data and has previously been associated with TrickBot. The spam emails were short and personalized, with proper social engineering elements. The spam attempted to lure targets via a fake complaint.