Cyware Weekly Threat Intelligence - November 14–18

The Good

With healthcare-related cyber incidents growing in scale and scope, preparedness before a cyber event has become an important aspect. Keeping this in mind, the FDA and MITRE have issued an updated version of the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook to help protect healthcare organizations. In another initiative, the Australian government announced the formation of a task force that would assist organizations in countering ransomware attacks.

• The FDA and MITRE released an updated version of the ‘Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook.’ The playbook provides healthcare organizations with actionable strategies and resources to respond to cyber incidents, while ensuring the security of medical devices.
• In a major crackdown, Ukraine police, along with Europol, dismantled an e-commerce fraud operation that affected 19 countries. Around 55 scammers were involved, who used stolen credit card information to order high-value goods from online shops.
• The Australian government has announced the formation of a task force in an attempt to counter ransomware attacks. The government also plans to pass tougher privacy laws, early next year, that will include penalties for serious data breaches.

The Bad

Ahead of the holiday season, threat actors were found targeting online shoppers using a mixture of tricks. In one campaign, at least seven hacker groups infected Magento and Adobe Commerce websites with RATs to steal customers' information and credit card numbers. In another update, a sophisticated phishing kit was used to mimic several reputed brands and dupe users into believing that their logging on to legitimate websites. A widespread spear-phishing campaign targeting government, academic, philanthropy, and research sectors around the world was also reported this week. Believed to be the work of Mustang Panda APT, the ultimate goal of the campaign was to steal sensitive documents and information.

• Security firm NCC Group reported that the month of October witnessed the highest number of DDoS attacks. The industrial sector, followed by healthcare and technology, were the most affected by these attacks.

• About 38% of Magento and Adobe Commerce websites have been targeted in TrojanOrders attacks. The attack involves infecting the targeted site with RATs that steal customers' information and credit card numbers when purchasing products in the store.

• A wave of spear-phishing attacks orchestrated by the Mustang Panda APT was used to target government, academic, foundations, and research sectors around the world. The infection routines led to the distribution of several malware payloads, such as TONEINS, TONESHELL, and PUBLOAD. The ultimate goal of the attackers was to steal sensitive documents and information, which could be used as entry vectors for the next wave of intrusions.

• Kentucky-based CorrectCare Integrated Health, a medical claims processing firm, exposed the PHI of about 600,000 inmates who received medical care during the last decade. The breach occurred due to a misconfigured server that contained data that was almost a decade old.

• Iranian state-backed actors exploited the Log4Shell vulnerability in a VMware system to compromise a federal agency. They exploited the vulnerability in an unpatched VMware Horizon server, installed XMRig crypto-mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence.

• Public schools in two Michigan counties were forced to halt their operations after a ransomware attack. The schools notified law enforcement agencies and engaged cybersecurity advisors to investigate the incident. As a precautionary measure, the staff asked everyone to refrain from using any school-issued devices.

• A sophisticated phishing kit was spotted preying on online shoppers looking for holiday specials. The campaign started in September and continued through October. The kit included several functionalities to impersonate reputed brands and evade detection.

• The FBI issued an advisory against tech support scams, in which scammers impersonate support staff from software firms and trick users into giving up their bank account details. The scammers contact victims by phone calls or phishing emails and persuade them to renew the annual subscription service of antivirus that is about to expire.

• The Russian scooter-sharing service Whoosh confirmed a data breach that affected the data of 7.2 million customers. Reportedly, the data was found being sold on hacker forums along with other sensitive information such as promotion codes and payment card details.

• According to new findings, hundreds of databases on Amazon Relational Database Service (Amazon RDS) are exposing PII, including names, phone numbers, email addresses, marital status, dates of birth, car rental information, and even company logins. The reason behind the leaks stems from a feature called public RDS snapshots, which allows the creation of a backup of the entire database environment running in the cloud and can be accessed by all AWS accounts.

• In the last few weeks, Mastodon gained popularity as a replacement for Twitter. But recently a vulnerability was discovered in Glitch, a fork of Mastodon, which could allow attackers to steal user credentials. Attackers can inject form elements and spoof a password form which, when combined with Chrome autofill, would allow them access to the credentials.

New Threats

New versions of several malware were spotted this week. While new variants of LodaRAT were found alongside RedLine and Neshta trojans in a series of attacks, a new avatar of RapperBot was used exclusively to launch DDoS attacks. Besides, a new crypto miner for hire named Typhon Stealer was found upgraded with abilities to steal crypto wallets, monitor keystrokes, and evade antivirus products.

• Fortinet researchers found that a botnet called RapperBot has been repurposed to launch DDoS attacks. The botnet was first spotted in August and was used in brute-force attacks. According to the latest data, the botnet is being used to target gaming servers and is a continuation of similar attacks observed earlier this year.
• The CISA, the FBI, and the HHS issued a joint advisory on the Hive ransomware. As of November, the ransomware actors have victimized over 1300 companies worldwide, receiving approximately $100 million in ransom payments.
• Several new versions of the LodaRAT malware have been found to be deployed alongside RedLine and Neshta trojans in a series of attack campaigns. Significant upgrades include new functionality allowing proliferation via removable storage devices and a new string of encoding algorithms. The new implementations are likely to improve the speed of execution and evasion process.
• A newly found ARCrypter ransomware has begun expanding its operations beyond Latin America. The ransomware operation claims to steal data during its attacks, however, it does not have a data leak site currently for publishing data for victims who didn’t pay the ransom.
• From August to October, the DEV-0596 threat actors were observed delivering Royal ransomware via malicious links posing as legitimate installers for numerous applications, such as TeamViewer, Adobe Flash Player, Zoom, and AnyDesk. Previously, the attackers leveraged malvertising, fake forum pages, and blog comments to distribute malware.
• Proofpoint shared a detailed write-up on the recent spam campaigns delivering Emotet trojan. The trojan made a comeback from its most recent hiatus, ceasing all its activities between June and November. The comeback involves a lot of international lures targeting users in different languages such as Greek, German, French, Italian, Japanese, and Spanish.
• Palo Alto Networks’ Unit 42 researchers uncovered a new crypto miner for hire named Typhon Stealer. Shortly after, a new version of the malware was released. Both versions of the malware have the ability to steal crypto wallets, monitor keystrokes, and evade antivirus products.
• Researchers discovered new malicious packages on PyPI, a package index for Python developers, infected with the WASP info-stealer. The malware is designed to steal credentials, personal information, and cryptocurrency. Moreover, the operator has been found selling copies of WASP to other attackers at $20 (to be paid in the form of cryptocurrency or gift cards).
• A Chinese state-sponsored actor, tracked as Billbug (aka Thrip, Lotus Blossom, Spring Dragon), is associated with an attack campaign that has been ongoing since March. So far, the victims include a digital certificate authority, as well as government agencies and defense organizations in Asia.
• North Korean hacking group Lazarus is using a new variant of the DTrack backdoor to target organizations in Europe and South America. The new variant conceals itself within legitimate-looking executable files to evade detection. Moreover, it uses three layers of encryption algorithms to make analysis difficult.
• VMware witnessed a new malware loader, dubbed BatLoader, which compromised 43 systems in the last 90 days. The targeted organizations span the education, healthcare, IT, and retail sectors, among others.
• A new attack method, dubbed PCspooF, affects Time-Triggered Ethernet (TTE), a networking technology used in safety-critical infrastructure. This attack is designed to break TTE's security guarantees and induce TTE devices to lose synchronization for up to a second, potentially causing the failure of time-sensitive systems powering spacecraft and aircraft.