Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence - November 14–18

Cyware Weekly Threat Intelligence - November 14–18 - Featured Image

Weekly Threat Briefing Nov 18, 2022

The Good

With healthcare-related cyber incidents growing in scale and scope, preparedness before a cyber event has become an important aspect. Keeping this in mind, the FDA and MITRE have issued an updated version of the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook to help protect healthcare organizations. In another initiative, the Australian government announced the formation of a task force that would assist organizations in countering ransomware attacks.

  • The FDA and MITRE released an updated version of the ‘Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook.’ The playbook provides healthcare organizations with actionable strategies and resources to respond to cyber incidents, while ensuring the security of medical devices.

  • In a major crackdown, Ukraine police, along with Europol, dismantled an e-commerce fraud operation that affected 19 countries. Around 55 scammers were involved, who used stolen credit card information to order high-value goods from online shops.

  • The Australian government has announced the formation of a task force in an attempt to counter ransomware attacks. The government also plans to pass tougher privacy laws, early next year, that will include penalties for serious data breaches.

The Bad

Ahead of the holiday season, threat actors were found targeting online shoppers using a mixture of tricks. In one campaign, at least seven hacker groups infected Magento and Adobe Commerce websites with RATs to steal customers' information and credit card numbers. In another update, a sophisticated phishing kit was used to mimic several reputed brands and dupe users into believing that their logging on to legitimate websites. A widespread spear-phishing campaign targeting government, academic, philanthropy, and research sectors around the world was also reported this week. Believed to be the work of Mustang Panda APT, the ultimate goal of the campaign was to steal sensitive documents and information.

  • Security firm NCC Group reported that the month of October witnessed the highest number of DDoS attacks. The industrial sector, followed by healthcare and technology, were the most affected by these attacks.

  • About 38% of Magento and Adobe Commerce websites have been targeted in TrojanOrders attacks. The attack involves infecting the targeted site with RATs that steal customers' information and credit card numbers when purchasing products in the store.

  • A wave of spear-phishing attacks orchestrated by the Mustang Panda APT was used to target government, academic, foundations, and research sectors around the world. The infection routines led to the distribution of several malware payloads, such as TONEINS, TONESHELL, and PUBLOAD. The ultimate goal of the attackers was to steal sensitive documents and information, which could be used as entry vectors for the next wave of intrusions.

  • Kentucky-based CorrectCare Integrated Health, a medical claims processing firm, exposed the PHI of about 600,000 inmates who received medical care during the last decade. The breach occurred due to a misconfigured server that contained data that was almost a decade old.

  • Iranian state-backed actors exploited the Log4Shell vulnerability in a VMware system to compromise a federal agency. They exploited the vulnerability in an unpatched VMware Horizon server, installed XMRig crypto-mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence.

  • Public schools in two Michigan counties were forced to halt their operations after a ransomware attack. The schools notified law enforcement agencies and engaged cybersecurity advisors to investigate the incident. As a precautionary measure, the staff asked everyone to refrain from using any school-issued devices.

  • A sophisticated phishing kit was spotted preying on online shoppers looking for holiday specials. The campaign started in September and continued through October. The kit included several functionalities to impersonate reputed brands and evade detection.

  • The FBI issued an advisory against tech support scams, in which scammers impersonate support staff from software firms and trick users into giving up their bank account details. The scammers contact victims by phone calls or phishing emails and persuade them to renew the annual subscription service of antivirus that is about to expire.

  • The Russian scooter-sharing service Whoosh confirmed a data breach that affected the data of 7.2 million customers. Reportedly, the data was found being sold on hacker forums along with other sensitive information such as promotion codes and payment card details.

  • According to new findings, hundreds of databases on Amazon Relational Database Service (Amazon RDS) are exposing PII, including names, phone numbers, email addresses, marital status, dates of birth, car rental information, and even company logins. The reason behind the leaks stems from a feature called public RDS snapshots, which allows the creation of a backup of the entire database environment running in the cloud and can be accessed by all AWS accounts.

  • In the last few weeks, Mastodon gained popularity as a replacement for Twitter. But recently a vulnerability was discovered in Glitch, a fork of Mastodon, which could allow attackers to steal user credentials. Attackers can inject form elements and spoof a password form which, when combined with Chrome autofill, would allow them access to the credentials.

New Threats

New versions of several malware were spotted this week. While new variants of LodaRAT were found alongside RedLine and Neshta trojans in a series of attacks, a new avatar of RapperBot was used exclusively to launch DDoS attacks. Besides, a new crypto miner for hire named Typhon Stealer was found upgraded with abilities to steal crypto wallets, monitor keystrokes, and evade antivirus products.

  • Fortinet researchers found that a botnet called RapperBot has been repurposed to launch DDoS attacks. The botnet was first spotted in August and was used in brute-force attacks. According to the latest data, the botnet is being used to target gaming servers and is a continuation of similar attacks observed earlier this year.
  • The CISA, the FBI, and the HHS issued a joint advisory on the Hive ransomware. As of November, the ransomware actors have victimized over 1300 companies worldwide, receiving approximately $100 million in ransom payments.
  • Several new versions of the LodaRAT malware have been found to be deployed alongside RedLine and Neshta trojans in a series of attack campaigns. Significant upgrades include new functionality allowing proliferation via removable storage devices and a new string of encoding algorithms. The new implementations are likely to improve the speed of execution and evasion process.
  • A newly found ARCrypter ransomware has begun expanding its operations beyond Latin America. The ransomware operation claims to steal data during its attacks, however, it does not have a data leak site currently for publishing data for victims who didn’t pay the ransom.
  • From August to October, the DEV-0596 threat actors were observed delivering Royal ransomware via malicious links posing as legitimate installers for numerous applications, such as TeamViewer, Adobe Flash Player, Zoom, and AnyDesk. Previously, the attackers leveraged malvertising, fake forum pages, and blog comments to distribute malware.
  • Proofpoint shared a detailed write-up on the recent spam campaigns delivering Emotet trojan. The trojan made a comeback from its most recent hiatus, ceasing all its activities between June and November. The comeback involves a lot of international lures targeting users in different languages such as Greek, German, French, Italian, Japanese, and Spanish.
  • Palo Alto Networks’ Unit 42 researchers uncovered a new crypto miner for hire named Typhon Stealer. Shortly after, a new version of the malware was released. Both versions of the malware have the ability to steal crypto wallets, monitor keystrokes, and evade antivirus products.
  • Researchers discovered new malicious packages on PyPI, a package index for Python developers, infected with the WASP info-stealer. The malware is designed to steal credentials, personal information, and cryptocurrency. Moreover, the operator has been found selling copies of WASP to other attackers at $20 (to be paid in the form of cryptocurrency or gift cards).
  • A Chinese state-sponsored actor, tracked as Billbug (aka Thrip, Lotus Blossom, Spring Dragon), is associated with an attack campaign that has been ongoing since March. So far, the victims include a digital certificate authority, as well as government agencies and defense organizations in Asia.
  • North Korean hacking group Lazarus is using a new variant of the DTrack backdoor to target organizations in Europe and South America. The new variant conceals itself within legitimate-looking executable files to evade detection. Moreover, it uses three layers of encryption algorithms to make analysis difficult.
  • VMware witnessed a new malware loader, dubbed BatLoader, which compromised 43 systems in the last 90 days. The targeted organizations span the education, healthcare, IT, and retail sectors, among others.
  • A new attack method, dubbed PCspooF, affects Time-Triggered Ethernet (TTE), a networking technology used in safety-critical infrastructure. This attack is designed to break TTE's security guarantees and induce TTE devices to lose synchronization for up to a second, potentially causing the failure of time-sensitive systems powering spacecraft and aircraft.

Related Threat Briefings

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.