Cyware Weekly Threat Intelligence - November 22–26

The Good

Conti was hacked by security researchers! What can be a better opening to your Friday than this! They found a flaw in the gang’s payment portal and discovered the real IP addresses behind it. However, the operators yet remain unidentified. Talking about the good forces winning over the bad, five members allegedly belonging to the Phoenix group were caught by Ukrainian investigators.

• The Conti ransomware group suffered a security breach temporarily after researchers tracked down the real IP address of one of its most sensitive servers. This was possible by exploiting a vulnerability in the recovery servers that Conti used. As a result, researchers were able to gain access to the gang’s payment portal, the site used for negotiating ransom payments.
• Ukrainian investigators hunted down five members of the Phoenix group that would steal funds and data from victims by redirecting them to Apple and Samsung phishing sites. The gang also made profits by unlocking stolen and lost Apple gadgets and selling them via stores in Kyiv and Kharkiv.
• The U.K government introduced the Product Security and Telecommunications Infrastructure Bill that mandates smart device manufacturers and sellers to meet new cybersecurity standards. The bill would enable the government to force companies into being transparent about their actions regarding patching vulnerabilities, designing a better public reporting system for bugs, and blocking universal default passwords.
• New guidance was released by Health-ISAC to support healthcare providers in the process of adopting an identity-centered approach to data sharing. This is the fourth installment of the H-ISAC series that assists CISOs with an improved comprehension of such an approach in data sharing processes under the 21st Century Cures Act. In addition, providers would be able to execute robust identity solutions to keep electronic health info secure.

The Bad

Losing data doesn’t only impact an organization but its customers and stakeholders as well. A hard lesson was learned by the Cronin digital marketing agency as it leaked 92 million records, containing important data which can be used by threat actors for future attacks. As the holiday season has already approached, the FBI issued warnings against cybercriminals attempting to dupe shoppers of their sensitive information. The GoDaddy breach took an ugly turn as apart from exposing the data of 1.2 million customers, it also affected Managed WordPress service resellers.

• New Mexico-based True Health suffered a breach that affected the personal information of over 62,000 U.S. citizens. The incident occurred after attackers gained unauthorized access to the organization’s IT systems in October. The stolen documents may contain information such as policyholders’ names, Social Security numbers, dates of birth, home and email addresses, medical data, and insurance details.
• The Cronin digital marketing agency suffered a major data leak due to an unprotected database worth 26.43GB containing 92 million records. The exposed records include Google analytics data, internally logged client ad campaigns, keywords, session ID, client ID, and device data, among other key identifying information. Moreover, usernames, hashed passwords, and emails of internal Cronin employees can possibly be used for phishing attacks in the future or gaining access to restricted areas.
• The CISA and the FBI released joint alert warning businesses and critical infrastructure partners of cyber adversaries looking to disrupt their critical networks and systems. Another alert was released by the FBI ahead of Thanksgiving, warning shoppers against online scams. The IC3 recorded over $53 million in losses during the 2020 holiday shopping season.
• During an investigation, researchers from Palo Alto Networks found that cybercriminals have sped up the process of compromising poorly configured cloud services. Out of 320 honeypots set up by the researchers, malicious actors had compromised around 256 of the servers that included ones with RDP, SSH, SMB, and Postgres database services. One such attacker compromised 96% of the Postgres honeypots within 30 seconds.
• Fake giveaway scams leveraging the rising popularity of Shiba Inu virtual currency are making the rounds of the cyberworld via several YouTube channels and Telegram accounts. Reports state that the scammers have earned $239,000 worth of cryptocurrency since October 20. Besides this scam, they also used phishing links masquerading as the cryptocurrency wallet Trust to steal victims’ wallet information.
• GoDaddy has disclosed a data breach that exposed the data of 1.2 million customers. The incident occurred after attackers used compromised passwords to access the company’s Managed WordPress hosting environment. The attack is believed to have taken place on September 6. This breach has also impacted various Managed WordPress services resellers, including Media Temple, tsoHost, Domain Factory, Host Europe, Heart Internet, and 123Reg.
• The Cl0p ransomware gang claimed Asia Pacific-based Swire Pacific Offshore as its latest victim. The firm is located in Singapore and has revenues of $3 billion, making it a lucrative target for extortion. The gang has published screenshots of passports, employee personal details, folder lists, and sensitive company documents on its extortion site.
• GoDaddy has disclosed a data breach that exposed the data of 1.2 million customers. The incident occurred after attackers used compromised passwords to access the company’s Managed WordPress hosting environment. The attack is believed to have taken place on September 6. This breach has also impacted various Managed WordPress services resellers, including Media Temple, tsoHost, Domain Factory, Host Europe, Heart Internet, and 123Reg.
• North Korean state-backed hackers, dubbed Zinc, impersonated Samsung recruiters and sent fake job offers to employees at South Korean security firms offering anti-malware solutions. Google TAG researchers attributed the attacks to the same threat actors who targeted security researchers across Twitter and other social media networks in 2020 and all over 2021. The gang reportedly attempted to gain access to unreleased bugs and exploits.

New Threats

Furthermore, we were introduced to a new trojan, named Cynos, that hid in Huawei’s AppGallery and compromised 9.3 million Android users. Another cause of concern for security teams this week was the new Tardigrade malware targeting biomanufacturing facilities with no clear clue of the attackers' objectives. Let us also tell you about this malware loader called RATDispenser that deploys eight RAT families.

• Malware authors are targeting cryptocurrency enthusiasts using a new crypter dubbed Babadeda. The crypter has been active since May in multiple campaigns targeting crypto, NFT, and DeFi-related communities on Discord. It can bypass signature-based antivirus solutions.
• A newly discovered Iranian threat actor was found exploiting Microsoft MSHTML RCE bug (CVE-2021-40444) to propagate a PowerShell-based stealer dubbed PowerShortShell. The infostealer pilfers Google and Instagram credentials from Farsi-speaking targets. It is also used for Telegram surveillance and collecting system information from compromised devices, most of which are located in the U.S.
• The APT C-23 threat actor group, also known as FrozenCell, GnatSpy, and VAMP, upgraded its Android spyware with new anti-analysis features to stay under the radar. The new variant is distributed via apps that purport to install updates on the target’s phone, with names such as App Updates, System Apps updates, or Android Update Intelligence. Researchers surmise that these apps are sent via SMS.
• Dr.Web disclosed that Cynos mobile trojan, which disguises itself as games on Huawei’s AppGallery marketplace, infected at least 9.3 million Android devices to steal data. This new class of malware was found in 190 games—platformers, arcades, simulators, shooters, and strategies—on AppGallery.
• Researchers demonstrated a set of three new attacks, dubbed Printjack, that can be launched against printers. The attack includes turning printers into an army of botnets to launch DDoS attacks, impose a paper DoS state, and perform MiTM attacks. One of these attack types can be launched by exploiting CVE-2014-3741 RCE vulnerability affecting printers.
• BIO-ISAC warned of cyberattacks against biomanufacturing facilities. The campaign is launched using a new malware dubbed Tardigrade. It bears resemblance to Smoke Loader and is capable of downloading payloads, including ransomware, and manipulating files on compromised systems. Some researchers believe that the malware aims to sabotage the investigations linked with the COVID-19, as several nations are still undergoing the vaccination process.
• Threat actors have added two new malware delivery tactics in the latest version of BazarLoader. One of the methods involves the use of compromised software installers and the second one involves the use of an ISO file with LNK and DLL payloads. Most of the attacks were launched against U.S. targets.
• A new JavaScript malware loader named RATDispenser has been found distributing eight RATs as payloads in multiple stealthy attacks. The propagated RATs include STRRAT, AdWind, Formbook, WSHRAT, Remcos, Panda Stealer, Ratty, and GuLoader. The infection chain of the campaign begins with phishing emails sent to users.
• The SEC has warned of a new multi-channel vishing campaign that pilfers sensitive details from victims. Scammers pretend to be SEC staff members and attempt to trick victims through phone calls and voicemail messages. They ask the victims to take immediate action by providing their personal details while claiming that suspicious activities have been detected on their cryptocurrency accounts.