Cyware Weekly Threat Intelligence - October 02–06

The Good

As part of the ongoing cyber initiatives sweeping across the federal government, the GSA, the DoD, and NASA proposed new information-sharing and incident-reporting requirements for federal contractors. One of these requirements includes the development and maintenance of SBOMs for all software used as part of a federal contract. Some prominent cybercrime takedowns have also been reported this week. One such operation dismantled a large cybercriminal network that had raked in $277 million worth of crypto assets from over 3,200 victims.

• As part of the upcoming revisions to the Federal Acquisition Regulation, the GSA, along with the DoD and NASA, proposed new information sharing and incident reporting requirements for federal contractors, necessitating the creation and maintenance of SBOMs for all software used as part of a federal contract. As part of the requirements, contractors will also need to provide access and collaborate with the CISA’s threat hunting and incident response initiatives. The new rules stem from the cybersecurity executive order issued by President Joe Biden in May 2021.
• Human Security dismantled the operations of PEACHPIT, a vast ad fraud botnet operated by the BADBOX threat actor. The purpose of the botnet was to secretly install apps on malware-infected devices that would show and play unwanted ads. At its peak, PEACHPIT was found communicating with more than 121,000 Android devices and more than 159,000 iOS devices a day.
• Thai law enforcement collaborated with Binance and the U.S. Homeland Security Investigation (HSI) to take down a large cybercriminal network responsible for major crypto scams. The authorities arrested five members of this group and seized $277 million worth of crypto assets stolen from over 3,200 victims.

The Bad

As we celebrate Cybersecurity Awareness Month, there’s a piece of warning for all those who are looking for jobs online. Scammers were found running multiple mass-scale recruitment scams to steal sensitive information and cryptocurrency from job seekers. There are new victim updates around the MOVEit data breach too; Sony and Arietis Health confirmed being targeted by the Cl0p ransomware. In another distressing news, many Fortune 1000 companies were found at risk of attacks as researchers identified nearly 100,000 internet-exposed Industrial Control Systems (ICSs).

• In a filing, Builders Mutual Insurance Co. mentioned that the personal data of around 64,761 individuals was affected in a hack that occurred in December 2022. The data belongs to customers and current and former employees of the firm.
• The DNA testing company 23andMe is investigating an incident involving the sale of its customers’ data on popular hacking forums. The database contains 20 million pieces of data, which also includes users’ personal information such as names, addresses, phone numbers, and dates of birth.
• Threat actors exploited an open-redirection vulnerability in the job search platform Indeed to carry out phishing attacks that redirected victims to phishing pages impersonating Microsoft. The phishing pages were created using the EvilProxy phishing kit to target senior executives across various industries, primarily in the banking, financial services, insurance, property management and real estate, and manufacturing sectors.
• Ransomware attackers weaponized a critical flaw (CVE-2023-42793) in JetBrains TeamCity build management and continuous integration servers to target multiple organizations. One of these attacks was traced to the Shadowserver threat group, which targeted nearly 1,300 unpatched TeamCity servers in the U.S.
• Arietis Health of Fort Meyers, Florida, announced a MOVEit data breach that potentially impacted patients’ personal data at NorthStar Anesthesia facilities. The billing services company was informed about the incident on May 31, following which, it took action to patch the unsecured MOVEit servers.
• Sony Interactive Entertainment notified about 6,800 current and former employees, and their family members, that their personal information was exposed in the MOVEit hack launched by the Cl0p ransomware group. According to the notice, the compromise occurred on May 28. A majority of the stolen data belongs to people in the U.S.
• A report on the global state of ICS security by BitSight revealed that nearly 100,000 ICS are exposed on the public internet, allowing attackers to probe them for vulnerabilities and launch attacks against organizations. These exposed systems belong to Fortune 1000 companies located across 96 countries and include sensors, actuators, switches, and building management systems, among others.
• A new scam operation, dubbed WebWyrm, designed to trick job seekers into parting with their cryptocurrency funds was uncovered this week. The operation, so far, has targeted more than 100,000 individuals across 50 countries by impersonating over 1,000 companies across 10 industries. It has already potentially netted the scammers over $100 million.
• In its latest attack spree, the PLAY ransomware group added six organizations, including ??Roof Management, Security Instrument Corp, Filtration Control Ltd, Cinépolis Cinemas, CHARMANT Group, and Stavanger Municipality, to its list of victims. While the exact intent remains unclear, the group has shared the names on its data leak site.
• A misconfigured database belonging to the B2B CRM provider Really Simply Systems exposed over three million records containing images, invoices, templates, and internal files of the firm. Among other documents, the database contained customers’ names, addresses, and CRM plan details.
• Cyble researchers discovered a phishing campaign, wherein threat actors were found using applications banned in Russia as lures to target users. The attack was carried out via phishing sites mimicking popular applications like ExpressVPN, WeChat, and Skype, all of which are restricted in Russia.
• NATO is investigating an alleged cyberattack affecting some unclassified websites. This comes after the SiegedSec hacking group claimed it stole 9GB of data, including more than 3,000 documents, from various NATO portals. In a series of posts on Telegram, the hacking group boasted of accessing data from Joint Advanced Distribution Learning, NATI Lesson Learned portal, Communities of Interest Cooperation portal, NATO Investment Division portal, and NATO Standardization Office.

New Threats

Meanwhile, the discovery of new sets of malicious packages on open-source platforms continued to add to the burgeoning supply chain threats. In one incident, around 272 malicious Python packages were used in a campaign to steal data and cryptocurrency from targeted systems. Separately, over three dozen npm packages were deployed by cybercriminals. Furthermore, a lesser-known LightSpy malware capable of pilfering payment details from WeChat Pay was discovered by researchers. Lastly, beware of widespread stream-jacking attacks that are gaining traction on YouTube.

• Over three dozen data-stealing packages designed to exfiltrate sensitive data from developers’ systems were discovered in the npm repository. Some of these packages leveraged a Discord webhook to exfiltrate sensitive data, while a few others were engineered to automatically download and execute a potentially malicious executable.
• In another incident, Checkmarx observed around 272 information-stealing Python packages, on open-source platforms, being used as part of a campaign since early April. The attack campaign has evolved over the months, with the package author implementing more anti-evasion techniques for stealing data and cryptocurrency from targeted systems.
• The LightSpy spyware has been found to be embedded with a set of 14 plugins that are responsible for private data exfiltration. Two of these plugins can enable attackers to record WeChat VoIP audio conversations and steal the payment history from WeChat Pay. The malware is attributed to the China-based APT41 group.
• Group-IB researchers detected a previously unknown Android trojan, named GoldDigger, targeting financial organizations in Vietnam. The trojan has been active since June and spreads via bogus apps on Google Play or fake websites mimicking over 51 Vietnamese financial apps, e-wallets, and crypto apps. The malware also features translations into additional languages, hinting at plans for expansion in Asia, Europe, and South America.
• Stream-jacking attacks have gained traction in recent months, with cybercriminals targeting high-profile YouTube channels to drive a large number of people to fraudulent schemes. Some of the impersonated public figures include the likes of Elon Musk and Changpeng Zhao. Attackers use their names and images to run bogus live streams on YouTube and mislead viewers with content that ultimately leads them to cryptocurrency scams designed to siphon their money.
• Mozilla issued a ransomware alert, advising users to download Thunderbird only from trusted websites. The alert came after researchers discovered a Snatch ransomware group campaign using fake software downloads to deliver its payload onto victims’ systems. Mozilla noted that it actively took down such malicious sites to protect users.
• The hackers behind Qakbot have been found delivering Cyclops ransomware and Remcos RAT, despite the fact the FBI took down its infrastructure, revealed Cisco Talos researchers. It is believed that people in Europe are targeted in the new campaign.
• Three variants derived from the Mirai botnet—named hailBot, kiraiBot, and catDDoS—have been spotted in the wild, targeting IoT devices. All these botnets are designed to launch a variety of DDoS attacks, including TCP flood attacks, UDP flood attacks, and ack_flood attacks. They are distributed via brute force attacks or by exploiting old vulnerabilities.
• A newly discovered DinodasRAT was used in a cyberespionage campaign targeting a governmental entity in Guyana. The malware was distributed via phishing emails containing a ZIP file and primarily revolving around Guyana politics to lure recipients. It is capable of exfiltrating sensitive information and executing malicious commands.