Cyware Weekly Threat Intelligence - October 09–13

The Good

With an aim to reduce software supply chain attacks, the CISA, along with the FBI, the NSA, and the US Treasury, has issued an advisory on improving the security of open source software (OSS) used in operational technology (OT) and industrial control systems (ICS). Also, there’s an update on a new data privacy law issued by the California government. Named Delete Act, the law would allow Californians to request that their personal data be deleted from the servers of online companies.

• The CISA, the FBI, the NSA, and the US Treasury published a joint advisory on improving the security of Open Source Software (OSS) in Operational Technology (OT) and Industrial Control Systems (ICS). The advisory provides recommendations on supporting OSS development and maintenance, managing and patching vulnerabilities in OT/ICS organizations, and adopting the Cross-Sector Cybersecurity Performance Goals (CPGs) as a common framework for cybersecurity best practices.
• California Governor Gavin Newsom signed a bill into law that allows Californians to request that their personal data be deleted from the servers of online companies. Named Delete Act, the law is inspired by the EU’s GDPR regulation and tasks the Californian Privacy Protection Agency with creating a portal where users can ask data brokers to delete their information. The portal will be launched by January 1, 2026.
• Singapore's Infocomm Media Development Authority and the U.S. Federal Communications Commission (FCC) signed a memorandum to work together to combat online scams. As part of the effort, the two government agencies will involved in exchanging information and work with other regulators to deal with scams originating from messages and calls.

The Bad

PLAY ransomware group gained the limelight for adding seven new victim organizations right after it listed the names of six other organizations to its leak site in the last week. Meanwhile, the May MOVEit hack continues to grow bigger as the names of fresh victims come forward. In another update, a financial service provider in New York admitted to falling victim to a cyber incident that impacted over 80,000 U.S. customers. Besides this, a new wave of web skimming attacks was observed abusing 404 error pages to pilfer shoppers’ credit card details from multiple food and retail websites.

• In a new wave of web skimming attacks, multiple organizations in the food and retail industries were targeted by hiding malicious code within the 404 error page. The campaign was launched against e-commerce sites using Magento and WooCommerce platforms to steal sensitive financial information. Unlike previous Magecart attacks, this campaign exhibits advanced evasion techniques that have left many security experts puzzled.

• Volex, a cable manufacturer, faced a data breach after attackers gained unauthorized access to its systems. The firm is investigating the incident to understand the scope of the attack. Despite the incident, all sites remain operational and the firm continues to trade with customers and suppliers.

• Flagstar Bank disclosed that a data breach at a third-party service provider, Fiserv, affected the personal data of over 800,000 of its U.S. customers. Fiserv was compromised as part of the global Cl0p MOVEit Transfer data theft incident which impacted over 2,000 companies across the globe.

• PLAY ransomware group added seven new organizations to its list of victims. These victims include Hughes Gill Cochrane Tinetti, Saltire Energy, Centek Industries, NachtExpress Austria, WCM Europe, Starr Finley, and a Missouri-based organization. The latest addition comes a week after the group listed six new victims to its leak site.

• The Knight ransomware group claimed responsibility for cyberattacks on India’s National Health Mission. It shared screenshots of the attack on its darkweb leak site. It remains unclear as to what kind of data was compromised in the attack.

• The BianLian extortion group claimed responsibility for attacks on Air Canada by sharing screenshots of the stolen data on its leak site. The group added that it stole 210GB of data, which includes details about the company's technical and security challenges, SQL backups, personal information of employees, information of vendors and suppliers, confidential documents, and archives from company databases.

• Cryptocurrency trading platform 3Commas confirmed a security breach after hackers gained access to customer accounts and made unauthorized transactions. While the exact fund stolen in the incident is not known, the firm took prompt action to secure the compromised accounts.

• Simpson Manufacturing, a building materials provider, disclosed that parts of its business operations were disrupted following a cyberattack. As soon as it became aware of the malicious activity, the company took steps to take the systems offline. The company is taking further remediation steps and the business operations are temporarily halted.

• Researchers at Confense revealed that threat actors are abusing a LinkedIn feature named Smart Links to bypass security email gateways. They had seen this feature abused for the first time in September 2022 and again in a new campaign in July this year. The latest campaign redirected users to a phishing site that attempted to harvest their Microsoft credentials.

• A credential harvesting campaign targeted unpatched Citrix NetScaler instances to steal user credentials. The flaw, tracked as CVE-2023-3519, was abused to inject a PHP web shell, which eventually enabled attackers to fetch user credentials via a JavaScript file hosted on the attackers’ infrastructure.

• The District of Columbia Board of Elections (DCBOE) is investigating a data leak incident involving an unknown number of voter records. The incident came to light after RansomedVC claimed to access the information through the web server of Data Net, the hosting provider for D.C.’s election authority.

• Indian law enforcement is probing a massive scam that allowed cybercriminals to siphon off Rs 18,180 crore of funds. The fraud came to light after hackers allegedly hacked into the six-year-old Safexpay Technology Pvt Ltd (STPL’s) payment gateway and then transferred to hundreds of bank accounts.

New Threats

The battle between cyber defenders and threat actors continues to intensify with new and sophisticated threats emerging as a constant challenge. To begin with, Mirai-based botnet IZ1H9 added 13 new exploits to its arsenal to launch DDoS attacks on Wi-Fi routers and IoT devices. Along the same line, Google, in participation with Cloudflare and AWS, issued an advisory about the largest-ever DDoS attack dubbed Rapid Reset. In separate news, a previously undocumented threat actor named Grayling has been linked to a number of cyberattacks it pursued against manufacturing, IT, and biomedical - all were achieved by exploiting public-facing infrastructures.

• FortiGuard Labs uncovered a significant evolution in the IZ1H9 Mirai-based DDoS campaign, which involved the addition of 13 new exploit payloads. The exploits focus on targeting vulnerabilities in D-Link, Netis, Sunhillo SureLine, Geutebruck, Yealink Device Management, Zyxel, TP-Link Archer, Korenix JetWave, and TOTOLINK devices. A peak in the exploitation of these vulnerabilities was observed on September 6, with trigger counts reaching tens of thousands.
• A previously undocumented threat actor named Grayling was linked to several attacks targeting organizations in the manufacturing, IT, and biomedical sectors in Taiwan. Evidence revealed that the campaign was executed between February and May. The initial foothold to victim environments was achieved by exploiting public-facing infrastructures.
• Google, Cloudflare, and AWS released advisories to warn organizations about ‘Rapid Reset’ attacks. Threat actors were found exploiting a zero-day vulnerability (CVE-2023-44487) in the HTTP/2 protocol since August to launch the largest ever-seen DDoS attacks that reached a peak of 398 million requests per second.
• ASEC revealed that there has been an increase in the use of abnormal certificates to distribute malware such as LummaC2 infostealer and RecordBreaker. The attacks distributing LummaC2 later switched to downloading the configuration information from C2 to install additional malware like Amadey and Clipbanker.
• In a detailed report, ASEC shared details of a change in the distribution method of the ShellBot malware, which is installed on poorly managed Linux SSH servers. Although the overall flow remains the same, the download URL used by the threat actor has changed from a regular IP address to a hexadecimal value.
• Researchers uncovered a new cyberespionage campaign targeting the telecommunications industry and government organizations across Kazakhstan, Uzbekistan, Pakistan, and Vietnam. The campaign, named Stayin Alive, has been active since 2021 and leveraged spear-phishing emails and DLL side-loading to deliver malware loaders onto the victims’ systems. It is possibly the work of a Chinese threat actor called ToddyCat.
• The CISA updated its KEV database with five new vulnerabilities that are currently being exploited in the wild. The list includes the three zero-days from this week's Microsoft Patch Tuesday, a Cisco zero-day from last month, and an Adobe Reader bug that was patched back in January but is now being exploited.
• Checkmarx discovered a series of malicious libraries on the PyPI portal, all purporting to be the SDKs of various cloud service providers such as Alibaba Cloud, AWS, Tencent, and Telegram. The packages contained functional code but also included a hidden mechanism that stole any authentication tokens and credentials added by developers.
• Several threat actors, including known ones, have joined in on the Israel-Hamas conflict escalation. One of these hacking groups, called Predatroy Sparrow, has re-emerged to support the government. Other hacking groups tracked on the sight are Anonymous Sudan, Killnet, and Cyber Av3ngers.
• In a similar incident, Phylum researchers found malicious NuGet packages infecting developer systems with the SeroXen RAT. The package was released first on October 6 and since then has evolved to three versions, amassing over 100,000 downloads.
• Sophos revealed that threat actors named Reichsadler Cybercrime Group exploited a vulnerability (CVE-23023-40044) in WS-FTP servers in an attempt to deploy ransomware payloads onto the victims’ systems. The ransomware was created using a LockBit 3.0 builder. The vulnerability in question was fixed by Progress Software on September 27 and organizations are urged to upgrade the firmware to the latest version to stay safe.