Cyware Weekly Threat Intelligence - October 23–27

The Good

Modern healthcare is heavily reliant on digital services and technologies to store and analyze patient data, which eventually increases their attack surface. In an effort to reduce the likelihood of attacks and prevent the theft of sensitive data, the CISA, along with the HHS and HSCC, released new cybersecurity resources for the healthcare sector. In another initiative, the agency is working on revising the 2016 National Cyber Incident Response Plan (NICRP) that can be actively used by every organization involved in cyber incidents.

• The CISA, along with the HHS and HSCC, has published a new set of resources for the healthcare and public health sectors to improve their security posture. The resources include guidance and provide information on freely available cybersecurity services and tools to reduce the likelihood of cyber intrusions and prevent the theft of personal and medical information of patients.
• The CISA is working with industry stakeholders and the Office of the National Cyber Director (ONCD) on a new version of the National Cyber Incident Response Plan (NCIRP) to address evolving threats. Built on four principles that include unification, shared responsibility, learning from the past, and keeping pace with evolutions, the plan will aim for a more effective response and better recovery process from cyber incidents.
• The Transportation Security Administration (TSA) announced updates to three security directives regulating passenger and freight railroad carriers in the continued effort to strengthen the industry’s defenses against cyberattacks. The revised directive required owners and operators to submit an annual Cybersecurity Assessment Plan to TSA, test two objectives in their Cybersecurity Incident Response Plan, and provide cybersecurity training to employees.
• Spanish law enforcement dismantled a cybercrime group that made around $3.2 million in illegal profits from various online scams conducted via email, SMS, and phone calls. The scammers pretended to be from banks and electricity companies and contacted victims to trick them into visiting fake sites that captured their credentials.

The Bad

Meanwhile, the list of companies impacted by the MOVEit mass data breach continues to grow as new victims emerge. This week, the Bank of Canton and CCleaner confirmed being impacted by the attack, with the former revealing that the personal information of approximately 9,500 customers was exposed during the breach. In other potential data breaches, a threat actor was found offering 1.2 million Airbnb user records for sale on dark web forums. Separately, the University of Michigan disclosed that the records of around 230,000 students, applicants, and employees were stolen in the August cyberattack.

• A cyberattack on shared IT service provider TransForm impacted operations and delayed patient appointments for five hospitals in Ontario, Canada. The five impacted hospitals were Windsor Regional Hospital, Hotel Dieu Grace, Erie Shores Healthcare, Hospice of Windsor-Essex, and Chatham-Kent Health Alliance. Investigations are underway to understand the cause and scope of the incident.

• An unsecured database containing over half a million records associated with vehicle seizures by the Irish National Police, An Garda Síochána, was leaked online. The records dated back to 2017 and included scanned identity documents, insurance investigation inquiries, and certificates of vehicle registration.

• In an update on the August cyberattack, the University of Michigan informed that threat actors stole sensitive personal information belonging to around 230,000 students, applicants, employees, and others. They had access to the university’s systems from August 23 to 27, even after the campus network was disconnected from the internet.

• French professional basketball team LDLC ASVEL confirmed a data breach after the NoEscape ransomware gang claimed to steal 32 GB of data from the club. The stolen data included the personal information of players, passports, and ID cards, and many documents related to finance, taxation, and legal matters.

• Popular password management solution 1Password revealed a security incident linked to the Okta support system breach. However, the firm disclosed that there was no compromise of user data or other sensitive systems. As part of the security measures, 1Password notified all impacted customers.

• This week, the Bank of Canton and CCleaner reported being impacted by MOVEit Transfer hacks. While the Bank of Canton revealed that approximately 9,500 customers were impacted following the attack at Fiserv, CCleaner disclosed that the personal information, such as names and contact details, of a limited number of customers were affected in the attack.

• Japanese watchmaker Seiko notified that 60,000 pieces of personal data from customers, employees, business partners, and job applicants were affected in the recent ransomware attack. BlackCat ransomware group had taken the credit for the attack.

• The government of Philadelphia said hackers spent at least three months, from May 26 to July 28, inside city email systems and accessed health information of residents. The type of information impacted includes names, addresses, dates of birth, Social Security numbers, diagnosis information, and contact details. The incident was first discovered on May 24 and since then the officials have been investigating the matter.

• According to Ukraine’s National Cyber Security Coordination Center (NCSCC), Russian cybercriminals have increased their cyberattacks against Ukrainian financial and government organizations using the SmokeLoader malware. In one of the recent campaigns, the attackers used the malware to attack state, private, and financial institutions, with a particular focus on accounting departments.

• An unsecured 7TB database belonging to Indian diagnostic service provider Redcliffe Labs exposed over 12 million healthcare records. These included medical scans, test results, internal business documents, mobile application details, and patient information.

• A threat actor, who goes by the name ‘Sheriff’, claimed to sell 1.2 million Airbnb user records on the dark web. The records included sensitive details such as users’ names, email addresses, countries of residence, and cities. Meanwhile, the firm has not confirmed the claim.

• Hello Alfred, an in-home hospitality app, left a database accessible without password protection, exposing almost 170,000 records containing private user data. The leaked information included partial payment information, user names, email addresses, phone numbers, home addresses, and private notes of users.

New Threats

Are you sure your browser is up to date? A new FakeUpdateRU malware has been observed spreading via a fake Chrome update, tricking users into downloading a trojan on their systems. Besides, the Russia-based Winter Vivern APT re-emerged in a cyberespionage campaign that exploited a zero-day vulnerability in RoundCube Webmail to target European entities. Security researchers also warned about evolving Octo Tempest campaigns and urged organizations to take precautionary measures.

• The Russian-aligned APT group Winter Vivern group exploited a zero-day vulnerability (CVE-2023-5631) in the Roundcube Webmail servers to compromise government systems across Europe remotely. As part of the campaign, the emails were sent from the address team.managment@outlook[.]com with the subject line ‘Get started in your Outlook.’ These emails included a malicious SVG file that contained a base64-encoded payload.
• A new fake Google Chrome update malware named FakeUpdateRU emerged in the threat landscape, enabling the victims to overwrite the main index.php file for the active theme on the website. The campaign leverages compromised WordPress websites as well as other CMS platforms.
• Microsoft shared details of a financially motivated threat actor Octo Tempest (aka 0tapus, UNC3944, or Scattered Spider), whose evolving campaigns have become a growing concern for organizations across multiple industries. Notably, it became an affiliate of the BlackCat ransomware group a few months ago. The attackers leverage a wide range of social engineering tactics, including SMS phishing, and SIM swapping attacks, to gain control over a user’s phone number. Other tools used by the group include DBeaver, MongoDB Compass, Azure SQL Query Editor, and Cerebrata.
• The Iranian threat actor known as Tortoiseshell was attributed to a new wave of watering hole attacks that deployed a malware dubbed IMAPLoader. Based on the .NET framework, IMAPLoader is a replacement for a previously used Python-based IMAP implant and has the ability to fingerprint victim systems using native Windows utilities. It also acts as a downloader for delivering other malicious payloads.
• A newly emerged ransomware gang, called Hunters International, claimed attacks on two victims earlier this month. One of them is a US plastic surgeon’s clinic and another is a UK primary school. In the case of the US plastic surgeon’s clinic, the attackers claimed to gain access to systems and leak patients’ pre-operation pictures.
• A relatively new threat actor group, known as Yoro Trooper, likely linked to Kazakhstan, was observed targeting government entities in Azerbaijan, Kyrgyzstan, Tajikistan, and other Commonwealth of Independent States (CIS) countries. The group relies on custom-built Python implants, PowerShell scripts, and VPN accounts to compromise systems.
• A new speculative side-channel attack, named iLeakage, can enable attackers to extract sensitive information from the Safari web browser. The attack works on all recent Apple devices and can be executed through a technique that uses the JavaScript window.open API.
• Researchers identified several malicious apps on the Google Play Store pushing FakeApp, Joker, and HiddenAds malware on infected devices. These apps—tracked as Super Skyibydi Killer, Agent Shooter, Rainbow Stretch, Rubber Punch 3D, Eternal Maze, Jungle Jewels, Stellar Secrets, Fire Fruits, Cowboy’s Frontier, and Enchanted Elixir— amassed over 2 million downloads.