Cyware Weekly Threat Intelligence - October 25–29

The Good

It rained ransomware decryptors this week, with Avast releasing keys for AtomSilo, Babuk, and Lockfile, while Emsisoft released a free decryptor for the notorious BlackMatter ransomware. In another piece of good news, the NSA and CISA published a joint guidance on how to secure cloud-native 5G networks. The recommendations can be used by service providers and system integrators that build and configure 5G cloud infrastructure.

• Avast released free decryption utilities to recover files encrypted by three ransomware strains - AtomSilo, Babuk, and LockFile. The decryptors for AtomSilo and LockFile are the same because they share similarities. However, the decrypter will only work for past Babuk victims who had files encrypted with either .babuk or .babyk file extensions only.
• Experts from Emsisoft released a free decryption key for victims affected by BlackMatter ransomware. The decrypter can only decrypt files encrypted with BlackMatter versions used by attackers between July and September. The decryption key has been created using a critical flaw discovered in the ransomware.
• The U.S. State Department announced the launch of the Bureau of Cyberspace and Digital Policy that will deal with matters of international cybersecurity, international digital policy, and digital freedom. The department will also appoint an envoy for critical and emerging technology.
• The U.S. authorities and the Ukrainian police detained an undisclosed number of suspects in a joint operation accused of targeting cryptocurrency wallets and laundering stolen money for cybercriminals. Authorities confiscated software programs and hardware resources used to infect targets and launder the proceeds. Images shared by the police reveal that the culprits might have been developing their fake cryptowallets, which would have been laced by malware.
• MITRE Corporation announced the release of the tenth version of ATT&CK framework. This version of ATT&CK for Enterprise contains 14 Tactics, 188 Techniques, 379 Sub-techniques, 129 Groups, and 638 Pieces of Software. It also includes a new set of Data Source and Data Component objects in Enterprise ATT&CK.
• A Russian national—Vladimir Dunaev—was extradited from South Korea to the U.S., under suspicions of being a member of the infamous Trickbot gang. He has apparently worked as a malware developer, managing the execution, developing browser modifications, and helping masking the malware from security solutions.
• The CISA and NSA released guidance for service providers and system integrators about how they can secure cloud-native 5G networks from attacks. Released as a four part series, the guidance can be used by cloud service providers, mobile network operators, and core network equipment vendors.

The Bad

“Spooky, scary skeletons, send shivers down your spine.” However, sadly, its not skeletons that scare us in the cyber world but cybercriminals with their heinous intents and acts. Nobelium, the actor behind the SolarWinds attacks, has resurfaced to target hundreds of MSPs. Cybercriminals are riding on the wave of popularity of Squid Game as they are attempting to trick users into downloading the Dridex banking trojan through carefully crafted lures. In other news, the Grief ransomware gang attacked the NRA and leaked screenshots and an archive as proof of the attack.

• An estimated $130 million worth of cryptocurrency assets was pilfered from Cream Finance. This is the third cyberattack against the firm this year. The attackers allegedly abused a vulnerability in the Flash Loaning platform. Earlier attacks led to a loss of $37 million and $29 million.
• According to FBI reports, Ranzy Locker ransomware operators crippled the networks of at least 30 U.S. organizations, mostly via brute-force attacks. The attacks targeted critical manufacturing, government facilities, transportation, and IT sectors. The stolen files include customer details, PII, and financial records.
• Microsoft revealed that the Russia-backed Nobelium threat group has targeted at least 140 organizations via 14 cloud service providers, MSPs, and IT services. The attack indicated a shift of interest to supply chain attacks. The attacks were being conducted in the U.S. and Europe since May.
• Cybercriminals were found offering a database containing 50 million records, of Moscow drivers, in an underground marketplace only for $800. The records contain car models, VIN, and registration details, and PII of owners. The database has, reportedly, been obtained through an insider in the local police - claimed the hackers.
• Joker malware returned to the Play Store disguised as a Squid Game-themed wallpaper app. The app was downloaded 5,000 times before Google removed it. The malware is designed to steal users’ precious data to commit ad fraud or subscribe unsuspecting users to unwanted SMS.
• Researchers uncovered an unsecured database of 63.58GB belonging to Deep 6 AI that contained more than 880 million medical records of U.S. citizens. The records contained complete physician notes, including patient illness, treatment, medication, and emotional issue details. The dataset could have fallen prey to a ransomware attack and could have been accessed by anybody with an internet connection.
• The Grief ransomware group allegedly targeted the National Rifle Association (NRA) and leaked the screenshots of U.S. tax information and investment amounts as proof of the hack. It has also leaked an archive—National Grants.zip—of 2.7MB, which reportedly contains NRA grant applications. The threat actor is linked to the Russia-based Evil Corp.
• Avast unearthed UltimaSMS, a fraud campaign that involves at least 151 malicious Android apps with over 10.5 million downloads. Targeted countries include Egypt, Saudi Arabia, the UAE, and Pakistan, accounting for more than a million victims. The apps were promoted via TikTok, Instagram, and Facebook.
• Large-scale DDoS attacks plundered at least eight email service providers, including Fastmail, Runbox, Posteo, TheXYZ, Guerilla Mail, Mailfence, Kolab Now, and RiseUp. The ransom demand was for 0.06 BTC and the victims were provided only three days to pay up. Attacks at Runbox and TheXYZ peaked at 50Gbps and 256Gbps, respectively.
• Proofpoint stumbled across a cybercrime actor, TA575, sending thousands of Squid Game lures aimed at multiple industries primarily in the U.S. These email lures are propagating the Dridex malware by asking the target to fill out an attached document to gain early access to the show’s next season. The attachments are macros-laden Excel documents that, when enabled, download Dridex from Discord URLs.

New Threats

While Halloween is just two days away, lets not forget the new ghosts of the week. A new strain of the Chaos ransomware is making the rounds across Japanese Minecraft players. While it encrypts some files, it destroys others - making recovery an impossible feat. Heard of SquirrelWaffle? As cute as it sounds, it’s a malware that has the potential to become a huge threat in the spam space. This week witnessed a novel Windown binary loader, dubbed Wslink, that has been launching campaigns in North America, the Middle East, and Central Europe.

• A new attack technique demonstrated on weak WiFi passwords can allow attackers to take control of devices. The attack leverages a security flaw to retrieve PMKID hashes and crack network passwords. A researcher was able to crack more than 3,500 WiFi networks, among a sample of 5,000 networks, within a short time.
• A highly active, new threat actor named Balikbayan Foxes aka TA2722 was found impersonating Philippine government entities such as the Department of Health, the Bureau of Customs, and the Philippine Overseas Employment Administration. The messages targeted shipping, manufacturing, finance, pharmaceutical, energy, business services, and logistics industries in North America, Southeast Asia, and Europe.
• ESET took the wraps off of Wslink, a Windows malware probably from a threat actor group. It is targeting victims in Central Europe, North America, and the Middle East. This unique Windows binaries loader runs a server and executes modules in memory, unlike other such loaders. No evidence connecting it to a known threat actor has been discovered yet.
• Conti has shifted its strategy to threatening victim organizations of selling their network access and stolen data if they refuse to pay the ransom or participate in negotiations. Experts are questioning the motives behind such a sudden shift as why would the gang advertise having hacked into organizations if they plan on selling that access.
• Cisco Talos warned against SquirrelWaffle, a new malware disseminating quickly via spam campaigns. Experts believe it has the potential to become the next big threat in the spam space. The malware enables threat actors to gain an initial foothold into systems and conduct further compromise or deploy more malware. The campaigns leverage stolen email threads containing hyperlinks to malicious ZIP archives hosted on web servers controlled by the attackers.
• Researchers uncovered a new variant of Chaos ransomware that targeted Minecraft gamers in Japan. The variant not only encrypts certain files but also destroys others, making any file recoverable. The malware variant is distributed in the form of a file pretending to be a list of ‘Minecraft Alt’ accounts. While the file is an executable, it uses a text icon to trick targets into thinking it to contain compromised usernames and passwords for Minecraft. Researchers surmise that the fake list is being advertised on Japanese Minecraft forums.
• DECAF is new ransomware written in the Go 1.17. The malware variant appeared in late September and has been under development through October. DECAF uses the AES-CBS-128 algorithm to encrypt the files and subsequently creates a README.txt file inside each directory. Golang 1.17 complicates the analysis of the application flow, allowing attackers greater agility with latest technology.
• A new Android malware strain named AbstractEmu was found to be distributed via 19 applications uploaded on Google Play Store, Amazon Appstore, Samsung Galaxy Store, and other unofficial third-party app stores. Once on a device, the malware downloads and executes one of five exploits for vulnerabilities affecting older Android phones. What’s unique about this malware is that it can root smartphones, which is a rare feature among current Android malware variants.