Cyware Weekly Threat Intelligence - September 09–13

The Good

The U.K government has elevated data centers to a new level of importance, officially designating them as critical national infrastructure - ensuring these digital fortresses get the protection and support they need during crises. Choosing secure tech just got easier: the FCC is introducing a cybersecurity labeling program, helping consumers spot products that meet strict security standards, just like ENERGY STAR does for energy efficiency.

• The U.K government designated the data center sector as part of the country's critical national infrastructure, recognizing its importance in safeguarding vital data from cyber attacks and disasters. This designation aims to prioritize engagement with the sector and ensure continuity of operations during crises. It signals greater government support for physical data centers and cloud operators, providing access to security agencies and emergency services in case of incidents.
• The FCC is launching a voluntary cybersecurity labeling program to help consumers make informed decisions about purchasing technology products. The program will use a U.S. Cyber Trust Mark to indicate products that meet cybersecurity standards, similar to the ENERGY STAR label for energy efficiency. The label will be displayed on internet of things products, providing information on security features and compliance with cybersecurity standards.
• The U.K National Crime Agency and Information Commissioner's Office have signed an agreement to share cyber threat information to improve cyber defenses and increase reporting. The aim is to help organizations struggling post-cyberattack and to encourage reporting of incidents. The agencies will share mainly anonymized and aggregated incident data and are urging companies to disclose cyber incidents to authorities. The agreement also aims to strengthen responses to disruptive cyberattacks against critical infrastructure in the U.K., as high-profile attacks continue to occur.

The Bad

An innocent-looking Excel file hides a malicious secret: exploiting an old Microsoft vulnerability to deploy the stealthy Remcos RAT, giving attackers remote access and dodging traditional security defenses across sectors worldwide. Iran's OilRig is making waves again, targeting Iraqi government networks with two new malware strains, Veaty and Spearal, designed to harvest files and execute PowerShell commands. Crimson Palace, a trio of Chinese hacker clusters, has quietly infiltrated Southeast Asian governments, using their latest weapon, Tattletale malware, to steal sensitive data and authentication keys.

• A recent phishing campaign delivered a harmless-looking Excel file that utilizes CVE-2017-0199 to embed malicious code through OLE objects in Microsoft Office. The file employs encryption and obfuscation techniques to hide the malicious payload, which, when opened, executes a fileless version of the Remcos RAT, providing attackers with remote access. This campaign has been targeting various sectors in different countries and involves OLE object exploitation, HTA application execution, and PowerShell commands to inject the RAT into a legitimate process. Remcos RAT establishes persistence by injecting itself into legitimate processes, evading traditional security measures.
• The Iranian state-sponsored threat actor OilRig launched a sophisticated campaign targeting Iraqi government networks, including organizations such as the Prime Minister's Office and the Ministry of Foreign Affairs. The recent campaign involves new malware families called Veaty and Spearal, which enable the execution of PowerShell commands and file harvesting. Check Point also discovered a third SSH tunneling backdoor associated with the threat actor infrastructure and an HTTP-based backdoor, CacheHttp. dll, targeting Microsoft's IIS servers.
• Sophos detailed an ongoing cyberespionage attack by Crimson Palace, targeting government organizations in Southeast Asia. Crimson Palace is a cluster of three Chinese clusters, namely, Cluster Alpha, Cluster Bravo, and Cluster Charlie. The hackers have adapted, using a new malware, Tattletale, to gather information and infiltrate networks. Cluster Charlie targeted government organizations, stealing sensitive data and authentication keys. The attackers focused on evading security tools and gaining deeper access within victim networks. They compromised at least 11 other organizations in the region, delivering malware under the guise of trusted access points.
• The RansomHub ransomware gang has been using the legitimate TDSSKiller tool from Kaspersky to disable EDR services on target systems. Once the defenses are down, the attackers use the LaZagne credential-harvesting tool to extract logins from application databases. Through these tools, attackers can move laterally and access sensitive data. Notably, TDSSKiller was observed using the -dcsvc flag to target specific services, like MBAMService.
• The Quad7 botnet is expanding its operations by targeting additional SOHO devices with new custom malware for Zyxel VPN appliances, Ruckus wireless routers, and Axentra media servers. This expansion includes the targeting of specific devices with different welcome banners on the Telnet port, and the use of new communication methods and tactics to evade detection. The botnet has evolved to utilize new tools such as "FsyNet" and a backdoor named "UPDTAE" for remote control of infected devices. There are also experiments with a new communication protocol named CJD route2.

New Threats

More than 1.3 million Android TV streaming boxes have fallen victim to the Vo1d backdoor, giving attackers full control and spreading infections across 200 countries. Banking customers in Central Asia are caught in the crosshairs of Ajina.Banker, a sneaky Android malware that’s spreading through Telegram channels disguised as trusted apps, siphoning off sensitive data for financial gain. Hadooken malware is taking Linux systems by storm, targeting WebLogic servers to drop cryptominers and Tsunami malware, exploiting weak passwords and erasing traces to ensure its silent persistence across compromised networks.

• Threat actors infected over 1.3 million Android TV streaming boxes with Vo1d backdoor, giving them full control over the devices. The malware targets Android firmware versions such as Android 7.1.2 and Android 10.1, modifying system files for persistence. Dr. Web researchers found infected devices in over 200 countries, with the most cases in Brazil, Morocco, and Pakistan. While the exact method of compromise is unknown, researchers suspect vulnerabilities in outdated software. Google clarified that the infected devices are not running Android TV but the Android Open Source Project (AOSP).
• Banking customers in Central Asia are under attack from Ajina.Banker, an Android malware discovered in May 2024 by Group-IB. The malware spreads through Telegram channels posing as legitimate apps related to banking, payment systems, and more. Affiliates motivated by financial gain are distributing the malware to ordinary users in countries like Armenia, Kazakhstan, Russia, and others. Once installed, Ajina.Banker can access SMS messages, SIM card information, financial apps, and more, sending the data to a remote server.
• Aqua Nautilus uncovered a new Linux malware, known as Hadooken, targeting Weblogic servers. This malware drops the Tsunami malware and deploys a cryptominer upon execution. The attackers exploited weak passwords to gain access and execute remote code on WebLogic servers. The malware creates cronjobs for persistence and deletes logs to evade detection. The malware also attempts lateral movement through SSH hijacking and performs resource hijacking with the cryptominer.
• GitLab released security updates for 17 vulnerabilities, including a critical flaw (CVE-2024-6678) that allows attackers to run pipeline jobs as arbitrary users. The update also addresses three high-severity, 11 medium-severity, and two low-severity bugs. These fixes are available in versions 17. 3. 2, 17. 2. 5, and 17. 1.7 for GitLab CE and EE. While there is no evidence of active exploitation, users are advised to apply the patches promptly to reduce potential risks.
• Cisco Talos discovered a new threat named DragonRank that targets countries in Asia and some in Europe using PlugX and BadIIS for SEO manipulation. DragonRank infiltrates web applications to deploy web shells, gather system information, and launch malware, along with credential-harvesting tools. The group has compromised over 35 IIS servers in countries including Thailand, India, Korea, Belgium, the Netherlands, and China. DragonRank is linked to a Simplified Chinese-speaking actor through their commercial website and messaging accounts.
• Microsoft announced three new security vulnerabilities affecting Windows, which are being actively exploited, as part of the September 2024 Patch Tuesday update. This release addressed a total of 79 vulnerabilities, with seven rated critical, 71 important, and one moderate. Additionally, 26 flaws in the Chromium-based Edge browser were also fixed. The exploited vulnerabilities include CVE-2024-38014, CVE-2024-38217, and CVE-2024-38226, along with CVE-2024-43491. These flaws can lead to security feature bypasses and remote code execution. Microsoft recommended installing the September 2024 Servicing stack update and the Windows security update to mitigate the risks.
• ESET researchers observed the CosmicBeetle, aka NoName, threat actor using its new ScRansom ransomware, replacing its previous Scarab ransomware, with a focus on small and medium-sized businesses. The threat actor has also been using the leaked LockBit builder to mimic the well-known ransomware gang in an attempt to boost its credibility. It is believed that CosmicBeetle may have connections to the RansomHub gang.