Cyware Weekly Threat Intelligence - September 18–22

Weekly Threat Briefing • September 22, 2023
Weekly Threat Briefing • September 22, 2023
In an attempt to bolster information security across federal agencies, the CISA released new Identity Credential and Access Management (ICAM) guidelines as part of its Continuous Diagnostics Mitigation (CDM) program. The recommendations will help strengthen the security posture of federal networks. In another development, the DHS issued new cyber incident reporting rules to better protect the nation’s critical infrastructure.
A security advisory was issued to warn critical infrastructure organizations about ongoing Snatch ransomware attacks. The advisory highlighted that the group is targeting organizations in the agriculture, IT, and defense industries. In a different incident, a sophisticated web skimming attack named Silent Skimmer went undetected for over a year, only to be discovered recently by researchers owing to its massive impact across APAC and NALA. Apart from these, an Android malware scam and a pig-butchering scam were also reported, which enabled threat actors to make profits in millions.
The cyber threat landscape witnessed the emergence of many new backdoor malware. While two new backdoors—named HTTPSnoop and PipeSnoop—were used to remotely execute code on Middle East-based telecommunications organizations, a new SprySOCKs backdoor was associated with an Earth Lusca campaign targeting government agencies across multiple countries. In another instance, a newly identified LuaDream malware was found using the LuaJIT platform to spread across networks.
Chinese hacking group Earth Lusca was discovered using a new Linux backdoor, SprySOCKS, in a campaign targeting government agencies in multiple countries. The malware borrows much of its source code from Trochilus open-source Windows backdoor. The structure of SprySOCK’s C2 protocol is similar to the one used by the RedLeaves backdoor.
A threat actor employed two new backdoors—HTTPSnoop and PipeSnoop—in a cyberespionage campaign targeting Middle East-based telecommunications organizations. These backdoors masqueraded as popular software products and used extensive anti-detection mechanisms to stay under the radar. Once implanted, the malware executed a shellcode to give the attackers a persistent foothold on the victims’ networks.
Organizations located in Azerbaijan were targeted by a Rust-based malware in a campaign named Operation Rusty Flag. The malware was deployed by exploiting a six-year-old memory corruption flaw (CVE-2017-11882) in Microsoft Office’s Equation Editor. The exact end goals of the campaign remain unclear.
A newly discovered ValleyRAT malware is being used alongside Sainbox RAT and Purple Fox malware in an attack campaign to target Chinese-speaking users. These malware are distributed via phishing emails including business-themed content—like invoices, payments, and new products—to lure recipients. Written in C++, ValleyRAT includes the functionalities of a basic RAT.
A new campaign abusing 4shared WebDAV services was used to distribute a new variant of the Bumblebee malware loader. The variant uses TCP, instead of WebSockets, for C2 communications. Additionally, it uses DGA to generate 100 domains on the ‘.life’ TLD upon execution.
A new Sandman APT group was identified using a new modular backdoor named LuaDream to target telecom service providers in Europe and Asia. The malware utilizes the LuaJIT platform to propagate on targeted organizations’ systems. According to SentinelOne, it shares similarities with another malware named DreamLand.
According to Cado Security, the activity of the P2Pinfect botnet has increased by 600 times since August 28, owing to the discovery of new variants of the botnet. A majority of infections were observed in China, followed by the U.S., Germany, Singapore, and Hong Kong. The new variants employ several crafty techniques to launch stealthy attacks.
ESET observed two OilRig campaigns which occurred throughout 2021 and 2022. These campaigns—dubbed Outer Space and Juicy Mix— used a new C#/.NET backdoor called Solar and its variant Mango to target Israeli organizations. These backdoors were deployed using VBS droppers, presumably spread via spearphishing emails.
A new version of BBTok banking malware was used to target clients of over 40 Mexican and Brazilian banks in a campaign that employed various file types, including ISO, ZIP, LNK, DOCX, JS, and XLL. The new variant replicates the interfaces of the banking sites and tricks victims into entering 2FA codes to steal payment card details from their bank accounts.