Cyware Weekly Threat Intelligence - September 25–29

The Good

Supply chain attacks continue to pose a significant threat across industry verticals. In an attempt to reduce such risks, the CISA has introduced a new Hardware Bill of Materials (HBOM) framework that would require hardware vendors to share information on all physical components used in their products. Moving on, the DHS has released a new four-year IT strategic plan to bolster the cyber workforce and security of software used across the department.

• The CISA introduced a new framework called the Hardware Bill of Materials (HBOM) to mitigate supply chain risks for hardware products. It is inspired and is meant to be a complement to SBOM, a framework that the CISA has been pushing to software vendors since the Log4Shell incident in late 2021. Under this new framework, hardware vendors are expected to produce an HBOM file that will contain information on all physical components used in their products.
• The DHS released its new IT strategic plan for fiscal years 2024 through 2028, which prioritizes including the DHS IT academy to upskill its workforce on cybersecurity, among other training. The plan also lays out to retire legacy systems and build modern, effective, and secure software across the department.
• Security firm Confiant worked with industry partners to take down the infrastructure of a threat actor named ScamClub. Active since 2018, the group has employed multiple browser zero-days and is believed to have made an estimated $8.5 million in the first half of the year alone.

The Bad

The MOVEit mass hack incident continued to grab headlines as the name of a new victim emerged this week. A healthcare organization funded by the Canadian province of Ontario, BORN, confirmed being impacted by the Clop ransomware attack that resulted in the theft of sensitive information of nearly 3.4 million people. Meanwhile, the BlackCat/ALPHV attackers are on a hacking spree as they added three new organizations to their list of victims. In another concerning matter, the FBI, along with the CISA, the NSA, and Japan’s NISC, disclosed that the BlackTech APT has been altering Cisco router firmware with the aim of targeting organizations across the U.S. and Japan.

• The infamous ALPHV ransomware group added three new organizations to its list of victims. These include Clarion, Phil-Data Business Systems Inc, and MNGI Digestive Health. While the information stolen from the firms is not clear, BlackCat gave MNGI a 48-hour deadline to contact them before it made the stolen data public.

• The Better Outcomes Registry & Network (BORN), a healthcare organization funded by the government of Ontario, Canada, announced that it was impacted by the recent Clop ransomware-led MOVEit hacking spree. The investigation revealed that the threat actors copied files containing sensitive information of approximately 3.4 million people who benefited from BORN services between January 2010 and May 2023.

• Hackers stole more than $200 million in assets from the centralized database of Mixin Network, a peer-to-peer transactional network for digital assets located in Hong Kong, forcing it to halt operations. The attack occurred on September 23 and is believed to be the work of Lazarus. The hackers are thought to have stolen at least $93.5 million in Ethereum and more than $23.5 million in Tether, according to cryptocurrency dealers.

• Johnson Controls suffered a ransomware attack by the Dark Angels Team, that affected the operations of its subsidiaries and some of its systems, including VMware ESXi servers. The attackers claimed to have stolen over 27 TB of corporate data and demanded $51 million in ransom. In its SEC filing, Johnson Controls said that it is working with its insurers to restore systems and customer access to its automation platform.

• Avanan researchers discovered a sophisticated phishing attack that leveraged the popular Dropbox file-sharing service to steal user credentials. Around 5,440 phishing emails, pretending to be from Dropbox, were sent in the first two weeks of September, prompting recipients to reply or comment on the content by clicking on a link. Once clicked, the link redirected victims to a legitimate Dropbox page that included another link to an external page designed to steal their credentials.

• Over 3.8 billion user credentials were exposed online through an unprotected Elasticsearch and Kibana interface belonging to DarkBeam, a company that specializes in digital risk protection. Each of the 16 "email 0-9" and "email A-F" collections held 239,635,000 records.

• The city of Fort Lauderdale in Florida lost $1.2 million in a BEC scam after an employee sent the funds to a scammer pretending to work for a local construction firm. The incident took place on September 14 and the fraudulent transaction was discovered six days later.

• A misconfigured AWS bucket used by the World Baseball Softball Confederation (WBSC) exposed nearly 50,000 files, out of which 4,600 were national passports. Overall, these files contained a significant amount of personal information, such as full names, dates of birth, and unique passport numbers.

• Booking.com users were the target of a large-scale phishing attack, wherein their personal data, including names, booking dates, hotel details, and partial payment methods, was stolen by attackers. The attackers utilized the stolen data to craft personalized messages designed to play on the fears and urgency of potential victims.

• The NSA, FBI, CISA, and Japan's NISC released a joint advisory in which they revealed that the BlackTech APT has been altering Cisco router firmware to hide its activities while attacking businesses in the U.S. and Japan. Using different iterations of a specialized firmware backdoor that could be enabled or disabled using specifically designed TCP or UDP packets, the attackers were able to infect a number of Cisco routers.

• Researchers observed several instances where attackers used malicious software packages to steal information from developers. In one instance, attackers uploaded 45 packages on npm and PyPI repositories in order to steal sensitive data such as SSH keys. In another incident, hackers breached GitHub accounts to insert malicious code disguised as Dependabot contributions in an attempt to steal authentication secrets and passwords from developers.

New Threats

Talking about new threats, organizations have been warned of a new trend adopted by several ransomware operators. It involves the deployment of two ransomware simultaneously against an organization, ultimately leading to mixed data encryption, exfiltration, and financial losses in the form of ransom payments. Besides these, a new malware dubbed ZenRAT was discovered in the wild, targeting Windows systems. A new variant of Xenomorph Android trojan also surfaced in the threat landscape, enabling its operators to target banking customers across the U.S. and Portugal.

• The Budworm APT used a previously unseen variant of SysUpdate backdoor, known as SysUpdate DLL inicore_v2.3.30.dll, to target a Middle Eastern telecommunications organization and an Asian government. The malware provides attackers with various capabilities, such as capturing screenshots, command execution, and service manipulation.
• Malwarebytes shared details on a new malvertising campaign that uses Bing Chat to distribute malware. Threat actors are injecting malicious ads that redirect to fake download sites into Bing Chat responses to trick users searching for certain software. In one such instance, researchers came across several fake download websites for the Advanced IP scanner being displayed in the responses of Bing Chat.
• The FBI issued a new private industry notification to warn organizations of new trends in ransomware attacks. It highlights that threat actors are deploying two ransomware variants against victim organizations in close date proximity to one another, leading to a mixture of data encryption, exfiltration, and financial losses associated with ransom payments. Some of the ransomware used in this manner are AvosLocker, Diamond, Hive, Karakurt, LockBit, Quantum, and Royal.
• Two previously unknown trojans, AtlasAgent and DangerAds, were revealed in attacks by the recently identified AtlasCross hacking gang. These trojans were distributed using phishing lures that claimed to be from the American Red Cross, encouraging users to take part in a "September 2023 Blood Drive." Both Atlas Agent and DangerAds are intended to infect Windows devices.
• Researchers noticed a well-crafted and innovative social engineering attack campaign that deployed five different information stealer malware, including RedLine Stealer, Vidar Stealer, Stealc, Lumma Stealer, and Spidey Bot, on victims’ systems. The campaign targeted the hospitality sector, primarily luxury hotel chains and resorts. Some of these stealers were used to deliver ransomware on compromised systems.
• A previously undocumented backdoor malware named LightlessCan has been attributed to the Lazarus group. The attackers are using the malware as part of the Operation Dreamjob campaign to target employees of an aerospace company located in Spain. The malware is a successor to BlindingCan and is deployed alongside miniBlindingCan (another variant of BlindingCan) via the NickelLoader malware.
• GPUs from six major suppliers, including Intel, AMD, Apple, and Nvidia, are vulnerable to a new side-channel attack, dubbed GPU.zip, that can allow attackers to view usernames, passwords, and other sensitive data on websites. The attack is launched by leveraging a malicious website that places a link to the webpage it wants to read inside an iframe.
• Group-IB researchers discovered the infrastructure linked to a threat group called ShadowSyndicate, which likely used seven distinct ransomware families in attacks last year. These involve Quantum, Nokoyawa, BlackCat/ALPHV, Clop, Royal, Cactus, and Play ransomware.
• A new malware strain called ZenRAT emerged in the wild to steal information from Windows systems. According to Proofpoint researchers, the malware was initially discovered on a website pretending to be associated with the open-source password manager Bitwarden.
• A new variant of Xenomorph emerged in the threat landscape, adding overlays for multiple crypto wallets, and targeting over 30 banking institutions in the U.S. and Portugal. The malware variant was distributed via phishing pages posing as Chrome updates, which also propagated LummaC2 Stealer and RisePro Stealer at different time periods.