Cyware Daily Threat Intelligence

From using off-the-shelf tools to deploying custom-built payloads, malware authors often give us a glimpse of rapid adaptation to the shifting security balance. An open-source kernel module rootkit is being used in real-world attacks to target Linux systems, discovered cybersecurity experts. It has been utilized in attacks by various threat groups, specifically Chinese actors, and was found in attacks against Korean companies. Meanwhile, the Cl0p ransomware gang has switched to using torrents for distributing stolen data, increasing the impact and complicating law enforcement efforts to shut down distribution - potentially escalating ransom pressure on victims.

What’s more? The SkidMap malware has been observed attacking poorly secured Redis server instances to deploy a dropper shell script, disguising itself as a GIF image file. Also read about the new variant of STRRAT, which has been in distribution since March.

Top Breaches Reported in the Last 24 Hours

Education department breached

The Colorado Department of Higher Education (CDHE) disclosed a data breach impacting current and former students and teachers after a ransomware attack in June. The breach exposed names, Social Security numbers, student identification numbers, and other education records. The number of affected individuals has not been disclosed yet. No ransomware group has claimed responsibility for the attack thus far.

**DDoS attack on Spanish entities **

A well-known Spanish research institute fell victim to a weeks-long distributed DDoS campaign, allegedly orchestrated by NoName057. The cyberattacks impacted at least 72 websites, including banks, telecoms providers, media companies, and government ministries. Separately, the Spanish National Research Council was hit by a ransomware attack last month.

Top Malware Reported in the Last 24 Hours

Malicious packages target IT professionals

A malicious package, disguised as the legitimate VMware vSphere connector module vConnector, was uploaded to the PyPI as ‘VMConnect’ specifically targeting IT professionals. The package was downloaded 237 times before being removed on August 1, 2023. Sonatype's investigation also revealed two more malicious packages, 'ethter' and 'quantiumbase,' which mimicked popular legitimate packages 'eth-tester' and 'databases,' respectively.

Open-source rootkit targeting Linux systems

Reptile, an open-source kernel module rootkit, designed to target Linux systems was found on GitHub. Unlike typical rootkit malware, Reptile not only conceals its presence but also offers a reverse shell, granting threat actors control over compromised systems. The rootkit utilizes a method called "Port Knocking" to establish connections with C&C servers. It shares similarities with Syslogk, based on the Adore-Ng rootkit.

Cl0p adopts torrents for data leaks

MOVEit-hijacker Cl0p ransomware gang has changed its extortion tactics and is now using torrents to distribute data stolen in the MOVEit Transfer breaches. Previously, the group utilized Tor data leak sites, but this method was slow and easier to shut down. Through torrents, criminals are expecting faster transfer speeds making the leak more impactful. As torrents are decentralized, it becomes challenging for law enforcement to shut them down.

STRRAT gets an upgrade

The Java-based RAT, STRRAT, has undergone significant evolution, showcasing several advancements, including the integration of a Crimson ransomware module and the adoption of multiple infection chains. A new distribution technique utilizing two-string obfuscation methods has been identified. The infection begins with a spam email containing a malicious PDF attachment that leads to the download of the STRRAT payload.

New threat lurks on vulnerable Redis servers

A highly sophisticated malware variant called SkidMap is targeting vulnerable Redis services on a wide range of Linux distributions, including Alibaba, Anolis, CentOS, and RedHat. First disclosed in September 2019 as a cryptocurrency mining botnet, SkidMap has evolved to adapt to the systems it infects. It adds SSH keys, disables SELinux, establishes a reverse shell, and downloads appropriate packages based on the Linux distribution.

Top Vulnerabilities Reported in the Last 24 Hours

RCE bug in PaperCut NG/MF

PaperCut, a print management software, recently fixed a critical security vulnerability—tracked as CVE-2023-39143—that could allow an unauthenticated user to remotely execute code on Windows servers. The flaw results from two path traversal weaknesses that enable threat actors to read, delete, and upload arbitrary files without user interaction. The vulnerability impacts servers in non-default configurations, although it is, generally, enabled in most Windows PaperCut servers. The issue has been actively exploited by ransomware gangs, including the Cl0p and LockBit groups.

Top Scams Reported in the Last 24 Hours

Scammers impersonate NFT developers

The FBI is warning about fraudsters posing as Non-Fungible Token (NFT) developers to deceive NFT enthusiasts and steal their cryptocurrency and NFT assets. These criminals gain unauthorized access to NFT developers’ social media accounts or create fake accounts to promote "exclusive" NFT releases, preying on victims with misleading claims and a false sense of urgency.

Cyware Daily Threat Intelligence, November 21, 2024

With advanced techniques and creative exploits, cybercriminals are escalating their attacks on users' digital and financial lives. A revamped version of NodeStealer is targeting Facebook Ads Manager accounts to extract sensitive information and steal credit card data from web browsers. The malware employs sophisticated methods to access credit card details, which are then exfiltrated via Telegram. The WorkflowKit Race Vulnerability in macOS has exposed users to potential data breaches and remote code execution. The flaw arises from a race condition during the shortcut extraction process, allowing malicious apps to intercept and modify shortcuts during import. Apple addressed this critical issue in macOS 14.5 with enhanced sandbox restrictions. Adding to these growing concerns, criminals have devised a new scam known as Ghost Tap, exploiting NFC technology in mobile payment services. Using phishing tactics and mobile banking malware, attackers capture victims’ card credentials, link them to mobile wallets, and deploy mules to make fraudulent purchases at physical stores.

Cyware Daily Threat Intelligence, November 20, 2024

Cybercriminals and nation-state actors are fine-tuning their craft, targeting everything from IoT devices to global telecom networks. The Ngioweb malware has been used to assemble a botnet of over 35,000 compromised IoT devices and SOHO routers, to sell residential proxies on platforms like NSOCKS. A China-linked group, LIMINAL PANDA, has been conducting cyberespionage against telecommunications entities in South Asia and Africa since 2020. Armed with custom malware like SIGTRANslator and PingPong, they exploit telecom protocols to exfiltrate data and maintain persistent access, employing advanced tactics. Meanwhile, the CISA has issued warnings about three actively exploited vulnerabilities in networking products. These include a critical Kemp LoadMaster OS flaw and two Palo Alto PAN-OS vulnerabilities. The vulnerabilities have been added to the the KEV catalog.

Cyware Daily Threat Intelligence, November 19, 2024

As cyber threats grow more sophisticated, attackers are leveraging tailored tactics to exploit both individuals and organizations. BabbleLoader, a stealthy malware loader, is delivering information stealers like WhiteSnake and Meduza, targeting users searching for cracked software and professionals in finance and administration by disguising itself as accounting software. Its advanced evasion techniques bypass antivirus and sandbox defenses, disrupting analysis and detection. Critical vulnerabilities are also under scrutiny. The LibreNMS project revealed CVE-2024-51092, a flaw in its network monitoring platform that allows authenticated attackers to execute OS commands and potentially take over servers. Users are strongly advised to update to version 24.10.0 to mitigate these risks. Meanwhile, phishing campaigns continue to escalate. DocuSign phishing attacks targeting state and municipal contractors have surged by 98% in just one week. Exploiting licensing cycles and spoofing government agencies like the Department of Health, these campaigns aim to trick businesses into signing fake documents for financial gain.

Cyware Daily Threat Intelligence, November 18, 2024

Threat actors are employing sophisticated techniques to breach defenses across industries, from maritime manufacturing to WordPress websites and software impersonation campaigns. A DONOT APT campaign has been targeting Pakistan’s manufacturing sector supporting maritime and defense operations. The attackers use malicious LNK files disguised as RTF documents, leveraging dynamic domain generation and updated encryption to maintain persistence and evade detection. Meanwhile, a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin is putting over four million sites at risk, granting attackers full administrative access. Another vulnerability in the WPLMS Learning Management System exposes sites to arbitrary file reading and deletion, prompting emergency patches and forced updates by WordPress. On the social engineering front, researchers highlighted the rise of ClickFix campaigns, impersonating trusted software to deliver malware like AsyncRAT and Lumma Stealer. A fake CAPTCHA variant in these campaigns recently tricked users into executing malicious payloads, impacting hundreds of organizations globally.

Cyware Daily Threat Intelligence, November 15, 2024

From app stores to online shopping platforms, cybercriminals are exploiting trust to infiltrate systems and steal sensitive data. Eight trojan-infected Android apps were spotted on the Google Play Store, downloaded over two million times. These apps, containing Android.FakeApp.1669, connect to malicious DNS servers to display deceptive links. Meanwhile, the CISA has issued a warning about two critical vulnerabilities in Palo Alto Networks Expedition software, citing active exploitation. These flaws allow attackers to execute commands as root and access sensitive database contents. In another alarming campaign, Chinese threat actor SilkSpecter has created over 4,500 fake domains impersonating brands like North Face and Ikea to steal credit card details from shoppers in the U.S. and Europe.

Cyware Daily Threat Intelligence, November 14, 2024

The lines between digital espionage and warfare blur as state-sponsored threat actors employ increasingly advanced methods to compromise their targets. China’s APT41 has launched a cyberespionage campaign targeting organizations in South Asia, utilizing the DeepData Framework. This Windows-based toolkit consists of 12 malicious plugins that are designed to harvest a wide range of sensitive data. Meanwhile, the Lazarus Group has turned its sights on macOS users with a new malware strain, RustyAttr. Built using the Tauri framework, the malware exploits extended file attributes to execute a malicious shell script that loads a Rust-based backend via a fake webpage. In another wave of attacks, a critical zero-day vulnerability is being exploited to target Windows systems in Ukraine. This vulnerability allows attackers to take control of systems when users interact with malicious URL files delivered through phishing emails.

Cyware Daily Threat Intelligence, November 13, 2024

From deceptive apps to vulnerabilities and developer-targeted tools, attackers are exploiting every corner of the digital landscape. SpyNote is posing as a fake antivirus, giving attackers full control over Android devices, stealing credentials, and targeting cryptocurrency users. In its November Patch Tuesday, Microsoft patched 89 security flaws, including two actively exploited vulnerabilities, urging immediate updates. Meanwhile, a new tool named GoIssue is being sold to attackers, allowing bulk theft of developer credentials from GitHub profiles, enabling supply chain attacks.

Top Breaches Reported in the Last 24 Hours

Top Malware Reported in the Last 24 Hours

Top Vulnerabilities Reported in the Last 24 Hours

Top Scams Reported in the Last 24 Hours

Related Threat Briefings

Nov 21, 2024