Earth Minotaur is turning Android messaging apps into silent spies, using the MOONSHINE exploit kit to infiltrate Tibetan and Uyghur communities. With over 55 active servers, the group deploys the DarkNimbus backdoor for comprehensive surveillance across Android and Windows devices. Their tactics extend to compromising WeChat and leveraging social engineering to lure victims into clicking malicious links.

Critical flaws in Lorex 2K Indoor Wi-Fi Security Cameras have exposed live feeds to potential attackers, prompting urgent updates. Researchers highlighted vulnerabilities allowing authentication bypass, admin control resets, and remote code execution. Affected users must install the mandatory firmware update to safeguard their devices against malicious takeovers.

The National Tax Service has become the latest disguise in a surge of phishing campaigns targeting unsuspecting users. Impersonating the NTS, attackers employ malicious DLL and CHM files to distribute malware, exploiting tax-related topics to deceive victims and compromise systems.

Top Malware Reported in the Last 24 Hours

Earth Minotaur uses MOONSHINE and DarkNimbus

The Earth Minotaur threat group has been using the MOONSHINE exploit kit to target vulnerabilities in Android messaging apps and compromise the devices of Tibetan and Uyghur communities. The kit has over 55 identified servers and has been updated to include newer exploits. Earth Minotaur uses it to install the DarkNimbus backdoor for surveillance on both Android and Windows devices. The backdoor is used to steal a wide range of data, and the group uses social engineering tactics to entice victims to click on malicious links. MOONSHINE has also been used to compromise WeChat.

New DroidBot targets banking and crypto apps

A new Android banking malware called DroidBot targets over 77 cryptocurrency exchanges and banking apps. Despite its lack of unique features, DroidBot's botnets show 776 unique infections across the U.K, Italy, France, Spain, and Portugal. The malware has been active since June 2024 and operates as a MaaS platform, with affiliates customizing the tool for specific targets. DroidBot uses keylogging, overlaying, SMS interception, and VNC capabilities to steal sensitive information. It also abuses Android's Accessibility Services. Cleafy has identified at least 17 groups using this malware to customize attacks for specific targets. 

Top Vulnerabilities Reported in the Last 24 Hours

Android December 2024 security update

Google announced patches for 14 high-severity vulnerabilities as part of Android’s December 2024 security update, including a critical RCE flaw in the System component. The first part of the update, labeled as the 2024-12-01 security patch, fixes six security defects in the Framework and System components, five of which could let attackers elevate their privileges. The most severe issue, tracked as CVE-2024-43767, allows remote code execution without needing additional privileges. The second part of the update, arriving on devices as the 2024-12-05 security patch level, resolves these six flaws and eight additional vulnerabilities in other components. 

Five bugs in Lorex 2K security cameras

Rapid7’s found critical vulnerabilities in the Lorex 2K Indoor Wi-Fi Security Camera, which allow attackers to compromise the cameras, accessing live feeds and executing harmful code remotely. The five vulnerabilities are categorized in two phases. Phase 1 includes a critical authentication bypass (CVE-2024-52544) and two medium-level issues (CVE-2024-52545 and CVE-2024-52546) that let attackers reset the admin password and gain control. Phase 2 focuses on remote code execution (CVE-2024-52547 and CVE-2024-52548), allowing attackers with admin access to execute commands and potentially install malware. Affected Lorex models require a mandatory firmware update (V2.800.0000000.8.R.20241111) to fix the issues, which users must install via the Lorex app.

Top Scams Reported in the Last 24 Hours

Phishing emails mimic National Tax Service

The National Tax Service (NTS) is facing a significant increase in phishing emails, with threat actors impersonating the NTS to distribute malware. These phishing emails use various file formats, such as DLL and CHM, to execute malicious behaviors. The DLL files distribute a legitimate file with a changed name, ultimately performing malicious functions. The CHM files contain a malicious script and access specific URLs to execute various functions. Threat actors are continuously exploiting topics like tax payments to trick users.

Payroll Pirates: payroll redirection scam

A threat group called Payroll Pirates is conducting a payroll redirection phishing scam targeting employees, particularly from Workday customers. The group uses various tactics, including buying search ads with brand keywords to direct users to sponsored phishing websites and using website builders to create domains quickly. The analysts have identified numerous domains primarily aimed at high-profile organizations like the California Employment Development Department, Kaiser Permanente, Macy’s, New York Life, and Roche. The scam involves luring individuals to fake HR pages to gain access to employee portals. Once the scammers obtain credentials, they can redirect payroll funds to accounts they control.