We use cookies to improve your experience. Do you accept?

Cyware Announces Healthcare TIP

•

Check it Out

Skip to main content

Cyware Daily Threat Intelligence, December 12, 2024

shutterstock_1679249305

Daily Threat Briefing • Dec 12, 2024

Malware threats continue to evolve, targeting both enterprises and individual developers. Zloader’s latest variant leverages a custom protocol for DNS tunneling and advanced anti-analysis features. Meanwhile, a typosquatting attack tricked developers by mimicking the popular TypeScript ESLint plugin’s NPM package, enabling clipboard monitoring and persistence on compromised systems.

Researchers revealed details about the AuthQuake vulnerability affecting Microsoft’s MFA system, leaving critical services like Outlook, Teams, and Azure exposed to brute-force attacks. Meanwhile, Siemens Healthineers issued a hotfix to address an SQL injection flaw in its syngo.plaza software that allowed database compromise.

Phishing campaigns are becoming increasingly elaborate, with "Aggressive Inventory Zombies (AIZ)" impersonating major retailers like Amazon, Etsy, and eBay, and crypto platforms like Binance and Kraken. The phishing network preyed on unsuspecting users using fake sites and fraudulent chat support.

Top Malware Reported in the Last 24 Hours

Ukrainian Military Devices Hit With Custom Malware

Microsoft warned of the Russian APT Secret Blizzard using tools from other cybercrime gangs to assist the Kremlin's military actions in Ukraine by installing custom malware on Ukrainian military devices. This cyber-espionage gang has targeted foreign ministries, embassies, and defense sectors globally. From March to April 2024, they used Amadey bots to deploy their Tavdig backdoor on targeted Ukrainian military devices.

Latest Zloader Variant Enhances Evasion

Zloader, a trojan linked to Zeus malware, has evolved again, with a new version 2.9.4.0 featuring a custom DNS tunneling protocol for C2 communication. Originally designed for banking fraud, Zloader is now used for ransomware attacks. The new version offers enhanced anti-analysis techniques and an interactive shell for executing commands. It also employs targeted distribution methods, connecting it with Black Basta ransomware attacks.

Rogue NPM Package Imitates ESLint Plugin

A new report revealed a typosquatting attack aimed at developers using the popular  TypeScript ESLint plugin. Attackers published a malicious NPM package, @typescript_eslinter/eslint, to infect developers’ systems. The package enabled clipboard and keyboard monitoring, and establishing persistence on compromised systems.

Windows UI Framework Abused to Avoid EDR Tools

A new malware technique uses a Windows accessibility system called UI Automation (UIA) to perform rogue actions without being detected by security software. Users can be tricked into running a UIA program, which can execute commands, access sensitive data, and redirect browsers to phishing sites. This method can also affect messaging apps and manipulate UI elements over a network. It can be abused to read messages, steal data, and execute harmful redirects.

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft Azure MFA Flaw Fixed

Researchers revealed a major flaw in Microsoft's Multi-Factor Authentication (MFA) system that could let hackers circumvent key security defenses, and obtain access to Outlook, OneDrive, Teams, and Azure Cloud. The exploit relied on defects within the time-based one-time password (TOTP) system that Microsoft employs as part of its MFA procedure, which presents users with a six-digit code that changes every 30 seconds. However, Microsoft’s system enforces inadequate rate limits, letting hackers guess the codes relentlessly. A temporary fix was issued on July 4, followed by a permanent remedy on October 9.

WordPress Sites Exposed to Two Critical Bugs

Hackers have been abusing two critical security bugs in the Hunk Companion (CVE-2024-9707) and WP Query Console (CVE-2024-50498) WordPress plugins to obtain persistent backdoor access to vulnerable websites. The former causes remote code execution (RCE) while the latter enables website takeover. Installing Hunk Companion version 1.9.0 and checking websites for unauthorized installation of WP Query Console or other WordPress plugins is advised.

SQL Injection Flaw Impacts syngo.plaza VB30E

A critical unauthenticated SQL injection flaw, CVE-2024-52335, exists in the Siemens Healthineers syngo.plaza VB30E medical imaging software. The flaw affects all versions below VB30E_HF05 and arises from improper sanitization of input data before it is sent to the SQL server. Adversaries with access to the application could execute rogue SQL commands and compromise the entire database. A new hotfix (HF05) addresses this flaw.

Critical Apache Struts Flaw Causes RCE

A critical security flaw, CVE-2024-53677, lies in the file upload logic of Apache Struts versions 2.0.0 through 2.5.33, and 6.0.0 through 6.3.0.2. Intruders can manipulate file upload parameters to enable path traversal and remote code execution. The flaw has been remediated in version 6.4.0, however, developers need to migrate to a new file upload mechanism to protect the vulnerable instances of Apache Struts.

Top Scams Reported in the Last 24 Hours

Researchers uncover AIZ campaign

Researchers observed suspicious domains impersonating brands like Etsy in a widespread phishing and pig-butchering network targeting retail brands and a crypto phishing campaign. The retail phishing campaign, dubbed "Aggressive Inventory Zombies (AIZ)," targets major retailers and marketplaces, like Amazon, BestBuy, eBay, Wayfair, Costco, Rakuten, etc, and also targets crypto audiences from Binance, Kraken, etc. The operators behind this campaign have been creating phishing sites using a popular website template and integrating chat services for phishing activities. It's believed that the threat actor has some financial ties to India.

Related Threat Briefings

Dec 20, 2024

Cyware Daily Threat Intelligence, December 20, 2024

Disguised as a harmless health tool, the BMI CalculationVsn app hid its sinister purpose within the Amazon Appstore. The spyware recorded screens, intercepted sensitive SMS messages, and scanned installed apps, leaving users vulnerable before its removal. However, traces of the app may still linger, necessitating manual removal and device scans. A critical vulnerability in BeyondTrust's Privileged Remote Access products landed on CISA's KEV catalog after reports of active exploitation. Tracked as CVE-2024-12356, the flaw enables attackers to execute commands as a site user, with patched updates now available for self-hosted installations. Copy-paste commands are no longer innocent. Threat actors have weaponized clipboard activity, tricking users into running malicious PowerShell scripts under the guise of software notifications. By exploiting trusted brands and Cloudflare tunnels, they discreetly deploy malware while bypassing conventional defenses.

Dec 19, 2024

Cyware Daily Threat Intelligence, December 19, 2024

Cybercriminals are pushing the boundaries of their operations, exploiting vulnerabilities in both devices and software ecosystems to widen their reach. The BADBOX botnet, thought to be dismantled, has made a troubling comeback, infecting over 192,000 Android-based devices worldwide. Expanding its scope, BADBOX now compromises high-end smart TVs and smartphones at the supply chain level. Juniper Networks routers are under siege in a botnet campaign deploying the Mirai malware. Exploiting default credentials, the malware scans the internet for vulnerable devices, infecting systems to launch DDoS attacks and execute malicious commands remotely. Juniper strongly advises users to change default passwords, monitor devices for unusual activity, and update firmware. Infected systems require reimaging to fully eradicate the threat. Fortinet has issued urgent patches for critical vulnerabilities in its products, including FortiClient VPN, FortiManager, and FortiWLM. The flaws allow attackers to extract VPN passwords, execute remote code, and access sensitive files. With millions of users at risk, Fortinet urges immediate upgrades to secure versions, highlighting the importance of proactive vulnerability management in today’s threat landscape.

Dec 18, 2024

Cyware Daily Threat Intelligence, December 18, 2024

Cybercriminals are weaving new layers of deception, blending sophisticated delivery methods with innocuous-looking themes. The FLUX#CONSOLE phishing campaign has been targeting Pakistan with tax-themed lures to deliver a stealthy backdoor. I2PRAT, a malware leveraging the I2P network, is redefining stealth by enabling encrypted, anonymous communication between attackers and infected systems. Delivered through phishing emails that lead to malicious CAPTCHA pages, I2PRAT installs a RAT while disabling system defenses like Microsoft Defender. Meanwhile, vulnerabilities in Apache Tomcat are raising alarms. A critical flaw allows remote code execution via the default servlet, while a DoS vulnerability affects the "examples" web app. The Apache Software Foundation urges users to update to the latest versions to safeguard against these risks. Adding to the chaos, Google Calendar spoofing campaigns have targeted 300 organizations, using altered headers to lure victims into phishing traps. Fake links to Google Forms and Drawings masquerade as cryptocurrency services, stealing personal and financial data from unsuspecting users.

Dec 17, 2024

Cyware Daily Threat Intelligence, December 17, 2024

Cybercriminals are doubling down on exploiting overlooked vulnerabilities, turning common devices and platforms into tools for covert operations. The FBI issued a warning about HiatusRAT attacks that target web cameras and DVRs, especially Chinese-branded devices with weak passwords and known flaws. Unit 42 researchers uncovered critical vulnerabilities in Azure Data Factory's Apache Airflow integration, exposing cloud infrastructure to potential compromise. Flaws like misconfigured Kubernetes RBAC and mishandled Geneva secrets could allow attackers to exfiltrate data, deploy malware, and gain unauthorized control. Meanwhile, Guardio Labs identified a malvertising campaign called DeceptionAds, responsible for over one million daily ad impressions. The attackers exploit a single ad network to spread fake CAPTCHA prompts, tricking users into running harmful PowerShell commands.

Dec 16, 2024

Cyware Daily Threat Intelligence, December 16, 2024

The ever-evolving threat landscape continues to target unsuspecting users across industries and platforms. A SocGholish malware campaign recently set its sights on Kaiser Permanente employees, leveraging fraudulent Google Search Ads masquerading as an HR portal. Meanwhile, the Chinese hacking group Winnti has unleashed a new modular backdoor named Glutton, targeting industries in both China and the U.S. This advanced ELF-based backdoor not only enables tailored cyberattacks but also infiltrates other threat actors’ systems by embedding itself in software packages. Ruijie Networks faced scrutiny as researchers uncovered 10 vulnerabilities in its Reyee cloud management platform and OS devices. Among these flaws is Open Sesame, allowing attackers near a Ruijie access point to exploit its cloud connection and infiltrate internal networks. Though Ruijie has patched these vulnerabilities at the cloud level, the findings emphasize the growing risks associated with cloud-enabled devices. Even content creators are under siege, as over 200,000 YouTubers have been targeted in a phishing campaign that mimics major brands. Cybercriminals lure victims with fake collaboration emails containing malware-laden attachments designed to steal credentials and grant remote system access.

Dec 13, 2024

Cyware Daily Threat Intelligence, December 13, 2024

Malware’s relentless evolution continues to shape the cyber landscape, with threat actors pushing boundaries in espionage and infrastructure disruption. Two spyware families, BoneSpy and PlainGnome, linked to the Russian group Gamaredon, have been identified as tools of surveillance. Both spyware families enable extensive data collection, reinforcing Gamaredon’s focus on espionage. Iranian cyber actors have unleashed IOCONTROL malware to compromise IoT and OT/SCADA systems in critical infrastructure. By exploiting routers and fuel management systems, this malware poses a serious threat to key infrastructure in Israel and the U.S. IOCONTROL is capable of executing commands, sending system information, and even self-deleting to avoid detection, highlighting the increasing risks tied to interconnected devices. Cleo has urged its customers to immediately patch their file-sharing products after the discovery of a vulnerability affecting widely used systems. Despite an earlier patch, the flaw remains exploitable. With exploitation reports rising, firms must secure their systems to mitigate risks associated with this critical bug.

Dec 11, 2024

Cyware Daily Threat Intelligence, December 11, 2024

Privacy breaches wear a new mask as EagleMsgSpy, a stealthy spyware tool linked to Chinese law enforcement, was spotted. Active since 2017, this Android-based tool silently intercepts messages from apps like WhatsApp and WeChat, gathering extensive user data and transmitting it securely to C2 servers, raising alarms over state-sponsored surveillance. Microsoft delivered its December 2024 Patch Tuesday, addressing 71 vulnerabilities. Among the fixes is an actively exploited zero-day in the Windows Common Log File System Driver, alongside critical flaws across Remote Desktop Services, Edge, and SharePoint. Scammers turned UAE’s National Day into a playground for fraud, as the Smishing Triad exploited the celebratory buzz. Impersonating law enforcement, these fraudsters used phishing and smishing to manipulate victims, raking in financial gains while exploiting the festive spirit to lower guards.

Dec 10, 2024

Cyware Daily Threat Intelligence, December 10, 2024

Digital trust took a hit in Southern Asia as WhatsApp became the delivery vector for a sophisticated SpyNote RAT campaign targeting high-profile individuals. Disguised as seemingly benign apps like “Best Friend,” the malware exploited accessibility settings to gain deeper control over devices, enabling location tracking and the reading of text messages. OpenWrt narrowly avoided a potential security catastrophe with a critical flaw in its Attended Sysupgrade feature. The vulnerability, involving command injection and hash truncation, could have allowed attackers to distribute harmful firmware packages to network devices. Meanwhile, cybercriminals launched a new phishing campaign to spread the AppLite Banker malware, targeting Android devices through fake job applications. Masquerading as recruiters from trusted companies, the attackers directed victims to fraudulent websites where they were tricked into downloading a fake CRM app.

Dec 9, 2024

Cyware Daily Threat Intelligence, December 09, 2024

In a stark reminder of supply chain vulnerabilities, cybercriminals turned a trusted AI library into a covert delivery system for malware. A supply chain attack on the popular ultralytics AI library injected malicious code into two versions, distributing a crypto coinminer and creating backdoor access to compromised environments. Bitcoin's Lightning Network faced a storm of uncertainty. A newly disclosed vulnerability can expose the network's transaction-relay mechanism to jamming attacks, risking financial losses and degraded stability. The flaw allows malicious actors to disrupt Lightning channels, highlighting the fragile intersection of innovation and security in blockchain technologies. Deception ran deep in a phishing campaign against Ukraine's defense sector. Threat group UAC-0185 used emails advertising a fake NATO conference to infect systems with malware. By deploying a remote management program, the attackers gained unauthorized access to messaging and military systems, aiming to compromise Ukraine's security infrastructure.

Dec 6, 2024

Cyware Daily Threat Intelligence, December 06, 2024

BlueAlpha sharpened its arsenal by exploiting Cloudflare Tunnels to obscure its malware staging infrastructure. The Russian-backed group deployed GammaDrop malware against Ukrainian organizations, using advanced techniques like HTML smuggling to bypass email filters and DNS fast-fluxing for stealthy command-and-control. Mitel MiCollab’s unresolved vulnerability exposed enterprises to potential cyber risks despite earlier patches. While two critical flaws, including an authentication bypass, were fixed, a lingering arbitrary file read vulnerability remains open after over 100 days without a vendor-provided solution. Manufacturing firms have become the latest victims of a multi-stage malware campaign. Threat actors disguised malicious LNK files as PDFs, leveraging LOLBins and PowerShell commands to bypass security. The attack deploys tools like Lumma stealer and Amadey bot to siphon sensitive data.

Dec 5, 2024

Cyware Daily Threat Intelligence, December 05, 2024

Earth Minotaur is turning Android messaging apps into silent spies, using the MOONSHINE exploit kit to infiltrate Tibetan and Uyghur communities. With over 55 active servers, the group deploys the DarkNimbus backdoor for comprehensive surveillance across Android and Windows devices. Their tactics extend to compromising WeChat and leveraging social engineering to lure victims into clicking malicious links. Critical flaws in Lorex 2K Indoor Wi-Fi Security Cameras have exposed live feeds to potential attackers, prompting urgent updates. Researchers highlighted vulnerabilities allowing authentication bypass, admin control resets, and remote code execution. Affected users must install the mandatory firmware update to safeguard their devices against malicious takeovers. The National Tax Service has become the latest disguise in a surge of phishing campaigns targeting unsuspecting users. Impersonating the NTS, attackers employ malicious DLL and CHM files to distribute malware, exploiting tax-related topics to deceive victims and compromise systems.

Dec 4, 2024

Cyware Daily Threat Intelligence, December 04, 2024

Attackers struck at the heart of Solana’s Web3.js library, turning a trusted tool for decentralized applications into a weapon for stealing private keys and cryptocurrency funds. Versions 1.95.6 and 1.95.7 were compromised for five hours before being replaced with a clean update but the ripple effects may still endanger third-party tools managing private keys. A single filename was all it took to unravel security in MobSF. A Stored XSS vulnerability in feature allowed malicious scripts embedded in filenames to bypass security and execute harmful actions. Users of version 4.2.8 are urged to patch their systems without delay. Cloudflare’s trusted domains became a haven for cybercriminals as phishing campaigns skyrocketed. With phishing incidents up 198% this year, attackers are using these platforms to disguise their scams and target thousands of unsuspecting users globally.