A newly identified ransomware group, FunkSec, has emerged as a low-cost yet prolific threat, targeting over 80 victims across multiple countries within a month. The group’s tactics include demanding modest ransoms and offering tools for DDoS attacks. FunkSec’s latest ransomware version, FunkSec V1, shows signs of AI-assisted development, adding a layer of sophistication to its operations.

A critical vulnerability has put Aviatrix Controller users at significant risk by allowing unauthenticated remote code execution. The flaw, caused by improper API input handling, exposes cloud enterprise environments to malicious activities. While Aviatrix has released patches, early exploitation suggests attackers have already begun leveraging the vulnerability for broader campaigns.

Cybercriminals are exploiting Apple iMessage’s phishing protection by manipulating users into disabling link-blocking features. Smishing texts urge recipients to reply with Y to re-enable links, bypassing safeguards and exposing victims to malicious websites.

Top Malware Reported in the Last 24 Hours

New ransomware uses AI to develop malware

Check Point has identified a new ransomware group called FunkSec that has targeted over 80 victims in a month, primarily in the U.S., India, Italy, Brazil, Israel, Spain, and Mongolia. The group demands low ransoms and sells stolen data at reduced prices, with some recycled from previous hacktivism campaigns.The group also offers tools for DDoS attacks and remote desktop management. The ransomware group's latest version, FunkSec V1, was uploaded from Algeria and contains elements apparently created with the help of artificial intelligence.

RedCurl drops malware 

The RedCurl APT group has been identified carrying out malicious activities in Canada, utilizing scheduled tasks to execute pcalua.exe for running malicious binaries and Python scripts. Evidence suggests data exfiltration to cloud storage, targeting various industries for long-term data collection. The malware leverages PowerShell and Python for file downloads, encryption, and exfiltration, while also utilizing living-off-the-land techniques to evade detection. The backdoor component, RedLoader, employs obfuscation techniques and encryption to conceal its true purpose. 

Top Vulnerabilities Reported in the Last 24 Hours

PoC released for macOS Sandbox flaw

A security researcher revealed a PoC exploit for CVE-2024-54498, a vulnerability allowing applications to escape the macOS Sandbox. This PoC, shared on GitHub, shows how attackers could gain unauthorized access to sensitive data. The macOS Sandbox is meant to stop applications from accessing files outside their area, protecting users from malware. However, CVE-2024-54498, which has a high severity score of 8. 8, allows bypassing these restrictions. Apple has fixed this vulnerability in recent updates: macOS Sequoia 15.2, macOS Ventura 13.7.2, and macOS Sonoma 14.7.2.

Aviatrix Controller RCE actively exploited

CVE-2024-50603 is a critical code execution vulnerability affecting Aviatrix Controller, rated 10.0 on the CVSS score. This flaw allows attackers without authentication to run commands on the system remotely due to improper handling of input. It has been fixed in versions 7.1.4191 and 7.2.4996. The vulnerability exists within the Aviatrix Controller's API, which improperly processes user parameters, enabling command injection by unauthenticated users. Currently, about 3% of cloud enterprise environments use Aviatrix Controller, and in 65% of those, there is a risk of lateral movement to admin permissions in the cloud. Exploitation was first reported on January 7, with immediate evidence of the vulnerability being attacked. Attackers were found mining cryptocurrency and deploying backdoors, suggesting potential later data exfiltration. 

Top Scams Reported in the Last 24 Hours

Muddling Meerkat’s domain spoofing scams

Infoblox discovered a widespread use of domain spoofing in spam campaigns while investigating a threat actor known as Muddling Meerkat. Multiple spam campaigns were identified, including phishing with QR codes, impersonating brands, extortion, and mysterious financial spam. These campaigns utilized sophisticated domain spoofing techniques to deceive recipients and bypass security measures.

Smishing attacks target iMessage users

Cybercriminals are using a tactic to bypass Apple iMessage's phishing protection by tricking users into re-enabling disabled links. This tactic involves sending smishing texts and asking recipients to reply with "Y" to enable the links. By doing so, the phishing protection is turned off, making the user vulnerable to potential attacks. This attack technique has been in use over the past year, with an increase since the summer. 

New transaction simulation spoofing attack

Threat actors are using a new tactic called transaction simulation spoofing to deceive users into approving fraudulent transactions. This involves luring victims to a fake website that initiates a deceptive "Claim" function, showing a small amount of Ethereum in a transaction simulation. However, a time delay allows the attackers to change the transaction's actual outcome after the user has approved it, resulting in the loss of cryptocurrency from the victim's wallet. This sophisticated attack exploits trusted wallet features.