In the sprawling labyrinth of the digital web, cybercriminals have co-opted Facebook’s business pages and advertisements, masquerading counterfeit Windows themes and illicitly pirated games. Their payload? The SYS01 info-stealer.

Enter Void Banshee, a shadowy syndicate leveraging a zero-day vulnerability, nestled within Microsoft’s MSHTML browser engine. Exploiting vulnerable Internet Explorer elements, the attackers deploy the Atlantida stealer in a sophisticated, multi-phased assault. The attack is initiated through URL files and meticulously crafted spear-phishing emails.

Simultaneously, a new phishing campaign has been pretending to be an urgent communiqué from an HR department, with its subject line meticulously designed to evoke a sense of immediacy. The end goal entails stealing the victims’ credentials.

Top Malware Reported in the Last 24 Hours

MirrorFace targets Japanese organizations

JPCERT/CC has observed attack activities by the MirrorFace threat actor that has shifted its targets from media, political organizations, think tanks, and universities to manufacturers and research institutions. The actor uses spear-phishing emails and exploits vulnerabilities in external assets to infiltrate target networks. It, furthermore, leverages the NOOPDOOR malware that can be executed through an XML file (Type1) or a DLL file (Type2), and has various functions such as communicating over port 443, receiving commands via TCP port 47000, and altering file timestamps.

SEXi ransomware rebrands to APT INC

The SEXi ransomware operation, known for targeting VMware ESXi and Windows servers, has rebranded as APT Inc. and continues to use the leaked Babuk and LockBit 3.0 encryptors in recent attacks. It has targeted organizations such as IxMetro Powerhost, encrypting servers and demanding large ransom amounts. Victims are assigned random names and are directed to contact the threat actors using Session, an encrypted messaging application. Ransom demands vary from tens of thousands to millions.

Facebook ads drop info-stealer

Cybercriminals are using Facebook business pages and advertisements to promote fake Windows themes, pirated games, and software that infect users with the SYS01 password-stealing malware. The threat actors target a wide audience and hijack existing Facebook pages to promote their fraudulent ads. The malware steals sensitive data, including Facebook cookies and passwords, which can be sold or used for further breaches. Similar campaigns have also been observed on LinkedIn and YouTube.

Top Vulnerabilities Reported in the Last 24 Hours

Void Banshee exploits MHTML bug

A threat group called Void Banshee used a zero-day vulnerability, CVE-2024-38112, in the Microsoft MSHTML browser engine to exploit disabled Internet Explorer remnants and infect users with the Atlantida stealer. The vulnerability is being used in a multi-stage attack chain involving URL files and spear-phishing emails. The attackers targeted victims in North America, Europe, and Southeast Asia by distributing malicious files disguised as book PDFs via cloud-sharing websites, Discord servers, and online libraries.

Critical flaw in Cellopoint SEG

A critical vulnerability, CVE-2024-6744, has been found in the Cellopoint Secure Email Gateway, with a high CVSS score of 9.8. The vulnerability allows remote attackers to execute arbitrary system commands due to improper input validation, potentially compromising the entire email infrastructure. The vulnerability resides in the SMTP Listener component of the Secure Email Gateway, specifically in versions before 4.5.0. The flaw stems from improper user input validation, leading to a buffer overflow condition. Cellopoint has released a patch to address the issue, and organizations are urged to install it immediately.

?Top Scams Reported in the Last 24 Hours

Phishing attack targets employees

Cofense warned about a sophisticated phishing tactic that appears to be an official communication from a company’s HR department, with a subject line that creates a sense of urgency for employees to review a revised employee handbook. The email contains a link that redirects the victim to a page mimicking a legitimate document hosting site, where they are prompted to click a PROCEED button. Clicking the PROCEED button takes the victim to a fake Microsoft login page, where their username and password are captured by the threat actors.