Cyware Monthly Threat Intelligence, January 2022

The Good

• Researchers from the South Korean Gwangju Institute of Science and Technology (GIST) developed a way to enhance digital security by using silk fibers to generate encryption keys. The paper published by them argues that silk properties could be leveraged to create Physical Unclonable Functions (PUFs). The researchers used a light-reflecting mirror, three light-emitting diodes, and an image sensor to capture patterns of light reflected off the silk to build a security tag pattern.
• The White House, CISA, and Environmental Protection Agency (EPA) launched a 100-day plan to strengthen the cybersecurity of the nation’s water systems. Dubbed the Industrial Control Systems Cybersecurity Initiative—Water and Wastewater Sector Action Plan, the plan will develop a task force of water utility industry leaders, boost incident monitoring pilot programs, offer technical support to water systems in distress, and enhance information sharing. 
• Researchers from the University of California, Santa Barbara, (UCSB) developed a scalable technique to scrutinize smart contracts and remove state-inconsistency vulnerabilities. The process assisted them in identifying 47 zero-day bugs in the Ethereum blockchain. Dubbed Sailfish, the technique audits the smart contract’s source pre-deployment and delivers a bug-free contract as smart contracts are not readily upgradable. 
• The U.S. Cyber Command announced a partnership with 84 colleges and universities from 34 states and the District of Columbia to bridge the cybersecurity talent gap in the U.S. military. The partners include nine minority-serving institutions, 13 community colleges, 69 universities, four military war and staff colleges, and four military service academies. 

The Bad

• Dozens of Ukrainian government websites were defaced by Russian cybercriminals. The defaced websites were displayed with messages written in Russian, Ukrainian, and Polish languages. The campaign abused compromised Content Management Systems (CMS) to disseminate fake news.
• DeFi platform Qubit Finance witnessed a loss of $80 million in BNB coins after cybercriminals exploited a bug in the firm’s network system. Meanwhile, Crypto[.]com revealed missing $31 million in crypto funds from the wallets of 483 individuals.
• A large-scale cyberespionage campaign, active since at least 2019, is targeting renewable energy and industrial technology organizations. Threat actors behind the campaign used legitimate websites, DNS scans, and public sandbox submissions to steal the login credentials of employees. The targeted organizations include Schneider Electric, Honeywell, Huawei, Telekom Romania, University of Wisconsin, Utah State University, and Taiwan Forestry Research Institute, among others.
• Marketing giant RR Donnelly (RRD) underwent a Conti ransomware attack that disrupted the IT systems, making its customers unable to receive printed documents required for vendor payments, disbursement checks, and motor vehicle documentation. The attackers claimed responsibility and leaked 2.5GB of the stolen data.
• Finland’s National Cyber Security Centre (NCSC-Fi) warned of an ongoing phishing campaign trying to take over Facebook accounts by pretending to be the victims’ friends in Messenger chat. The agency stated that Facebook users who received texts from online acquaintances for their phone numbers and verification number are victims of the scam. 
• An AWS S3 bucket leak affected the sensitive data—API keys, user data, internal messaging systems, and cloud systems—of gaming giant SEGA. in addition to this, other leaked data include multiple sets of AWS keys providing access to all of SEGA Europe’s cloud systems, MailChimp and Steam API keys, and hundreds of thousands of the Football Managers forum members’ data. 
• A report by New York’s OAG states that around 17 well-known online retailers, restaurant chains, and food delivery services were targeted in credential stuffing attacks over the past several months. The OAG confirmed the attacks after investigating thousands of posts containing credentials of more than 1.1 million customer accounts.
• Nearly 70 investors fell victim to a long-running internet-based fraud operation that tricked them with various investment opportunities. The victims were directed to 150 different fraudulent sites as a part of the scam carried out by a cybercriminal posing as FINRA broker-dealers. The scam went on for eight long years and the attackers gained over $50 million from the investors. 
• Finalsite, a U.S.-based digital marketing and communications solutions provider to schools, suffered a ransomware attack resulting in thousands of school websites going offline. Around 8,000 schools across 110 countries are claimed to use services provided by the company. However, no evidence of data theft has yet been found. 
• A ransomware attack led to an unplanned lockdown of the Metropolitan Detention Center, Bernalillo County, New Mexico. The attack impacted the local government systems, including the ones used to manage the prison. It is suspected that the attack corrupted several databases, including an incident tracker.
• French cosmetic company Clarins was hit by a data breach that affected the personal information of Singapore customers. The incident occurred as the company failed to patch the Log4Shell vulnerabilities on time. The data affected include names, addresses, email, phone numbers, and loyalty program status of customers.
• Around 50 top-notch FIFA Ultimate Team traders were the subjects of a cyberattack, in which the attackers made off with the victims’ FIFA points and coins. Electronic Arts (EA) blamed the attack on human error that resulted in the loss of access to accounts and thousands of dollars of in-game currency for the victims. 
• Around 39 million patient records leaked from Bangkok-based Siriraj Hospital have been offered for sale on a dark web forum. These records contain names, addresses, Thai IDs, phone numbers, gender details, and dates of birth of users. Some of the data also belongs to the Siriraj Piyamaharajkarun Hospital, containing records of VIP patients.
• A malicious 2FA Authenticator app was removed from the Google Play Store after over 10,000 downloads. The fully functional app came loaded with the Vultur stealer, aiming to steal financial and banking information from the victims. By asking for extra permissions, the scam app was also able to access user location data, disable password and device lock security, and take control of the device even if it is switched off.

New Threats

• A new Linux version of the AvosLocker ransomware that targets VMware ESXi servers has been spotted by researchers. Once launched on a Linux system, the ransomware terminates all ESXi machines on the server. Later it begins the encryption process and appends the .avoslinux extension to the encrypted files.
• Konni RAT received significant updates and is being actively developed. Its evasion capabilities have been upgraded. The malware has also transitioned from base64 encoding to AES encryption to its string for obfuscation purposes. Moreover, some samples were found using an unknown packer, however, it has not been observed in real-world scenarios yet. 
• MoonBounce, a new firmware bootkit, is found quite active in the wild. The bootkit is being used by the APT41 threat actor group in targeted attacks. It hides in a computer’s Unified Extensible Firmware Interface (UEFI) firmware, making it hard for proprietary security products to spot.
• The Android malware BRATA has upgraded its features to perform a factory reset on compromised devices to wipe all traces of malicious activity. The malware has three new strains that have targeted online banking users in the U.K, Poland, Italy, Spain, China, and Latin America. Some new capabilities added to the new variants include keylogging functionality and GPS tracking.
• A new multi-platform backdoor, named SysJoker, was spotted targeting Windows, Mac, and Linux has been discovered by researchers. The malware was first discovered in December 2021 during an active attack against a leading educational institution. It masquerades as a system update and generates its C2 by decoding a string retrieved from a text file hosted on Google Drive.
• Researchers tracked a new ransomware family, named White Rabbit, that targeted a local U.S. bank in December 2021. The new malware borrows some of its features from Egregor ransomware and researchers suspect a connection to the FIN8 APT gang. The ransomware uses a double extortion strategy to threaten its victims.
• A threat actor named MalSmoke was found exploiting Microsoft’s digital signature verification method to deploy Zloader malware. Active since November 2021, the campaign has affected thousands of victims from 111 countries and is being used to steal user credentials. The attackers used legitimate Remote Management software named Atera to gain initial access to the target machine.
• A new malware, dubbed DazzleSpy, came to light during the investigation of a watering hole attack targeting Windows and Android users. ESET researchers found that the group also targeted macOS users and visitors of a pro-democracy radio station website in Hong Kong. Moreover, the attackers had exploited a WebKit flaw in Safari as part of the infection chain.
• A new ransomware, dubbed Night Sky, has been targeting corporate networks and exfiltrating data, with double extortion tactics. The attack started on December 27, 2021, and the group has already published the data of two victims.
• Researchers demonstrated a new PoC that fakes reboot of iPhones to stop malware from being removed from the device. Named NoReboot, the PoC enables threat actors to collect sensitive information and snoop on microphones. It is a persistence tactic that interrupts the normal rebooting process to delete malicious activity from memory.
• There was a new crypto scam exploiting the Amazon brand to lure potential investors into handing over Bitcoins. The campaign posted fake social media news in cryptocurrency-related groups. Clicking on the post redirected victims to a fake CNBC Decoded website that had an article about soon-to-be-released Amazon crypto token. 
• A new email phishing campaign was found tricking users with a fake McAfee antivirus subscription. The email appeared to come from McAfee and notified recipients about an expired subscription. The lure aimed to create a sense of urgency by offering the users a huge discount on a new subscription for a limited period of time.