Cyware Monthly Threat Intelligence, September 2022

The Good

• The European Union started working on a set of new cybersecurity rules for IoT vendors that are expected to come into effect by 2024. Some of the rules mandate frequent testing of devices for vulnerabilities, encryption of confidential data, and application of security updates regularly. Companies failing to comply with the rules may risk fines of 2.5% of their annual turnover or €15 million (~$15.07 million). 
• The NSA published requirements for quantum-resistant algorithms that need to be implemented by vendors and operators of national security systems. The process aims to secure the classified information that is critical for military and intelligence activities.
• The CISA announced the release of its 2023–2025 strategic plan that aims to focus on reducing risk and building resilience to cyber threats to the nation’s infrastructure. The plan is built on the foundation of CISA Strategic Intent, published in 2019. 
• The Biden Administration launched a cyber grant program of up to $1 billion for state and local governments to fortify their digital defenses. The program will be administered by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA). 

The Bad

• The FBI issued an alert about hackers targeting healthcare payment processors to route payments to their bank accounts. This year, threat actors have stolen more than $4.6 million from healthcare companies. In another alert, the agency warned the sector that threat actors are continuing to exploit unpatched and outdated medical devices. 
• Threat actors were found leveraging hacked Facebook business pages to spread RedLine Stealer. These accounts belonged to a Brazilian ISP, Mexican sporting goods store, a mountain tourism site in Slovakia, and a computer repair shop in the Philippines. The malware is available on dark web forums for about $100 to $150. 
• Around 20,000 accounts associated with The North Face outdoor apparel brand were compromised in a credential stuffing attack. These accounts included personal information, such as full names, billing addresses, shipping addresses, telephone numbers, and XPLR Pass reward records of users.
• Cryptocurrency market maker Wintermute was breached, with attackers stealing $162.5 million worth of cryptocurrency from the company’s DeFi business. The hackers exploited a privileged function with the private key leak to replace a swap contract with their contract. This is the fifth largest cryptocurrency theft, so far, this year.
• A hacker claimed to have pilfered 2 billion TikTok records, including 760GB of user data. While security analysts confirmed the breach, the social media platform denied any such incident. Meanwhile, TikTok shot back at reports of the breach.
• Researchers at Mandiant and Microsoft have linked a series of cyberespionage attacks targeted against the Albanian government. Microsoft reported four different Iranian APTs—DEV-0842, DEV-0861, DEV0166, and DEV-0133—were involved in these attacks that were believed to be active since 2021.  
• Lorenz ransomware group exploited a flaw in MiVoice Connect’s Mitel Service Appliance component to gain access to a corporate network. The attackers waited for a month after gaining initial access and then performed lateral movement. They utilized FileZilla for data exfiltration and performed encryption through BitLocker.
• Classified NATO documents belonging to the Armed Forces General Staff agency of Portugal (EMGFA) were put on sale on the dark web. The stolen documents were spotted by the U.S. Information Services, after which it alerted the Portuguese authorities by informing the U.S. embassy in Lisbon. 
• Threat actors exploited an unauthorized access vulnerability to target over 39000 Redis servers to deploy XMRig cryptominer. Most of the vulnerable Redis servers were located in China, followed by Germany and Singapore.
• Australia-based telecommunications provider Optus notified that it is dealing with a cyberattack that affected customers’ personal data. The information exposed include names, dates of birth, phone numbers, ID document numbers, and email addresses of customers. 
• Hive ransomware claimed an attack on the New York Racing Association (NYRA). The attack took place on June 30, and resulted in the exfiltration of customers’ data such as their Social Security Numbers, health records, and health insurance information.  
• Multiple npm packages published by crypto exchange dYdX, and used by at least 44 cryptocurrency projects, were compromised to run infostealers on systems. The infostealer was used to steal AWS IAM credentials, SSH keys, and GitHub tokens. 
• DeFi cryptocurrency platform BXH suffered a loss of around $40,000 due to a flash loan attack. This is the second time that the organization was attacked after losing an amount of nearly $2.5 million in a hack that occurred on September 23.

New Threats

• A newly found NullMixer malware dropper is being used to drop a variety of malware such as RedLine Stealer, Vidar, SmokeLoader, PsuedoManuscrypt, and Danbot. The malware dropper spreads via malicious websites found on search engines. These websites are related to cracks, keygens, and activators for downloading software illegally.
• Black Lotus Labs detected a multifunctional Go-based malware, dubbed Chaos, purposed to target a wide range of devices, including small office/home office (SOHO) routers and enterprise servers. The malware samples were likely written by Chinese actors, and rely on a China-based C2 infrastructure, with key attack features being DDoS and cryptomining. Most of its bot infections were located in Europe, specifically Italy.
• Sucuri discovered a campaign using fake Cloudflare CAPTCHA dialog boxes to trick users into downloading and installing malware on their devices. The malware used in the attack enabled threat actors to gain full access to systems, paving the way for a ransomware infection or banking trojan attack.
• The Witchetty espionage group has been progressively updating its toolset to target government sectors in the Middle East and Africa. Among the new tools used by the group is a backdoor named Stegmap. The malware is distributed via the rarely used steganography technique. 
• Fancy Bear hacking group used a new code execution technique that exploits mouse movement in PowerPoint files to distribute the Graphite malware. The group leveraged the SyncAppvPublishingServer utility for this purpose.
• The builder for the LockBit 3.0 ransomware was leaked on Twitter, which will likely lead to a rise in other threat actors using it to launch their own attacks. The builder can allow anyone to quickly build the executables required to launch their own ransomware operation, including an encryptor, decryptor, and specialized tools to launch the decryptor in certain ways. The recently formed Bl00Dy ransomware group was found using the leaked builder in its recent attacks.
• A new APT group called Metador has been found targeting telcos, internet service providers, and universities across the Middle East and Africa. The threat actor uses two malware platforms to target Windows systems, along with at least one Linux implant. 
• OriginLogger, also known as Agent Tesla v3, is a new variant of the Agent Tesla keylogger malware. It is distributed via a Microsoft Word document containing a passport-size photo, along with a credit card. 
• A new self-spreading malware bundle has been promoted in the form of fake cheat codes and cracks for popular games like FIFA, Final Fantasy, Forza Horizon, Lego Star Wars, and Spider-Man. These cheat codes and cracks are advertised via YouTube videos. 
• Malicious actors were found exploiting both old and new Oracle WebLogic Server vulnerabilities to deliver different malware families, with Kinsing being one of them. One of these vulnerabilities is tracked as CVE-2020-14882. 
• SharkBot Android trojan disguised as fake updates for antivirus was used to infect users across the U.S., Spain, Poland, Austria, Germany, and Australia in a new campaign. The apps were distributed through Google Play Store. 
• A new version of Bumblebee malware loader has been spotted in the wild. It features a new infection method that uses the PowerSploit post-exploitation framework for stealthy reflective injection of a DLL payload into memory.
• Attackers behind Qyick, Agenda, BlackCat, Black Basta, and PLAY ransomware strains are leveraging a new Intermittent encryption approach to accelerate the encryption process and evade detection on victims’ systems. The tactic is being intensively advertised to attract buyers and affiliates.