Cyware Weekly Threat Intelligence, January 22–26, 2024

The Good

• The HHS released voluntary cybersecurity performance goals for the healthcare sector, divided into essential and enhanced categories. These goals, based on industry frameworks, aim to strengthen the sector's cybersecurity posture and address common attack vectors such as ransomware.
• Computer science researchers developed a new method to identify security weaknesses that make people vulnerable to account takeover attacks, where unauthorized access is gained to online accounts. They found that the method could be adopted by device manufacturers and app developers to understand complex hacking attacks and improve security measures.
• The director general of the Israel National Cyber Directorate (INCD) and the Czech Republic National Cyber and Information Security Agency have signed a Memorandum of Cooperation. The agreement enables closer collaboration between experts from both countries, facilitating the sharing of information and experience, such as through internships, to bolster cybersecurity efforts.
• The latest update for the iOS 17 branch includes a new feature called Stolen Device Protection, which helps protect sensitive information if your iPhone is stolen. This feature makes it difficult for thieves to access certain features and perform actions on the stolen iPhone, and enforces a security delay for making changes to critical settings.

The Bad

• Microsoft revealed that the email accounts of its top executives, including the individuals in the cybersecurity and legal departments, were breached in an attack attributed to Cozy Bear (aka APT29). The campaign is estimated to have commenced in November 2023 and leveraged password spray attacks to gain an initial foothold.
• Monobank, Ukraine's largest mobile-only bank, faced a second massive DDoS attack involving 580 million service requests on January 21, after it tackled a similar disruption on January 20. No threat group has yet been held responsible for the attacks.
• Resecurity researchers detected threat actors circulating the PII of 55 million Thai citizens on the dark web. It’s believed that these sensitive details were sourced from various breached platforms and are from organizations in e-commerce, fintech, and government sectors.
• An unsecured storage instance leaked over 12TB of data, including 26 billion records, from several companies such as X, Tencent, Weibo, Dropbox, LinkedIn, Adobe, and Canva, among others. The leak also included records of various government organizations in the U.S., Brazil, Germany, Turkey, and the Philippines.
• The sensitive personal information of 16.6 million customers was stolen during a ransomware attack earlier this month, loanDepot confirmed in a filing with the SEC. The kind of data impacted in the incident remains unknown.
• A ransomware group called Slug claimed that it stole 1TB of data in an attack at AerCap, the world's largest aircraft leasing company. While the group revealed no further information, the firm claimed in the SEC filing that there was no financial loss and that all systems were under control.
• In another update, 23andMe confirmed that attackers stole health reports and raw genotype data of customers in the credential stuffing attack that went unnoticed from April 29, 2023, to September 27, 2023. The hack impacted 6.9 million people, leading to lawsuits and updated Terms of Use.
• Trezor, the hardware crypto wallet provider, disclosed a data breach that exposed the emails and names of nearly 66,000 users. The incident occurred on January 17 and affected users who interacted with their support team since December 2021.
• An exposed Trello API allowed the linking of private email addresses with public Trello profiles, leading to a data leak of 15 million members' information, including emails, usernames, full names, and other details.
• An unsecured database containing 1.3 million sets of Dutch COVID-19 records, including 118,441 test certificates, 506,663 appointment records, and 660,173 testing samples, was left exposed by CoronaLab.
• Hewlett Packard Enterprise disclosed that the December cyberattack was conducted by the Russia-linked cyberespionage group Midnight Blizzard that gained unauthorized access to its cloud-based email environment. The attackers collected information on the company's cybersecurity division and other functions, exfiltrating data since May 2023.
• The HHS issued a warning about a cybersecurity breach involving the self-hosted version of the remote access tool ScreenConnect from ConnectWise. The incident involved the compromise of the pharmacy supply chain and managed services provider, Outcomes, allowing threat actors to gain unauthorized access to their IT environment.

New Threats

• SentinelLabs observed a campaign by ScarCruft actors targeting media organizations and high-profile experts in North Korean affairs. As part of the attack, the group impersonated a North Korea Research Institute member, used the RokRAT backdoor, and harvested threat intelligence from their targets.
• Within three days after the disclosure of an RCE flaw impacting the Atlassian Confluence Data Center and Confluence Server, researchers recorded nearly 40,000 exploitation attempts in the wild from more than 600 unique IP addresses. A majority of IP addresses are from Russia, followed by Singapore, Hong Kong, the U.S., and China.
• FortiGuard Labs team identified a malware author, who goes by the ID ‘WS,’ discreetly uploading malicious PyPI packages to deploy Whitesnake PE and a Python script on Windows and Linux systems, respectively. So far, over 2000 users are estimated to be infected by these packages.
• Researchers discovered a supply chain attack called MavenGate that allowed hackers to hijack Java and Android apps by exploiting vulnerabilities in the dependency repositories. The attack impacted over 200 companies, including Google, Facebook, Signal, and Amazon. Researchers suggested using DNS TXT records for identity confirmation in group ID registration
• Cyble spotted a campaign leveraging the MetaStealer malware to target individuals seeking asylum in the U.S., using deceptive PDF lures to infiltrate systems. MetaStealer exhibits advanced evasion techniques, gathers sensitive information, and communicates securely with its C2 server, posing a significant threat to compromised systems.
• Researchers discovered an updated version of a backdoor malware called LODEINFO, distributed through spear-phishing attacks. The malware, attributed to the Chinese nation-state actor Stone Panda, has evolved to include new features and anti-analysis techniques. It is capable of executing arbitrary shellcode, taking screenshots, and exfiltrating files. The attacks involve phishing emails with malicious Word documents, and the latest version of LODEINFO includes a fileless downloader and backdoor shellcode.
• BlackBerry found a financially motivated threat actor targeting Mexican banks and cryptocurrency trading entities with custom-packaged installers delivering a modified version of the AllaKore RAT. The attackers use lures with Mexican Social Security Institute (IMSS) naming schemas and links to legitimate documents during the installation process. The payload is heavily modified to send stolen banking credentials and unique authentication information to a C2 server for financial fraud.
• Over 5,370 GitLab servers are vulnerable to a critical flaw CVE-2023-7028 that allows for zero-click account takeover via password reset. The bug has been addressed with the release of versions 16.7.2, 16.5.6, and 16.6.4. A majority of the servers are located in the U.S., Germany, and Russia. 
• ESET researchers uncovered a sophisticated implant called NSPX30, used by a new China-aligned APT group named Blackwood, which has been used for cyberespionage operations targeting individuals and companies in China, Japan, and the U.K. The implant includes an orchestrator, backdoor, and plugins, and can extract various data from compromised systems.
• Cisco has released patches to fix a critical security flaw (CVE-2024-20253) in its Unified Communications and Contact Center Solutions products, which could allow remote attackers to execute arbitrary code on affected devices. There are no workarounds, but users are advised to set up access control lists to limit access until updates can be applied. This comes after Cisco recently issued fixes for another critical security flaw (CVE-2024-20272) in Unity Connection.
• The 'Better Search Replace' WordPress plugin, used by over a million websites, has a critical security flaw (CVE-2023-6933) that allows attackers to execute code, access sensitive data, and delete files. Hackers have already initiated thousands of attacks targeting this vulnerability in the past 24 hours. The plugin's vendor, WP Engine, released version 1.4.5 to fix the issue, and users are urged to update immediately.
• The National Investor, an Abu Dhabi-based investment firm, issued a warning about fraudulent use of its name, logo, and employees' names in online scams. These scams solicit personal and financial information from individuals and entities under the pretense of investment opportunities and tenders.