Cyware Weekly Threat Intelligence, March 11–March 15, 2024

The Good

• The CISA, in collaboration with SAFECOM and NCSWIC, launched the 911 Cybersecurity Resource Hub. This initiative aims to provide ECCs across the nation with comprehensive cybersecurity resources to address their multifaceted cybersecurity needs. The hub serves as a centralized repository, streamlining access to essential resources and expertise sourced from federal agencies, industry partners, academia, and the private sector.
• The FCC approved a voluntary cybersecurity labeling program for wireless consumer IoT products, aiming to improve security and provide transparency to buyers. The U.S. Cyber Trust Mark will indicate compliance with NIST cybersecurity standards and provide buyers with information on product security and support. The program seeks to enhance accountability in IoT device manufacturing and supply chains, potentially becoming a worldwide standard for secure IoT devices.
• The CISA introduced a software development attestation form that mandates federal contractors to specify the minimum security standards utilized in software interacting with government systems. The form requires federal contractors to detail minimum required security standards and mandates signing by the software contractor’s CEO. The attestation form also requires self-attestation for products developed or modified after September 2022 and the operation of a vulnerability disclosure program.
• The Biden administration unveiled a $1.67 trillion discretionary spending proposal, including a $13 billion allocation for U.S. federal civilian cybersecurity spending in the upcoming fiscal year. Military cybersecurity spending is set at $7.4 billion, with additional funds for cyberspace operations and research and development. 

The Bad

• The Encina Wastewater Authority in Carlsbad, California, has reportedly been targeted by the BlackByte ransomware group. The threat actor claimed to have obtained sensitive company documents and hinted at their potential sale. Despite the lack of immediate signs of intrusion on their website, experts believe the threat actor may have accessed the organization's backend systems.
• Viber, a popular platform for secure communication, is facing allegations of a significant data breach. The perpetrator claimed to have stolen 740GB of data, along with the source code, and is looking to sell it for 8 Bitcoins (~ $583,000). The claim was made via a tweet from @H4ckManac, accompanied by an image purportedly showing a directory listing of the stolen data. 
• The Alabama state government encountered a DDoS attack by the threat group, Anonymous Sudan, allegedly backed by the Russian government. Governor Kay Ivey confirmed that a cyberattack on state systems began on March 12 and assured that network and system data were not compromised. The incident hindered the verification of stolen vehicles and the checking of arrest warrants.
• A malicious campaign exploited the Meson Network ahead of a crypto token unlock, creating 6000 nodes and costing the account owner over $2,000 per day. The attacker's focus on storage space and high bandwidth, rather than CPU-centric cryptomining, reflects a shift in attacker priorities within the blockchain domain.
• The NHS Dumfries and Galloway in Scotland was targeted by a focused and ongoing cyber attack, potentially leading to disruption of services. The nature of the incident has not been fully disclosed, but there are concerns that sensitive data, including patient and staff information, may have been compromised.
• France Travail, formerly known as Pôle Emploi, disclosed a significant data breach affecting approximately 43 million individuals. Hackers breached the French unemployment agency's systems, stealing personal details of job seekers registered over the past 20 years, including full names, dates of birth, SSNs, and contact information. The agency had suffered another breach last August.
• Nissan Oceania is sending breach notifications to around 100,000 people in Australia and New Zealand. The breach, which occurred in December 2023, resulted in the theft of government identification documents, including Medicare cards, driving licenses, passports, and tax file numbers, of around 10% of victims. The Akira group claimed to have the stolen data available on its website.
• Stanford University confirmed that the personal information of over 27,000 people was impacted by an Akira ransomware attack last year. The impacted data varies from person to person and includes dates of birth, SSNs, government IDs, passport numbers, and driver’s license numbers. Additionally, some people’s biometric data, medical information, digital signatures, and credit card information were also stolen in the attack. 
• Acer confirmed that its employee’s attendance data in the Philippines was stolen in a third-party vendor breach and leaked on a hacking forum. A threat actor named ‘ph1ns’ published the link to the stolen database for free on the hacking forum, indicating that anyone can easily download and access the data. The company has notified the National Privacy Commission and the Cybercrime Investigation and Coordination Center and an investigation is underway.
• A database containing 2,363,222 documents in PDF and PNG formats, totaling 92.3 GB, was publicly exposed, exposing reservations, injury waivers, receipts, and digital gift cards. Personally identifiable information (PII) including names, addresses, phone numbers, and credit card details were compromised, potentially affecting customers across Kids Empire's 68 locations in 18 states. Despite a responsible disclosure notice, the data remained accessible for at least three weeks, raising concerns about the extent of exposure and potential unauthorized access.
• Roku disclosed that the accounts of over 15,000 customers were hacked in a credential-stuffing attack, allowing threat actors to lock customers out of their accounts and make fraudulent purchases of hardware and streaming subscriptions. The credentials were gathered from previous data breaches and each account was offered for $0.50. The company further added that once an account was breached it allowed threat actors to change the information on the account, including passwords, email addresses, and shipping addresses.
• Financial services firm Paysign is investigating reports of a data breach after hackers attempted to sell a database allegedly containing millions of customer records. A cybercriminal forum user named "emo" claimed to have stolen over 1.2 million records, including customer names, addresses, dates of birth, phone numbers, and account balances. The company emphasized its commitment to customer data security but provided no further details on the incident.

New Threats

• The DarkGate malware operation launched a new wave of attacks exploiting a recently patched Windows Defender SmartScreen vulnerability (CVE-2024-21412). Trend Micro analysts have reported that DarkGate operators are leveraging this vulnerability to enhance their malware distribution efforts, targeting traders' systems with the DarkMe malware. The attack involves a complex chain of exploitation, including phishing emails, open redirects, and Windows shortcuts, ultimately leading to the execution of DarkGate malware.
• The latest PixPirate banking trojan for Android employs a new evasion method, remaining active even after its dropper app is removed. It lacks an icon, making it invisible on recent Android versions. Using two apps, downloader and droppee, it steals information and targets the Brazilian Pix payment platform for fraudulent transactions. The droppee app, without a launcher intent, hides on devices while being triggered by the downloader via a service connection.
• Fresh campaigns were found using multi-layered phishing techniques, targeting financial, biomedical, HVAC, employment, and professional services sectors. The attackers attempt to deceive recipients through authenticated Adobe notifications, personalized sender domains, company logos, and malicious QR codes. Leveraging authentic Constant Contact domains and image-based phishing techniques further obfuscates detection. The campaign attempts to pull off an advanced fee scam in the end.
• A new malware called VCURMS RAT was found being distributed alongside STRRAT in a phishing campaign that targeted Java-based platforms. The campaign leveraged phishing emails, urging recipients to click a button to verify payment information. Subsequently, a harmful JAR file hosted on AWS is downloaded, which deploys the RATs. The ultimate goal of VCURMS RAT is to pilfer system information as well as secrets from popular apps and browsers.
• Attackers exploited YouTube and Discord to infect Roblox users with a new info-stealer named Tweak. Based on PowerShell, the malware masquerades as a tool to enhance frames per second for Roblox users. Once executed, it exfiltrates sensitive data like user information, location, Wi-Fi profiles, passwords, Roblox IDs, and in-game currency details. The stolen data is sent via a Discord webhook to an attacker-controlled server.
• As the April 15 tax filing deadline approaches in the US, tax-related scams targeting taxpayers and tax professionals have come to light. One of these schemes involved the use of cardboard envelopes from a delivery service. The enclosed letter includes the IRS masthead with contact information and a phone number that does not belong to the IRS and warns recipients about an unclaimed refund. The IRS also warned of phishing emails sent to tax professionals posing as potential clients, requesting Electronic Filing Identification Numbers (EFINs) under false pretenses.
• Enterprises in the U.S. and Europe are facing heightened concerns due to the emergence of the DoNex ransomware strain. The group employs double-extortion tactics, encrypting files and exfiltrating sensitive data to increase pressure on victims. While the attackers’ exact infiltration methods remain undisclosed, cybersecurity teams are actively investigating to uncover DoNex's modus operandi. The group has already leaked data from at least five companies.
• The Matanbuchus malware launched a fresh campaign targeting Windows systems through malicious XLS files. The malware's sophistication allows it to fetch JavaScript files and download malicious DLLs, initiating potential cascaded infections. Notably, the malware strain is used in association with Cobalt Strike beacons, enhancing threat actors' control over compromised systems.
• Microsoft rolled out security patches for 61 vulnerabilities as part of the March 2024 Patch Tuesday update. Twenty-four of these are privilege escalation issues and another 18 are RCE flaws. Security feature bypass, information disclosure, DoS, and spoofing are among the other vulnerabilities that received patches this month. The impacted products include Windows, Azure, Skype for Consumer, Microsoft Defender, and Microsoft Office, among others.
• FakeBat malvertising campaigns are evolving to use new redirectors and leverage legitimate websites to bypass security checks, making them harder to detect. The latest wave of FakeBat malvertising is targeting a diverse range of brands, indicating a shift from repeatedly impersonating the same software brands. The latest campaigns exhibited diversity in the targeted brands, such as OneNote, Epic Games, and Ginger.