Cyware Weekly Threat Intelligence, May 20–24, 2024

The Good

• Authorities have successfully dismantled several dark web marketplaces offering illicit goods in a coordinated global crackdown known as Operation SpecTor. The operation, led by Europol, involved authorities from the U.S., U.K, Germany, and Australia. Authorities targeted several high-profile dark web markets, seizing servers, arresting key operators, and confiscating vast amounts of illegal goods including drugs, firearms, counterfeit currencies, and stolen data. Significant amounts of cryptocurrency used for dark web transactions were also confiscated.
• The White House unveiled a framework to protect U.S. workers from the risks posed by AI in the workplace, emphasizing the importance of health and safety rights, governance, human oversight, and transparency as organizations adopt emerging technologies. The principles also encourage employers to upskill workers whose jobs are replaced or transitioned due to AI technologies. The AI safety framework is voluntary, similar to other recent AI frameworks and best practices released by the White House.
• The U.K government has published voluntary guidance to help AI developers and vendors secure their AI models. The guidance includes recommendations such as monitoring AI system behavior, performing model testing, and procuring secure software components from verified third-party developers. It also emphasizes the need to ensure the integrity of training data and to provide security training for AI developers.
• The U.K government is investing £8.5 million ($10.8 million) to fund new AI safety research aimed at tackling cyber-threats, including deepfakes, to better protect society from AI risks and harness the technology's benefits. The research aims to generate ideas on how to adapt infrastructure and systems for a world where AI is embedded in everything. 

The Bad

• The JAVS courtroom recording software was recently targeted in a supply chain attack where attackers backdoored the installer with malware, allowing them to compromise systems. The compromised software, containing a malicious fffmpeg.exe binary, was distributed to over 10,000 installations in courtrooms, legal offices, correctional facilities, and government agencies worldwide.
• Apple's Wi-Fi Positioning System can be abused to create a global privacy nightmare by allowing the tracking of individuals and groups, even those not using Apple devices, through the collection and analysis of Wi-Fi access point (AP) location data. This data can be used to identify individual homes, businesses, military units, and other sensitive locations.
• Recorded Future's Insikt Group discovered a campaign dubbed GitCaught, exploiting legitimate services like GitHub and FileZilla to distribute an array of malware. Perpetrators, possibly Russian-speaking threat actors, utilize fake profiles and repositories on GitHub to host counterfeit software, aiming to steal sensitive data. The malware distributed included Atomic, Vidar, and Octo.
• A consumer-grade spyware app, pcTattletale, has been discovered on check-in systems at three Wyndham hotels in the U.S., exposing sensitive data. The spyware, intended for remote monitoring, captured screenshots containing sensitive information like guest names and partial payment card numbers. It was found exposing these screenshots publicly due to a security flaw.
• Attackers exploited the obscure Dessky Snippets WordPress plugin to inject server-side malware into a WooCommerce store, stealing credit card details. The malware, disguised within PHP code, manipulates billing forms to capture sensitive information. It then sends the captured data to a third-party URL, bypassing browser autocomplete warnings to avoid suspicion.
• An unidentified threat actor was found exploiting known vulnerabilities in Microsoft Exchange Server to deploy a keylogger malware, targeting entities across Africa and the Middle East. Russian cybersecurity firm Positive Technologies revealed over 30 victims, including government agencies, banks, and educational institutions, with compromises dating back to 2021. The attack exploits ProxyShell flaws, allowing attackers to bypass authentication and execute remote code.

New Threats

• Zscaler ThreatLabz reported a new version of Hijack Loader incorporating updated anti-analysis methods for stealthier operations. The loader now bypasses Windows Defender, UAC, and employs process hollowing. It delivers various malware families, including Amadey, and utilizes PNG image decryption for payload loading. Recent iterations also feature additional modules for enhanced capabilities, posing a significant threat in malware distribution campaigns.
• Two UC Santa Cruz students Alexander Sherbrooke and Iakov Taranenko uncovered a vulnerability affecting over a million internet-connected laundry machines. They could remotely command the laundry machines to start cycles without payment. The flaw lies in the insecure API used by CSC's mobile app, lacking proper security checks. CSC reportedly reset the students' account balance of several million dollars but failed to fix the bug.
• The UserPro plugin by DeluxeThemes, used by over 20,000 WordPress sites for creating user profiles and community portals, was found to have a critical security vulnerability. Discovered by Patchstack, the flaw resides in the password reset mechanism within the userpro_process_form function, allowing unauthenticated users to change others' passwords under certain conditions. Identified as CVE-2024-35700, the issue stemmed from improper handling of the “secret key” during password resets, enabling unauthorized access.
• Google has patched the eighth zero-day vulnerability in Chrome this year that was being actively exploited. The vulnerability, tracked as CVE-2024-5274, is a high-severity 'type confusion' flaw in Chrome's V8 JavaScript engine. Google has updated Chrome to version 125.0.6422.112/.113 for Windows and Mac, and version 125.0.6422.112 for Linux to fix the vulnerability.
• Intel disclosed a critical vulnerability in its Intel Neural Compressor software for AI model compression that allows remote attackers to execute arbitrary code on affected systems. The vulnerability, designated as CVE-2024-22476, is caused by improper input validation in the software. It allows unauthenticated attackers to remotely execute arbitrary code on systems running affected versions of Intel Neural Compressor. Intel has given the vulnerability a maximum severity score of 10 on the CVSS scale.
• Sentinel One researchers revealed a shift in tactics among cybercriminal groups increasingly deploying ransomware to disrupt and draw attention to political causes, targeting Philippine entities. Groups such as Ikaruz Red Team (IRT), Turk Hack Team, and Anka Underground leverage leaked builders, hijack branding from government agencies like CERT-PH, intertwining cyberattacks with geopolitical tensions.