Cyware Monthly Threat Intelligence, March 2023

The Good

• The Pentagon released its first cybersecurity strategy aimed at protecting the defense industrial base from cyberattacks. The strategy outlines goals and objectives to enhance cybersecurity and resilience within the supply chain, which consists of numerous entities contracting directly with the Pentagon. This initiative includes the Cybersecurity Maturity Model Certification program to raise standards among contractors.
• The CISA, in collaboration with SAFECOM and NCSWIC, launched the 911 Cybersecurity Resource Hub. This initiative aims to provide ECCs across the nation with comprehensive cybersecurity resources to address their multifaceted cybersecurity needs. The hub serves as a centralized repository, streamlining access to essential resources and expertise sourced from federal agencies, industry partners, academia, and the private sector.
• GitHub is implementing push protection as the default for all public repositories to prevent accidental leakage of secrets like API keys and tokens. The feature scans code commits for secrets and alerts developers if any are found. It has detected over one million leaked secrets this year alone. The feature supports over 200 token types and patterns from 180 service providers.

The Bad

• SentinelOne researchers identified a new variant of the data-wiping malware AcidRain, named AcidPour, specifically tailored to target Linux x86 devices. This ELF binary, distinct from previous iterations, is designed to erase content from RAID arrays and Unsorted Block Image (UBI) file systems. While the exact targets remain unclear, SentinelOne alerted Ukrainian agencies, highlighting the ongoing threat of wiper malware.
• A new PhaaS named Darcula was found using nearly 20,000 domains to spoof brands and steal credentials from Android and iPhone users in more than 100 countries. Touted to offer over 200 templates, the kit has been used against various organizations, including financial, government, telecommunications, and airlines. These templates impersonate landing pages of multiple brands and use the correct local language, logos, and content to trick users.
• Enterprises in the U.S. and Europe witnessed the emergence of the DoNex ransomware strain. The group behind it employed double-extortion tactics, encrypting files and exfiltrating sensitive data to further pressurize the victims into coughing up a ransom. While the attackers’ exact infiltration methods remain undisclosed, cybersecurity experts revealed that the group had already stolen data from at least five companies.
• A cyberespionage campaign targeted Tibetans through a strategic web compromise and trojanized software, utilizing the Monlam Festival as a focal point for attacks, revealed ESET. The Evasive Panda APT group, with Chinese alignment, was identified as the likely perpetrator based on the use of MgBot and the newly discovered Nightdoor backdoor.
• A new malware dubbed WogRAT was found using the online notepad platform, aNotepad, as a covert channel to target Windows and Linux systems. The Linux version of the malware, which comes in ELF form, shares similarities with the Windows variant. However, it distinguishes itself by utilizing Tiny Shell for routing operations and additional encryption in its communication with the C2 server. The malware has been targeting users in Japan, Singapore, China, Hong Kong, and other Asian countries.
• Small business owners and self-employed individuals were being targeted by a tax scam, prompting them to apply for an IRS Employer Identification Number (EIN) through a fraudulent email. Scammers likely obtained email addresses from data brokers, seeking extensive personal information, including SSNs. There are telltale signs of the scam, such as errors in website setup.
• Insikt Group unearthed a new infrastructure used by the operators of the Predator spyware in 11 countries. By analyzing the domains facilitating the spyware's delivery, potential Predator customers were identified in countries like Saudi Arabia, Egypt, and Kazakhstan. Predator grants access to sensitive data and leave minimal traces. The sophisticated spyware is distributed through spoofed websites and an anonymization network, making attribution challenging.
• Researchers uncovered a new ransomware, named HelloFire, that disguises as legitimate penetration testing activities to trick users. Once executed, the ransomware appends the encrypted files with the ‘.afire’ extension and launches a ransom note in a ‘Restore.txt’ file. The encryptor is built as a Windows PE 32bit executable using Visual C++ and has a file size of 49.5KB.
• Attackers exploited YouTube and Discord to infect Roblox users with a new info-stealer named Tweak. Based on PowerShell, the malware masquerades as a tool to enhance frames per second for Roblox users. Once executed, it would exfiltrate sensitive data like user information, location, Wi-Fi profiles, passwords, Roblox IDs, and in-game currency details. The stolen data is then sent via a Discord webhook to an attacker-controlled server.
• Researchers warned about a new banking trojan, named CHAVECLOAK, that uses Smishing, phishing emails, and compromised websites to infect Brazilian banking users. The malware targets Windows devices and accesses online banking platforms to steal credentials and other financial information. In one such campaign, the attackers used phishing emails disguised as legitimate bank communications to trick users into downloading the malware.