Cyware Weekly Threat Intelligence, June 03–07, 2024

The Good

• The FCC has approved a $200 million pilot program to enhance cybersecurity in schools and libraries, aiming to prevent cyberattacks against these institutions. This decision comes in response to a rise in cyberattacks on schools and libraries, with the FCC aiming to address the issue by allocating funds from the Universal Service Fund. The proposal also includes a requirement for major broadband providers to submit plans to improve the cybersecurity of the Border Gateway Protocol, a crucial data transmission algorithm.
• The FBI retrieved around 7,000 decryption keys for LockBit ransomware. The agency has urged victims to come forth to decrypt their data without any legal or financial repercussions.
• As allies, Kenya and the U.S. aim to bolster digital security in Africa by expanding Kenya’s technology sector, improving cybersecurity training, and hardening defenses against cyberattacks to protect the country’s fast-growing digital economy. The leaders also agreed to sharing threat intelligence between partners in the East Africa region and highlighted private industry collaborations, including a joint effort between the Kenyan government and Google to establish a cyber-operations platform along with an e-government pilot project. 
• The CISA Cybersecurity Advisory Committee (CSAC) has adopted recommendations to optimize the Joint Cyber Defense Collaborative (JCDC), a public-private partnership focused on sharing cybersecurity data and coordinating cyber defense operations. The key recommendations suggest JCDC should focus on “operational cyber defense.”
• Poland announced an investment of around $760 million to fortify its defenses against ongoing cyberattacks from Russia. The announcement came after threat actors published a fake article about military mobilization on the news feed of Poland's state news agency, PAP, late last week. Since this attack, Poland’s critical infrastructure was also targeted in a series of attacks. 

The Bad

• Ukrainian cyber defenders have discovered the return of the Vermin hacker group, targeting the country’s defense forces with spear-phishing emails containing SPECTR malware. The malware acts as a RAT and is used to steal sensitive information. The group's latest campaign, named SickSync, marks its first significant activity since March 2022. The attackers exploited the legitimate Syncthing software for data exfiltration and used spear-phishing emails containing password-protected archives to initiate the attack.
• A counterfeit package named 'crytic-compilers' was uploaded to PyPI, resembling a legitimate Python library used by cryptocurrency developers. The malicious package scored 436 downloads before being taken offline from PyPI. The Russia-linked Lumma stealer was disguised by aligning its version numbers with the legitimate library and attempting to install the real library to avoid suspicion.
• Cybercriminals are using typo-squatted domains and fake ads to distribute a backdoored version of the Advanced IP Scanner tool, compromising unsuspecting users' systems. The compromised installer contains a malicious DLL module that injects a Cobalt Strike beacon into the system, enabling attackers to maintain control over compromised computers. The malicious code communicates with C2 servers at nanopeb[.]com and coldfusioncnc[.]com.
• ASEC discovered phishing emails containing HTML attachments that prompt users to run malicious PowerShell commands. The emails disguise the attachments as MS Word documents and urge users to click a "How to fix" button, which then initiates the execution of a malicious PowerShell script. This script ultimately downloads and executes the DarkGate malware, posing a serious threat to systems.
• Broadcom discovered that Signal Messenger is being exploited to deliver DarkCrystal RAT malware to high-profile targets. The targets include government officials, military personnel, and representatives of defense enterprises in Ukraine. The infection chain begins with the victim receiving a message containing an archive file, a password, and instructions on how to open it. When the user runs these files, their computer becomes infected with the DarkCrystal RAT malware, granting attackers unauthorized access to the system.
• Hackers are exploiting two old vulnerabilities in ThinkPHP applications, CVE-2018-20062 and CVE-2019-9082, to install a persistent web shell named Dama. This web shell allows further exploitation of breached endpoints, enabling remote server control and advanced capabilities such as file system navigation, file upload, and system data gathering. The campaign, which started in October 2023, has recently intensified and expanded to target a broad range of systems. To mitigate this, organizations should upgrade to the latest ThinkPHP version (8.0). 
• The FBI has issued a warning about scammers posing as recruiters for legitimate companies, using fake remote job ads to steal cryptocurrency from job seekers. These work-from-home scams entice victims with easy tasks and a confusing compensation structure that requires cryptocurrency payments. Victims of such fraudulent activities are advised to report to the FBI IC3 and provide transaction details associated with the scam.

New Threats

• The Mallox ransomware group has developed a new Linux variant targeting VMWare ESXi environments. This variant only proceeds with the attack if the system is running in a VMWare ESXi environment and has administrative rights. The group has been active in various sectors and regions, using sophisticated methods to target high-level users. The variant uses a custom shell script to deliver and execute ransomware, exfiltrate victim information, and create challenges for incident response.
• Arctic Wolf Labs discovered a new ransomware variant called Fog that has targeted organizations in the U.S., primarily in the education and recreation sectors. Threat actors gained access to victim environments by leveraging compromised VPN credentials and used techniques like pass-the-hash, credential stuffing, and PsExec to move laterally and encrypt data. The ransomware payload exhibits common techniques, with the threat actors focused on rapid encryption of VM storage data rather than data exfiltration, suggesting a financially motivated attack targeting the education sector.
• Attackers have recently hijacked high-profile TikTok accounts using a zero-day vulnerability in the social media platform's direct messages feature. Companies such as Sony and CNN, along with celebrity accounts like Paris Hilton's, were affected. The exploit used by the attackers does not require the targets to download any payload or click on embedded links.
• Researcher Sam Curry discovered that Cox support agents could remotely control and update device settings, such as changing Wi-Fi passwords and viewing connected devices, using the TR-069 protocol. Analysis of the underlying mechanism identified about 700 exposed API endpoints, some of which could be exploited to gain administrative functionality and run unauthorized commands by weaponizing the permission issues and replaying the HTTP requests repeatedly. The issue has been addressed.
• Cisco Talos discovered a new suspected data theft campaign, active since at least 2021, attributed to the LilacSquid APT group. The group has targeted a diverse set of victims in the information technology, energy, and pharmaceutical sectors across the U.S., Asia, and Europe. LilacSquid uses a variety of initial access techniques, including exploiting vulnerabilities and using compromised RDP credentials. When using compromised RDP credentials, LilacSquid deploys the InkLoader malware loader, which then executes the PurpleInk implant - a customized Quasar RAT variant.
• Attackers are targeting GitHub repositories, wiping their contents, and extorting victims for their data, posing as cyber incident analysts on Telegram. The attackers, using the handle Gitloker on Telegram, claim to have stolen the victims' data and offer to restore the deleted content. This incident is part of a series of attacks on GitHub accounts, with previous incidents involving data theft and phishing campaigns, highlighting the ongoing threat to users' private repositories.
• A new malware called Viper RAT is being advertised on dark web forums. It offers a multi-grabber feature to steal credentials, emails, 2FA codes, wallets, and keys. It, furthermore, provides smooth hidden VNC control, screen capture, and the ability to unlock phones. Viper RAT targets Android devices regardless of hardware, posing a serious risk to users.
• Cisco Talos has discovered a new banking trojan called CarnavalHeist targeting Brazilian users. CarnavalHeist begins with financial-themed spam emails that redirect users to malicious websites hosting the first-stage payload. The payload uses a combination of LNK files, batch scripts, and Python loaders to download and execute the final banking trojan DLL. The DLL uses overlay attacks to present fake login screens for Brazilian financial institutions and capture user credentials.
• Aqua Security discovered a new Muhstik malware campaign exploiting a known remote code execution vulnerability (CVE-2023-33246) in Apache RocketMQ versions 5.1.0 and below to gain initial access to vulnerable instances. The Muhstik malware is then downloaded and executed on the compromised instances, allowing the attackers to establish persistence, evade detection, and perform various malicious activities like cryptocurrency mining and DDoS attacks. Analysis shows that there are over 5,200 vulnerable RocketMQ instances exposed on the internet.