Threat Research Feed

Intel Source:

Security Joes

Intel Name:

Hackers_Exploiting_MinIO_Storage_System

Date of Scan:

2023-09-05

Impact:

LOW

Summary:

Infected Microsoft SQL Server (MSSQL) databases were being used to deliver Cobalt Strike and ransomware payloads, according to Securonix Threat Lab research. Using MSSQL as a beachhead, the attackers deploy a variety of payloads, including remote-access Trojans (RATs) and a fresh Mimic ransomware variant named FreeWorld, after first infiltrating the target machine.

Source:
https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services

Intel Name:

Cyberattack_by_APT28_Using_msedge_as_a_Bootloader

Date of Scan:

2023-09-05

Impact:

LOW

Summary:

Researchers from CERT-UA have observed a deliberate cyber attack against a crucial Ukrainian energy infrastructure site. An email message with a phony sender address and a link to an archive, like “photo.zip,” is being distributed to carry out the malicious scheme.

Source:
https://cert.gov.ua/article/5702579

Intel Source:

Okta

Intel Name:

Okta_Warns_of_Social_Engineering_Attacks

Date of Scan:

2023-09-04

Impact:

LOW

Summary:

Recent weeks have seen an increase in social engineering attacks against IT service desk staff, according to several U.S.-based Okta customers. The caller’s tactic was to persuade the service desk staff to reset all multi-factor authentication (MFA) factors enrolled by highly privileged users.

Source:
https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection

Intel Source:

ASEC

Intel Name:

Following_the_Spread_of_Fileless_Malware_Through_Spam_Emails

Date of Scan:

2023-09-04

Impact:

LOW

Summary:

A phishing campaign that spreads via spam emails and runs a PE file (EXE) without placing the file on the user’s computer has been uncovered by ASEC researchers. The malware strains AgentTesla, Remcos, and LimeRAT are finally executed by the malware attachment in the hta extension.

Source:
https://asec.ahnlab.com/en/56512/

Intel Source:

Seqrite

Intel Name:

ZeroDay_Vulnerabilities_Detected_on_WinRAR

Date of Scan:

2023-09-04

Impact:

MEDIUM

Summary:

In the widely used WinRAR software, the zero-day vulnerabilities CVE-2023-38831 and CVE-2023-40477 have been discovered. The possibility of remote code execution presented by these vulnerabilities raises serious security concerns. With half a billion users globally, it is a well-liked compression tool that is essential to numerous digital processes.

Source:
https://www.seqrite.com/blog/threat-advisory-zero-day-vulnerabilities-detected-on-winrar/

Intel Source:

Securonix Threat Labs

Intel Name:

FreeWorld_Ransomware_Attacks_on_MSSQL_Databases

Date of Scan:

2023-09-04

Impact:

MEDIUM

Summary:

Infected Microsoft SQL Server (MSSQL) databases were being used to deliver Cobalt Strike and ransomware payloads, according to Securonix Threat Lab research. Using MSSQL as a beachhead, the attackers deploy a variety of payloads, including remote-access Trojans (RATs) and a fresh Mimic ransomware variant named FreeWorld, after first infiltrating the target machine.

Source:
https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/

Intel Source:

Interlab

Intel Name:

A_new_campaign_of_novel_RAT

Date of Scan:

2023-09-02

Impact:

LOW

Summary:

On 8/28/2023, Interlab got some a sample which was sent to a journalist with highly targeted content luring the recipient to open the document. After checking it, Interlab discovered that after initial compromise, the execution of an AutoIT script that was used to perform process injection using a process hollowing technique. The injected process contained a novel RAT, which was named “SuperBear” due to naming conventions in the code.

Source:
https://interlab.or.kr/archives/19416

Intel Source:

Talos

Intel Name:

Analyses_on_new_open_source_infostealer

Date of Scan:

2023-09-02

Impact:

LOW

Summary:

This week’s edition of the Threat Source newsletter. Talos is seeing more and more bad guys take advantage of the availability of tools that have been added to public malware sites, such as the infostealer “SaphireStealer” which was analyzed by Talos reserachers and shared in their blog.

Source:
https://blog.talosintelligence.com/new-open-source-infostealer-and-reflections-on-2023-so-far/

Intel Source:

Rapid7

Intel Name:

New_IDAT_Loader_executes_StealC_and_Lumma_Infostealers

Date of Scan:

2023-09-02

Impact:

LOW

Summary:

Recently, Rapid7 discoverd the Fake Browser Update tricking users into executing malicious binaries. While analyzing the dropped binaries, Rapid7 determined a new loader is utilized in order to execute infostealers on compromised systems including StealC and Lumma.

Source:
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/

Intel Source:

Talos

Intel Name:

An_Open_Source_Info_Stealer_Named_SapphireStealer

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

In December 2022, SapphireStealer was first published by the open-source community as an information stealing malware. Since then, it’s been observed across a number of public malware repositories with increasing frequency. The researchers have moderate confidence that multiple entities are using SapphireStealer. They have separately improved and modified the original code base, extending it to support additional data exfiltration mechanisms.

Source:
https://blog.talosintelligence.com/sapphirestealer-goes-open-source/

Intel Source:

Resecurity

Intel Name:

The_attacks_on_USPS_and_US_Citizens_for_data_theft

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

Resecurity has discovered a big-scale smishing campaign targeting the US Citizens. Similar scams have been noticed before targeting Fedex and UPS. The bad actors attributed to Chinese-speaking cybercriminals are leveraging a package tracking text scam sent via iMessage to collect personal (PII) and payment information from the victims with the goal of identity theft and credit card fraud. The cybercriminal group with associated campaign has been named “Smishing Triad” as it leverages smishing as the main attack vector and originates from China.

Source:
https://www.resecurity.com/blog/article/smishing-triad-targeted-usps-and-us-citizens-for-data-theft

Intel Source:

Trustwave

Intel Name:

Malicious_PDFs

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

Last couple months, Trustwave SpiderLabs analysts have noticed a spikein threat actors employing PDF documents to gain initial access through email-borne attacks. Though the use of PDF files as a malicious vector is not a novel approach, it has become more popular as threat actors continue to experiment with techniques to bypass conventional security controls.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/threat-loaded-malicious-pdfs-never-go-out-of-style/

Intel Source:

Cybergeeks

Intel Name:

A_detailed_analyses_of_Brute_Ratel_C4_payloads

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

Cyber Geeks did deep analyses of Brute Ratel C4 payloads. Brute Ratel C4 is a Red Team & Adversary simulation software that can be considered an alternative to Cobalt Strike.

Source:
https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads/

Intel Source:

Eclecticiq

Intel Name:

Decrypting_Key_Group_Ransomware

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

EclecticIQ analysts discovered that Key Group ransomware can be classified as a low-sophisticated threat actor. The ransomware samples contained multiple cryptographic mistakes that enabled EclecticIQ to create a decryption tool for this specific ransomware version built in August 03,2023. Key Group or KEYGROUP777, is a Russian-speaking cybercrime actor focusing on financial gain by selling Personal Identifying Information (PII) or initial access to compromised devices and obtaining ransom money.

Source:
https://blog.eclecticiq.com/decrypting-key-group-ransomware-emerging-financially-motivated-cyber-crime-gang

Intel Source:

CERT-UA

Intel Name:

Exploitation_of_CVE_2023_38831

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

The Ukrainian CERT-UA government computer emergency response team has noted a cyberattack by the UAC-0057 group. It was discovered that the “Zbirnyk_tez_Y_23.rar” file contained an exploit for the CVE-2023-38831 vulnerability. If this exploit is successful, it will cause the BAT file “16872_16_2023_03049.pdf.cmd” to be launched, which will cause the LNK file “16872_16_2023_03049.lnk” to launch, which will then use the mshta.

Source:
https://cert.gov.ua/article/5661411

Intel Source:

TrendMicro

Intel Name:

Taking_down_the_main_admin_of_phishing_as_a_service_16shop

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

TrendMicro did analyses and investigations on phishing-as-a-service 16shop through the years. Plus was mentioned about he partnership between Trend Micro and Interpol in taking down the main administrators and servers of this massive phishing campaign.

Source:
https://www.trendmicro.com/en_us/research/23/i/revisiting-16shop-phishing-kit-trend-interpol-partnership.html

Intel Source:

Checkpoint

Intel Name:

Custom_Executable_Formats_From_Hidden_Bee_to_Rhadamanthys

Date of Scan:

2023-09-01

Impact:

LOW

Summary:

The design and implementation of Hidden Bee coin miner and Rhadamanthys stealer considerably overlap. Custom executable formats, the usage of comparable virtual filesystems, the use of LUA scripts, identical routes to some of the components, reused functions, similar use of steganography, and overall related architecture are just a few examples of the similarities that are readily obvious.

Source:
https://research.checkpoint.com/2023/from-hidden-bee-to-rhadamanthys-the-evolution-of-custom-executable-formats/

Intel Source:

Sentilone

Intel Name:

A_new_wave_of_Good_Day_ransomware_attacks

Date of Scan:

2023-08-31

Impact:

LOW

Summary:

Sentilone reserachers shared in their blog several unique Good Day ransom notes and victim portals and shared their analysis of a sample associated with a URL leading to a known Cloak extortion site. Good Day ransomware, a variant within the ARCrypter family. This new wave of Good Day attacks feature individual TOR-based victim portals for each target.

Source:
https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/

Intel Source:

Fortinet

Intel Name:

The_attacks_on_Adobe_ColdFusion

Date of Scan:

2023-08-31

Impact:

LOW

Summary:

Last month, Adobe took some counter measurementsto the exploitation of targeting pre-authentication remote code execution (RCE) vulnerabilities in their ColdFusion solution. FortiGuard Labs IPS telemetry data again detected numerous efforts to exploit the Adobe ColdFusion deserialization of untrusted data vulnerability, which creates a huge risk of arbitrary code execution. These attacks include probing, establishing reverse shells, and deploying malware for subsequent actions. Fortinet nalysts shared their detailed analysis of how this threat group exploits the Adobe ColdFusion vulnerability.

Source:
https://www.fortinet.com/blog/threat-research/multiple-threats-target-adobe-coldfusion-vulnerabilities

Intel Source:

Rapid7

Intel Name:

The_increased_threat_activity_against_Cisco_ASA_SSL_VPN_appliances

Date of Scan:

2023-08-31

Impact:

MEDIUM

Summary:

Rapid7’s managed detection and response team have discovered increased threat activity targeting Cisco ASA SSL VPN appliances (physical and virtual). In some cases, adversaries have created credential stuffing attacks that leveraged weak or default passwords; in others, the activity was observed appears to be the result of targeted brute-force attacks on ASA appliances where multi-factor authentication (MFA) was either not enabled or was not enforced for all users (i.e., via MFA bypass groups).

Source:
https://www.rapid7.com/blog/post/2023/08/29/under-siege-rapid7-observed-exploitation-of-cisco-asa-ssl-vpns/

Intel Source:

Walmart Global Tech Blog

Intel Name:

DGA_analysis_and_the_Gazavat_DMSniff_link

Date of Scan:

2023-08-31

Impact:

LOW

Summary:

Gazavat, a multi-functional backdoor that shares code with the POS malware DMSniff, is also known as Expiro, at least in part. It has been grouped alongside a few other malware versions throughout the years under the name Expiro, a file infector, by AV companies. This is a result of various malware families using the Carberp malware leak’s leaked code.

Source:
https://medium.com/walmartglobaltech/gazavat-expiro-dmsniff-connection-and-dga-analysis-8b965cc0221d

Intel Source:

ASEC

Intel Name:

Examining_Andariel_Recent_Attacking_Activities

Date of Scan:

2023-08-31

Impact:

LOW

Summary:

Attacks thought to have been carried out by the Andariel group have been found by ASEC researchers. It is known that the Lazarus threat group or one of its affiliates is associated with the Andariel threat group, which typically targets Korean businesses and organizations. Since 2008, attacks on targets in Korea have been noted.

Source:
https://asec.ahnlab.com/en/56405/

Intel Source:

TrendMicro

Intel Name:

Earth_Estries_Targeting_Government_and_Technology_Sector

Date of Scan:

2023-08-30

Impact:

MEDIUM

Summary:

Researchers from TrendMicro have uncovered a fresh cyberespionage operation by the Earth Estries hacker collective. As Earth Estries targets governments and enterprises in the technology sector, they found parallels with the advanced persistent threat (APT) group FamousSparrow after analyzing the deployed tactics, methods, and procedures (TTPs).

Source:
https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html

Intel Source:

McAfee

Intel Name:

RemcosRat_Malware_Peeled_Back

Date of Scan:

2023-08-30

Impact:

LOW

Summary:

Researchers from McAfee have discovered a Remcos RAT operation that uses phishing emails to distribute malicious VBS scripts. A ZIP/RAR attachment was included in a phishing email. There is a highly obscured VBS file inside of this ZIP.

Source:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/peeling-back-the-layers-of-remcosrat-malware/

Intel Source:

Trustwave

Intel Name:

The_Rise_of_QR_Codes_in_Phishing

Date of Scan:

2023-08-30

Impact:

LOW

Summary:

Threat actors are taking image phishing to the advance level by taking advantage of QR codes, a.k.a. ‘Qishing’, to hide their malicious URLs. The samples Tustwave analysts observed have been useing the technique are primarily disguised as Multifactor Authentication (MFA) notifications, which tricks their victims into scanning the QR code with their mobile phones to gain access. However, instead of going to the target’s desired location, the QR code leads them to the threat actor’s phishing page.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/think-before-you-scan-the-rise-of-qr-codes-in-phishing/

Intel Source:

Secureworks

Intel Name:

The_actions_against_the_Qakbot_botnet

Date of Scan:

2023-08-30

Impact:

MEDIUM

Summary:

On August 29, 2023, U.S. law enforcement started a national operation for a that disruptionof the Qakbot botnet (also known as Qbot) and associated infrastructure. Secureworks Counter Threat Unit researchers have observed and monitored for a long time this botnet and detected the disruption activity on August 25. The initial access vector for these intrusions was a phishing email. Qakbot was one of the top malware threats, used by cybercriminals to deliver other malware such as Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta. The botnet was lucrative for the GOLD LAGOON threat group, which has operated the Qakbot malware since 2007. The threat actors reportedly received approximately $58 million in ransom payments between October 2021 and April 2023.

Source:
https://www.secureworks.com/blog/qakbot-campaign-delivered-black-basta-ransomware

Intel Source:

Aquasec

Intel Name:

The_exploition_of_Kinsing_Malware

Date of Scan:

2023-08-30

Impact:

LOW

Summary:

Aqua Nautilus observed a new malware campaign that exploits the Openfire vulnerability (CVE-2023-32315) which deploys Kinsing malware and a cryptominer. This vulnerability leads to a path traversal attack, which grants an unauthenticated user access to the Openfire setup environment. This then allows the threat actor to create a new admin user and upload malicious plugins. Eventually the attacker can gain full control over the server.

Source:
https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability

Intel Source:

Security Affairs

Intel Name:

Target_on_Citrix_NetScaler_systems_in_massive_attacks

Date of Scan:

2023-08-29

Impact:

MEDIUM

Summary:

Sophos X-Ops has tracked an ongoing campaign, which is targeting Citrix NetScaler systems, conducted by threat actors linked to the FIN8 group. The hackers are exploiting the remote code execution, tracked as CVE-2023-3519, in a large-scale campaign. The flaw CVE-2023-3519 (CVSS score: 9.8) is a code injection that could result in unauthenticated remote code execution.

Source:
https://securityaffairs.com/150028/hacking/fin8-citrix-netscaler.html?amp=1

Intel Source:

Sophos

Intel Name:

Hackers_Targeting_Unpatched_Citrix_and_NetScaler_Systems

Date of Scan:

2023-08-29

Impact:

LOW

Summary:

A campaign by threat actors to target unpatched Citrix and NetScaler systems that are online is being monitored by Sophos X-Ops at the moment. The data shows a considerable similarity between CVE-2023-3519-based attacks that deliver malware and webshells and earlier attempts that used a lot of the same TTPs.
IOC link: https://github.com/sophoslabs/IoCs/blob/master/2023-08-25%20Citrix%20CVE-2023-3519%20attacks.csv

Source:
https://infosec.exchange/@SophosXOps/110951651051968204

Intel Source:

Phylum

Intel Name:

NPM_Package_Masquerading

Date of Scan:

2023-08-29

Impact:

LOW

Summary:

On August 24th 2023,, Phylum’s detection system observed a suspicious package published to npm called “emails-helper.” After investigating it, it was determined that this package was part of an sophisticated attack involving Base64-encoded and encrypted binaries. The scheme delivers encryption keys from a DNS TXT record hosted on a remote server. Additionally, a hex-encoded URL is retrieved from this remote server and then passed to the spawned binaries. The outcome of it is the deployment of powerful penetration testing tools such as dnscat2, mettle, and Cobalt Strike Beacon.

Source:
https://blog.phylum.io/npm-emails-validator-package-malware/

Intel Source:

JPCERT

Intel Name:

Embedding_a_malicious_Word_file_into_a_PDF_file

Date of Scan:

2023-08-29

Impact:

LOW

Summary:

JPCERT/CC has discovered a new technique was used in a July attack, which bypassed detection by embedding a malicious Word file into a PDF file. They described in their blog the technique “MalDoc in PDF” and explained the details of and countermeasures against it.

Source:
https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html

Intel Source:

Telekom Security

Intel Name:

DarkGate_Malware_Activity_Spikes

Date of Scan:

2023-08-29

Impact:

LOW

Summary:

Telekom security researchers have identified that a new malspam campaign was observed deploying an off-the-shelf malware called DarkGate. The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates.

Source:
https://github.security.telekom.com/2023/08/darkgate-loader.html

Intel Source:

Ironnet

Intel Name:

An_increase_in_MacOS_malware_detections

Date of Scan:

2023-08-28

Impact:

LOW

Summary:

IronNet has observed an increase in MacOS malware within IronDome’s Education sector over the past couple of weeks. Their analysts investigated into these incidents found these infections were originating from already-infected personal devices that were brought into education networks, with the majority of these occurring at higher education institutions.

Source:
https://www.ironnet.com/blog/back-to-school-reminder-keep-your-macs-clean

Intel Source:

CERT-UA

Intel Name:

Emails_Containing_BAT_Files_in_BZIP_GZIP_and_RAR_Archives

Date of Scan:

2023-08-28

Impact:

MEDIUM

Summary:

The distribution of emails with attachments in the form of BZIP, GZIP, and RAR archives containing BAT files made with the aid of the ScrubCrypt cryptor (price – from USD 249), the launch of which will guarantee that the computer is affected by the malicious program AsyncRAT, has been observed by CERT-UA researchers.

Source:
https://cert.gov.ua/article/5628441

Intel Source:

Netenrich

Intel Name:

In_Depth_Analysis_of_ADHUBLLKA_Ransomware_Family

Date of Scan:

2023-08-28

Impact:

LOW

Summary:

Researchers at Netenrich examined the Adhubllka ransomware, which is targeting regular people and small businesses with ransoms ranging from $800 to $1,600 since at least January 2020.

Source:
https://netenrich.com/blog/discovering-the-adhubllka-ransomware-family

Intel Source:

Juniper

Intel Name:

DreamBus_Botnet_comes_back

Date of Scan:

2023-08-28

Impact:

LOW

Summary:

Juniper Threat Labs reserachers has observed multiple attacks where threat actors used a vulnerability affecting RocketMQ servers (CVE-2023-33246) to infiltrate systems and install the malicious DreamBus bot, a malware strain last seen in 2021. This vulnerability opened the door for hackers to exploit the RocketMQ platform, leading to a series of attacks. Juniper analysts shared the details in their blog of the attacks and the bot.

Source:
https://blogs.juniper.net/en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability

Intel Source:

Akamai

Intel Name:

IoT_Targeting_Malware_Expands_Threat_Landscape

Date of Scan:

2023-08-28

Impact:

LOW

Summary:

The Akamai Security Intelligence Response Team (SIRT) has identified a concerning evolution in the KmsdBot malware campaign. The newly discovered Kmsdx binary marks a significant update, now focusing on targeting Internet of Things (IoT) devices. This version of the malware incorporates telnet scanning capabilities and supports a wider range of CPU architectures, expanding its attack potential. The update underscores the ongoing threat posed by vulnerable IoT devices and reinforces the critical need for continuous security measures and updates. KmsdBot’s scope encompasses private gaming servers, cloud hosting providers, and specific government and educational sites, suggesting a persistent concern for IoT security in a rapidly evolving threat landscape.

Source:
https://www.akamai.com/blog/security-research/updated-kmsdbot-binary-targeting-iot

Intel Source:

DFIR Report

Intel Name:

Widespread_Ransomware_is_Caused_by_HTML_Smuggling

Date of Scan:

2023-08-28

Impact:

LOW

Summary:

Researchers from the DFIR report have noted that the threat actor behind the Nokoyawa Ransomware only deployed the final ransomware 12 hours after the initial intrusion. In November 2022, this threat actor used HTML smuggling to send businesses a password-protected ZIP file. An ISO file that distributed IcedID, which then used Cobalt Strike and finally Nokoyawa ransomware, was contained in the password-protected ZIP file.

Source:
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

Intel Source:

ASEC

Intel Name:

Case_Studies_of_MS_SQL_Server_Proxyjacking

Date of Scan:

2023-08-28

Impact:

MEDIUM

Summary:

Poorly managed MS-SQL servers have been the subject of proxyjacking attacks, according to ASEC experts. One of the primary attack methods for Windows systems is to employ publicly accessible MS-SQL servers with easy-to-guess passwords. Threat actors frequently attempt to obtain access to poorly maintained MS-SQL servers via brute force or dictionary assaults. If successful, they infect the system with malware.

Source:
https://asec.ahnlab.com/en/56350/

Intel Source:

Trellix

Intel Name:

Recent_activity_of_Scattered_Spider_threat_group

Date of Scan:

2023-08-26

Impact:

MEDIUM

Summary:

Trellix researchers in their blog describe the details of the modus operandi of Scattered Spider; their recent events and tools leveraged by tthem, vulnerabilities exploited, and their impact. It also indicates that this group has started targeting other sectors, including critical infrastructure organizations. Scattered Spider is known for theft of sensitive data and leveraging trusted organizational infrastructure for follow-on attacks on downstream customers.

Source:
https://www.trellix.com/en-us/about/newsroom/stories/research/scattered-spider-the-modus-operandi.html

Intel Source:

Cyfirma

Intel Name:

The_Constant_Threat_Posed_by_Remcos_RAT

Date of Scan:

2023-08-25

Impact:

LOW

Summary:

Researchers from Cyfirma have examined an ongoing operation run by the Remcos Remote Access Trojan (RAT). The analysis reveals a highly developed threat ecosystem that makes use of a number of strategies, including malicious IP addresses, covert payloads, and complex functions that infect systems and acquire sensitive data.

Source:
https://www.cyfirma.com/outofband/the-persistent-danger-of-remcos-rat/

Intel Source:

Microsoft

Intel Name:

A_Chinese_threat_actor_group_Flax_Typhoon_access_Taiwanese_organizations

Date of Scan:

2023-08-25

Impact:

LOW

Summary:

Microsoft has detected a pattern of malicious activity affecting organizations in Taiwan using techniques that could be easily reused in other operations everywhere else. Microsoft assignes this campaign to Flax Typhoon (overlaps with ETHEREAL PANDA), a nation-state actor based out of China. Flax Typhoon’s observed behavior tells the threat actor intends to perform espionage and maintain access to organizations across a broad range of industries for as long as possible.

Source:
https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/

Intel Source:

Eclecticiq

Intel Name:

The_Investigation_of_RedLine_Stealer_Spam_Campaign

Date of Scan:

2023-08-25

Impact:

LOW

Summary:

EclecticIQ researchers have gathered samples from a RedLine stealer spam campaign that ran between April and August 2023. The campaign was successful by distributing command and control among recently created domains hosted on IP addresses with reliable traffic, and Redline developers provide minor iterations to previous variants.

Source:
https://blog.eclecticiq.com/redline-stealer-variants-demonstrate-a-low-barrier-to-entry-threat

Intel Source:

Talos

Intel Name:

Lazarus_Group_Exploits_ManageEngine_Flaw_to_Launch_QuiteRAT

Date of Scan:

2023-08-25

Impact:

HIGH

Summary:

Researchers from Cisco Talos have identified the Lazarus Group as a state-sponsored actor operating against European and American healthcare organizations and internet backbone infrastructure. This is the third known effort that this actor is responsible for in less than a year, and they have all utilized the same infrastructure.

Source:
https://blog.talosintelligence.com/lazarus-quiterat/

Intel Source:

Secureworks

Intel Name:

Smoke_Loader_Dropping_Geolocation_Malware_And_Flimsy_Recon_WiFi_Scanning_Software

Date of Scan:

2023-08-25

Impact:

LOW

Summary:

Researchers from Secureworks have seen the Smoke Loader botnet deliver a specific Wi-Fi scanning program to compromised systems. This trojan was given the name Whiffy Recon. With the help of adjacent Wi-Fi access points as a source of information, it triangulates the coordinates of the infected PCs using Google’s geolocation API.

Source:
https://www.secureworks.com/blog/smoke-loader-drops-whiffy-recon-wi-fi-scanning-and-geolocation-malware

Intel Source:

Talos

Intel Name:

Lazarus_Group_new_threat_CollectionRAT

Date of Scan:

2023-08-25

Impact:

HIGH

Summary:

Researchers from Cisco Talos have discovered another Lazarus Group’s new threat called “CollectionRAT”. CollectionRAT has standard remote access trojan (RAT) capabilities, including the ability to run arbitrary commands on an infected system. Cisco Talos analysts made analysis on it and came to the conclusion that CollectionRAT appears to be connected to Jupiter/EarlyRAT, another malware family Kaspersky recently wrote about and attributed to Andariel, a subgroup within the Lazarus Group umbrella of threat actors.

Source:
https://blog.talosintelligence.com/lazarus-collectionrat/

Intel Source:

Zscaler

Intel Name:

New_Info_Stealer_Family_Named_Agniane

Date of Scan:

2023-08-24

Impact:

LOW

Summary:

Agniane Stealer is a novel information stealer family discovered by Zscaler researchers. This malware takes credentials, system data, and session information from browsers, tokens, and file transfer tools. When Agniane Stealer acquires sensitive data, it passes it to command-and-control servers, where threat actors can act on the stolen information.

Source:
https://www.zscaler.com/blogs/security-research/agniane-stealer-dark-webs-crypto-threat

Intel Source:

Sentinelone

Intel Name:

Evolution_of_Ransomware_Linux_and_ESXi_Focused_Threats

Date of Scan:

2023-08-24

Impact:

LOW

Summary:

SentinelOne researchers have observed that Ransomware tactics have evolved, with attackers now targeting Linux and VMWare ESXi platforms alongside Windows. This article explores recent ransomware families like MONTI Locker, Akira Ransomware, Trigona Linux Locker, and Abyss Locker. These threats exhibit cross-platform capabilities and strategic code reuse.

Source:
https://www.sentinelone.com/blog/from-conti-to-akira-decoding-the-latest-linux-esxi-ransomware-families/

Intel Source:

SOC Radar

Intel Name:

Raccoon_Stealer_Returns_with_New_Version

Date of Scan:

2023-08-24

Impact:

LOW

Summary:

SOC Radar researchers have discovered that the creators of the data-stealing malware Raccoon Stealer have ended their six-month online silence. They are currently encouraging potential hackers to use the updated 2.3.0 malware (2.3.0.1 since August 15, 2023) version.

Source:
https://socradar.io/raccoon-stealer-resurfaces-with-new-enhancements/

Intel Source:

Any.Run

Intel Name:

Technical_Analysis_of_XWorm_Malware

Date of Scan:

2023-08-24

Impact:

LOW

Summary:

AnyRun researchers have seen the latest version of an XWorm sample — a widespread malicious program that is advertised for sale on underground forums.

Source:
https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/

Intel Source:

Safebreach

Intel Name:

New_Threat_Coverage_Akira_8Base_and_Rorschach

Date of Scan:

2023-08-24

Impact:

MEDIUM

Summary:

Safebreach researchers have observed that the Hacker’s Playbook Threat Coverage round-up unveils added coverage for recently identified ransomware and malware variants, including Akira ransomware, 8Base ransomware, Rorschach (BabLock) ransomware, and others. SafeBreach customers can now simulate and assess their defenses against these evolving threats using the SafeBreach Hacker’s Playbook™.

Source:
https://www.safebreach.com/resources/akira-ransomware-8base-threat-coverage/

Intel Source:

Malwarebytes

Intel Name:

Evolving_Malvertising_Tactics_advanced_Cloaking_Strategies

Date of Scan:

2023-08-24

Impact:

LOW

Summary:

Malvertising campaigns are evolving with the adoption of advanced cloaking techniques that hinder detection and response. This article explores a recent malvertising chain that employs intricate fingerprinting, using encoded JavaScript, to assess visitor legitimacy. This escalating cyber battle underscores the challenges faced by defenders in countering these deceptive tactics

Source:
https://www.malwarebytes.com/blog/threat-intelligence/2023/08/malvertisers-up-the-game-against-researchers

Intel Source:

Trendmicro

Intel Name:

AI_Hype_Abused_in_Malicious_Facebook_Ads

Date of Scan:

2023-08-23

Impact:

LOW

Summary:

Trendmicro researchers have identified Cybercriminals are capitalizing on the excitement surrounding Artificial Intelligence (AI) advancements through deceptive Facebook ads. These ads promise AI-powered advantages but instead distribute a malicious browser add-on that aims to steal victims’ credentials. By exploiting AI enthusiasm, attackers are using URL shorteners and cloud storage to spread their harmful payload.

Source:
https://www.trendmicro.com/en_us/research/23/h/profile-stealers-spread-via-llm-themed-facebook-ads.html

Intel Source:

ISC.SANS

Intel Name:

Dropping_AgentTesla_Exotic_Excel_Files

Date of Scan:

2023-08-23

Impact:

LOW

Summary:

SANS researchers discovered that attackers prefer to employ more unusual extensions to boost their chances of escaping simple and foolish mail gateway regulations. This time, the extension “.xlam” was used.It discovered multiple emails that sent.xlam files to potential victims.

Source:
https://isc.sans.edu/diary/More+Exotic+Excel+Files+Dropping+AgentTesla/30150/

Intel Source:

Welivesecurity

Intel Name:

Spacecolon_Deploy_Scarab_Ransomware_on_Vulnerable_Servers

Date of Scan:

2023-08-23

Impact:

LOW

Summary:

ESET researchers examined the Spacecolon, a modest toolset used to distribute Scarab ransomware versions to victims all around the world. It is most likely introduced into victim organisations by its operators exploiting insecure web servers or brute-forcing RDP credentials.

Source:
https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/

Intel Source:

ASEC

Intel Name:

APT_Attack_Patterns_Targeting_Web_Services_of_Korean_Corporations

Date of Scan:

2023-08-22

Impact:

MEDIUM

Summary:

ASEC reserachers has discovered the APT attacks on Korean corporate web servers. The attackers exploit vulnerabilities to infiltrate and execute malicious actions. The report covers attack techniques such as privilege escalation, credential theft, and remote control using tools like Mimikatz, Potato, and NetCat. The attackers’ objectives appear to evolve from ad insertion to potentially deploying ransomware.

Source:
https://asec.ahnlab.com/en/56236/

Intel Source:

Cyfirma

Intel Name:

CraxsRAT_and_CypherRAT_Created_by_EVLF_DEV

Date of Scan:

2023-08-22

Impact:

LOW

Summary:

The CYFIRMA research team has identified a new Malware-as-a-Service (MaaS) operator known as EVLF DEV. This threat actor is responsible for the development of CypherRAT and CraxsRAT, which have been purchased on a lifetime licence by over 100 different threat actors in the previous three years.

Source:
https://www.cyfirma.com/outofband/unmasking-evlf-dev-the-creator-of-cypherrat-and-craxsrat/

Intel Source:

Symantec

Intel Name:

Chinese_APT_Targeting_Hong_Kong_in_Supply_Chain_Attack

Date of Scan:

2023-08-22

Impact:

LOW

Summary:

Symantec researchers have identified that an emerging China-backed advanced persistent threat group targeted organizations in Hong Kong in a supply chain attack that leveraged legitimate software to deploy the PlugX/Korplug backdoor.

Source:
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse

Intel Source:

Sentinelone

Intel Name:

New_Variant_of_XLoader_macOS_Malware

Date of Scan:

2023-08-22

Impact:

LOW

Summary:

SentinelOne researchers have observed that a new variant of an Apple macOS malware called XLoader has surfaced in the wild, masquerading its malicious features under the guise of an office productivity app called OfficeNote.

Source:
https://www.sentinelone.com/blog/xloaders-latest-trick-new-macos-variant-disguised-as-signed-officenote-app/

Intel Source:

Malwarebytes

Intel Name:

The_WoofLocker_Tech_Support_Campaign_is_Back

Date of Scan:

2023-08-21

Impact:

LOW

Summary:

Malwarebytes researchers have discovered that the WoofLocker tech support scam scheme has returned. The tactics and procedures are fairly similar, but the infrastructure has been strengthened to withstand future takedown attempts.

Source:
https://www.malwarebytes.com/blog/threat-intelligence/2023/08/wooflocker2

Intel Source:

ISC.SANS

Intel Name:

System_BCMalware_Activity

Date of Scan:

2023-08-21

Impact:

LOW

Summary:

Researchers from SANS have analyzed the captured request: /systembc/password.php. According to some references, this is likely the SystemBC Remote Access Trojan (RAT), all 4 IPs are part of the Digital Ocean ASN and only one has been reported as likely malicious.

Source:
https://isc.sans.edu/diary/SystemBC+Malware+Activity/30138/

Intel Source:

QuickHeal

Intel Name:

Diving_Deep_into_Darkrace_Ransomware

Date of Scan:

2023-08-18

Impact:

LOW

Summary:

The incorporation of Lockbit’s strategies into DarkRace demonstrates how cybercriminals are utilizing tried-and-true techniques to strengthen their attacks and increase damage. Combining these strategies could increase infections, compromise data, and escalate ransom demands.

Source:
https://blogs.quickheal.com/darkrace-ransomware-a-deep-dive-into-its-techniques-and-impact/

Intel Source:

QuickHeal

Intel Name:

Mallox_Ransomware_Targeting_Unprotected_Microsoft_SQL_Servers

Date of Scan:

2023-08-18

Impact:

MEDIUM

Summary:

Researchers from QuickHeal have discovered that the Mallox (also known as TargetCompany) ransomware is presently using unprotected Microsoft SQL Servers as an attack vector to enter victims’ systems and spread itself.

Source:
https://blogs.quickheal.com/mallox-ransomware-strikes-unsecured-mssql-servers/

Intel Source:

Fortinet

Intel Name:

NoCry_and_Trash_Panda_Ransomware

Date of Scan:

2023-08-18

Impact:

LOW

Summary:

Researchers from Fortinet looked into Trash Panda and a fresh, tiny NoCry ransomware strain. Windows-based malware called Trash Panda was initially discovered in the first few days of August. On infected computers, it encrypts files, changes the desktop background, and drops a ransom note with political statements. The Windows platform ransomware known as NoCry was first identified in April 2021. The creators of the NoCry ransomware produce variations that are then offered for sale on the group’s Telegram channel.

Source:
https://www.fortinet.com/blog/threat-research/ransomware-roundup-trash-panda-and-nocry-variant

Intel Source:

Blackberry

Intel Name:

New_Tool_Deployed_by_Cuba_Ransomware

Date of Scan:

2023-08-18

Impact:

MEDIUM

Summary:

BlackBerry researchers have discovered and documented new tools used by the Cuba ransomware threat group. It is currently in the fourth year of its operation and shows no sign of slowing down. In the first half of 2023 alone, the operators behind Cuba ransomware were the perpetrators of several high-profile attacks across disparate industries.

Source:
https://blogs.blackberry.com/en/2023/08/cuba-ransomware-deploys-new-tools-targets-critical-infrastructure-sector-in-the-usa-and-it-integrator-in-latin-america

Intel Source:

Lumen

Intel Name:

HiatusRAT_Returns_To_Action_After_A_Short_Break

Date of Scan:

2023-08-18

Impact:

LOW

Summary:

Lumen researchers have continued to track threat actor resulting in new malware samples and infrastructure associated with the HiatusRAT cluster. In the latest campaign, they observed a shift in reconnaissance and targeting activity.

Source:
https://blog.lumen.com/hiatusrat-takes-little-time-off-in-a-return-to-action/?utm_source=rss&utm_medium=rss&utm_campaign=hiatusrat-takes-little-time-off-in-a-return-to-action

Intel Source:

eSentire

Intel Name:

StealC_Delivering_via_Deceptive_Google_Sheets

Date of Scan:

2023-08-18

Impact:

MEDIUM

Summary:

Researchers at Esentire have discovered that a malicious advertisement that the user saw while trying to download Google Sheets was the infection’s point of origin. This advertisement sent the visitor to a malicious website that contained a downloader for the malware StealC infostealer.

Source:
https://www.esentire.com/blog/stealc-delivered-via-deceptive-google-sheets

Intel Source:

ISC.SANS

Intel Name:

From_a_Zalando_Phishing_to_a_RAT

Date of Scan:

2023-08-18

Impact:

LOW

Summary:

ISC.SANS researchers have seen a bunch of phishing emails targeting Zalando customers.

Source:
https://isc.sans.edu/diary/From+a+Zalando+Phishing+to+a+RAT/30136/

Intel Source:

IBM Security Intelligence

Intel Name:

Gozi_Malware_Launches_Another_Attack

Date of Scan:

2023-08-17

Impact:

LOW

Summary:

Researchers at IBM Security Intelligence have noticed that the Gozi malware has returned and is now focusing on cryptocurrency platforms, banks, and other financial institutions.

Source:
https://securityintelligence.com/posts/gozi-strikes-again-targeting-banks-cryptocurrency-and-more/

Intel Source:

Sysdig

Intel Name:

Malicious_Campaign_Targeting_GitLab

Date of Scan:

2023-08-17

Impact:

LOW

Summary:

The Sysdig Threat Research Team have discovered a new, financially motivated operation, dubbed LABRAT. This operation set itself apart from others due to the attacker’s emphasis on stealth and defense evasion in their attacks.

Source:
https://sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign/

Intel Source:

Security Affairs

Intel Name:

Massive_phishing_campaign_targets_energy_sector

Date of Scan:

2023-08-17

Impact:

MEDIUM

Summary:

Starting this May 2023, researchers from Cofense have observed a massive phishing campaign using QR codes in attacks to steal the Microsoft credentials of users from multiple industries. One of the organizations targeted by hackers is a notable energy company in the US.

Source:
https://securityaffairs.com/149567/hacking/phishing-campaign-qr-codes.html?amp=1

Intel Source:

Welivesecurity

Intel Name:

A_new_phishing_campaign_targeting_Zimbra_users

Date of Scan:

2023-08-17

Impact:

LOW

Summary:

ESET researchers have uncovered a mass-spreading phishing campaign, aimed at collecting Zimbra account users’ credentials, active since at least April 2023 and still ongoing. Zimbra Collaboration is an open-core collaborative software platform, a popular alternative to enterprise email solutions. The campaign is mass-spreading; its targets are a variety of small and medium businesses and governmental entities. According to ESET telemetry, the greatest number of targets are located in Poland, followed by Ecuador and Italy. To date, we have not attributed this campaign to any known threat actors.

Source:
https://www.welivesecurity.com/en/eset-research/mass-spreading-campaign-targeting-zimbra-users/

Intel Source:

ASEC

Intel Name:

Hakuna_Matata_ransomware

Date of Scan:

2023-08-16

Impact:

LOW

Summary:

Recently, ASEC reserachers has discovered the Hakuna Matata ransomware is used to attack Korean companies. Hakuna Matata is a recent ransomware and it was first time identified in July, 2023 on Twitter. Later this month, a post of a threat actor using Hakuna Matata on the dark web was shared on Twitter as well. Also to be mentined by researchers that the ransomware strains uploaded on VirusTotal, the file uploaded on July 2nd, 2023 is confirmed to be the first case.

Source:
https://asec.ahnlab.com/en/56010/

Intel Source:

Cyberint

Intel Name:

Raccoon_Stealer_Malware_Returns

Date of Scan:

2023-08-16

Impact:

LOW

Summary:

Cyberint researchers have seen that the developers of Raccoon Stealer information-stealing malware have ended their 6-month hiatus from hacker forums to promote a new 2.3.0 version of the malware to cyber criminals. It is one of the most well-known and widely used information-stealing malware families, having been around since 2019, sold via a subscription model for $200/month to threat actors.

Source:
https://cyberint.com/blog/financial-services/raccoon-stealer/

Intel Source:

Trustwave

Intel Name:

The_rise_of_LLM_engines_WormGPT_and_FraudGPT

Date of Scan:

2023-08-16

Impact:

LOW

Summary:

Trustwave researchers discussed in their blog two such LLM engines that were up for sale available on underground forums, WormGPT and FraudGPT. If criminals would get their own ChatGPT-like tool, the implications for cybersecurity, social engineering, and overall digital safety could be so damagimg. This prospect highlights the importance of staying vigilant in our efforts to secure, and responsibly develop, artificial intelligence technology in order to mitigate potential risks and safeguard against misuse.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/wormgpt-and-fraudgpt-the-rise-of-malicious-llms/
https://netenrich.com/blog/fraudgpt-the-villain-avatar-of-chatgpt

Intel Source:

Uptycs

Intel Name:

QwixxRAT_aka_Telegram_RAT

Date of Scan:

2023-08-16

Impact:

LOW

Summary:

The Uptycs researchers discovered QwixxRAT (aka Telegram RAT) in early August 2023. The threat actor is widely distributing their malicious tool through Telegram and Discord platforms. Once installed on the victim’s Windows platform machines, the RAT stealthily collects sensitive data, which is then sent to the attacker’s Telegram bot, providing them with unauthorized access to the victim’s sensitive information.

Source:
https://www.uptycs.com/blog/remote-access-trojan-qwixx-telegram

Intel Source:

Netscope

Intel Name:

Phishing_Campaign_Steals_Cloud_Credentials

Date of Scan:

2023-08-16

Impact:

MEDIUM

Summary:

Last couple months Netskope Threat Labs analysts has been monitoring a staggering 61-fold increase in traffic to phishing pages hosted in Cloudflare R2. The most of the phishing campaigns target Microsoft login credentials, although there are some pages targeting Adobe, Dropbox, and other cloud apps. The attacks have been targeting victims mainly in North America and Asia, across different segments, led by the technology, financial services, and banking sectors.

Source:
https://www.netskope.com/blog/evasive-phishing-campaign-steals-cloud-credentials-using-cloudflare-r2-and-turnstile

Intel Source:

Cyble

Intel Name:

Amadey_Bot_leveraged_by_LummaC_Stealer_to_Deploy_SectopRAT

Date of Scan:

2023-08-16

Impact:

LOW

Summary:

Cyble reserachers has recently come across a novel approach for spreading SectopRAT. This technique entails delivering the SectopRAT payload by utilizing the Amadey bot malware, which is retrieved from the LummaC stealer.

Source:
https://cyble.com/blog/lummac-stealer-leveraging-amadey-bot-to-deploy-sectoprat/

Intel Source:

AT&T

Intel Name:

The_Shadow_Nexus_of_Malware_and_Proxy_Application

Date of Scan:

2023-08-16

Impact:

MEDIUM

Summary:

Researchers from AT&T Alien Labs found a significant campaign of attacks distributing a proxy server application on Windows computers. Additionally, a proxy service provider was found, whose proxy requests are forwarded through hacked systems that have been turned into residential exit nodes by malware invasion.

Source:
https://cybersecurity.att.com/blogs/labs-research/proxynation-the-dark-nexus-between-proxy-apps-and-malware

Intel Source:

HP ThreatResearch

Intel Name:

The_malware_campaigns_use_a_variety_of_programming_languages

Date of Scan:

2023-08-15

Impact:

LOW

Summary:

Last couple months, HP ThreatResrearch team have noticed a surge of finance-themed malicious spam campaigns spreading malware through batch scripts (.bat). The campaigns use a wide variety of programming languages to achieve different objectives within the infection chain – from batch scripts, PowerShell, Go, shellcode to .NET.

Source:
https://threatresearch.ext.hp.com/do-you-speak-multiple-languages-malware-does/

Intel Source:

Fortinet

Intel Name:

Continues_OSS_Supply_Chain_Attacks_Hidden_in_the_Python_Package

Date of Scan:

2023-08-15

Impact:

LOW

Summary:

Python Package Index (PyPI) packages have become a common thing for threat actors to post malware that unsuspecting victims possible download. The FortiGuard Labs analysts has been monitoring that activity attack vector for some time and posted the update of the zero-day attacks they have discovered. Recently, they discovered several new zero-day PyPI attacks using this AI engine assistant.

Source:
https://www.fortinet.com/blog/threat-research/continued-oss-supply-chain-attacks-hidden-in-pypi

Intel Source:

Trellix

Intel Name:

NetSupportRAT_exploring_new_techniques

Date of Scan:

2023-08-15

Impact:

LOW

Summary:

Trellix researchers observed a new campaign using fake Chrome browser updates to trick victims to install a remote administration software tool called NetSupport Manager. The threat actors take advantage of this software to steal information and take control of victim computers. The detected campaign has similarity with previously reported SocGholish campaign, which was run by a suspected Russian threat actor.

Source:
https://www.trellix.com/en-us/about/newsroom/stories/research/new-techniques-of-fake-browser-updates.html

Intel Source:

Cyfirma

Intel Name:

Stealthy_Malicious_MSI_Loader

Date of Scan:

2023-08-15

Impact:

LOW

Summary:

The Cyfirma reserachers has observed a disguised Stealthy MSI Loader being advertised in dark web forums by Russian threat actor, showcasing it has a potential ability to evade detection by both Virus Total scan and Windows Defender. Additionally, through the researchers’s investigation, it was established a link between this MSI Loader and the BatLoader campaign observed in March 2023, highlighting potential coordination between these threats.

Source:
https://www.cyfirma.com/outofband/stealthy-malicious-msi-loader-overlapping-technique-and-infrastructure-with-batloader/

Intel Source:

Akamai

Intel Name:

New_Magento_Campaign_Discovered_called_Xurum

Date of Scan:

2023-08-14

Impact:

LOW

Summary:

Over the past few months, Akamai has been closely monitoring a focused campaign that specifically targets a relatively small number of Magento deployments. They dubbed the campaign Xurum to reference the domain name of the C2 server utilized by the attacker.

Source:
https://www.akamai.com/blog/security-research/new-sophisticated-magento-campaign-xurum-webshell#:~:text=Akamai%20researchers%20have%20discovered%20an%20ongoing%20server-side%20template
of%20the%20attacker%E2%80%99s%20command%20and%20control%20%28C2%29%20server.

Intel Source:

Zscaler

Intel Name:

Unraveling_a_New_Threat_Targeting_LATAM_FinTech_Users

Date of Scan:

2023-08-14

Impact:

MEDIUM

Summary:

JanelaRAT, a newly discovered cyber threat, has been unveiled by Zscaler ThreatLabz. Primarily focused on the Latin American (LATAM) financial sector, this sophisticated malware employs advanced techniques including DLL side-loading and dynamic command and control infrastructure. With capabilities ranging from evasive maneuvers to self-defense mechanisms, the threat aims to compromise sensitive financial data. The malware’s origins are suggested by Portuguese strings in its code and a Portuguese-speaking developer, highlighting its targeted region and intentions.

Source:
https://www.zscaler.com/blogs/security-research/janelarat-repurposed-bx-rat-variant-targeting-latam-fintech

Intel Source:

Trendmicro

Intel Name:

Monti_Ransomware_Group_Resumes_Attacks_with_New_Linux_Variant

Date of Scan:

2023-08-14

Impact:

MEDIUM

Summary:

Trend Micro researchers observe the Monti ransomware group, resembling Conti, resumes attacks on legal and government sectors with a fresh Linux variant. Unlike previous versions, this variant modifies encryption methods, uses an infection marker, and alters system files.

Source:
https://www.trendmicro.com/en_us/research/23/h/monti-ransomware-unleashes-a-new-encryptor-for-linux.html

Intel Source:

CERT UA

Intel Name:

Phishing_Attack_Targeting_Government_Agencies

Date of Scan:

2023-08-14

Impact:

MEDIUM

Summary:

CERT-UA has identified a phishing attack on government agencies involving fraudulent emails from CERT-UA urging password change through a malicious link. The attackers imitate Roundcube’s interface and use a deceptive subdomain

Source:
https://cert.gov.ua/article/5455833

Intel Source:

CISA

Intel Name:

Updates_on_SEASPY_and_WHIRLPOOL_Backdoors

Date of Scan:

2023-08-14

Impact:

MEDIUM

Summary:

The US Department of Homeland Security (CISA) has published a report on Barracuda email servers that were compromised by cyber-thieves in the summer of 2016 and the following year. CISA obtained four malware samples – including SEASPY and WHIRLPOOL backdoors. The device was compromised by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG).

Source:
https://www.cisa.gov/news-events/analysis-reports/ar23-221a

Intel Source:

Sucuri

Intel Name:

The_surge_in_malware_cases_linked_to_a_Gootloader_payload_delivery

Date of Scan:

2023-08-12

Impact:

LOW

Summary:

This month, Sucuri analysts traced a noticeable surge in malwares linked to a malicious payload delivery system known as Gootloader. The group behind this malware is believed to operate a malware-as-a-service operation, exclusively providing a malware delivery service for other threat actors. In their blog, Sucuri is dicussing why Gootloader is so effective, and go into the details of inner workings and shed light on the tactics employed by the operators behind it.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gootloader-why-your-legal-document-search-may-end-in-misery/

Intel Source:

PaloAlto

Intel Name:

The_SugarCRM_CVE_2023_22952_zero_day_vulnerability

Date of Scan:

2023-08-12

Impact:

MEDIUM

Summary:

A zero-day vulnerability in the SugarCRM customer relationship management platform was used by threat actors to gain access to customers’ AWS accounts, according to a report from Palo Alto Networks Unit 42.

Source:
https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/

Intel Source:

SOCRadar

Intel Name:

A_new_cybercriminals_service_called_Dark_Utilities

Date of Scan:

2023-08-12

Impact:

MEDIUM

Summary:

In their blog, Cisco Talos shared that they observed malware samples using Dark Utilities service in the wild to establish C2 communications channels and remote access capabilities on infected systems. They discovered malware targeted Windows and Linux systems leveraging Dark Utilities

Source:
https://socradar.io/dark-utilities-platform-provides-c2-server-for-threat-actors/

Intel Source:

Fortinet

Intel Name:

Attackers_Using_Freezers_And_SYK_Crypter_to_Distribute_Malware

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

Researchers from FortiGuard have discovered a brand-new Rust-written injector that can introduce XWorm and shellcode into a victim’s environment. Additionally, an investigation by researchers showed a sharp rise in injector activity in May 2023. To avoid antivirus detection, shellcode can be encrypted using AES, RC4, or LZMA, and it can be Base64-encoded.

Source:
https://www.fortinet.com/blog/threat-research/malware-distributed-via-freezers-and-syk-crypter

Intel Source:

Securelist

Intel Name:

Unknown_Actor_Using_DroxiDat_and_Cobalt_Strike

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

Securelist researchers have seen a new SystemBC variant deployed to a critical infrastructure target. This time, the proxy-capable backdoor was deployed alongside Cobalt Strike beacons in a South African nation’s critical infrastructure.

Source:
https://securelist.com/focus-on-droxidat-systembc/110302/

Intel Source:

WeliveSecurity

Intel Name:

MoustachedBouncer_cyberespionage_activity_against_diplomats

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

MoustachedBouncer is a cyberespionage group discovered by ESET Research since 2014. Thousands of IPs have been seen by AT&T Alien Labs to act as proxy exit nodes in a way that resembles corrupted AdLoad systems. This activity might be a sign that tens of thousands of Mac computers have been taken over and used as proxy exit nodes. Over the past year, at least 150 samples have been seen in the wild. Welinesecurity reserachers believe that MoustachedBouncer uses a lawful interception system (such as SORM) to conduct its AitM operations.

Source:
https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/

Intel Source:

Kaspersky

Intel Name:

Common_TTPs_of_attacks_against_industrial_organizations

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

Kaspersky ICS Cert analysts identified over 15 implants and their variants planted by the threat actor(s) in various combinations. The attackers aimed to establish a permanent channel for data exfiltration, including data stored on air-gapped systems. Analysts have medium to high confidence that a threat actor called APT31, also known as Judgment Panda and Zirconium, is behind the activities described in their report.

Source:
https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Intel Source:

Cyble

Intel Name:

The_Most_Recent_STRRAT_Version_Contains_Dual_Obfuscation_Layers

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

The Cyble Research and Intelligence Labs have discovered a fresh method of infection that is used to spread STRRAT. This novel approach entails disseminating STRRAT version 1.6, which makes use of two string obfuscation strategies.

Source:
https://cyble.com/blog/strrats-latest-version-incorporates-dual-obfuscation-layers/

Intel Source:

ASEC

Intel Name:

Changes_in_CHM_Malware_Distribution

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

ASEC has previously published a CHM malware type coping Korean financial institutes and insurance companies. Recently, the execution method of this malware type has been changing every week. ASEC post will cover how the changed execution processes of the CHM malware are recorded in AhnLab’s EDR products.

Source:
https://asec.ahnlab.com/en/55972/

Intel Source:

Sucuri

Intel Name:

Hybrid_malware_leveraging_various_internet_protocols

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

Sucuri analysts discover periodically an unique hybrid malware leveraging various internet protocols. During a recent investigation, the analysts found an interesting piece of JavaScript malware that indirectly uses the DNS protocol to obtain redirect URLs.

Source:
https://blog.sucuri.net/2023/08/from-google-dns-to-tech-support-scam-sites-unmasking-the-malware-trail.html

Intel Source:

Sentinelone

Intel Name:

In_Depth_Analysis_of_LOLKEK_Payloads

Date of Scan:

2023-08-11

Impact:

LOW

Summary:

Researchers from SentinelLabs have examined LOLKEK Payload sample sets. Small to medium-sized enterprises (SMBs) and individual users are typically the main objectives.

Source:
https://www.sentinelone.com/blog/lolkek-unmasked-an-in-depth-analysis-of-new-samples-and-evolving-tactics/

Intel Source:

CrowdStrike

Intel Name:

Zero_Day_Exploit_Case_Study_CVE_2023_36874

Date of Scan:

2023-08-11

Impact:

MEDIUM

Summary:

In July 2023, the CrowdStrike Falcon team observed an unknown exploit with unknown vulnerability affecting the Windows Error Reporting (WER) component. Crowdstrike team put their findings to their report about this new vulnerability to Microsoft. Microsoft assigned the identifier CVE-2023-36874 to the vulnerability.

Source:
https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/

Intel Source:

Eclecticiq

Intel Name:

Campaign_Against_NATO_Aligned_Foreign_Ministries

Date of Scan:

2023-08-11

Impact:

MEDIUM

Summary:

Two PDF documents have been spotted, and EclecticIQ researchers believe with high confidence that they are a part of a continuous campaign aimed at NATO member countries’ foreign ministries. The PDF files contained two fake diplomatic invitations that appeared to be coming from the German embassy.

Source:
https://blog.eclecticiq.com/german-embassy-lure-likely-part-of-campaign-against-nato-aligned-ministries-of-foreign-affairs

Intel Source:

Proofpoint

Intel Name:

Attackers_Using_EvilProxy_Phishing_Kit

Date of Scan:

2023-08-10

Impact:

HIGH

Summary:

Threat actors have been using the phishing toolkit EvilProxy to take control of cloud-based Microsoft 365 accounts belonging to executives at prominent companies.Researchers said the attacks exhibited both the prevalence of pre-packaged phishing-as-a-service toolkits, as well as the increased bypassing of multi-factor authentication to gain access to accounts.

Source:
https://www.proofpoint.com/us/blog/email-and-cloud-threats/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level

Intel Source:

AT&T

Intel Name:

AdLoad_Turns_Mac_Systems_into_Proxy_Exit_Nodes

Date of Scan:

2023-08-10

Impact:

LOW

Summary:

Thousands of IPs have been seen by AT&T Alien Labs to act as proxy exit nodes in a way that resembles corrupted AdLoad systems. This activity might be a sign that tens of thousands of Mac computers have been taken over and used as proxy exit nodes. Over the past year, at least 150 samples have been seen in the wild.

Source:
https://cybersecurity.att.com/blogs/labs-research/mac-systems-turned-into-proxy-exit-nodes-by-adload

Intel Source:

ASEC

Intel Name:

Tax_Invoices_and_Shipping_Statements_Posing_as_GuLoader_Malware

Date of Scan:

2023-08-10

Impact:

LOW

Summary:

Researchers from ASEC have discovered instances in which GuLoader was sent as an attachment in emails that were falsely labeled as shipping bills and tax invoices. A RAR (Roshal Archive packed) packed file included the freshly discovered GuLoader variation. GuLoader eventually downloads well-known malware strains including Remcos, AgentTesla, and Vidar when it is run by a user.

Source:
https://asec.ahnlab.com/en/55978/

Intel Source:

ASEC

Intel Name:

Magniber_Ransomware_Injection

Date of Scan:

2023-08-10

Impact:

LOW

Summary:

High numbers of the Magniber ransomware are routinely disseminated. It has been disseminated through the Internet Explorer vulnerability for the past few years, however when the browser’s support ended, the vulnerability is no longer being exploited. Recently, the ransomware has started spreading through Chrome and Edge browsers using filenames impersonating Windows security update packages (such as ERROR.Center.Security.msi). Currently, Magniber injects the ransomware into an active process, causing damage by encrypting the user’s files.

Source:
https://asec.ahnlab.com/en/55961/

Intel Source:

Aquasec

Intel Name:

Kubernetes_Exposed

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

The potential catastrophe of having Kubernetes (k8s) cluster hijacked is could be a disaster magnified a million times over. Aquasec researchers investigated and uncovered Kubernetes clusters belonging to more than 350 organizations, open-source projects, and individuals, openly accessible and largely unprotected. At least 60% of them were breached and had an active campaign that deployed malware and backdoors.

Source:
https://blog.aquasec.com/kubernetes-exposed-one-yaml-away-from-disaster

Intel Source:

Cyble

Intel Name:

The_AgentTesla_malware_attack

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

Cyble Research and Intelligence Labs (CRIL) has recently observed an AgentTesla malware attack that employs a well-developed process with multiple stages. The campaign is designed to trick unsuspecting users into opening Tax related documents and accompanying control panel files (CPL).

Source:
https://cyble.com/blog/agenttesla-malware-targets-users-with-malicious-control-panel-file/

Intel Source:

Zscalar

Intel Name:

New_InfoStealer_Named_Statc_Stealer

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

Zscaler ThreatLabz researchers have discovered a new information stealer family called Statc Stealer. It is a sophisticated malware that infects devices powered by Windows, gains access to computer systems, and steals sensitive information.

Source:
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat

Intel Source:

ReversingLabs

Intel Name:

Malicious_Python_Package_Campaign_Targets_Developers_through_PyPI

Date of Scan:

2023-08-09

Impact:

MEDIUM

Summary:

Researchers from ReversingLabs identified persistent campaign leverages malicious Python packages on PyPI to deceive developers. Attackers mimic popular open-source tools, embedding hidden malicious code. They create matching GitHub repositories for credibility and employ dynamic command and control URLs

Source:
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Intel Source:

Cyble

Intel Name:

Uncovering_Tech_Scammers_involved_in_different_ransomware_attacks

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

Cyble researchers recently observed a new Tech Scam campaign. It seemed it has involved scammers setting up a non-existent antivirus solution site to deceive users into paying for non-existent services. During analysis, researchers discovered various ransomware variants leveraged by tech scammers to propagate their fraudulent schemes.

Source:
https://cyble.com/blog/utilization-of-leaked-ransomware-builders-in-tech-related-scams/

Intel Source:

ASEC

Intel Name:

The_Malware_distribution_as_Coin_exchange

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

ASEC lab response Center has recently discovered a new malware disguised with coin exchange and investment-related topics. The malware is pretended in the form of an executable and a Word file.It is suspected that it was created by the Kimsuky group.

Source:
https://asec.ahnlab.com/en/55944/

Intel Source:

ASEC

Intel Name:

The_malware_installation_as_normal_file_of_a_Korean_Development_Company

Date of Scan:

2023-08-09

Impact:

LOW

Summary:

AhnLab has previously mentioned about the malware that is generated by the installation file of a Korean program development company. When malware is distributed alongside an installation file, users will struggle to notice that malware is being executed concurrently.

Source:
https://asec.ahnlab.com/en/55940/

Intel Source:

SOC Radar

Intel Name:

Investigating_the_Big_Head_Ransomware

Date of Scan:

2023-08-08

Impact:

LOW

Summary:

After first appearing in May 2023, Big Head Ransomware is a relatively new actor in the cyber threat environment. This malicious program is made up of several different varieties, each with its own features and powers. Little is known about the threat actor who is responsible for the Big Head Ransomware. The actor has been seen interacting with victims on Telegram and through emails.

Source:
https://socradar.io/dark-web-profile-big-head-ransomware/

Intel Source:

Team-Cymru

Intel Name:

An_Overview_of_Qakbot_Infrastructure

Date of Scan:

2023-08-08

Impact:

LOW

Summary:

Team-Cymru researchers have provided an update on the high-level analysis of QakBot infrastructure, this represents an ongoing piece of research, their analysis of QakBot is fluid with various hypotheses being identified and tested. As and when they uncover new insights into QakBot campaigns they will seek to provide further written updates.

Source:
https://www.team-cymru.com/post/visualizing-qakbot-infrastructure-part-ii-uncharted-territory

Intel Source:

TrendMicro

Intel Name:

TargetCompany_Ransomware_Abusing_FUD_Obfuscator_Packers

Date of Scan:

2023-08-07

Impact:

LOW

Summary:

In order to persistently deploy its initial stage, the most recent version of the TargetCompany ransomware first exploits weak SQL servers. The code tries many approaches to try persistence, such as switching the URLs or relevant routes, until it successfully locates a location to run the Remcos RAT.

Source:
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html

Intel Source:

Fortinet

Intel Name:

DoDo_and_Proton_Ransomware_targeting_windows_users

Date of Scan:

2023-08-07

Impact:

MEDIUM

Summary:

Researchers from Fortinet have discovered the Ransomware Roundup report highlights the emerging threats of DoDo and Proton ransomware variants, both specifically designed to target Microsoft Windows users. DoDo ransomware, a derivative of Chaos ransomware, disguises itself as an educational application called “Mercurial Grabber” to steal information and encrypt victims’ files. Its recent variants demand ransom for file decryption and data non-disclosure. Meanwhile, Proton ransomware encrypts files on Windows systems, demanding a ransom for file recovery.

Source:
https://www.fortinet.com/blog/threat-research/ransomware-roundup-dodo-and-proton

Intel Source:

Trend Micro

Intel Name:

Water_minyades_batloader_malware

Date of Scan:

2023-08-07

Impact:

MEDIUM

Summary:

Trend Micro researchers observe the Water Minyades Batloader malware has evolved with Pyarmor Pro obfuscation, making manual de-obfuscation difficult. Using large MSI files, it initiates a sophisticated kill chain, fingerprinting victim networks and delivering second-stage payloads for stealthy attacks.

Source:
https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html

Intel Source:

Talos

Intel Name:

New_Threat_Actor_Leveraging_Customized_Yashma_Ransomware

Date of Scan:

2023-08-07

Impact:

LOW

Summary:

Researchers from Cisco Talos have identified an unknown threat actor, who appears to be of Vietnamese descent, who has been operating ransomware since at least June 4, 2023. This continuing attack makes use of a Yashma ransomware version that mimics WannaCry traits and is expected to target several locations. The ransom note is sent using an unusual method by the threat actor. They execute an embedded batch file to download the ransom note from the actor-controlled GitHub repository rather than inserting the ransom note strings in the malware.

Source:
https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/

Intel Source:

Sentilone

Intel Name:

North_Korea_icompromised_Russian_Missile_Engineering_Company

Date of Scan:

2023-08-07

Impact:

MEDIUM

Summary:

SentinelLabs identified an intrusion into the Russian defense industrial base, specifically a missile engineering organization NPO Mashinostroyeniya. Our analysis attributes the email server compromise to the ScarCruft threat actor. We also identify the separate use of a Lazarus Group backdoor for compromise of their internal network.

Source:
https://www.sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/

Intel Source:

CERT UA

Intel Name:

MerlinAgent_cyber_attacks_against_Ukraine

Date of Scan:

2023-08-07

Impact:

LOW

Summary:

Ukraine’s CERT-UA is warning of malicious emails posing as official communications. The emails contain harmful attachments, leading to the execution of dangerous scripts and the deployment of the malicious “ctlhost.exe” associated with the MerlinAgent program

Source:
https://cert.gov.ua/article/5391805

Intel Source:

Security Affairs

Intel Name:

NPM_highly_targeted_attacks

Date of Scan:

2023-08-07

Impact:

LOW

Summary:

Security Affairs researchers discovered a new set of malicious packages on the npm package manager that can exfiltrate sensitive developer data.

Source:
https://securityaffairs.com/149165/hacking/npm-highly-targeted-attacks.html

Intel Source:

PT Security

Intel Name:

The_Cyber_Campaign_by_Space_Pirates_in_Russia_and_Serbia

Date of Scan:

2023-08-05

Impact:

MEDIUM

Summary:

Using unique strategies and acquiring new cyber weapons, the threat actor known as Space Pirates has been connected to attacks on at least 16 organizations in Serbia and Russia over the past year. Governmental organizations, educational institutions, private security firms, aerospace makers, agricultural producers, defense, energy, and healthcare companies are among the targets.

Source:
https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools/

Intel Source:

Any.Run

Intel Name:

Remcos_Malware_Analysis

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

Any.Run malware hunting service recorded a video for Remcos RAT execution and analysis. Remcos is a remote access trojan – a malware used to take remote control over infected PCs. This trojan is created and sold to clients by a “business” called Breaking Security. Remcos trojan can be delivered in different forms. Based on RAT’s analysis, it can be spread as an executable file with the name that should convince users to open it, or it pretends to bne a Microsoft Word file that exploits vulnerabilities.

Source:
https://any.run/malware-trends/remcos

Intel Source:

ISC.SANS

Intel Name:

From_Small_LNK_to_Large_Malicious_BAT_File_With_Zero_VT_Score

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

ISC.SANS researchers have seen my spam trap caught an e-mail with LNK attachment, the e-mail message was the usual malspam fare trying to appear as a purchase order sent to the recipient.

Source:
https://isc.sans.edu/diary/From+small+LNK+to+large+malicious+BAT+file+with+zero+VT+score/30094/

Intel Source:

Any Run

Intel Name:

Redline_Malware_Analysis

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

ANY.RUN researchers did the analysis and watched the RedLine malware actions in an interactive sandbox simulation. RedLine Stealer or RedLine is malware that can collect users’ confidential information and deliver other malicious programs.

Source:
https://any.run/malware-trends/redline

Intel Source:

MetaBase Q

Intel Name:

Botnet_Fenix_new_botnet

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

The Threat Intel team at Metabase Q has discovered a local group that created a new botnet called as “Fenix,” which specifically targets users accessing government services, particularly tax-paying individuals in Mexico and Chile. The attackers redirect victims to fraudulent websites that mimic the official portals These fake websites prompt users to download a supposed security tool, claiming it will enhance their portal navigation safety

Source:
https://www.metabaseq.com/fenix-botnet/

Intel Source:

TrendMicro

Intel Name:

The_Play_ransomware_activity

Date of Scan:

2023-08-04

Impact:

MEDIUM

Summary:

TrendMicro have observed the Play ransomware group amplified their activity with a number of new tools and exploits, including the vulnerabilities ProxyNotShell, OWASSRF, and a Microsoft Exchange Server Remote Code Execution. More recently, it’s also begun to use new tools like Grixba, a custom network scanner and infostealer, and the open-source VSS management tool AlphaVSS.

Source:
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play

Intel Source:

Securelist

Intel Name:

Emotet_DarkGate_and_LokiBot_new_analyses

Date of Scan:

2023-08-04

Impact:

MEDIUM

Summary:

Securelist researchers found new Emotet samples, a new loader dubbed “DarkGate”, and a new LokiBot infostealer campaign. They described all three in private reports, from which this post contains an excerpt.

Source:
https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/

Intel Source:

SOC Radar

Intel Name:

The_Attack_Method_of_Rhysida_Ransomware

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

The Rhysida Ransomware Group has become a serious threat in the online environment. In a short period of time, Rhysida posed a significant concern to businesses all across the world with its powerful encryption capabilities and double extortion tactics. The group’s emphasis on attacking military and governmental institutions, as seen in their assault on the Chilean Army, emphasizes how serious their actions may be.

Source:
https://socradar.io/threat-profile-rhysida-ransomware/

Intel Source:

McAfee

Intel Name:

The_Back_to_School_Scams

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

McAfee Labs analysts has discovered the following PDFs targeting back-to-school trends. Their article warns the parents on what to educate their children on and how not to fall victim to such fraud. McAfee Labs encountered a PDF file campaign featuring a fake CAPTCHA on its first page, to verify human interaction.

Source:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-season-of-back-to-school-scams/

Intel Source:

Trustwave

Intel Name:

New_Rilide_Stealer_Version

Date of Scan:

2023-08-04

Impact:

LOW

Summary:

Securelist researchers found new Emotet samples, a new loader dubbed “DarkGate”, and a new LokiBot infostealer campaign. They described all three in private reports, from which this post contains an excerpt.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/new-rilide-stealer-version-targets-banking-data-and-works-around-google-chrome-manifest-v3/

Intel Source:

Microsoft

Intel Name:

Hackers_Sent_Phishing_Emails_Masquerading_as_Microsoft_Teams_Chats

Date of Scan:

2023-08-03

Impact:

MEDIUM

Summary:

In “highly targeted social engineering attacks,” hackers within the Russian military utilized Microsoft Teams discussions as phishing baits. The IT giant announced on Wednesday that it has discovered a campaign by the well-known Russian hacker collective Midnight Blizzard, also known as NOBELIUM, Cozy Bear, or APT29. According to U.S. and U.K. law enforcement organizations, the group is a component of the Russian Federation’s Foreign Intelligence Service.

Source:
https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/

Intel Source:

Recorded Future

Intel Name:

Russian_APT_BlueCharlie_Swaps_Infrastructure_to_Evade_Detection

Date of Scan:

2023-08-03

Impact:

LOW

Summary:

Researchers from Recorded Future have identified the latest campaign from BlueCharlie, the group completely switched up its infrastructure, creating nearly 100 new domains from which to perform credential harvesting and follow-on espionage attacks.

Source:
https://go.recordedfuture.com/hubfs/reports/cta-2023-0802.pdf

Intel Source:

Sentilone

Intel Name:

Illicit_Brand_Impersonation

Date of Scan:

2023-08-03

Impact:

LOW

Summary:

Santilone researchers continually observe brands being impersonated for illicit use, including credential phishing and malware delivery. In their blog they shared examples of opportunistic and targeted threat actors impersonating trusted brands and they can make use of new tooling for the purposes of hunting and tracking them moving forward.

Source:
https://www.sentinelone.com/blog/illicit-brand-impersonation-a-threat-hunting-approach/

Intel Source:

ASEC

Intel Name:

Linux_Systems_Are_Affected_by_Reptile_Malware

Date of Scan:

2023-08-03

Impact:

LOW

Summary:

ASEC has recently observed Reptile, an open-source Linux rootkit with powerful concealment features and Port Knocking capabilities. It examines real-world attacks, including those targeting Korean companies, and draws parallels to the Mélofée malware.

Source:
https://asec.ahnlab.com/en/55785/

Intel Source:

ASEC

Intel Name:

Sliver_C2_malware_being_distributed

Date of Scan:

2023-08-03

Impact:

LOW

Summary:

ASEC has recently observed similar malware from the past SparkRAT being distributed while being pretending as setup files for Korean VPN service providers and marketing program producers. Contrary the past cases where SparkRAT was used, Sliver C2 was used in the recent attacks and techniques to avoid detection were employed.

Source:
https://asec.ahnlab.com/en/55652/

Intel Source:

CISA

Intel Name:

Attackers_Exploiting_Ivanti_EPMM_Vulnerabilities

Date of Scan:

2023-08-02

Impact:

MEDIUM

Summary:

In response to the active exploitation of CVE-2023-35078 and CVE-2023-35081, the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) have released a joint cybersecurity advisory. From at least April 2023 to July 2023, advanced persistent threat actors used CVE-2023-35078 as a zero-day exploit to collect data from a number of Norwegian enterprises as well as to access and compromise the network of a Norwegian government agency.

Source:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

Intel Source:

Halcyon

Intel Name:

Ransomware_Command_and_Control_Providers_report

Date of Scan:

2023-08-02

Impact:

LOW

Summary:

The Halcyon researchers shared their research that observed new techniques used to unmask yet another Ransomware Economy player that is speed up ransomware attacks and state-sponsored APT operations like Command-and-Control Providers (C2P) who sell services to threat actors while assuming a legal business profile. In their report, titled Cloudzy with a Chance of Ransomware, Halcyon showed a unique method for identifying C2P entities that can be used to forecast the pioneer to major ransomware campaigns and other advanced attacks. Halcyon also identifies two new, previously undisclosed ransomware affiliates Halcyon named them as Ghost Clown and Space Kook that currently deploy BlackBasta and Royal, respectively.

Source:
https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Intel Source:

Cado Security

Intel Name:

New_P2Pinfect_Malware_Campaign_Against_Redis_Servers_Detailed

Date of Scan:

2023-08-02

Impact:

LOW

Summary:

Researchers from Cado Security Labs have just discovered a brand-new malware campaign that targets Redis data store deployments that are open to the general public. The malware, which was created in Rust and given the name “P2Pinfect” by the creators, functions as a botnet agent. An embedded Portable Executable (PE) and an additional ELF executable are both included in the sample that researchers analyzed, indicating cross-platform compatibility between Windows and Linux.

Source:
https://www.cadosecurity.com/redis-p2pinfect/

Intel Source:

Trustwave

Intel Name:

New_Variant_of_SkidMap_Targeting_Redis

Date of Scan:

2023-08-02

Impact:

LOW

Summary:

Researchers from Trustwave examined the most recent logs from a honeypot in central Europe and discovered an intriguing entry that appeared again less than two weeks later. Only open Redis instances are targeted by SkidMap (also known as “NO AUTH”). They haven’t noticed brute-force attacks coming from the precise IP where the initial attack started.

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-new-variant-of-skidmap-targeting-redis/

Intel Source:

PaloAlto

Intel Name:

NodeStealer_2_0_The_Python_Version

Date of Scan:

2023-08-02

Impact:

LOW

Summary:

Unit 42 researchers have recently discovered a previously unreported phishing campaign that distributed an infostealer equipped to fully take over Facebook business accounts. Facebook business accounts were targeted with a phishing lure offering tools such as spreadsheet templates for busines

Source:
https://unit42.paloaltonetworks.com/nodestealer-2-targets-facebook-business/

Intel Source:

Cyble

Intel Name:

The_Cunning_XWorms_Multi_Staged_Attack

Date of Scan:

2023-08-01

Impact:

LOW

Summary:

The XWorm malware uses a new multistage approach to deliver its payload utilizing LOLBins, according to an analysis by Cyble researchers.

Source:
https://cyble.com/blog/sneaky-xworm-uses-multistaged-attack/

Intel Source:

Proofpoint

Intel Name:

WikiLoader_Favors_Complex_Evasion

Date of Scan:

2023-08-01

Impact:

LOW

Summary:

WikiLoader is a new piece of malware that Proofpoint researchers have discovered. It was originally discovered in December 2022 being delivered by TA544, an attacker who frequently targets Italian enterprises with Ursnif malware. They also noticed numerous succeeding initiatives, the majority of which had Italian groups as their target.

Source:
https://www.proofpoint.com/us/blog/threat-insight/out-sandbox-wikiloader-digs-sophisticated-evasion

Intel Source:

Team-Cymru

Intel Name:

The_IcedID_BackConnect_Protocol_Internals

Date of Scan:

2023-08-01

Impact:

LOW

Summary:

Researchers from Team-Cymru have updated their investigation and monitoring of the infrastructure linked to IcedID’s BackConnect protocol.

Source:
https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol-part-2

Intel Source:

Avast

Intel Name:

The_Unknown_Risks_of_Dot_Zip_Domains

Date of Scan:

2023-08-01

Impact:

LOW

Summary:

Cybercriminals have begun using.zip domains to trick people into thinking they are downloadable files rather than URLs, according to Avast researchers. According to research, one-third of the top 30.zip domains blacklisted by threat detection engines misuse the names of well-known IT firms like Microsoft, Google, Amazon, and Paypal to deceive users into thinking they are files from reputable businesses.

Source:
https://decoded.avast.io/matejkrcma/unpacking-the-threats-within-the-hidden-dangers-of-zip-domains/

Intel Source:

PaloAlto

Intel Name:

URLs_That_Deliver_Ransomware

Date of Scan:

2023-08-01

Impact:

LOW

Summary:

Researchers from Palo Alto have seen that threat actors are increasingly using URLs to deliver ransomware as they look for new ways to get their inventions past victims’ defenses. Additionally, they are utilizing more dynamic behaviors to spread their malware. Threat actors frequently switch hostnames, paths, filenames, or a combination of all three to disperse ransomware, in addition to following the tried-and-true method of deploying polymorphic variants of their ransomware.

Source:
https://unit42.paloaltonetworks.com/url-delivered-ransomware/#post-129339-_cfw3vjr99swz

Intel Source:

CISA

Intel Name:

v2_SUBMARINE_Backdoor

Date of Scan:

2023-07-31

Impact:

MEDIUM

Summary:

The US Department of Homeland Security (CISA) has released a report on a new type of backdoor malware, which could be used by hackers to gain access to a network of secure email addresses. CISA obtained seven malware samples related to a novel backdoor CISA has named SUBMARINE. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting certain versions 5.1.3.001 – 9.2.0.006 of Barracuda Email Security Gateway (ESG).

Source:
https://www.cisa.gov/news-events/analysis-reports/ar23-209a

Intel Source:

Bitdefender

Intel Name:

Threat_Actors_Abusing_the_Ad_Network

Date of Scan:

2023-07-31

Impact:

MEDIUM

Summary:

A threat actor with previous roots in cybercrime has shifted its initial access techniques to search engine advertisements to hijack searches for business applications such as AnyDesk, WinSCP, Cisco AnyConnect, Slack, TreeSize and potentially more. Bitdefender research showed that the actor(s) has successfully used this type of attack since late May 2023. Based on their threat insights, attackers seem to exclusively focus on North America. Until now, we have identified six target organizations in the US and one in Canada.

Source:
https://blogapp.bitdefender.com/labs/content/files/2023/07/Bitdefender-PR-WhitePaper-RatNitro-dex14210-en_EN.pdf

Intel Source:

Dr. Web

Intel Name:

Fruity_Trojan_Downloaders_Infect_Windows_Systems_in_Multiple_Stages

Date of Scan:

2023-07-31

Impact:

LOW

Summary:

Dr.Web researchers have observed that threat actors are creating fake websites hosting trojanized software installers to trick unsuspecting users into downloading a downloader malware called Fruity with the goal of installing remote trojans tools like Remcos RAT.

Source:
https://news.drweb.com/show/?i=14728&lng=en

Intel Source:

CISA

Intel Name:

CISA_Analyses_Report_v1_Exploit_Payload_Backdoor

Date of Scan:

2023-07-31

Impact:

MEDIUM

Summary:

CISA obtained 14 malware samples comprised of Barracuda exploit payloads and reverse shell backdoors. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG). The payload triggers a command injection (exploiting CVE-2023-2868), leading to dropping and execution of reverse shells on the ESG appliance. The reverse shells establish backdoor communications via OpenSSL with threat actor command and control (C2) servers. The actors delivered this payload to the victim via a phishing email with a malicious .tar attachment.

Source:
https://www.cisa.gov/news-events/analysis-reports/ar23-209c

Intel Source:

Securonix Threat Labs

Intel Name:

STARK_MULE_Targeting_Koreans_With_US_Military_Themed_Document_Lures

Date of Scan:

2023-07-31

Impact:

MEDIUM

Summary:

Securonix researchers have detected an ongoing cyber assault campaign that is targeting Korean-speaking people by using document lures with American military themes to fool them into launching malware on compromised systems.

Source:
https://www.securonix.com/blog/detecting-ongoing-starkmule-attack-campaign-targeting-victims-using-us-military-document-lures/

Intel Source:

CISA

Intel Name:

SEASPY_Backdoor

Date of Scan:

2023-07-31

Impact:

MEDIUM

Summary:

CISA obtained two SEASPY malware samples. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG). SEASPY is a persistent and passive backdoor that masquerades as a legitimate Barracuda service “BarracudaMailService” that allows the threat actors to execute arbitrary commands on the ESG appliance.

Source:
https://www.cisa.gov/news-events/analysis-reports/ar23-209b

Intel Source:

Blackberry

Intel Name:

Behavioral_detection_tips_for_the_RomCom_campaign

Date of Scan:

2023-07-28

Impact:

MEDIUM

Summary:

This article provides a technical analysis of the RomCom threat group, which is targeting politicians in Ukraine and U.S.-based healthcare organizations. It outlines process activity, IoCs, and Sigma rules to detect malicious behavior, such as the execution of a file from the Temp folder with a specific command line, and the use of COM objects to establish system persistence.

Source:
https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection

Intel Source:

Recorded Future

Intel Name:

BlueBravo_Attacks_European_Diplomatic_Entities

Date of Scan:

2023-07-28

Impact:

MEDIUM

Summary:

In order to deliver a new backdoor named GraphicalProton, the Russian nation-state actor known as BlueBravo has been detected targeting diplomatic institutions around Eastern Europe. This illustrates the threat’s ongoing evolution. The use of lawful internet services (LIS) for command-and-control (C2) obfuscation is a defining feature of the phishing campaign.

Source:
https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf

Intel Source:

Sophos

Intel Name:

A_New_Malicious_Campaign_Distributing_IT_Tools

Date of Scan:

2023-07-28

Impact:

LOW

Summary:

Researchers from Sophos have discovered a new malvertising campaign that targets users looking for IT tools like AnyDesk, Cisco AnyConnect VPN, and WinSCP by using ads on Google Search and Bing. This campaign attempts to trick users into downloading trojanized installers in order to access corporate networks and possibly launch future ransomware attacks.

Source:
https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/

Intel Source:

Sophos

Intel Name:

The_discover_of_apps_targeting_Iranian_bank_customers

Date of Scan:

2023-07-28

Impact:

LOW

Summary:

Sophos X-Ops researchers discovered malicious apps targeting Iranian banks, which collect internet banking login credentials and credit card details, and have capabilities such as hiding icons and intercepting SMS messages. The threat actors used Firebase as a C2 mechanism and leveraged legitimate domains for C2 servers. The malware also searches for other banking, payment, and cryptocurrency apps, and the certificate used to sign the malicious apps was previously used by an IT consulting and development firm in Malaysia. The malicious apps request permissions to read SMS messages and urge users to grant them.

Source:
https://news.sophos.com/en-us/2023/07/27/uncovering-an-iranian-mobile-malware-campaign/

Intel Source:

GitHub Blog

Intel Name:

Jade_Sleet_Storm_0954_Social_Engineering_Campaign

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

GitHub has observed a Jade Sleet social engineering campaign which targets employees of technology firms, those who are connected to the blockchain, cryptocurrency, online gambling, and cybersecurity sectors. Jade Sleet (Storm-0954) is an activity group originally from North Korea and specializes in targeting cryptocurrency-related organizations. They utilize a range of tactics lke the development of applications that look like legitimate cryptocurrency apps, to spread their attacks. Jade Sleet has used the multi-platform targeted malware framework (MATA) and Electron frameworks to create implants for both Microsoft Windows and Mac-based systems.

Source:
https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/

Intel Source:

ICS CERT

Intel Name:

Attack_Tactics_Against_Industrial_Organizations

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Researchers from Kaspersky ICS CERT have looked at a number of assaults on commercial targets in Eastern Europe. The attackers’ goal in the attacks was to create an ongoing conduit for data exfiltration, including data from air-gapped systems. Based on the commonalities between these operations and other efforts that have been previously studied (such as ExCone and DexCone), including the use of FourteenHi variants, particular TTPs, and the scale of the attack.

Source:
https://ics-cert.kaspersky.com/publications/reports/2023/07/20/common-ttps-of-attacks-against-industrial-organizations-implants-for-remote-access/

Intel Source:

PaloAlto

Intel Name:

Diving_Deep_into_Mallox_Ransomware

Date of Scan:

2023-07-27

Impact:

MEDIUM

Summary:

Unit 42 researchers have observed an uptick of Mallox ransomware activities with an increase of almost 174% compared to the previous year exploiting MS-SQL servers to distribute the ransomware. Mallox (aka TargetCompany, FARGO and Tohnichi) is a ransomware strain that targets Microsoft Windows systems. It has been active since June 2021, and is notable for exploiting unsecured MS-SQL servers as a penetration vector to compromise victims’ networks.

Source:
https://unit42.paloaltonetworks.com/mallox-ransomware/

Intel Source:

Microsoft

Intel Name:

The_Investigation_of_Cloud_Compute_Resource_Abuse

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Microsoft researchers have observed an attack that is targeting organizations that incurred more than $300,000 in computing fees due to cryptojacking attacks

Source:
https://www.microsoft.com/en-us/security/blog/2023/07/25/cryptojacking-understanding-and-defending-against-cloud-compute-resource-abuse/

Intel Source:

Cyble

Intel Name:

Hackers_Targeting_Developers_via_Trojanized_MS_Visual_Studio

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Cyble researchers have uncovered a deceitful installer masquerading as an authentic Microsoft Visual Studio installer delivering a Cookie Stealer. This stealer is specifically designed to infiltrate and extract sensitive information stored in browser cookies, allowing attackers to compromise user accounts and invade privacy.

Source:
https://blog.cyble.com/2023/07/25/threat-actor-targeting-developers-via-trojanized-ms-visual-studio/

Intel Source:

Trellix

Intel Name:

Exploiting_of_the_search_ms_URI_Protocol_Handler

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

This article discusses the use of malicious payloads, such as AsyncRAT and Remcos RAT, by attackers to gain remote control over an infected system. It also covers the use of the “search” / “search-ms” URI protocol handler to launch attacks using a variety of file types, and how to disable this protocol handler. Additionally, it provides configuration information for AsyncRAT, including two IP addresses, six ports, a default botnet, a version number, and various settings.

Source:
https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html

Intel Source:

ASEC

Intel Name:

PurpleFox_Loader_Distributing_via_MS_SQL_Server

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

ASEC researchers have discovered the PurpleFox malware being installed on poorly managed MS-SQL servers. PurpleFox is a Loader that downloads additional malware and is known to mainly install CoinMiners.

Source:
https://asec.ahnlab.com/en/55492/

Intel Source:

Zscaler

Intel Name:

In_depth_Campaign_Analysis_of_QakBot

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Researchers from Zscaler have conducted in-depth investigations to uncover the various attack chains employed by Qakbot. In this research, they delve into the depths of Qakbot, conducting a comprehensive technical analysis to understand its behavior, attack vectors, and distribution methods.

Source:
https://www.zscaler.com/blogs/security-research/hibernating-qakbot-comprehensive-study-and-depth-campaign-analysis

Intel Source:

Sygnia

Intel Name:

Casbaneiro_Infection_Chain_is_Back

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Sygnia researchers have observed that threat actors behind the Casbaneiro campaign are still active to this day, with some changes over the years in their attack chain, C2 infrastructure, and TTPs. The threat actors are still making effective use of spear-phishing attack to initiate their infection chain, and still appear to be focused on Latin American targets.

Source:
https://blog.sygnia.co/breaking-down-casbaneiro-infection-chain-part2

Intel Source:

Splunk

Intel Name:

The_Analysis_of_Amadey_Threat

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

The Amadey Trojan Stealer, an active and prominent malware, first emerged on the cybersecurity landscape in 2018 and has maintained a persistent botnet infrastructure ever since. Several campaigns have used this malware.

Source:
https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html

Intel Source:

ASEC

Intel Name:

Lazarus_Threat_Group_Attacking_Windows_Servers

Date of Scan:

2023-07-27

Impact:

MEDIUM

Summary:

ASEC researchers have discovered that Lazarus, a threat group deemed to be nationally funded, is attacking Windows Internet Information Service (IIS) web servers and using them as distribution points for their malware.

Source:
https://asec.ahnlab.com/en/55369/

Intel Source:

Cyfirma

Intel Name:

A_Deceptive_and_Evolving_Malware_Tool

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

Cyfirma has identified a new threat in the cybersecurity landscape – Attacker-Crypter. This powerful tool allows cybercriminals to encrypt, obfuscate, and manipulate malicious code, evading detection by security tools and antivirus software. The freely available tool offers various features to enhance malware capabilities, including process injection, debugger evasion, and network communication.

Source:
https://www.cyfirma.com/outofband/attacker-crypter-v0-9-unveiling-a-powerful-tool-for-evading-antivirus-and-enhancing-malware-capabilities/

Intel Source:

Aquasec

Intel Name:

Tomcat_attacked_by_Mirai_Malware_and_beyond

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

This article discusses the misconfiguration of Apache Tomcat, the impact of the malware ‘l4sd4sx64’, and the prevalence of Apache Tomcat in cloud, big data, and website development. It also provides an analysis of the attacks against Tomcat server honeypots over a two-year period, including the detection of a web shell hidden in a WAR file, the execution of a shell script, and the execution of the Mirai malware.

Source:
https://blog.aquasec.com/tomcat-under-attack-investigating-the-mirai-malware

Intel Source:

Mandiant

Intel Name:

The_Deep_Investigation_of_JumpCloud_System_Breach

Date of Scan:

2023-07-27

Impact:

MEDIUM

Summary:

Mandiant researchers have investigated the JumpCloud system breach and its impact on customers. Mandiant attributed these intrusions to UNC4899, a Democratic People’s Republic of Korea (DPRK)-nexus actor, with a history of targeting companies within the cryptocurrency vertical.

Source:
https://www.mandiant.com/resources/blog/north-korea-supply-chain

Intel Source:

Checkmarx

Intel Name:

Targeted_Open_Source_Software_Supply_Chain_Attacks_on_Banking_Sector

Date of Scan:

2023-07-27

Impact:

LOW

Summary:

The banking sector is facing targeted open-source software supply chain attacks. Malicious actors exploit vulnerabilities in open-source packages, utilizing advanced techniques and deceptive tactics. Traditional controls fall short, necessitating proactive security measures throughout the Software Development Lifecycle (SDLC). Collaboration is key to strengthen defenses against these evolving threats. Checkmarx’s Supply Chain Intelligence offers protection and ongoing tracking.

Source:
https://checkmarx.com/blog/first-known-targeted-oss-supply-chain-attacks-against-the-banking-sector/

Intel Source:

Fortinet

Intel Name:

Cl0p_Ransomware_Financially_Motivated_Menace_Exploiting_Critical_Vulnerabilities

Date of Scan:

2023-07-27

Impact:

MEDIUM

Summary:

Cl0p ransomware, operated by the FIN11 threat group, has been a persistent and financially motivated menace since early 2019. This malicious software targets organizations in North America and Europe, encrypting files and exfiltrating sensitive data. Recent attacks have exploited critical vulnerabilities in software, including the MOVEit Transfer SQL injection flaw. The ransom group demands payment in exchange for file decryption and to prevent the public exposure of stolen information

Source:
https://www.fortinet.com/blog/threat-research/ransomware-roundup-cl0p

Intel Source:

Proofpoint

Intel Name:

Scammers_Targeting_Universities_With_Bioscience_Lures

Date of Scan:

2023-07-26

Impact:

LOW

Summary:

Researchers from Proofpoint have seen a campaign that targets university students in North America in late May 2023 using a variety of email lures with job-related themes. The emails claimed to be from several different organizations, the bulk of which were involved in the biosciences, healthcare, and biotechnology, as well as a few other unrelated ones. The operation went on until June 2023.

Source:
https://www.proofpoint.com/us/blog/threat-insight/job-scams-using-bioscience-lures-target-universitie

Intel Source:

Fortinet

Intel Name:

Zyxel_Vulnerability_Targeted_by_DDoS_Botnets

Date of Scan:

2023-07-26

Impact:

MEDIUM

Summary:

Researchers from FortiGuard have discovered the spread of many DDoS botnets that are taking use of the Zyxel vulnerability (CVE-2023-28771). It is possible for an unauthorized attacker to execute arbitrary code by sending a specially designed packet to the targeted device, which is how this vulnerability is defined by a command injection bug impacting several firewall models.

Source:
https://www.fortinet.com/blog/threat-research/ddos-botnets-target-zyxel-vulnerability-cve-2023-28771

Intel Source:

PaloAlto

Intel Name:

The_Rusty_peer_to_Peer_self_Replicating_worm_Called_P2PInfect

Date of Scan:

2023-07-26

Impact:

LOW

Summary:

Cloud researchers at Unit 42 have found a fresh peer-to-peer (P2P) worm that they named P2PInfect. This worm is capable of cross-platform infections and is written in the highly scalable and cloud-friendly programming language Rust. It targets Redis, a well-known open-source database application that is frequently utilized in cloud environments.

Source:
https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/

Intel Source:

Cyfirma

Intel Name:

Hackers_Behind_Big_Head_and_Poop69_Ransomware_Are_DEV0970_Storm_0970

Date of Scan:

2023-07-26

Impact:

LOW

Summary:

CYFIRMA research team have observed Poop69 ransomware appearing in the wild, and shortly after that, another ransomware named BIG HEAD emerged, thought to originate from the same threat actor, which has become popular recently due to its fake Windows update method.

Source:
https://www.cyfirma.com/outofband/dev-0970-storm-0970-the-threat-actors-behind-big-head-and-poop69-ransomware/

Intel Source:

Avast

Intel Name:

The_Dangers_of_Downloading_Illegal_Software_and_the_Hidden_AutoHotkey_Script

Date of Scan:

2023-07-26

Impact:

MEDIUM

Summary:

In a recent rise in malware activity, malicious AutoHotkey scripts that started the HotRat virus on victims’ PCs were bundled with illicit software, according to Avast researchers. This malware spreads via open repositories, with URLs being shared on social media and online discussion boards.

Source:
https://decoded.avast.io/martinchlumecky/hotrat-the-risks-of-illegal-software-downloads-and-hidden-autohotkey-script-within/

Intel Source:

Eclecticiq

Intel Name:

Spearphishing_Campaign_Targeting_Zimbra_Webmail_Portals_of_Government_Organizations

Date of Scan:

2023-07-26

Impact:

MEDIUM

Summary:

Researchers at EclecticIQ have discovered a spearphishing effort that uses vulnerable Zimbra and Roundcube email servers to target governmental institutions. The effort began in January 2023 and has primarily targeted Ukrainian government organizations, however it has also targeted Spain, Indonesia, and France.

Source:
https://blog.eclecticiq.com/spearphishing-campaign-targets-zimbra-webmail-portals-of-government-organizations

Intel Source:

Sentilone

Intel Name:

JumpCloud_Intrusion_linked_to_North_Korean_APT_Activity

Date of Scan:

2023-07-26

Impact:

MEDIUM

Summary:

Sentilone shared the details after investigation and attributed this attack to an unnamed “sophisticated nation-state sponsored threat actor”. Additionally, there are updated IOCs released and researchers associated the cluster of threat activity to a North Korean state sponsored APT. The IOCs are linked to a wide variety of activity that Sentilone attributes to DPRK, overall centric to the supply chain targeting approach seen in previous campaigns.

Source:
https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/?utm_source=substack&utm_medium=email

Intel Source:

HP Labs

Intel Name:

Cybercriminals_Using_Ads_to_Spread_IcedID_and_Infostealers

Date of Scan:

2023-07-25

Impact:

MEDIUM

Summary:

Researchers from HP Labs have observed two major malware campaigns delivering Vidar Stealer and IcedID, both of which use malvertising and imitate well-known software. Also, seen other families distributed using this method, including BatLoader and Rhadamanthys Stealer, indicating the growing popularity of this delivery mechanism among threat actors.

Source:
https://threatresearch.ext.hp.com/adverts-mimicking-popular-software-leads-to-malware/?web_view=true

Intel Source:

JPCERT/CC

Intel Name:

DangerousPasswords_Python_and_Nodejs_Malware_Across_Platforms

Date of Scan:

2023-07-25

Impact:

LOW

Summary:

JPCERT/CC has shared about DangerousPassword, a targeted attack group, is targeting developers of cryptocurrency exchange businesses on Windows, macOS, and Linux environments. They use Python and Node.js malware to infect systems. The malware downloads and executes MSI files (Windows) and Python files (macOS, Linux) from external sources, communicating with a C2 server every minute.

Source:
https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html

Intel Source:

CERT-UA

Intel Name:

Turla_Attacks_Using_CAPIBAR_and_KAZUAR_Malware

Date of Scan:

2023-07-25

Impact:

MEDIUM

Summary:

CERT-UA researchers have discovered that in addition to the use of XSLT (Extensible Stylesheet Language Transformations) and COM-hijacking, the specificity of CAPIBAR is the presence of a server part, which is typically installed on infected MS Exchange servers in the form of a MOF (Managed Object Format) file using the Desired State Configuration (DCS) PowerShell tool, effectively converting a legitimate server into a malware control center.

Source:
https://cert.gov.ua/article/5213167

Intel Source:

Securilist

Intel Name:

Outlook_Vulnerability_and_Clever_Attacker_Tactics

Date of Scan:

2023-07-25

Impact:

LOW

Summary:

Securilist shared retheir analyses CVE-2023-23397 vulnerability in Microsoft Outlook for Windows allowed attackers to leak Net-NTLMv2 hashes by sending malicious objects. Samples exploiting this flaw targeted various entities from March 2022 to March 2023. Attackers used compromised ISP routers for hosting fake SMB servers.

Source:
https://securelist.com/analysis-of-attack-samples-exploiting-cve-2023-23397/110202/

Intel Source:

Malwarebytes

Intel Name:

New_Campaign_Distributing_NetSupport_RAT_Through_Fake_Browser_Updates

Date of Scan:

2023-07-25

Impact:

LOW

Summary:

Researchers from Malwarebytes have observed a new campaign called FakeSG is distributing the NetSupport RAT through hacked WordPress websites. It uses fake browser update templates to deceive users. The payload is delivered via Internet shortcuts or zipped downloads.

Source:
https://www.malwarebytes.com/blog/threat-intelligence/2023/07/socgholish-copycat-delivers-netsupport-rat

Intel Source:

Fotinet

Intel Name:

Threat_Actors_Embrace_ZIP_Domains_in_Deceptive_Attacks

Date of Scan:

2023-07-25

Impact:

LOW

Summary:

FortiGate researchers have observed new ‘.ZIP’ Top-Level Domain (TLD) to launch sophisticated phishing attacks. These domains can trick users into thinking they are downloading files when they’re actually visiting malicious websites.

Source:
https://www.fortinet.com/blog/industry-trends/threat-actors-add-zip-domains-to-phishing-arsenals

Intel Source:

Checkpoint

Intel Name:

BundleBot_A_Stealthy_Threat_Abusing_Self_Contained_Dotnet_Format

Date of Scan:

2023-07-25

Impact:

MEDIUM

Summary:

Check Point Research (CPR) conducted an analysis of a new malware strain called BundleBot, which is spreading covertly. BundleBot uses the dotnet bundle (single-file), self-contained format, making static detection challenging. The malware is commonly distributed via Facebook Ads and compromised accounts, masquerading as legitimate program utilities, AI tools, and games.

Source:
https://research.checkpoint.com/2023/byos-bundle-your-own-stealer/

Intel Source:

Permiso

Intel Name:

Agile_Approach_to_Mass_Cloud_Credential_Harvesting_and_Crypto_Mining_Sprints_Ahead

Date of Scan:

2023-07-24

Impact:

LOW

Summary:

Researchers from Permiso have observed Attackers are using an agile approach for mass cloud credential harvesting and crypto mining. They developed and deployed incremental iterations of their malware, targeting multiple cloud services. The campaign includes multi-cloud support, possible German-speaking actors, and hosting on Nice VPS.

Source:
https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/?utm_source=substack&utm_medium=email

Intel Source:

Symantec

Intel Name:

Modified_Sardonic_Backdoor_by_FIN8_Group

Date of Scan:

2023-07-24

Impact:

LOW

Summary:

Symantec researchers have found evidence of the financially motivated threat actor known as FIN8 employing a “revamped” variation of the Sardonic backdoor to spread the BlackCat ransomware.

Source:
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

Intel Source:

Sonatype

Intel Name:

NullRAT_InfoStealer_Targeting_PyPI_Package_for_Windows

Date of Scan:

2023-07-24

Impact:

LOW

Summary:

Sonatype’s automated malware detection systems discovered sonatype-2023-2950, a malicious PyPI package with the name “feur,” which has since been taken down.

Source:
https://blog.sonatype.com/quoi…-feur-from-meme-to-malware-pypi-package-targets-windows-with-nullrat-info-stealer

Intel Source:

Cofense

Intel Name:

The_Use_of_HTML_Attachments_in_Phishing_Campaigns_Has_Increased

Date of Scan:

2023-07-24

Impact:

LOW

Summary:

Researchers from Cofense have observed developments in the phishing and email security scene. The use of HTML attachments in dangerous phishing attempts has increased significantly, by 168% and 450%, respectively, compared to both Q1 and Q2 of the preceding two years.

Source:
https://cofense.com/blog/html-attachments-used-in-malicious-phishing-campaigns/

Intel Source:

Rapid7

Intel Name:

Exploiting_Several_Adobe_ColdFusion_Vulnerabilities_Actively

Date of Scan:

2023-07-24

Impact:

LOW

Summary:

Researchers from Rapid7 have discovered that criminals are actively taking advantage of two ColdFusion flaws to circumvent authentication, remotely execute commands, and install webshells on vulnerable servers. Threat actors are combining exploits for the critical remote code execution vulnerability CVE-2023-38203 and the access control bypass vulnerability CVE-2023-29298.

Source:
https://www.rapid7.com/blog/post/2023/07/17/etr-active-exploitation-of-multiple-adobe-coldfusion-vulnerabilities/

Intel Source:

Microsoft

Intel Name:

The_deeper_details_of_Storm_0558_techniques_for_unauthorized_access

Date of Scan:

2023-07-23

Impact:

LOW

Summary:

Earlier this month, Microsoft shared detailed information about a malicious campaign by a threat actor Storm-0558 that targeted customer email. Microsoft continued their investigation into this incident and deployed defense in depth to harden all systems involved, additionally they are providing their deeper analysis of the observed actor techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.

Source:
https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/

Intel Source:

Netscope

Intel Name:

AWS_Amplify_Hosted_Phishing_Campaigns

Date of Scan:

2023-07-23

Impact:

LOW

Summary:

Last couple months, Netskope Threat Labs researchers observed an increase in traffic to phishing pages hosted in AWS Amplify. These attacks have been targeting victims across different segments, led by the technology and finance verticals.

Source:
https://www.netskope.com/de/blog/aws-amplify-hosted-phishing-campaigns-abusing-telegram-static-forms

Intel Source:

Bleeding Computer, Jumpcloud

Intel Name:

JumpCloud_had_a_breach_by_state_backed_APT_hacking_group

Date of Scan:

2023-07-23

Impact:

MEDIUM

Summary:

US-based enterprise software firm JumpCloud says a state-backed hacking group breached its systems almost one month ago as part of a highly targeted attack focused on a limited set of customers. The company discovered the incident on June 27, one week after the attackers breached its systems via a spear-phishing attack. On July 5, JumpCloud discovered “unusual activity in the commands framework for a small set of customers” while investigating the attack and analyzing logs for signs of malicious activity.

Source:
https://www.bleepingcomputer.com/news/security/jumpcloud-discloses-breach-by-state-backed-apt-hacking-group/
https://jumpcloud.com/support/july-2023-iocs

Intel Source:

Perception Point

Intel Name:

A_complex_phishing_operation_Manipulated_Caiman

Date of Scan:

2023-07-22

Impact:

LOW

Summary:

Perception Point investigated for a complex phishing operation that cwas called “Manipulated Caiman”. The threat actor, Manipulated Caiman, based on one of the files analyzed, containing the words “Loader Manipulado” in the pdb path. Seems like attacker’s origin is likely Latin America. Manipulated Caiman employs spear phishing with malicious attachments to deliver malware, such as URSA, SMTP bruteforce client, malicious extension installer, net info checker, and spammer client.

Source:
https://perception-point.io/blog/manipulated-caiman-the-sophisticated-snare-of-mexicos-banking-predators-technical-edition/

Intel Source:

Security Intelligence

Intel Name:

The_delivery_of_BlotchyQuasar_malware

Date of Scan:

2023-07-22

Impact:

MEDIUM

Summary:

IBM Security X-Force discovered some phishing emails leading to packed executable files delivering malware called BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from multiple Latin American-based banking applications and websites used within public and private environments.

Source:
https://securityintelligence.com/posts/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/

Intel Source:

eSentire

Intel Name:

The_Delivery_of_Sorillus_RAT

Date of Scan:

2023-07-21

Impact:

LOW

Summary:

Esentire researchers have identified Sorillus RAT, and a phishing page delivering using HTML smuggled files and links using Google’s Firebase Hosting service.

Source:
https://www.esentire.com/blog/google-firebase-hosting-abused-to-deliver-sorillus-rat-phishing-page

Intel Source:

Cyfirma

Intel Name:

A_High_Evasive_Blank_Grabber_Returns

Date of Scan:

2023-07-20

Impact:

LOW

Summary:

CYFIRMA researchers have identified an infostealer builder known as ‘Blank Grabber’. It is released in 2022, however, since then, it has been frequently updated with 85 contributions to the project in the last one month alone. The infostealer targets Windows operating systems and possesses a wide range of capabilities aimed at stealing sensitive information from unsuspecting users.

Source:
https://www.cyfirma.com/outofband/blank-grabber-returns-with-high-evasiveness/

Intel Source:

Fortinet

Intel Name:

Diving_Deep_into_Rancoz_Ransomware

Date of Scan:

2023-07-20

Impact:

LOW

Summary:

FortiGate researchers have observed that a few months back the Rancoz ransomware first came to the public’s attention. However, it’s important to raise awareness of this ransomware variant, as the most recent victim on their data leak site on TOR dates back just a few weeks to mid-June.

Source:
https://www.fortinet.com/blog/threat-research/ransomware-roundup-rancoz

Intel Source:

Citizenlab

Intel Name:

The_Analysis_of_HKLEAKS_Campaign

Date of Scan:

2023-07-20

Impact:

LOW

Summary:

Researchers from Citizen Lab have conducted a forensic analysis of the entire identifiable digital footprint of the HKLEAKS campaign. In August 2019, at the height of the Anti-Extradition Bill protests that rocked Hong Kong, a series of websites branded “HKLEAKS” began surfacing on the web. Claiming to be run by anonymous citizens, they systematically exposed (“dotted”) the personal identifiable information of protesters, journalists, and other individuals perceived as affiliated with the protest movement.

Source:
https://citizenlab.ca/2023/07/hkleaks-covert-and-overt-online-harassment-tactics-to-repress-the-2019-hong-kong-protests/

Intel Source:

Vadesecure

Intel Name:

M365_Phishing_Email_Analysis

Date of Scan:

2023-07-20

Impact:

LOW

Summary:

Vade’s researchers have detected a new Microsoft 365 phishing attack and analyzed an email containing a malicious HTML attachment.

Source:
https://www.vadesecure.com/en/blog/m365-phishing-email-analysis-eevilcorp

Intel Source:

CERT-HR

Intel Name:

WordPress_Plugin_ULTIMATE_MEMBER_Is_Vulnerable

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

CERT-HR researchers have observed that ‘Ultimate Member’ is a plugin that allows registration and management of communities on WordPress sites. The critical vulnerability (CVE-2023-3460) has been rated 9.8. All versions of the plugin, which has more than 200,000 active installations, are vulnerable.

Source:
https://www.cert.hr/otkrivena-je-kriticna-ranjivost-ultimate-member-wordress-dodatka-zakrpe-nema/?utm_source=rss&utm_medium=rss&utm_campaign=otkrivena-je-kriticna-ranjivost-ultimate-member-wordress-dodatka-zakrpe-nema

Intel Source:

Trustwave

Intel Name:

Enterprise_Applications_Honeypot_revealed_some_findings

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

Trustwave researchers have established a honeypot sensors network across six countries: Russia, Ukraine, Poland, UK, China, and the United States. Also, they present the most intriguing findings from the research into exposing vulnerable enterprise applications, such as Fortra GoAnywhere MFT, Microsoft Exchange, Fortinet FortiNAC, Atlassian BitBucket, and F5 Big-IP.s

Source:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/

Intel Source:

Uptycs

Intel Name:

Fake_PoC_for_Linux_Kernel_Vulnerability_on_GitHub

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

Cybersecurity researchers continue to be under the radar of malicious actors, a proof-of-concept (PoC) has been discovered on GitHub, concealing a backdoor with a “crafty” persistence method.

Source:
https://www.uptycs.com/blog/new-poc-exploit-backdoor-malware

Intel Source:

CERT-UA

Intel Name:

The_activities_of_the_UAC_0010_group_as_of_July_2023

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

The continuous accumulation and analysis of data on cyber incidents allows us to conclude that one of the most persistent cyber threats is UAC-0010 (Armageddon), the activities of which are carried out by former “officers” of the State Security Service of Crimea, who in 2014 betrayed their military oath and began to serve the FSB of Russia. The main task of the group is cyberespionage against the security and defense forces of Ukraine. At the same time, we know at least one case of destructive activity at an information infrastructure facility.

Source:
https://cert.gov.ua/article/5160737

Intel Source:

KrebsonSecurity

Intel Name:

DomainNetworks_Mail_Scam

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

Researchers from KrebsonSecurity have identified domainNetworks is a fraudulent company behind a snail mail scam targeting domain owners. Its true operators remain unidentified, despite connections to thedomainsvault.com and UBSagency. These scams trick organizations into paying for unnecessary services.

Source:
https://krebsonsecurity.com/2023/07/whos-behind-the-domainnetworks-snail-mail-scam/?replytocom=587051

Intel Source:

Kaspersky, Palant

Intel Name:

Malicious_extensions_in_Chrome_Web_Store

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

The subpage of the Kaspersky official blog discusses the discovery of malicious extensions in the Chrome Web Store with a total of 87 million downloads. The most popular extension, “Autoskip for Youtube,” had nine million downloads. Users are advised to check and uninstall any malicious extensions as they can access user data.

Source:
https://www.kaspersky.com/blog/dangerous-chrome-extensions-87-million/48562/
https://palant.info/2023/05/31/more-malicious-extensions-in-chrome-web-store/

Intel Source:

Lab52

Intel Name:

New_Invitation_From_APT29_to_Use_CCleaner

Date of Scan:

2023-07-19

Impact:

LOW

Summary:

Researchers from Lab52 have seen a phishing effort that appears to be the Norwegian embassy inviting people to a party. The format of this particular “invitation” is in .svg. When the file is opened, a script is run that mounts and downloads an ISO file that contains the subsequent infection stage. The .svg file serves as an HTML smuggler in this manner, infecting the target and causing them to skip the subsequent stage.

Source:
https://lab52.io/blog/2344-2/

Intel Source:

Rapid7

Intel Name:

Old_Blackmoon_Trojan_NEW_Monetization_Approach

Date of Scan:

2023-07-18

Impact:

LOW

Summary:

Rapid7 has discovered a new campaign using the Blackmoon trojan targeting businesses in the USA and Canada.
This campaign focuses on implementing evasion and persistence techniques, such as disabling Windows Defender.
The trojan uses various persistence techniques, process injection, and exploits for remote services.
It disables security tools, hijacks resources, and communicates with a Command and Control server using web protocols.
The webpage includes file names, MD5 hashes, email addresses, a reference to a C&C server, and a link to a related article on monitor persistence.

Source:
https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/

Intel Source:

Sysdig

Intel Name:

SCARLETEEL_2

Date of Scan:

2023-07-18

Impact:

LOW

Summary:

Sysdig observed the their most recent activities of new version of SCARLTEEL 2.0. The analysts saw a similar strategy to previously reported of compromise AWS accounts through exploiting vulnerable compute services, gain persistence, and attempt to make money using cryptominers. Had we not thwarted their attack, our conservative estimate is that their mining would have cost over $4,000 per day until stopped. By knowing the details of SCARLETEEL previously, it was discovered they are not only after cryptomining, but stealing intellectual property as well. In their recent attack, the actor discovered and exploited a customer mistake in an AWS policy which allowed them to escalate privileges to AdministratorAccess and gain control over the account, enabling them to then do with it what they wanted. We also watched them target Kubernetes in order to significantly scale their attack.

Source:
https://sysdig.com/blog/scarleteel-2-0/

Intel Source:

Sucuri

Intel Name:

A_variant_of_a_common_malware_injection

Date of Scan:

2023-07-18

Impact:

LOW

Summary:

A recent investigation found malware injecting obfuscated JavaScript into legitimate files, redirecting website traffic to a parked domain for ad monetization. The injected script creates an invisible iframe from the parked domain, generating ad revenue and potentially redirecting visitors to questionable sites.

Source:
https://blog.sucuri.net/2023/07/malicious-injection-redirects-traffic-to-parked-domain.html

Intel Source:

Symantec, Cyble

Intel Name:

Microsoft_ZeroDay_Vulnerability_Exploited_by_Attackers

Date of Scan:

2023-07-18

Impact:

HIGH

Summary:

Attackers are making use of a zero-day vulnerability (CVE-2023-36884) that affects Microsoft Windows and Office products. The exploit has so far been applied in extremely targeted attacks against businesses in the European and North American government and defense industries.
Link: https://blog.cyble.com/2023/07/12/microsoft-zero-day-vulnerability-cve-2023-36884-being-actively-exploited/

Source:
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/microsoft-zeroday-exploit

Intel Source:

FACCT

Intel Name:

RedCurl_Hackers_Return_to_Spy_on_Major_Russian_Banks

Date of Scan:

2023-07-18

Impact:

MEDIUM

Summary:

According to FACCT, the Russian-speaking Red Curl organization has attacked businesses in the UK, Germany, Canada, Norway, Ukraine, and Australia at least 34 times. Twenty of the attacks—more than half—took place in Russia. Construction, financial, consultancy, retail, banking, insurance, and legal enterprises were among the victims of cyber espionage.

Source:
https://www.facct.ru/blog/redcurl-2023/?utm_source=twitter&utm_campaign=redcurl-23&utm_medium=social

Intel Source:

Wordfence

Intel Name:

Massive_Targeted_Exploit_Campaign_Against_WooCommerce_Payments

Date of Scan:

2023-07-18

Impact:

LOW

Summary:

Wordfence researchers have identified there is an ongoing exploit campaign targeting a vulnerability in the WooCommerce Payments plugin. Attackers can gain administrative privileges on vulnerable websites. Wordfence provides protection against this vulnerability

Source:
https://www.wordfence.com/blog/2023/07/massive-targeted-exploit-campaign-against-woocommerce-payments-underway/?utm_medium=email&_hsmi=266639985&_hsenc=p2ANqtz-8AxrS0jQ-RkxVtD0SfniOq77V_8TP6U08rEjcEDj_b8n3bXW3pcEeNGxsBvY58nI-AEfYwqBRm9q3Xeub5y8sJZSw9rzqT5rAlvdnt2riEjE_XnEc&utm_content=266639985&utm_source=hs_email

Intel Source:

Talos

Intel Name:

Malicious_Campaigns_Targeting_Civilian_Military_and_Governmental_Organisations

Date of Scan:

2023-07-17

Impact:

MEDIUM

Summary:

Researchers from Talos have identified a threat actor who has been running various campaigns in Poland and Ukraine against civilian users, military groups, and governmental institutions. They determined that these actions are most likely carried out with the intent to steal data and gain ongoing remote access.

Source:
https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland/

Intel Source:

Fortinet

Intel Name:

Microsoft_Office_Vulnerabilities_and_Macros_Used_by_LokiBot_Campaign

Date of Scan:

2023-07-17

Impact:

MEDIUM

Summary:

Several malicious Microsoft Office documents created to take advantage of known vulnerabilities have been found by FortiGate researchers. Remote code execution flaws include CVE-2021-40444 and CVE-2022-30190 specifically. By taking advantage of these flaws, the attackers were able to insert malicious macros into Microsoft documents that, when used, installed the LokiBot malware on the victim’s computer

Source:
https://www.fortinet.com/blog/threat-research/lokibot-targets-microsoft-office-document-using-vulnerabilities-and-macros

Intel Source:

Sentinelone

Intel Name:

Credential_Stealer_Expands_to_Azure_GCP_from_AWS

Date of Scan:

2023-07-17

Impact:

LOW

Summary:

This ad shows the development of an experienced cloud actor who is knowledgeable about a variety of technologies. The actor apparently underwent a great deal of trial and error, as evidenced by decisions like feeding the curl binary to systems that do not already have it. Additionally, the actor has enhanced the tool’s data layout to promote more autonomous engagement, displaying a certain amount of maturity and proficiency.

Source:
https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/

Intel Source:

PaloAlto

Intel Name:

Beware_of_Cloaked_Ursa_Phishing_Scam

Date of Scan:

2023-07-17

Impact:

LOW

Summary:

Unit 42 researchers have observed instances of Cloaked Ursa using lures focusing on the diplomats themselves more than the countries they represent. Also, identified Cloaked Ursa targeting diplomatic missions within Ukraine by leveraging something that all recently placed diplomats need – a vehicle.

Source:
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/

Intel Source:

Lumen

Intel Name:

Exploring_AVrecon_Underground_Routers

Date of Scan:

2023-07-16

Impact:

LOW

Summary:

Another multi-year scheme involving infected routers all around the world is discovered by Lumen Black Lotus Labs. Small-office/home-office (SOHO) routers are infected as part of a sophisticated operation that uses the Linux-based Remote Access Trojan (RAT) known as “AVrecon.”

Source:
https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/

Intel Source:

Aquasec

Intel Name:

Introducing_TeamTNT_New_Cloud_Campaign

Date of Scan:

2023-07-16

Impact:

LOW

Summary:

AquaSec researchers have uncovered an emerging campaign that is targeting exposed Docker APIs and JupyterLab instances. Upon further investigation of the infrastructure, found evidence of a broader campaign orchestrated by TeamTNT.

Source:
https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign

Intel Source:

AT&T

Intel Name:

Attackers_Leveraging_OneNote_to_Deliver_Malware

Date of Scan:

2023-07-16

Impact:

LOW

Summary:

Malware distributed using phishing emails with a OneNote attachment has increased from December 22nd, 2022. The end user would open the OneNote attachment, as they do with most phishing emails, but OneNote does not support macros like Microsoft Word or Excel do. Threat actors have historically used this method to launch programs that install malware.

Source:
https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-onenote-malspam-detection-response

Intel Source:

Cyble

Intel Name:

Hackers_Modify_TeamViewer_Installer_to_Deliver_njRAT

Date of Scan:

2023-07-15

Impact:

LOW

Summary:

Researchers from Cyble have discovered a noteworthy occurrence involving the false use of a TeamViewer program file. A popular software program called TeamViewer enables remote control, desktop sharing, online meetings, file transfers, and group collaboration across numerous devices.

Source:
https://blog.cyble.com/2023/07/13/trojanized-application-preying-on-teamviewer-users/

Intel Source:

ThreatFabric

Intel Name:

A_New_Sophisticated_Toolkit_For_Vishing_Called_Letscall

Date of Scan:

2023-07-15

Impact:

LOW

Summary:

Researchers from Threat Fabric have identified a new sophisticated Vishing toolset called Letscall which currently targeting individuals from South Korea.

Source:
https://www.threatfabric.com/blogs/letscall-new-sophisticated-vishing-toolset

Intel Source:

Mandiant

Intel Name:

Stealing_Secrets_With_Infected_USB_Drives

Date of Scan:

2023-07-14

Impact:

LOW

Summary:

Mandiant researchers have observed a threefold increase in the number of attacks using infected USB drives to steal secrets. The campaign named ‘Sogu,’ attributed to a Chinese espionage threat group ‘TEMP.HEX,’ and another named ‘Snowydrive,’ attributed to UNC4698, which targets oil and gas firms in Asia.

Source:
https://www.mandiant.com/resources/blog/infected-usb-steal-secrets

Intel Source:

CERT-UA

Intel Name:

SmokeLoader_Distribution_via_Email

Date of Scan:

2023-07-14

Impact:

MEDIUM

Summary:

CERT-UA researchers have identified a mass mailing of electronic messages with the subject “Invoice” and an attachment in the form of the file “Act_Zvirky_ta_rah.fakt_vid_12_07_2023.zip” containing the VBS file “invoice_from_12_07_2023_to_payment .vbs “, the opening of which will ensure that the SmokeLoader malware is downloaded and launched.

Source:
https://cert.gov.ua/article/5158006

Intel Source:

TrendMicro

Intel Name:

BPFDoor_Backdoor_Variants_Abusing_BPF_Filters

Date of Scan:

2023-07-14

Impact:

LOW

Summary:

BPFDoor has since become more difficult to detect due to the improved usage of Berkeley Packet Filter (BPF), a technology that allows programs to attach network filters to an open socket that’s being used by the threat actors behind BPFDoor to bypass firewalls’ inbound traffic rules and similar network protection solutions in Linux and Solaris operating systems (OS).

Source:
https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html

Intel Source:

Malwarebytes

Intel Name:

Malicious_Extension

Date of Scan:

2023-07-14

Impact:

LOW

Summary:

The specific information on this subpage includes a password-protected RAR archive with the passwords 888 or 999. An MSI file has been analyzed, and it is mentioned that Malwarebytes EDR and MDR can remove ransomware remnants and prevent reinfection. There is also a free trial available for Malwarebytes’ cybersecurity services

Source:
https://www.malwarebytes.com/blog/threat-intelligence/2023/07/criminals-target-businesses-with-malicious-extension-for-metas-ads-manager-and-accidentally-leak-stolen-accounts

Intel Source:

ASEC

Intel Name:

Kimsuky_Threat_Group_Using_Chrome_Remote_Desktop

Date of Scan:

2023-07-14

Impact:

LOW

Summary:

Remote Desktop by the Kimsuky threat group, supported by North Korea, for their attacks. The group utilizes their own AppleSeed malware, as well as other remote control tools like Meterpreter and VNC, to gain control over infected systems. The Kimsuky group mainly distributes malware through spear phishing emails containing HWP and MS Office document files or CHM files. They also use Infostealer to gather sensitive information.

Source:
https://asec.ahnlab.com/en/55145/

Intel Source:

Huntress

Intel Name:

Business_Email_Compromise_hunting_details

Date of Scan:

2023-07-13

Impact:

LOW

Summary:

The subpage specifically discusses threat hunting for business email compromise (BEC) using user agents on Microsoft 365. The author shares their approach and examples of suspicious user agents.vThey emphasize the importance of baseline user behavior, detection technology, The subpage also includes information on terms of use, privacy policy, legalities, and cookie policy of Huntress, with an option to sign up for blog updates.and prevention measures like multi-factor authentication.

Source:
https://www.huntress.com/blog/threat-hunting-for-business-email-compromise-through-user-agents

Intel Source:

Wiz

Intel Name:

The_cloud_workloads_targeted_by_Python_based_fileless_malware

Date of Scan:

2023-07-13

Impact:

LOW

Summary:

This subpage discusses the PyLoose fileless malware that targets cloud workloads. It provides information on the attack flow, including initial access, Python script drop, fileless execution, and in-memory XMRig execution. It mentions the attacker’s Monero wallet address and provides details about the PyLoose loader’s associated files and hash values. The subpage also references other articles and promotes the Wiz platform for cloud security.

Source:
https://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads

Intel Source:

Talos

Intel Name:

RedDriver_targets_Chinese_speakers_and_internet_cafes

Date of Scan:

2023-07-13

Impact:

LOW

Summary:

The specific information on this subpage describes an undocumented browser hijacker called RedDriver. It explains that RedDriver targets Chinese speakers and internet cafes, and uses the Windows Filtering Platform to intercept browser traffic. It bypasses driver signature enforcement policies and utilizes stolen certificates. The authors of RedDriver are skilled in driver development and have deep knowledge of the Windows operating system. The subpage also includes a list of domains associated with RedDriver and provides various software and support resources offered by Talos.

Source:
https://blog.talosintelligence.com/undocumented-reddriver/

Intel Source:

Blackberry

Intel Name:

The_suspicion_of_targeting_Ukraine_s_NATO_Membership_Talks_by_RomCom_Threat_Actor

Date of Scan:

2023-07-12

Impact:

MEDIUM

Summary:

In the bebinning of this month, the BlackBerry Threat researchers found two malicious documents came from an IP address in Hungary, sent as bate to an organization supporting Ukraine abroad, and a document targeting upcoming NATO Summit guests. Blackberry analysis assume to conclude that the threat actor known as RomCom who is behind this operation. Based on our internal network data analysis, and the full set of cyber tools were collected, was believed the threat actor behind this campaign ran their first drills on June 22, and also a few days before the command-and-control (C2) mentioned in their report was registered and went live.

Source:
https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit

Intel Source:

Uptycs

Intel Name:

Deceptive_PoC_poses_hidden_backdoor

Date of Scan:

2023-07-12

Impact:

LOW

Summary:

Uptycs reserachers discovered Backdoor disguised as innocuous learning tool targets Linux systems. Ensure removal of unauthorized SSH keys, delete kworker file, remove kworker path from bashrc file, and check /tmp/.iCE-unix.pid for potential threats. Exercise caution when testing PoCs and utilize isolated environments for protection.

Source:
https://www.uptycs.com/blog/new-poc-exploit-backdoor-malware

Intel Source:

Microsoft

Intel Name:

StormP_0978_phishing_campaign_uncovered_by_Microsoft

Date of Scan:

2023-07-12

Impact:

LOW

Summary:

Microsoft identifies Storm-0978 targeting defense and government entities in Europe and North America. Exploiting CVE-2023-36884, they employ phishing campaigns and distribute the RomCom backdoor. Storm-0978 conducts opportunistic ransomware and espionage-related operations

Source:
https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/

Intel Source:

TrendMicro

Intel Name:

Rootkit_acts_as_a_universal_loader

Date of Scan:

2023-07-11