Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label APT. Show all posts
Data Theft
APT Cyberattacks CyberCrime Cybersecurity Data Breach Data Heist Data Theft

The Great Data Heist: China's Alleged Theft of Voter Data and Its Potential Impact

 


Chinese-backed hackers allegedly targeted U.S. officials, journalists, corporations, pro-democracy activists and the United Kingdom's electoral watchdog in a comprehensive, state-backed attack on March 25, authorities announced in an announcement on March 25. The attack was aimed at targeting officials, journalists, corporations, pro-democracy activists, and the British election watchdog. 

In 2010, China launched Operation Troll to harass critics of the government, steal trade secrets from American corporations, as well as spy on and trace high-level political figures, an operation that began in 2010. Officials say the campaign began in 2010. During the last election, Western officials sounded a fresh alarm about a country long regarded as having advanced espionage capabilities when they revealed the operation, which was carried out by a hacking group called APT31. 

According to the U.S. Justice Department, seven hackers are being charged with crimes in China, and they are believed to be living there. An official announcement by the British government concerning the breach that may have provided China with access to information on tens of millions of U.K. voters held by the Electoral Commission was that a front company and two defendants had been imposed sanctions by the British government. 

U.K. Deputy Prime Minister Oliver Dowden said that hackers working for the Chinese government were responsible for the 2021 data breach at the Electoral Commission in his speech to lawmakers in Parliament on Monday. It was the first time since the cyberattack was reported in 2023 that the United Kingdom has attributed it to the Chinese government and has said it is not going to hesitate to take swift and robust actions whenever the Chinese government threatens its interest.

In his speech, Dowden said the U.K. government would not hesitate to take quick and robust action whenever the Chinese government threatened its interests. In the United Kingdom, the Electoral Commission, which keeps copies of the register of citizens eligible for voting, reported in July that hackers had taken an estimated 40 million U.K. citizens' names and addresses. There are approximately 5 million registered voters across the U.S. including all people who voted in the last 4 years.

Between 2014 and 2022, over 30 million people were affected by the data breach, but they weren't recognized until after a year had passed. As the deputy prime minister of the United Kingdom mentioned in Parliament in Downden's speech, the attack likely occurred as part of a wider threat perpetrated by government-backed groups. 

The government of New Zealand, as well as the governments of other Western countries, have also voiced their concerns. Several high-profile phishing attacks targeting German politicians that were linked to Russian-backed groups have recently been reported in the media. APT31, a Chinese-based cyberattack group, has been sanctioned in the UK as part of the government's response to the attack by responding to the involvement of two individuals, Zhao Guangzong and Ni Gaobin, and one company, Wuhan Xiaoruizhi Science and Technology Company Ltd. 

Those companies are no longer authorised to handle these funds or assets, and the individuals are not allowed to enter the country. " There is no doubt that APT31 has an impeccable track record of targeting politicians both in the US and Europe. They have targeted various political campaigns, parliamentarians, and other targets to gain insight into the landscape," said John Hultquist, Chief Analyst of Mandiant Intelligence - Google Cloud. APT31 has been identified as a threat targeting British lawmakers during a separate campaign in 2021, the National Cyber Security Centre said, even though no parliamentary accounts were compromised, a reconnaissance activity was conducted against the lawmakers during that campaign. 

The British Foreign Secretary, David Cameron, made a formal request for the Chinese ambassador to be summoned, and he said in a separate statement that he raised the matter directly with the Chinese Foreign Minister, Wang Yi. It is clear from the episode that for the UK, this represents an increasing level of tension that has been growing since Hong Kong passed security legislation that the UK says undermines freedom in Hong Kong. Moreover, this violated the handover agreement signed by the two countries when Beijing took over the governance of the territory in 1997.z
Read more »
Iran
Advanced Persistent Threat APT APT 32 APT actors APT attacks APT Campaigns APT Group APT27 APT34 APT43 Cyber Security Cybercriminal Tactics Iran

Analysing Advanced Persistent Threats 2023: Tactics, Targets, and Trends

 

The term "Advanced Persistent Threat" (APT) denotes a highly specialised category of cyber adversaries within the field of cybersecurity. These entities distinguish themselves through advanced skill sets and substantial access to resources, often employing sophisticated tools and techniques. APTs typically exhibit state sponsorship, indicating either direct or indirect government support or intricate ties to organized crime syndicates. 

This connection to state actors or criminal groups grants them a level of persistence and capability that far exceeds that of conventional cybercriminals. In 2023, the cybersecurity landscape has witnessed the persistent activity of several Advanced Persistent Threat (APT) groups, with attributions largely pointing to nation-states, notably Iran and China. These sophisticated entities operate at the forefront of cyber capabilities, employing advanced tactics, techniques, and procedures. Their activities extend beyond conventional cybercriminal motives, often involving strategic objectives tied to geopolitical influence, military espionage, or the compromise of critical infrastructure. As the year unfolds, the vigilance of cybersecurity experts remains crucial in monitoring and responding to the evolving tactics employed by these APT groups, reflecting the ongoing challenge of safeguarding against state-sponsored cyber threats.  

Here’s a summary of some of the most active and prominent APT Groups as of 2023:  

1) APT39  

APT39, believed to be associated with Iran, has emerged as a notable player in the cyber threat landscape in 2023. This advanced persistent threat group strategically directs its efforts towards the Middle East, with a specific focus on key sectors such as telecommunications, travel, and information technology firms. APT39 employs a sophisticated arsenal of cyber tools, including the use of SEAWEED and CACHEMONEY backdoors, along with spearphishing techniques for initial compromise. 

2) APT35 

APT35, believed to be affiliated with Iran, has solidified its position as a significant threat in 2023, honing its focus on military, diplomatic, and government personnel across the U.S., Western Europe, and the Middle East. Employing a sophisticated toolkit that includes malware such as ASPXSHELLSV and BROKEYOLK, the group employs a multifaceted approach, leveraging spearphishing and password spray attacks to infiltrate target networks. APT35's strategic interests span various sectors, encompassing U.S. and Middle Eastern military, diplomatic and government personnel, as well as organizations in the media, energy, defense industrial base (DIB), and the engineering, business services, and telecommunications sectors.  

3) APT41 

APT41, believed to be linked to China, continues to pose a significant cyber threat in 2023, targeting a diverse range of sectors including healthcare, telecommunications, high-tech, education, and news/media. Renowned for employing an extensive arsenal of malware and spear-phishing tactics with attachments, APT41 demonstrates a multifaceted approach, engaging in both state-sponsored espionage and financially motivated activities. Researchers have identified APT41 as a Chinese state-sponsored espionage group that has also ventured into financially motivated operations. Active since at least 2012, the group has been observed targeting industries such as healthcare, telecom, technology, and video games across 14 countries. APT41's activities overlap, at least partially, with other known threat groups, including BARIUM and Winnti Group, underscoring the complexity and interconnected nature of cyber threats associated with this sophisticated actor.  

4) APT40 

APT40, associated with China, maintains a strategic focus on countries crucial to China's Belt and Road Initiative, with a particular emphasis on the maritime, defense, aviation, and technology sectors. Notably active in 2023, APT40 employs a diverse range of techniques for initial compromise, showcasing their sophisticated capabilities. These methods include web server exploitation, phishing campaigns delivering both publicly available and custom backdoors, and strategic web compromises. APT40's modus operandi involves the utilization of compromised credentials to access connected systems and conduct reconnaissance. The group further employs Remote Desktop Protocol (RDP), Secure Shell (SSH), legitimate software within victim environments, an array of native Windows capabilities, publicly available tools, and custom scripts to facilitate internal reconnaissance. This comprehensive approach highlights APT40's adaptability and underscores the persistent and evolving nature of cyber threats in the geopolitical landscape. 

5) APT31 

Focused on government entities, international financial organizations, aerospace, and defense sectors, among others, APT31, also known as Zirconium or Judgment Panda, stands out as a formidable Advanced Persistent Threat group with a clear mission likely aligned with gathering intelligence on behalf of the Chinese government. Operating in 2023, APT31 exhibits a strategic approach, concentrating on exploiting vulnerabilities in applications like Java and Adobe Flash to achieve its objectives. Similar to other nation-state actors, the group's primary focus is on acquiring data relevant to the People's Republic of China (PRC) and its strategic and geopolitical ambitions. The group's activities underscore the ongoing challenge of safeguarding sensitive information against sophisticated state-sponsored cyber threats. 

6) APT30 

APT30, believed to be associated with China, distinguishes itself through its noteworthy focus on long-term operations and the infiltration of air-gapped networks, specifically targeting members of the Association of Southeast Asian Nations (ASEAN). Employing malware such as SHIPSHAPE and SPACESHIP, this threat actor utilizes spear-phishing techniques to target government and private sector agencies in the South China Sea region. Notably, APT30's objectives appear to lean towards data theft rather than financial gain, as they have not been observed targeting victims or data that can be readily monetized, such as credit card information or bank credentials. Instead, the group's tools demonstrate functionality tailored for identifying and stealing documents, with a particular interest in those stored on air-gapped networks. APT30 employs decoy documents on topics related to Southeast Asia, India, border areas, and broader security and diplomatic issues, indicating a strategic approach to lure in and compromise their intended targets in the geopolitical landscape. 

7) APT27 

APT27 believed to be operating from China, is a formidable threat actor specializing in global intellectual property theft across diverse industries. Employing sophisticated malware such as PANDORA and SOGU, the group frequently relies on spear-phishing techniques for initial compromise. APT27 demonstrates versatility in deploying a wide array of tools and tactics for its cyberespionage missions. Notably, between 2015 and 2017, the group executed watering hole attacks through the compromise of nearly 100 legitimate websites to infiltrate victims' networks. Targeting sectors including government, information technology, research, business services, high tech, energy, aerospace, travel, automotive, and electronics, APT27 operates across regions such as North America, South-East Asia, Western Asia, Eastern Asia, South America, and the Middle East. The group's motives encompass cyberespionage, data theft, and ransom, employing a diverse range of malware including Sogu, Ghost, ASPXSpy, ZxShell RAT, HyperBro, PlugX RAT, Windows Credential Editor, and FoundCore. 

8) APT26 

APT26, suspected to have origins in China, specializes in targeting the aerospace, defense, and energy sectors. Recognized for its strategic web compromises and deployment of custom backdoors, this threat actor's primary objective is intellectual property theft, with a specific focus on data and projects that provide a competitive edge to targeted organizations within their respective fields. The group's tactics involve the utilization of associated malware such as SOGU, HTRAN, POSTSIZE, TWOCHAINS, and BEACON. APT26 employs strategic web compromises as a common attack vector to gain access to target networks, complementing their approach with custom backdoors deployed once they penetrate a victim's environment.  

9) APT25 

APT25, also recognized as Uncool, Vixen Panda, Ke3chang, Sushi Roll, and Tor, is a cyber threat group with suspected ties to China. The group strategically targets the defense industrial base, media, financial services, and transportation sectors in both the U.S. and Europe. APT25's primary objective is data theft, and its operations are marked by the deployment of associated malware such as LINGBO, PLAYWORK, MADWOFL, MIRAGE, TOUGHROW, TOYSNAKE, and SABERTOOTH. Historically, the group has relied on spear-phishing techniques in its operations, incorporating malicious attachments and hyperlinks in deceptive messages. APT25 actors typically refrain from using zero-day exploits but may leverage them once they become public knowledge. The group's consistent focus on targeted sectors and methods underscores its persistence and intent to pilfer sensitive information from key industries in the U.S. and Europe. 

10) APT24 

APT24, also known as PittyTiger and suspected to have origins in China, conducts targeted operations across a diverse array of sectors, including government, healthcare, construction, mining, nonprofit, and telecommunications industries. The group has historically targeted organizations in countries such as the U.S. and Taiwan. APT24 is distinguished by its use of the RAR archive utility to encrypt and compress stolen data before exfiltration from the network. Notably, the stolen data primarily consists of politically significant documents, indicating the group's intention to monitor the positions of various nation-states on issues relevant to China's ongoing territorial or sovereignty disputes. Associated malware utilized by APT24 includes PITTYTIGER, ENFAL, and TAIDOOR. The group employs phishing emails with themes related to military, renewable energy, or business strategy as lures, and its cyber operations primarily focus on intellectual property theft, targeting data and projects that contribute to an organization's competitiveness within its field. 

11) APT23 

APT23, suspected to have ties to China, directs its cyber operations towards the media and government sectors in the U.S. and the Philippines, with a distinct focus on data theft of political and military significance. Unlike other threat groups, APT23's objectives lean towards traditional espionage rather than intellectual property theft. The stolen information suggests a strategic interest in political and military data, implying that APT23 may be involved in supporting more traditional espionage operations. The associated malware used by APT23 is identified as NONGMIN. The group employs spear-phishing messages, including education-related phishing lures, as attack vectors to compromise victim networks. While APT23 actors are not known for utilizing zero-day exploits, they have demonstrated the capability to leverage these exploits once they become public knowledge. 

12) APT22 

Also known as Barista and suspected to be linked to China, APT22 focuses its cyber operations on political, military, and economic entities in East Asia, Europe, and the U.S., with a primary objective of data theft and surveillance. Operating since at least early 2014, APT22 is believed to have a nexus to China and has targeted a diverse range of public and private sector entities, including dissidents. The group utilizes associated malware such as PISCES, SOGU, FLATNOTE, ANGRYBELL, BASELESS, SEAWOLF, and LOGJAM. APT22 employs strategic web compromises as a key attack vector, allowing for the passive exploitation of targets of interest. Additionally, threat actors associated with APT22 identify vulnerable public-facing web servers on victim networks, uploading webshells to gain access to the victim's network. This comprehensive approach underscores APT22's persistent and multifaceted tactics in carrying out intrusions and surveillance activities on a global scale. 

13) APT43 

Linked to North Korea, APT43 has targeted South Korea, the U.S., Japan, and Europe across various sectors, including government, education/research/think tanks, business services, and manufacturing. Employing spear-phishing and fake websites, the group utilizes the LATEOP backdoor and other malicious tools to gather information. A distinctive aspect of APT43's operations involves stealing and laundering cryptocurrency to purchase operational infrastructure, aligning with North Korea's ideology of self-reliance, thereby reducing fiscal strain on the central government. APT43 employs sophisticated tactics, creating numerous convincing personas for social engineering, masquerading as key individuals in areas like diplomacy and defense. Additionally, the group leverages stolen personally identifiable information (PII) to create accounts and register domains, establishing cover identities for acquiring operational tooling and infrastructure. 

14) Storm-0978 (DEV-0978/RomCom) 

Storm-0978, also known as RomCom, is a Russian-based cybercriminal group identified by Microsoft. Specializing in ransomware, extortion-only operations, and credential-stealing attacks, this group operates, develops, and distributes the RomCom backdoor, and its latest campaign, detected in June 2023, exploited CVE-2023-36884 to deliver a backdoor with similarities to RomCom. Storm-0978's targeted operations have had a significant impact on government and military organizations primarily in Ukraine, with additional targets in Europe and North America linked to Ukrainian affairs. The group is recognized for its tactic of targeting organizations with trojanized versions of popular legitimate software, leading to the installation of RomCom. Notably, ransomware attacks attributed to Storm-0978 have affected industries such as telecommunications and finance, highlighting the group's broad impact and the evolving nature of cyber threats in the geopolitical landscape. 

15) Camaro Dragon 

A Chinese state-sponsored hacking group named 'Camaro Dragon' has recently shifted its focus to infecting residential TP-Link routers with a custom malware called 'Horse Shell.' European foreign affairs organizations are the specific targets of this cyber campaign. The attackers utilize a malicious firmware exclusively designed for TP-Link routers, enabling them to launch attacks appearing to originate from residential networks rather than directly targeting sensitive networks. Check Point, the cybersecurity firm that uncovered this campaign, clarifies that homeowners with infected routers are unwitting contributors rather than specific targets. The infection is attributed to self-propagating malware spread via USB drives. Checkpoint identified updated versions of the malware toolset, including WispRider and HopperTick, with similar capabilities for spreading through USB drives. These tools are associated with other tools employed by the same threat actor, such as the Go-based backdoor TinyNote and a malicious router firmware implant named HorseShell. The shared infrastructure and operational objectives among these tools provide further evidence of Camaro Dragon's extensive and coordinated cyber activities. 

In conclusion, the cybersecurity landscape of 2023 has been defined by a substantial surge in Advanced Persistent Threat (APT) activities, reflecting a sophisticated and dynamic threat environment. This analysis has delved into the intricate and evolving nature of these threats, emphasizing the persistent and increasingly sophisticated endeavours of emerging and established APT groups. These actors, distinguished by high skill levels and substantial resources, often operate with state sponsorship or connections to organized crime, enabling them to execute complex and prolonged cyber campaigns. 

Throughout the year, APTs have prominently featured, executing meticulously planned operations focused on long-term infiltration and espionage. Their objectives extend beyond financial gain, encompassing geopolitical influence, military espionage, and critical infrastructure disruption, posing a significant threat to global stability and security. 

Key regions such as the Asia-Pacific (APAC), South America, Russia, and the Middle East have witnessed diverse APT activities, showcasing unique tactics and targeting various sectors. Notable incidents, including compromising secure USB drives, deploying remote access Trojans (RATs), and sophisticated spear-phishing campaigns, underscore the adaptability of APT groups. The emergence of new actors alongside well-established groups, utilizing platforms like Discord and exploiting zero-day vulnerabilities, highlights the need for enhanced cyber defenses and international cooperation. 

Incidents like the Sandworm attack and exploitation of Atlassian Confluence flaws exemplify the diverse and evolving nature of APT threats, emphasizing their technical prowess and strategic focus on critical sectors and infrastructure. In response, a comprehensive and adaptive approach involving robust security measures, intelligence sharing, and strategic collaboration is essential to effectively mitigate the multifaceted risks posed by these highly skilled adversaries in the ever-evolving cyber threat landscape.
Read more »
Technology
APT Cyber Fraud Cyberattacks CyberCrime Cybersecurity Discord Malware Threat Technology

Discord's Security Challenge: APTs Enter the Malware Mix

 


APT groups continue to use Discord to spread malware and exfiltrate data, it is being commonly used by hackers to distribute malware and as a platform to steal authentication tokens. Consequently, Discord is serving as a breeding ground for malicious activity. 

Considering a recent report by Trellix, it has been revealed that Discord is now being used by APT (advanced persistent threat) hackers, too, who target critical infrastructure through the platform to steal information. 

Even though cybercrime has grown in magnitude and relevance in recent years, Discord has not been able to implement effective measures. This has prevented Discord from being able to deter cybercrime, deal with the issue decisively or at least limit its potential impact. Online gaming and digital communication have become part of a household name due to Discord. This is a platform that is becoming increasingly popular among gamers, friends, and families for chatting, sharing, and collaborating. 

A lot of people, including millions of people worldwide, use the Discord program as a way to communicate with one another. 

Discord Viruses: What Are They?


The Discord virus is a phrase used to describe a group of malware programs which can be found in the Discord app or distributed through the Discord platform. Discord users are frequently fooled by cybercriminals by the use of various tricks so that their devices can be infected by a virus which will cause devastating effects on the users' devices. 

In Discord, users will most likely find a Remote Access Trojan (RAT), which is one of the most common types of malware. It is most commonly found that hackers spread them by sending links that contain malicious codes, and when they gain administrative rights over a user's device, they can track their activity, steal data and manipulate settings without knowledge. 

In Discord, users can also find RATs, spyware, adware, and other forms of malware that can potentially be installed along with the RAT. These can also be used as part of DDoS attacks as a means to spread viruses further into a user's system. 

Trellix researchers have recently discovered a new sample of malware targeted specifically at crucial Ukrainian infrastructure, which has put the cybersecurity landscape at a pivotal point. The APT activity in Discord has changed significantly in the last few months, as the latest platform to be targeted is the Advanced Persistent Threat (APT). 

There are three ways in which threat actors exploit Discord: they use its content delivery network (CDN) to distribute malware, they modify the Discord client to obtain passwords, and they exploit its webhook mechanism to gain access to the victim's data. This is made possible because Discord's CDN was commonly used to deliver malicious payloads on a victim's PC. 

As these files are sent from the trusted domain 'cdn.discordapp.com', malware operators can avoid detection by anti-virus software. The data from Trellix shows that more than 10,000 malware samples rely on Discord's CDN to load their second-stage payloads on their systems, mostly malware loaders as well as generic loader scripts.

In addition to RedLine stealer, Vidar, AgentTesla, and zgRAT, Discord's CDN also fetched several other payloads through it. There is one method, which is popular among users, to upload files that can later be downloaded, namely Discord’s Content Delivery Network (CDN). There seems to be no complicated method to this attack. 

The perpetrator fabricates a Discord account so that they can transfer a malicious file, which will then be shared discreetly through a private message. This method appears to be quite straightforward. The goal is to make the "second stage" available for download by simply copying and pasting the file's URL into a GET request which then allows it to be downloaded using the link that was handed to the user upon uploading the file.  

Identifying malware on Discord


Antiviruses should be able to detect malicious software including Discord viruses but keep an eye out for any significant changes to how the system works. For instance, pop-ups could indicate that the device has been infected with adware. Often, system performance changes can serve as a signal that something’s up. 

Whether a user's computer starts crashing more frequently, simply slows down, or the browser starts misbehaving, they should check your system for viruses. Outgoing traffic is a little harder to notice but an unexpected increase in data usage or network activity could indicate a malware infection. 

Some types of malware, such as botnets, use your device’s resources to carry out tasks like sending spam or carrying out denial-of-service (DoS) attacks. The usage of Discord by APT groups is a recent development, signalling a new and complex dimension of the threat landscape. 

While APTs may employ Discord for exploration or early-stage activities, they may still rely on more secure methods at later stages. However, general malware poses a different challenge. From trojans to ransomware, they have been using Discord’s capabilities for years, extending the range of business threats. 

To ensure the proper detection of these malicious activities and safeguard systems, monitoring and controlling Discord communications has become essential, even to the extent of blocking them if necessary.
Read more »
IT
APT Cyber Crime Cyber crimes Cybersecurity Data Theft IT

Data Theft Surge: How IT Admins Are Fighting Back

 


A survey conducted by the company between the 9th and 14th of August 2023 revealed that 55% of IT security decision-makers ranked data theft as their top concern among all IT security concerns they face. There is an interesting trend taking place in terms of ransomware, which has been a staple concern of ours, now slipping from first to third place (29%) behind phishing attacks (35%). 

Based on the results of a survey conducted by the CIO Institute, which collated responses from 205 IT security decision-makers, it was discovered that advanced persistent threats (APTs) and targeted attacks were of greater concern to CIOs (30%) and CTOs (33%), than ransomware (28%, 33%). 

As such, the majority of these APT attack methods are designed to achieve national-level objectives, such as the destruction of infrastructure or the conduct of espionage operations. Based on the data, it appears that data theft is the second most commonly encountered cybersecurity incident within organizations, ranking at 27% of cases reported in the study. 

With 46%, phishing is still at the top of the list when it comes to cybercrime. Therefore, it has become imperative to protect sensitive data, which is why nearly half of the professionals surveyed said they stayed up all night to do so (48%). 

What is Data Theft?


When someone steals data from a computer, server, or another device, to install malware on that device and obtain confidential information, it is considered data theft, as it violates the privacy of the victim. There are increasing numbers of computer users, corporations and organizations that are committing data theft as a major problem. 

At the corporate level, there is a real risk of insiders stealing data from the company as well as from outside its walls; minimizing the risk of insider data theft is anything but an easy task.  The emergence of ransomware has caused headlines over the last decade since it first gained prominence over a decade ago. 

The ransomware has since undergone several evolution cycles and is now capable of both encrypting and stealing sensitive data from a network. It has become increasingly complex for businesses to manage IT environments due to the proliferation of multi-cloud strategies and multiple products, as well as the fact that many enterprises are now using multiple products and multi-cloud strategies, which can lead to security breaches and businesses being forced to pay for tools that are underused or overlap. 

As a result of consolidating cybersecurity architectures, risks can be mitigated, instruments and vendors can be reduced, silos can be removed, costs can be decreased and overall security posture will be improved. A recent study found that security alerts are on the rise, with 89 per cent of respondents reporting an increase in security alert volumes over the past twelve months, while 76 per cent said that alerts have increased by between one and fifty per cent in the past year. 

As a result, 26 per cent of respondents stated a 26 to 50 per cent increase in alerts, which emphasizes that security teams are under increasing pressure and that businesses are facing an ever-increasing number of threats. As a result of losing data in this way, a business is not only at risk of losing customers due to a tarnished image, but they can also potentially lose profits due to disruption and be fined by law enforcement agencies, state legislators, and privacy watchdogs for failure to keep their business data protected. 

A further point to note is that in addition to ransomware, advanced persistent threats (APTs) and targeted attacks are seen as being a greater threat even among CIOs (30%) and CTOs (33%). To mitigate these risks, robust security measures must be implemented to protect these systems and data.
Read more »
US-China
APT CISA Cyber Attacks DOD Military Degradation Operational Technology US Department of Defense US Military US-China

DoD Claims: China’s ICS Cyber Onslaught Aims at Gaining Strategic Warfare Advantages


According to the US Department of Defense (DoD), China's relentless cyberattacks on vital infrastructure are likely a precautionary measure intended to obtain a strategic advantage in the event of violent warfare.

The Cyber Strategy released earlier this week by DoD has mentioned an increase in the state-sponsored cybercrime from People's Republic of China (PRC), particularly against sensitive targets that could affect military responses. 

According to the agency, this is done in order to "to counter US conventional military power and degrade the combat capability of the Joint Force."

The DoD claims in their report that the PRC "poses a broad and pervasive cyberespionage threat," monitoring movements of individual beyond its borders, and further acquiring technology secrets, and eroding the capabilities of the military-industrial complex. However, the NSA cautioned that the operation goes beyond routine information collecting.

"This malicious cyber activity informs the PRC's preparations for war[…]In the event of conflict, the PRC likely intends to launch destructive cyberattacks against the US Homeland in order to hinder military mobilization, sow chaos, and divert attention and resources. It will also likely seek to disrupt key networks which enable Joint Force power projection in combat," the report stated.

An Increasing Chinese Focus on Military Degradation

The notion that cyber activities can signal impending military action is consistent with predictions made earlier this year in the wake of the Volt Typhoon attacks by Microsoft and others. With a series of compromises that targeted telecom networks, power and water controls, US military bases at home and abroad, and other infrastructure whose disruption would interfere with actual military operations, the Beijing-backed advanced persistent threat (APT) made national headlines in the US in May, June, and July.

However, the operational technology (OT) used by the victims has not yet been impacted by the compromises. But, CISA Director Jen Easterly warned at Black Hat USA in August that if the US gets involved in a potential invasion of Taiwan, the Chinese government may be positioning itself to launch disruptive attacks on American pipelines, railroads, and other critical infrastructure.

"This APT moves laterally into environments, gaining access to areas in which it wouldn't traditionally reside[…]Additionally, this threat actor worked hard to cover their tracks by meticulously dumping all extracted memory and artifacts, making it difficult for security teams to pinpoint the level of infiltration," says Blake Benson, cyber lead at ABS Group Consulting.

Taking into account the military-focused cyber activities that can potentially entail collateral damage to bystander business, there could also be a sort of ‘anti-halo effect’ at work, according to John Gallagher, vice president of Viakoo Labs at Viakoo.

"Virtually all exploits launched by nation-states 'leak' over to non-nation-state threat actors[…]That means organizations who depend on IoT/OT systems will be direct targets at some point to the same threats being launched against national critical infrastructure," warns Gallagher.  

Read more »
PDF Exploits
Apple MacOS APT Mac Malware malware North Korean Hackers PDF Exploits

Rustbucket Malware Targeting MacOS Devices Silently

 

Rustbucket, a brand-new type of malware, has just lately surfaced and is now a serious threat to macOS devices. This sneaky spyware works stealthily to infect Mac systems without raising any red flags. Rustbucket has drawn the attention of security professionals due to its capacity to pass itself off as a secure PDF viewer. The goal of this paper is to educate readers on Rustbucket's secrecy, its possible origins, and the security measures that users should take to safeguard their macOS computers.

Rustbucket has been making waves in the cybersecurity community due to its covert infiltration tactics. It disguises itself as a seemingly innocent PDF viewer, tricking users into unknowingly granting it access to their Mac systems. Once inside, the malware remains dormant, evading detection by security software and Mac users alike. Experts have emphasized the sophistication of Rustbucket's techniques, enabling it to silently gather sensitive information and execute malicious activities undetected.

Researchers have linked Rustbucket to North Korean state-sponsored advanced persistent threat (APT) attacks. While further investigation is needed to confirm its origins definitively, the resemblance to previously observed North Korean APT malware is striking. This discovery raises concerns about potential state-sponsored cyber espionage and highlights the need for heightened vigilance in macOS security.

Users of macOS face serious threats because of the existence of Rustbucket. Once installed, it can enable the execution of more malicious actions, undermine user privacy, and provide unwanted access to sensitive data. Additionally, Rustbucket grows harder to locate and remove as it surreptitiously infiltrates the system, possibly causing long-term harm.

Protective Measures:
  • Keep software up to date: Regularly updating the operating system and applications help protect against known vulnerabilities that malware exploits.
  • Exercise caution with email attachments: Be cautious when opening email attachments, particularly those from unknown or suspicious sources. Verify the legitimacy of the attachment and sender before proceeding.
  • Employ robust security software: Install reputable antivirus software specifically designed for macOS systems. Regularly update and scan your device to detect and remove potential threats.
  • Practice safe browsing habits: Exercise caution when visiting unfamiliar websites or downloading files. Stick to trusted sources and use caution when prompted to install third-party plugins or applications.
For macOS users, Rustbucket poses a serious security risk because it surreptitiously infiltrates their systems while pretending to be a helpful PDF viewer. With possible ties to North Korean APT strikes, its covert operation raises questions about data privacy and cybersecurity. Users may defend their macOS devices against Rustbucket and related threats by remaining watchful, updating their applications, and using strong security measures.




Read more »
Technology
Aerospace APT Cyber Crime cyber espionage Cyber Intelligence Cyber Spying Cyberattacks CyberCrime Cybersecurity FBI FireEye Hackers Technology

Cyber Spying Seems to be the Predominant Goal of North Korean Hackers

 


According to a new study, an increasingly sophisticated North Korean cyber-espionage unit is using its skills to carry out spying operations on the aerospace and defense industries. 

As per an updated report released by a cyber-intelligence company, North Korean hackers are no longer viewed as sole criminals who commit cybercrimes motivated by financial gain and break into cryptocurrency exchanges. According to the report, instead of focusing on cyber espionage and data collection, they focus more on information collection. 

A group of bad actors connected to potentially criminal activities on the internet has been identified by Google analysts as an advanced persistent threat (APT) or as a group of cybercriminals linked to activities that might be considered criminal. 

In its report, FireEye, a US-based security firm that keeps track of cyber-attackers around the world, examines the threat from North Korean hackers called APT37 (Reaper) and claims to have found that the group uses malware to infiltrate computer networks at home and abroad. This group has been active in the past but has now migrated to an advanced persistent threat. 

Yet another  report published exclusively by Foreign Policy, authored by private cyber-intelligence company Recorded Future, identifies espionage as the primary motivation behind North Korea's cyber program, which experts attribute to a desire for economic advantage. 

Recorded Future says over 14 years there have been 273 cyberattacks associated with state-sponsored groups in North Korean society. Over 70% of the respondents stated that they were motivated primarily by the desire to collect information about government entities and countries in neighboring Asia, as well as to use their skill sets to commit high-profile cryptocurrency heists. 

It is clear from the report that Pyongyang intends to gain a better understanding of how its adversaries think. This is done by providing the country with "insight into how its adversaries think" as well as knowledge about technologies that could benefit the North in the event of a conflict. Government agencies are usually the targets of this type of attack, followed by cryptocurrency exchanges, media outlets, financial institutions, defense institutions, and nongovernmental organizations as the next most frequent targets. 

Unlike many other countries, North Korea's government seems much more interested in finding out what other nations think of them and how they can improve. It only takes them a minute or two to gather information that can help them develop nuclear and ballistic missile technology. They steal money to fund their regime. 

According to Anne Neuberger, deputy national security adviser for cyber and emerging technologies under President Biden, North Korea is unique in how it views and uses cryptocurrency. This is because it employs cyber operations to finance its nuclear arsenal. About half of the regime's missile program is financed by cryptocurrency and cyber heists. 

The group's cyber operation targets Japan, Vietnam, and the Middle East as part of its efforts. By attempting to steal secret information from companies and organizations involved in chemical, electronics, manufacturing, aerospace, automotive, healthcare, and other sectors, it is attempting to steal valuable information.

In recent years, North Korean hackers have been reported to have stolen billions of dollars from cryptocurrency exchanges around the world. The greatest threat of this year has so far been the high-profile attacks on exchanges, which have targeted Estonia and California so far. 

There has been an increasing number of instances in which North Korea has been linked to attacks beyond crypto, as well as smaller, more disruptive attacks across the globe, starting with the crippling of Sony Pictures just under a decade ago that put its cyber capabilities in the spotlight. After that, Bangladesh's central bank was hacked, which compromised the Swift global financial transfer system used by the United Kingdom to transfer money, and the National Health Service of the United Kingdom was crippled following the hack. 

Nevertheless, Haszard and his coworkers found that a substantial majority of North Korea's cyber activities are directed at domestic targets to which they do not have access.  

According to the report, 83 percent of the attacks for which spatial information is available occurred in Asia, where the majority of the attacks were targeted. There were 29 countries where attacks took place, most of them being in the immediate neighborhood of South Korea, where almost 65 percent of the targets were located North Korean attacks accounted for 8.5 percent of countries, while only three percent of countries were responsible for more than three percent of total North Korean attacks. 

A study by Recorded Future revealed that Lazarus, the biggest and most prominent group of hackers connected to the authoritarian regime, tends to target global targets but is not the most frequent perpetrator of cyberattacks in the world. A group known as Kimsuky targets Asian governments and civil organizations. This accounts for more than one-third of the group's attacks.

U.S. law enforcement agencies say kinky hackers pose as South Korean journalists. They exchange emails with their targets to set up interviews before sending them a link or document embedded with malware. This is the result of their scam. 

It is believed that the malware, known as BabyShark, can provide hackers with access to the devices and communications of those victims. It was found in a joint cybersecurity advisory published earlier this month by the FBI, National Security Agency, and South Korean authorities that Kimsuky actors had also been known to configure a victim's email account so that all emails were automatically forwarded to another account controlled by them. 

North Korea is increasingly focusing on cyber espionage and information collection to gain an advantage over its adversaries. This raises concerns about its intentions and capabilities in cyberspace. Despite this, the report also confirms that North Korea has demonstrated enhanced flexibility when conducting large-scale disruptions of critical infrastructure or engaging in ransomware campaigns compared to opposing adversaries with cyber capabilities like Russia and China.
Read more »
US Government
APT China Cyber Security Cyber Attacks data bias Kaspersky National Cyber Power Index US Government

Why are Western Cyber Attacks Less Heard of?


Camaro Dragon, Fancy Bear, Static Kitten and Stardust Chollima – these are some of the most notorious hacking group around the world. These cyber teams have been under the radar for hacking, stealing information and causing trouble allegedly on the orders of their governments.

Marketers of these companies have been pin pointing locations these groups are originating from, warning users of these ‘advanced persistent threat’ groups (APTs). The groups have majorly been tracked back to Russia, China, North Korea and Iran.

Cyber Defenders Under Attack

Russia’s most popular cyber company Kaspersky were made to investigate its own employees when several staff members’ mobile phones begin distributing their information to some shady parts of the internet.

"Obviously our minds turned straight to spyware but we were pretty sceptical at first[…]Everyone's heard about powerful cyber tools which can turn mobile phones into spying devices but I thought of this as a kind of urban legend that happens to someone else, somewhere else," said chief security researcher Igor Kuznetsov.

Igor came to the conclusion that his intuition had been correct and that they had in fact discovered a sizable sophisticated surveillance-hacking effort against their own team after painstakingly analyzing "several dozen" infected iPhones. Apparently, the attackers had found a way to infect iPhones by simply sending an iMessage, that after installing malware to devices, deleted itself from the device.

In the operation to tackle the issue, the victims’ phone contents were tracked back to the hackers at regular intervals. This included messages, emails, pictures, and even access to cameras and microphones.

Once the issue was solved, on being asked, Kaspersky did not tell the origin of the attack, saying they are not interested “in from where this digital espionage attack was launched.”

The incident raised concerns of the Russian government. Russian security agencies released an urgent advisory the same day Kaspersky reported their discovery, claiming to have "uncovered a reconnaissance operation by American intelligence services carried out using Apple mobile devices.”

The bulletin even accused Apple of being involved in the campaign, however the conglomerate denied the accusation. Neither did the firm in question, the US National Security Agency (NSA), comment on the accusations.

In addition to this, the US Government issues a statement with Microsoft last month, confirming that the Chinese state-sponsored hackers have been found “lurking inside energy networks in US territories”.

In response to this, China denied the accusations saying the "story was a part of a disinformation campaign" from the Five Eyes countries – the UK, Australia, Canada and New Zealand.

Chinese Foreign Ministry official Mao Ning added China's regular response: "The fact is the United States is the empire of hacking."

But as with Russia, China now appears to be taking a more assertive stance in criticizing Western hacking.

According to China Daily, China’s official news source, the foreign government-backed hackers are currently the biggest threat to the nation's cyber security.

Additionally, the Chinese company 360 Security Technology included a statistic with the warning, stating that it has found "51 hacker organizations targeting China." Requests for comments from the business received no response.

China also charged the US with hacking a government-funded university in charge of space and aviation research last September.

While many would brush off the accusation of China, there might could be some truth to it.

According to researchers, there are reasons why the western hacking groups never come to light. We are listing some of these reasons below: 

  • The US is the only tier-one cyber power in the world, based on attack, defence and influence. Its is also labelled as ‘World’s top cyber power,’ by National Cyber Power Index, compiled by researchers at the Belfer Centre for Science and International Affairs. 
  • Western cyber-security companies fail to track western cyber activities, since they do not have customers in the rival countries. It could also be that the companies put less effort in investigating western groups, since many cyber security companies gain major chunk of revenue from the UK or US state-backed lucrative contracts.
  • Another factor contributing to the lack of information about Western cyberattacks is that they are frequently more covert and result in less collateral damage.

Read more »
Gambling Industry
APT Cyber Security Cybersecurity Double-Clean-App Technique Dragon Breath APT Group Gambling Industry

Dragon Breath's Latest Double-Clean-App Technique Targeting Gambling Industry


The Double-Clean-App Technique Explained

The Dragon Breath APT group is known for its sophisticated cyber-attacks on a wide range of industries, including the gambling industry. Recently, security researchers have uncovered the group's latest technique: the use of the double-clean-app method to evade detection and infiltrate targeted networks. 

The double-clean-app technique involves the use of two different types of malware, both designed to evade detection by traditional antivirus software. The first piece of malware is a "clean" version that appears harmless to security systems. It is often disguised as a legitimate application or file, such as a PDF document or a Microsoft Office file. 

Once the clean malware is downloaded and executed, it then downloads a second, more malicious piece of malware. "The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an encrypted payload, with various modifications made to these components over time," said Sophos researcher Gabor Szappanos. "The latest campaigns add a twist in which a first-stage clean application 'side'-loads a second clean application and auto-executes it. The second clean application side-loads the malicious loader DLL. After that, the malicious loader DLL executes the final payload."

Dragon Breath APT Group's Attacks on the Gambling Industry

The second piece of malware is designed to infiltrate the targeted network and steal sensitive data, such as usernames, passwords, and financial information. It can also create backdoors for future attacks or cause damage to the network's infrastructure. QiAnXin reported on Operation Dragon Breath, also known as APT-Q-27 and Golden Eye, in 2020. 

The report described a watering hole campaign aimed at deceiving users into downloading a Windows installer for Telegram that had been infected with a Trojan virus. The Dragon Breath APT group has been using the double-clean-app technique to target the gambling industry. This industry is particularly vulnerable to cyber-attacks due to its reliance on online transactions and the storage of sensitive customer data. 

The group's attacks on the gambling industry have been highly sophisticated, involving the use of multiple techniques to evade detection. The group has also used social engineering tactics to trick employees into downloading malware or disclosing sensitive information. 

Strengthening Cybersecurity Measures for the Gambling Industry

In addition to financial losses, a breach can lead to a loss of customer trust and reputational damage. Customers may be hesitant to continue using a platform that has been compromised, and regulatory authorities may impose fines or sanctions. 

To protect against these types of attacks, companies in the gambling industry must implement robust cybersecurity measures. This includes regular training for employees on how to identify and avoid phishing attacks, the use of advanced antivirus software, and the implementation of multi-factor authentication. 

Companies should also regularly conduct penetration testing and vulnerability assessments to identify any weaknesses in their systems. This will allow them to proactively address potential security issues before they are exploited by threat actors.
Read more »
URL
APT Backdoor Botnet Chinese Hackers Data Breach Sensitive Information Software URL

Chinese APT Group Hijacks Software Updates for Malware Delivery

An advanced persistent threat (APT) group from China, known as Evasive Panda, has been discovered to be hijacking legitimate software update channels of Chinese-developed applications to deliver custom malware to individuals in China and Nigeria for cyber-espionage purposes. Researchers from Eset discovered that when performing automated updates, a legitimate application software component downloaded MgBot backdoor installers from legitimate URLs and IP addresses. The modular malware allows Evasive Panda to spy on victims and enhance its capabilities on the go.

The APT group's activity was fairly easy to attribute to Evasive Panda as researchers have never observed any other threat actors using the MgBot backdoor. The attacks have been ongoing for two years, and the primary goal is to steal credentials and data for espionage purposes. This is another example of state-sponsored actors' increasing sophistication and persistence in cyberspace.

Using legitimate software update channels is a clever technique employed by the group to avoid detection by traditional security measures. Once the malware is delivered through the update, it can operate in the background undetected, and the APT group can exfiltrate sensitive information from the victim's device.

This discovery highlights the importance of maintaining a secure software supply chain and the need for constant vigilance in monitoring the activity of state-sponsored threat actors. Organizations and individuals should always keep their software up to date, maintain robust security measures, and be wary of any suspicious activity or unexpected system changes.

The Eset researchers noted that the MgBot malware has been specifically customized for each victim, suggesting a high degree of sophistication and customization by the APT group. This type of advanced malware is difficult to detect and defend against, making it imperative for individuals and organizations to be proactive in their cybersecurity measures.
Read more »
virus
APT Cyber Attacks Cybersecurity Linux Malware malware North Korea SET SimplexTea virus

Linux Malware Set to Be Deployed by North Korean APT Group

 


There is a shred of growing evidence that North Korean actors were responsible for the 3CX software supply chain hack, as found by ESET researchers. The newly discovered piece of malware extends the evidence that a North Korean group hacked the supply chain. 

In analyzing the backdoor, researchers from cybersecurity firm Eset found that it was tied to Pyongyang's latest fake job recruitment campaign, Operation Dream Job. This campaign recruits people for Pyongyang jobs. The Eset report indicates that North Korean hackers produce and use malware that works on all major desktop operating systems, including Windows, MacOS, and Linux. 

There is no connection between Linux malware and the 3CX supply-chain attack disclosed in late March by Lazarus Group. However, ESET researchers said they were confident that the 3CX attack was conducted by this company. This is even though it does not seem related to the Linux malware. As the name suggests, this is less a distinct organization than it is an umbrella term for a variety of North Korean hacking groups, some state-sponsored, and some criminal, that work for the Hermit Kingdom, and that are based in the country. 

A Trojan attack on 3CX's source code by North Korean hackers was publicly reported in late March, revealing their source code was stolen. A research team from Mandiant reported this week that they had traced the infection source to a previous attack on Trading Technologies' software supply chain. 

Trading Technologies develops software used in financial trading. Researchers from Symantec said on Friday that they had identified two more victims of the Trading Technologies hack that occurred earlier this week. 

There was no doubt throughout this whole investigation that the 3CX case had a North Korean connection from the very start. On March 29, a CrowdStrike engineer posted a message on a Reddit thread in which he reported that this had happened. 

It has also been confirmed that a North Korean nexus was involved in the attack by a preliminary report to be presented to 3CX by Mandiant - hired to investigate the breach. As well as Syphos, Check Point, Broadcom, Trend Micro, and other security companies have also provided summaries of the events. Most of them attribute the compromise to a group aligned with North Korea, citing various reasons. 

In addition to having more than 600,000 clients, 3CX according to their website, boasts several big names in the field. These include American Express, BMW, Air France, Toyota, IKEA, and many others. Shodan's search, conducted on March 30, found over 240,000 phone management systems exposed by 3CX. Huntress, a managed security service provider, reported on March 13, that it received 2,783 incident reports where the binary 3CXDesktopApp.exe matches known malicious hashes. In addition, it has a 3CX-certified certificate attached. 

HSBC, a British multinational bank with a presence in more than 155 countries, offered software development services involving Linux backdoors revealed by ESET researchers. It is believed that anyone who double-clicked on the PDF offer letter downloaded ESET's SimplexTea backdoor for Linux, an operating system known for its lack of security.

SimplexTea has similarities to Bluecall, a North Korean backdoor for Windows computers that had already been identified. This includes the use of domains to construct secure TLS connections similar to SimplexTea domains.  

It is also worth noting that the SimplexTea backdoor used the same core implementation of the A5/1 cipher used by North Korean hackers to sabotage Sony Pictures' release of the comedy "The Interview", which depicts Kim Jong Un's death by fiery helicopter as a camera pans through the company's offices. 

In addition to this direct connection, Eset also mentions that it shares the network infrastructure with the Trojanized VoIP software that serves as the backdoor for the 3CX hackers. As a command-and-control domain, each of these programs uses journalide.org as its point of control. There is also a similar method of loading the configuration files for SimplexTea malware and 3CX malware. 

In a statement released by ESET, the North Korean actors have been identified as the Lazarus Group. Despite this, Mandiant has identified the documents as likely associated with UNC4736, also known as AppleJeus, a Pyongyang hacking activity motivated by profit. 

According to Conversant Group's chief executive officer, John Anthony Smith, this Linux-based malware attack shows how threat actors are continuously expanding their arsenals, targets, tactics, and reach to circumvent security controls and practices in place. There is a growing trend among threat actors to expand the range of their malware variants to affect more systems, he added.
Read more »
Ukraine
APT C&C C2 Encryption malware Payload Russian Hackers SSH Threat actors Ukraine

Data Theft Feature Added by Russian Nodaria APT

An updated piece of information-stealing malware is being used against targets in Ukraine by the Nodaria spy organization, also known as UAC-0056. The malware was created in Go and is intended to gather a variety of data from the infected computer, including screenshots, files, system information, and login passwords.

The two-stage threat known as graphiron consists of a downloader and a payload. The downloader has the addresses of command-and-control (C&C) servers hardcoded in. It will look for active processes when it is executed and compare them to a blacklist of malware analysis tools.

If no processes on the blacklist are discovered, this will connect to a C&C server, download the payload, and then decrypt it before adding it to autorun. The downloader is set up to run only once. It won't try again or send a signal if it is unable to download and run the payload.

Graphiron shares several characteristics with earlier Nodaria tools like GraphSteel and GrimPlant. Advanced features allow it to execute shell commands, gather system data, files, login passwords, screenshots, and SSH keys. Further, it uses port 443 to communicate with the C2 server, and all communications are encrypted using an AES cipher.

Attacks against Georgia and Kyrgyzstan have been carried out by Nodaria since at least March 2021. The recognized tools used by the group include WhisperGate, Elephant Dropper and Downloader, SaintBot downloader, OutSteel information stealer, GrimPlant, and GraphSteel information stealer.



Read more »
state-backed cyberattacks
APT Cyber Attacks CyberWar state-backed cyberattacks

How Cybercrime and Cyberwar are Interlinked?


Cybersecurity experts have long debated that future conflicts will no longer be confronted just on a physical battlefield, but in a digital sphere as well. Although it is clear that the physical battlefield will not be mitigated sooner, considering the recent conflicts, we are also witnessing a rise in state-sponsored attacks like never before. It is therefore important that businesses, individuals, and governments ensure that they are prepared in combating an attack. Since, in a digital battleground, it is not just the soldiers being targeted, but everyone is in the line of fire. 

Broadly speaking, an act of cyberwar is any state-backed malicious online activity that targets foreign networks. However, as with most geopolitical phenomena, real-world examples of cyber warfare are far more complex. In the world of state-sponsored cybercrime, it is not just the government intelligence agencies that are directly carrying out attacks, but these days one can witness attacks from organized cybercriminal organizations that have ties to a nation-state. 

These organizations are known as advanced persistent threat (APT) groups. The infamous APT-28, also known as Fancy Bear, which hacked the Democratic National Committee in the year 2016 is an excellent example of this type of espionage operation. In a way, this serves as the ideal cover for malicious state actors who want to attack and disrupt vital infrastructure while lowering the potential for generating a geopolitical crisis or military conflict. 

If the Enemy Is in Range, So Are You 

Whether a cyberattack is directly linked to a foreign government agency, attacks on critical infrastructure can have devastating repercussions. Critical infrastructure does not just refer to state-owned and operated infrastructures such as power grids and government organizations - banks, large corporations, and Internet service providers all fall under the umbrella of critical infrastructure targets. 

As governments and private organizations continue to adopt advanced and connected IT networks, the risks and potential consequences will only increase. Recent research by the University of Michigan found security vulnerabilities in local traffic light systems. Although the flaw has subsequently been patched, this emphasizes the significance of robust, up-to-date inbuilt security systems to protect infrastructure against cyberattacks. 

Defend Now or Be Conquered Later 

With the rise in advancement and complexity in networks, the chance that vulnerabilities can be exploited as well increases exponentially. Every single endpoint on the network must be constantly monitored and secured if organizations are to have any chance of surviving a sophisticated state-backed attack. 

Some organizations are seen learning this lesson the hard way. For instance, in 2017, US food giant Mondelez was denied a $100 million insurance payout after suffering a Russian ATP cyberattack, since the attack was assumed to be “an act of war” and was not included in the firm’s cybersecurity policy. The conglomerate and Zurich Insurance recently rectified this issue on undisclosed terms.

Endpoint security has never been more critical than it is today. The use of personal mobile devices as a work tool has become pervasive across almost every single industry. This rise in the bring-your-own-devices policy has in part been driven by the false assumption that mobile devices are inherently more secure than desktops. 

However, for over 10 years, various governments and ATP groups with potential cyber capabilities have adapted to and exploited the mobile threat landscape with extremely low detection rates. Attacks on the state and public mobile networks can take down large parts of the workforce, impacting productivity and disrupting everything from the government’s decision-making to the state’s economy. 

IT and security managing experts may not be the ones preventing the inevitable cyberattacks or cyber war, but they can defend themselves against major setbacks. If a device is connected to the infrastructure, physically or virtually, it has become a potential back door for cybercriminals to access the data and disrupt operations. Thus, if organizations want to avoid being victims of potential cyberwarfare, endpoint security should be a priority in conducting operations, from mobiles to desktops.

Read more »
Trojan Attacks
Antivirus APT Backdoor Botnets Cyber Crime Endpoint ESET Symantec Trojan Attacks

Hacker Group Cranefly Develops ISS Method

The novel method of reading commands from seemingly innocent Internet Information Services (IIS) logs has been used to install backdoors and other tools by a recently leaked dropper. Cybersecurity experts at Symantec claimed an attacker is utilizing the malware known as Cranefly also known as UNC3524 to install Trojan. Danfuan, another undocumented malware, as well as other tools.

Mandiant reported that Cranefly mainly targeted the emails of individuals who specialized in corporate development, merger and acquisitions, and significant corporate transactions when it was originally founded in May. Mandiant claims that these attackers remained undetected on target networks for at least 18 months by using backdoors on equipment without support for security measures.

One of the main malware strains used by the gang is QUIETEXIT, a backdoor installed on network equipment like cloud services and wireless access point controllers that do not enable antivirus or endpoint monitoring. This allows the attacker to remain undetected for a long time.

Geppei and Danfuan augment Cranefly's arsenal of specialized cyber weapons, with Geppei serving as a dropper by collecting orders from IIS logs that look like normal web access requests delivered to a compromised host.

The most recent Symantec advisory now claims that UNC3524 used Hacktool-based backdoors in some instances. Multiple advanced persistent threat (APT) clusters use the open-source technology Regeorg.
Additionally, Symantec has cautioned that Cranefly is a 'pretty experienced' hacking group as evidenced by the adoption of a new method in conjunction with the bespoke tools and the measures made to conceal their activity.

On its alert and Protection Bulletins website, Symantec lists the indicators of compromise (IoC) for this attack. Polonium is another threat actor that usually focuses on gathering intelligence, and ESET recently saw Polonium utilizing seven different backdoor variants to snoop on Israeli firms.

Cranefly employs this sneaky method to keep a foothold on compromised servers and gather information covertly. As attackers can send commands through various channels, including proxy servers, VPNs, Tor, or online development environments, this method also aids in avoiding detection by investigators and law enforcement.

It is unclear how many systems have been compromised or how often the threat actors may have utilized this technique in ongoing operations.



Read more »
GamePlayerFramework
APT Casinos Cyber Attacks Cyber Hackers GamePlayerFramework

Hackers Target Online Casinos With GamePlayerFramework Malware

 


The Russian cybersecurity company Kaspersky has stated that the activity of gambling puppet and DRBControl is associated with another set of intrusions that are being linked to Earth Berberoka (aka GamblingPuppet) and Earth Berberoka, citing a similar tactic and targeting as well as the creation of secure messaging clients.

As per the speculations "there may be a mix between espionage and IP theft, though their true motives remain a mystery so far," researchers Kurt Baumgartner and Georgy Kucherin wrote in a technical paper that appeared this week.

In November 2021 Kaspersky said that a PlugX loader and other payloads were detected on an employee monitoring service and a security package deployment service.

A company representative said on Friday that the attacker "was able to perform cyber espionage activities with some degree of stealth due to the initial infection method - the distribution of the framework through security solution packages."

"In addition to downloading programs, launchers, and a set of plugins used to gain remote access, the researchers also developed a new collection of keyloggers that can steal clipboard data and keystrokes from the computer."

In the following weeks, the same security package deployment service has also been used in the delivery of what is called the GamePlayerFramework, a C# variant of a C++-based malware known as PuppetLoader that was deployed.

Based on signs that have been uncovered, DiceyF appears to be a follow-on campaign to Earth Berberoka with a re-engineered malware toolset, even though the framework is maintained by two separate branches called Tifa and Yuna, which include different modules of varying sophistication.

While the Tifa branch mainly consists of a downloader and a core component, the Yuna branch is more complex in terms of functionality. It includes a downloader, a set of plugins, and a minimum of 12 PuppetLoader modules in addition to the downloader. Despite this, it is believed that both branches are actively and incrementally updated, and they are both considered active.

Regardless of the variant employed, once the GamePlayerFramework is launched, it can connect to the command-and-control system (C2) and transmit information about the compromised host, as well as the contents of the clipboard, and then the malware can seize control of the host by answering any of the fifteen commands that the C2 has provided.

As part of this process, the C2 server will also launch a plugin on the victim system. The plugin can either be downloaded from the C2 server when the framework is instantiated or retrieved by requesting the "InstallPlugin" command from the server when the framework is instantiated.

This allows the plugins to be used in conjunction with Google Chrome and Mozilla Firefox browsers to steal cookies from the browsers themselves. Also, this software is capable of capturing keystrokes and clipboard data, establishing virtual desktop sessions, and even being able to remotely log into the machine through Secure Shell.

Moreover, Kaspersky pointed out the use of a malicious app that mimicked Mango Employee Account Data Synchronizer, another piece of software that mimics employee account data synchronization. The GamePlayerFramework is dropped in the network by this messenger app which is used by the targeted entities to make their campaigns more effective.

Researchers have observed several exciting characteristics of DiceyF campaigns and TTP, according to the researchers. There is evidence that the group has modified their software over time, and has developed functionality in the code throughout their intrusions.

To ensure that victims would not become suspicious about the disguised implants, attackers gathered information about targeted organizations (like the floor where the IT department of the organization is located) and included the information in graphic windows that were displayed to victims.
Read more »
malware
APK Files APT APT actors APT attacks cyber espionage DLL EU European Union Fancy Bear Malicious actor malware

FancyBear: Hackers Use PowerPoint Files to Deliver Malware

 

FancyBear: Hackers Use PowerPoint Files to Deliver Malware Cluster25 researchers have recently detected a threat group, APT28, also known as FancyBear, and attributed it to the Russian GRU (Main Intelligence Directorate of the Russian General Staff). The group has used a new code execution technique that uses mouse movement in Microsoft PowerPoint, to deliver Graphite malware.
 
According to the researchers, the threat campaign has been actively targeting organizations and individuals in the defense and government organizations of the European Union and East European countries. The cyber espionage campaign is believed to be still active.
 

Methodology of Threat Actor

 
The threat actor allegedly entices victims with a PowerPoint file claiming to be associated with the Organization for Economic Cooperation (OECD).
 
This file includes two slides, with instructions in English and French to access the translation feature in zoom. Additionally, it incorporates a hyperlink that plays a trigger for delivering a malicious PowerShell script that downloads a JPEG image carrying an encrypted DLL file.
 
The resulting payload, Graphite malware is in Portable Executable (PE) form, which allows the malware operator to load other malwares into the system memory.
 
“The code execution runs a PowerShell script that downloads and executes a dropper from OneDrive. The latter downloads a payload that extracts and injects in itself a new PE (Portable Executable) file, that the analysis showed to be a variant of a malware family known as Graphite, that uses the Microsoft Graph API and OneDrive for C&C communications.” States Cluster25, in its published analysis.
 
The aforementioned Graphite malware is a fileless malware that is deployed in-memory only and is used by malware operators to deliver post-exploitation frameworks like Empire. Graphite malware’s purpose is to allow the attacker to deploy other malwares into the system memory.
 
 
Based on the discovered metadata, according to Cluster25, the hackers have been preparing for the cyber campaign between January and February. However, the URLs used in the attacks were active in August and September.
 
With more hacker groups attempting to carry out such malicious cyber campaigns, the government and private sectors must deploy more powerful solutions to prevent future breaches and cyber attacks to safeguard their organizations.
Read more »
Subscribe to: Posts (Atom)