Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

Source: CHECK POINT

Our analysis of recent campaigns reveals continuous enhancements in the malware’s evasion techniques, along with introducing a new stealer payload called “ApoloStealer.” Read more.

TA Phone Home: EDR Evasion Testing Reveals Extortion Actor’s Toolkit

Source: UNIT 42

In a recent investigation involving an extortion attempt, we discovered a threat actor had purchased access to the client network via Atera RMM from an initial access broker. We discovered the threat actor used rogue systems to install the Cortex XDR agent onto a virtual system. Read more.

Custom “Pygmy Goat” malware used in Sophos Firewall hack on govt network

Source: BLEEPING COMPUTER

UK’s National Cyber Security Centre (NCSC) has published an analysis of a Linux malware named “Pigmy Goat” created to backdoor Sophos XG firewall devices as part of recently disclosed attacks by Chinese threat actors. Read more.

Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network

Source: Microsoft

Microsoft has linked the source of these password spray attacks to a network of compromised devices we track as CovertNetwork-1658, also known as xlogin and Quad7 (7777). Read more.

Strela Stealer targets Central and Southwestern Europe through Stealthy Execution via WebDAV

Source: CYBLE

The payload, Strela Stealer, is embedded within an obfuscated DLL file, specifically targeting systems in Germany and Spain. Strela Stealer is programmed to steal sensitive email configuration details, such as server information, usernames, and passwords. Read more.

Every Doggo Has Its Day: Unleashing the Xi? G?u Phishing Kit

Source: Netcraft

The kit comes equipped with Telegram bots to exfiltrate credentials, ensuring that threat actors can maintain access to data even if their phishing site is taken down. Threat actors using the kit use Rich Communications Services (RCS) rather than SMS to send lure messages. Read more.

New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

Source: The Hacker News

Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up. Read more.

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Source: Microsoft

In this campaign, the malicious .RDP attachment contained several sensitive settings that would lead to significant information exposure. Once the target system was compromised, it connected to the actor-controlled server and bidirectionally mapped the targeted user’s local device’s resources to the server. Read more.

CloudScout: Evasive Panda scouting cloud services

Source: welivesecurity

CloudScout utilizes stolen cookies, provided by MgBot plugins, to access and exfiltrate data stored at various cloud services. We analyzed three CloudScout modules, which aim to steal data from Google Drive, Gmail, and Outlook. We believe that at least seven additional modules exist. Read more.

RAT Malware Operating via Discord Bot

Source: ASEC

This post analyzes a case (PySilon) where RAT malware was implemented using a Discord Bot. The full source code of this RAT malware is publicly available on GitHub, and there are communities on platforms like its website and Telegram servers. Read more.

Want more articles? Check out the previous edition of Security Signals. Want to learn more about Threat Actors? Visit Malware Patrols Threat Actor Profile Page.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

IcePeony Hackers Exploiting Public Web Servers To Inject Webshells

Source: GBHackers

IcePeony, a China-nexus APT group, has been active since 2023, targeting India, Mauritius, and Vietnam by exploiting SQL injection vulnerabilities to compromise systems using webshells and backdoors, leveraging a custom IIS malware called IceCache. Read more.

WrnRAT disguised as a gambling game

Source: ASEC

The attacker created a homepage disguised as a gambling game, and if the game access device is downloaded, malicious code is installed that can control the infected system and steal information. The malicious code appears to have been created by the attacker himself, and it is called WrnRAT based on the string used in its creation. Read more.

New Bumblebee Loader Infection Chain Signals Possible Resurgence

Source: Netskope

The infection likely starts via a phishing email luring the victim to download a ZIP file and extract and execute the file inside it. The ZIP file contains an LNK file named “Report-41952.lnk” that, once executed, starts a chain of events to download and execute the final Bumblebee payload in memory, avoiding the need to write the DLL on disk, as observed in previous campaigns. Read more.

Stealer here, stealer there, stealers everywhere!

Source: SECURELIST

According to Kaspersky Digital Footprint Intelligence, almost 10 million devices, both personal and corporate, were attacked by information stealers in 2023. That said, the real number of the attacked devices may be even higher, as not all stealer operators publish all their logs immediately after stealing data. Read more.

Bored BeaverTail Yacht Club – A Lazarus Lure

Source: eSENTIRE

Upon installation of the malicious NPM packages through Visual Studio Code, the NPM packages attempted to download a Python executable and associated components from a remote location through a cURL command, attempting to retrieve the initial components of the InvisibleFerret backdoor malware. Read more.

Gatekeeper Bypass: Uncovering Weaknesses in a macOS Security Mechanism

Source: UNIT 42

Apple assumes that developers will comply with their security guidelines regarding the inheritance of extended attributes, to ensure that this scanning mechanism can properly function. Because this is not necessarily the case, this can pose a weakness in the Gatekeeper mechanism. Read more.

Call stack spoofing explained using APT41 malware

Source: CYBER GEEKS

Call stacks are a telemetry source for EDR software that can be used to determine if a process made suspicious actions. The purpose of the technique is to construct a fake call stack that mimics a legitimate call stack in order to hide suspicious activity that might be detected by EDR or other security software. Read more.

UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants

Source: Cisco TALOS

The latest series of attacks deploys an updated version of the RomCom malware we track as “SingleCamper”. This version is loaded directly from registry into memory and uses loopback address to communicate with its loader. Read more.

US disables Anonymous Sudan infrastructure linked to DDoS attack spree

Source: CYBERSECURITY DIVE

“The FBI’s seizure of this powerful attack tool successfully disabled the attack platform that caused widespread damage and destruction to critical infrastructure and networks across the world,” Rebecca Day, special agent in charge of the FBI Anchorage field office, said in a statement. Read more.

New FASTCash malware Linux variant helps steal money from ATMs

Source: BLEEPING COMPUTER

North Korean hackers are using a new Linux variant of the FASTCash malware to infect the payment switch systems of financial institutions and perform unauthorized cash withdrawals. Read more.

Want more articles? Check out the previous edition of Security Signals here.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Large scale Google Ads campaign targets utility software

Source: Malwarebytes LABS

Following the creation of advertiser identities belonging to real businesses, the threat actors launch their malicious ads, hiding their infrastructure behind several layers of fingerprinting and cloaking. Read more.

Mind the (air) gap: GoldenJackal gooses government guardrails

Source: welivesecurity

These toolsets provide GoldenJackal a wide set of capabilities for compromising and persisting in targeted networks. Victimized systems are abused to collect interesting information, process the information, exfiltrate files, and distribute files, configurations and commands to other systems. Read more.

Awaken Likho is awake: new techniques of an APT group

Source: SECURE LIST

Analysis of the campaign revealed that the attackers had significantly changed the software they used in their attacks. The attackers now prefer using the agent for the legitimate MeshCentral platform instead of the UltraVNC module, which they had previously used to gain remote access to systems. Read more.

How Malware is Evolving: Sandbox Evasion and Brand Impersonation

Source: VERITI

According to the MITRE ATT&CK framework, malware can check for signs of a sandbox by monitoring system behavior, including checking for user actions like mouse clicks or running time-based checks. Once the malware detects it is inside a sandbox, it can change its behavior, often terminating its execution or connecting to benign domains to avoid raising suspicion. Read more.

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

Source: Aqua

During one of our sandbox tests, the threat actor utilized one of the malware’s backdoors to access the honeypot and started deploying some new utilities to better understand the nature of our server, trying to understand what exactly we are doing to its malware. Read more.

Scam Information and Event Management

Source: SECURE LIST

The attackers distributed the malicious files using websites for downloading popular software (uTorrent, Microsoft Office, Minecraft, etc.) for free. These websites were shown to users in the top search results in Yandex. Malware was also distributed through Telegram channels targeted at crypto investors and in descriptions and comments on YouTube videos about cryptocurrency, cheats and gambling. Read more.

Crypto-Stealing Code Lurking in Python Package Dependencies

Source: Checkmarx

On September 22nd, a new PyPI user orchestrated a wide-ranging attack by uploading multiple packages within a short timeframe. These packages, bearing names like “AtomicDecoderss,” “TrustDecoderss,” “WalletDecoderss,” and “ExodusDecodes,” masqueraded as legitimate tools for decoding and managing data from an array of popular cryptocurrency wallets. Read more.

Stonefly: Extortion Attacks Continue Against U.S. Targets

Source: Symantec

In several of the attacks, Stonefly’s custom malware Backdoor.Preft (aka Dtrack, Valefor) was deployed. This tool is exclusively associated with the group. In addition to this, several Stonefly indicators of compromise recently documented by Microsoft were found on the compromised networks. Read more.

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

Source: Group-IB

Pig Butchering is a term used to describe a sophisticated and manipulative scam in which cybercriminals lure victims into fraudulent investment schemes, typically involving cryptocurrency or other financial instruments. The name of the scam refers to the practice of fattening a pig before slaughter. Read more.

BBTok Targeting Brazil: Deobfuscating the .NET Loader with dnlib and PowerShell

Source: G Data

In a complex infection chain that starts with an email containing an ISO image, this malware stands out by its way of compiling C# code directly on the infected machine. It also uses a technique known as AppDomain Manager Injection to advance execution. Read more.

Want more articles? Check out the previous edition of Security Signals here.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Tyson Ransomware

Source: EnigmaSoft

The Tyson Ransomware infiltrates systems, encrypts data, and holds files hostage, demanding payment for decryption. Once installed on a device, it immediately starts locking down files and appends a “.tyson” extension to encrypted files. Read more.

Undetected Android Spyware Targeting Individuals In South Korea

Source: CYBLE

The Spyware is capable of exfiltrating sensitive information from an infected device, including SMSs, contact lists, images, and videos. The stolen data, stored openly on the S3 bucket, suggests poor operational security, potentially leading to unintended leaks of sensitive information. Read more.

How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus Protections

Source: TREND MICRO

The RansomHub ransomware’s attack chain includes exploiting the Zerologon vulnerability (CVE-2020-1472). Left unpatched, it can enable threat actors to take control of an entire network without needing authentication. Read more.

The Vanilla Tempest cybercrime gang used INC ransomware for the first time in attacks on the healthcare sector

Source: Security Affairs

Microsoft Threat Intelligence team revealed that a financially motivated threat actor, tracked as Vanilla Tempest (formerly DEV-0832) is using the INC ransomware for the first time to target the U.S. healthcare sector. Read more.

Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool

Source: UNIT 42

Splinter is developed in Rust, a relatively new programming language that’s recommended for developing memory-safe software. However, it has densely layered runtime code, which amounts for up to 99% of a program’s code. This density makes analysis a real challenge for malware reverse engineers. Read more.

UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks

Source: Google Cloud

A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East. Read more.

Walmart customers scammed via fake shopping lists, threatened with arrest

Source: Malwarebytes LABS

Case in point, a malicious ad campaign is abusing Walmart Lists, a kind of virtual shopping list customers can share with family and friends, by embedding rogue customer service phone numbers with the appearance and branding of the official Walmart site. Read more.

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Source: TREND MICRO

Threat actor Earth Baxia has targeted a government organization in Taiwan – and potentially other countries in the Asia-Pacific (APAC) region – using spear-phishing emails and the GeoServer vulnerability CVE-2024-36401. Read more.

An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader

Source: Google Cloud

UNC2970 targets victims under the guise of job openings, masquerading as a recruiter for prominent companies. Mandiant has observed UNC2970 copy and tailor job descriptions to fit their respective targets. Read more.

Malware locks browser in kiosk mode to steal Google credentials

Source: BLEEPING COMPUTER

Specifically, the malware “locks” the user’s browser on Google’s login page with no obvious way to close the window, as the malware also blocks the “ESC” and “F11” keyboard keys. The goal is to frustrate the user enough that they enter and save their Google credentials in the browser to “unlock” the computer. Read more.

Want more articles? Check out the previous edition of Security Signals here.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Reputation Hijacking with JamPlus: A Maneuver to Bypass Smart App Control (SAC)

Source: CYBLE

This campaign utilizes a recently demonstrated proof-of-concept (PoC) that repurposes the JamPlus build utility to execute malicious scripts while evading detection. Read more.

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401

Source: FORTINET

Multiple OGC request parameters allow remote code execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Read more.

BlindEagle Targets Colombian Insurance Sector with BlotchyQuasar

Source: Zscaler

BlindEagle has leveraged a version of BlotchyQuasar for attacks, which is heavily protected by several nested obfuscation layers. Read more.

Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords

Source: BLEEPING COMPUTER

Hackers are targeting other hackers with a fake OnlyFans tool that claims to help steal accounts but instead infects threat actors with the Lumma stealer information-stealing malware. Read more.

Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility Command

Source: TREND MICRO

Notorious Mekotio and BBTok are having a resurgence targeting Latin American users. Mekotio’s latest variant suggests the gang behind it is broadening their target, while BBTok is seen abusing MSBuild.exe to evade detection. Read more.

Mallox ransomware: in-depth analysis and evolution

Source: SECURE LIST

In the first half of 2024, the malware was still being actively developed, with new versions being released several times a month, while the Mallox RaaS affiliate program advertised on dark web forums was seeking new partners. Read more.

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

Source: JFrog

This attack technique involves hijacking PyPI software packages by manipulating the option to re-register them once they’re removed from PyPI’s index by the original owner; a technique we’ve dubbed “Revival Hijack”. Read more.

Hacker Leaks Data of 390 Million Users from VK, a Russian Social Network

Source: HACK READ

A hacker using the alias “HikkI-Chan” has leaked the personal details of over 390 million VK users (specifically, 390,425,719) on the notorious cybercrime and hacker platform Breach Forums. Read more.

In plain sight: Malicious ads hiding in search results

Source: We Live Security

Malvertising campaigns typically involve threat actors buying top ad space from search engines to lure potential victims into clicking on their malicious ads; attackers have delivered ads imitating popular software such as Blender, Audacity, GIMP, and MSI Afterburner, to name a few. Read more.

North Korean threat actor Citrine Sleet exploiting Chromium zero-day

Source: Microsoft

Citrine Sleet most commonly infects targets with the unique trojan malware it developed, AppleJeus, which collects information necessary to seize control of the targets’ cryptocurrency assets. Read more.

Want more articles? Check out the previous edition of Security Signals. Want to dive deeper into Reputation Jacking, visit the Malware Patrol Blog Post: Reputation Jacking: Unknown Threats on Well-Known Sites to learn more.