News

Who:

• Entities Involved: Cybercriminals using a variant of Remcos RAT malware in a phishing campaign; Fortinet FortiGuard Labs identified this activity.

What:

• Attack Vector: Phishing emails with purchase order themes lure victims into opening a malicious Excel attachment, which exploits an old Office vulnerability (CVE-2017-0199) to deliver Remcos RAT as a fileless payload.

• Malware Capabilities: Remcos RAT can remotely control infected systems, collecting sensitive data and issuing commands for activities like file harvesting, process manipulation, registry editing, and enabling cameras or microphones.

Impact:

• Security Risks: The fileless nature of Remcos RAT complicates detection, allowing attackers to evade security measures and maintain control over compromised systems. This campaign highlights evolving techniques in malware delivery through commonly used applications, increasing risks for unprotected users.

  
  

Read the full article HERE

Who:

• Entities Involved: Threat actors deploying AndroxGh0st malware in collaboration with Mozi botnet; identified by CloudSEK.

What:

• Attack Method: AndroxGh0st malware is exploiting vulnerabilities across internet-facing applications and using the Mozi botnet to infect IoT and cloud systems. The malware leverages unpatched flaws in various platforms (e.g., Cisco ASA, Dasan GPON, and Oracle EBS) for remote code execution and credential theft, gaining control over targeted devices.

• Botnet Capabilities: Mozi enables DDoS attacks, while AndroxGh0st expands its scope by embedding Mozi’s IoT infection mechanisms, enabling wider IoT device compromise.

Impact:

• Security Risks: The operational alliance between AndroxGh0st and Mozi escalates the threat to IoT and cloud services, expanding potential attack surfaces and allowing for coordinated, large-scale botnet operations. This integration poses a high risk for critical infrastructure, with enhanced capabilities for sustained access and increased infection rates across devices.

  
  

Read the full article HERE

• Context: The FBI has issued a warning to police departments and governments worldwide about a rise in cybercriminal activities that involve the use of hacked police emails. Cybercriminals exploit these email accounts to send fake subpoenas and unauthorized data requests to tech companies, aiming to access sensitive customer data.

• Key Threats:

  • Fake Emergency Data Requests (EDRs): Criminals use compromised government emails to submit fake EDRs, bypassing formal court approval processes. EDRs claim urgent situations, like threats to safety, pressuring companies to quickly release data.

  • Cybercrime Forums and Services: Cybercriminals are selling police email access and fake EDR services on cybercrime forums. Vendors offer forged EDR services for $1,000–$3,000, claiming access to hacked government emails in over 25 countries.

  • Phishing & Malware Attacks: Hackers often gain email access via phishing and malware. The FBI noted poor cybersecurity practices in many law enforcement agencies, emphasizing the need for stronger protections, like multifactor authentication.

• Market for Fake EDR Services: Some vendors specialize in sending false requests to specific platforms, while others sell access to hacked government emails, leaving document forgery to the buyer. Vendors also exploit platforms like Kodex, a service for screening EDR legitimacy, by creating accounts to request data.

• Challenges and Consequences:

  • High Compliance Rates: Tech companies often comply with EDRs to avoid potential harm, making them vulnerable to data leaks from fake requests.

  • Account Freeze Exploits: Criminals can abuse EDRs to freeze or even seize funds in financial accounts, posing serious risks to individuals and companies.

• Preventive Measures: Kodex and the FBI stress that law enforcement agencies improve security practices. Kodex, founded by a former FBI agent, works with companies to verify requests and has suspended numerous suspicious accounts. However, the FBI warns that more agencies need to adopt robust security measures to prevent similar incidents.

Read the full article HERE

Who:

• Threat Actor: Lazarus Group, a North Korean state-sponsored hacking group.

• Target: Cryptocurrency sector, including individuals and organizations.

What:

• Vulnerability Exploited: CVE-2024-4947, a zero-day flaw in Google Chrome's V8 JavaScript engine (patched in May 2024).

• Attack Chain:

  • Malicious website disguised as a blockchain-based game (DeFiTankWar) used to trigger the Chrome vulnerability.

  • Exploit gives attackers control over infected devices, enabling them to steal information and deploy further malware.

  • Social engineering via X (formerly Twitter) and LinkedIn to lure victims into downloading the malware-laden game.

Impact:

• Control Over Devices: Successful exploitation allows attackers to fully control victim systems, potentially leading to major data breaches and financial losses.

• Social Engineering: Lazarus leverages elaborate social media campaigns and stolen game code to trick high-value cryptocurrency targets.

• Broader Threat: The group's evolving tactics, including the use of generative AI and sophisticated social engineering, signal ongoing danger to financial and digital sectors.

  
  

Read the full article HERE

Who:

• Victim: Major US internet service providers (ISPs), including Verizon, AT&T, and Lumen (CenturyLink).

• Perpetrator: Chinese government hackers, attributed to the group "Salt Typhoon."

What:

• Incident: Chinese hackers infiltrated the networks of US ISPs, potentially gaining access to systems used for court-authorized wiretaps of communications networks. Hackers also had access to broader internet traffic, reconfiguring Cisco routers to exfiltrate data.

• Breach Duration: Hackers remained undetected in the networks for months.

Impact:

• Potential Exposure: While it is unconfirmed, there are concerns that wiretap systems and federal surveillance targets could have been compromised. Investigations by the FBI, intelligence agencies, and the Department of Homeland Security are ongoing.

• Response: Verizon is working closely with the FBI, Microsoft, and Google’s Mandiant to address the breach. The hack raises concerns about the security posture of the affected ISPs and the sophistication of the attackers.

  
  

Read the full article HERE