December 2024 - Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

Google’s New SAIF Risk Assessment Tool for AI Security 

Google has introduced the Secure AI Framework (SAIF) Risk Assessment tool to help organizations proactively identify and mitigate security risks in their AI systems. This interactive tool assesses key areas such as training data integrity, access controls, and defenses against adversarial inputs. Upon completion, organizations receive a tailored report outlining specific vulnerabilities and recommended mitigation strategies, reinforcing the need for robust security measures as AI systems become more prevalent. 

Further Reading: Google Blog on SAIF Risk Assessment 

Session Cookie Theft Bypasses MFA Protections 

The FBI has issued a warning about cybercriminals exploiting stolen session cookies to hijack email accounts, effectively bypassing Multi-Factor Authentication (MFA) safeguards. These "Remember-Me" cookies, typically valid for 30 days, store session IDs that authenticate users without repeated logins. If intercepted, attackers can impersonate users, gaining unauthorized access to email accounts and sensitive information. 

Mitigation Strategies: 

• Monitor Account Activity: Stay vigilant for unfamiliar login attempts or unauthorized changes. 

• Implement Robust Security Measures: Utilize endpoint protection solutions to detect and prevent malware that could steal session cookies. 

Further Reading: Malwarebytes 

Sophos Reports Sophisticated China-Based Threats Targeting Network Perimeters 

Sophos recently uncovered a five-year cyber espionage campaign by China-based groups, including APT31 and APT41, that targeted network edge devices like firewalls. These attackers used zero-day vulnerabilities and custom malware to infiltrate and persist within critical infrastructure across the Indo-Pacific region, including energy suppliers, government agencies, and telecommunications. Advanced tactics include stealth operations, sabotaging firewall telemetry, and deploying an early version of a UEFI bootkit on firewall devices. 

Key Insights: 

• Critical Infrastructure Targeting: Attackers focused on high-value assets, compromising essential services. 

• Advanced Persistence Tactics: Use of rootkits and stealth malware for long-term access. 

• Importance of Edge Device Security: Firewalls and perimeter defenses remain primary entry points for these threats. 

Further Reading: Sophos News 

Preparing for Emerging AI Risks 

The latest Unit 42 Threat Frontier report highlights the evolving risks associated with generative AI (GenAI) in cybersecurity. As threat actors increasingly explore AI tools to enhance attack methods, traditional defenses like Zero Trust architectures remain essential, but additional AI-focused defenses are becoming critical. The report also emphasizes the growing issue of "Shadow AI," or the unauthorized use of AI tools within organizations, which poses unique security challenges. 

Key Insights: 

• Shadow AI Risk: Unauthorized use of AI tools within organizations increases security vulnerabilities. 

• AI-Specific Defenses: Integrating AI-focused security measures early in development is essential for robust protection. 

• Continued Importance of Traditional Defenses: Zero Trust and other established architectures are still effective but need AI-specific adaptations. 

Further Reading: Unit 42 - Palo Alto Networks 

Extortion Actor's EDR Bypass Attempt Unveiled 

Unit 42 recently investigated an extortion incident where threat actors attempted to bypass Endpoint Detection and Response (EDR) systems using a tool named "disabler.exe." This tool, derived from the publicly available EDRSandBlast, aimed to unhook EDR hooks in both user-mode libraries and kernel-mode, facilitating unauthorized access. The attackers utilized rogue systems with outdated Cortex XDR agents to test their methods, inadvertently exposing their toolkit and operations. This exposure allowed Unit 42 to trace the tool's sale on cybercrime forums and identify one of the threat actors involved.  

Unit 42 

Key Insights: 

• Advanced Evasion Techniques: Attackers are employing sophisticated tools to disable security mechanisms, highlighting the need for robust and up-to-date EDR solutions. 

• Operational Exposure: Testing malicious tools in uncontrolled environments can inadvertently reveal threat actor methodologies and identities. 

• Community Vigilance: Monitoring cybercrime forums and sharing intelligence are crucial for preempting and mitigating such threats. 

Further Reading: Unit 42 - Palo Alto Networks 

Surge in Fake Emergency Data Requests 

The FBI has issued a warning to U.S. organizations about a rise in fraudulent emergency data requests (EDRs) by cybercriminals. These malicious actors compromise government email accounts to impersonate law enforcement, exploiting the urgency of EDRs to obtain sensitive user information from service providers without legal oversight. 

Key Insights: 

• Tactics: Cybercriminals gain access to official email accounts, enabling them to submit convincing EDRs to companies, thereby bypassing standard legal procedures. 

• Motivations: The harvested data is often used for further criminal activities, including identity theft, financial fraud, and targeted cyberattacks. 

• Indicators of Compromise: Unusual or unexpected data requests, especially those marked as urgent, should be scrutinized for authenticity. 

Recommendations: 

• Verification Protocols: Implement strict verification processes for all data requests, including direct confirmation with the requesting agency through known contact points. 

• Employee Training: Educate staff on the prevalence of fake EDRs and establish clear procedures for handling such requests. 

• Monitoring and Reporting: Continuously monitor for suspicious data requests and report any fraudulent attempts to the appropriate authorities. 

Staying vigilant against these deceptive tactics is crucial to safeguarding sensitive information and maintaining trust with users. 

Further Reading: SecurityWeek 

The Credential Abuse Cycle 

Recent analyses have highlighted the escalating threat of credential abuse, where cybercriminals exploit stolen usernames and passwords to infiltrate networks and access sensitive data. This cycle comprises three key stages: theft, trade, and exploitation. 

Key Insights: 

• Credential Theft: Attackers acquire credentials through data breaches, malware (notably infostealers), and social engineering. 

• Underground Trading: Stolen credentials are sold on cybercriminal forums, specialized marketplaces, and messaging platforms like Telegram. 

• Exploitation: With these credentials, threat actors conduct account takeovers, credential stuffing, and valid account abuse, leading to data breaches and financial losses. 

Further Reading: ReliaQuest Blog 

Rise in SVG-Based Phishing Attacks 

Cybercriminals are increasingly utilizing Scalable Vector Graphics (SVG) files in phishing emails to bypass security filters and deliver malicious content. Unlike traditional image formats, SVG files can contain embedded scripts, allowing attackers to execute malicious code when the file is opened. 

Key Insights: 

• Evasion Techniques: SVG files are often overlooked by email security systems, enabling malicious payloads to reach recipients undetected. 

• Embedded Malware: Attackers embed JavaScript within SVG files to initiate redirects to phishing sites or to download malware onto the victim's device. 

• Increased Prevalence: There is a notable uptick in phishing campaigns leveraging SVG attachments, highlighting the need for heightened vigilance. 

Further Reading: Bleeping Computer 

2024 CWE Top 25 Most Dangerous Software Weaknesses Released 

The Common Weakness Enumeration (CWE) has published its 2024 list of the Top 25 Most Dangerous Software Weaknesses. This annual compilation identifies the most prevalent and critical vulnerabilities that can lead to severe security breaches, including system takeovers, data theft, and application disruptions. 

Key Highlights: 

• Top Vulnerabilities: The list features critical weaknesses such as Cross-Site Scripting (CWE-79), Out-of-Bounds Write (CWE-787), and SQL Injection (CWE-89). 

• Data Insights: The 2024 list is based on an analysis of 31,770 CVE Records, providing a comprehensive overview of current software security challenges. 

• Resource for Mitigation: The CWE Top 25 serves as a valuable resource for developers and security professionals to prioritize mitigation efforts and enhance software security practices. 

Further Reading: CWE Top 25 Most Dangerous Software Weaknesses 

Analysis of CISA's 2023 Top Exploited Vulnerabilities 

The Cybersecurity and Infrastructure Security Agency (CISA) has released its 2023 report on the most routinely exploited vulnerabilities, providing critical insights into the threat landscape. An in-depth analysis by VulnCheck offers additional perspectives on these vulnerabilities, emphasizing their exploitation patterns and associated threat actors. 

Key Insights: 

• Exploit Availability: Out of the 15 vulnerabilities highlighted, 14 have eight or more publicly available proof-of-concept (POC) exploits, indicating a high risk of exploitation. 

• Weaponized Exploits: Thirteen vulnerabilities have weaponized exploits, with five being weaponized before any public evidence of exploitation emerged. 

• Threat Actor Activity: Sixty named threat actors are linked to 13 of these vulnerabilities. Notably, North Korea's Silent Chollima group targeted nine of the listed vulnerabilities. 

• Detection Coverage: VulnCheck provides Initial Access artifacts for 12 of the 15 vulnerabilities, aiding defenders in identifying and mitigating potential threats. 

Further Reading: VulnCheck Blog 

Surge in Eventbrite-Based Phishing Attacks 

Recent analyses by Perception Point have identified a significant increase in phishing campaigns exploiting Eventbrite's scheduling platform. Between July and October 2024, these attacks escalated by 900%, with cybercriminals sending deceptive emails from 'noreply[@]events[.]eventbrite[.]com' to distribute malicious content. 

Key Insights: 

• Legitimate Appearance: Utilizing Eventbrite's legitimate email domain allows attackers to bypass standard security filters, making the phishing emails appear authentic to recipients. 

• Malicious Payloads: The emails often contain links or attachments designed to harvest credentials or deploy malware upon interaction. 

• Targeted Entities: While the attacks are widespread, they predominantly focus on organizations that frequently use event management platforms, increasing the likelihood of successful exploitation. 

Further Reading: KnowBe4 Blog 

Large-Scale Phishing Campaign Deploys Rhadamanthys Stealer v0.7 

Check Point Research has identified a significant phishing operation utilizing the latest version of the Rhadamanthys Stealer, known as Rhadamanthys.07. This campaign, dubbed "CopyRh(ight)adamantys," impersonates legitimate companies to distribute malware under the guise of copyright infringement notices.  

Checkpoint Blog 

Key Insights: 

• Phishing Tactics: Attackers send emails from Gmail accounts, alleging copyright violations on the recipient's social media pages, prompting them to download a file that initiates the malware infection. 

• Global Reach: The campaign targets individuals and organizations across multiple continents, with approximately 70% of impersonated companies belonging to the entertainment, media, technology, and software sectors. 

• Malware Capabilities: Rhadamanthys.07 includes features such as AI-powered optical character recognition (OCR) modules, enhancing its ability to extract data from infected machines. 

Further Reading: Check Point Blog 

Corrupted Word Documents in Novel Phishing Campaign 

A newly identified phishing campaign exploits Microsoft's Word file recovery feature by using intentionally corrupted Word documents as email attachments. These documents evade detection by security solutions due to their damaged state, but Word can still recover and open them. 

Key Insights: 

• The Lure: Emails impersonate payroll and HR departments, with themes like employee bonuses and benefits. The attachments appear as corrupted files but can be repaired by Word. 

• Malicious QR Codes: Upon recovery, the documents prompt users to scan a QR code branded with company logos. Scanning leads to phishing sites designed to steal Microsoft login credentials. 

• Detection Challenges: Most attachments used in this campaign avoid detection on platforms like VirusTotal, as they contain no active malicious code, just deceptive QR codes. 

• Attack Effectiveness: By exploiting overlooked document recovery mechanisms, this method bypasses traditional email security filters, increasing the likelihood of reaching victims. 

Further Reading: BleepingComputer Article 

Surge in Infostealer Malware Exploiting Innovative Attack Vectors 

In October 2024, Check Point Research identified a significant increase in infostealer malware activity, with cybercriminals employing advanced tactics to infiltrate systems and exfiltrate sensitive data.  

Key Insights: 

• Prevalent Malware Families: The top threats included FakeUpdates, impacting 6% of organizations worldwide, followed by Androxgh0st at 5%, and AgentTesla at 4%.  

• Innovative Attack Vectors: Threat actors are leveraging sophisticated methods, such as malicious advertisements in search results—a tactic known as "malvertising"—to distribute infostealers. This approach enhances the legitimacy of malicious links, increasing the likelihood of user engagement.  

• Global Impact: The widespread distribution of these malware families underscores the necessity for organizations to adopt proactive and adaptive security measures to counter evolving cyber threats. 

Further Reading: Check Point Blog 

Attackers Exploit Corrupted Files to Evade Detection 

Cybersecurity researchers have identified a novel phishing campaign that utilizes intentionally corrupted Microsoft Office documents and ZIP archives to bypass email security measures. These corrupted files evade antivirus scans and email filters, yet can be opened by users through built-in recovery features in applications like Microsoft Word and WinRAR. 

Key Insights: 

• Evasion Techniques: The corrupted state of these attachments prevents security tools from properly scanning them, allowing malicious emails to reach users' inboxes undetected. 

• User Interaction: When users attempt to open these corrupted files, applications prompt them to recover the content, leading to the display of malicious elements such as QR codes. 

• Malicious Outcomes: Scanning the embedded QR codes can redirect users to phishing websites designed to steal credentials or deploy malware. 

This tactic highlights the continuous evolution of phishing strategies aimed at circumventing security defenses and exploiting user trust in application recovery features. 

Further Reading: The Hacker News 

Protecting Your Vote: Understanding Cyber Threats Ahead of the 2024 US Elections

I created this blog post for distribution internally as part of our Security Awareness program. Feel free to grab and share internally at your own company.

As the November 5, 2024, US elections approach, cybercriminals are exploiting the event to carry out sophisticated phishing campaigns, financial fraud, and misinformation according to a report from BforeAI. These malicious actors often use the names of prominent candidates, like "Harris," "Trump," and "Biden," in fake domains to mislead the public. Websites mimicking legitimate voting resources aim to steal personal and financial information. Additionally, fraudulent ecommerce stores and cryptocurrency themed around the elections pose significant financial risks to unsuspecting voters.

The Threat Landscape

Phishing and Fake Domains: Cybercriminals are creating fake domains and websites using candidate names and election-related terms like “vote” and “election” to increase their credibility. These sites are used to deceive voters into providing sensitive information, making donations to fraudulent campaigns, or spreading misinformation about voting dates and locations. For example, domains like "vote-no-sunnybailey[.]com" are designed to manipulate public opinion and suppress voter turnout through the dissemination of fake news and propaganda.

Financial Fraud: Many malicious websites are set up to collect personal and financial information from voters. Fraudulent donation sites mimic legitimate campaign fundraising efforts but are designed to steal credit card details and personally identifiable information (PII). This data is then sold on and used for future fraud and social engineering attacks. Furthermore, the emergence of meme coins themed around the elections is another avenue for financial exploitation, with these digital currencies often promoted on social media as quick investment opportunities, only to disappear after collecting funds from unsuspecting victims.

Misinformation Campaigns: Cybercriminals are also leveraging free web hosting platforms to quickly create and abandon malicious websites. These sites often contain misinformation about voting procedures, dates, and locations, aimed at confusing voters and reducing turnout. Additionally, unauthorized live streaming websites and other online platforms are being used to spread propaganda and manipulate voter behavior, further complicating the election process.

How to Protect Your Vote

To safeguard your vote and personal information during this election season, it’s essential to stay informed:

• Use Official Sources: Always verify voting information through official government websites like usa.gov and vote.gov. These sites use the “.gov” domain, which is restricted to government entities and ensures the legitimacy of the information.

• Avoid Clicking on Suspicious Links: Be wary of unsolicited emails, texts, or social media messages that link to unknown sites, especially those asking for donations or personal information. Always navigate to the official campaign or government website directly.

Conclusion

The 2024 US elections are a prime target for cybercriminals seeking to exploit voter emotions and manipulate election outcomes. By understanding the tactics used in these malicious campaigns, voters can better protect their identities and their votes. Staying informed and cautious is the best defense against these evolving threats.

Phishing Threat Intelligence Newsletter July 2024

This is a monthly threat intelligence newsletter with a lean towards phishing and healthcare I put together for the team at my company. Feel free to grab and share with your own internal team.

Threat Intelligence Newsletter: Resurgence of Russia's Fin7 

Overview: The notorious cybercrime group Fin7, previously thought to be dismantled, has re-emerged with increased activity. This resurgence is primarily facilitated by Stark Industries Solutions, a hosting provider linked to Russian cyberattacks. 

Key Developments: 

• Infrastructure: Fin7 now operates over 4,000 hosts, using tactics like typosquatting, booby-trapped ads, and phishing domains. 

• Targets: They mimic brands like American Express, Google, Microsoft 365, and more. 

• Techniques: Using domains that appear benign initially, Fin7 builds credibility before launching phishing attacks. 

Implications: Organizations must heighten vigilance against phishing, regularly update security protocols, and monitor for suspicious domain activities. 

For more details, visit Krebs on Security. 

New Internet Explorer Zero-Day Spoofing Attack (CVE-2024-38112) 

Overview: Check Point Research (CPR) has identified a new zero-day spoofing vulnerability in Internet Explorer, designated CVE-2024-38112. This vulnerability allows attackers to deceive users by displaying a fake website address in the browser's address bar, facilitating phishing and other malicious activities. 

Key Details: 

• Attack Vector: The attack leverages Internet Explorer's handling of URLs to present a legitimate-looking address while directing users to malicious sites. 

• Impact: Users can be tricked into divulging sensitive information or downloading malicious content, believing they are on a trusted website. 

Recommendations: 

• Mitigation: It is crucial to avoid using Internet Explorer and switch to more secure, up-to-date browsers. 

• Patching: Ensure all systems are updated with the latest security patches and consider deploying additional security measures such as web filtering and threat intelligence services. 

For further information, visit the Check Point Blog. 

Ransomware Attack Disrupts U.K. Health Service Laboratory 

Overview: A ransomware attack on Synnovis, a laboratory partner for several major London hospitals, has significantly disrupted health services. The Qilin ransomware group, utilizing a Ransomware-as-a-Service model, is behind the attack and also targets U.S. based organizations. After failing to receive a ransom payment, Qilin released over 400GB of private healthcare data online. 

Key Points: 

• Impact: Major disruption to hospital services. 

• Perpetrators: Qilin (also known as Agenda). 

• Initial Access: Through phishing and spear phishing emails. 

Recommendations: 

• Strengthen phishing defenses. 

• Conduct regular security awareness training. 

For more information, visit the KnowBe4 Blog. 

Microsoft Links Scattered Spider Hackers to Qilin Ransomware Attacks 

Microsoft has identified the Scattered Spider cybercrime group, also known as Octo Tempest, as responsible for recent Qilin ransomware attacks. This financially motivated group has been active since 2022, targeting over 130 high-profile organizations using tactics such as phishing, MFA bombing, and SIM swapping. The Qilin ransomware group, known for targeting VMware ESXi virtual machines, employs double-extortion attacks by threatening to release stolen data. 

Key Takeaways: 

• Increased Sophistication: Scattered Spider's diverse tactics highlight their adaptability. 

• Targeting Critical Infrastructure: Focus on high-profile organizations and virtual environments. 

• Mitigation Strategies: Enhanced security measures such as robust MFA policies and employee training on phishing can help defend against such attacks. 

For more details, read the full article from Bleeping Computer. 

Social Media Job Scams: Don't Be the Target! 

Hunting for your dream job online? Unfortunately, social media can be a breeding ground for scammers who target unsuspecting job seekers. But fear not! Here are some key takeaways to help you avoid falling victim to their schemes: 

• Be wary of unsolicited offers, especially those that come through social media. Legitimate recruiters typically only contact you if you've applied for a position or if they have a referral from someone you know. If you receive a message out of the blue about a fantastic opportunity, proceed with caution. 

• Watch out for unprofessional communication. Typos, grammatical errors, and requests for money upfront are all major red flags. Legitimate companies will communicate professionally and will never ask you to pay for a job interview or training. 

• Suspicious of remote jobs with high salaries? You should be! Scammers often lure people in with the promise of a high-paying work-from-home position. If something sounds too good to be true, it probably is. But that doesn't mean there aren't real remote work opportunities out there. Do your research to ensure the company is legitimate before getting your hopes up. 

• Don't be afraid to investigate! Before you apply for any job, take some time to research the company. Look for online reviews, check their website for legitimacy, and see if they have a social media presence with a good following. A little detective work can go a long way in weeding out imposters. 

• Keep your personal information private. This includes your Social Security number, bank account number, and credit card number. Never share this information with someone you don't know and trust, especially through social media or email. 

• Be cautious about clicking on links or attachments. Phishing emails and messages are a common tactic used by scammers. If you receive a message from an unknown sender about a job opportunity, don't click on any links or attachments. Instead, go directly to the company's website to see if the job is listed there. 

By following these tips, you can protect yourself from social media job scams and increase your chances of finding a legitimate and rewarding job opportunity. Remember, if it seems too good to be true, it probably is. So, be cautious, be smart, and happy hunting! For more details check out the KnowBe4 blog. 

Phishing Alert: Microsoft Top Target, Social Media on the Rise 

According to a recent Check Point Research report, Microsoft was the most imitated brand for phishing attacks in Q2 2024, accounting for over half of all attempts. This highlights the ongoing threat of brand phishing, where cybercriminals impersonate well-known companies to trick users into revealing personal information or clicking on malicious links. 

The report also reveals new entries to the top 10 most impersonated brands, including Adidas, WhatsApp, and Instagram. This trend indicates a shift in cybercriminals' tactics, as they target social media and technology companies that hold valuable user data. 

Top 10 Most Impersonated Brands in Q2 2024 

1. Microsoft (57%) 

2. Apple (10%) 

3. LinkedIn (7%) 

4. Google (6%) 

5. Facebook (1.8%) 

6. Amazon (1.6%) 

7. DHL (0.9%) 

8. Adidas (0.8%) 

9. WhatsApp (0.8%) 

10. Instagram (0.7%) 

Check out Check Point’s blog for more details. 

New Backdoor Used by APT41: MoonWalk 

A recent blog post by Zscaler details a new backdoor tool called MoonWalk المستخدمة من قبل مجموعة APT41 (used by the APT41 group). MoonWalk is a tool used by the APT41 threat group for espionage. The article discusses MoonWalk’s technical aspects, including its use of Google Drive for communication and Windows Fibers for evasion. MoonWalk also uses a modular design, allowing attackers to customize it for different situations. 

Here are some key takeaways from a threat intelligence perspective: 

• New APT41 Backdoor: APT41 is a well-known threat group known for its targeted attacks. The development of MoonWalk shows that the group is constantly evolving its tactics and techniques. 

• Google Drive for Communication: The use of Google Drive for communication is a novel technique that makes it more difficult for defenders to detect malicious activity. 

• Windows Fibers for Evasion: The use of Windows Fibers for evasion helps MoonWalk to avoid detection by security software. 

• Modular Design: The modular design of MoonWalk allows attackers to easily customize it for different targets and campaigns. 

Organizations should be aware of the MoonWalk backdoor and take steps to protect themselves, such as: 

• Implementing advanced endpoint detection and response (EDR) solutions 

• Educating employees about phishing attacks and social engineering techniques 

• Regularly patching systems and applications 

By following these steps, organizations can help to mitigate the risk of being targeted by APT41 and other threat groups. 

You can read more about MoonWalk here. 

Phish-Friendly Domain Registry ".top" Put on Notice 

The ".top" domain registry, managed by Jiangsu Bangning Science & Technology Co. Ltd., has been warned by ICANN for its failure to address phishing abuse. Findings revealed that over 4% of new ".top" domains from May 2023 to April 2024 were used for phishing. ICANN's notice demands immediate improvements, or the registry risks losing its license. This highlights the critical need for vigilant monitoring and prompt action against domain abuse to protect users from phishing threats. 

For more information, read the full article on Krebs on Security. 

Over 3,000 GitHub Accounts Exploited in Malware Distribution Scheme 

Summary: A new threat, dubbed 'Stargazers Ghost Network,' involves over 3,000 GitHub accounts used to distribute information-stealing malware via fake repositories. Discovered by Check Point Research, this Distribution-as-a-Service (DaaS) leverages GitHub’s reputation to spread infostealers like RedLine and Lumma Stealer. Despite GitHub's efforts, over 200 malicious repositories remain active. 

Key Takeaway: 

• Attack Mechanism: Utilizes compromised WordPress sites and GitHub repositories. 

• Targets: Cryptocurrency, gaming, and social media enthusiasts. 

• Operation: Accounts serve phishing templates, images, and malware, maintaining resilience even after takedowns. 

• Recommendations: Exercise caution with file downloads from GitHub and use VMs or VirusTotal to scan archives. 

For more information, read the full article on BleepingComputer. 

North Korean Operative Infiltrates KnowBe4 Using Stolen Identity 

Summary: KnowBe4 recently revealed that a North Korean hacker, posing as a U.S. citizen, successfully got hired as an IT worker. Despite multiple rounds of interviews and background checks, the individual was detected attempting to install malware on their new workstation. No sensitive data was accessed due to robust security measures. 

Key Takeaways: 

• Entry: Hacker used a stolen identity to pass interviews and background checks. 

• Detection: Suspicious activity was identified, and the laptop was quarantined swiftly. 

• Impact: No customer data was accessed; the malware was blocked by security tools. 

• Response: KnowBe4 has enhanced its hiring processes to prevent similar incidents. 

Recommendations: Regularly review and update hiring and onboarding procedures to mitigate risks from sophisticated threat actors. 

For more information, read the full article on KnowBe4 Blog. 

Exploiting CrowdStrike Outage: Phishing, Fake Scripts, and Social Engineering 

Summary: Following a recent CrowdStrike update that caused widespread blue screen of death (BSOD) errors, cybercriminals are capitalizing on the confusion. Fake PowerShell scripts, phishing domains, and social engineering attacks are proliferating, posing significant risks. 

Key Takeaways: 

• Fake Scripts: Malicious scripts on platforms like GitHub install dangerous software. 

• Phishing: Surge in domains offering fake fixes. 

• Social Engineering: Impersonation of IT personnel and cybersecurity firms to trick users. 

Recommendations: Verify the authenticity of scripts and domains, and educate users on phishing and social engineering tactics. 

For more information, read the full article on ReliaQuest Blog. 

Huntress Foils a Medical Software Update Hack 

Huntress recently uncovered a sophisticated phishing campaign targeting medical software updates. Cybercriminals created a fake version of a legitimate medical image viewer, embedding malicious code that established a secret connection back to the attackers. This attack highlights the critical need for vigilance even when dealing with trusted sources. Huntress's Security Operations Center (SOC) detected the anomaly and quickly isolated the threat, preventing potential data breaches. 

Key Takeaways: 

• Verify the authenticity of software updates. 

• Be cautious of unexpected file sizes or unusual behaviors. 

• Regularly update software from official websites. 

For more details, visit Huntress's blog. 

TuDoor: Exploiting DNS Logic Vulnerabilities 

A new DNS attack method, named TuDoor, has been identified, highlighting critical vulnerabilities in DNS response pre-processing. Attackers can use malformed DNS response packets to execute cache poisoning, denial-of-service, and resource exhaustion attacks. TuDoor impacts 24 mainstream DNS software and many public DNS services, potentially affecting millions of users. 

Key Takeaways: 

1. Be aware of the TuDoor attack method. 

1. Ensure DNS software is up-to-date with patches. 

1. Monitor for unusual DNS traffic patterns. 

For more details, visit TuDoor's website. 

Generative AI Tools: New Target for Scammers 

Recent intelligence highlights a surge in cyber threats exploiting interest in generative AI tools, particularly ChatGPT. Scammers are registering suspicious domains containing keywords like "gpt" and "prompt engineering," aiming to deceive users with phishing schemes and malware distribution. This trend coincides with major AI-related announcements, increasing the risk to individuals and organizations exploring these technologies. 

Key Insights: 

• Domain Surveillance: Monitor new domain registrations for AI-related keywords. 

• Phishing Alerts: Educate users on verifying AI tool sources. 

• Evolving Tactics: Stay updated on scam trends exploiting emerging technologies. 

For more details, visit KnowBe4's Blog. 

OneDrive Pastejacking: A New Phishing Tactic 

A new phishing threat, "pastejacking," targets OneDrive users by exploiting the copy-paste functionality. Attackers inject malicious commands into users' clipboards through seemingly benign text or files. This method can lead to unauthorized data access or malware installation when unsuspecting users paste the copied content. 

Key Insights: 

• Clipboard Exploitation: Phishing schemes use clipboard manipulation to inject harmful code. 

• User Vigilance: Verify clipboard content before pasting from unknown sources. 

• Security Measures: Put controls in place to limit user PowerShell usage and monitor for any abnormal PowerShell activity.  

For more details, visit Trellix's Blog. 

Phishing Threat Intelligence June 2024

Little behind getting this out but still wanted to get it out. This is a newsletter of articles I thought might be valuable for our security team and helped me plan this months simulated phish. Created with help from ChatGPT

New Execution Technique in ClearFake Campaign 

ReliaQuest has identified a new execution technique used in the ClearFake campaign, a variant of the SocGholish malware family. This sophisticated method involves using JavaScript to trick users into executing malicious PowerShell commands, representing a significant evolution in attack tactics. 

Key Findings: 

• Malicious JavaScript Files: The campaign leverages malicious JavaScript files named “update.js,” tricking users into copying and executing encoded PowerShell commands. 

• Obfuscation and Execution: The PowerShell code is obfuscated using base64 encoding. Once decoded and executed, it performs various actions, including DNS cache clearing, displaying deceptive messages, and downloading additional payloads from malicious URLs. 

• Persistence via Python: In a novel approach, the campaign uses Python scripts for establishing persistence, signaling an evolution in tactics to evade detection. 

Infection Chain: 

1. Ingress: The malicious JavaScript downloads and extracts Python, then sets up a scheduled task for persistence. 

1. Execution: The extracted Python script connects to command-and-control (C2) servers, facilitating further malicious activities. 

1. Persistence: The scheduled task ensures the malware remains active on the infected system, making it harder to detect and remove. 

Conclusion: The ClearFake campaign exemplifies the increasing sophistication of cyber threats, highlighting the need for robust security measures and continuous vigilance. By understanding and implementing the recommended defensive measures, organizations can better protect against these evolving threats. 

For detailed information and technical analysis, visit ReliaQuest's blog on the ClearFake campaign. Stay informed and secure! 

Phishing Campaigns Exploiting Cloudflare Workers 

Netskope has identified sophisticated phishing campaigns leveraging Cloudflare Workers to deploy malicious content through two main techniques: HTML smuggling and transparent phishing. These methods are designed to evade detection and compromise user credentials. 

Key Findings: 

• HTML Smuggling: This technique bypasses network controls by assembling the phishing page on the client side. Attackers embed the phishing page as a blob within a benign webpage, using JavaScript to decode and display the malicious content. 

• Transparent Phishing: In this approach, attackers use Cloudflare Workers as reverse proxies for legitimate login pages, intercepting credentials, cookies, and tokens as users attempt to log in. 

Campaign Details: 

• Targeted Regions: Recent phishing campaigns have primarily targeted victims in Asia, North America, and Southern Europe, focusing on sectors such as technology, financial services, and banking. 

• Credential Theft: Most phishing pages aim to steal Microsoft login credentials, with other targets including Gmail, Yahoo Mail, and cPanel Webmail. 

For detailed technical analysis and more information, visit Netskope's blog on the ClearFake campaign. 

New Phishing Campaign Uses Malicious LNK Files 

A sophisticated phishing campaign has been discovered, leveraging malicious LNK files to deliver malware. This technique bypasses traditional email security filters and lures victims into executing harmful payloads. 

Phishing Lure: 

• Email Content: Cybercriminals craft emails that appear to come from legitimate sources, often including urgent or enticing messages. 

• Attachment: The email includes a seemingly harmless LNK file. When clicked, this file triggers the download and installation of malware. 

For more details, visit The Hacker News. 

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers 

A sophisticated phishing campaign has been identified, deploying the WARMCOOKIE backdoor to exploit job seekers. The attack involves sending fake job offers with malicious attachments or links, which, when executed, install the WARMCOOKIE backdoor. This malware provides attackers with remote access to compromised systems, allowing data exfiltration and further exploitation. 

Attack Chain: 

1. Initial Phishing Email: Victims receive fake job offer emails. 

1. Malicious Attachment: The email contains a malicious attachment (e.g., .doc or .pdf). 

1. Execution: Opening the attachment installs the WARMCOOKIE backdoor. 

1. Backdoor Access: Attackers gain unauthorized access to the victim's system. 

1. Data Exfiltration: Sensitive information is extracted and used for further attacks. 

Key Indicators: 

• Fake job offer emails with .doc or .pdf attachments. 

• Unusual email addresses and domains. 

• Links redirecting to suspicious websites. 

For further details, visit the Hacker News article. 

RansomHub Strengthens Its Ransomware Arsenal with Scattered Spider Tactics 

A recent alliance between RansomHub and Scattered Spider has significantly boosted RansomHub’s capabilities, making it one of the largest active Ransomware-as-a-Service (RaaS) operations. 

Key Developments: 

• Evolution from Knight Ransomware: RansomHub emerged from the Knight ransomware group, using similar codebases and recruiting affiliates from other disbanded ransomware operations like LockBit and BlackCat (ALPHV). 

• Integration of Scattered Spider Techniques: Known for its sophisticated phishing campaigns, Scattered Spider has provided RansomHub with advanced phishing kits and data exfiltration techniques. 

Indicators of Compromise (IOCs): 

• Use of .doc and .pdf attachments in phishing emails. 

• Deployment of remote access tools such as Atera and Splashtop. 

• Exploitation of the ZeroLogon vulnerability. 

Recommendations: 

• Regularly update software and systems. 

• Implement advanced email filtering solutions. 

• Conduct security awareness training for employees. 

• Segment networks to limit ransomware spread. 

• Develop and test incident response plans. 

For more details, visit Security Boulevard and Dark Reading. 

Phorpiex Botnet and LockBit3 Ransomware Surge 

In May 2024, the cybersecurity landscape was significantly impacted by two major threats: the Phorpiex botnet and the LockBit3 ransomware group. 

Phorpiex Botnet's Phishing Campaign 

Researchers identified a large-scale phishing campaign involving the Phorpiex botnet, which sent millions of emails containing ransomware. The Phorpiex botnet, which resurfaced as a variant called "Twizt" in December 2021, used deceptive .doc.scr files in ZIP attachments to trigger ransomware encryption. This campaign employed over 1,500 unique IP addresses, primarily from regions such as Kazakhstan, Uzbekistan, Iran, Russia, and China. 

LockBit3 Ransomware Dominance 

LockBit3, operating as a Ransomware-as-a-Service (RaaS), accounted for 33% of published ransomware attacks in May. Despite previous law enforcement actions that disrupted their operations, LockBit3 quickly rebounded. This group continues to target large enterprises and government entities, particularly in regions excluding Russia and the Commonwealth of Independent States (CIS). 

Top Malware Families: 

1. FakeUpdates (SocGholish): Downloader leading to further compromises. 

1. Androxgh0st: Botnet targeting multiple platforms, stealing sensitive information. 

1. Qbot (Qakbot): Multipurpose malware stealing credentials and deploying additional malware. 

Top Exploited Vulnerabilities: 

1. Command Injection Over HTTP (CVE-2021-43936, CVE-2022-24086): Allows remote code execution. 

1. Web Servers Malicious URL Directory Traversal: Permits unauthorized file access on vulnerable servers. 

1. Apache Log4j Remote Code Execution (CVE-2021-44228): Enables attackers to execute arbitrary code. 

Top Mobile Malware: 

1. Anubis: Android banking Trojan with ransomware capabilities. 

1. AhMyth: Remote Access Trojan (RAT) stealing sensitive information. 

1. Hydra: Banking Trojan stealing credentials through manipulated permissions. 

Most Attacked Industries: 

1. Education/Research 

1. Government/Military 

1. Communications 

Top Ransomware Groups: 

1. LockBit3: Responsible for 33% of attacks, targeting large enterprises. 

1. Inc. Ransom: Emerging ransomware group targeting multiple sectors. 

1. Play: A ransomware impacting businesses and critical infrastructure. 

Organizations must stay vigilant and implement robust cybersecurity measures to defend against these evolving threats. For more detailed information, visit Check Point. 

SmokeLoader Evolution and Impact 

Zscaler's ThreatLabz provides an in-depth historical analysis of SmokeLoader, a modular malware family first advertised in 2011. Initially serving as a downloader, SmokeLoader has evolved to include functionalities for data theft, DDoS attacks, and cryptocurrency mining. Key features include advanced anti-analysis techniques, modular capabilities, and encrypted C2 communications. Notable developments include the introduction of a stager component in 2014 and sophisticated obfuscation methods. SmokeLoader remains a persistent threat due to its continuous evolution and adaptability. 

Key Takeaways: 

• Modular Design: Allows for flexible and varied attack strategies. 

• Advanced Evasion: Sophisticated anti-analysis and obfuscation techniques. 

• Persistent Threat: Continuous updates keep it relevant and dangerous. 

For detailed insights, visit the Zscaler Blog. 

DarkGate Malware's Evolving Tactics 

Cisco Talos has identified a significant increase in DarkGate malware activity through malicious email campaigns since March 2024. These campaigns use Remote Template Injection to bypass email security controls, deploying Excel attachments that trigger malware execution when opened. Notably, DarkGate has transitioned from using AutoIT to AutoHotKey scripts for its infection process, with the payload executing in-memory without being written to disk. 

Key Takeaways: 

• Remote Template Injection: Bypasses security controls using Excel files. 

• In-Memory Execution: Enhances evasion by avoiding disk writes. 

• AutoHotKey Scripts: Replaces AutoIT for advanced automation. 

For detailed insights, visit the Cisco Talos Blog. 

Active Phishing Campaign: Yousign HR Lure 

Agari has identified an active phishing campaign using the Yousign platform to distribute malicious emails posing as HR notifications. These emails prompt recipients to review an updated employee handbook, leading to credential harvesting. By leveraging the legitimacy of Yousign's domain, attackers bypass email security filters. The campaign employs Remote Template Injection and unique URLs to evade detection. 

Key Takeaways: 

• Legitimate Domains: Used to bypass security controls. 

• Credential Harvesting: Malicious forms disguised as HR documents. 

• Unique URLs: Hinders detection by security tools. 

For detailed insights, visit the Agari Blog. 

FBI Alert: Healthcare Industry Phishing Campaign 

The FBI and HHS have issued a warning about a sophisticated phishing campaign targeting the healthcare sector. Threat actors are using social engineering tactics to steal login credentials and redirect Automated Clearing House (ACH) payments to accounts they control. These attackers manipulate help desk staff to gain access and then use stealth techniques to divert payments. Healthcare organizations, due to their size and access to sensitive data, are prime targets. Enhance employee training to recognize and thwart social engineering attacks. 

Key Takeaways: 

1. Sophisticated Tactics: Attackers use social engineering to exploit help desk staff. 

1. ACH Payment Redirection: Stolen credentials are used to divert ACH payments. 

1. Targeted Sector: Healthcare organizations are primary targets due to their sensitive data. 

1. Employee Training: Essential to enhance awareness and ability to recognize phishing attempts. 

For detailed information, visit the KnowBe4 blog. 

New Threat: ASCII-Based QR Codes 

QR code phishing, or "quishing," is evolving with attackers now using ASCII characters to create QR codes within HTML, bypassing traditional OCR-based security measures. These codes appear as legitimate QR codes to users but evade detection by security systems, leading to credential theft and malware deployment. 

Key Takeaways: 

• Evolution of Technique: ASCII-based QR codes embedded in HTML are the latest in phishing tactics, making it harder for security systems to detect them (Avanan) (Techzine Europe) . 

• Real-World Impact: Over 600 instances detected, with significant disruptions including a recent healthcare provider attack (Sechub) (Coalition) . 

• Mitigation Strategies: 

• Implement security that decodes and analyzes QR codes in emails. 

• Use solutions that rewrite embedded QR codes with safe links. 

• Employ advanced AI-based tools to detect phishing indicators. 

Stay informed and update your security measures to guard against these sophisticated threats. 

For more details, visit the Checkpoint Blog or read more on Techzine. 

New Threat: Exploitation of Microsoft SmartScreen 

Overview Hackers are actively exploiting a vulnerability in Microsoft SmartScreen (CVE-2024-21412) to deploy stealer malware such as Lumma and Meduza Stealer. Despite a patch released in February 2024, attackers continue to bypass SmartScreen using malicious internet shortcuts distributed via spam emails. 

Key Takeaways: 

• Method: Bypassing SmartScreen through WebDAV-hosted shortcuts and executing multi-step attacks using PowerShell and JavaScript. 

• Impact: Significant breaches leading to information theft and potential system compromise. 

• Recommendations: Verify emails, use advanced filtering, avoid suspicious links, keep software updated, limit scripting languages, and segment networks. 

For more details, visit the Cyber Security News. 

New Threat: Volcano Demon Ransomware 

Overview A new ransomware group named Volcano Demon is using phone calls to pressure victims into paying ransoms. This group deploys LukaLocker ransomware to encrypt files and uses double extortion tactics by exfiltrating data before encryption. Victims receive threatening phone calls from unidentified numbers, increasing the pressure to comply with ransom demands. 

Key Takeaways: 

• Method: Phone calls combined with data exfiltration and encryption. 

• Impact: Significant disruption, with threats to leak data and continued attacks. 

• Recommendations: Strengthen network security, train employees on phishing tactics, and prepare for potential ransomware attacks. 

For more details, visit the The Record. 

Phishing Threat Intelligence April 2024

These are the phishing related stories I paid attention to in April 2024. Feel free to use these and share them with your own security teams.

 The NaurLegal Campaign Unveiled 

BlueVoyant's Threat Fusion Cell has exposed a new cyber attack campaign, dubbed ‘NaurLegal’, led by the notorious eCrime group Narwhal Spider. This campaign ingeniously exploits the trust in legal transactions by distributing malicious PDF files posing as invoices from reputable law firms. With filenames like "Invoice_[number]from[law firm name].pdf," these documents are crafted to bypass casual scrutiny and initiate malware infections. 

Key Insights: 

• Tactic Exploitation: NaurLegal leverages the routine nature of legal document exchanges, using this as a vector to deploy malware, including sophisticated threats like WikiLoader and potentially IcedID. 

• Infrastructure: The campaign operates through compromised WordPress sites for command and control (C2), a hallmark of Narwhal Spider’s modus operandi. 

• Evolving Threat: Unlike previous attacks primarily targeting Italian entities, NaurLegal broadens its focus, indicating a strategic shift towards exploiting a wider array of organizational vulnerabilities. 

Google Ads Malware Alert for Security Professionals 

In a recent discovery by AhnLab Security Intelligence Center (ASEC), a sophisticated malware distribution campaign has been identified exploiting Google Ads' tracking feature. Dubbed by ASEC, this campaign cleverly disguises malware as popular groupware installers like Notion, Slack, and Trello, leveraging Google Ads to reach a broad audience. The exploitation of the Ads platform's vast user base and complex targeting options presents a notable security concern, highlighting the innovative strategies of cybercriminals to breach defenses. 

Key Campaign Insights: 

• Malware Distribution: Attackers create or hijack Google Ads to distribute malware through tracking URLs hidden in legitimate-looking ads, leading unsuspecting users to download harmful executables. 

• Targeted Malware: The campaign specifically uses malware-laden files with names mimicking reputable software installers to trick users into initiating downloads. 

• Sophisticated Evasion Techniques: Upon execution, the malware contacts attacker-controlled servers to fetch additional malicious payloads, utilizing compromised domains and text-sharing sites for hosting. 

• Payloads and Execution: The Rhadamanthys infostealer malware, fetched from these links, is then injected into legitimate Windows system files, enabling it to steal private data while avoiding detection. 

Security Alert: New Loader and Agent Tesla Campaign Detected 

SpiderLabs has identified a phishing campaign deploying Agent Tesla via a sophisticated new loader. Initiated via email attachments disguised as bank payment receipts, this campaign utilizes advanced obfuscation and encryption to deliver its malicious payload while evading detection. 

Key Insights:

• Attack Vector: Phishing emails with attachments that trigger a complex infection chain to deploy Agent Tesla. 

• Evasion Tactics: The loader showcases advanced evasion, including polymorphism and AMSI bypass techniques, to execute the payload stealthily. 

• Agent Tesla Execution: Executes entirely in memory, focusing on data theft and utilizing SMTP for data exfiltration through compromised accounts. 

AI-Powered Malware Spreads Through Social Media Malvertising Campaigns 

This article from Bitdefender highlights a recent surge in information-stealing malware campaigns targeting social media users. 

Key Points: 

• Attackers Exploit Popularity of AI Software: Cybercriminals are leveraging the rising interest in AI-powered image and video generators to distribute malware. 

• Malicious Ads Impersonate Legitimate Software: Fake social media pages and sponsored ads mimic popular AI tools like Midjourney, Sora, and CapCut. 

• Ads Trick Users into Downloading Malware: Clicking on these ads leads users to download malicious software disguised as official installers. 

• Malware Steals Sensitive Information: The malware steals login credentials, browsing history, cookies, and even crypto wallet information. 

• Rilide V4, Vidar, IceRAT, and Nova Stealer Used: The report identifies various information stealers used in these campaigns, including Rilide V4, Vidar, IceRAT, and Nova Stealer. 

• Midjourney Most Targeted Platform: Midjourney, a popular AI image generation tool, was the most impersonated platform in this campaign. 

Attention Security Teams: Malware Spreads Through YouTube Video Game Cracks 

Threat actors are leveraging compromised YouTube accounts to distribute information stealers disguised as popular video game cracks. This campaign, detailed in a recent Proofpoint report, targets unsuspecting gamers, particularly younger audiences. 

• Compromised Accounts: Legitimate and newly created YouTube accounts are being used to upload malicious videos. 

• Deceptive Content: Videos advertise access to pirated software or game upgrades. Descriptions contain links that download malware upon clicking. 

• Targeted Audience: The campaign exploits the desire to bypass paid features, likely appealing to younger gamers. 

Security Implications: 

• Information stealers like Vidar, StealC, and Lumma Stealer can compromise user credentials and other sensitive data. 

• Compromised accounts can be used to further distribute malware or host phishing attacks. 

• Younger audiences may be less familiar with online safety best practices, increasing susceptibility. 

For further investigation: The Proofpoint report provides Indicators of Compromise (IOCs) to assist in identifying these malicious videos. 

ReliaQuest’s Annual Cyber-Threat Report: 2024 

According to the report: 

• Phishing links or attachments were involved in 71% of all initial access phases of cyber attacks 

• The top three MITRE ATT&CK techniques in attacks involved phishing or spear phishing 

• Drive-by-compromise was used in 29% of attack 

• QR code phishing saw a 51% increase in just one month – September – over the previous 8 months combined 

Android Malware Vultur Expands Its Capabilities 

A recent report by Fox-IT details the evolving capabilities of the Android malware Vultur. Key takeaways: 

• New Functionality: Vultur now possesses features that enable remote interaction with a device's screen through Accessibility Services. 

• Enhanced File Management: The malware can now download, upload, delete, install, and locate files on infected devices. 

• Evasion Techniques: Vultur employs app impersonation and communication encryption to evade detection. 

These expanded capabilities pose a significant threat to Android users, as Vultur can now perform a wider range of malicious activities. 

Agent Tesla Targets US and AU Organizations: A Newsletter for Security Professionals 

A recent campaign by cyberespionage actors, nicknamed "Bignosa" and "Gods", has been targeting organizations in the United States and Australia. The attackers use phishing emails with topics related to purchasing goods and order delivery to distribute the Agent Tesla malware. Once installed, Agent Tesla can steal keystrokes and login credentials. 

Key takeaways: 

• Malicious Mails: Phishing emails with seemingly legitimate topics are being used to lure unsuspecting victims. 

• Agent Tesla: This malware steals keystrokes and login credentials, posing a significant threat to compromised systems. 

• Stay Vigilant: Keeping software updated and exercising caution regarding unexpected emails are crucial for mitigating such attacks. 

New Download Threat: Latrodectus Emerges 

A new downloader malware called Latrodectus has emerged, posing a threat to system security. Two threat actors, TA577 and TA578, have been distributing Latrodectus, raising concerns about its potential reach. 

This malware functions as a downloader, capable of not only information theft but also installing additional malware, potentially escalating the attack. Security experts believe Latrodectus might be linked to the creators of IcedID, another malicious software. Key takeaways: 

• Latrodectus's Reach: The involvement of multiple threat actors (TA577 and TA578) indicates a wider distribution network, increasing the potential for encountering this malware. 

• Multi-faceted Threat: Latrodectus goes beyond information theft; its ability to install additional malware poses a serious risk of system compromise. 

• Possible Connection to IcedID: The link to IcedID suggests a potentially sophisticated threat actor behind Latrodectus. 

New Malware Delivery Techniques on the Rise 

New research from Check Point reveals that cybercriminals are developing new methods to deliver malware. These techniques involve novel infection chains designed to bypass common security measures and deliver Remcos, a powerful Remote Access Trojan (RAT). 

The report also highlights the evolving tactics employed by attackers to exploit vulnerabilities. While Lockbit3 remains the most prevalent ransomware, Blackbasta has worryingly climbed the ranks, entering the top three. 

Key takeaways: 

• Cybercriminals are developing new methods to deliver malware, employing novel infection chains to bypass common security measures. 

• Remcos, a powerful Remote Access Trojan (RAT), is being delivered through these new techniques. 

• Lockbit3 remains the most prevalent ransomware, but Blackbasta has risen in prominence. 

• FakeUpdates is the most common malware encountered. 

Tycoon 2FA: Phishing As A Service Evolving to Bypass MFA 

MFA Fatigue? Tycoon 2FA Raises Concerns 

A new variant of the Tycoon 2FA phishing kit is making waves for its effectiveness in bypassing multi-factor authentication (MFA). This phishing-as-a-service (PhishingaaS) tool targets Microsoft 365 credentials and utilizes a technique known as adversary-in-the-middle (AiTM) to steal session cookies, granting access even with MFA enabled. 

Key Points for Security Teams: 

• Active Threat: First observed in August 2023, Tycoon 2FA has become a prevalent threat due to its ease of use and affordability. 

• MFA Bypass: The phishing kit steals Microsoft 365 session cookies, allowing attackers to bypass MFA and gain access to compromised accounts. 

• Stealthier Than Ever: Recent updates enhance the kit's stealth capabilities, potentially reducing detection by security products. 

• Widespread Impact: Sekoia has identified over 1200 domain names associated with Tycoon 2FA infrastructure since its release. 

Alert: Cisco Duo's Multifactor Authentication Service Compromised 

Cisco Duo has issued a warning to its customers following a breach involving a third-party telephony service provider. This incident, which unfolded on April 1, 2024, involved the unauthorized access of SMS logs due to a social engineering cyberattack. 

Key Details: 

• Breach Dynamics: Threat actors gained access by using compromised employee credentials at a third-party provider that handles SMS and VOIP services for Cisco Duo's multifactor authentication (MFA). 

• Data Compromised: The breach resulted in the unauthorized download of message logs for SMS messages sent between March 1, 2024, and March 31, 2024. These logs included phone numbers, carriers, country and state data, and other metadata like the date, time, and type of messages. 

• No Message Content Exposed: It's important to note that the content of the messages was not exposed in the breach. 

Customer Advisory: Cisco Duo has advised all impacted users to notify individuals whose information was compromised and to stay alert for potential phishing attacks leveraging the stolen data. 

Tech Giants Lead Phishing Charge: Microsoft, Google Top Q1 Brand Impersonation 

Phishing remains a top threat, with technology brands the most impersonated. 

A recent report by Check Point Research (CPR) paints a concerning picture of the evolving phishing landscape. Their analysis of brand phishing attempts in Q1 2024 reveals a worrying trend: technology giants are the most targeted sectors. 

Key Findings: 

• Microsoft Maintains Top Spot: Microsoft continues to be the most impersonated brand in phishing attacks, accounting for a staggering 38% of all attempts in Q1 2024. 

• Google Makes Gains: Google rose to the second-place position, capturing 11% of phishing attempts – a significant increase from its previous third-place ranking. 

• Tech Sector Dominates: Technology remains the most impersonated industry, likely due to its prevalence in corporate environments and the potential for lucrative access to company assets through stolen credentials. 

Why Tech Brands? 

Cybercriminals often target technology brands for several reasons: 

• Widespread Use: These brands are familiar and widely used, making them a believable target for phishing attempts. 

• Access to Sensitive Data: Gaining access to compromised accounts in these platforms can grant attackers access to sensitive corporate data or financial information. 

• Remote Work Reliance: The increased use of cloud-based services and remote work environments expands the potential attack surface for tech-focused phishing campaigns. 

Beware of Sophisticated Phishing Attacks Targeting Help Desks! 

Alert! A recent report from the Department of Health and Human Services (HHS) warns of a rise in sophisticated social engineering attacks targeting IT help desks within the healthcare sector. 

Here's what you need to know: 

• Impersonation Tactics: Attackers are making phone calls to help desks, impersonating employees (often in financial roles) and claiming they require urgent assistance. 

• Credentials at Risk: These imposters are armed with convincing details about the targeted employee, including the last four digits of their Social Security number and corporate ID. This information allows them to bypass initial security checks. 

• Potential for Data Breaches: The ultimate goal of these attacks is to steal login credentials or trick help desk personnel into granting access to sensitive systems and data. 

Malvertising Campaign Targets IT Teams with "MadMxShell" Backdoor 

Threat actors are leveraging malvertising campaigns to distribute a previously unseen backdoor dubbed "MadMxShell." This campaign targets IT security and network administration teams by spoofing legitimate IP scanner software websites. 

Key Details: 

• Attack Chain: The threat actors register typosquatted domain names resembling popular IP scanner software. 

• Google Ads Abuse: They then exploit Google Ads to push these malicious websites to the top of search engine results pages (SERPs) for relevant keywords used by IT professionals searching for IP scanner tools. 

• Delivery of Backdoor: Unsuspecting victims who visit the spoofed websites are redirected to download links that deliver the MadMxShell backdoor. 

Technical Analysis: 

• MadMxShell Backdoor: This backdoor offers remote access capabilities, allowing attackers to gain unauthorized control over compromised systems. 

• Limited Information: While details about MadMxShell's functionalities are scarce, the report suggests it possesses file system manipulation and process execution abilities. 

Shift in Attack Tactics: Vulnerability Exploitation on the Rise 

Phishing Declines, Zero-Days Soar 

A recent report by Mandiant indicates a significant shift in cyberattacker tactics. Vulnerability exploitation has overtaken phishing as the primary method for gaining initial network access. Researchers found that in 2023, vulnerabilities were exploited in 38% of intrusions, a 6% increase over 2022. Phishing attempts, while still the second most common initial infection vector, dropped from 22% to 17% over the same period. 

The report also highlights a sharp rise in the exploitation of zero-day vulnerabilities, previously unknown flaws in software, by 56% year-over-year. Chinese cyber espionage groups were found to be the most active users of zero-days, while financially motivated attackers continue to leverage these vulnerabilities to steal financial data. 

Key Takeaways 

• Patching vulnerabilities promptly is crucial to preventing initial network access by attackers. 

• Organizations should prioritize vulnerability management and invest in threat detection solutions capable of identifying zero-day exploits. 

• While phishing remains a threat, user awareness training should be supplemented with additional security measures to mitigate the evolving tactics of cybercriminals. 

Ransomware on the Rise: More Groups, More Victims 

Ransomware is back with a vengeance. A GRIT report shows a worrying 20% increase in victims in Q1 2024 compared to the same period last year. This coincides with a surge in active ransomware groups, jumping from 29 to 45 (a 55% increase). BlackBasta and Play are new major players, joining the persistent LockBit. 

Brutality and Distribution Mark New Era 

These groups are targeting critical infrastructure like hospitals, highlighting a ruthless shift in tactics. Additionally, RaaS groups are recruiting affiliates, creating a more distributed threat landscape. 

Key Takeaways: 

• Patching and Detection are Critical: Shore up defenses by patching vulnerabilities and implementing security solutions. 

• Beyond Phishing: Non-phishing attacks are the new norm, so vulnerability management is key. 

• Backups are Essential: Regular backups ensure a swift recovery from an attack. 

• Stay Ahead of the Curve: Keeping informed about the evolving threat landscape allows for proactive defense. 

Phishing Attacks on the Rise: AI-powered Threat Landscape 

A recent report by AI-ThreatLabz highlights a significant increase in phishing attacks, with a staggering 58% rise observed in 2024 compared to the previous year. This surge is attributed to the growing adoption of Artificial Intelligence (AI) by attackers, enabling them to craft highly personalized and believable phishing campaigns. 

Key Takeaways 

• Phishing Attacks are Soaring: Phishing remains a major threat, with a sharp increase in incidents this year. 

• AI-powered Attacks: Attackers are leveraging AI to create more believable and personalized phishing emails, making them harder to detect. 

• Zero Trust Security is Key: Traditional security approaches may not be sufficient. Zero trust security principles can help mitigate the risk of phishing attacks by continuously verifying access requests. 

Phishing Threat Intelligence March 2024

Tax Season Phishing Campaigns - Targeting New Tactics 

Microsoft Threat Intelligence (MSTI) has uncovered a rise in phishing campaigns targeting taxpayers during the tax season. These campaigns leverage social engineering tactics to trick victims into revealing sensitive information or clicking on malicious links. 

Targets and Techniques: 

• High-Risk Groups: New taxpayers, small business owners, and older adults are identified as the most vulnerable demographics. 

• Phishing Methods: Emails disguised as legitimate tax documents or communications from employers are common methods. The emails may contain urgency or use scare tactics to pressure recipients into clicking malicious links or opening attachments containing malware. 

Iranian Threat Actor TA450 Shifts Tactics in Latest Campaign 

Summary: A recent campaign by Iranian threat actor TA450 has been detected leveraging a new technique. 

Previous Tactics: Historically, TA450 has targeted Israeli users via email campaigns containing malicious links directly embedded within the email body. These links typically led to file-sharing sites that, when clicked, downloaded remote access trojans (RATs). 

New Development: Proofpoint researchers observed a shift in TA450's tactics. The latest campaign utilizes PDF attachments containing malicious links. The social engineering lure involves emails disguised as pay slips, likely designed to trick victims into opening the attachments. 

Security Implications: This new delivery method makes TA450's emails appear more legitimate, potentially increasing the success rate of these phishing attacks. Security professionals should be aware of this evolving technique and update email security filters accordingly. 

New Trojan: VCURMS Discovered by Fortinet 

Fortinet researchers have uncovered a new trojan named VCURMS. This trojan leverages obfuscation techniques to bypass traditional antivirus detection and establish persistence on compromised systems. 

VCURMS Capabilities: 

• Information Theft: VCURMS can steal sensitive information from infected devices. 

• Remote Access: The trojan grants remote access to attackers, enabling them to control the compromised system. 

Delivery Method: 

VCURMS primarily spreads through phishing campaigns. Attackers target victims with emails containing malicious attachments. Once a user opens the attachment, the trojan infects the system. 

Zscaler ThreatLabz Releases New Report on AI Security Trends and Risks 

A recent Zscaler report, "New AI Insights: Exploring Key AI Trends and Risks ThreatLabz 2024 AI Security Report," delves into the evolving landscape of AI security. Key takeaways for security professionals include: 

• Soaring Enterprise AI Adoption: The report highlights a significant increase (595%) in enterprise adoption of AI technologies. This presents both opportunities and challenges for security teams. 

• Balancing Benefits and Risks: While AI offers significant advantages, it also introduces new security risks. The report emphasizes the need for a well-defined security posture to mitigate these risks. 

• Heightened AI-Driven Threats: Zscaler ThreatLabz observed an 18.5% rise in blocked AI traffic, indicating a rise in malicious actors leveraging AI. 

• Security Best Practices: The report outlines essential security practices for securing AI deployments. These include data loss prevention (DLP) controls and granular access controls to safeguard sensitive data and prevent unauthorized access. 

Blue Team Starter Kit - Twitter for intelligence

Twitter is a wonderful tool for getting live streaming information from around the world. This isn’t exclusive to information security. Sporting, political, entertainment, and other types of news first break on Twitter. It's also a valuable research tool and forum to discuss security topics. This can work to the advantage of a security team that embraces the social media platform.

I first discovered the value of Twitter when the Heartbleed news broke. Initially, we thought Heartbleed wouldn’t affect us. But after finding a free scan tool via Twitter we discovered that we were dead wrong. Unsure of how this was possible we started investigating. Twitter having served its discovery purpose now shifted into a research tool.

At the time everyone was discussing the vulnerability. There were plenty of links each uniquely analyzing and explaining the vulnerability. XKCD even had a great comic on it. After gaining a basic understanding of the vulnerability we needed to confirm our findings. After some more research, we found a tool for that purpose. Twitter wasn't the only tool we used (Google previously discussed was also used), but it did compliment our efforts for understanding, testing, and ultimately mitigating the vulnerability.

There are several ways a security team can setup Twitter. We ended up creating a brand new account. This allowed us to share the Twitter feed among ourselves and various devices. We then followed as many security professionals and companies as we could find. Hashtags like #infosec are a good place to start when searching for accounts to follow. Other hashtags that can be scouted for infosec accounts to follow include:

• #appsec (application security)

• #dtsr (podcast discussion hash tag)

• #pentesting (red teaming)

• #dfir (digital forensics, incident response)

• and many more.  

Twitter also provides the list feature for carving out accounts that focus on an individual discipline. Simply, create a new list and start adding people to it. The great thing about lists is that you don't have to be following the account to add it to a list. This is useful for organization and to keep work from invading your personal Twitter feed constantly (if you have one). Lists are able to be subscribed to, if there's a desire not to start a new account.

Tweetdeck and Hootsuite are two options for managing multiple Twitter feeds. They allow for multiple feeds to be displayed in the browser. I typically have my person feed, personal interactions, the security team feed, and then either a hashtag or list.

If you haven’t incorporated Twitter into your day-to-day monitoring, do it. It’s a powerful tool that leverages live information on news, discussions, and tools. It’s free (which makes it affordable) and it’s simple to use. Keeping a thumb on the pulse of information security is essential for any security team.

This post first appeared on Exploring Information Security.