Cyber Hub

Over the past week, researchers reported that a new China-based APT was observed to be targeting Microsoft Exchange servers using previously unknown malware. Moreover, a new phishing campaign spreading the IcedID banking trojan was detected, while the malware was observed utilizing new Tactics, Techniques, and Procedures (TTPs). Lastly, a new malware tool named Quantum LNK Builder was spotted. It uses a recently trending technique that allows the distribution of payloads by creating Windows shortcuts.

During the past week, security researchers detected a new malspam campaign that drops the Matanbuchus malware. Also, security researchers reported a new remote access trojan used by the GALLIUM Advanced Persistent Threat (APT) group, named PingPull. Additionally, security researchers disclosed a new stealthy Linux rootkit in the wild named Syslogk – which uses “magic packets” that trigger a backdoor within an infected device.

This week, security researchers published an in-depth analysis of the Tactics, Techniques, and Procedures (TTPs) of the Black Basta ransomware, including how it now uses Qbot to move laterally across compromised networks. Additionally, Black Basta strains encrypting VMware ESXi virtual machines (VMs) running on enterprise Linux servers were discovered.

Over the weekend, proof-of-concept exploits for the actively exploited Atlassian Confluence zero-day RCE - CVE-2022-26134 - vulnerability were released to the public.

This week, security researchers disclosed a new Linux-based ransomware, targeting compromised VMware ESXi servers.

During the past week, security researchers shared a thorough investigation into the XorDDoS malware. Additionally, researchers detected a campaign that has been targeting vulnerable MS SQL servers. Finally, security researchers shared a research report covering recent developments of the UpdateAgent malware dropper.

This past week, several different malware campaigns were observed. The campaigns included malware such as Emotet, Agent Tesla, and others. The targeted operating systems throughout all of the malware campaigns mentioned include Windows, Linux, and macOS. Furthermore, the initial access for each campaign is different, but it seems that plenty of these malwares are spreading in phishing campaigns.

During the past week, security researchers shared a research report covering an emerging APT group named UNC3524. This highly sophisticated threat actor - suspected to be of Russian origins - was able to remain under the radar for 18 months without being detected. Additionally, researchers encountered a sophisticated malware framework named NetDooka, and have taken a closer look into the notorious Winnti Group’s operations, campaigns, and arsenal. Finally, last week, cyber security researchers also spotted a new Windows malware named Raspberry Robin, with worm-like capabilities that propagate through removable USB devices.

During the past week, security researchers shared a research report specifying new delivery techniques tested in a recent Emotet malware campaign. In addition, researchers disclosed a new malware loader called Bumblebee - used by multiple crimeware threat actors previously observed delivering BazaLoader and IcedID. Researchers also observed a RIG Exploit Kit campaign using exploits found in Internet Explorer, to deliver the RedLine Stealer. Finally, security researchers did a deep dive into the SaintStealer malware, a C# .NET-based information stealer developed by the Saint gang. The malware is not packed and has multiple functionalities to steal credentials and system information.

During the past week, security researchers shared an in-depth report on an ongoing LemonDuck botnet campaign that targets Docker to mine crypto currency on Linux machines. In addition, researchers disclosed a new information stealer abusing fake Windows 11 installers to lure victims.