Cyber Hub

Over the past week, researchers observed DEV-0569 delivering Royal ransomware and other payloads.

This week, security researchers disclosed an ongoing phishing campaign that infects a large scale of victims by distributing the new version of the IceXLoader malware.

This past week, researchers uncovered evidence that links the Black Basta ransomware gang to the financially motivated hacking group FIN7 (Carbanak).

This week, researchers uncovered a novel cryptojacking campaign targeting vulnerable Docker and Kubernetes infrastructure. The campaign, named ‘Kiss-a-dog’, dates back to at least September. It utilizes multiple command and control (C&C) servers to launch mining attacks, using the Diamorphine and libprocesshide rootkits to hide activities as well as to backdoor compromised containers, move laterally in the network, and gain persistence. While no clear attribution was made, the researchers note that the campaign relies on tools and techniques previously associated with groups like TeamTNT.[1] The Kiss-a-dog campaign uses a host mount to escape from the container – a known technique attributed to a lack of innovation by attackers. However, this technique speaks to the vast and easy Docker attack surface exposed and available on the internet. After a container escape with root privileges, the Kiss-a-dog campaign reuses publicly available code from GitHub to remove cloud monitoring services. In addition to cryptojacking, the campaign also attempts to reach as many vulnerable instances of Redis and Docker as possible. The attackers download and compile network-scanning tools like pnscan, masscan, and zgrab on the compromised container, which randomly scan IP ranges to look for vulnerable instances of Docker and Redis servers. The Kiss-a-dog campaign installs a Redis server in the background and listens on port 6379 for incoming connections. This is mostly used to backdoor the container. [1] https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/

In a recent report, researchers reported an incident where a Qakbot-related attack has led to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware.

This past week, researchers reported an incident where two servers infected with LockBit 3.0 were initially infected by exploiting flaws in Microsoft Exchange Server.

This past week, researchers discovered a sophisticated EDR Bypass technique that is utilized by recent samples of the BlackByte ransomware.

This past week, researchers analyzed an info stealer – CredoMap - that was leveraged by APT28 during the Russia-Ukraine conflict. Furthermore, researchers identified a new threat actor named ZINC that leverages open-source software to infect victims. Researchers have also shared a report exploring an ongoing Agent Tesla malware campaign. The new campaign leverages the Quantum Builder to generate malicious payloads, and presents sophisticated Tactics, Techniques, and Procedures (TTPs) to bypass User Account Control (UAC) in a multi-stage infection chain. Additionally, researchers discovered a new malware targeting Windows and Linux devices for Distributed Denial of Service (DDoS) attacks. Researchers have also detected a new campaign that delivers Cobalt Strike beacons. Lastly, security researchers linked the Lazarus Group to a recent spear phishing campaign that was observed in Belgium and the Netherlands, sending fake job offers to employees.

This week, researchers warned of a widespread malware campaign spreading the Vidar info stealer and the ChromeLoader malware.

As part of its monthly security advisory, Microsoft has disclosed and patched nearly 70 vulnerabilities, including one that was exploited in the wild. The exploited vulnerability, identified as CVE-2022-37969, impacts the Windows Common Log File System Driver.[1] Exploitation requires access to the system, as well as the ability to run code on it. Successful exploitation allows the attacker to gain new privileges. According to the researchers, these kinds of vulnerabilities are often exploited as part of some form of social engineering attack. [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969