December 29, 2023 – Cyber Briefing

👉 What’s going on in the cyber world today?

Kimsuky, Spear-Phishing, Meduza Malware 2.2, Kubernetes Flaw, Microsoft, MSIX Protocol, MASEPIE Malware, Lulz Security, Pinterest DDoS, Levana Exploit, Thunder Terminal, Eagers Automotive, Intel, Israel, Nine Global Crypto, Palo Alto Networks.

🚨 Cyber Alerts

1. North Korea’s Cyber Espionage

North Korean state-affiliated hackers, identified as Kimsuky, deploy sophisticated spear-phishing attacks to distribute malware tools, including AppleSeed, Meterpreter, and TinyNuke, targeting compromised machines. South Korean cybersecurity firm AhnLab attributes the activity to this advanced persistent threat group, known for its decade-long cyber espionage campaigns. The evolving tactics, use of backdoors, and connections to recent LinkedIn and GitHub personas illustrate North Korea’s persistence and adaptability in cyber operations, challenging perceptions of the country’s cyber capabilities.

2. Meduza 2.2 Upgrade for Password Theft

Meduza, a notorious password-stealing software, has unveiled version 2.2, showcasing significant upgrades in capabilities and user interface features. Positioned as a robust competitor to infamous password stealers like Azorult and Redline, Meduza now supports a broad range of applications, browsers, cryptocurrency wallets, and communication tools. Its strategic release just before the New Year amplifies its potential impact on compromised systems, raising concerns among cybersecurity experts about the escalating threats and continuous evolution of malicious tools in the dark web landscape.

3. Google Cloud Mitigates Kubernetes Flaw

Google Cloud swiftly addressed a medium-severity security loophole that could potentially empower an attacker with escalated privileges within a Kubernetes cluster. Discovered by Palo Alto Networks Unit 42, this vulnerability, impacting the Fluent Bit logging container, could be exploited in conjunction with Anthos Service Mesh, providing an avenue for privilege escalation. The fix has been implemented in specified versions of Google Kubernetes Engine (GKE) and Anthos Service Mesh (ASM) to mitigate potential misuse, emphasizing the criticality of securing initial access points to prevent further compromise.

4. MSIX Handler Disabled by Microsoft

Microsoft disabled the MSIX ms-appinstaller handler due to financial threat groups exploiting CVE-2021-43890, distributing malware via Windows systems. Actors like Sangria Tempest and Storm-1674 used phishing and malicious ads, bypassing security measures. Sangria Tempest, linked to ransomware, targeted PaperCut servers. Past exploits by Emotet and BazarLoader through AppX Installer highlight similar tactics. Microsoft recommends updating App Installer and disabling the protocol to counter this malware threat after its recent re-enablement.

5. MASEPIE Targets Ukraine in Cyber Attack

Ukraine’s CERT has issued a warning on a recent cyber attack conducted by the Russian state-sponsored APT28, known as Fancy Bear, targeting Ukraine between December 15 and 25, 2023. The attack employed a sophisticated phishing campaign redirecting victims to malicious sites, utilizing JavaScript to deliver a new Python malware downloader named ‘MASEPIE.’ This malware, characterized by deceptive tactics such as modifying the Windows Registry and adding misleading LNK files, acted as a conduit for additional malware downloads and data theft. APT28 also utilized tools like ‘STEELHOOK’ PowerShell scripts to extract data from Chrome-based browsers and ‘OCEANMAP,’ a C# backdoor, for stealthy command execution via IMAP. The rapid deployment of these tools within an hour highlighted the well-coordinated and advanced nature of the cyber attack, showcasing APT28’s expertise in exploiting vulnerabilities and conducting swift, targeted assaults.

6. Security Fixes in Juniper Analytics

The Juniper Secure Analytics platform, across versions up to 7.5.0 UP7, faced various critical vulnerabilities. These issues, spanning Java-related risks to potential code execution and data breaches, are now addressed in the latest Juniper Secure Analytics 7.5.0 UP7 IF03 release and subsequent updates. Vulnerabilities include threats like unauthorized data access, potential arbitrary code execution, and security flaws in components like Jetty, Apache Tomcat, and IBM Qradar SIEM. Users are strongly urged to update their software through Juniper’s support downloads to counter these risks, as there are no known workarounds available for these critical issues.

💥 Cyber Incidents

7. Australian PM Site Allegedly Hacked

Lulz Security Indonesia claims a cyberattack on Australia’s PM website, lacking evidence. Experts question its validity. Amid Australia’s robust cybersecurity plan led by Clare O’Neil, the alleged attack raises concerns. The strategy involves awareness programs, tech safety measures, and telecom innovation. With a $385M budget commitment, Australia confronts cyber threats, yet the claimed attack signals broader challenges, urging a unified approach against evolving cyber campaigns orchestrated by groups like Lulz Security Indonesia.

8. Pinterest Hit by Anonymous Sudan DDoS

Pinterest is grappling with a disruptive Distributed Denial of Service (DDoS) attack believed to be orchestrated by Anonymous Sudan, causing significant disruptions to its website functionality. The attack, displaying cyclical and sophisticated traits, appears linked to the Skynet botnet, echoing a previous assault on ChatGPT. Anonymous Sudan, a hacktivist group with alleged ties to Sudan but potential connections to Russia, surfaced in 2023, targeting Western nations with DDoS attacks. Their motive, purportedly to draw global attention to Sudan’s situation, aligns with the recent cyberattack on Pinterest. The platform’s response involves investigating the incident, collaborating with mitigation services, and enhancing overall cybersecurity measures to safeguard against future threats.

9. Levana Protocol Suffers $1.1M Exploit

Levana, a protocol within the Osmosis blockchain, faced an exploit resulting in a significant loss of $1.1 million from its liquidity pools over a 13-day period. Exploiting congestion issues on the Osmosis chain and leveraging a bug in the fee market code, attackers manipulated prices, draining 10% of Levana’s liquidity pools. The exploit stemmed from issues in Osmosis’ fee market code and integration complexities with Pyth oracle, prompting Levana’s focus on a fix and a pause on new trades temporarily. While existing positions remained unaffected, Levana plans compensation through airdrops and fee distributions, emphasizing recovery measures post-incident.

10. Thunder Terminal Faces Wallet Breach

On-chain trading platform Thunder Terminal recently repelled an exploit that compromised user wallets, resulting in a loss of approximately $240,000. Despite the quick response, the attacker demanded a 50 ETH ransom and disputed the platform’s assurances. While Thunder Terminal reaffirmed user fund safety and pledged refunds, the incident highlights the persistent threats faced by cryptocurrency platforms and the evolving challenges in securing user data against determined attackers.

11. Car Dealer Hit by Cyberattack

Eagers Automotive, the major car dealership operator in Australia and New Zealand, faces a severe setback after a cyber attack disrupted its operations, compelling a trading halt on the stock exchange. This incident has caused system disruptions across various locations, prompting an urgent investigation supported by external experts. While the extent of the breach remains uncertain, the company, encompassing 8,500 employees and boasting a substantial revenue of AU$4.82 billion in the first half of 2023, has engaged national cybersecurity authorities to address the situation. Concerns loom over potential data breaches, raising alarms about the security of customer and employee information. Though there’s no mention of a confirmed data leak, the incident underscores the escalating cyber threats faced by prominent Australian businesses, following recent attacks on Yakult Australia and Nissan Australia, among others.

📢 Cyber News

12. Intel’s $3.2B Israeli Chip Plant

Intel has made a landmark agreement with the Israeli government, pledging $3.2 billion towards constructing a mammoth $25 billion chip fabrication facility in Kiryat Gat, Israel, set to commence operations in 2028. This substantial investment, Intel’s largest in the region, reflects its strategic focus on bolstering its global supply chain. Despite geopolitical tensions, Intel’s decision to expand in Israel echoes its decades-long presence in the country, underlining its commitment to capacity expansion and competition against industry rivals. Led by CEO Pat Gelsinger, this initiative is part of a wider expansion plan, encompassing multiple locations worldwide, including projects in Arizona, Ohio, and Germany. The move highlights Intel’s confidence in its Israeli operations and aims to fortify its manufacturing foothold amid intensifying semiconductor industry competition.

13. School Cyber Threats Surge

Amid physical safety concerns, educational institutions face growing cyber threats impacting the entire school community. Cybersecurity risks, highlighted by extensive network probing and attacks, have doubled in U.S. schools, compelling educators like Charlie Reisinger to advocate for improved data privacy. The education sector grapples with a surge in cyberattacks, with identity theft and ransomware targeting sensitive student data, urging the need for enhanced regulations and federal support to safeguard schools.

14. India Flags Major Crypto Exchanges

The Indian Financial Intelligence Unit (FIU) flagged nine global crypto exchanges, including Binance and Kraken, for operating “illegally” by not complying with local anti-money laundering regulations. Despite lacking a physical presence, these platforms serving Indian users must adhere to India’s AML/CFT framework. As India began taxing virtual currencies last year, some traders shifted to global platforms, potentially to evade taxes. Indian exchanges maintain strict verifications, contrasting the lax practices of global counterparts. The FIU’s directive impacts offshore crypto service providers, while Binance’s founder previously cited India’s unfriendly market for their expansion hesitancy.

15. Palo Alto Completes Talon Acquisition

Palo Alto Networks finalizes Talon Cyber Security acquisition, empowering comprehensive browser-based security for unmanaged devices. Valued at $625 million, Talon’s tech, integrated into SASE suite, combats malware and data leaks, streamlines onboarding, and fortifies SSO. Palo Alto plans free tech extension to eligible SASE AI users, addressing web browser security gaps, amid Microsoft’s similar market entry.