September 24 2024 – Cyber Briefing

👉 What’s the latest in the cyber world today?

Octo2, Android, Trojan, Europe, Device Takeover, Mallox, Ransomware, Linux, Kryptina, Apache, AXIS Server, Malicious, Web Shells, Code Execution, GNU/Linux, Scam, TikTok, Vietnam, Fake, App Updates, OpenAI, X, Hacked, Cryptocurrency, MoneyGram, Cybersecurity, Issue, Arkansas City Water Treatment, Bankroll Status, Attack, DualPools Group, Delaware Libraries, Ransomware, $1 Million, Biden Administration, Ban, China, Russia, Tech, US, Vehicles, UK, Enhancement, Collaboration, AI, Cybersecurity, EU, Global, Spyware, Proliferation, Telegram, User Data, Lehigh Valley Health Network, Settlement, Patient, Photo Leak

Listen to the full podcast

🚨 Cyber Alerts

1. New Octo2 Trojan Enables Device Takeovers

Cybersecurity researchers have uncovered Octo2, an advanced Android banking trojan with enhanced device takeover (DTO) capabilities, targeting users across Europe, including Italy, Poland, Moldova, and Hungary. Derived from the leaked source code of its predecessor, Octo, this variant includes robust features like a Domain Generation Algorithm (DGA) for evading detection and APK binding via Zombinder to distribute malware through legitimate apps.

2. New Mallox Ransomware Variant Targets Linux

A new Linux variant of the Mallox ransomware, dubbed Mallox Linux 1.0, has emerged, based on the leaked source code of the Kryptina ransomware. Originally a Windows-only malware, Mallox has now expanded its focus to target Linux and VMware ESXi systems. According to SentinelLabs, this rebranded variant retains Kryptina’s core AES-256-CBC encryption mechanism and decryption routines, with only minor modifications. The shift follows the leak of Kryptina’s source code earlier this year, allowing Mallox affiliates to adapt it for Linux-targeting attacks, marking a significant evolution in the ransomware’s tactics.

3. Hackers Deploy Web Shells Using Apache AXIS

Hackers have been actively exploiting vulnerabilities in the Apache AXIS server to deploy malicious web shells, according to a report from Binary Defense. Linked to a China-based threat actor, the attacks began in August 2024, targeting unmanaged AIX servers accessed through weak administrative passwords. After breaching the systems, attackers uploaded an AxisInvoker web shell and established persistent communication via a Fast Reverse Proxy (FRP). They conducted extensive reconnaissance using LDAP and SMB shares, later attempting to move laterally into a Windows environment with Cobalt Strike beacons and JavaScript web shells.

4. Critical RCE Flaw Found in All Linux Systems

A critical unauthenticated Remote Code Execution (RCE) vulnerability has been identified, affecting all GNU/Linux systems and posing a significant threat to their security. The flaw, which has been present for over a decade, has been confirmed as severe by leading Linux distributors, including Canonical and Red Hat, receiving a rating of 9.9 out of 10. Despite the acknowledgment of the vulnerability’s potential for catastrophic damage, no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned, and no effective fixes are currently available.

5. New TikTok Scam Targets Users with Malware

Vietnam’s National Cybersecurity Monitoring Center (NCSC) has issued a warning about a new online scam targeting TikTok users, where cybercriminals trick individuals into downloading fake app updates that contain malware. The scam involves fraudulent TikTok accounts that message users, claiming they have been selected for a beta test of a new app version, promising enhanced features and an improved interface. Unsuspecting users are then directed to provide personal information and download a malicious version of TikTok.

💥 Cyber Incidents

6. OpenAI Account Hacked in Latest Crypto Scam

An official OpenAI account on X, @OpenAINewsroom, was hacked on Monday evening and used to promote a fraudulent cryptocurrency called $OPENAI. The compromised account, which has nearly 54,000 followers, posted a now-deleted announcement claiming the launch of the cryptocurrency, asserting it would connect AI and blockchain technology while inviting users to connect their wallets to claim a share of its initial supply. This incident, the fourth hacking of an OpenAI-related account in 15 months, raises significant concerns about cybersecurity within the organization and highlights the ongoing risk of cryptocurrency scams.

7. MoneyGram Taken Offline Due to Cyberattack

MoneyGram International has temporarily taken its financial transfer system offline as it investigates a cybersecurity issue impacting its operations. The Dallas-based company is collaborating with cybersecurity experts and law enforcement to resolve the problem and restore normal business services. Reports indicate widespread outages, particularly affecting customers in the Caribbean, as hundreds of issues have been logged on platforms like Downdetector.

8. Arkansas City Water Plant Hit by Cyberattack

The City of Arkansas City has assured residents that its drinking water remains safe following a cyberattack on the water treatment facility early Sunday morning. An employee discovered a malfunctioning computer displaying a message instructing them to contact a specific email address, indicating a possible cyber threat. While city officials are still assessing the financial impact of the attack, they are relieved to have insurance coverage for cyber incidents.

9. Bankroll Status Loses $230,000 to Hackers

Bankroll Status, a decentralized finance (DeFi) platform operating on the BNB Chain, has reported a significant loss of $230,000 due to a cyberattack attributed to the notorious DualPools hacker group. Cybersecurity firm Cyvers detected the breach, flagging suspicious transactions as part of a larger malicious operation. The attack is believed to involve a smart contract deployed approximately 90 days prior, which served as a gateway for the theft.

10. Ransomware Attack Hits Delaware Libraries

Delaware libraries are facing a significant challenge following a ransomware attack that occurred on Friday, which led to the hackers seizing control of the virtual servers managing public-use computers. According to Annie Norman, Director of the Delaware Division of Libraries, the attackers are demanding a ransom of approximately $1 million to relinquish control of the systems. In response to the situation, Norman has instructed that no ransom be paid and plans to rebuild the servers instead. While the libraries remain open and offer WiFi, access to public computers has been disrupted, impacting users who rely on these facilities for internet access.

📢 Cyber News

11. Biden Aims to Ban Chinese and Russian Tech

The Biden administration is taking significant steps to enhance national security by proposing a ban on connected and autonomous vehicles equipped with Chinese and Russian software and hardware. Announced by the Commerce Department, the measure aims to protect U.S. drivers and address growing concerns about the potential for foreign adversaries to exploit vulnerabilities in vehicle technology. While the ban on software is set to take effect for the 2027 model year, hardware restrictions are scheduled for 2030, reflecting the complexities of modifying existing automotive supply chains.

12. UK, US and Canada Announce New Collaboration

The UK government has announced a groundbreaking collaboration with the US and Canadian governments to develop advanced technologies in artificial intelligence (AI) and cybersecurity. Spearheaded by the UK Ministry of Defence’s Defence and Science Technology Laboratory, along with the US Defense Advanced Research Projects Agency (DARPA) and Defence Research and Development Canada (DRDC), this partnership aims to enhance national security and defense capabilities.

13. EU Nations Join US Coalition Against Spyware

Four more European Union nations — Austria, Estonia, Lithuania, and the Netherlands — have joined a U.S.-led initiative aimed at combating the global misuse of spyware. This coalition, which began in March, has expanded to include 21 countries as concerns grow over the European Commission’s perceived failure to regulate the spyware market effectively. The U.S. Department of State encourages signatory nations to implement measures such as sharing information about commercial spyware and restricting the export of technologies that could facilitate cyber abuses.

14. Telegram to Share User Data with Authorities

In a significant shift in policy, Telegram has announced that it will begin sharing user data, including IP addresses and phone numbers, with authorities in response to valid legal requests aimed at curbing criminal activities on its platform. CEO Pavel Durov stated that this decision reflects a commitment to addressing violations of the platform’s Terms of Service. Previously, Telegram limited such disclosures to cases involving terror suspects, but the updated policy now includes users suspected of various criminal activities.

15. LVHN Settles for $65M Over Photo Hack

Lehigh Valley Health Network in Pennsylvania has agreed to pay $65 million as part of a proposed settlement in a class-action lawsuit stemming from a ransomware attack by the BlackCat group in 2023. The breach resulted in the unauthorized access and subsequent leak of sensitive medical images, including disrobed photos of breast cancer patients, affecting approximately 134,000 individuals. The settlement outlines compensation tiers based on the severity of the breach, with affected individuals set to receive amounts ranging from $50 to up to $80,000 for the unauthorized release of intimate photos.