January 08, 2024 – Cyber Briefing

👉 What’s happening in cybersecurity today?

AsyncRAT, North Korea, macOS, SpectralBlur Backdoor, SeaTurtle Cyber Espionage, Dutch Telecom, KyberSlash, Quantum-Safe Encryption, Apache RocketMQ, Remote Execution Threat, Lebanon, Beirut Airport, loanDepot, Blockchain, Swiss Air Force, Nest Wallet, Crypto Scam, FBI, Anti-Crime, U.S. Department of Energy, Energy Resilience Research, xDedic Dark Web Marketplace, Albania, No-Justice Wiper.

🚨 Cyber Alerts

1. Sophisticated AsyncRAT Campaign Targets US

A pervasive AsyncRAT malware campaign has been active for over 11 months, employing hundreds of unique loader samples and 100+ domains. Cybercriminals utilize AsyncRAT, an open-source remote access tool, for various malicious activities such as remote command execution and data theft. The attacks, meticulously targeting specific individuals and companies managing critical infrastructure in the U.S., involve decoy payloads, anti-sandboxing measures, and a domain generation algorithm, making detection challenging for security researchers.

2. North Korea’s macOS Threat Surge

Cybersecurity researchers have unearthed a new macOS backdoor named SpectralBlur, linked to a known malware family associated with North Korean threat actors. SpectralBlur, a moderately capable backdoor, exhibits similarities with KANDYKORN, a sophisticated implant functioning as a remote access trojan. The findings underscore a growing trend of North Korean threat actors focusing on macOS, particularly targeting high-value sectors like cryptocurrency and blockchain, as evidenced by the increased discovery of new macOS-targeting malware families in recent months.

3. Sea Turtle Cyber Espionage in the Netherlands

A new cyber espionage campaign orchestrated by the Turkiye-nexus threat actor Sea Turtle has targeted telecommunication, media, internet service providers, IT-service providers, and Kurdish websites in the Netherlands. Dutch security firm Hunt and Hackett revealed that the attack group exploited supply chain vulnerabilities to collect politically motivated information, particularly focusing on personal details of minority groups and potential political dissidents. Sea Turtle, also known as Cosmic Wolf and UNC1326, has a history of state-sponsored attacks since January 2017, employing DNS hijacking and, more recently, utilizing a Linux/Unix reverse TCP shell called SnappyTCP for attacks carried out between 2021 and 2023. The group’s stealthy approach continues, employing defense evasion techniques to harvest email archives and potentially exploit the stolen information for surveillance or intelligence gathering on specific individuals or groups.

4. KyberSlash Threatens Quantum-Safe Encryption

The Kyber key encapsulation mechanism, a quantum-safe encryption protocol, faces vulnerabilities collectively known as KyberSlash, potentially enabling the recovery of secret keys. Popular projects like Mullvad VPN and Signal messenger utilize Kyber implementations, making them susceptible to timing-based attacks that compromise encryption by analyzing execution times during certain operations. Although patches have been released for some affected projects, the impact of KyberSlash varies across implementations, emphasizing the importance of upgrading to secure versions and implementing additional security measures.

5. Apache RocketMQ Vulnerabilities Alert

Security researchers have identified daily scans targeting Apache RocketMQ services, attempting to exploit critical remote command execution vulnerabilities (CVE-2023-33246 and CVE-2023-37582). Despite an initial patch by Apache in May 2023, the vulnerabilities persist, particularly affecting the NameServer component in RocketMQ versions 5.1 and older. Attackers can exploit exposed NameServer addresses to execute commands, posing a severe risk, and upgrading to RocketMQ 5.1.2/4.9.7 or above is advised to prevent potential attacks leveraging these vulnerabilities.

💥 Cyber Incidents

6. Beirut Airport Cyber Breach Raises Tensions

A cyber attack targeted Beirut’s Rafic Hariri International Airport, compromising the Flight Information Display System (FIDS). The airport, a vital hub for both domestic and international air travel in Lebanon, fell victim to threat actors who displayed a message on screens, alleging that Hezbollah and Iran were pushing the country into war against the will of the Lebanese people, warning of potential airport bombings due to arms smuggling. The cyber attack, disrupting the Baggage Handling System (BHS), has heightened tensions amid the ongoing conflict between Israel and Lebanon, with no specific hacker group claiming responsibility at this time.

7. loanDepot Cyberattack Disruption

U.S. mortgage lender loanDepot has fallen victim to a cyberattack, prompting the company to temporarily take IT systems offline, affecting online loan payments. As one of the largest nonbank retail mortgage lenders in the USA, loanDepot services over $140 billion in loans and employs around 6,000 people. While the nature of the cyberattack remains undisclosed, customers have faced disruptions in accessing the payment portal, raising concerns about potential data exposure, especially given loanDepot’s history of a disclosed data breach in May 2022.

8. Swiss Air Force Cyber Breach

The Swiss Air Force falls victim to a cyber attack as a US security company, “Ultra Intelligence and Communications,” faces a breach. Suspected to originate from Russia, hackers allegedly stole tens of thousands of sensitive documents, including a $5 million contract between the Swiss Federal Department of Defence and the US company. While the extent of the damage remains unclear, cybersecurity experts emphasize the potential danger posed by the leaked information, stating that even non-technical data can be exploited on a large scale if vulnerabilities become known.

9. CertiK X Hijack Spurs Cryptocurrency Scams

Blockchain security firm CertiK’s X account, with over 343,000 followers, was hijacked in a social engineering attack, leading followers to a malicious website promoting a cryptocurrency wallet drainer. The compromised account, associated with a media figure, was used to send phishing messages about an alleged Forbes interview, ultimately stealing employee credentials. The attackers then posted a phishing message on CertiK’s account, warning of a vulnerability in Uniswap Router and directing users to a fake site, highlighting the increasing trend of verified accounts being hijacked for cryptocurrency scams and phishing schemes.

10. Crypto Wallet Co-founder Loses $125k to Scam

Bill Lou, co-founder of Nest Wallet, a cryptocurrency startup, expressed his devastation after falling victim to a crypto scam, losing $125,000. The CEO, who believed he was participating in a legitimate cryptocurrency airdrop, later discovered that the website he visited was set up to phish unsuspecting users. Lou, known for improving wallet security, shared his mistake on social media, emphasizing the importance of vigilance in the crypto space and warning others about potential phishing scams.

📢 Cyber News

11. FBI Expands Global Cybercrime Combat

The FBI is enhancing its global cyber presence by deploying additional agents to U.S. embassies, a key strategy in its proactive approach to combating international cybercrime. The agency is adding six new cyber assistant legal attachés (ALATs), nearly a 40% increase, with postings in New Delhi, Rome, and Brasilia. As cybercriminal operations become more dispersed across the globe, this expansion aims to improve coordination and evidence collection for investigations involving victims and perpetrators in diverse locations, reflecting a broader shift toward a more proactive approach against cybercrime infrastructure.

12. DOE Funds Energy Resilience Innovations

The U.S. Department of Energy (DOE) is allocating up to $70 million to support research into technologies enhancing the resilience of energy delivery infrastructure against various hazards, including cyber threats and climate-change-driven extreme weather. The funding opportunity, open to public and private sector stakeholders, universities, and DOE’s National Laboratories, aims to advance innovations securing America’s energy systems, such as power grids, utilities, pipelines, and renewable energy sources. The program, managed by DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), encompasses diverse areas like cyber research, climate mitigation, wildfire mitigation, and physical security.

13. xDedic Dark Web Dismantled, 19 Charged

The U.S. Department of Justice concluded its investigation into the notorious xDedic dark web marketplace, successfully dismantling the multinational criminal organizations behind it. The marketplace, infamous for illegally selling login credentials and personal information, saw charges against 19 individuals, ranging from administrators to buyers. The international scope of the January 2019 takedown reflects the distributed infrastructure of xDedic, which contributed to more than $68 million in global fraud, with suspects facing extradition and sentencing as a result of broad international cooperation.

14. Iran Cyber Attacks on Albanian Entities

A recent surge in cyber attacks against Albanian entities has exposed the deployment of a destructive wiper named No-Justice. Cybersecurity firm ClearSky reveals that this Windows-based malware incapacitates the operating system to an unrecoverable state. The attacks, attributed to an Iranian psychological operation group called Homeland Justice, resumed on December 24, 2023, with the group declaring its mission to “destroy supporters of terrorists” and launching the campaign #DestroyDurresMilitaryCamp, targeting key organizations like ONE Albania, Eagle Mobile Albania, Air Albania, and the Albanian parliament.

15. North Korea’s $600M Crypto Heists

Threat actors associated with North Korea, officially the Democratic People’s Republic of Korea (DPRK), have successfully plundered over $600 million in cryptocurrency during 2023, marking a significant reduction from the $850 million haul in the previous year. Blockchain analytics firm TRM Labs revealed that DPRK-linked hacks were ten times more damaging on average than those unrelated to North Korea, highlighting the nation’s prowess in financially motivated cyber attacks. The targeted cryptocurrency companies have been a lucrative revenue source for the sanctions-hit nation, funding weapons of mass destruction and ballistic missile programs, with indications suggesting the total stolen could reach $700 million by the end of 2023.