November 19 2024 – Cyber Briefing

👉 What’s the latest in the cyber world today?

BabbleLoader, Malware, WhiteSnake, Meduza, Stealer, Helldown, Ransomware, VMware, Linux, Virtualized Systems, Earth Kasha, LODEINFO Campaign, IoT Devices, Water Barghest, Fake, Bitwarden Ads, Malicious, Chrome Extension, iLearningEngines, Cyberattack, Maxar Space Systems, Breach, Undersea Data Cables, Finland, Germany, Ford Motors, Hack, Muroran Institute of Technology, Leak, CISA, Cybersecurity Training, Incident Recovery, Average, 7 Months, India, Hospitals, Security, Phobos Ransomware, Extradited, Spectro Cloud, $75 Million, Kubernetes Management

Listen to the full podcast

🚨 Cyber Alerts

1. BabbleLoader Malware Delivers Info Stealers

Cybersecurity researchers have uncovered BabbleLoader, a stealthy malware loader designed to deliver advanced information-stealing malware such as WhiteSnake and Meduza. Known for its sophisticated evasion techniques, BabbleLoader uses junk code, metamorphic transformations, and runtime-only function resolution to bypass antivirus, sandbox, and AI-based detection systems. The loader targets users seeking cracked software and business professionals by masquerading as legitimate tools, such as accounting software.

2. Helldown Ransomware Targets VMware and Linux

Cybersecurity researchers have uncovered a Linux variant of the Helldown ransomware, signaling its expansion to VMware and virtualized systems. Derived from LockBit 3.0, Helldown has been targeting sectors like IT, healthcare, and manufacturing, employing double extortion tactics to pressure victims. It exploits vulnerabilities in Zyxel firewalls for initial access, followed by credential harvesting and lateral movement before encrypting files. The Linux variant is less obfuscated than its Windows counterpart but includes features to terminate virtual machines for broader file access.

3. Earth Kasha Launches New LODEINFO Campaign

Earth Kasha, a cyber threat group known for using the LODEINFO malware, has recently launched a new campaign targeting organizations primarily in Japan, Taiwan, and India. Since 2019, LODEINFO has been Earth Kasha’s primary backdoor, but in this latest wave, the group has diversified its tools, also using Cobalt Strike and the newly discovered NOOPDOOR. This shift in strategy comes with updated tactics, including exploiting vulnerabilities in public-facing applications like SSL-VPN and file storage services to gain initial access. Once inside, the group deploys backdoors, conducts credential dumping, and exfiltrates valuable data from compromised networks.

4. IoT Devices Exploited by Water Barghest

Water Barghest, a cybercriminal group, has been exploiting vulnerabilities in Internet of Things (IoT) devices to create a lucrative proxy botnet. As of October 2024, the group had compromised over 20,000 IoT devices, leveraging automated scripts to find and exploit vulnerable devices listed on public internet scan databases like Shodan. Once compromised, these devices are infected with the Ngioweb malware, which runs in memory and registers the devices as proxies to be sold on residential proxy marketplaces.

5. Fake Bitwarden Ads Push Malicious Extensions

A recent malvertising campaign has been targeting Bitwarden users through fake ads on Facebook, leading to the distribution of a malicious Google Chrome extension. Disguised as an update for the popular password manager, the ads claim users need to update their Bitwarden app to secure their passwords. The link directs users to a fraudulent website resembling the official Chrome Web Store, prompting them to manually install a ZIP file containing the harmful extension.

💥 Cyber Incidents

6. iLearningEngines Hack Leads to $250K Loss

iLearningEngines, an AI-driven company specializing in automation tools for industries like healthcare, education, and retail, recently disclosed a cybersecurity breach resulting in the misdirection of a $250,000 wire payment. The company revealed that a cybercriminal had accessed its network, deleting several email messages and redirecting the funds to an unauthorized account. Although iLearningEngines quickly contained the breach and initiated an internal investigation, the stolen funds remain unrecovered.

7. Maxar Space Systems Hit by Data Breach

Maxar Space Systems, a key player in space technology and geospatial intelligence, recently reported a data breach that exposed sensitive employee information. The breach, which occurred between October 4–11, 2024, was traced back to an unauthorized access attempt from a Hong Kong-based IP address. Personal data compromised in the incident included home addresses, social security numbers, business contact details, and employment-related information such as job titles and employment dates.

8. Severed Undersea Cables Cause Concerns

Undersea data cables linking Finland to Germany and Lithuania to Sweden were severed this week, sparking suspicions of intentional sabotage. The cable between Finland and Germany, a crucial 1,200-kilometer connection, was cut on Monday, while the 218 km link between Lithuania and Sweden was damaged a day earlier. Finnish authorities, alongside their German counterparts, have launched investigations, expressing concern over potential malicious interference with critical infrastructure. These incidents follow a pattern of growing concerns about targeted attacks on undersea cables, particularly in the Baltic Sea, an area of high geopolitical sensitivity.

9. Ford Motors Investigates Alleged Data Breach

Ford Motor Company is investigating a potential data breach after hackers, allegedly associated with the group IntelBroker, claimed to have stolen an internal database containing sensitive customer information. The leaked data, reportedly affecting around 44,000 customers, includes personal details such as names, physical addresses, country codes, and product purchase information. The breach is concerning, as the exposed data could be used for malicious purposes, including identity theft and phishing scams.

10. Muroran Institute of Technology Breached

On October 27, 2024, Muroran Institute of Technology in Japan reported a data breach involving unauthorized access to a laboratory server. The breach, which occurred after a faculty member’s account was compromised, potentially exposed the personal information of 159 individuals. Affected data included names, addresses, and phone numbers of current and former students affiliated with the lab. While the exact extent of the breach is still under investigation, the university is taking immediate steps to assess the incident and safeguard against future unauthorized access.

📢 Cyber News

11. CISA Launches Next-Gen Learning Platform

The Cybersecurity and Infrastructure Security Agency (CISA) has launched CISA Learning, a next-generation learning management system designed to modernize cybersecurity training for government personnel, veterans, and key stakeholders. This new platform, which replaces the Federal Virtual Training Environment (FedVTE), offers enhanced functionalities, including classroom-based courses, virtual instructor-led training, and self-paced online modules. CISA Learning centralizes training resources, streamlining course enrollment and tracking, while providing more accessible training to federal, state, and local government employees, U.S. military personnel, veterans, and the public — free of charge.

12. Recovery From Cyber Incidents Takes 7 Months

A recent report from Fastly reveals that organizations are underestimating the time it takes to recover from major cybersecurity incidents. While IT decision makers predict an average recovery time of 5.85 months, the reality is far longer, with companies taking an average of 7.34 months to fully recover. For organizations planning to reduce cybersecurity investment, recovery times are even longer, averaging 10.88 months. Recovery activities include implementing stronger security measures, offering employee training, restoring data from backups, and conducting forensic analysis.

13. 89% of Indian Hospitals Boost Cybersecurity

A recent report by Deloitte India and the Data Security Council of India (DSCI) reveals that while nearly 89% of hospitals in India have adopted Third-Party Risk Management (TPRM) systems to safeguard patient data, significant cybersecurity gaps still persist. Despite this progress, only 10% of hospitals have fully implemented comprehensive data privacy programs, and only 60% conduct regular crisis simulation exercises, leaving many underprepared for potential cyberattacks.

14. Phobos Ransomware Administrator Extradited

Evgenii Ptitsyn, a 42-year-old Russian national, was extradited from South Korea to the United States to face charges related to his role in operating the Phobos ransomware operation. The Justice Department unsealed criminal charges against Ptitsyn, accusing him of facilitating the sale, distribution, and operation of Phobos ransomware, which targeted over 1,000 public and private entities worldwide, extorting more than $16 million in ransom payments. Ptitsyn is alleged to have coordinated with affiliates who deployed the ransomware, encrypted victim data, and demanded payment for decryption keys.

15. Spectro Cloud Raises $75M for Kubernetes

Spectro Cloud, a company focused on simplifying Kubernetes management, has raised $75 million in a Series C funding round led by Goldman Sachs, bringing its total funding to $160 million and valuing the company at $750 million. Kubernetes, an open-source system for managing containerized applications, has become essential for enterprises, but its complexity remains a challenge. Spectro Cloud aims to address this issue by offering solutions that work across multi-cloud, on-premise, and edge environments. Its platform supports various Kubernetes distributions, allowing enterprises to efficiently manage their deployments at scale.