Daily Briefing for 06.21.24

At a glance.

• Biden administration bans Kaspersky products in the US.
• SneakyChef targets government entities with SugarGh0st RAT
• RansomHub ransomware expands targeting to ESXi servers.
• Ransomware gang publishes alleged London hospital data.

Biden administration bans Kaspersky products in the US.

The Biden administration will ban Kaspersky from selling its products in the US beginning July 20th, Axios reports. Current Kaspersky customers will stop receiving security updates on September 29th. The US Commerce Department's Bureau of Industry and Security said in a statement, "Today’s Final Determination and Entity Listing are the result of a lengthy and thorough investigation, which found that the company’s continued operations in the United States presented a national security risk—due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations—that could not be addressed through mitigation measures short of a total prohibition. Individuals and businesses that utilize Kaspersky software are strongly encouraged to expeditiously transition to new vendors to limit exposure of personal or other sensitive data to malign actors due to a potential lack of cybersecurity coverage."

Ransomware gang publishes alleged London hospital data.

The Qilin ransomware gang last night published 400 gigabytes of data allegedly stolen from NHS pathology provider Synnovis after the company refused to pay a $50 million ransom, the Register reports. NHS England told the BBC that it had "been made aware that the cyber criminal group published data last night which they are claiming belongs to Synnovis and was stolen as part of this attack." The NHS added, "We understand that people may be concerned by this and we are continuing to work with Synnovis, the National Cyber Security Centre and other partners to determine the content of the published files as quickly as possible. This includes whether it is data extracted from the Synnovis system, and if so whether it relates to NHS patients."

The attack against Synnovis earlier this month delayed thousands of appointments at hospitals in London. A Qilin spokesperson told the Register they were aware that the attack would cause a healthcare crisis in the city, stating, "That was our goal."

SneakyChef targets government entities with SugarGh0st RAT

Cisco Talos describes a campaign by the suspected Chinese threat actor "SneakyChef" that used the SugarGh0st RAT to target government entities in Angola, India, Kazakhstan, Latvia, Saudi Arabia, and Turkmenistan. The malware was delivered via phishing emails with well-crafted decoy documents that impersonated various government organizations. The researchers note, "The threat actor is using an SFX RAR as the initial vector in this attack. When a victim runs the executable, the SFX script executes to drop a decoy document, DLL loader, encrypted SugarGh0st, and a malicious VB script into the victim’s user profile temporary folder and executes the malicious VB script."

RansomHub ransomware expands targeting to ESXi servers.

The RansomHub ransomware-as-a-service operation is using a Linux encryptor to target VMware ESXi environments, BleepingComputer reports. Recorded Future's Insikt Group notes that this feature "significantly expands the range of potential victims." The researchers add, "RansomHub’s ESXi version employs a unique tactic by creating a file named /tmp/app.pid to prevent multiple instances from running simultaneously. Modifying this file can halt the ransomware’s operations, presenting a potential mitigation strategy for affected systems."