Major online marketplace used to launder scam proceeds. APT41 deploys new malware.

Summary

By the CyberWire staff

At a glance.

Major online marketplace used to launder scam proceeds.
APT41 deploys new malware.
GitLab patches critical flaw.

Major online marketplace used to launder scam proceeds.

Researchers at Elliptic say the multibillion-dollar online marketplace Huione Guarantee is being widely used by scammers for money laundering. Huione Guarantee is a Chinese-language marketplace owned by the Cambodian conglomerate Huione Group. Huinone Guarantee presents itself as a neutral platform for selling legitimate products, but Elliptic says "the majority of the goods and services on offer today appear to be targeted squarely at cyber scam operators."

The researchers explain, "The largest category of merchants operating on Huione Guarantee are those offering to move and exchange money. Many of the merchants explicitly offer money laundering services, including accepting payments from victims around the world, transferring it across borders, and converting it to other assets including cash, stablecoins, and to Chinese payment apps. Most specify the types of fraud proceeds that they are willing to launder, based on the perceived risk of having the funds frozen by financial institutions or law enforcement."

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

APT41 deploys new malware.

Zscaler has published a report on "DodgeBox," a newly discovered malware loader associated with the China-aligned threat actor APT41. DodgeBox is used to install a new backdoor dubbed "MoonWalk" that uses Google Drive for command-and-control communications.

The researchers state, "DodgeBox, a reflective DLL loader written in C, showcases similarities to StealthVector in terms of concept but incorporates significant improvements in its implementation. It offers various capabilities, including decrypting and loading embedded DLLs, conducting environment checks and bindings, and executing cleanup procedures. What sets DodgeBox apart from other malware is its unique algorithms and techniques."

VirusTotal telemetry suggests the malware has been used to target entities in Thailand and Taiwan, which aligns with APT41's previous targeting.

Attention all security professionals! Want real-time IP intelligence at your fingertips?

Sign up for Scout Insight's free trial today! Get immediate insights into threats, search any IP with no training required, and enjoy intuitive graphical results. Whether you need to identify compromised hosts or enrich Splunk queries, Scout Insight has you covered. Don’t wait – accelerate your threat response now. Visit team-cymru.com/cyberwire to start your free trial!

GitLab patches critical flaw.

GitLab has patched a critical vulnerability (CVE-2024-6385) affecting its GitLab Community and Enterprise editions that could allow "an attacker to trigger a pipeline as another user under certain circumstances." The vulnerability was assigned a CVSS severity score of 9.6 out of 10. GitLab stated, "[W]e strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running the patched version."

Notes.

Today's issue includes events affecting China, Taiwan, Thailand, and the United States.

Attacks, Threats, and Vulnerabilities

OilAlpha Malicious Applications Target Humanitarian Aid Groups Operating in Yemen | Recorded Future (Recorded Future) Discover how OilAlpha's malicious applications are targeting humanitarian aid groups in Yemen. Learn about their tactics and how to mitigate risks.

Ransomware Groups Prioritize Defense Evasion for Data Exfiltration (Infosecurity Magazine) A Cisco report highlighted TTPs used by the most prominent ransomware groups to evade detection, establish persistence and exfiltrate sensitive data

Marketplace

OpenAI board shake-up: Microsoft out, Apple backs away amid AI partnership scrutiny (Ars Technica) Microsoft gives up non-voting observer board role; Apple rethinks a planned similar position.

Legislation, Policy, and Regulation

GOP platform says protecting critical infrastructure from hackers is a ‘national priority’ (The Record) The Republican National Committee on Monday published a policy roadmap committing the GOP to “use all tools of National Power” to safeguard U.S. critical infrastructure and the country’s industrial base “from malicious cyber actors.”

Litigation, Investigation, and Law Enforcement

Man sentenced to 7 years for Westfield High School threat hoax (Current Publishing) A New Mexico man who pleaded guilty to making a hoax call about a threat at Westfield High School in 2021 has been sentenced to seven years in federal prison.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SecureWorld Artificial Intelligence Virtual Conference (Virtual, Jul 24, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Jul 29 - 30, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SecureWorld Detroit (Novi, Michigan, USA, Sep 18, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld St. Louis (Clayton, Missouri, USA, Sep 26, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Dallas (Plano, Texas, USA, Oct 3, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Denver (Denver, Colorado, USA, Oct 10, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld New York City (New York, New York, USA, Oct 15, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Government & Education Virtual Conference (Virtual, Oct 16, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Midwest Virtual Conference (Virtual, Nov 13, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Events

SANSFIRE Washington, DC 2024 (Washington (or virtual), DC, USA, Jul 15 - 20, 2024) At SANSFIRE Washington, DC 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 07.11.24