Kaspersky is shuttering its US operations. MuddyWater deploys new backdoor against Israeli organizations.

Summary

By the CyberWire staff

At a glance.

Kaspersky is shuttering its US operations.
MuddyWater deploys new backdoor against Israeli organizations.
Poco RAT targets mining entities.
BadPack delivers Android Trojans.

Kaspersky is shuttering its US operations.

Russian cybersecurity company Kaspersky Lab is shuttering its business in the United States, BleepingComputer reports. The US Department of Commerce announced last month that Kaspersky would be banned from selling its products in the United States beginning September 29th, due to national security concerns. The company told BleepingComputer, "Starting from July 20, 2024 Kaspersky will gradually wind down its U.S. operations and eliminate U.S.-based positions. The decision and process follows the Final Determination by the U.S. Department of Commerce, prohibiting the sales and distribution of Kaspersky products in the U.S. The company has carefully examined and evaluated the impact of the U.S. legal requirements and made this sad and difficult decision as business opportunities in the country are no longer viable."

Putting the “I” in CDR: Does your cloud security meet the /555 Benchmark?

An attack can execute in the cloud in as little as 10 minutes. Security teams must accelerate cloud investigation to combat these fast-moving threats. But how? Tune in to our on-demand webinar to hear from cloud security experts - firsthand - as they discuss the industry’s ONLY cloud security benchmark (/555) and why it’s critical to achieve this milestone for cloud detection and response. Further, learn methods to streamline investigations and reduce manual effort for your SecOps team! Watch now!

Poco RAT targets mining entities.

Cofense is tracking a new remote access Trojan called "Poco RAT" that's targeting Spanish-speaking users in Latin America. The malware was first observed in February 2024 targeting entities in the mining sector. Its targeting has since expanded to the manufacturing, hospitality, and utilities sectors, though the mining industry remains its primary focus. The malware is distributed via finance-themed phishing emails that encourage users to download malicious files.

Cofense explains, "Unless the infected computer has a geo location in Latin America, the attempts to communicate are not responded to by the C2. If the infected computer appears to be coming from Latin America, then a very small conversation takes place over an extended period of time. Aside from being able to communicate basic information about the environment, Poco RAT also appears to be able to download and execute files making it capable of delivering other malware more specialized for information stealing or even ransomware."

Attention all security professionals! Want real-time IP intelligence at your fingertips?

Sign up for Scout Insight's free trial today! Get immediate insights into threats, search any IP with no training required, and enjoy intuitive graphical results. Whether you need to identify compromised hosts or enrich Splunk queries, Scout Insight has you covered. Don’t wait – accelerate your threat response now. Visit team-cymru.com/cyberwire to start your free trial!

MuddyWater deploys new backdoor against Israeli organizations.

Check Point warns that the Iranian threat actor MuddyWater is using a new backdoor dubbed "BugSleep" to target Israeli entities. The malware is distributed via spearphishing campaigns targeting "Israeli municipalities as well as a broader group of airlines, travel agencies, and journalists." Check Point notes, "BugSleep is a backdoor designed to execute the threat actors’ commands and transfer files between the compromised machine and the C&C server. The backdoor is currently in development, with the threat actors continuously improving its functionality and addressing bugs."

Modernize Your Identity Systems with Ease.

Identity architects and engineers, Strata helps you integrate legacy apps with any IDP, ensuring seamless identity failover and applying MFA without touching app code. Reduce tech debt and enhance security with Strata's robust identity orchestration solution. Share your biggest identity challenge and receive a pair of complimentary AirPods Pro.

BadPack delivers Android Trojans.

Palo Alto Networks's Unit 42 has published a report on BadPack, a malware dropper used by many Android-based banking Trojans. Unit 42 explains, "BadPack is an APK file intentionally packaged in a malicious way. In most cases, this means an attacker has maliciously altered header information used in the compressed file format for APK files. These tampered headers are a key feature of BadPack, and such samples typically pose a challenge for Android reverse engineering tools." The researchers reported their findings to Google, noting that "[b]ased on Google’s current detection, no apps containing this malware are found on Google Play." Unit 42 recommends that users avoid installing apps from third-party sources.

Notes.

Today's issue includes events affecting Iran, Israel, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks (KrebsOnSecurity) At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week. Squarespace bought all assets of Google Domains a year ago, but many customers still haven't set up their new accounts. Experts say…

New Malware Campaign Targeting Spanish Language Victims (Cofense) Cofense recently identified and named a new malware called Poco RAT, which is a simple Remote Access Trojan that targets Spanish language victims. It was first observed in early 2024, primarily focusing on companies in the Mining sector and initially was delivered via embedded links to 7zip archives containing executables that were hosted on Google Drive. The campaigns are ongoing and continue to exhibit the same TTPs.

Security Patches, Mitigations, and Software Updates

Microsoft finally fixes Outlook alerts bug caused by December updates (BleepingComputer) Microsoft has finally fixed a known Outlook issue, confirmed in February, which was triggering incorrect security alerts after installing the December security updates for Outlook Desktop.

Marketplace

Kaspersky Lab Closing U.S. Division; Laying Off Workers (ZERO DAY) Russian cybersecurity firm, Kaspersky Lab, has told workers in its U.S.-based division that they are being laid off this week and that it is closing its U.S. business, according to several sources. The sudden move comes after the U.S. Commerce Department announced last month that it

Legislation, Policy, and Regulation

New Open Source law in Switzerland (Joinup) Switzerland has enacted the "Federal Law on the Use of Electronic Means for the Fulfilment of Governmental Tasks" (EMBAG), establishing a mandatory requirement for open source software within public sector bodies.

Litigation, Investigation, and Law Enforcement

Patagonia invaded privacy by using AI to analyze customer service interactions, lawsuit alleges (The Record) The plaintiffs of a suit filed in California say their communications with Patagonia were intercepted, recorded and analyzed by a third party without their permission.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cybersecurity in Congress - Hosted by Women in Cyber (Virtual, Jul 25, 2024) Welcome to our online event where we'll be discussing all things cybersecurity in Congress! Join us for insightful discussions, engaging panels, and networking opportunities with fellow cybersecurity enthusiasts. Whether you're a seasoned professional or just starting out in the field, this event is perfect for anyone interested in the intersection of cybersecurity and government. Don't miss out on this unique opportunity to learn from industry experts and connect with like-minded individuals. Register now and secure your spot!

Women in Cyber Leadership - Summer Event - Chicago (Chicago, Illinois, USA, Jul 25, 2024) Come together for lunch with fellow leaders in the cybersecurity field for an opportunity to re-connect or make new connections. Continuing the WICL tradition of uniting accomplished women, for knowledge-sharing and celebrating our achievements in this dynamic industry. This in-person event will be held at Porter Kitchen & Deck in Chicago. See you there! For more, join the Women in Cyber Leadership Group on LinkedIn: https://www.linkedin.com/groups/13514921/

Events

SANSFIRE Washington, DC 2024 (Washington (or virtual), DC, USA, Jul 15 - 20, 2024) At SANSFIRE Washington, DC 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SecureWorld Artificial Intelligence Virtual Conference (Virtual, Jul 24, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Jul 29 - 30, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 07.16.24