Daily Briefing for 09.06.24

At a glance.

• Cadet Blizzard attributed to Unit 29155 of Russia’s GRU.
• Predator spyware resurfaces.
• SonicWall vulnerability exploited in the wild.

Cadet Blizzard attributed to Unit 29155 of Russia’s GRU.

A group of Western government agencies, including four of the Five Eyes, has issued a joint advisory on Cadet Blizzard, a threat actor attributed to the Russian GRU's Unit 29155. The US FBI says "the Unit 29155 cyber actors to be junior active-duty GRU officers under the direction of experienced Unit 29155 leadership. These individuals appear to be gaining cyber experience and enhancing their technical skills through conducting cyber operations and intrusions. Additionally, FBI assesses Unit 29155 cyber actors rely on non-GRU actors, including known cyber-criminals and enablers to conduct their operations."

The advisory adds, "In addition to WhisperGate and other incidents against Ukraine, Unit 29155 cyber actors have conducted computer network operations against numerous members of the North Atlantic Treaty Organization (NATO) in Europe and North America, as well as countries in Europe, Latin America, and Central Asia. The activity includes cyber campaigns such as website defacements, infrastructure scanning, data exfiltration, and data leak operations. These actors sell or publicly release exfiltrated victim data obtained from their compromises. Since early 2022, the primary focus of the cyber actors appears to be targeting and disrupting efforts to provide aid to Ukraine."

WIRED notes that hacking is a relatively new endeavor for Unit 29155; the group has previously been known for physical tactics, including "poisonings, attempted coups, and bombings inside Western countries."

Predator spyware resurfaces.

Researchers at Recorded Future warn that Intellexa's Predator spyware has resurfaced, with likely customers in Angola, Saudi Arabia, and the Democratic Republic of the Congo. Intellexa, which is based in Europe and was founded by an Israeli ex-intelligence officer, was sanctioned by the US Treasury Department earlier this year for enabling "the proliferation of commercial spyware and surveillance technologies around the world, including to authoritarian regimes."

Recorded Future states, "Predator's operators have significantly enhanced their infrastructure, adding layers of complexity to evade detection. The new infrastructure includes an additional tier in its multi-tiered delivery system, which anonymizes customer operations, making it even harder to identify which countries are using the spyware. This change makes it more difficult for researchers and cybersecurity defenders to track the spread of Predator."

SonicWall vulnerability exploited in the wild.

A recently patched access control vulnerability (CVE-2024-40766) affecting SonicWall's SonicOS is being exploited in the wild, BleepingComputer reports. The vulnerability affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions. SonicWall urges customers to apply the patch as soon as possible.

The company adds, "SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access. Users can change their passwords if the 'User must change password' option is enabled on their account. Administrators must manually enable the 'User must change password' option for each local account to ensure this critical security measure is enforced."