Earth Preta deploys new malware in the Asia-Pacific.

Summary

By the CyberWire staff

At a glance.

Earth Preta deploys new malware in the Asia-Pacific.
NoName deploys new ransomware and partners with RansomHub.
New RaaS operation is recruiting criminal affiliates.

Earth Preta deploys new malware in the Asia-Pacific.

Trend Micro is tracking new variants of malware used by the China-aligned threat actor Earth Preta (also known as "Mustang Panda"). The threat actor is using spearphishing emails and removable drives to deploy malware against government entities in the Asia-Pacific region. Trend Micro states, "Earth Preta employed a variant of the worm HIUPAN to propagate PUBLOAD into their targets' networks via removable drives. PUBLOAD was used as the main control tool for most of the campaign and to perform various tasks, including the execution of tools such as RAR for collection and curl for data exfiltration. PUBLOAD was also used to introduce supplemental tools into the targets' environment, such as FDMTP to serve as a secondary control tool, which was observed to perform similar tasks as that of PUBLOAD; and PTSOCKET, a tool used as an alternative exfiltration option."

Cobalt: The Only “Outperformer” in GigaOm’s Pentesting Report

For the second year in a row, Cobalt has been named the only “outperformer” in GigaOm’s independent report on Pentesting as a Service. Recognized for its streamlined approach, free retesting, and swift test launches, Cobalt leads the pack. Download the full report to see why Cobalt stands out as the category leader.

NoName deploys new ransomware and partners with RansomHub.

The NoName ransomware gang appears to be working as an affiliate for the RansomHub ransomware-as-a-service operation, BleepingComputer reports. ESET, which tracks NoName as "CosmicBeetle," says the group is also using its own strain of ransomware dubbed "ScRansom." ESET notes, "ScRansom is not very sophisticated ransomware, yet CosmicBeetle has been able to compromise interesting targets and cause great harm to them." The researchers add that since the ScRansom malware is buggy, victims who decide to pay the ransom should be prepared to deal with complications and potential loss of data during the decryption process.

Elevate Your Enterprise Identity Solutions

Seamlessly connect legacy apps to any identity provider with Strata. Effortlessly apply MFA and maintain identity continuity without disruptions. Enhance security and reduce tech debt with Strata’s efficient identity orchestration platform. Share your identity challenge and receive free AirPods Pro.

New RaaS operation is recruiting criminal affiliates.

Palo Alto Networks' Unit 42 has published a report on Repellent Scorpius, a ransomware-as-a-service operation that surfaced in May 2024. The group distributes the Cicada3301 ransomware and conducts double-extortion attacks by exfiltrating data before deploying the ransomware. The researchers state, "Unit 42 has evidence to suggest that the Repellent Scorpius operators have developed a RaaS affiliate program. It operates a control panel for affiliates and ransom payment pages for victims, and actively recruits initial access brokers (IAB) and network intruders on Russian-language cybercrime forums."

XPOSURE, The Virtual CTEM Summit Hosted by Pentera on September 10th!

Feeling a little too "xposed"? Gartner predicts implementing CTEM can make your organization 3x less likely to experience a breach. XPOSURE is your ticket to mastering the CTEM framework and ensuring you’re never caught with your defenses down. In just 3 hours, you'll learn how to continuously test your resilience, identify high-risk gaps, and apply best practices across your entire attack surface. Join us live on September 10th or tune in on-demand!

Notes.

Today's issue includes events affecting , and China the United States.

Sponsored Events

2024 DataTribe Challenge (Virtual (for submissions), Sep 9 - 27, 2024) The DataTribe Challenge is a unique startup competition for pre-seed and seed stage cybersecurity and data science startups. It’s a platform for startups to connect with DataTribe, to tighten their pitch, to gain industry exposure, and to make connections with prospective investors and customers.

DMV Rising, D.C.’s Premier Conference for Cyber Execs. (Virtual and Washington, DC, US, Sep 12, 2024) The Washington, D.C. Maryland, and Virginia (DMV) region has established itself as a top-tier player in the global cyber industry. Join us on September 12, 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Upcoming Cybersecurity Summits (Multiple locations, Sep 17 - 27, 2024) Join us In-Person and network over breakfast, lunch & a cocktail reception on 9/17 in Atlanta, 9/19 in Wall Street, 9/26 in Columbus and 9/27 in Philadelphia. Learn about the latest threats and solutions from The IRS, U.S. DHS/CISA, Visit Philadelphia & more. Earn CPE/CEU credits with your attendance. Get 50% off admission w/ code CSS24-CYBERWIRE at CyberSecuritySummit.com (Only $125 with code)

HITRUST Collaborate 2024 (Omni Star at The Dallas Cowboys World Headquarters, Oct 1 - 3, 2024) Cybersecurity risk management leaders will cover critical topics, like challenges posed by AI, business resilience in the face of ransomware, the future cybersecurity workforce, and access to cybersecurity insurance. Thought leaders will offer actionable insights to help you fortify your security posture.

On-demand webinar - Watch now: Generative AI for Security (Virtual, On-demand, Oct 2 - Sep 30, 2024) How can generative artificial intelligence (AI) enhance your security operations? Watch this webinar from AWS and SANS to get a comprehensive roadmap for securely adopting generative AI using Amazon Bedrock. Experts will address key challenges and ethical considerations, then guide you through a hands-on Explore-Develop-Deploy framework while looking at real-world use cases and implementation. Watch now.

ISC2 Security Congress 2024 (Virtual / Las Vegas, NV, US, Oct 14 - 16, 2024) Join us at ISC2 Security Congress, October 14-16 in Las Vegas or online. Connect with global cyber experts, hear from four keynote speakers, and participate in one of eight pre-conference workshops. Discover cutting-edge insights and advance your skills in cybersecurity. Don’t miss out!

Step into the heart of excitement at the Finance & Accounting Technology Expo! (New York, NY, Oct 29 - 30, 2024) FATE is the leading expo in the finance industry, bringing together experts, innovators, and professionals like yourself to connect, explore and expand! There will be over 70 technologies, more than 60 learning sessions, incredible networking with over 1000 finance and accounting professionals -- and great keynote speakers. Our keynote speakers range from Shark Tank Judge Daymond John to CFO Glenn Hopper and even a TechStack of Sports panel, bringing you CFOs of some of the most recognized brands in sports sharing how technology powers their decisions and their growth! This premier event will leave you with the latest insights, strategies, and tools necessary to excel in the dynamic landscape of finance, accounting, and technology. And the best part is that – it's FREE! Use Code: wko735 and reduce your ticket price to $0. Register here today!

Selected Reading

Attacks, Threats, and Vulnerabilities

Acadian Ambulance service is reporting data breach, exposing almost 3 Million people (BeyondMachines) Acadian Ambulance Service experienced a ransomware attack by the Daixin group in June 2024, potentially compromising sensitive information, including names, Social Security numbers, and medical data of nearly 3 million individuals, though the attackers claim up to 10 million were affected. The breach led to at least 10 federal class action lawsuits alleging negligence, and Acadian has offered free identity and credit monitoring services to those impacted.

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware (Unit 42) Repellent Scorpius distributes Cicada3301 ransomware, using double extortion and targeting global victims since May 2024. We break down their toolset and more. Repellent Scorpius distributes Cicada3301 ransomware, using double extortion and targeting global victims since May 2024. We break down their toolset and more.

Crimson Palace returns: New Tools, Tactics, and Targets (Sophos News) Chinese cyberespionage campaign renews efforts in multiple organizations in Southeast Asia, blending tactics and expanding efforts

Payment Gateway SLIM CD Data Breach: 1.7 Million Users Impacted (Hackread) Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

Legislation, Policy, and Regulation

The AI Convention: Lofty Goals, Legal Loopholes, and National Security Caveats (SecurityWeek) Signed on September 5, 2024, the AI Convention is a laudable intent but suffers from the usual exclusions and exemptions necessary to satisfy multiple nations.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

DMV Rising 2024 (Washington, DC, Sep 12, 2024) DMV Rising is D.C.'s premier cybersecurity event, bringing together cybersecurity executives to tackle tough problems, share new insights, and explore innovative solutions emerging in D.C., Maryland, and Virginia.

SecureWorld Detroit (Novi, Michigan, USA, Sep 18, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld St. Louis (Clayton, Missouri, USA, Sep 26, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

2024 DataTribe Challenge Submission Deadline (Fulton and Virtual, Maryland, USA, Sep 27, 2024) As founders ourselves, we have never liked the feeling of being the entertainment that comes with participating in most pitch competitions. So, in creating the DataTribe Challenge, we have centered it on the North Star of creating a platform that is a valuable use of time for the founders participating. Submit your startup to potentially be selected to be part of a startup competition like no other. The DataTribe Challenge is a unique program to accelerate your cybersecurity startup. Workshop your messaging and meet potential investors and customers. We will pick five finalists to join the program, receive coaching from our team of startup veterans, present at the live event, and benefit from free promotion and press coverage. Finalists share $25,000 in prizes and all will receive the title of DataTribe Challenge Finalist.

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.10.24

At a glance.

Earth Preta deploys new malware in the Asia-Pacific.

NoName deploys new ransomware and partners with RansomHub.

New RaaS operation is recruiting criminal affiliates.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Events