Daily Briefing for 01.26.24

At a glance.

• US senator says NSA's purchase of Americans' data is unlawful.
• Mexican banks targeted by AllaKore RAT.
• Trickbot developer sentenced to five years.
• Suspected Chinese threat actor uses backdoor from 2005.

US senator says NSA's purchase of Americans' data is unlawful.

US Senator Ron Wyden (Democrat of Oregon) yesterday sent a letter to Director of National Intelligence Avril Haines asserting that the US National Security Agency (NSA) is unlawfully purchasing US citizens' information from data brokers, the Record reports. Wyden states, "Although the intelligence agencies’ warrantless purchase of Americans’ personal data is now a matter of public record, recent actions by the Federal Trade Commission (FTC), the primary federal privacy regulator, raise serious questions about the legality of this practice." The FTC earlier this month barred two data brokers from selling Americans' location data.

Wyden adds, "According to the FTC, it is not enough for a consumer to consent to an app or website collecting such data, the consumer must be told and agree to their data being sold to 'government contractors for national security purposes.' I have conducted a broad probe of the data broker industry over the past seven years, and I am unaware of any company that provides such warnings to consumers before their data is collected. As such, the lawbreaking is likely industrywide, and not limited to this particular data broker."

Wyden requests that Haines direct the US intelligence agencies to conduct the following actions:

• "Conduct an inventory of the personal data purchased by the agency about Americans, including, but not limited to, location and internet metadata. As you know, the cataloging of IC acquisition of commercially available information was also a recommendation of the Senior Advisory Group Panel on Commercially Available Information in its January 2022 report.
• "Determine whether each data source identified in that inventory meets the standards for legal personal data sales outlined by the FTC. This, too, is consistent with the Senior Advisory Group’s recommendation to “identify and protect sensitive [Commercially Available Information] that implicates privacy and civil liberties concerns.”
• "Where those data purchases do not meet the FTC’s standard for legal data personal data sales, promptly purge the data. Should IC elements have a specific need to retain the data, I request that such need, and a description of any retained data, be conveyed to Congress and, to the greatest extent possible, to the American public."

Mexican banks targeted by AllaKore RAT.

Researchers at BlackBerry warn that a financially motivated threat actor is using a modified version of the open-source remote access tool AllaKore to target Mexican banks and cryptocurrency trading entities: "Lures use Mexican Social Security Institute (IMSS) naming schemas and links to legitimate, benign documents during the installation process. The AllaKore RAT payload is heavily modified to allow the threat actors to send stolen banking credentials and unique authentication information back to a command-and-control (C2) server for the purposes of financial fraud. The targeting we observed was indifferent to industry; the attackers appear to be most interested in large companies, many with gross revenues over $100M USD. We know this because the lures sent out by the threat actors only work for companies that are large enough to be reporting directly to the Mexican government’s IMSS department."

Trickbot developer sentenced to five years.

Russian national Vladimir Dunaev, a former developer of the Trickbot malware, pleaded guilty in the US to conspiracy to commit computer fraud and conspiracy to commit wire fraud, the Register reports. Dunaev admitted in his plea agreement to providing "specialized services and technical abilities" to the Trickbot gang between June 2016 and June 2021. Dunaev has been sentenced in the Northern District of Ohio to five years and four months in prison.

Suspected Chinese threat actor uses backdoor from 2005.

Researchers at ESET are tracking a China-aligned threat actor they've dubbed "Blackwood" that's conducting cyberespionage against Chinese and Japanese companies. The threat actor has also targeted individuals in China and Japan, as well as a "Chinese-speaking individual connected to the network of a high-profile public research university in the United Kingdom."

Blackwood has been active since at least 2018, and it's using an updated version of an implant called "NSPX30" that dates back to 2005. The researchers note, "Interestingly, the Project Wood implant from 2005 appears to be the work of developers with experience in malware development, given the techniques implemented, leading us to believe that we are yet to discover more about the history of the primordial backdoor."