US government disrupts Volt Typhoon. Schneider Electric confirms ransomware attack.

Summary

By the CyberWire staff

At a glance.

US government disrupts Volt Typhoon.
Schneider Electric confirms ransomware attack.
Microsoft Teams abused for phishing.
New variant of the Zloader Trojan.

US government disrupts Volt Typhoon.

Reuters reports that the US Justice Department and FBI disabled portions of a network of compromised devices that was being used by the China-linked threat actor Volt Typhoon to target US critical infrastructure. Volt Typhoon had been forming a botnet by compromising vulnerable devices, including routers, modems, and IoT devices, in order to hide later intrusions into sensitive targets.

John Hultquist, Chief Analyst at Mandiant Intelligence, said in an emailed statement that Volt Typhoon has been conducting battlespace preparation by staging potentially disruptive attacks: "This actor is not doing the quiet intelligence collection and theft of secrets that has been the norm in the US. They are probing sensitive critical infrastructure so they can disrupt major services if, and when, the order comes down."

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

Schneider Electric confirms ransomware attack.

Schneider Electric has confirmed that its sustainability business division was disrupted by a ransomware attack, Silicon Republic reports. The company stated, "From an impact assessment standpoint, the ongoing investigation shows that data have been accessed. As more information becomes available, the sustainability business division of Schneider Electric will continue the dialogue directly with its impacted customers and will continue to provide information and assistance as relevant."

BleepingComputer says the attack occurred on January 17th, and involved the Cactus strain of ransomware.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Microsoft Teams abused for phishing.

AT&T Cybersecurity warns that threat actors are abusing Microsoft Teams to launch phishing attacks: "Most Teams activity is intra-organizational, but Microsoft enables External Access by default, which allows members of one organization to add users outside the organization to their Teams chats. Perhaps predictably, this feature has provided malicious actors a new avenue by which to exploit untrained or unaware users." The researchers observed a threat actor using this vector to send phishing lures delivering the DarkGate malware.

The researchers conclude, "Unless absolutely necessary for daily business use, disabling External Access in Microsoft Teams is advisable for most companies, as email is generally a more secure and more closely monitored communication channel."

New variant of the Zloader Trojan.

Zscaler says a new variant of the Zloader Trojan has surfaced after an almost two-year hiatus. The malware's operations were disrupted after Microsoft dismantled its infrastructure in April 2022. Zscaler says the new version of the Trojan offers "new obfuscation techniques, an updated domain generation algorithm (DGA), RSA encryption for network communications, and the loader now has native support for 64-bit versions of Windows."

Notes.

Today's issue includes events affecting China, Myanmar, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks (CSIRT-CTI) CSIRT-CTI has identified two campaigns exhibiting strong indications of being connected to Stately Taurus (alias Bronze President, Camaro Dragon, Earth Preta, Mustang Panda, Red Delta and Luminous Moth), both assessed to have targeted the Myanmar Ministry of Defence and Foreign Affairs.

Zloader: No Longer Silent in the Night (Zscaler) Technical analysis of Zloader 2.1.7.0 | Updates include new obfuscation, RSA encryption, modifications to the DGA and a 64-bit loader module

Hundreds of network operators’ credentials found circulating in Dark Web (Security Affairs) Hundreds of compromised credentials of customers of RIPE, APNIC, AFRINIC, and LACNIC available on the dark web, Resecurity warns.

Series of cyber attacks risks sensitive data at N.J. schools, hospitals (NJ.com) What New Jersey officials are doing to stop rise in hacking, ransomware attacks.

Synopsys Comments on Increased Cyberattacks in Healthcare (Healthcare Digital) Cyber-Attacks on Hospital Systems Show That Protecting Human Health Is a Critical Priority Says Tim Mackey, Synopsys Software Integrity Group

Malicious ads for restricted messaging applications target Chinese users (Malwarebytes) Chinese speaking users looking for Telegram, or LINE are being targeted with malicious ads. Instead of downloading the legitimate application, they install malware.

Trends

2023 Cybersecurity Insights Report: Focus on Finance (AT&T Cybersecurity) Based on the 2023 AT&T Cybersecurity Insights Report: Edge Ecosystem, this report focuses on finance companies worldwide. It explains how edge computing is changing the finance industry to solve operational issues and reduce costs. Our 2023 report reveals what your peers are planning and doing to embrace edge computing.

Legislation, Policy, and Regulation

Florida cybersecurity safe harbor bill advances (Healthcare IT News) The Sunshine State's proposed law would shield governments and businesses against liability claims that result from a data breach that occurs during a cyberattack.

AI companies will need to start reporting their safety tests to the US government (AP News) The Biden administration will start implementing a new requirement for the developers of major artificial intelligence systems to disclose their safety test results to the government.

Litigation, Investigation, and Law Enforcement

Canadian malware spreader gets 2 years in prison (The Record) Matthew Philbert carried out cyberattacks on more than 1,100 victims total. He pleaded guilty in October of last year to charges of fraud and unauthorized access to computers.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Improve Spear Phishing Detection With AI (Virtual, Jan 30 - 31, 2024) Phishing remains one of the costliest attack vectors. Spear phishing, a more targeted form of phishing, is very convincing and poses a great risk to organizations. As threat actors crank up the volume of spear phishing attacks, companies are increasingly embracing AI for cybersecurity. Join this webinar to learn how NVIDIA’s AI technologies, along with ecosystem partners, can help organizations build powerful solutions to defend against cyber threats.

Insider Threat Program Development, Management & Optimization Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2024) This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS San Diego 2024 (San Diego (and virtual), California, USA, Feb 12 - 17, 2024) At SANS San Diego 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Security East New Orleans 2024 (New Orleans, and virtual, Louisiana, USA, Feb 19 - 24, 2024) At SANS Security East New Orleans 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.30.24