Daily Briefing for 12.10.24

At a glance.

• Nemesis and ShinyHunters target misconfigured websites.
• Radiant Capital attributes $50 million cryptocurrency theft to DPRK hackers.
• Romanian energy company hit by ransomware.

Nemesis and ShinyHunters target misconfigured websites.

Security researchers Noam Rotem and Ran Locar discovered a widespread hacking operation tied to the Nemesis and ShinyHunters threat actors, targeting vulnerabilities in improperly configured public websites. The hackers accidentally exposed their stolen data, tools, and possible identities in a misconfigured AWS S3 bucket.

vpnMentor published a report on the operation, stating, "This incident resulted in the exposure of sensitive keys and secrets, granting unauthorized access to customer data. A sophisticated and extensive infrastructure, orchestrated by threat actors from a French-speaking country, conducted comprehensive scans of the internet, searching for exploitable vulnerable endpoints. These vulnerable endpoints gave the attackers access to infrastructure credentials, proprietary source code, application databases, and even credentials to additional external services in some cases." 

Radiant Capital attributes $50 million cryptocurrency theft to DPRK hackers.

Decentralized finance (DeFi) protocol Radiant Capital has attributed a $50 million cryptocurrency theft to North Korean government hackers, BleepingComputer reports. The theft occurred on October 16, 2024, following a social engineering attack. Radiant Capital shared in an update, "On September 11, 2024, a Radiant developer received a Telegram message from what appeared to be a trusted former contractor. The message said that the contractor was pursuing a new career opportunity related to smart contract auditing. It included a link to a zipped PDF regarding the contractor’s new alleged endeavor and sought feedback about their work." The ZIP file was shared with other Radiant developers for feedback, and installed a "persistent macOS backdoor" when it was opened.

Romanian energy company hit by ransomware.

Romanian energy supplier Electrica sustained a ransomware attack yesterday, the Record reports. The company's CEO Alexandru Chirita stated, "Teams of specialists are working closely with the national cybersecurity authorities to manage and resolve the incident, aiming to address the situation as quickly as possible, identify the source of the attack, and limit its impact....Our primary priority remains maintaining continuity in the distribution and supply of electricity, as well as protecting the managed personal data and the operational data of all entities within Electrica Group."

Romania's Ministry of Energy said in a press statement, "Initial investigations show that it was a ransomware attack. The network equipment has been removed and is not affected. The SCADA systems of Distributie Electric Power Romania are fully functional and insulated, and our technical teams, together with our security partners, are already on the ground to eliminate any risk."