Suspected Iranian threat actor targets aerospace and defense entities.

Summary

By the CyberWire staff

At a glance.

Suspected Iranian threat actor targets aerospace and defense entities.
Repo confusion campaign spreading on GitHub.
AI models deliver backdoor.

Suspected Iranian threat actor targets aerospace and defense entities.

Mandiant says the suspected Iranian threat actor UNC1549 has been targeting aerospace, aviation, and defense entities in Middle Eastern countries with two unique backdoors dubbed "MINIBIKE" and "MINIBUS." The campaign overlaps with activity by Tortoiseshell, a threat actor attributed to Iran’s Islamic Revolutionary Guard Corps (IRGC). Mandiant notes, "The potential link between this activity and the Iranian IRGC is noteworthy given the focus on defense-related entities and the recent tensions with Iran in light of the Israel-Hamas war. Notably, Mandiant observed an Israel-Hamas war-themed campaign that masquerades as the 'Bring Them Home Now' movement, which calls for the return of the Israelis kidnapped and held hostage by Hamas. This suspected UNC1549 activity has been active since at least June 2022 and is still ongoing as of February 2024."

Secure your future with a master’s degree in cybersecurity from Penn State World Campus.

Boost your cybersecurity career with Penn State World Campus! Our online master's program delivers cutting-edge knowledge, hands-on skills, and expert insights. Benefit from flexible learning that fits your schedule, while gaining industry-relevant expertise in areas like threat detection, risk management, and ethical hacking. Join a renowned institution, be guided by industry leaders, and advance your career in the dynamic field of cybersecurity. Elevate your skills, secure your future — apply today!

Repo confusion campaign spreading on GitHub.

Researchers at Apiiro warn that a malicious repo confusion campaign has impacted more than a hundred thousand GitHub repositories since mid-2023: "Most of the forked repos are quickly removed by GitHub, which identifies the automation. However, the automation detection seems to miss many repos, and the ones that were uploaded manually survive. Because the whole attack chain seems to be mostly automated on a large scale, the 1% that survive still amount to thousands of malicious repos....Counting the removed ones, the number of repos reaches millions."

The malicious repos are clones of legitimate ones, containing a version of the BlackCap-Grabber designed to steal "login credentials from different apps, browser passwords and cookies, and other confidential data." The researchers note, "The targeted repos are in a small niche and have low popularity, making it easier for unsuspecting developers to make the mistake and clone their malicious impersonators."

Team Cymru’s Threat Intelligence solutions allow you to aim your sights on the malicious actors.

Imagine a world where you're always one step ahead of cyber threats, where your defenses are impenetrable because you see what others don't. With real-time access to the worlds largest threat intelligence data ocean, we enable you to turn the tables on attackers. Transform your security from reactive to proactive through accelerated threat hunting and incident response, made possible through automation. Team Cymru: be the hunter, not the hunted.

AI models deliver backdoor.

JFrog has identified at least 100 backdoored AI models available on the Hugging Face AI collaboration platform, BleepingComputer reports. The researchers note, "As with other open-source repositories, we’ve been regularly monitoring and scanning AI models uploaded by users, and have discovered a model whose loading leads to code execution, after loading a pickle file. The model’s payload grants the attacker a shell on the compromised machine, enabling them to gain full control over victims’ machines through what is commonly referred to as a 'backdoor.' This silent infiltration could potentially grant access to critical internal systems and pave the way for large-scale data breaches or even corporate espionage, impacting not just individual users but potentially entire organizations across the globe, all while leaving victims utterly unaware of their compromised state."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Notes.

Today's issue includes events affecting Iran, Israel, and the United States.

Attacks, Threats, and Vulnerabilities

Russia Attacked Ukraine's Power Grid at Least 66 Times to ‘Freeze It Into Submission’ (WIRED) Several of the strikes occurred far from the front lines of the conflict, indicating possible war crimes. Researchers say the attacks likely had devastating impacts on civilians.

Examining Malicious Hugging Face ML Models with Silent Backdoor (JFrog) Is Hugging Face the target of model-based attacks? See a detailed explanation of the attack mechanism and what is required to identify real threats >

Malicious AI models on Hugging Face backdoor users’ machines (BleepingComputer) At least 100 instances of malicious AI ML models were found on the Hugging Face platform, some of which can execute code on the victim's machine, giving attackers a persistent backdoor.

Popular video doorbells can be easily hijacked, researchers find (TechCrunch) Walmart and Temu pulled the affected doorbell cameras from their stores. Amazon and others have taken no action.

Over 100,000 Infected Repos Found on GitHub (Apiiro) The Apiiro research team has detected a repo confusion campaign that has evolved and expanded, impacting over 100k GitHub repos with malicious code.

Rhysida ransomware wants $3.6 million for children’s stolen data (BleepingComputer) The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month.

When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors | Mandiant (Mandiant) Suspected Iran-nexus espionage targeting the aerospace, aviation and defense in Middle East countries.

Security Patches, Mitigations, and Software Updates

Cisco Patches High-Severity Vulnerabilities in Data Center OS (SecurityWeek) Cisco’s semiannual FXOS and NX-OS security advisory bundle resolves two high- and two medium-severity vulnerabilities.

Litigation, Investigation, and Law Enforcement

Network intelligence company Sandvine banned from trading in the US (SC Media) Sandvine, a network intelligence firm based in Ontario, Canada, that specializes in network policy control products, was subjected to government restrictions.

Rights groups file GDPR suits on Meta's pay-or-consent model (The Register) GDPR claim alleges Facebook parent's 'commercial surveillance practices are fundamentally illegal'

Senator asks FTC to investigate automakers’ data privacy practices (The Register) Calling automakers’ responses to his demand for answers “evasive and vague,” Sen. Edward Markey (D-MA) on Wednesday called on Federal Trade Commission (FTC) Chair Lina Khan to investigate the car industry’s data privacy practices.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

CyberLaunch Competition (Orlando, Florida, USA, Mar 1, 2024) Cyber Florida is thrilled to announce Florida’s first-ever statewide high school cybersecurity competition: CyberLaunch! The CyberLaunch program aims to introduce high school students to the universe of cybersecurity careers through the fun of a statewide competition. The program includes resources for teachers and students who are new to cybersecurity, including classroom activities that provide a sneak peek of the competition platform for practice! Through this endeavor, we hope to build interest in cybersecurity careers, awareness of cybersecurity best practices, and help connect the cybersecurity industry in Florida with local school districts.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SO-CON Summit (Arlington, Virginia, USA, Mar 11 - 15, 2024) It will feature over 20 unique cybersecurity sessions from industry experts. They’ll be sharing new research, new open source tools, best-practices, and much more. The first day of the summit will be followed by several days of training (including red teaming, tradecraft analysis, AD security fundamentals, and much more).

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.29.24

At a glance.

Suspected Iranian threat actor targets aerospace and defense entities.

Repo confusion campaign spreading on GitHub.

AI models deliver backdoor.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Litigation, Investigation, and Law Enforcement

Events