BlackCat/ALPHV ransomware gang receives $22 million payment. TA577 steals NTLM hashes.

Summary

By the CyberWire staff

At a glance.

BlackCat/ALPHV ransomware gang receives $22 million payment.
TA577 steals NTLM hashes.
Exploits available for JetBrains TeamCity vulnerabilities.
South Korean semiconductor industry targeted by DPRK.

BlackCat/ALPHV ransomware gang receives $22 million payment.

WIRED reports that BlackCat/ALPHV, the ransomware-as-a-service operation responsible for the attack against UnitedHealth Group's Change Healthcare platform, on March 1st received a payment of 350 bitcoins (approximately $22 million). The Register says UnitedHealth Group declined to say whether it paid the ransom. ALPHV said on its leak site last week that it had stolen six terabytes of sensitive data from Change Healthcare and its partners, but has since removed the post.

The Register also notes that ALPHV may be pulling an exit scam with the $22 million. Recorded Future researcher Dmitry Smilyanets says someone claiming to be the affiliate behind the Change Healthcare attack posted on an underground forum saying that ALPHV suspended their account and then "emptied the wallet and took all the money."

The Washington Post has published a summary of the impacts of the Change Healthcare attack. Molly Smith, group vice president for public policy at the American Hospital Association, stated, "Our assessment is that this is the most significant attack on the health-care system in U.S. history."

Team Cymru’s Threat Intelligence solutions allow you to aim your sights on the malicious actors.

Imagine a world where you're always one step ahead of cyber threats, where your defenses are impenetrable because you see what others don't. With real-time access to the worlds largest threat intelligence data ocean, we enable you to turn the tables on attackers. Transform your security from reactive to proactive through accelerated threat hunting and incident response, made possible through automation. Team Cymru: be the hunter, not the hunted.

TA577 steals NTLM hashes.

Proofpoint says the cybercriminal group TA577 is using a new attack chain to steal NT LAN Manager (NTLM) authentication information: "Proofpoint identified at least two campaigns leveraging the same technique to steal NTLM hashes on 26 and 27 February 2024. Campaigns included tens of thousands of messages targeting hundreds of organizations globally. Messages appeared as replies to previous emails, known as thread hijacking, and contained zipped HTML attachments."

The HTML attachments are tailored to each victim and are designed to connect to attacker-controlled SMB servers: "When opened, the HTML file triggered a system connection attempt to a Server Message Block (SMB) server via a meta refresh to a file scheme URI ending in .txt. That is, the file would automatically contact an external SMB resource owned by the threat actor. Proofpoint has not observed malware delivery from these URLs, instead researchers assess with high confidence TA577’s objective is to capture NTLMv2 Challenge/Response pairs from the SMB server to steal NTLM hashes based on characteristics of the attack chain and tools used."

Experience the ultimate cloud security challenge.

Put your cloud security skills to the test in a virtual game of Capture the Flag. Join Lacework in this interactive and gamified learning session, where you’ll dive into challenges simulating real-world investigations and threat-hunting scenarios. Plus, the top three scorers will receive a Valve Steam Deck. Attendance is limited, so register now to secure your spot.

Exploits available for JetBrains TeamCity vulnerabilities.

Rapid7 describes two authentication bypass vulnerabilities (CVE-2024-27198 and CVE-2024-27199) affecting JetBrains TeamCity CI/CD server. JetBrains issued patches for the flaws on Sunday. Rapid7 notes that CVE-2024-27198 has been assigned a CVSS base score of 9.8 and can allow "for a complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker, including unauthenticated RCE." The Register reports that the vulnerabilities are already being exploited.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

South Korean semiconductor industry targeted by DPRK.

South Korea's National Intelligence Service (NIS) says two of the country's semiconductor companies were breached by North Korean hackers in December 2023 and February 2024, the Record reports. The hackers stole "product design drawings and facility site photos." The NIS believes North Korea wants to build up its own domestic semiconductor industry to bypass international sanctions.

Notes.

Today's issue includes events affecting The Democratic People's Republic of Korea, the Republic of Korea, and the United States.

Attacks, Threats, and Vulnerabilities

Cyberattack forces Canada’s financial intelligence agency to take systems offline (The Record) FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada, said it "has and continues to manage a cyber incident."

South Korea says semiconductor industry targeted by cyber-spies from North (The Record) South Korea's National Intelligence Service (NIS) said the networks of at least two companies were breached in recently observed espionage campaigns.

Hackers Selling WordPress 0-day Exploits on Hacker Forums (Cyber Security News) A new post on a hacker forum has advertised the sale of a WordPress 0-day exploit, packaged as a PHP script, that can be used with a WordPress plugin.

Ukraine claims it hacked Russian Ministry of Defense servers (BleepingComputer) The Main Intelligence Directorate (GUR) of Ukraine's Ministry of Defense claims that it breached the servers of the Russian Ministry of Defense (Minoborony) and stole sensitive documents.

TA577’s Unusual Attack Chain Leads to NTLM Data Theft (Proofpoint) What happened Proofpoint identified notable cybercriminal threat actor TA577 using a new attack chain to demonstrate an uncommonly observed objective: stealing NT LAN Manager (NTLM) authentication...

Hackers exploited Windows 0-day for 6 months after Microsoft knew of it (Ars Technica) Technically, Microsoft doesn't consider such bugs vulnerabilities. It patched it anyway.

Maine DHHS announces interim payment system for pharmacies impacted by cybersecurity issue (newscentermaine.com) In an announcement on Wednesday, Maine DHHS said the system will issue payments to help independent and safety net pharmacies to support MaineCare members.

Security Patches, Mitigations, and Software Updates

TeamCity Users Urged to Patch Critical Vulnerabilities (Infosecurity Magazine) JetBrains says on-premises TeamCity servers must be upgraded to mitigate two critical new bugs

Marketplace

Axonius, a specialist in cyber asset managment, secures $200M at a flat $2.6B valuation (TechCrunch) Axonius, one of the bigger players in the world of enterprise asset management -- understanding and monitoring the digital assets and infrastructure that

Litigation, Investigation, and Law Enforcement

Pentagon leaker Jack Teixeira pleads guilty under a deal that calls for at least 11 years in prison (AP News) The Massachusetts Air National Guard member pleaded guilty in federal court to leaking national security secrets.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SO-CON Summit (Arlington, Virginia, USA, Mar 11 - 15, 2024) It will feature over 20 unique cybersecurity sessions from industry experts. They’ll be sharing new research, new open source tools, best-practices, and much more. The first day of the summit will be followed by several days of training (including red teaming, tradecraft analysis, AD security fundamentals, and much more).

SANS Dallas 2024 (Dallas (and virtual), Texas, USA, Mar 11 - 16, 2024) At SANS Dallas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.05.24