AsyncRAT campaign targets US infrastructure. US DOJ charges individuals for involvement with xDedic cybercriminal marketplace

Summary

By the CyberWire staff

At a glance.

AsyncRAT campaign targets US infrastructure.
US DOJ charges individuals for involvement with xDedic cybercriminal marketplace.
US cities recovering from cyberattacks.
Cyber incident at loanDepot.
NIST outlines machine learning threats.

AsyncRAT campaign targets US infrastructure.

Researchers at AT&T Alien Labs are tracking an AsyncRAT malware campaign that’s been targeting entities that “manage key infrastructure in the US” for the past eleven months. The malware is delivered via a JavaScript file embedded in a phishing page: “These files, despite being clearly a script, contain long strings that are commented out, with texts composed of randomly positioned words, with ‘Melville’, ‘church’, ‘chapter’ and ‘scottish’ being the most repeated words.”

The researchers identified over 300 samples hosted on more than 100 domains.

US DOJ charges individuals for involvement with xDedic cybercriminal marketplace.

The US Justice Department last week charged nineteen individuals in its investigation into xDedic, a cybercriminal marketplace that was shuttered by law enforcement in 2019, the Record reports. The Justice Department stated, “In the years that followed the takedown of the xDedic Marketplace, the U.S. Attorney’s Office investigated and charged individuals involved in every level of the website’s operation, including its administrators, server sellers, and buyers. For example, Alexandru Habasescu and Pavlo Kharmanskyi were Marketplace administrators. Habasescu, who resided in Chisnau, Moldova, was the lead developer and technical mastermind for the Marketplace, while Kharmanskyi, who lived in Kiev, Ukraine, advertised for the website, paid administrators, and provided customer support to buyers. Habasescu was taken into custody in the Spanish Canary Islands in 2022 and extradited to the United States, while Kharmanskyi was arrested at the Miami International Airport in 2019 as he attempted to enter the United States. Habasescu and Kharmanskyi were sentenced to 41 and 30 months’ imprisonment, respectively.”

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

US cities recovering from cyberattacks.

The city of Beckley, West Virginia, sustained a cyberattack last week, StateScoop reports. The city said in a Facebook post, “We are working diligently to investigate the source of the incident, confirm the incident’s full scope and impact, and identify whether data may be impacted.”

The Ohio city of Huber Heights is still recovering from a ransomware attack it sustained in November, the Record reports. City Manager Rick Dzik said last week that $350,000 has been spent on recovery so far. Dzik added that forensic investigators “are going to review approximately 65,000 compromised files to determine if any contain personal data,” noting that “this is expected to be the most time-intensive part of the process.”

Share your message with our audience of security leaders.

N2K Cyber’s 2024 sponsorship packages are now available. If you're looking to reach the eyes and ears of our influential security professionals, let's talk and see how we can build a program that meets your goals.

Cyber incident at loanDepot.

US mortgage lender loanDepot sustained a cyberattack over the weekend that forced the company to take some of its IT systems offline, BleepingComputer reports. The incident prevented customers from making online payments.

The company stated, “loanDepot is experiencing a cyber incident. We have taken certain systems offline and are working diligently to restore normal business operations as quickly as possible. We are working quickly to understand the extent of the incident and taking steps to minimize its impact. The Company has retained leading forensics experts to aid in our investigation and is working with law enforcement.We sincerely apologize for any impacts to our customers and we are focused on resolving these matters as soon as possible.”

NIST outlines machine learning threats.

The US National Institute of Standards and Technology (NIST) issued a report last week describing “adversarial machine learning” threats, the Hacker News reports. NIST computer scientist Apostol Vassilev stated, “We are providing an overview of attack techniques and methodologies that consider all types of AI systems. We also describe current mitigation strategies reported in the literature, but these available defenses currently lack robust assurances that they fully mitigate the risks. We are encouraging the community to come up with better defenses.”

Notes.

Today's issue includes events affecting Bangladesh, China, Germany, Switzerland, Syria, Taiwan, Ukraine, and the United States.

Selected Reading

Attacks, Threats, and Vulnerabilities

Syrian Threat Group Peddles Destructive SilverRAT (Dark Reading) The Middle Eastern developers claim to be building a new version of the antivirus-bypassing remote access Trojan (RAT) attack tool.

Major IT, Crypto Firms Exposed to Supply Chain Compromise via New Class of CI/CD Attack (SecurityWeek) Self-hosted GitHub Actions runners could allow attackers to inject malicious code into repositories, leading to supply chain attacks.

Swiss Air Force documents exposed via cyber attack on third party (BeyondMachines) The Swiss Air Force experienced a significant data breach through its supplier, Ultra Intelligence & Communications, with the ALPHV hacker group leaking about 30 gigabytes of sensitive documents on the darknet, including Swiss Department of Defence and RUAG contracts.

Swatting: The new normal in ransomware extortion tactics (The Register) Remember the good old days when ransomware crooks vowed not to infect medical centers?

Mortgage firm loanDepot cyberattack impacts IT systems, payment portal (BleepingComputer) U.S. mortgage lender loanDepot has suffered a cyberattack that caused the company to take IT systems offline, preventing online payments against loans.

Taiwan to reveal Chinese election interference after Jan. 13 vote (The Record) After the polls close, Taiwan said it will share details on China's activity to “soften the learning curve for fellow democracies in dealing with malign authoritarian influence.”

Merck Settles With Insurers Over $700m NotPetya Claim (Infosecurity Magazine) Pharma giant Merck has reached a settlement with cyber-insurers that refused to pay out for “acts of war”

NIST Warns of Security and Privacy Risks from Rapid AI System Deployment (The Hacker News) NIST raises an alarm on AI's privacy & security risks. Discover how AI systems like ChatGPT face new threats.

Bangladesh official alleges cyberattack ‘from Ukraine and Germany’ targeted election () Mohammed Jahangir Alam, the Election Commission’s official secretary, told journalists that an election app had been “slowed down from Ukraine and Germany,” without specifying the nature of the incident.

Marketplace

North American Startup Funding Ended 2023 With A Q4 Dip (Crunchbase News) North American startup investors closed out 2023 with the worst quarter of the year, pulling back sharply on late-stage deals amid a weak exit environment.

Cybersecurity startup Vigilant Ops raises $2M from DataTribe (Technical.ly) The Pittsburgh company could double in size as it looks to serve industries beyond healthcare, CEO Ken Zalevsky said.

Mimecast Acquires Risk Identification Startup Elevate Security (CRN) Mimecast announced the acquisition of cybersecurity startup Elevate Security.

Big Tech has already made enough money in 2024 to pay all its 2023 fines | Proton (Proton) Big Tech (Alphabet, Amazon, Apple, Meta, and Microsoft)'s annual revenue dwarfs total fines. The cost for privacy is insignificant to them.

Products, Services, and Solutions

McAfee Unveils Advanced Deepfake Audio Detection Technology at CES 2024 to Defend Against Rise in AI-Generated Scams and Disinformation (Yahoo Finance) SAN JOSE, Calif., January 08, 2024--Today, McAfee Corp., a global leader in online protection, announced its AI-powered Deepfake Audio Detection technology, known as Project Mockingbird, at the Consumer Electronics Show. This new, proprietary technology was developed to help defend consumers against the surging threat of cybercriminals utilizing fabricated, AI-generated audio to carry out scams that rob people of money and personal information, enable cyberbullying, and manipulate the public ima

Legislation, Policy, and Regulation

Energy Department has cyber threats to infrastructure in mind with $70 million funding offer (FedScoop) The DOE’s Office of Cybersecurity, Energy Security and Emergency Response is seeking proposals for technology that strengthens the resilience of infrastructure from a variety of risks, including cybersecurity, part of an emphasis on taking care of “the operational technology side of the house.”

Space Force is crafting in-house cyber teams but sees need for closer work with USCYBERCOM (Nextgov.com) U.S. Cyber Command has been “an incredible partner” to the Space Force but does not currently have any personnel from the military branch within its ranks, a top official said.

Litigation, Investigation, and Law Enforcement

19 Individuals Worldwide Charged In Transnational Cybercrime Investigation Of The xDedic Marketplace (US Department of Justice) Tampa, Florida – United States Attorney Roger B. Handberg announces the culmination of a transnational cybercrime investigation involving the xDedic Marketplace.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

The International Conference on Cyber Security 2024 (New York, New York, USA, Jan 8 - 10, 2024) The International Conference on Cyber Security (ICCS) is the premier global cybersecurity event spanning three days, with over 50 distinguished speakers from the government, the private sector, and academia. It is an unparalleled opportunity for global cyber threat analysis, operations, research, and law enforcement leaders to coordinate and share their efforts to create a more secure world.

SANS Cloud Defender 2024 (Virtual, Jan 8 - 13, 2024) At SANS Cloud Defender 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jan 17 - 18, 2024) This highly sought after and very comprehensive 1 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

SANS Cyber Security Mountain: January 2024 (Virtual, Jan 22 - 27, 2024) At SANS Cyber Security Mountain: January 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.08.24