APT29 launches phishing campaign against German politicians. Supply chain attack compromises Python developers.

Summary

By the CyberWire staff

At a glance.

APT29 launches phishing campaign against German politicians.
Supply chain attack compromises Python developers.
Law enforcement shuts down holiday fraud ring.

APT29 launches phishing campaign against German politicians.

Researchers at Mandiant warn that APT29, a threat actor attributed to Russia's SVR, launched a phishing campaign against German politicians in late February 2024. The phishing emails impersonated invites to a dinner reception, and were designed to deliver the WINELOADER backdoor discovered by Zscaler last month.

Mandiant states, "Notably, this activity represents a departure from this APT29 initial access cluster’s typical remit of targeting governments, foreign embassies, and other diplomatic missions, and is the first time Mandiant has seen an operational interest in political parties from this APT29 subcluster. Additionally, while APT29 has previously used lure documents bearing the logo of German government organizations, this is the first instance where we have seen the group use German-language lure content — a possible artifact of the targeting differences (i.e. domestic vs. foreign) between the two operations."

Team Cymru’s Threat Intelligence solutions allow you to aim your sights on the malicious actors.

Imagine a world where you're always one step ahead of cyber threats, where your defenses are impenetrable because you see what others don't. With real-time access to the worlds largest threat intelligence data ocean, we enable you to turn the tables on attackers. Transform your security from reactive to proactive through accelerated threat hunting and incident response, made possible through automation. Team Cymru: be the hunter, not the hunted.

Supply chain attack compromises Python developers.

A malicious clone of the Colorama python package compromised multiple Python developers, including a maintainer of Top.gg's code repository, according to researchers at Checkmarx. The researchers state, "The threat actors used multiple TTPs in this attack, including account takeover via stolen browser cookies, contributing malicious code with verified commits, setting up a custom Python mirror, and publishing malicious packages to the PyPi registry." The attackers "concealed the harmful payload within Colorama using space-padding and hosted this modified version on their typosquatted-domain fake-mirror."

The top 5 malware that hackers use to steal your users’ passwords

Redline malware is the hacking community’s current favorite password-stealing toy, racking up 170 million stolen credentials over the past six months. The prevalence of Redline highlights the alarming danger of password reuse and the potential compromise of sensitive information.

See the data and learn how you can block compromised passwords from your Active Directory with Specops Password Policy. Learn more and sign up for a free trial.

Law enforcement shuts down holiday fraud ring.

Law enforcement in Romania and Spain have arrested nine individuals who were allegedly "engaged in the publishing of fake advertisements for cheap holiday rentals," Infosecurity Magazine reports. Europol said in a press release, "Although this sort of cyber fraud is not new, the level of sophistication exhibited by the gang involved in this case is unprecedented, and a multifaceted investigation was required to crack the case." The police searched twenty-two houses in Romania and seized 174,000 euros and 41,000 Romanian lei.

Europol added, "Although most of the published advertisements listed holiday rentals, criminals would also publicise second-hand cars and electronic devices. According to authorities, the amount spent per victim ranged between EUR 200 and EUR 10 000."

Create your own luck. 25% off top cert prep.

Boost confidence without relying on luck! N2K's practice tests offer a comprehensive toolkit for ultimate success, including a vast question Qbank for custom quizzes, final exam simulations, performance tracking, and more in our robust LMS. Visit n2k.com/certify, use code NETWORK, and save 25% on our top practice tests. Don't miss out - offer ends 3/27.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Notes.

Today's issue includes events affecting Germany, Romania, Russia, Spain, and the United States.

Attacks, Threats, and Vulnerabilities

Illinois county government, local college affected by ransomware attacks (The Record) Illinois' Henry County has been dealing with a wide-ranging cyberattack since March 18, and nearby Monmouth College reported a ransomware attack this week that occurred last December.

Large-Scale StrelaStealer Campaign in Early 2024 (Unit 42) We unravel the details of two large-scale StrelaStealer campaigns from 2023 and 2024. This email credential stealer has a new variant delivered through zipped JScript.

Attack Using Fake Python Infrastructure (Checkmarx.com) The Checkmarx Research team recently discovered an attack campaign targeting the software supply chain, with evidence of successful exploitation of multiple victims. The threat actors used multiple TTPs in this attack, including account takeover via stolen browser cookies, contributing malicious code with verified commits, setting up a custom Python mirror, and publishing malicious packages to the PyPi registry. This blog will cover the attack and the techniques used by the attackers.

Google's new AI search results promotes sites pushing malware, scams (BleepingComputer) Google's new AI-powered 'Search Generative Experience' algorithms recommend scam sites that redirect visitors to unwanted Chrome extensions, fake iPhone giveaways, browser spam subscriptions, and tech support scams.

Security Patches, Mitigations, and Software Updates

Mozilla Patches Firefox Zero-Days Exploited at Pwn2Own (SecurityWeek) Firefox browser updates address two zero-day vulnerabilities exploited at the Pwn2Own hacking contest.

Marketplace

General Motors Quits Sharing Driving Behavior With Data Brokers (NYTimes) G.M. had provided information about braking, acceleration and speed to LexisNexis Risk Solution and Verisk, firms that generated driver risk profiles for insurers.

Products, Services, and Solutions

Nametag Launches Self-Service Account Recovery Solution That Stops AI-Generated Deepfake Attacks (GlobeNewswire News Room) Nametag has launched Nametag Autopilot, the only self-service account recovery solution that prevents AI-generated deepfake attacks....

Legislation, Policy, and Regulation

Pentagon, Congress have a ‘limited window’ to properly create a Cyber Force (The Record) “Years after designating cyberspace as a warfighting domain, leaders must acknowledge the writing on the wall,” states a report issued by the nonpartisan Foundation for Defense of Democracies.

Litigation, Investigation, and Law Enforcement

Police Bust Multimillion-Dollar Holiday Fraud Gang (Infosecurity Magazine) Law enforcers have arrested nine suspected members of a prolific cyber-fraud gang

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Maryland STEM Festival: Girl Scout Cybersecurity Badge Event (Baltimore, Maryland, USA, Mar 30, 2024) One of thte fastest growing and most exciting STEM fields is Cybersecurity. Girl Scouts have a Cybersecurity Badge! Daisies, Brownies, Cadettes and Juniors can earn this badge by going through activities on March 30 at Morgan State University from 2-4 pm. The activities will be run by STEM Professional Women and members of the Morgan Women in Computer Science Club. This is the fourth time we have run this event and one way the Festival celebrates Women History Month. See some pictures from past events below. The event is free. Registration is required. Space is limited. Make sure your group gets their slot before they are gone. To register send your scouts' name, level and troop number to mdstemfest@gmail.com.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

SANS Orlando 2024 (Orlando (or virtual), Florida, USA, Mar 24 - 29, 2024) At SANS Orlando 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Risk Management Program Evaluation & Optimization Training Course (Vienna, Virginia, USA, Apr 8 - 9, 2024) The training course will be taught on April 8-9, 2024. Students will receive extensive training, knowledge and resources to help them evaluate an Insider Risk Management (IRM) Program, identify gaps and provide cost effective strategies to optimize the program. This training will provide a 360 perspective for detecting Insider Risks / Threats and also covers establishing an Employee Continuous Monitoring & Reporting Program and employee monitoring on computer systems and networks using Insider Threat Detection Tools. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended our training courses and received ITP Manager Certificates. The Insider Threat Defense Group offers the most affordable, advanced / next generation and value packed training for IRM. This provides students with IRM training that is taught from a real world, practical and operational perspective.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.25.24