At a glance.
- China's Salt Typhoon campaign may have impacted every American.
- Extortion group claims responsibility for Jaguar Land Rover attack.
- XWorm RAT grows stealthier.
China's Salt Typhoon campaign may have impacted every American.
The New York Times reports on the significance of China's Salt Typhoon campaign, noting that the cyberespionage operation may have gathered information on every American. Cynthia Kaiser, the FBI's former Deputy Assistant Director who oversaw an investigation into Salt Typhoon, told the Times that the scope of the campaign was much broader than typical cyberespionage activity. The widespread operation swept up information from "telecommunications, government, transportation, lodging, and military infrastructure networks."
Western allies—including the US, UK, Canada, Finland, Germany, Italy, Japan, and Spain—issued a "name-and-shame" statement on Salt Typhoon last week, linking the activity to several Chinese technology companies that provide services to Beijing's People's Liberation Army and Ministry of State Security.
Extortion group claims responsibility for Jaguar Land Rover attack.
A criminal collective calling itself "Scattered Lapsus$ Hunters" has claimed responsibility for a disruptive attack against Jaguar Land Rover (JLR), the BBC reports. The hackers, who are thought to be English-speaking teenagers, chose the name due to their prior associations with the criminal groups Shiny Hunters, Lapsus$, and Scattered Spider. The group is attempting to extort JLR as they brag about the hack on Telegram. The BBC notes that the UK's National Crime Agency recently arrested four alleged Scattered Spider members accused of hacking M&S, Co-op, and Harrods earlier this year.
JLR is still working to recover operations at its two primary plants in the UK. The Telegraph reports that more than a million drivers are unable to get repairs as dealerships cannot obtain parts for Jaguar or Land Rover vehicles.
XWorm RAT grows stealthier.
Trellix has published a report on the evolution of the XWorm backdoor's infection chain, noting "a deliberate move towards more deceptive and intricate methods." The researchers explain, "The XWorm malware infection chain has evolved to include additional techniques beyond traditional email-based attacks. While email and .lnk files remain common initial access vectors, XWorm now also leverages legitimate-looking .exe filenames to disguise itself as harmless applications, exploiting user and system trust. This marks a shift towards combining social engineering with technical attack vectors for greater effectiveness."
