Daily Briefing for 03.05.25

At a glance.

• US Treasury Department sanctions Iranian national accused of running the Nemesis criminal marketplace.
• Hunters International threatens to leak data stolen from Tata Technologies.
• Scammers impersonate ransomware gang via snail mail.
• Stealthy malware campaign targets the UAE's aviation and satellite industry.

US Treasury Department sanctions Iranian national accused of running the Nemesis criminal marketplace.

The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned the administrator of the Nemesis darknet marketplace, which was shuttered by law enforcement last year. Treasury says Iranian national Behrouz Parsarad maintained full control of the marketplace and its illicit profits, pocketing millions of dollars while Nemesis was active.

Acting Under Secretary for Terrorism and Financial Intelligence Bradley T. Smith said in a press release, "As the administrator of the Nemesis darknet marketplace, Parsarad sought to build—and continues to try to re-establish—a safe haven to facilitate the production, sale, and shipment of illegal narcotics like fentanyl and other synthetic opioids. Treasury, in partnership with U.S. law enforcement, will use all available tools to dismantle these darknet marketplaces and hold accountable the individuals who oversee them."

Hunters International threatens to leak data stolen from Tata Technologies.

The Hunters International ransomware gang has claimed responsibility for an attack against Tata Technologies, a product engineering subsidiary of Indian auto manufacturing giant Tata Motors. The company disclosed in January that it had sustained a ransomware attack that affected some of its IT systems, SecurityWeek reports. The Hunters gang is threatening to publish 1.4 terabytes of stolen data if a ransom isn't paid by next week.

Hunters hasn't shared what the stolen data contains, and Tata hasn't commented on the gang's claims.

Scammers impersonate ransomware gang via snail mail.

Scammers are impersonating the BianLian ransomware gang and sending physical letters with fake ransom demands to C-suite employees in the US, BleepingComputer reports. The letters inform the recipient that their organization's data has been stolen and will be published if a ransom isn't paid within ten days. The letters contain a QR code leading to a Bitcoin wallet address, and recipients are instructed to pay up to $350,000.

GuidePoint Security, which is tracking the scam, assesses "with a high level of confidence" that the extortion demands are fake and are not tied to the BianLian gang. The security firm hasn't observed any evidence of intrusions at the targeted organizations, and the information in the letters is copied from BianLian's public websites.

Stealthy malware campaign targets the UAE's aviation and satellite industry.

Proofpoint has published a report on a highly targeted phishing campaign that targeted several aviation and satellite communications organizations in the United Arab Emirates, as well as critical transportation infrastructure. The threat actor, which Proofpoint tracks as "UNK_CraftyCamel," compromised an Indian electronics company that had a business relationship with the targets and used this access to send spearphishing emails tailored to each targeted entity. The emails were designed to deliver a custom Go backdoor, which Proofpoint has dubbed "Sosano."

The researchers note, "The campaign used polyglot files to obfuscate payload content, a technique that is relatively uncommon for espionage-motivated actors in Proofpoint telemetry and speaks to the desire of the operator to remain undetected."

Proofpoint doesn't attribute the campaign to any known threat actor, but notes that the TTPs overlap with previous operations tied to Iran's Islamic Revolutionary Guard Corps (IRGC).