Russia responsible for more than half of state-sponsored cyberattacks. Chinese influence operation attempts to stir up protests in the US.

Summary

By the CyberWire staff

At a glance.

Russia responsible for more than half of state-sponsored cyberattacks.
Chinese influence operation attempts to stir up protests in the US.
SnapMC launches data theft extortion attacks.

Russia responsible for more than half of state-sponsored cyberattacks.

Microsoft says that Russia has been responsible for 58% of the state-sponsored cyberattacks the company has observed over the past year. These attacks have also been more successful this year, and have increasingly focused on government agencies:

"[A]ttacks from Russian nation-state actors are increasingly effective, jumping from a 21% successful compromise rate last year to a 32% rate this year. Russian nation-state actors are increasingly targeting government agencies for intelligence gathering, which jumped from 3% of their targets a year ago to 53% – largely agencies involved in foreign policy, national security or defense. The top three countries targeted by Russian nation-state actors were the United States, Ukraine and the UK."

Following Russia, the largest number of attacks came from North Korea, Iran, and China. Most of these attacks were focused on espionage, although Iran also launched destructive cyberattacks against Israel and North Korea conducted financially motivated operations against cryptocurrency companies.

Chinese influence operation attempts to stir up protests in the US.

Mandiant Threat Intelligence has observed a Chinese influence campaign that attempted to foment physical protests in the US over claims by Chinese dissident Guo Wengui, former White House Chief Strategist Steve Bannon, and Chinese virologist Dr. Li-Meng Yan, that COVID-19 originated in a Chinese lab. In some instances, the posts shared the apparent home address of Guo Wengui:

"Accounts in the network have actively sought to physically mobilize protesters in the U.S. in response to the COVID-19 pandemic, though we have seen no indication that these attempts motivated any real-world activity. While previous public reporting has highlighted limited instances of organic engagement with the network on Twitter and we have continued to track similar instances of organic engagement on both social media and niche online forums, this direct call for physical mobilization is a significant development compared to prior activity, potentially indicative of an emerging intent to motivate real-world activity outside of China’s territories. While this attempt did not appear to achieve any success, we believe it is critical that observers continue to monitor for such attempts in case greater degrees of organic engagement are later realized by the network."

The campaign had previously been spotted by other observers on Facebook, Twitter, and Instagram, but Mandiant's researchers "have now observed this pro-PRC activity taking place on 30 social media platforms and over 40 additional websites and niche forums, and in additional languages including Russian, German, Spanish, Korean, and Japanese."

SnapMC launches data theft extortion attacks.

NCC Group is tracking a threat actor dubbed "SnapMC" that's opted to forgo ransomware and simply conduct data theft extortion attacks. The threat actor gains access via SQL injection or by exploiting a patched remote code execution vulnerability in Telerik UI for ASPX.NET. After exfiltrating the information, the attackers send an email to the victim with a list of the stolen data, and demand payment within three days.

While many ransomware operators have adopted a dual-extortion approach by stealing data before deploying ransomware, NCC Group believes pure data theft extortion attacks will become more popular:

"NCC Group’s Threat Intelligence team predicts that data breach extortion attacks will increase over time, as it takes less time, and even less technical in-depth knowledge or skill in comparison to a full-blown ransomware attack. In a ransomware attack, the adversary needs to achieve persistence and become domain administrator before stealing data and deploying ransomware. While in the data breach extortion attacks, most of the activity could even be automated and takes less time while still having a significant impact."

Selected Reading

Clean Up in the Digital Aisle: Privacy Concerns with Sobeys Inc. “Caper Carts” System (The Citizen Lab) "Smart"in-store shopping carts, developed by Caper and used by Sobeys, issue electronic receipts via SMS message and share a URL that uses an easily predictable format. These receipts contain a number of personal data points, including the customer’s partial credit/debit/Air Miles card numbers, a full list of purchases, and the date, time, and location of the customer’s purchase.

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms (Cybereason) The highly-targeted attacks against aerospace and telecoms firms by new Iranian threat actor MalKamak includes newly discovered malware that evaded security tools since 2018 and abuses Dropbox services for command and control...

Sophos Researchers Uncover New Python Ransomware Targeting an ESXi Server and Virtual Machines in an Ultra-High-Speed Attack (Sophos) Sophos, a global leader in next-generation cybersecurity, has released details of a new ransomware written in Python that attackers used to compromise and encrypt virtual machines hosted on an ESXi hypervisor

FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets (Mandiant) Today, Mandiant Intelligence is releasing a comprehensive report detailing FIN12, an aggressive, financially motivated threat actor behind prolific ransomware attacks since at least October 2018.

UEFI threats moving to the ESP: Introducing ESPecter bootkit (WeLiveSecurity) ESET researchers discover and analyze ESPecter, a previously undocumented UEFI bootkit with roots that go back all the way to at least 2012.

FontOnLake: Previously unknown malware family targeting Linux (WeLiveSecurity) ESET researchers uncover FontOnLake, a malware family that uses custom and well-designed modules to target operating systems running Linux.

Iran-linked DEV-0343 targeting defense, GIS, and maritime sectors (Microsoft Security Blog) MSTIC has observed DEV-0343 conducting extensive password spraying against more than 250 Office 365 tenants, with a focus on United States and Israeli defense technology companies, Persian Gulf ports of entry, or global maritime transportation companies with business presence in the Middle East.

SnapMC skips ransomware, steals data (Fox-IT International blog) Over the past few months NCC Group has observed an increasing number of data breach extortion cases, where the attacker steals data and threatens to publish said data online if the victim decides n…

Actors Target Huawei Cloud Using Upgraded Linux Malware (Trend Micro) In this article, we discuss a new Linux malware trend in which malicious actors deploy code that removes applications and services present mainly in Huawei Cloud.