Iranian threat actors target the IT supply chain. North Korean cyberespionage. More information on Emotet's return.

Iranian threat actors target the IT supply chain. North Korean cyberespionage. RedCurl continues conducting corporate cyberespionage. More information on Emotet's return.

Summary

By the CyberWire staff

At a glance.

Iranian threat actors target the IT supply chain.
North Korean cyberespionage.
RedCurl continues conducting corporate cyberespionage.
More information on Emotet's return.

Iranian threat actors target the IT supply chain.

Microsoft's Threat Intelligence Center (MSTIC) warns of an increase in Iranian actors targeting companies in the IT supply chain, particularly in India:

"In July 2021, a group that MSTIC tracks as DEV-0228 and assesses as based in Iran compromised a single Israel-based IT company that provides business management software. Based on MSTIC’s assessment, DEV-0228 used access to that IT company to extend their attacks and compromise downstream customers in the defense, energy, and legal sectors in Israel. In September, we detected a separate Iranian group, DEV-0056, compromising email accounts at a Bahrain-based IT integration company that works on IT integration with Bahrain Government clients, who were likely DEV-0056’s ultimate target. DEV-0056 also compromised various accounts at a partially government-owned organization in the Middle East that provide information and communications technology to the defense and transportation sectors, which are targets of interest to the Iranian regime. DEV-0056 maintained persistence at the IT integration organization through at least October."

Microsoft adds, "MSTIC detected a significant increase in these and other Iranian groups targeting IT companies based in India beginning in mid-August. From mid-August to late September, we issued 1,788 nation state notifications (NSNs) across Iranian actors to enterprise customers in India, roughly 80% of which were to IT companies, an exponential rise from the 10 notifications we issued the previous three years in response to previous Iranian targeting. Iranian cyber actors have rarely targeted India, and the lack of pressing geopolitical issues that would have prompted such a shift suggests that this targeting is for indirect access to subsidiaries and clients outside India."

North Korean cyberespionage.

Proofpoint has published a report on TA406, one of three threat actors that Proofpoint tracks under the umbrella of the North Korean threat group Kimsuky (also known as Thallium or Konni Group). The researchers say the group conducts both cyberespionage and financially motivated attacks, including cryptocurrency theft and sextortion. Proofpoint stated, "In early 2021, TA406 began almost weekly campaigns featuring themes that included nuclear weapon safety, U.S. President Joe Biden, Korean foreign policy and other political themes. The group attempted to collect credentials, such as Microsoft logins or other corporate credentials, from the targeted individuals. In some cases, the emails were benign in nature; these messages may have been attempts by the attackers to engage with victims before sending them a malicious link or attachment."

RedCurl continues conducting corporate cyberespionage.

Group-IB is tracking a threat actor dubbed "RedCurl" that's conducting corporate cyberespionage. The threat actor has attacked a Russian wholesale company and two other unknown companies since the beginning of 2021. The researchers note that the group is stealthy and focuses solely on data theft rather than ransomware or extortion:

"Group-IB has noted that despite a high level of control over the victim’s network, RedCurl does not encrypt infrastructure, withdraw money from accounts, or demand ransoms for stolen data. This most likely indicates that the group monetizes on its attacks in a different way. The group strives to obtain valuable information as covertly as possible. RedCurl is mainly interested in the following types of files: business emails, staff records, documents relating to various legal entities, court records, and other internal information. Even after the attack has ended, victims could remain unaware that confidential information has been exfiltrated to RedCurl's servers."

More information on Emotet's return.

Researchers at AdvIntel offer details on the reappearance of the Emotet Trojan and botnet, noting that former members of the Ryuk ransomware gang (many of whom are now believed to operate the Conti ransomware) pushed Emotet's operators to rebuild their infrastructure:

"AdvIntel's visibility into the adversary space enables us to confirm that it was the former Ryuk members who were able to convince former Emotet operators to set up a backend and a malware builder from the existing repository project to return to business in order to restore the TrickBot-Emotet-Ryuk triad. This partnership enables the Conti syndicate to answer the unfulfilled demand for initial accesses on an industrial scale, while competitor groups such as LockBit or HIVE will need to rely on individual low-quality access brokers. As a result, Conti can further advance their goal of becoming a ransomware monopolist."

Selected Reading

Identifying hacker Pompompurin: Fallout from the FBI email server hoax (Shadowbyte) The blog provides identification and attribution for the hacker Pompompurin, who is responsible for hacking the FBI email server, and more.

Complaining about Canada’s alleged failure to extradite someone makes no sense when there’s no request to extradite (DataBreaches.net) Yesterday, DataBreaches.net reported on a hoax email sent from a government system by an individual who calls himself “Pompompurin” on Twitter...

Observing Attacks Against Hundreds of Exposed Services in Public Clouds (Unit42) Insecurely exposed services are common misconfigurations in cloud environments. We used a honeypot infrastructure to learn about attacks against them.

The awakening: Group-IB uncovers new corporate espionage attacks by RedCurl (Group-IB) Group-IB, one of the leading solution providers dedicated to detecting and preventing cyberattacks, identifying online fraud, investigating high-tech crimes, and intellectual property protection, detected new attacks by RedCurl, a corporate cyber espionage threat actor targeting companies in various industries. Group-IB’s latest report «RedCurl: The awakening» details how the adversary’s tactics and tools have evolved. Since the beginning of 2021, RedCurl has carried out four attacks, bringing the total count to 30.

RAMP Ransomware’s Apparent Overture to Chinese Threat Actors (Flashpoint) RAMP forum returns—but to what end? Flashpoint has observed an increase in recent weeks of Mandarin and Chinese-speaking threat actors on RAMP as well as

Groups Target Alibaba ECS Instances for Cryptojacking (Trend Micro) We looked at how some malicious groups disable features in Alibaba Cloud ECS instances for illicit mining of Monero.

New ransomware actor uses password-protected archives to bypass encryption protection (Sophos News) Calling themselves “Memento team”, actors use Python-based ransomware that they reconfigured after setbacks.

New Aggah Campaign Hijacks Clipboards to Replace Cryptocurrency Addresses (RiskIQ) Aggah is a threat group known for espionage and information theft worldwide, as well as its deft use of free and open-source infrastructure to conduct its attacks. We've recently reported that the group is linked with the Mana Tools malware distribution and command and control (C2) panel. RiskIQ recently identified a new Aggah campaign via our global monitoring of malicious VBScript code posted on websites.

Linux malware agent hits eCommerce sites (Sansec) Sansec discovered a new malicious agent “linux_avp” that hides as system process on eCommerce servers. It is being deployed around the world since last week and takes commands from a control server in Beijing.

Fake Ransomware Infection Spooks Website Owners (Sucuri) Starting this past Friday we have seen a number of websites showing a fake ransomware infection. Google search results for “FOR RESTORE SEND 0.1 BITCOIN” were sitting at 6 last week and increased to 291 at the time of writing this. Upon visiting their website webmasters have been met with an alarming message:

Corporate Loader "Emotet": History of "X" Project Return for Ransomware (AdvIntel) By Yelisey Boguslavskiy & Vitali Kremez AdvIntel deep-dives into the contemporary threat landscape illustrating how Emotet’s return might re-shift the ransomware ecosystem. Executive Summary - Why Corporate Loader Returned? The November 14, return of Emotet (project "X" internally) correlates with two long-term developments in the ransomware ecosystem: 1) unfulfilled loader commodity demand 2) decline of the decentralized RaaS (Ransomware-as-a-Service) model, and the return of the monopoly of or

Uncovering MosesStaff techniques: Ideology over Money (Check Point Research) Introduction In September 2021, the hacker group MosesStaff began targeting Israeli organizations, joining a wave of attacks which was started about a year ago by the Pay2Key and BlackShadow attack groups. Those actors operated mainly for political reasons in attempt to create noise in the media and damage the country’s image, demanding money and conducting... Click to Read More

SkyFail. 6 million routers left exposed | Pen Test Partners (Pen Test Partners) Sky broadband had a significant security flaw in around 6 million of their customer routers that would allow remote compromise of home networks. When informed about it, they took nearly […]

BrazKing Android Malware Upgraded and Targeting Brazilian Banks (Security Intelligence) IBM Trusteer researchers found the BrazKing Android malware has new tactics. See how it infects and hides in phones that use Brazilian banking apps.

Triple Threat: North Korea-Aligned TA406 Scams, Spies, and Steals (Proofpoint) Throughout 2021, the North Korea-aligned threat actor TA406 conducted frequent credential theft campaigns targeting research, education, government, media and other organizations.