Lebanese threat actor targets Israeli organizations. LuoYu launches man-on-the-side-attacks.

Announcement

Control Loop: the CyberWire and Dragos announce a new podcast covering industrial infrastructure security.

The CyberWire and Dragos, Inc. announced last week the launch of Control Loop, a new podcast and newsletter covering operational technology (OT) and industrial control systems (ICS) security. With the aim of bringing attention to industrial cybersecurity, Control Loop is an informative and educational resource for the international community of infrastructure operators and security professionals. Control Loop is a collaboration between cybersecurity news leader the CyberWire, and Dragos, the global leader in cybersecurity solutions for industrial infrastructure. New episodes will launch every two weeks; check out the first episode now. The first newsletter publishes next week with new editions every month. Listen and subscribe to the podcast wherever you get your favorite shows and subscribe to the newsletter on the CyberWire website.

Summary

By the CyberWire staff

At a glance.

Lebanese threat actor targets Israeli organizations.
LuoYu launches man-on-the-side-attacks.

Lebanese threat actor targets Israeli organizations.

Microsoft says a previously little-observed Lebanese threat actor dubbed "POLONIUM" is coordinating with Iran’s Ministry of Intelligence and Security (MOIS) to target Israeli entities in the critical manufacturing, IT, and defense industries. The threat actor used legitimate OneDrive accounts as command-and-control platforms, and the researchers suspect that the actor gained initial access to victims' networks by exploiting CVE-2018-13379 in unpatched Fortinet devices:

"MSTIC assesses with high confidence that POLONIUM represents an operational group based in Lebanon. We also assess with moderate confidence that the observed activity was coordinated with other actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based primarily on victim overlap and commonality of tools and techniques. Such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the Government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability.

"POLONIUM has targeted or compromised more than 20 organizations based in Israel and one intergovernmental organization with operations in Lebanon over the past three months. This actor has deployed unique tools that abuse legitimate cloud services for command and control (C2) across most of their victims. POLONIUM was observed creating and using legitimate OneDrive accounts, then utilizing those accounts as C2 to execute part of their attack operation. This activity does not represent any security issues or vulnerabilities on the OneDrive platform. In addition, MSTIC does not, at present, see any links between this activity and other publicly documented groups linked to Lebanon like Volatile Cedar."

LuoYu launches man-on-the-side-attacks.

Researchers at Kaspersky have published a report on LuoYu, an "extremely sophisticated" threat actor that primarily targets Chinese entities, including "foreign diplomatic organizations established in the country, members of the academic community, or companies from the defense, logistics and telecommunications sectors." Most notably, the threat actor is using a malware platform dubbed "WinDealer" that randomly chooses between one of 48,000 IP addresses for its command-and-control server:

"It is very hard to believe that an attacker would be able to control the 48,000 IP addresses of the aforementioned IP ranges, or even a significant portion of them. The only way to explain these seemingly impossible network behaviors is by assuming the existence of a man-on-the-side attacker who is able to intercept all network traffic and even modify it if needed. Such capabilities are not unheard of: the QUANTUM program revealed in 2014 was the first known instance."

Kaspersky offers the following thoughts on how LuoYu was able to pull this off:

"We can only speculate as to how they were able to obtain such capabilities. They could have compromised routers on the route to (or inside) AS4134. Alternatively, they may use signals intelligence methods unknown to the general public. They may even have access (legitimate or fraudulent) to law enforcement tools set up at the ISP level and are abusing them to perform offensive operations. Overall, a threat actor is leveraging capabilities that could be compared (but are distinct) from the QUANTUMINSERT program in order to infect targets located in China."

Selected Reading

“Follina”- Zero-day vulnerability in Microsoft Office (Check Point Software) On May 30th researchers revealed “Follina” - a zero-day vulnerability in Microsoft Office that if exploited by using a malicious word document, might enable code execution on a victim’s machine.

Shining the Light on Black Basta (NCC Group Research) This blog post documents some of the TTPs employed by a threat actor group who were observed deploying Black Basta ransomware during a recent incident response engagement, as well as a breakdown of…

WinDealer dealing on the side (Securelist) We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

Vulnerability within the UNISOC baseband opens mobile phones communications to remote hacker attacks (Check Point Research) Research by: Slava Makkaveev Introduction Do you remember push-button telephones? Many of them were based on chips from Spreadtrum Communications Inc., a Chinese chip manufacturer founded in 2001. In 2011, over half of all phones in China were powered by Spreadtrum chips. In 2018, Spreadtrum rebranded itself as UNISOC. Today, the manufacturer produces budget chipsets that... Click to Read More

Threat Actors Prey on Eager Travelers (Fortinet Blog) With travel becoming more frequent, it is essential for travelers to understand that malicious actors are also eager to leverage travel as an opportunity to deliver malware. Read our blog to learn …

Popping Eagle: How Global Analytics Uncovered a Stealthy Threat Actor (Unit42) We observed a specially crafted DLL hijacking attack used by a previously unknown piece of malware that we dubbed Popping Eagle.

Analysis of the Massive NDSW/NDSX Malware Campaign (Sucuri Blog) A detailed analysis of the notable ongoing NDSW/NDSX malware infection with steps on how to identify and clean up the malware from a compromised website.

Zero-Day Exploitation of Atlassian Confluence (Volexity) UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to mitigate their risk. Additional observations after publication of this blog post have been shared here, with guidance on how to verify if you have been impacted by unauthorized access.

Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation (Cisco Talos) A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

CVE-2022-26134 Threat Brief: Atlassian Confluence RCE Vulnerability (Unit42) CVE-2022-26134 Threat Brief: We analyze the vulnerability, share statistics on potentially vulnerable servers and suggest mitigations.