By the CyberWire staff
At a glance.
- AT&T discloses breach affecting nearly every customer.
- Advance Auto Parts breach affected 2.3 million job applicants.
- Criminals leak Ticketmaster print-at-home tickets.
- Major online marketplace used to launder scam proceeds.
- APT41 deploys new malware.
- Five Eyes describe techniques used by Chinese threat actors.
- CRYSTALRAY abuses open-source security tools to compromise 1,500 victims.
- OpenAI declined to disclose a previous breach.
- New ransomware-as-a-service offering surfaces.
- Cyberattack disrupts Frankfurt University of Applied Sciences.
- Microsoft to require employees in China to use iPhones.
AT&T discloses breach affecting nearly every customer.
AT&T has disclosed that a threat actor stole phone call and text message records from nearly every AT&T customer (approximately 109 million people) between May and October of 2022. The company stated, "These records identify other phone numbers that an AT&T wireless number interacted with during this time, including AT&T landline (home phone) customers. For a subset of the records, one or more cell site ID numbers associated with the interactions are also included. At this time, we do not believe the data is publicly available. We continue to work with law enforcement in their efforts to arrest those involved. Based on information available to us, we understand that at least one person has been apprehended."
TechCrunch reports that the breach occurred after a threat actor gained access to AT&T's Snowflake cloud storage account. Snowflake hired Mandiant several weeks ago to investigate a widespread hacking campaign targeting Snowflake accounts with stolen credentials, and Mandiant attributed the campaign to the cybercriminal group UNC5537.
Advance Auto Parts breach affected 2.3 million job applicants.
Advance Auto Parts is notifying 2.3 million people that their personal data was stolen after a threat actor breached the company's Snowflake account, BleepingComputer reports. The breach notification states, "Our investigation determined that an unauthorized third party accessed or copied certain information maintained by Advance Auto Parts from April 14, 2024, to May 24, 2024...The personal information about you involved in this incident may include your name and the following: Social Security number, driver’s license or other government issued identification number, and date of birth. This information was collected as part of the Advance Auto Parts job application process."
If you're on the front line, we've got your back.
Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.
What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.
Criminals leak Ticketmaster print-at-home tickets.
BleepingComputer reports that the Sp1derHunters threat actor has leaked nearly 39,000 Ticketmaster print-at-home tickets for 154 upcoming events, including Pearl Jam, Foo Fighters, Billy Joel & Sting, Bruce Springsteen, and Carrie Underwood concerts. The data was allegedly stolen after the crooks breached TicketMaster's Snowflake account.
The threat actors leaked 166,000 Taylor Swift ticket barcodes last week, demanding a $2 million ransom. TicketMaster said these barcodes were useless, since the company's anti-fraud measures refresh ticket codes every few seconds. Sp1derHunters responded by leaking the print-at-home tickets, which they claim can't be automatically rotated.
Major online marketplace used to launder scam proceeds.
Researchers at Elliptic say the multibillion-dollar online marketplace Huione Guarantee is being widely used by scammers for money laundering. Huione Guarantee is a Chinese-language marketplace owned by the Cambodian conglomerate Huione Group. Huinone Guarantee presents itself as a neutral platform for selling legitimate products, but Elliptic says "the majority of the goods and services on offer today appear to be targeted squarely at cyber scam operators."
The researchers explain, "The largest category of merchants operating on Huione Guarantee are those offering to move and exchange money. Many of the merchants explicitly offer money laundering services, including accepting payments from victims around the world, transferring it across borders, and converting it to other assets including cash, stablecoins, and to Chinese payment apps. Most specify the types of fraud proceeds that they are willing to launder, based on the perceived risk of having the funds frozen by financial institutions or law enforcement."
Attention all security professionals! Want real-time IP intelligence at your fingertips?
Sign up for Scout Insight's free trial today! Get immediate insights into threats, search any IP with no training required, and enjoy intuitive graphical results. Whether you need to identify compromised hosts or enrich Splunk queries, Scout Insight has you covered. Don’t wait – accelerate your threat response now. Visit team-cymru.com/cyberwire to start your free trial!
APT41 deploys new malware.
Zscaler has published a report on "DodgeBox," a newly discovered malware loader associated with the China-aligned threat actor APT41. DodgeBox is used to install a new backdoor dubbed "MoonWalk" that uses Google Drive for command-and-control communications.
The researchers state, "DodgeBox, a reflective DLL loader written in C, showcases similarities to StealthVector in terms of concept but incorporates significant improvements in its implementation. It offers various capabilities, including decrypting and loading embedded DLLs, conducting environment checks and bindings, and executing cleanup procedures. What sets DodgeBox apart from other malware is its unique algorithms and techniques."
VirusTotal telemetry suggests the malware has been used to target entities in Thailand and Taiwan, which aligns with APT41's previous targeting.
Five Eyes describe techniques used by Chinese threat actors.
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), and its international partners have issued an alert outlining new attack techniques used by Chinese state-sponsored actors. The advisory describes attacks launched by APT40, a threat actor tied to China's Ministry of State Security, against Australian networks. The ACSC states, "APT40 has embraced the global trend of using compromised devices, including small-office/home-office (SOHO) devices, as operational infrastructure and last-hop redirectors for its operations in Australia....Many of these SOHO devices are end-of-life or unpatched and offer a soft target for N-day exploitation. Once compromised, SOHO devices offer a launching point for attacks to blend in with legitimate traffic and challenge network defenders."
The advisory also notes that "APT40 does occasionally use procured or leased infrastructure as victim-facing C2 infrastructure in its operations; however, this tradecraft appears to be in relative decline."
Streamline Your Identity Management.
IAM experts, integrate any identity service with non-standard apps using Strata. Apply MFA without changing app code and ensure always-on identity availability. Reduce stress and improve security without the headaches of app refactoring. Share your identity challenge and get free AirPods Pro.
CRYSTALRAY abuses open-source security tools to compromise 1,500 victims.
Sysdig has published a report on "CRYSTALRAY," a threat actor that's compromised more than 1,500 victims using a combination of open-source tools, including zmap, asn, httpx, nuclei, platypus, and SSH-Snake. The threat actor's "motivations are to collect and sell credentials, deploy cryptominers, and maintain persistence in victim environments." The researchers note, "Rather than massive internet-wide ipv4 scans or very specific IP targets, CRYSTALRAY creates a range of IPs for specific countries to launch scans with more precision than a botnet, but less precision than an APT or ransomware attack. The United States and China combined for over 54% of the known targets."
OpenAI declined to disclose a previous breach.
The New York Times reports that OpenAI sustained a breach last year that affected an internal employee discussion forum. The company did not disclose the breach externally because the threat actor didn't gain access to any sensitive data. The hacker in this case is believed to be a private individual, but the Times notes that the incident highlights the company's potential vulnerability to state-sponsored threat actors. TechCrunch points out that AI companies are "gatekeepers to a tremendous amount of very valuable data."
New ransomware-as-a-service offering surfaces.
Researchers at Group-IB describe a ransomware-as-a-service offering dubbed "Eldorado" that surfaced in March 2024. The malware is written in Golang, and targets both Windows and Linux systems. The researchers explain, "There are Eldorado versions for Windows (32bit and 64bit) and Linux (32bit and 64bit). The choice of using the Go programming language could be due to its cross-platform capabilities. Go programs’ ability to cross-compile code into native, self-contained binaries could be a reason why malware authors favored developing in Golang."
BleepingComputer says Eldorado "has already claimed 16 victims, most of them in the U.S., in real estate, educational, healthcare, and manufacturing sectors."
Got proof that your SSO and MFA controls are performing their security duty?
The increasing frequency of identity-based attacks highlights the necessity of ensuring your Single Sign-On (SSO) and Multi-Factor Authentication (MFA) systems are functioning as intended. Simply implementing these technologies isn’t sufficient; ongoing verification of their effectiveness is crucial. Savvy provides real-time visibility for performing audits and implementing automated controls, guiding users at scale to address issues before threat actors can exploit them. Discover how Savvy can help you put policy into practice. Learn more.
Cyberattack disrupts Frankfurt University of Applied Sciences.
The Frankfurt University of Applied Sciences in Germany yesterday disclosed a "serious hacker attack" that shut down its IT systems, the Record reports. The university stated, "The extent of the attack cannot yet be estimated at this point in time. Unfortunately, it is therefore not yet possible to say when the IT systems and services will be available again to their usual extent." The incident has affected communications infrastructure and online enrollment. The attack also forced the university to disable elevators in campus buildings.
Microsoft to require employees in China to use iPhones.
Bloomberg reports that Microsoft will require its employees in China to use iPhones for work instead of Androids, in order to ensure that all staff are using the Microsoft Authenticator password manager and Identity Pass app. The Google Play Store is unavailable in China, so Android users rely on a fragmented market of local platforms by Huawei, Xiaomi, and others. Microsoft will provide its workers in China with an iPhone 15 beginning in September. Bloomberg says the move is part of Microsoft’s global Secure Future Initiative.
Patch news.
GitLab has patched a critical vulnerability (CVE-2024-6385) affecting its GitLab Community and Enterprise editions that could allow "an attacker to trigger a pipeline as another user under certain circumstances." The vulnerability was assigned a CVSS severity score of 9.6 out of 10. GitLab stated, "[W]e strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running the patched version."