Skip to content
Contact us

This Week's Cyber Threat Intelligence Update

Picture of Digital Frontier Partners

This week, cybersecurity updates highlighted new malware threats, vulnerabilities, and cyber incidents. Notably, a malware campaign targeting Docker environments for crypto mining continues to threaten cloud infrastructure. The North Korean group Kimsuky exploited the BlueKeep vulnerability, while other North Korean clusters executed phishing attacks on TRON, stealing significant cryptocurrency sums. The emergence of SuperCard X malware, enabling NFC relay attacks in Italy, and the persistent threat of ransomware, such as Fog ransomware, underscore the evolving landscape of cyber threats. Additionally, Proton66, a Russian hosting provider, has been linked to increased malicious activities. In Australia, an individual was arrested for accessing restricted NSW court documents, highlighting local cybersecurity challenges. These incidents emphasize the need for enhanced security frameworks, multifactor authentication, and vigilance against phishing and social engineering tactics.

Vulnerability Report

  1. SAP NetWeaver: A critical vulnerability allows unauthorised remote code execution through unauthenticated file uploads. Immediate patching is urged to mitigate risks.
  2. Storm-1977 Campaign: This threat actor conducts password spraying attacks on educational cloud tenants, compromising guest accounts and mining cryptocurrency in deployed containers.
  3. Craft CMS Zero-Day Exploits: Exploited vulnerabilities in Craft CMS servers necessitate updates and database credential rotations.
  4. DslogdRAT Malware: Deployed via a zero-day vulnerability in Ivanti Connect Secure, highlighting the need for vigilant VPN and secure access updates.
  5. Ruby Web Servers: Critical vulnerabilities in Rack::Static middleware pose threats of unauthorised access, urging updates and security measures.
  6. ToyMaker and CACTUS Ransomware: ToyMaker uses custom malware to infiltrate systems, facilitating ransomware deployments.
  7. NHIs Security Threats: Non-Human Identities like Service Accounts and API keys contribute significantly to cyber risks, urging enhanced machine identity management.
  8. North Korean Interview Campaign: Hackers use fake job interviews to disseminate malware, highlighting the need for rigorous verification processes.
  9. SuperCard X Android Malware: Exploits NFC capabilities on Android devices for fraud, emphasizing user awareness about permissions and download sources.
  10. Elusive Comet Group: Targets cryptocurrency professionals using Zoom for remote access manipulation, necessitating reinforced security protocols.
  11. Marks & Spencer Cyberattack: A significant cyberattack led to a temporary halt of online operations, underscoring vulnerabilities in retail cybersecurity.

Categories of Cyber Threats

  • Cyber Attacks and Breaches: North Korean actors stole $137 million from TRON users, and the China-linked Lotus Panda group breached Southeast Asian organisations. Marks & Spencer paused online services after a significant cyberattack.
  • New Malware and Exploits: Phishing campaigns leveraging Google Sites and DKIM replay techniques, North Korean hackers stealing from TRON users, and the emergence of SuperCard X malware.
  • Vulnerabilities in Software and Systems: Critical vulnerabilities in Schneider Electric's Modicon Controllers, SAP NetWeaver, and ASUS routers with AiCloud.
  • Cyber Threats to Financial and Banking Systems: Sophisticated threats targeting financial systems, including phishing schemes and malware exploiting NFC relay attacks.
  • Nation-State Cyber Espionage and Cybercrime Activities: North Korean hackers exploiting BlueKeep, Chinese-affiliated Lotus Panda targeting Southeast Asian entities, and Russian threat actors linked to global exploitation attempts.

Conclusion

The evolving landscape of cyber threats demands constant vigilance and proactive measures. Organisations must prioritise updating their security frameworks, adopting multifactor authentication, and maintaining awareness of emerging threats. Collaboration across sectors is essential to effectively combat the diversified and sophisticated nature of cyber threats. Stay informed, stay secure.