Reader

Country: Islamic Republic of Iran Organization: Ministry of Intelligence and Security (MOIS) Objective: Espionage, Sabotage (Page last updated September 12, 2024)

Aliases (sorted alphabetically):

• APT34 (Check Point Research, FireEye, Intezer, NSFOCUS, Trend Micro)
• CHRYSENE (Dragos)
• Cobalt Gypsy (Secureworks) (primary)
• Cobalt Lyceum (Secureworks)
• Crambus (Symantec)
• Europium (previously used by Microsoft)
• Greenbug (ClearSky, Symantec)
• Hazel Sandstorm (Microsoft)
• Helix Kitten (CrowdStrike, Wikipedia)
• HEXANE (Dragos) (linked to Lyceum by Kaspersky)
• ITG13 (IBM)
• Lyceum (Kaspersky, Secureworks)
• OilRig (ClearSky, Cyble, EDTA, ESET, Kaspersky, Malpedia, MITRE, Unit 42)
• TA452 (Proofpoint)
• TG-2889 (formerly used by Secureworks)
• Yellow Maero (PwC

Sub-group:

• DEV-0842 (Microsoft)
• DEV-0861 (Microsoft) / Scarred Manticore (Check Point Research)
• DEV-0166 (Microsoft) / IntrudingDivisor (Unit 42)
• DEV-0133 (Microsoft)

Known Associates

• Mojtaba Mostafavi. Source: U.S. Treasury (linked by PwC, via Lab Dookhtegan leaks)
• Farzin Karimi Mazlganchai: PwC

Vulnerabilities Exploited

• CVE-2019-0604 (CVE, NVD. CVSSv3.1: 9.8 critical, in CISA's KEV Catalog) Microsoft SharePoint Remote Code Execution Vulnerability Source: Microsoft
• CVE-2017-11882 (CVE, NVD. CVSSv3.1: 7.8 high, in CISA's KEV Catalog) Microsoft Office Memory Corruption Vulnerability Source: Mandiant
• CVE-2017-0199 (CVE, NVD, CVSS3v1: 7.8 high, in CISA's KEV Catalog) Microsoft Office and WordPad Remote Code Execution Vulnerability Source: Unit 42

Tactics, Techniques, and Procedures (TTPs)

• Enterprise TTPs mapped to MITRE ATT&CK Navigator Layers
• Industrial Control System (ICS) TTPs mapped to MITRE ATT&CK Navigator Layers

Known Tools Used

As listed by MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

• September 11, 2024 – Check Point Research: Targeted Iranian Attacks Against Iraqi Government Infrastructure

2023

• December 20, 2023 – Security Scorecard: A detailed analysis of the Menorah malware used by APT34
• December 14, 2023 – ESET: OilRig’s persistent attacks using cloud service-powered downloaders
• October 31, 2023 – Check Point Research: From Albania to the Middle East: The Scarred Manticore is Listening (AFFILIATED WITH MOIS)
• October 19, 2023 – Symantec: Crambus: New Campaign Targets Middle Eastern Government
• September 29, 2023 – Trend Micro: APT34 Deploys Phishing Attack With New Malware
• September 21, 2023 – ESET: OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes
• August 30, 2023 – NSFOCUS: APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan
• May 09, 2023 – ESET: ESET APT Activity Report Q4 2022­–Q1 2023, specifically on page 8 in PDF (PDF)
• May 08, 2023 – Kaspersky: Kaspersky experts warn of increased IT supply chain attacks by OilRig APT in the Middle East and Turkiye
• February 02, 2023 – Trend Micro: New APT34 Malware Targets The Middle East

2022

• September 08, 2022 – Microsoft: Microsoft investigates Iranian attacks against the Albanian government (ATTRIBUTION TO MOIS)
• May 10, 2022 – Malwarebytes: APT34 targets Jordan Government using new Saitama backdoor

2021

• October 18, 2021 – Kaspersky: Lyceum group reborn
• April 08, 2021 – Check Point Research: Iran’s APT34 Returns with an Updated Arsenal

2020

• July 22, 2020 – Unit 42: OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
• May 19, 2020 – Symantec: Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia
• March 02, 2020 – Telsy: APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants
• January 30, 2020 – Intezer: New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset

2019

• December 17, 2019 – Kaspersky: OilRig’s Poison Frog – old samples, same trick
• December 04, 2019 – IBM: New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East
• November 09, 2019 – NSFOCUS: APT34 Event Analysis Report
• August 27, 2019 – Secureworks: LYCEUM Takes Center Stage in Middle East Campaign
• July 18, 2019 – FireEye: Hard Pass: Declining APT34's Invite to Join Their Professional Network
• July 16, 2019 – BGD e-GOV CIRT (Bangladesh): [DNSPIONAGE] – FOCUS ON INTERNAL ACTIONS
• May 15, 2019 – Proofpoint: Threat Actor Profile: TA542, From Banker to Malware Distribution Service
• May 06, 2019 – NSFOCUS: Analysis of File Disclosure by APT34
• April 30, 2019 – Unit 42: Behind the Scenes with OilRig
• April 16, 2019 – Unit 42: DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling

2018

• November 27, 2018 – Cisco Talos: DNSpionage Campaign Targets Middle East (attributed by FireEye on July 18, 2019)
• November 16, 2018 – Unit 42: Analyzing OilRig's Ops Tempo from Testing to Weaponization to Delivery
• September 12, 2018 – Unit 42: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
• September 04, 2018 – Unit 42: OilRig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE
• July 25, 2018 – Unit 42: OilRig Targets Technology Service Provider and Government Agency with QUADAGENT
• February 23, 2018 – Unit 42: OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
• February 23, 2018 – Booz Allen: Researchers Discover New variants of APT34 Malware
• January 25, 2018 – Unit 42: OilRig uses RGDoor IIS Backdoor on Targets in the Middle East

2017

• December 15, 2017 – Unit 42: Introducing the Adversary Playbook: First up, OilRig
• December 11, 2017 – Unit 42: OilRig Performs Tests on the TwoFace Webshell
• December 07, 2017 – FireEye: New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit
• November 08, 2017 – Unit 42: OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
• October 24, 2017 – ClearSky: Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies
• October 09, 2017 – Unit 42: OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
• September 26, 2017 – Unit 42: Striking Oil: A Closer Look at Adversary Infrastructure
• August 28, 2017 – ClearSky: Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug
• July 27, 2017 – Unit 42: OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
• July 27, 2017 – Secureworks: The Curious Case of Mia Ash: Fake Persona Lures Middle Eastern Targets
• April 27, 2017 – Unit 42: OilRig Actors Provide a Glimpse into Development and Testing Efforts
• March 31, 2017 – LogRhythm Labs: OilRig Campaign Analysis (PDF, TLP:WHITE)
• February 15, 2017 – Secureworks: Iranian PupyRAT Bites Middle Eastern Organizations
• January 05, 2017 – ClearSky: Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford

2016

• October 04, 2016 – Unit 42: OilRig Malware Campaign Updates Toolset and Expands Targets
• May 26, 2016 – Unit 42: The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor

2015

• October 07, 2015 – Secureworks: Hacker Group Creates Network of Fake LinkedIn Profiles

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Back after vacation – My weekly shortlist of cyber security highlights. (maybe I'll even redo the skipped weeks 😏) The short summaries are AI generated! If something is wrong, please let me know.

---

News For All

🕵️‍♂️ Ausweiskopie und persönliche Daten an Kriminelle weitergegeben? Das können Sie tun security news – Criminals exploit job offers and ads to steal personal data and ID copies, leading to identity theft, fraudulent accounts, and potential legal consequences for victims. https://www.watchlist-internet.at/news/umgang-mit-datendiebstahl/

✈️ SQL Injection Attack on Airport Security vulnerability – A serious SQL injection vulnerability allows unauthorized users to bypass airport security checks, risking safety by granting access to restricted areas like cockpits. https://www.schneier.com/blog/archives/2024/09/sql-injection-attack-on-airport-security.html

🛫 German air traffic control agency confirms cyberattack, says operations unaffected security news – Germany's air traffic control agency confirmed a cyberattack affecting administrative systems but assured that flight safety remains intact and operations were not disrupted. https://therecord.media/german-air-traffic-control-company-deutsche-flugsicherung-cyberattack

🚍 Transport for London (TfL) is dealing with an ongoing cyberattack security news – TfL is investigating a cyberattack affecting internal systems but reports no evidence of customer data compromise, assuring that services remain unaffected. https://securityaffairs.com/167946/hacking/transport-for-london-tfl-ongoing-cyberattack.html

🔑 Owners of 1-Time Passcode Theft Service Plead Guilty cybercrime – Three men pleaded guilty for operating OTP Agency, a service that intercepted one-time passcodes for account takeovers, affecting over 12,500 victims before its shutdown. https://krebsonsecurity.com/2024/09/owners-of-1-time-passcode-theft-service-plead-guilty/

🦠 Disinfo group Spamouflage more aggressively targeting U.S. elections, candidates cybercrime – The disinformation group Spamouflage has intensified efforts to impersonate U.S. voters, undermining political candidates and institutions, though its impact on engagement remains limited. https://cyberscoop.com/spamouflage-targeting-us-election-candidates/

📸 Sextortion Scams Now Include Photos of Your Home – Krebs on Security cybercrime – Sextortion scams are evolving, now featuring personalized threats with photos of victims' homes, increasing fear and urgency to pay ransoms, often near $2,000 in Bitcoin. https://krebsonsecurity.com/2024/09/sextortion-scams-now-include-photos-of-your-home/

💰 Data watchdog fines Clearview AI $33M privacy – The Dutch Data Protection Authority fined Clearview AI €30.5 million for illegally collecting images without consent, stating the company's practices violate GDPR and threaten individual privacy. https://www.theregister.com/2024/09/03/clearview_ai_dutch_fine/

🔒 Google releases Pixel update to get rid of surveillance vulnerability vulnerability – Google's latest Pixel update removes the insecure Showcase.apk, originally intended for Verizon demos, which posed risks of man-in-the-middle attacks and spyware, ensuring enhanced device security. https://www.theverge.com/2024/9/3/24235127/google-pixel-showcase-vulnerability-patch

🔑 YubiKeys have an unfixable security flaw — but it’s difficult to exploit vulnerability – A vulnerability in older YubiKey devices allows cloning but is hard to exploit, requiring physical access and additional knowledge. Devices prior to firmware version 5.7 remain permanently affected. https://www.theverge.com/2024/9/4/24235635/yubikey-unfixable-security-vulnerability-side-channel-explot

🚨 846 routers are affected by code execution flaws. Replace them! vulnerability – D-Link's discontinued DIR-846 routers are vulnerable to multiple critical remote code execution flaws (CVSS scores up to 9.8). Users are advised to replace these devices as they are no longer supported. https://securityaffairs.com/168041/security/d-link-dir-846-routers-code-execution-flaws.html

☢️ Zyxel warns of vulnerabilities in a wide range of its products vulnerability – Zyxel has disclosed nearly a dozen vulnerabilities across its products, with the most critical (CVE-2024-7261) allowing unauthenticated OS command execution, rated 9.8. Users are urged to patch immediately. https://arstechnica.com/?p=2047312

🗳️ Biden cracks down on Putin's election meddling cybercrime – The Biden administration seized 32 websites linked to Russian propaganda efforts and charged two RT employees in a $10 million scheme to influence the upcoming U.S. presidential election. https://www.theregister.com/2024/09/05/biden_cracks_down_on_putins/

🎣 Warning Against Phishing Emails Impersonating Netflix warning – AhnLab warns of phishing emails posing as Netflix, claiming payment failures and urging users to update payment methods via malicious links. Users are advised to verify URLs before clicking. https://asec.ahnlab.com/en/82969/

⚡ Quishing, an insidious threat to electric car owners security news – Quishing is a phishing attack using counterfeit QR codes at electric car charging stations to steal sensitive information. Users are urged to use recharge cards and verify URLs to protect against scams. https://securityaffairs.com/168059/hacking/quishing-electric-car-owners.html

♀️ New report shows ongoing gender pay gap in cybersecurity security news – The ISC2 Cybersecurity Workforce Study reveals a persistent gender pay gap in cybersecurity, with men earning more than women, and highlights the underrepresentation of women in the field, emphasizing the need for targeted DEI hiring initiatives. https://securityintelligence.com/articles/new-report-shows-gender-pay-gap-in-cybersecurity/

🦠 Predator spyware resurfaces with signs of activity, Recorded Future says security news – Recorded Future reports renewed activity from Predator spyware, linked to Intellexa, with new infrastructure identified and potential customers in Angola, Saudi Arabia, and the Democratic Republic of the Congo. https://cyberscoop.com/predator-spyware-resurfaces-with-signs-of-activity-recorded-future-says/

🔎 Colombian president suggests prior administration illegally sent $11 million in cash to Israel for spyware security news – Colombian President Gustavo Petro announced an investigation into $11 million allegedly used by the previous administration to purchase Pegasus spyware, questioning the legality of the transactions. https://therecord.media/colombian-president-pegasus-spyware-israel-missing-money

📎 Telegram changes its tone on moderating private chats after CEO’s arrest security news – Following CEO Pavel Durov's arrest, Telegram revised its FAQ to allow reporting of illegal content in private chats, shifting from a previous stance of non-cooperation with moderation requests. https://www.theverge.com/2024/9/5/24237254/telegram-pavel-durov-arrest-private-chats-moderation-policy-change

🛋️ Therapy Sessions Exposed by Mental Health Care Firm’s Unsecured Database data breach – Confidant Health inadvertently exposed sensitive patient data, including therapy session recordings, due to an unsecured database. The incident highlights the urgent need for improved data security in healthcare organizations. https://www.wired.com/story/confidant-health-therapy-records-database-exposure/

🔓 Hackers Threaten to Leak Planned Parenthood Data cybercrime – RansomHub ransomware group claims to have hacked Planned Parenthood's Montana branch, threatening to leak 93 GB of sensitive data after a cybersecurity incident was reported on August 28. https://www.wired.com/story/hackers-threaten-to-leak-planned-parenthood-data/

---

Some More, For the Curious

🔍 Most interesting IR cases in 2023: insider threats and more security research – Kaspersky's Global Emergency Response Team highlights 2023's notable incident response cases, including insider fraud and advanced persistent threats, emphasizing the need for enhanced monitoring and threat intelligence. https://securelist.com/incident-response-interesting-cases-2023/113611/

🔒 Vulnerabilities in Microsoft apps for macOS allow stealing permissions vulnerability – Eight vulnerabilities in Microsoft apps for macOS could enable attackers to steal permissions, allowing unauthorized access to sensitive resources like cameras and microphones without user knowledge. https://securityaffairs.com/167973/hacking/microsoft-apps-for-macos-flaws.html

🛑 VMWare releases Fusion vulnerability with 8.8 rating vulnerability – A critical vulnerability in VMWare Fusion (CVE-2024-38811) allows code execution with standard user privileges, rated 8.8 on the CVSS scale, prompting a software patch. https://cyberscoop.com/vmware-vulnerability-fushion-cve-2024-38811/

💻 Rust in Linux lead retires rather than deal with more “nontechnical nonsense” security news – Wedson Almeida Filho, leader of the Rust for Linux project, retires citing frustration with nontechnical disputes, expressing concern that the Linux kernel must embrace memory-safe languages like Rust to remain relevant. https://arstechnica.com/?p=2046763

🧬 Evolution of Mallox: from private ransomware to RaaS security research – Mallox ransomware has evolved from targeted attacks to a Ransomware-as-a-Service model, with over 700 samples identified. Its affiliate program seeks experienced partners for cybercrime, indicating a shift in operational strategy. https://securelist.com/mallox-ransomware/113529/

🐍 Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk security research – The 'Revival Hijack' technique allows attackers to reclaim deleted PyPI packages, risking 22,000 packages and potentially leading to malicious downloads. JFrog has taken action to protect the community. https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/

📃 Validate your Windows Audit Policy Configuration with KQL cyber defense – Ensuring proper configuration of Windows audit policies is essential for security. This article discusses using Kusto Query Language (KQL) to validate and troubleshoot audit policy application across environments. https://blog.nviso.eu/2024/09/05/validate-your-windows-audit-policy-configuration-with-kql/

🦗 Cicada Ransomware – What You Need To Know security news – Cicada ransomware, discovered in June 2024, has targeted over 20 organizations primarily in North America and the UK. Written in Rust, it threatens to publish stolen data unless a ransom is paid. https://www.tripwire.com/state-of-security/cicada-ransomware-what-you-need-know

🪅 Veeam fixed a critical flaw in Veeam Backup & Replication software vulnerability – Veeam patched 18 high and critical vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVE-2024-40711) with a CVSS score of 9.8, requiring immediate attention. https://securityaffairs.com/168088/security/veeam-backup-replication-cve-2024-40711.html

🧱 SonicWall warns that SonicOS bug exploited in attacks vulnerability – SonicWall alerts users of a critical access control vulnerability (CVE-2024-40766) in SonicOS that may be actively exploited, urging immediate patching to prevent unauthorized access and potential firewall crashes. https://securityaffairs.com/168112/hacking/sonicwall-sonicos-bug-exploited.html

🔧 Building a Hardware Hacking Arsenal: The Right Bits for Every Byte security research – This article outlines essential tools for hardware hacking, emphasizing cost-effective options that support learning and experimentation in security assessments. Safety and accessibility are also highlighted. https://www.guidepointsecurity.com/blog/building-a-hardware-hacking-arsenal-the-right-bits-for-every-byte/

---

CISA Corner

⚠️ LOYTEC Electronics LINX Series vulnerability – Multiple vulnerabilities in LOYTEC's LINX series devices could allow attackers to exploit sensitive information and gain unauthorized access, with high CVSS scores indicating significant risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog vulnerability – CISA has added three vulnerabilities, including two in Draytek VigorConnect and one in Kingsoft WPS Office, to its catalog due to active exploitation risks for federal networks. https://www.cisa.gov/news-events/alerts/2024/09/03/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – On September 5, 2024, CISA released four advisories addressing security vulnerabilities in various Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2024/09/05/cisa-releases-four-industrial-control-systems-advisories

⚔️ Russian Military Cyber Actors Target US and Global Critical Infrastructure security news – The FBI, CISA, and NSA report that Russian GRU Unit 29155 is behind ongoing cyber operations targeting critical infrastructure, utilizing tools like WhisperGate malware and exploiting various vulnerabilities since at least 2020. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

Country: People's Republic of China Organization: Loosely connected private contractors operating on behalf of China’s Ministry of State Security (MSS). Some have worked at Chengdu 404 Network Technology Objective: Espionage, Information theft, Financial crime (Page last updated: September 08, 2024)

Aliases (sorted alphabetically):

• APT41 (FBI, CISA, Cisco, EDTA, FireEye, Mandiant, Kaspersky, Malpedia, Unit 42, Zscaler)
• Axiom (Note: treated as a separate threat actor)
• BARIUM (formerly used by Microsoft)
• Blackfly (Symantec)
• Brass Typhoon (Microsoft)
• Bronze Atlas (SecureWorks)
• Double Dragon (Wikipedia)
• Earth Baku (Trend Micro)
• Grayfly (Symantec)
• Red Kelpie (PWC?)
• RedEcho (different threat actor from Recorded Future possible overlaps)
• Redfly (not used by Symantec, but linked via ShadowPad malware)
• RedGolf (officially used by Recorded Future)
• SparklingGoblin (ESET)
• TG-2633 (formerly used by SecureWorks)
• Wicked Panda (used by CrowdStrike to track espionage)
• Wicked Spider (used by CrowdStrike to track cybercrime)
• Winnti, Winnti Group (Kaspersky, ESET, Cybereason, PwC)

Subgroups

• Earth Longzhi (Trend Micro)
• Earth Freybug (Trend Micro)
• Lead (formerly used by Microsoft)
• Leopard Typhoon (Microsoft)
• Vanadinite (Dragos)

Identified Members

• Zhang Haoran (张浩然): FBI Most Wanted
• Tan Dailin (谭戴林): FBI Most Wanted
• Jiang Lizhi (蒋立志): FBI Most Wanted
• Qian Chuan (钱川): FBI Most Wanted
• Fu Qiang (付强): FBI Most Wanted

Associated Company

Chengdu Si Lingsi (404) Network Technology Company Ltd. (成都市肆零肆网络科技有限公司)

Vulnerabilities Exploited

• CVE-2018-0824 (7.5 high, in CISA's KEV Catalog) Microsoft COM for Windows Remote Code Execution Vulnerability Source: Cisco
• CVE-2017-0199 (7.8 high, in CISA's KEV Catalog) Microsoft Office and WordPad Remote Code Execution Vulnerability Sources: Clearsky, Fortinet, FireEye
• CVE-2019-3396 (9.8 critical, in CISA's KEV Catalog) Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability. Sources: FireEye, Fortinet
• CVE-2015-1641 (7.8 high, in CISA's KEV Catalog) Microsoft Office Memory Corruption Vulnerability Source: Fortinet
• CVE-2012-0158 (8.8 high, in CISA's KEV Catalog) Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Sources: Fortinet, FireEye
• CVE-2017-11882 (7.8 high, in CISA's KEV Catalog) Microsoft Office Memory Corruption Vulnerability Source: FireEye

The following 7 vulnerabilities have the same source: U.S. DOJ

• CVE-2019-19781 (9.8 critical, in CISA's KEV Catalog) Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Additional sources: FireEye, Fortinet
• CVE-2019-11510 (10.0 critical, in CISA's KEV Catalog) Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
• CVE-2019-16920 (9.8 critical, in CISA's KEV Catalog) D-Link Multiple Routers Command Injection Vulnerability
• CVE-2019-16278 (9.8 critical) Nostromo 1.9.6 Directory Traversal/ Remote Command Execution Vulnerability
• CVE-2019-1652 (7.2 high, in CISA's KEV Catalog) Cisco Small Business Routers Improper Input Validation Vulnerability. Additional source: FireEye
• CVE-2019-1653 (7.5 high, in CISA's KEV Catalog) Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability. Additional source: FireEye
• CVE-2020-10189 (9.8 critical, in CISA's KEV Catalog) Zoho ManageEngine Desktop Central File Upload Vulnerability. Additional sources: FireEye, Fortinet

The following 2 vulnerabilities have the same source: Mandiant

• CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell).
• CVE-2021-44207 (8.1 high) Acclaim USAHERDS Hard-Coded Credentials Vulnerability

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK Navigator Layers

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

• August 04, 2024 – Trend Micro: A Dive into Earth Baku’s Latest Campaign
• August 01, 2024 – Cisco Talos: APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
• July 18, 2024 – Mandiant: APT41 Has Arisen From the DUST
• July 11, 2024 – Zscaler: MoonWalk: A deep dive into the updated arsenal of APT41 | Part 2
• July 10, 2024 – Zscaler: DodgeBox: A deep dive into the updated arsenal of APT41 | Part 1
• June 10, 2024 – Technical University of Zurich (ETH Zurich): From Vegas to Chengdu: Hacking Contests Bug Bounties, and China’s Offensive Cyber Ecosystem (PDF, research paper)
• May 29, 2024 – Natto Thoughts: APT41’s Reconnaissance Techniques and Toolkit: Nmap and What Else?
• May 22, 2024 – Natto Thoughts: Front Company or Real Business in China’s Cyber Operations
• April 02, 2024 – Trend Micro: Earth Freybug Uses UNAPIMON for Unhooking Critical APIs (APT41 subgroup)
• February 28, 2024 – Natto Thoughts: i-SOON: Kicking off the Year of the Dragon with Good Luck … or Not (more about association of i-SOON to Chengdu 404)

2023

• October 27, 2023 – Natto Thoughts: i-SOON: Another Company in the APT41 Network
• September 22, 2023 – Mandiant: Threat Trends: Unraveling WyrmSpy and DragonEgg Mobile Malware with Lookout
• September 12, 2023 – Symantec: Redfly: Espionage Actors Continue to Target Critical Infrastructure (tenuous link via ShadowPad trojan)
• July 19, 2023 – Lookout: Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41
• May 02, 2023 – Trend Micro: Attack on Security Titans: Earth Longzhi Returns With New Tricks (APT41 subgroup)
• April 01, 2023 – Google Cloud/Threat Analysis Group (TAG): April 2023 Threat Horizons Report (PDF, page 9: HOODOO Uses Public Tooling, Google Workspace to Target Taiwanese Media)
• March 30, 2023 – Recorded Future: With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets (PDF)
• February 28, 2023 – Symantec: Blackfly: Espionage Group Targets Materials Technology

2022

• November 09, 2022 – Trend Micro: Hack the Real Box: APT41’s New Subgroup Earth Longzhi (APT41 subgroup)
• October 18, 2022 – Symantec: Spyder Loader: Malware Seen in Recent Campaign Targeting Organizations in Hong Kong
• September 22, 2022 – U.S. Health and Human Services (HHS): APT41 and Recent Activity (PDF)
• September 14, 2022 – ESET: You never walk alone: The SideWalk backdoor gets a Linux variant
• August 22, 2022 – Mandiant: APT41 (Double Dragon): A Dual Espionage and Cyber Crime Operation (PDF)
• August 18, 2022 – Group-IB:
  • APT41 World Tour 2021 on a tight schedule
  • Inflexible schedule: Group-IB reveals malicious APT41 campaigns involving new tactics and tools
• July 24, 2022 – Intrusion Truth: Chinese APTs: Interlinked networks and side hustles
• July 23, 2022 – Intrusion Truth: The people behind Chengdu 404
• July 22, 2022 – Intrusion Truth: Chengdu 404
• July 21, 2022 – Intrusion Truth: The old school hackers behind APT41
• July 20, 2022 – Intrusion Truth: APT41: A Case Sudy [sic]
• May 02, 2022 – Cybereason:
  • Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation
  • Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive
  • Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
• March 08, 2022 – Mandiant: Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments
• February 15, 2022 – Secureworks: ShadowPad Malware Analysis
• January 20, 2022 – Kaspersky: MoonBounce: the dark side of UEFI firmware

2021

• October 05, 2021 – BlackBerry: Drawing a Dragon: Connecting the Dots to Find APT41
• September 21, 2021 – Recorded Future: China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware, available as PDF (tenuous connection via Winnti malware)
• September 09, 2021 – Symantec: Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware
• August 24, 2021 – ESET: The SideWalk may be as dangerous as the CROSSWALK
• August 24, 2021 – Trend Micro: APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign
  • Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor. (PDF, white paper)
• August 20, 2021 – CISA: Chinese State-Sponsored Cyber Operations: Observed TTPs (generalized Chinese threat activity)
• July 08, 2021 – Recorded Future: Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling (TAG-22 overlaps with Winnti, but is considered Aquatic Panda)
• July 01, 2021 – Avast: Backdoored Client from Mongolian CA MonPass
• June 10, 2021 – Group-IB: Big airline heist
• April 29, 2021 – NTT: The Operations of Winnti group (PDF)
• March 16, 2021 – Dragos: New ICS Threat Activity Group: VANADINITE (Winnti subgroup)
• March 10, 2021 – Intezer: New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor
• March 08, 2021 – Mazaher Kianpour: Socio-Technical Root Cause Analysis of Cyber-enabled Theft of the U.S. Intellectual Property — The Case of APT41 (PDF)
• February 28, 2021 – Recorded Future: China-linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions, majority in PDF
• January 14, 2021 – Positive Technologies: Higaisa or Winnti? APT41 backdoors, old and new

2020

• November 11, 2020 – Microsoft: Hunting for Barium using Azure Sentinel
• October 20, 2020 – CISA: Potential for China Cyber Response to Heightened U.S.–China Tensions (brief mention of APT41)
• September 29, 2020 – Positive Technologies: ShadowPad: new activity from the Winnti group
• September 18, 2020 – Trend Micro: U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks
• September 17, 2020 – Symantec: APT41: Indictments Put Chinese Espionage Group in the Spotlight
• September 16, 2020 – U.S. Department of Justice: Seven International Cyber Defendants, Including “Apt41” Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally (ATTRIBUTION)
  • Indictment: United States of America v. Zhang Haoran, Tan Dailin (PDF)
• September 16, 2020 – FBI FLASH: Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities (PDF)
• June 11, 2020 – Zscaler: The Return of the Higaisa APT (see Positive Technologies link from January 14, 2021)
• June 04, 2020 – Malwarebytes: New LNK attack tied to Higaisa APT discovered (see Positive Technologies link from January 14, 2021)
• May 21, 2020 – ESET: No “Game over” for the Winnti Group
• May 06, 2020 – Trend Micro: Targeted Ransomware Attack Hits Taiwan Organizations
• April 20, 2020 – QuoIntelligence: WINNTI GROUP: Insights From the Past
• April 13, 2020 – Unit 42: APT41 Using New Speculoos Backdoor to Target Organizations Globally
• March 25, 2020 – FireEye: This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
• February ??, 2020 – PwC: Cyber Threats 2019: A Year in Retrospect (PDF, page 10)
• January 31, 2020 – ESET: Winnti Group targeting universities in Hong Kong
• January 31, 2020 – Tagesschau (German news): Deutsches Chemieunternehmen gehackt (German language, archive of dead link. English translated title: “German chemical company hacked”)

2019

• October 31, 2019 – FireEye: MESSAGETAP: Who’s Reading Your Text Messages?
• October 21, 2019 – ESET: Winnti Group's skip-2.0: A Microsoft SQL Server backdoor
• October 15, 2019 – FireEye: LOWKEY: Hunting for the Missing Volume Serial ID
• October 14, 2019 – ESET: Connecting the dots: Exposing the arsenal and methods of the Winnti Group, with whitepaper PDF
• September 14, 2019 – VMware: CB TAU Threat Intelligence Notification: Winnti Malware 4.0
• August 19, 2019 – FireEye: GAME OVER: Detecting and Stopping an APT41 Operation
• August 07, 2019 – FireEye: APT41: A Dual Espionage and Cyber Crime Operation, available as PDF
• July 24, 2019 – Bayerischer Rundfunk (BR): Winnti: Attacking the Heart of the German Industry
• May 29, 2019 – Intezer: HiddenWasp Malware Stings Targeted Linux Systems (link to Winnti malware)
• May 16, 2019 – Lab52: Winnti Group: Geostrategic and TTP (Tactics, Techniques and Procedures)
• May 15, 2019 – Chronicle: Winnti: More than just Windows and Gates
• April 23, 2019 – Kaspersky: Operation ShadowHammer: a high-profile supply chain attack
• March 25, 2019 – Kaspersky: Operation ShadowHammer
• March 11, 2019 – ESET: Gaming industry still in the scope of attackers in Asia

2018

• June 13, 2018 – Microsoft: Microsoft Corporation v. John Does 1-2 (PDF, Case 1:17-cv-01224-TSE-MSN. Proposed default judgment and order for permanent injunction)
• May 03, 2018 – 401 TRG: Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

2017

• September 21, 2017 – ESET: CConsiderations on the CCleaner incident (later attributed to Winnti by ESET on May 20, 2020)
• August 15, 2017 – Kaspersky: ShadowPad in corporate networks (attributed to Winnti by PwC in 2019)
• July 18, 2017 – Clearsky: Recent Winnti Infrastructure and Samples
• April 19, 2017 – Trend Micro: Examining a Possible Member of the Winnti Group
• March 22, 2017 – Trend Micro: Winnti Abuses GitHub for C&C Communications

2016

• October 18, 2016 – BlackBerry: Digitally Signed Malware Targeting Gaming Companies (links PassCV APT to Winnti)

2015

• October 05, 2015 – VSEC: Initial Winnti analysis against Vietnam game company (archive of dead link)
• June 22, 2015 – Kaspersky: Games are over: Winnti is now targeting pharmaceutical companies (links Winnti to Axiom)
• April 07, 2015 – Novetta: Operation SMN – Winnti Update (archive of dead link), Winnti Analysis (PDF, archive of dead link)

2013

• April 15, 2013 – Kaspersky: Winnti returns with PlugX
• April 11, 2013 – Kaspersky:
  • Winnti. More than just a game, available as PDF (ORIGIN OF WINNTI NAME)
  • The Winnti honeypot – luring intruders

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Country: Russia Organization: Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) Objective: Espionage, Sabotage, Assassinations, Influence Operations (Page last updated: September 07, 2024)

Aliases:

• Bleeding Bear (superseded by Ember Bear)
• Cadet Blizzard (Microsoft)
• DEV-0586 (formerly used by Microsoft)
• Ember Bear (CrowdStrike, MITRE)
• FROZENVISTA (Google TAG)
• Lorec53 (NSFOCUS)
• Nascent Ursa (Unit 42?)
• Nodaria (Symantec)
• SaintBear ( Malpedia, ETDA)
• UNC2589 (Mandiant)
• UAC-0056 (CERT-UA, Unit 42)

Identified Members

• Amin Timovich Stigal (Амин Стигал), Russian civilian hacker:
  • FBI Most Wanted
  • Rewards for Justice
  • Transnational Organized Crime Rewards Program
• Yuriy Fedorovich Denisov (Юрий Денисов), Colonel and Commanding Officer of Cyber Operations for Unit 29155:
  • FBI Most Wanted
• Vladislav Yevgenyevich Borovkov (Владислав Боровков), lieutenant in Unit 29155:
  • FBI Most Wanted
• Denis Igorevich Denisenko (Денис Денисенко), lieutenant in Unit 29155:
  • FBI Most Wanted
• Dmitriy Yuryevich Goloshubov (Дима Голошубов), lieutenant in Unit 29155:
  • FBI Most Wanted
• Nikolay Aleksandrovich Korchagin (Николай Корчагин), lieutenant in Unit 29155:
  • FBI Most Wanted

Vulnerabilities Exploited

• CVE-2017-11882 (7.8 high, in CISA's KEV Catalog) Microsoft Office Memory Corruption Vulnerability Source: Unit 42

The following 5 vulnerabilities have the same source: CISA

• CVE-2021-33044 (9.8 critical, in CISA's KEV Catalog) Dahua IP Camera Authentication Bypass Vulnerability
• CVE-2021-33045 (9.8 critical, in CISA's KEV Catalog) Dahua IP Camera Authentication Bypass Vulnerability
• CVE-2022-26134 (9.8 critical, in CISA's KEV Catalog) Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
• CVE-2022-26138 (9.8 critical, in CISA's KEV Catalog) Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
• CVE-2022-3236 (9.8 critical, in CISA's KEV Catalog) Sophos Firewall Code Injection Vulnerability

Exploitation Likely

CISA and co-authoring agencies warned on 06 September 2024 that Unit 29155 cyber actors have been observed obtaining the respective exploit scripts for the following 5 vulnerabilities:

• CVE-2020-1472 (9.8 critical, in CISA's KEV Catalog) Microsoft Netlogon Privilege Escalation Vulnerability
• CVE-2021-26084 (9.8 critical, in CISA's KEV Catalog) Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
• CVE-2021-3156 (7.8 high, in CISA's KEV Catalog) Sudo Heap-Based Buffer Overflow Vulnerability
• CVE-2021-4034 (7.8 high, in CISA's KEV Catalog) Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
• CVE-2022-27666 (7.8 high) Red Hat: IPSec ESP Local Privilege Escalation Vulnerability

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK Navigator Layers

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

• September 06, 2024 – ASD ACSC: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure
• September 05, 2024 – CISA: Russian Military Cyber Actors Target US and Global Critical Infrastructure, available as PDF
• September 05, 2024 – U.S. Department of Justice:
  • Five Russian GRU Officers and One Civilian Charged for Conspiring to Hack Ukrainian Government
  • Indictment: United States of America v. Amin Stigal, Vladislav Borovkov, Denis Denisenko, Yuriy Denisov, Dmitriy Goloshubov, and Nikolay Korchagin
  • Assistant Attorney General Matthew G. Olsen Delivers Remarks Announcing Charges Against Russian Military Officers
• September 05, 2024 – NSA: NSA, FBI, CISA, and Allies Issue Advisory about Russian Military Cyber Actors
• September 05, 2024 – U.S. State Department: Up to $1 Million Reward Offer for Information Leading to Arrest and/or Conviction of Russian National Tim Vakhaevich Stigal
  • September 05, 2024 – Rewards for Justice: GRU Officers –Unit 29155
• September 05, 2024 – NCSC-UK: UK and Allies uncover Russian military unit carrying out cyber attacks and digital sabotage for the first time
• September 05, 2024 – BfV (Germany): Joint Cybersecurity Advisory on Russian Military Cyber Actors targeting U.S. and Global Critical Infrastructure
• September 05, 2024 – KAPO (Estonia): A GRU military unit launched cyberattacks against Estonian authorities
• September 05, 2024 – Estonia Prosecutor's Office: A GRU military unit launched cyberattacks against Estonian authorities
• September 05, 2024 – Estonia Ministry of Foreign Affairs (MFA): Estonia names Russia’s military intelligence in a first-ever attribution of cyberattacks
• September 05, 2024 – The Netherlands Military Intelligence and Security Service (MIVD): MIVD waarschuwt: Russen hebben het gemunt op westerse hulp aan Oekraïne (Dutch)
• September 05, 2024 – CCCS: Russian military cyber actors target U.S. and global critical infrastructure
• June 26, 2024 – U.S. Department of Justice: Russian National Charged For Conspiring With Russian Military Intelligence To Destroy Ukrainian Government Computer Systems And Data (Amin Stigal)

2023

• June 14, 2023 – Microsoft: Cadet Blizzard emerges as a novel and distinct Russian threat actor
• February 16, 2023 – Google TAG: Fog of war: how the Ukraine conflict transformed the cyber threat landscape (PDF)
• February 08, 2023 – Symantec: Graphiron: New Russian Information Stealing Malware Deployed Against Ukraine

2022

• December 05, 2022 – Elastic: Operation Bleeding Bear
• July 20, 2022 – USCYBERCOM: Cyber National Mission Force discloses IOCs from Ukrainian networks
• July 20, 2022 – Mandiant: Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities
• July 13, 2022 – Malwarebytes: Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign
• July 11, 2022 – CERT-UA: Attack by UAC-0056 group on state organizations of Ukraine using Cobalt Strike Beacon (CERT-UA#4941) (Ukrainian)
• July 06, 2022 – CERT-UA: Cyber ​​attack UAC-0056 on state organizations of Ukraine using Cobalt Strike Beacon (CERT-UA#4914) (Ukrainian)
• April 26, 2022 – CERT-UA: UAC-0056 group cyber attack using GraphSteel and GrimPlant malware and the topic of COVID-19 (CERT-UA#4545) (Ukrainian)
• April 25, 2022 – Bitdefender: Deep Dive into the Elephant Framework – A New Cyber Threat in Ukraine
• April 04, 2022 – Intezer: Elephant Framework Delivered in Phishing Attacks Against Ukrainian Organizations
• April 04, 2022 – NioGuard: Russian SaintBear Group Attacked Ukrainian Government Agencies Using GraphSteel & GrimPlant malware
• April 01, 2022 – Malwarebytes: New UAC-0056 activity: There’s a Go Elephant in the room
• March 30, 2022 – CrowdStrike: Who is EMBER BEAR?
• March 28, 2022 – CERT-UA: Cyber ​​attack of the UAC-0056 group on the state bodies of Ukraine using GraphSteel and GrimPlant malware (CERT-UA#4293) (Ukrainian)
• March 15, 2022 – SentinelOne: Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
• March 04, 2022 – Mandiant: Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation
• February 25, 2022 – Unit 42: Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot
• February 21, 2022 – NSFOCUS: APT Lorec53 group launched a series of cyber attacks against Ukraine
• February 08, 2022 – NSFOCUS: APT Retrospection: Lorec53, An Active Russian Hack Group Launched Phishing Attacks Against Georgian Government
• February 02, 2022 – CERT-UA: Cyber ​​attack of the UAC-0056 group on state organizations of Ukraine using SaintBot and OutSteel malware (CERT-UA#3799) (Ukrainian)
• January 20, 2022 – Unit 42: Threat Brief: Ongoing Russia and Ukraine Cyber Activity
• January 17, 2022 – Picus: TTPs used by DEV-0586 APT Group in WhisperGate Attack Targeting Ukraine
• January 16, 2022 – NCSCC-UA on Twitter: Operation #BleedingBear
• January 15, 2022 – Microsoft: Destructive malware targeting Ukrainian organizations

2021

• November 28, 2021 – NSFOCUS: 2021 Analysis Report on Lorec53 Group (PDF)
• April 06, 2021 – Malwarebytes: A deep dive into Saint Bot, a new downloader (origin of SaintBear?)

Country: Islamic Republic of Iran Organization: Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) Objective: Espionage, Intelligence collection (Page last updated September 04, 2024)

Aliases:

• APT42 (Mandiant)
• APT35 (Check Point Research, Google Threat Analysis Group)
• Ballistic Bobcat (ESET)
• CALANQUE (Google Threat Analysis Group)
• CharmingCypress (Volexity)
• Charming Kitten (Clearsky, CERT-FA, Bitdefender)
• COBALT ILLUSION (Secureworks)
• ITG18 (IBM)
• Magic Hound (MITRE, Unit 42, Cyble)
• Mint Sandstorm (Microsoft)
• PHOSPHORUS (previously used by Microsoft, The DFIR Report, Deep Instinct, Cybereason)
• TAG-56 (previously used by Recorded Future)
• TA453 (Proofpoint)
• TunnelVision or Tunnel Vision (eSentire, SentinelOne)
• Yellow Garuda (PwC)

Sub-group:

• Nemesis Kitten (CrowdStrike)
• Storm-0270 (Microsoft, formerly tracked as DEV-0270)

Vulnerabilities Exploited

• CVE-2022-47966 (9.8 critical) Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Source: Microsoft
• CVE-2023-27350 (9.8 critical) PaperCut MF/NG Improper Access Control Vulnerability Source: Microsoft Threat Intelligence
• CVE-2022-47986 (9.8 critical) IBM Aspera Faspex Code Execution Vulnerability. Source: Microsoft
• Log4Shell:
  • CVE-2021-44228 (10.0 critical) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell). Source: Check Point Research, Microsoft
  • CVE-2021-45046 (9.0 critical) Apache Log4j2 Deserialization of Untrusted Data Vulnerability Source: Microsoft
• CVE-2018-13379 (9.8 critical) Fortinet FortiOS SSL VPN Path Traversal Vulnerability. Source: Microsoft, SentinelOne
• ProxyLogon (Source: Microsoft):
  • CVE-2021-26855 (9.8 critical) Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-26857 (7.8 high) Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-26858 (7.8 high) Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-27065 (7.8 high) Microsoft Exchange Server Remote Code Execution Vulnerability
• ProxyShell (Source: The DFIR Report):
  • CVE-2021-34473 (9.1 critical) Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-34523 (9.8 critical) Microsoft Exchange Server Privilege Escalation Vulnerability
    
  • CVE-2021-31207 (6.6 medium) Microsoft Exchange Server Security Feature Bypass Vulnerability

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

• August 28, 2024 – Mandiant: I Spy With My Little Eye: Uncovering an Iranian Counterintelligence Operation (note: weak overlap)
• August 23, 2024 – Meta: Taking Action Against Malicious Accounts in Iran
• August 20, 2024 – Proofpoint: Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset
• August 20, 2024 – Recorded Future: GreenCharlie Infrastructure Linked to US Political Campaign Targeting, available as PDF
• August 19, 2024 – CISA: Joint ODNI, FBI, and CISA Statement on Iranian Election Influence Efforts (Note: not explicitly identified)
• August 14, 2024 – Google Threat Analysis Group (TAG): Iranian backed group steps up phishing campaigns against Israel, U.S.
• August 14, 2024 – Harfang Lab: Cyclops: a likely replacement for BellaCiao
• August 08, 2024 – Microsoft Threat Analysis Center Iran Targeting 2024 US Election
• May 22, 2024 – Cyble: Threat Actor Profile: Magic Hound
• May 10, 2024: New Jersey Cybersecurity & Communications Integration Cell (NJ-CCIC): Recent Observed Iranian State-Sponsored Cyber Threat Group Activity (ATTRIBUTION to IRGC-IO)
• May 1, 2024 – Mandiant: Uncharmed: Untangling Iran's APT42 Operations
• February 13, 2024 – Volexity: CharmingCypress: Innovating Persistence
• January 17, 2024 – Microsoft: New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs

2023

• November 09, 2023 – Microsoft: Microsoft shares threat intelligence at CYBERWARCON 2023
• September 11, 2023 – ESET: Sponsor with batch-filed whiskers: Ballistic Bobcat’s scan and strike backdoor
• June 28, 2023 – Volexity: Charming Kitten Updates POWERSTAR with an InterPlanetary Twist
• July 06, 2023 – Proofpoint: Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware
• April 26, 2023 – Bitdefender: Unpacking BellaCiao: A Closer Look at Iran’s Latest Malware
• April 18, 2023 – Microsoft: Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets
• March 09, 2023 – Secureworks: COBALT ILLUSION Masquerades as Atlantic Council Employee

2022

• December 14, 2022 – Proofpoint: Would’ve, Could’ve, Should’ve…Did: TA453 Refuses to be Bound by Expectations
• December 12, 2022 – SOCRadar: Dark Web Profile: APT42 – Iranian Cyber Espionage Group
• November 29, 2022 – Recorded Future: Suspected Iran-Nexus TAG-56 Uses UAE Forum Lure for Credential Theft Against US Think Tank, available as PDF
• September 27, 2022 – Avertium: An In-Depth Look at APT35 aka Charming Kitten
• September 14, 2022 – U.S. Treasury: Treasury Sanctions IRGC-Affiliated Cyber Actors for Roles in Ransomware Activity (ATTRIBUTION to IRGC, links “Tunnel Vision” to Charming Kitten)
• September 13, 2022 – Proofpoint: Look What You Made Me Do: TA453 Uses Multi-Persona Impersonation to Capitalize on FOMO
• September 09, 2022 – CERT-FA: Charming Kitten: “Can We Have A Meeting?”
• September 07, 2022 – Mandiant: APT42: Crooked Charms, Cons, and Compromises, available as PDF
• September 07, 2022 – Microsoft: Profiling DEV-0270: PHOSPHORUS’ ransomware operations
• August 23, 2022 – Google Threat Analysis Group (TAG): New Iranian APT data extraction tool
• July 22, 2022 – PwC: Old cat, new tricks, bad habits
• June 01, 2022 – Deep Instinct: Iranian Threat Actor Continues to Develop Mass Exploitation Tools
• March 30, 2022 – Recorded Future: Social Engineering Remains Key Tradecraft for Iranian APTs, available as PDF
• March 21, 2022 – The DFIR Report: PHOSPHORUS Automates Initial Access Using ProxyShell
• March 09, 2022 – eSentire: Exploitation of VMware Horizon Servers by TunnelVision Threat Actor
• February 17, 2022 – SentinelOne: Log4j2 In The Wild | Iranian-Aligned Threat Actor “TunnelVision” Actively Exploiting VMware Horizon
• February 01?, 2022 – Cybereason: PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage
• January 11, 2022 – Check Point Research: APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit

2021

• November 16, 2021 – Microsoft: Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021
• November 15, 2021 – The DFIR Report: Exchange Exploit Leads to Domain Wide Ransomware
• October 14, 2021 – Google Threat Analysis Group (TAG): Countering threats from Iran
• August 04, 2021 – IBM: ITG18: Operational security errors continue to plague sizable Iranian threat group
• July 13, 2021 – Proofpoint: Operation SpoofedScholars: A Conversation with TA453
• March 30, 2021 – Proofpoint: BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns
• January 08, 2021 – CERT-FA: Charming Kitten’s Christmas Gift

2020

• October 28, 2020 – Microsoft: Cyberattacks target international conference attendees
• August 27, 2020 – Clearsky: The Kittens Are Back in Town 3, available as PDF
• July 16, 2020 – IBM: New Research Exposes Iranian Threat Group Operations
• January 30, 2020 – CERT-FA: Fake Interview: The New Activity of Charming Kitten

2019

• October 07, 2019 – Clearsky: The Kittens Are Back in Town 2 – Charming Kitten Campaign Keeps Going on, Using New Impersonation Methods
• October 04, 2019 – Microsoft: Recent cyberattacks require us all to be vigilant
• September 15, 2019 – Clearsky: The Kittens Are Back in Town Charming Kitten – Campaign Against Academic Researchers
• March 17, 2019 – Microsoft: New steps to protect customers from hacking

2018

• December 13, 2018 – CERT-FA: The Return of The Charming Kitten

2017

• December 05, 2017 – Clearsky: Charming Kitten: Iranian Cyber Espionage Against Human Rights Activists, Academic Researchers and Media Outlets available as a PDF (PDF)
• February 06, 2017 – Iran Threats: iKittens: Iranian Actor Resurfaces with Malware for Mac (MacDownloader)

2016

• November 11, 2016 – Iran Threats: Fictitious Profiles and WebRTC’s Privacy Leaks Used to Identify Iranian Activists
• April 27, 2016 – Kaspersky: Freezer Paper around Free Meat

Salt and the Liberal Party

• UMSU's 2024 candidate list
• Gabi Steinberg's pro-Israel comments

Country: People's Republic of China (PRC) Organization: Hainan State Security Department (HSSD), of the Ministry of State Security (MSS) Objective: Espionage

Aliases:

• Bronze Mohawk (Secureworks)
• Leviathan/Kryptonite Panda (CrowdStrike)
• Gadolinium (formerly used by Microsoft)
• Gingam Typhoon (Microsoft)
• FEVERDREAM, G0065, GreenCrash, Hellsing, Mudcarp, Periscope
• Temp.Periscope/ Temp.Jumper (FireEye)

Front Company

• Hainan Xiandun Technology Development Co., Ltd. (海南仙盾) (Hainan Xiandun) (Note: disbanded)

Identified Members

• Ding Xiaoyang (丁晓阳)
• Cheng Qingmin (程庆民)
• Zhu Yunmin (朱允敏)
• Wu Shurong (吴淑荣)

References:

Links (Sorted in Chronological Order)

2021

• July 20, 2021 – CISA: Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department
• July 19, 2021 – U.S. Department of Justice: Four Chinese Nationals Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including Infectious Disease Research

2020

• September 24/ 2020 – Microsoft: Microsoft Security—detecting empires in the cloud

2019

• March 04, 2019 – Mandiant: APT40: Examining a China-Nexus Espionage Actor

I got a job over a month ago. I mean, kinda. It's something I can do when I'm capable of, concerns writing (including reviewing and correcting other people's work), and pays around double the hourly minimum wage in my country.

I can usually work 2 hours a day, sometimes 3 or 4 hours, 5 or 6 days a week. There are also days when I'm in such pain that I can't do a thing.

I don't make a fortune (I wouldn't mind, though!), but at least it has been enough to be able to pay for my medications.

#Job #LifeUpdate

I think I'm overthinking this. I think I'll follow the instructions for Secure Boot for the Linux Surface project and see how that goes.

The GH project's wiki references following steps outlined in the ArchWiki.

Additionally, I came across the following sources:

• Super User thread from Stack Exchange
• GitHub gist from July 2022
• A blog post from January 2022

I haven't been able to sit down and try this — but expect that this worked if I don't come back to follow up.

About three days ago, I was reading federal government online sources about online job scams.

There is resource page from the FTC and another FTC page to report online scams, as well as the the Internet Crime Complaint Center (IC3) page from the FBI.

Conclusion

Most traditional jobs don't advertise on Craigslist. I almost got burned, but luckily I smoked this scam out before I could even apply for it.

The particular one I was looking at struck me as strange, as it has been the only Craigslist posting (of any type) that didn't use Craigslist's prviate e-mail relay/address option. Due to this, I kept looking at the e-mail address (as it was a Yahoo e-mail address, instead of from an official e-mail address from a real American healthcare corporation) until I realized I was looking at a scam — it was very much like looking at a very well camoflauged animal for a long time before spotting it.

An offer that's “too good to be true” doesn't have to be hyperbolically exaggerated to the point of being comical and super obvious — it can also be a toned-down, realistic decoy.

Also, it is a good rule of thumb to cross-reference and check if the same online job listing you've stumbled upon on an aggregate site (such as Craigslist or Indeed) can be found on a better first-party source, such as the company website.

eBay is sometimes tedious to deal with. I use the site to buy electronic parts for repair, but some aspects of the site are annoying to deal with.

For example, if you use a password manager, then you should wait a few seconds (at least 5 seconds, if I had to pick name a number) before submitting your password. (Then, you will be prompted with an hCaptcha, if you are using a VPN; followed by an SMS message for 2FA.)

I received an error message, identical to that described in an EcommerceBytes article from January 2021. I think this was because I tried to log in very quickly, assisted by KeePassXC.

This YouTube video from August 2023 also shows the rate limiting.

This is sort of annoying, as checking my order status on eBay is currently my only way to check the shipping status of orders, since even the U.S. Postal Service completely blocks VPNs (at least Mullvad VPN) when I tried doing this about two days ago.

There is a site called Read Comic Online, which I first saw when I on a fellow student's laptop during my last year of undergraduate studies.

(This site is definitely violating copyright, but on the other hand there is probably no pragmatic way I could buy physical copies of any of the Stranger Things comics when I started reading those, except in collected book versions; though I'd have to go to the library to read those. Also, I have yet to explore in-person comic book stores.)

In early 2024, I was browsing the site when I discovered the webcomic Kill Six Billion Demons (or KSBD).

Fair warning: if you thought that reading a Boruto chapter monthly (or a Naruto manga chapter back during its publication run) was painful, then the anticipation of waitng for each page of KSBD to be released might be too much for you.

Anyways, I somehow started reading the middle of the series online and quickly read through all the books available on Read Comic Online. As some context: it has been a while since the series has collected the later books into print form with Image Comics, so you can get a lot further into the story by reading the webcomic.

I was immediately hooked. But then I went to the actual KSBD website and realized I had no idea what was happening in the story, as the webcomic site is much further along than the completed print books avaialbe on Read Comic Online. So, I caught up with the story, as of early 2024.

I was initially shocked at the outer appearance of protagonist Allison when I first opened the KSBD webcomic site. Initially, she was drawn in a way that made be believe she was a villian, which was not the case and at first confused me. However, after catching up with the story, I understand how Allison came to her current state in the story.

I just wanted to talk about KSBD, as there is not much (meta-)explanatory material on KSBD generally online, except for rather obscure places — such as the comments under each page of KSBD.

Critiques

• The venue was too bright. Chillout rooms and talk tracks could have used a dimmer.
• Speaking of the Chillout room, it was somewhat disappointing. (I’m talking about Chillout 2, as Chillout 1 felt like a giant hospital waiting room). I like a cavernous, dim, and ambient room for, you know, chilling out. #SomaFM was over in the hallway, the Chillout room had a live stage, and it was overall pretty small.

“Best-ofs”

These are the best things I personally saw or were close to. There’s so much going on that this just represents the best stuff I saw in my fractional DEFCON experience.

• Best thing I learned: Gained a good bit of familiarity with InspectAI at the AI Village as a part of their CTF.
• Best Talk: “Librarian in Broad Daylight: Fighting back against ever encroaching capitalism” by the Cyberpunk Librarian in the War Stories track.
• Best Rant: Cory Doctorow on #enshittification
• Best Tool or Technique: “MySQL honeypot that drops shells”
• Best Research: “Watchers being watched: Exploiting the Surveillance System” in which the researchers exploited 4 different surveillance systems.
• Best Real-World Impact: “Bastardo Grande: Hunting the Largest Black Market Bike Fence In The World” by Bryan Hance. Talk not up yet, see the related Wired article
• Best Contest: There’s too many, but I loved the idea of Sn4ck3r, the machine that vends real items for captured flags.
• Best Party: the 503 Party, of course!
• Best Entertainment: DJ Jackalope brought an awesome set after Hacker Jeopardy. (and Skittish and Bus did a great job warming up the crowd just before)
• Biggest Drama: the badge
• Best Village: The Packet Hacking village due to the supreme DEFCON-y ambience and the well-run workshops they provided to people of all skill levels

Observations & Random Points

1. I probably haven’t been to a main track talk in person for over 6 years. I decided to go to a few of them and really enjoyed the atmosphere. I’ll have to remember to put at least 2 on the agenda each year going forward.
2. BlueTeam Village got a much larger space this year. I’m happy to see that, as they were nearly impossible to get into over at the Flamingo in recent years. BTV is doing good work and people should be able to experience it.
3. There were a lot of contests.
4. The Car-hacking village really brings it. They had a semi truck rig, a Rivian, and they gave away a Tesla. Well done, and my only ask is that we make it easier for people & mechanics to jail break their cars when the companies John Deere-ify them.

Next #DEFCON will be held Aug 7-10, 2025 at the LVCC. I hope to see you there!

East of West is probably the best self-contained story I've read recently in the general genre of comic series, graphic novel, and manga. It's longer than one collected book, yet isn't a series that feels like it's going on forever, such as Naruto or Boruto.

I will say that the very of East of West seems to be relatively anticlimactic compared to how it starts, yet it is still better than the ending of the original Matrix film trilogy.

Regardless, East of West still ends way better than The Empty Man, which I felt started really well but then ended in a rather mediocre fashion — much like the Matrix trilogy.

I sort of wished that production of the comic series Godslap, which was co-created by MoistCr1TiKaL, would release more frequently, as well as comic series of Outlast: The Murkoff Account and the vampire comic series Sucker.

(Though, to be fair, the continuation of the Murkoff Outlast comic that I am invested in can't finish anytime soon, as the game Outlast III hasn't been released yet.)

Apparently, as of November 2023, the third and final volume of Sucker is in production. I really liked this one because it had some rather sharp social commentary on Big Pharma... maybe too sharp, given that Volume 2 was released on March 2020, when the COVID-19 pandemic really started in the US.

(The following links are probably NSFW-risky links, though not completely explicit, for the Sucker comic: Volume 1 and Volume 2 are published by Polite Strangers. This series was originally crowdfunded on Kickstarter and IndieGoGo — I was able to find these links despite some difficulty.)

Conclusion

From my experiences, I think most time reading comic books and graphic novels should be done alone. It's how I discovered all of these unique stories that almost no one in mainstream media outlets (both in TV and film) would even consider exploring. It's not just online ARGs, analog horror, and SCP Foundation-esque entries that have more wildly creative ideas than even the most unfiltered indie film and TV projects.

I think some of my formative time spent in public libraries was reading graphic novels alone. You learn by osmosis how to form your own opinion regarding media literacy.

I would love to see The Private Eye comic adapted into a A24-like two-part miniseries, as this finished serialization by December 2015 and is really prescient in a post-Snowden era and the post-COVID technology chilling. The screenplay and basic storyboard is at least 50% towards MVP of a screenplay script, if you think about it.

Also, adapting Xombi Volume 2 as a stand-alone three-part miniseries for the character Xombi would be my highest personal cinematic adaptation goal. I think DC could consider exploring some “experimental” media entries, similar to that of the 2022 Werewolf by Night film special from Marvel; as much of its DC cinematic and television entries are pretty disconnected already.

I mean, Spider-Man: Homecoming completely avoided redoing Tom Holland's being bitten by the spider and yet the film did just fine. So, we wouldn't have to trudge through David Kim's origin story. If your story is good, then it's good. A superhero-like character doesn't always have to be an origin story to have a compelling story.

Lastly, there is some music (just two tracks) that was created for East of West, which is available on Bandcamp at a cost of “name your price” (including free).

Really random and funny postscript

Speaking of Bandcamp: Nathan Barnatt, the IRL actor who plays the character Dad, also has a Bandcamp for all of the original music and songs created for the Dad series.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🚫 Videos: Van der Bellen & Assinger werben nicht für Investmentplattformen security news – The article discusses that videos featuring Van der Bellen and Assinger do not promote investment platforms, clarifying any misconceptions surrounding their appearances. https://www.watchlist-internet.at/news/fake-videos-van-der-bellen-assinger-werben-nicht-fuer-investmentplattformen/

💸 Should Organizations Pay Ransom Demands? cybercrime – Organizations are urged to avoid paying ransomware demands as it funds cybercriminals and doesn't guarantee data recovery. Proactive cybersecurity measures are emphasized as a better defense. https://securityaffairs.com/166650/uncategorized/ransomware-organizations-should-avoid-paying-ransoms.html

📧 Users: Microsoft must update Outlook's friendly name feature security news – Users are urging Microsoft to change how Outlook displays sender names to combat phishing, as friendly names can mislead users into clicking malicious links. Calls for disabling aliases have grown. https://www.theregister.com/2024/08/06/users_call_for_microsoft_to/

🛑 Consumer Reports study finds data removal services are often ineffective privacy – A Consumer Reports study found that data removal services are largely ineffective, with only 35% of personal data removed from people-search sites within four months, raising concerns about their reliability. https://therecord.media/data-removal-services-mostly-worthless-study

💻 Report: Myths about tech still plaguing the IT world security news – A Kaspersky survey reveals widespread misconceptions about digital security among tech-savvy Brits, including beliefs about webcam safety, incognito mode, and the effectiveness of encryption, highlighting a need for better cybersecurity education. https://www.theregister.com/2024/08/08/report_tech_misconceptions_plague_the/

🪖 Russia's Kursk region suffers 'massive' DDoS attack amid Ukraine offensive cyber defense – Kursk, Russia, experienced a significant DDoS attack targeting government and business websites, coinciding with Ukraine's military advances, though critical infrastructure remained protected from damage. https://therecord.media/kursk-military-offensive-ddos-russia-ukraine

🐄 Crooks took control of a cow milking robot causing the death of a cow cybercrime – Cybercriminals hacked a farmer's milking robot, demanding a $10,000 ransom. The farmer refused to pay, leading to the death of a cow due to lost data on insemination dates. https://securityaffairs.com/166839/cyber-crime/cow-milking-robot-hacked.html

🔊 Sonos smart speakers flaw allowed to eavesdrop on users vulnerability – NCC Group discovered vulnerabilities in Sonos smart speakers, including CVE-2023-50809, allowing remote code execution and potential eavesdropping. Sonos released a patch to address the issues. https://securityaffairs.com/166823/hacking/sonos-smart-speakers-flaw.html

🔑 How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards security research – Researchers reveal a method to extract HID encoder keys, allowing easy cloning of keycards. https://www.wired.com/story/hid-keycard-authentication-key-vulnerability/

🛡️ Security Tips for Modern Web Administrators security news – Website security is vital for user trust. Employ multi-layered defenses, keep software updated, and follow best practices to safeguard against attacks and protect sensitive data. https://blog.sucuri.net/2024/08/security-tips-for-modern-web-administrators.html

🆙 Mac and Windows users infected by software updates delivered over hacked ISP malware – Hackers compromised an ISP to deliver malware to users via tampered software updates. This attack exploited unencrypted connections, enabling malicious file downloads for Windows and macOS users. https://arstechnica.com/security/2024/08/hacked-isp-infects-users-receiving-unsecure-software-updates/

👁️ Illinois relaxes biometric privacy law, reduces penalties privacy – Illinois has amended its Biometric Information Privacy Act, reducing penalties for breaches by counting multiple data distributions as one violation, which critics say lowers potential damages. https://www.theregister.com/2024/08/06/illinois_bipa_amendment_reduces_penalties/

🔒 Google says Android zero-day was exploited in the wild vulnerability – Google has patched a high-severity Android vulnerability (CVE-2024-36971) allowing remote code execution, amid reports of targeted exploitation. This reflects a rising trend in zero-day attacks. https://therecord.media/android-zero-day-google-fix-august-patch

💻 Students scramble after security breach wipes 13,000 devices data breach – A security breach at Mobile Guardian led to the remote wiping of data from 13,000 school-issued devices in Singapore, prompting the Ministry of Education to halt its services and remove the app. https://arstechnica.com/security/2024/08/students-scramble-after-security-breach-wipes-13000-devices/

🐍 SharpRhino malware targets IT admins, Hunters Intl suspected malware – The SharpRhino malware, disguised as Angry IP Scanner, targets network admins and is linked to the Hunters International gang, known for ransomware-as-a-service tactics and double extortion. https://www.theregister.com/2024/08/07/sharprhino_malware_admins/

❎ Problems with Georgia’s Voter Registration Portal security news – Georgia's voter registration portal has security flaws allowing unauthorized cancellation of registrations and exposing sensitive voter data, highlighting challenges in balancing usability and security. https://www.schneier.com/blog/archives/2024/08/problems-with-georgias-voter-registration-portal.html

💰 US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks cybercrime – The U.S. State Department has offered a $10 million reward for information on six Iranian hackers linked to cyberattacks on U.S. water utilities, attributed to the CyberAv3ngers group. https://therecord.media/us-offers-reward-for-info-on-iranian-hackers-water-utilities

🧓 Researchers find decades-old vulnerability in major web browsers vulnerability – A zero-day vulnerability discovered by Oligo Security affects major browsers, allowing attackers to exploit network requests to 0.0.0.0, potentially breaching local networks and accessing private data. https://cyberscoop.com/browser-zero-day-oligo-security-0-0-0-0-day/

🧑‍🌾 Nashville man arrested for running “laptop farm” to get jobs for North Koreans cybercrime – Matthew Isaac Knoot was arrested for hosting laptops to deceive US companies into hiring North Korean nationals, funneling their earnings to fund North Korea’s weapons program. https://arstechnica.com/security/2024/08/nashville-man-arrested-for-running-laptop-farm-to-get-jobs-for-north-koreans/

---

Some More, For the Curious

⚡ Hacking a Virtual Power Plant hacking write-up – A security researcher exploited a vulnerability in a virtual power plant's API using weak 512-bit RSA keys, revealing how easily sensitive data could be accessed. https://rya.nc/vpp-hack.html

📊 State of Exploitation – A Peek into 1H-2024 Vulnerability Exploitation security research – In the first half of 2024, 390 new vulnerabilities were added to the Known Exploited Vulnerabilities Catalog, highlighting ongoing threats and trends in exploitation and weaponization. https://vulncheck.com/blog/state-of-exploitation-1h-2024

💼 Florida firm sued over theft of 2.9B personal records data breach – A lawsuit claims Jerico Pictures negligently failed to secure 2.9 billion records, leading to a data breach where personal information was sold on the dark web, risking identity theft. https://www.theregister.com/2024/08/05/national_public_data_lawsuit/

💰 Drama ‘Dark Angels’ Reap Record Ransoms cybercrime – The Dark Angels ransomware group made headlines after receiving a record $75 million ransom from a Fortune 50 company, focusing on massive data theft while avoiding disruption and publicity. https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/

🗽 Intelligence bill would elevate ransomware to a terrorist threat security news – A Senate proposal aims to treat ransomware attacks as terrorism, enhancing legal authority to combat cybercriminals and sanction states harboring them, despite concerns over effectiveness. https://cyberscoop.com/ransomware-terrorism-ndaa-2025/

🌮 Turning the screws: The pressure tactics of ransomware gangs cybercrime – Ransomware gangs are escalating pressure tactics, using media, legislation, and personal threats to coerce victims into paying ransoms, including targeting secondary victims for leverage. https://news.sophos.com/en-us/2024/08/06/turning-the-screws-the-pressure-tactics-of-ransomware-gangs/

➖ Best security practices for ESXi environments cyber defense – Organizations using VMware ESXi should implement ten security practices to mitigate risks, as native EDR is unavailable, including ensuring patching, enforcing strong passwords, and enabling lockdown modes. https://news.sophos.com/en-us/2024/08/07/best-security-practices-for-esxi-environments/

🧠 Mental Health – An Infosec Challenge security news – Cybersecurity professionals face unique mental health challenges like burnout and anxiety due to constant stress. The article offers tips for prevention, emphasizing self-care, communication, and community support. https://www.blackhillsinfosec.com/mental-health-an-infosec-challenge/

🤑 Hackers return $12 million taken during Ronin network breach cybercrime – Hackers returned $12 million stolen from the Ronin gaming blockchain, claiming to act as white-hats after exploiting a vulnerability. The company plans to enhance security and awarded the hackers a $500,000 bounty. https://therecord.media/hackers-return-12-million-taken-from-ronin-network

🎩 The top stories coming out of the Black Hat cybersecurity conference security news – At the Black Hat conference, AI's role in cybersecurity takes center stage, alongside vulnerabilities in car infotainment systems and the impact of upcoming elections on cybersecurity policy. https://blog.talosintelligence.com/threat-source-newsletter-aug-8-2024/

---

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog vulnerability – CISA has included CVE-2018-0824, a Microsoft vulnerability, in its catalog due to active exploitation, emphasizing the need for federal agencies to address such risks promptly. https://www.cisa.gov/news-events/alerts/2024/08/05/cisa-adds-one-known-exploited-vulnerability-catalog 🚨 CISA Adds Two Known Exploited Vulnerabilities to Catalog vulnerability – CISA has included CVE-2024-36971 and CVE-2024-32113 in its catalog due to active exploitation, highlighting risks to federal networks and the need for timely remediation. https://www.cisa.gov/news-events/alerts/2024/08/07/cisa-adds-two-known-exploited-vulnerabilities-catalog

🛠️ Delta Electronics DIAScreen vulnerability – A stack-based buffer overflow vulnerability in Delta Electronics DIAScreen could allow arbitrary code execution. Users are urged to update to version 1.4.2 to mitigate risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-219-01 🔍 Dorsett Controls InfoScan vulnerability – Dorsett Controls InfoScan has vulnerabilities allowing unauthorized access to sensitive information and path traversal. Users should update to version 1.38 or later to mitigate risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-221-01

🛒 Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem cyber defense – This guide empowers software customers to demand security in product design, offering questions to assess manufacturers' cybersecurity practices and ensuring resilience against cyber threats. https://www.cisa.gov/resources-tools/resources/secure-demand-guide

🔐 Best Practices for Cisco Device Configuration security news – CISA advises disabling the Cisco Smart Install feature and using type 8 password protection to secure configurations, reducing the risk of password cracking and unauthorized access. https://www.cisa.gov/news-events/alerts/2024/08/08/best-practices-cisco-device-configuration

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.