Weekly Threat Intelligence Report
Date: May 13–17, 2024

---

Summary of Positive Developments

1. BreachForums Shutdown by International Law Enforcement

• Details: The FBI, DOJ, and global law enforcement agencies have successfully taken down the BreachForums hacker website.
• Outcome: This operation resulted in the arrest of the site’s administrators and the seizure of its infrastructure, significantly disrupting a major platform for illegal activities involving stolen data and hacking tools.

2. Introduction of NCSC-U.K’s Share and Defend System

• Details: The UK’s National Cyber Security Centre (NCSC) has launched the Share and Defend system.
• Outcome: This new system provides ISPs with the capability to block access to malicious domains, similar to protections used by government networks. This initiative aims to reduce cybercrime and online fraud by sharing threat intelligence with industry partners.

3. MITRE’s EMB3D Threat Model for Embedded Devices

• Details: MITRE has released the EMB3D threat model to address security challenges in embedded devices.
• Outcome: This model aligns with and expands on existing security frameworks such as Common Weakness Enumeration (CWE) and MITRE ATT&CK, offering a detailed approach to mitigating cyber threats targeting embedded systems.

4. Singapore’s Enhanced Cybersecurity Act

• Details: The Singapore government has updated its Cybersecurity Act, enhancing the regulatory powers of its primary cybersecurity agency.
• Outcome: These changes require critical infrastructure operators and third-party providers to report cyber incidents and comply with new regulations, aimed at strengthening national cybersecurity in response to increasing threats and reliance on cloud services.

5. FCC’s New Proposal for BGP Security

• Details: The Federal Communications Commission (FCC) is proposing new requirements for ISPs to improve the security of the Border Gateway Protocol (BGP).
• Outcome: The proposal mandates ISPs to develop and document BGP security plans, utilizing the Resource Public Key Infrastructure (RPKI) to enhance internet routing security.

---

Summary of Negative Developments

1. Espionage by Turla Group

• Details: Researchers have uncovered espionage activities by the Turla group using new backdoors named LunarWeb and LunarMail.
• Outcome: An unnamed European Ministry of Foreign Affairs and its diplomatic missions in the Middle East were targeted. These backdoors use HTTP(S) and email communications for command-and-control.

2. Ebury Botnet Compromises

• Details: The Ebury botnet has compromised over 400,000 Linux servers since 2009, with over 100,000 still affected.
• Outcome: The botnet has been used for various malicious activities, including spam distribution, web traffic redirection, and credential theft. It employs multiple infection vectors, including SSH credential theft.

3. Microsoft Patch Tuesday

• Details: Microsoft released updates addressing 61 security vulnerabilities.
• Outcome: Among these, two zero-day vulnerabilities in the Windows MSHTML Platform and Desktop Window Manager (DWM) Core Library are actively exploited, posing significant risks.

4. INC Ransom RaaS Operation

• Details: A cybercriminal known as ‘salfetka’ is selling the source code of the INC Ransom RaaS operation.
• Outcome: The sale includes ransomware versions for Windows and Linux/ESXi. This indicates possible internal changes or a rebranding of the ransomware group.

5. DanaBot Malware Campaign

• Details: Attackers are using DanaBot malware, distributed via spam emails disguised as job applications.
• Outcome: The malware propagates through Word attachments, executing via PowerShell to steal data such as screenshots and credentials.

6. Kimsuky APT Group Activities

• Details: The North Korean Kimsuky APT group has been using fake Facebook accounts to deliver malware.
• Outcome: The group targeted individuals in security-related fields by impersonating a South Korean public official, distributing malware through decoy documents on Messenger.

7. LockBit Black Ransomware Campaign

• Details: The re-emerged Phorpiex botnet group is orchestrating a LockBit Black ransomware campaign.
• Outcome: Millions of phishing emails with ZIP attachments have been sent, leveraging a peer-to-peer botnet that evades traditional detection methods.

8. Apple Product Vulnerabilities

• Details: Numerous security issues in Apple products pose significant risks.
• Outcome: The most severe flaw allows arbitrary code execution, affecting macOS, iOS, iPadOS, watchOS, and tvOS.

9. Malicious Use of GoTo Meeting Software

• Details: Attackers are exploiting GoTo Meeting to execute Remcos RAT malware.
• Outcome: They use deceptive LNK files and DLL sideloading techniques to bypass security and execute malicious payloads.

---

Emerging Threats

1. New Linux Malware by Kimsuky Group

• Details: The Kimsuky group has developed a new Linux malware called Gomir, distributed through trojanized software installers.
• Outcome: This malware targets South Korean government organizations, utilizing supply-chain attacks.

2. Google Chrome Zero-Day Vulnerability

• Details: Google issued an emergency update for Chrome to fix a high-severity zero-day vulnerability in the V8 JavaScript engine (CVE-2024-4947).
• Outcome: This is the third zero-day patch in a week, highlighting ongoing risks.

3. WiFi SSID Confusion Vulnerability

• Details: A new WiFi vulnerability (CVE-2023-52424) allows attackers to execute SSID Confusion attacks.
• Outcome: This flaw can lead to traffic interception and manipulation by tricking users into connecting to spoofed networks.

4. Phishing Attacks Using DocuSign

• Details: There is a surge in phishing attacks posing as DocuSign documents.
• Outcome: These attacks aim to steal sensitive information by tricking users into clicking on malicious links.

5. Arcserve UDP Software Vulnerabilities

• Details: The U.K’s NHS warned about vulnerabilities in Arcserve Unified Data Protection (UDP) software.
• Outcome: These flaws could lead to data theft and ransomware attacks if not addressed.

6. Robocall Scammers Identified

• Details: The FCC identified a group of robocall scammers known as Royal Tiger.
• Outcome: Despite previous warnings, this group continues to conduct illegal robocall campaigns, posing risks to consumers.

---

This report highlights the ongoing efforts in combating cyber threats and the evolving tactics used by cybercriminals. Staying informed and vigilant is crucial for maintaining robust cybersecurity defenses.

Elite Defender Security
Protecting Your Digital Frontier