Blog
Anomali Cyber Watch: Fractureiser Attempted Clipboard-Poisoning VM Escape, Asylum Ambuscade Spies as a Side Job, Stealth Soldier Connected with The Eye on The Nile Campaign, and More
Anomali Threat Research
June 13, 2023
<div id="weekly">
<p id="intro">The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics:<b> Advanced fee fraud, Cyberespionage, Extortion, Infostealers, SQL injection, Traffic direction system,</b> and<b> Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. <img src="https://cdn.filestackcontent.com/cJTaWiwjRjOO4P2VJ2eF"/><br/>
<b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p>
<div class="trending-threats-article" id="trending-threats">
<h2 id="trendingthreats">Trending Cyber News and Threat Intelligence</h2>
<h3 id="article-1"><a href="https://www.helpnetsecurity.com/2023/06/12/moveit-patch-again/" target="_blank">It’s Time to Patch Your MOVEit Transfer Solution Again!</a></h3>
<p>(published: June 12, 2023)</p>
<p>On June 9, 2023, Progress Software uncovered additional SQL injection vulnerabilities that could potentially be used by unauthenticated attackers to grab data from the MOVEit Transfer database. The company released patches/fixed versions and deployed a new patch to all MOVEit Cloud clusters to address the new vulnerabilities. The Cl0p cyber extortion gang has been actively exploiting another recently-disclosed MOVEit Transfer vulnerability (CVE-2023-34362) and has targeted a variety of organizations from small businesses to big enterprises in a variety of sectors across the world. Aer Lingus, the BBC, Boots, British Airways, the government of Nova Scotia province (Canada), and Zellis are among the victim organizations. Kroll researchers have found evidence of similar activity occurring in April 2022 and July 2021, indicating that the attackers were testing access to organizations and grabbing information from the MOVEit Transfer servers to identify which organization they were accessing.<br/>
<b>Analyst Comment:</b> MOVEit Transfer 2020.0.x (12.0) or older must be upgraded to a supported version, for newer versions apply the security patches available from Progress Software since June 10, 2023 <a href="https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-Pending-Reserve-Status-June-9-2023" target="_blank">(Link)</a>. Organizations should seek confirmations from their suppliers, especially those handling data on their behalf, whether they utilize MOVEit in their services, and confirm any compromises and are up to date with recommended mitigation and patches.<br/>
<b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/attackpattern/10012" target="_blank">[MITRE ATT&CK] T1190 - Exploit Public-Facing Application</a> | <a href="https://ui.threatstream.com/attackpattern/9597" target="_blank">[MITRE ATT&CK] T1036 - Masquerading</a> | <a href="https://ui.threatstream.com/attackpattern/9693" target="_blank">[MITRE ATT&CK] T1560.001 - Archive Collected Data: Archive Via Utility</a><br/>
<b>Tags:</b> target-software:MOVEit Transfer, vulnerability:CVE-2023-34362, target-country:Canada, target-country:US, actor:Cl0p, technique:SQL injection, threat-type:Data leak, threat-type:Extortion, target-country:UK, target-country:Canada, target-system:Windows</p>
<h3 id="article-2"><a href="https://www.bitdefender.com/blog/labs/infected-minecraft-mods-lead-to-multi-stage-multi-platform-infostealer-malware/" target="_blank">Infected Minecraft Mods Lead to Multi-Stage, Multi-Platform Infostealer Malware</a></h3>
<p>(published: June 9, 2023)</p>
<p>A new four-stage infostealer malware dubbed Fractureiser has been identified in several Minecraft mods and plugins hosted on the CurseForge and Bukkit modding communities. Since April 2023, the malware has been spreading through malicious updates from compromised accounts and has been downloaded several million times. Fractureiser has been targeting both Windows and Linux systems predominantly located in the US. Its final stage was observed attempting sandbox escape through constant clipboard poisoning in Windows Sandbox instances that are often used for testing mods. Fractureiser steals cookies and login data from browsers, steals Minecraft and Discord authentication tokens, and swaps crypto-currency wallet addresses.<br/>
<b>Analyst Comment:</b> When a malware manipulates data and changes payment details in the clipboard or messages, it is crucial to detect and prevent the possible losses via payment information double-checking (including via alternative channels such as phone calls). All known Fractureiser indicators are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/>
<b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/attackpattern/9609" target="_blank">[MITRE ATT&CK] T1195 - Supply Chain Compromise</a> | <a href="https://ui.threatstream.com/attackpattern/23207" target="_blank">[MITRE ATT&CK] Command and Control - Remote File Copy [T1105]</a> | <a href="https://ui.threatstream.com/attackpattern/9606" target="_blank">[MITRE ATT&CK] T1565 - Data Manipulation</a> | <a href="https://ui.threatstream.com/attackpattern/10025" target="_blank">[MITRE ATT&CK] T1555.003 - Credentials from Password Stores: Credentials From Web Browsers</a> | <a href="https://ui.threatstream.com/attackpattern/10031" target="_blank">[MITRE ATT&CK] T1539 - Steal Web Session Cookie</a> | <a href="https://ui.threatstream.com/attackpattern/10103" target="_blank">[MITRE ATT&CK] T1553.006 - Subvert Trust Controls: Code Signing Policy Modification</a><br/>
<b>Tags:</b> malware:Fractureiser, malware-type:Infostealer, detection:Trojan.Java.Fractureiser, target-identity:Minecraft user, technique:Supply chain compromise, technique:Sandbox escape, target-country:US, file-type:DLL, file-type:EXE, file-type:JAR, target-system:Linux, target-system:Windows</p>
<h3 id="article-3"><a href="https://www.welivesecurity.com/2023/06/08/asylum-ambuscade-crimeware-or-cyberespionage/" target="_blank">Asylum Ambuscade: Crimeware or Cyberespionage?</a></h3>
<p>(published: June 8, 2023)</p>
<p>Asylum Ambuscade is a cybercrime group that has targeted all the inhabited continents and has been performing both cybercrime and cyberespionage operations since at least 2020. Its cybercrime operations typically start with a malicious redirect triggered either by a malicious Google Ad or through a specific traffic direction system dubbed 404 TDS. The most targeted regions were North America (the US followed by Canada) and Europe (especially Germany) - cryptocurrency traders, individuals and various small and medium businesses. Asylum Ambuscade cyberespionage operations have been targeting government entities in Europe and Central Asia with malicious spearphishing attachments. The following infection steps are similar for both kinds of campaigns: an MSI package installing a first-stage downloader (SunSeed) , followed by a second-stage downloader (AHKBOT, NODEBOT) and various downloaded plugins for screenshotting, password-stealing, and other activities. To avoid detection, the group rewrites its plugins and downloaders in different languages: AutoHotkey, JavaScript, Lua, Python, Tcl, and VBS.<br/>
<b>Analyst Comment:</b> Many advanced attacks start with basic techniques such as unwarranted email with malicious attachment that requires the user to open it and enable macroses. It is important to teach your users basic online hygiene and awareness regarding phishing attachments and malicious Google Ads. Indicators associated with recent (2022-Q1 2023) Asylum Ambuscade campaigns are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/>
<b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/attackpattern/10043" target="_blank">[MITRE ATT&CK] T1583.003 - Acquire Infrastructure: Virtual Private Server</a> | <a href="https://ui.threatstream.com/attackpattern/23223" target="_blank">[MITRE ATT&CK] Resource Development - Develop Capabilities: Malware [T1587.001]</a> | <a href="https://ui.threatstream.com/attackpattern/3716" target="_blank">[MITRE ATT&CK] T1189: Drive-by Compromise</a> | <a href="https://ui.threatstream.com/attackpattern/10001" target="_blank">[MITRE ATT&CK] T1566.001 - Phishing: Spearphishing Attachment</a> | <a href="https://ui.threatstream.com/attackpattern/9853" target="_blank">[MITRE ATT&CK] T1059.005 - Command and Scripting Interpreter: Visual Basic</a> | <a href="https://ui.threatstream.com/attackpattern/9827" target="_blank">[MITRE ATT&CK] T1059.006 - Command and Scripting Interpreter: Python</a> | <a href="https://ui.threatstream.com/attackpattern/10112" target="_blank">[MITRE ATT&CK] T1059.007 - Command and Scripting Interpreter: Javascript</a> | <a href="https://ui.threatstream.com/attackpattern/14432" target="_blank">[MITRE ATT&CK] picus-security: The Most Used ATT&CK Technique — T1059 Command and Scripting Interpreter</a> | <a href="https://ui.threatstream.com/attackpattern/9615" target="_blank">[MITRE ATT&CK] T1204.002 - User Execution: Malicious File</a> | <a href="https://ui.threatstream.com/attackpattern/9933" target="_blank">[MITRE ATT&CK] T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder</a> | <a href="https://ui.threatstream.com/attackpattern/22938" target="_blank">[MITRE ATT&CK] Defense Evasion - Obfuscated Files or Information [T1027]</a> | <a href="https://ui.threatstream.com/attackpattern/10025" target="_blank">[MITRE ATT&CK] T1555.003 - Credentials from Password Stores: Credentials From Web Browsers</a> | <a href="https://ui.threatstream.com/attackpattern/9701" target="_blank">[MITRE ATT&CK] T1087.002 - Account Discovery: Domain Account</a> | <a href="https://ui.threatstream.com/attackpattern/9702" target="_blank">[MITRE ATT&CK] T1010 - Application Window Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9873" target="_blank">[MITRE ATT&CK] T1482 - Domain Trust Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9710" target="_blank">[MITRE ATT&CK] T1057 - Process Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9986" target="_blank">[MITRE ATT&CK] T1518.001 - Software Discovery: Security Software Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/13021" target="_blank">[MITRE ATT&CK] Picus: The System Information Discovery Technique Explained - MITRE ATT&CK T1082</a> | <a href="https://ui.threatstream.com/attackpattern/9983" target="_blank">[MITRE ATT&CK] T1016 - System Network Configuration Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9888" target="_blank">[MITRE ATT&CK] T1056.001 - Input Capture: Keylogging</a> | <a href="https://ui.threatstream.com/attackpattern/9796" target="_blank">[MITRE ATT&CK] T1115 - Clipboard Data</a> | <a href="https://ui.threatstream.com/attackpattern/9671" target="_blank">[MITRE ATT&CK] T1113 - Screen Capture</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/9617" target="_blank">[MITRE ATT&CK] T1041 - Exfiltration Over C2 Channel</a><br/>
<b>Tags:</b> actor:Asylum Ambuscade, malware:AHKBOT, malware:NODEBOT, malware-type:Downloader, malware-type:Infostealer, malware:SunSeed, malware:Cobalt Strike, malware-type:RAT, target-region:North America, target-region:Europe, target-region:Central Asia, target-country:Armenia, target-country:Canada, target-country:Germany, target-country:US, abused:Remote Utilities, abused:hVNC, abused:Google Ad, technique:TDS, abused:AutoHotkey, abused:JavaScript, abused:Lua, abused:Python, abused:Tcl, abused:VBS, vulnerability:Follina, vulnerability:CVE-2022-30190, file-type:AHK, file-type:DLL, file-type:DOC, file-type:EXE, file-type:Excel, file-type:MSI, file-type:JS, target-system:Windows</p>
<h3 id="article-4"><a href="https://research.checkpoint.com/2023/stealth-soldier-backdoor-used-in-targeted-espionage-attacks-in-north-africa/" target="_blank">Stealth Soldier Backdoor Used in Targeted Espionage Attacks in North Africa</a></h3>
<p>(published: June 8, 2023)</p>
<p>Check Point researchers have identified an ongoing espionage operation against targets in North Africa involving a previously-undisclosed, modular backdoor called Stealth Soldier. The malware is likely delivered using social engineering and its infection chain includes downloading six additional files. Stealth Soldier regularly checks for updates and supports functionality such as keystroke logging, screenshot and microphone recordings, and file exfiltration. Its versions were observed from October 2020 to February 2023 likely targeting government entities in Libya. Its hosting infrastructure and domain naming convention overlaps with the The Eye on the Nile campaign against Egyptian civilian society in 2019.<br/>
<b>Analyst Comment:</b> Stealth Soldier tend to re-use previously-detected infrastructure, use hard-coded XOR keys, and specific HTTP POST headers. Network defenders should train their users to recognize social engineering such as spear phishing. All known Stealth Soldier indicators are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/>
<b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/attackpattern/23207" target="_blank">[MITRE ATT&CK] Command and Control - Remote File Copy [T1105]</a> | <a href="https://ui.threatstream.com/attackpattern/22938" target="_blank">[MITRE ATT&CK] Defense Evasion - Obfuscated Files or Information [T1027]</a> | <a href="https://ui.threatstream.com/attackpattern/22186" target="_blank">[MITRE ATT&CK] Defense Evasion - Deobfuscate/Decode Files or Information [T1140]</a> | <a href="https://ui.threatstream.com/attackpattern/9931" target="_blank">[MITRE ATT&CK] T1053.005 - Scheduled Task/Job: Scheduled Task</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/9888" target="_blank">[MITRE ATT&CK] T1056.001 - Input Capture: Keylogging</a> | <a href="https://ui.threatstream.com/attackpattern/23209" target="_blank">[MITRE ATT&CK] Discovery - File and Directory Discovery [T1083]</a> | <a href="https://ui.threatstream.com/attackpattern/3708" target="_blank">[MITRE ATT&CK] T1005: Data from Local System</a> | <a href="https://ui.threatstream.com/attackpattern/10025" target="_blank">[MITRE ATT&CK] T1555.003 - Credentials from Password Stores: Credentials From Web Browsers</a> | <a href="https://ui.threatstream.com/attackpattern/3710" target="_blank">[MITRE ATT&CK] T1112: Modify Registry</a><br/>
<b>Tags:</b> malware:Stealth Soldier, malware-type:Backdoor, detection:Trojan.Wins.StealthSoldier, detection:Backdoor.WIN32.StealthSoldier, malware-type:Downloader, malware-type:Loader, target-country:Libya, target-region:North Africa, abused:.NET, abused:PowerShell, file-type:EXE, file-type:TXT, target-system:Windows</p>
<h3 id="article-5"><a href="https://www.trendmicro.com/en_us/research/23/f/impulse-team-massive-cryptocurrency-scam.html" target="_blank">Impulse Team’s Massive Years-Long Mostly-Undetected Cryptocurrency Scam</a></h3>
<p>(published: June 6, 2023)</p>
<p>A Russian-speaking threat actor named Impulse Team has been running a massive, affiliate cryptocurrency scam campaign since at least January 2021, possibly going back to 2016. Trend Macro researchers identified more than a thousand websites handled by different affiliates who are being paid a percentage through a program called Impulse Project. The scam works via an advanced fee fraud that involves tricking victims into believing that they have won a certain amount of cryptocurrency and need to pay a smaller fee to open an account on the website. Different affiliates used different domain registration methods and different social engineering delivery methods that included Twitter and Mastodon personal messages, and TikTok videos and ads.<br/>
<b>Analyst Comment:</b> Users should avoid clicking on suspicious ads and links, especially if they are being sent directly through private messages and social media. Investigate the advertised company and be skeptical of too-good-to-be-true opportunities. All known domains associated with this campaign are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/>
<b>Tags:</b> actor:Impulse Team, affiliate-program:Impulse Project, target-industry:Cryptocurrency, abused:Twitter, abused:Mastodon, abused:TikTok, threat-type:Scam, threat-type:Fraud, technique:Advanced fee fraud</p>
</div>
</div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
