Anomali Cyber Watch: Massive Growth of DDoSia Project, Proxyjacking Joins Cryptomining, 8Base Ransomware Became 2d Most Prolific, and More
The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Backdoors, Bootkits, Cyberespionage, DDoS, Iran, Ransomware, Russia, Spearphishing, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Trending Cyber News and Threat Intelligence
Following NoName057(16) DDoSia Project’s Targets
(published: June 29, 2023)
The pro-Russia DDoS project, DDoSia, has seen a massive 2,400% growth in less than a year, with over 10,000 people helping conduct attacks on Western organizations. The project was launched by a pro-Russian hacktivist group known as NoName057(16) in early 2022. The registration of new users is automated thanks to a Telegram bot, and DDoSia payloads are available for Linux, macOS, and Windows. Sekoia researchers decrypted DDoSia C2 traffic to find a large number of targeted countries dominated by Lithuania, Ukraine, Poland, Italy, and Czech Republic. NoName057(16) is very sensitive to news cycles: on 21 June 2023, it DDoSed French transportation targets following the announced delivery of a French air defense system to Kiev. And on June 24, 2023, the actors singled out two Wagner sites just as that private paramilitary group attempted a mutiny in Russia.
Analyst Comment: Hacktivist groups tend to utilize DDoS attacks as their main vector to affect businesses and government entities that they are not happy with. Denial-of-service attacks can potentially cost your company loss in revenue because severe attacks can shut down online services for extended periods of time. Organizations should implement DDoS protection measures and put in place a business continuity plan in the unfortunate case that your company is the target of a significant DDoS attack.
MITRE ATT&CK: [MITRE ATT&CK] T1498 - Network Denial Of Service | [MITRE ATT&CK] T1573 - Encrypted Channel
Tags: actor:NoName057(16), source-country:Russia, malware:DDoSia, malware-type:DDoS tool, technique:DDoS, target-country:Lithuania, target-country:Ukraine, target-country:Poland, target-country:Italy, target-country:Czechia, target-country:France, abused:AES-GCM
PSA: Unpatched Critical Privilege Escalation Vulnerability in Ultimate Member Plugin Being Actively Exploited
(published: June 29, 2023)
The Ultimate Member plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.6, that were installed on over 200,000 sites. This newly-discovered vulnerability was registered as CVE-2023-3460 and is considered critical (CVSSv3.1 score: 9.8). Wordfence researchers have identified network indicators for the ongoing zero-day exploitation, but do not provide any attribution.
Analyst Comment: Until a security patch for CVE-2023-3460 is developed, site administrators should uninstall the Ultimate Member plugin. Check for new user accounts created with administrator privileges. Check for plugins and themes that may not have been installed previously. All known network indicators associated with this Ultimate Member plugin exploitation campaign are available in the Anomali platform and customers are advised to block these on their infrastructure.
MITRE ATT&CK: [MITRE ATT&CK] T1190 - Exploit Public-Facing Application | [MITRE ATT&CK] T1136 - Create Account
Tags: target-software:Ultimate Member, vulnerability:CVE-2023-3460, vulnerability-type:Privilege escalation, target-identity:WordPress user
Proxyjacking: The Latest Cybercriminal Side Hustle
(published: June 29, 2023)
Akamai researchers have discovered a proxyjacking campaign that is targeting vulnerable SSH servers, then launching Docker services that share the victims bandwidth for money. This campaign uses a compromised web server to distribute necessary dependencies, actively searches for and removes competing instances, and employs obfuscation techniques to evade detection. The attack chain involves a bash script downloading and executing a curl binary and continuing with an otherwise fileless attack. Proxyjacking is a stealthier alternative to cryptojacking and it can enable cybercriminals to leverage proxies to obfuscate their attack origins.
Analyst Comment: Network defenders should isolate all unusual artifacts, not just those that are considered malicious, to prevent malicious actors from exploiting the system. Check for unwanted proxyjackin by grepping for strings related to companies like Peer2Profit and Honeygain that indiscriminately pay for contributing to proxy networks.
MITRE ATT&CK: [MITRE ATT&CK] T1190 - Exploit Public-Facing Application | [MITRE ATT&CK] Defense Evasion - Obfuscated Files or Information [T1027] | [MITRE ATT&CK] T1496 - Resource Hijacking | [MITRE ATT&CK] T1090 - Proxy
Tags: technique:Proxyjacking, technique:Compromised website, technique:Proxy, abused:Peer2Profit, abused:Honeygain, target-system:Web server, target-system:SSH server
Charming Kitten Updates POWERSTAR with an InterPlanetary Twist
(published: June 28, 2023)
In May 2023, the Iran-sponsored group dubbed Charming Kitten was observed using a new delivery method for its custom POWERSTAR framework. The observed spearphishing attack involved multiple benign email exchanges before delivering a password-protected RAR file containing a malicious LNK file, with the password being provided in a subsequent email. Volexity researchers have also observed Charming Kitten moving their malware distribution to Backblaze B2 buckets, IPFS, and privately hosted infrastructure. The new POWERSTAR version has improved operational security measures and is believed to be supported by a custom server-side component. The POWERSTAR backdoor has received at least four additional modules. It raises the total number of known optional modules to nine, with functionality varying from information gathering to removing forensic artifacts.
Analyst Comment: Defense-in-depth is the best way to ensure safety from advanced government-sponsored groups like Charming Kitten. Defense-in-depth can include network and endpoint security, social engineering training (such as training exercises to help detect phishing emails) for staff and robust threat intelligence capabilities. YARA rules and indicators associated with the new POWERSTAR usage are available in the Anomali platform for detection and prevention.
MITRE ATT&CK: [MITRE ATT&CK] T1566.001 - Phishing: Spearphishing Attachment | [MITRE ATT&CK] Defense Evasion - Obfuscated Files or Information [T1027] | [MITRE ATT&CK] Defense Evasion - Deobfuscate/Decode Files or Information [T1140] | [MITRE ATT&CK] T1113 - Screen Capture
Signatures: YARA Rules by Volexity: apt_win_powerstar_persistence_batch | apt_win_powerstar_memonly | apt_win_powerstar_logmessage | apt_win_powerstar_lnk | apt_win_powerstar_decrypt_function | apt_win_powerstar
Tags: actor:Charming Kitten, malware:POWERSTAR, malware-type:Backdoor, source-country:Iran, abused:PowerShell, abused:C#, abused:Backblaze B2, abused:IPFS, file-type:RAR, file-type:LNK, target-system:Windows
8Base Ransomware: A Heavy Hitting Player
(published: June 28, 2023)
The 8Base ransomware group has been active since March 2022 with a significant spike in activity in June of 2023 making it one of the most prolific ransomware threats, second only to LockBit. VMware researchers have revealed similarities between 8Base and the RansomHouse ransomware group. They have also discovered a second 8Base crypter variant based on Phobos ransomware version 2.9.1 with SmokeLoader for initial obfuscation on ingress, unpacking, and loading of the ransomware. 8Base is targeting smaller businesses with the top five targeted industries being business services, finance, manufacturing, information technology, and health care, in that order.
Analyst Comment: One of the best defenses against Smokeloader is anti-phishing training. Never click on attachments from spam emails or untrusted senders. Indicators associated with the 8Base ransomware are available in the Anomali platform and customers are advised to block these on their infrastructure.
MITRE ATT&CK: [MITRE ATT&CK] T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | [MITRE ATT&CK] T1135 - Network Share Discovery | [MITRE ATT&CK] T1134.001 - Access Token Manipulation: Token Impersonation/Theft | [MITRE ATT&CK] T1562.001: Disable or Modify Tools | [MITRE ATT&CK] T1027.002 - Obfuscated Files or Information: Software Packing | [MITRE ATT&CK] T1490: Inhibit System Recovery | [MITRE ATT&CK] T1486: Data Encrypted for Impact
Tags: actor:8Base, malware:8Base, malware-type:Ransomware, malware:SmokeLoader, malware:Phobos, abused:SystemBC, file-type:8base, file-type:EXE, target-system:Windows
BlackLotus Mitigation Guide
(published: June 22, 2023)
BlackLotus is a sophisticated malware that targets UEFI-booting versions of Windows such as Windows 10 and 11, including virtual machines. BlackLotus starts by acting as a boot software. It exploits a CVE-2022-21894 Secure Boot bypass vulnerability (Baton Drop). In Secure Boot-signed copies of the Windows Boot Manager it truncates the Secure Boot policy values. The vulnerable boot manager versions allow boot to continue. BlackLotus injects a version of shim utilizing its own Machine Owner Key to vouch for signatures on its own malicious binaries. According to the US National Security Agency, the vulnerable boot loaders are not revoked, so attackers can often substitute fully patched boot loaders with vulnerable versions to execute BlackLotus.
Analyst Comment: Patches are available for Windows 8.1, 10, and 11. Network defenders should enable the optional software mitigation from May 2023 Microsoft patches that prevent these rollbacks of the boot manager and kernel versions. After the BlackLotus malicious stack was fully installed it can not be deleted from the infected machine without full system reimagining.
MITRE ATT&CK: [MITRE ATT&CK] T1542.003 - Pre-OS Boot: Bootkit | [MITRE ATT&CK] T1553 - Subvert Trust Controls
Tags: malware:BlackLotus, malware-type:Bootkit, vulnerability:CVE-2022-21894, vulnerability:Baton Drop, target-system:UEFI, target-system:VM, target-system:Windows 10, target-system:Windows 10, target-system:Windows
