Feb 29 2024
Welcome to Gone Phishing, your daily cybersecurity newsletter that acts as cybercriminals’ judge, jury, and executioner ⚖️ #TheApprentice
Today’s hottest cybersecurity news stories:
???? Tax-themed ‘TimbreStealer’ malware targets Mexican IT users ????????
???? Middle East Aerospace, Defence targeted by Iran-linked cyber threat ????
⚠️ Ubiquiti EdgeRouter users beware! MooBot is looking for recruits ????
giphy.com
Since November 2023, Mexican users have fallen victim to tax-themed phishing attacks orchestrated by a sophisticated threat actor leveraging previously undocumented Windows malware dubbed TimbreStealer. Cisco Talos, the cybersecurity research division of Cisco Systems, uncovered this nefarious activity, highlighting the authors’ proficiency in deploying evasive tactics. ????
This threat actor, known for distributing the Mispadu banking trojan in September 2023, employs advanced obfuscation techniques to evade detection and ensure persistence. Geofencing mechanisms are leveraged to target Mexican users specifically, presenting an innocuous blank PDF file to users from other locations, thus avoiding suspicion. ????????
To further thwart security measures, custom loaders and direct system calls are utilised to bypass conventional API monitoring. Additionally, the malware employs Heaven’s Gate to execute 64-bit code within a 32-bit process, a technique reminiscent of HijackLoader’s recent tactics. ????????️
TimbreStealer boasts embedded modules for orchestration, decryption, and protection of the main binary. It conducts rigorous checks to ascertain whether it’s operating within a sandbox environment, the system language is non-Russian, and the time zone corresponds to Latin American regions. The orchestrator module performs file and registry key checks to ensure the system’s integrity before proceeding with the payload installation. ????????
The primary payload of TimbreStealer is designed to harvest a plethora of data, including credential information, system metadata, accessed URLs, and specific file types. Notably, it targets remote desktop software and focuses on industries such as manufacturing and transportation. Cisco Talos identified overlaps with the Mispadu campaign, underscoring the threat actor’s adaptability and persistence. ????????
As cybercriminals continue to refine their tactics, organisations must remain vigilant and adopt proactive security measures to safeguard against emerging threats and mitigate potential risks. The collaborative efforts of cybersecurity researchers and industry stakeholders are essential in combating the ever-evolving cyber threat landscape. ????????
Signup for Free
Learn AI in 5 minutes a day. We’ll teach you how to save time and earn more with AI. Join 400,000+ free daily readers for trending tools, productivity boosting prompts, the latest news, and more.
An Iran-linked cyber threat group, UNC1549, is reportedly behind a series of attacks targeting aerospace, aviation, and defence sectors in the Middle East, including Israel and the U.A.E. According to Mandiant, a cybersecurity company, other potential targets include Turkey, India, and Albania.
???? Who are They?
UNC1549, also known as Smoke Sandstorm and Crimson Sandstorm, has been active since at least June 2022. The group, possibly affiliated with the Islamic Revolutionary Guard Corps (IRGC), uses various aliases like Imperial Kitten and TA456. Their activities are still ongoing as of February 2024.
???? How do They Operate?
The attacks involve sophisticated tactics, including spear-phishing emails with fake job offers or links related to Israel-Hamas conflicts. Once clicked, these links deploy malicious software known as MINIBIKE and MINIBUS, allowing the group to gain access to networks. They also use Microsoft Azure cloud infrastructure for command-and-control operations.
????️ Challenges for Defenders
Mandiant warns that the use of tailored job-themed lures and cloud infrastructure makes it difficult for network defenders to detect and mitigate these attacks effectively.
???? What’s at Stake?
The intelligence collected by UNC1549 is deemed crucial for Iranian interests and may be used for espionage or other operations. The attacks could have significant implications for global security.
???? Global Threat Landscape
CrowdStrike’s Global Threat Report for 2024 highlights similar activities by other threat actors associated with Iran. Banished Kitten and Vengeful Kitten, for instance, have targeted critical infrastructure and conducted data-wiping activities in Israel.
???? The Bigger Picture
Despite the cyber threats, there’s been a noticeable absence of conflict-related activity from Hamas-linked adversaries, attributed to possible power and internet disruptions in the region.
Stay tuned for more updates on this developing story! ????????
???? The Motley Fool: “Fool me once, shame on — shame on you. Fool me — you can’t get fooled again.” Good ol’ George Dubya ???? Let us tell who’s not fooling around though; that’s the Crüe ???? at Motley Fool. You’d be a fool (alright, enough already! ????) not to check out their Share Tips from time to time so your savings can one day emerge from their cocoon as a beautiful butterfly! ???? Kidding aside, if you check out their website they’ve actually got a ton of great content with a wide variety of different investment ideas to suit most budgets ???? (LINK)
???? Wander: Find your happy place. Cue Happy Gilmore flashback ????️⛳????????️ Mmmm Happy Place… ???? So, we’ve noticed a lot of you guys are interested in travel. As are we! We stumbled upon this cool company that offers a range of breath-taking spots around the United States and, honestly, the website alone is worth a gander. When all you see about the Land of the free and the home of the brave is news of rioting, looting and school shootings, it’s easy to forget how beautiful some parts of it are. The awe-inspiring locations along with the innovative architecture of the hotels sets Wander apart from your run of the mill American getaway ????️???? (LINK)
???? Digital Ocean: If you build it they will come. Nope, we’re not talking about a baseball field for ghosts ⚾???????? (Great movie, to be fair ????). This is the Digital Ocean who’ve got a really cool platform for building and hosting pretty much anything you can think of. If you check out their website you’ll find yourself catching the buzz even if you can’t code (guilty ????). But if you can and you’re looking for somewhere to test things out or launch something new or simply enhance what you’ve got, we’d recommend checking out their services fo’ sho ???? And how can you not love their slogan: Dream it. Build it. Grow it. Right on, brother! ???? (LINK)
Cybersecurity agencies from multiple countries, including the U.S., are urging users of Ubiquiti EdgeRouter to take immediate protective measures. This comes after the takedown of a botnet named MooBot, operated by the Russia-linked threat group APT28, as part of Operation Dying Ember.
???? About the Threat
MooBot, utilised by APT28, was used to carry out covert cyber operations, dropping custom malware for further exploitation. APT28, associated with Russia’s GRU, has been active since 2007.
???? How It Works
The attackers compromised EdgeRouters globally to harvest credentials, proxy network traffic, and host phishing pages. The attacks targeted various sectors across multiple countries, including aerospace, defense, education, and more.
???? Protective Measures
Users are advised to perform a hardware factory reset, update firmware, change default credentials, and implement firewall rules to prevent remote management exposure.
????️ Staying Safe
Nation-state hackers are increasingly using routers as launchpads for attacks, emphasising the importance of robust cybersecurity measures.
Ensure your security measures are up-to-date to stay protected against emerging cyber threats! ????️????
That’s all for today folks! ????
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
????️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday ????
???? Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for ????
???? Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future ????
Let us know what you think!
So long and thanks for reading all the phish!
