In this week’s Shadow Talk podcast episode, the Digital Shadows (now ReliaQuest) Research Team covered a range of activity. Here’s a quick roundup.
Dark Caracal Infiltrates Devices for Espionage
The “Dark Caracal” threat group has conducted espionage through mobile and desktop malware variants since 2012, researchers have determined. The group delivered malware via phishing links and physical access to targeted devices, harvesting user information without particularly sophisticated tactics, techniques and procedures (TTPs). Although Dark Caracal has been allegedly linked to the Lebanese state, inconsistent geographic targeting, lack of tailored phishing content and operational security flaws do not suggest an organized, state-led campaign. Mobile devices will highly likely remain vulnerable to espionage and financially driven threats, given the valuable nature of their stored content.
Dridex Campaign Debuts Distribution Tactic
A new spam email campaign delivering the “Dridex” banking malware demonstrated a previously unreported tactic: compromising file transfer protocol (FTP) servers to act as the download location for malicious documents. The threat actors were likely trying to avoid detection by email gateways and network policies, which consider FTP servers as trusted locations. Security company Forcepoint attributed the campaign to the “Necurs” botnet, based on its previous association with Dridex, although this was a low-scale campaign in comparison with prior Necurs activity. More targeting of FTP servers to distribute malware is likely.
Turla Updates Malware After NCSC Public Advisory
The “Neuron” malware associated with “Turla”, a Russia-linked advanced persistent threat (APT) group, was updated five days after a public advisory on Turla activity by the United Kingdom National Cyber Security Centre (NCSC). Neuron was adapted to avoid identification by the malware detection signatures published by the NCSC. Although the reason for the update is unclear, Turla may have responded to public reporting on its own campaigns. Alternatively, Turla may have experienced diminished success following the advisory, when new defensive measures were taken. As threat actors can quickly change malware obfuscation techniques, organizations should be proactive about network security, using threat intelligence, network log monitoring and detection signatures.
Misconfigured Jenkins Servers Exposed Companies’ Sensitive Data
A researcher identified misconfigured servers associated with Jenkins, a software development tool. The accessed servers contained sensitive data pertaining to multiple British companies, including usernames, passwords, private keys and Amazon Work Space access tokens. The researcher identified exposed platforms using internet of things search engine Shodan, and then scraped revealed URLs to find unauthenticated login pages. It is unknown whether threat actors accessed any misconfigured servers; however, the method used to detect the vulnerable servers was likely replicable. Companies should ensure use of unique credentials and multi-factor authentication for internet-facing and cloud-based assets.
Russian Fuel Customers Shortchanged in Criminal Operation
A Russian criminal operation was disrupted after the perpetrators used software to over-charge individuals purchasing gas in Southern Russia. Malicious software was applied to electronic gas pumps and reportedly charged customers for more fuel than was delivered, shortchanging victims 3% to 7% per gallon of fuel pumped. The software enabled pumps, cash registers and back-end systems to display false data to victims and relied on complicit insiders at fuel stations. The developer of the software was reportedly arrested. The lucrative nature of the fuel industry means it will continue to be targeted by financially motivated criminal actors.
Fancy Bears Leaks Documents from International Luge Federation
The “Fancy Bears” hacking group publicly leaked documents purportedly sourced from the International Luge Federation (FIL), and claimed the violation of “principles of fair play”, particularly regarding drug tests. It is unknown how and when the documents were obtained, although threat group “APT-28” (aka Fancy Bear) allegedly targeted certain members of the International Olympic Winter Sports Federations in late 2017, including the FIL. The precise relationship between Fancy Bears and APT-28 is not publicly known, although APT-28 were previously associated with the compromise of the World Anti-Doping Agency in 2016. More leaks by Fancy Bears are likely in the near future.
US Media Personalities Targeted in Twitter Phishing Campaign
Media personalities and conservative individuals in the United States were targeted by a Twitter phishing campaign, potentially conducted by the Turkish Cyber Army. At least three Twitter accounts were confirmed as compromised, including that of journalists Sara Carter (@SaraCarterDC) and Greta Van Susteren (@greta), as well as Sheriff David Clarke (@SheriffClarkeTC). The campaign employed a spoofed Twitter login page, which was likely used to harvest credentials and compromise the three accounts. Although no official claim of responsibility was detected from the Turkish Cyber Army, this campaign would be consistent with previously observed activity. More media outlets will likely be targeted in the immediate future.
Listen to this week’s Shadow Talk Episode here:
Subscribe to our weekly newsletter to get the latest podcast and other research by Digital Shadows (now ReliaQuest).