Weekly Cyber Round-up

PoisonSeed campaign targets crypto companies and CRM and email providers

Silent Push researchers discovered a connection between the recent targeting of Troy Hunt’s Mailchimp account and the Coinbase cryptocurrency seed phrase poisoning operation. The campaign, dubbed PoisonSeed, involves phishing tactics and supply chain spam operations targeting cryptocurrency companies, as well as customer relationship management (CRM) and bulk email providers. The PoisonSeed actors set up seemingly legitimate phishing pages for CRM and bulk email companies before sending emails to victims. When credentials are successfully phished for an email provider, PoisonSeed automates a bulk download process of the email lists, with the threat actors creating a new API key for persistence if the password was reset. The tactics employed in the campaign overlap with those of Scattered Spider and CryptoChameleon, but may also be the work of a separate threat actor using similar tactics and infrastructure.

Rakuten Securities phishing campaign switches tactics to investment scam

Broadcom researchers warned that an ongoing campaign targeting Rakuten Securities users has switched social engineering tactics to an investment scam. The campaign previously used phishing emails impersonating legitimate security notices from Rakuten Securities but now uses malicious emails claiming to offer free investment guidance through LINE. The emails prey on financial concerns, pressuring users to invest and join a supposed investment community. Users who click on the links in the emails are redirected to a webpage urging them to add a LINE account in exchange for gifts and access to free seminars on growing retirement assets. The website claims to offer advice on using NISA, selecting stocks, and achieving early retirement, and falsely presents Rakuten’s CEO as promoting the scam via LINE.

Sapphire Werewolf targets energy companies with updated version of Amethyst Stealer

BI[.]ZONE researchers observed the threat actor Sapphire Werewolf using an updated version of the open-source malware Amethyst Stealer to target energy companies. The latest version of Amethyst Stealer features advanced checks for virtualised environments and employs Triple DES algorithm for string encryption. In the observed campaign, the malware was delivered via phishing emails and stored in an attachment disguised as an official memo from a human resources representative. The memo contains an executable with a fake PDF icon that delivers Amethyst Stealer, which is protected with .NET Reactor.