Weekly Cyber Round-up

SilkSpecter phishing campaign targets Black Friday shoppers

In early October 2024, EclecticIQ researchers discovered a phishing campaign targeting e-commerce shoppers in Europe and the United States. The campaign uses fake Black Friday discounts as phishing lures to deceive victims into providing their cardholder data (CHD), sensitive authentication data, and personally identifiable information. Based on infrastructure and language indicators, the researchers attribute the campaign with high confidence to the Chinese financially motivated threat actor SilkSpecter.

PXA Stealer targets education and government sectors in Europe and Asia

Cisco Talos researchers identified a campaign delivering a new infostealer, dubbed PXA Stealer, to the education sector in India and government organisations in Europe, including Sweden and Denmark. PXA Stealer targets credentials for online accounts, VPN and FTP clients, browser cookies, and data from gaming software. It also has the capability of decrypting a victim’s browser master password and using it to steal the stored credentials of online accounts. The attacker gains initial access by sending a phishing email with a ZIP file attachment that contains a malicious Rust loader executable and a hidden folder. The researchers assess that the attacker responsible for the attacks is of Vietnamese origin. The attacker was observed selling credentials and tools in a Telegram channel named ‘Mua Bán Scan MINI’, which is also where the CoralRaider threat actor operates.

Threat actors impersonate government agencies in latest Docusign phishing attacks

SlashNext researchers warned of new wave of Docusign phishing attacks targeting businesses that interact with state, municipal, and licensing authorities. The latest campaign impersonates various government agencies in the United States. The attack begins with a general contractor being sent a supposed Docusign request from their state licensing board. The attacks use legitimate Docusign infrastructure to appear authentic, include accurate pricing and terminology familiar to the industry, and target businesses during predictable licensing cycles. The messages additionally bypass email security filters since they come from actual Docusign accounts. Between November 8th and November 14th, 2024, the researchers observed a 98% increase in the use of Docusign phishing URLs compared to all of September and October 2024.

LIMINAL PANDA targets telecommunications sector for espionage purposes 

CrowdStrike researchers detailed the suspected China-nexus state-sponsored threat actor, LIMINAL PANDA, which has targeted telecommunications entities since at least 2020. LIMINAL PANDA demonstrates deep knowledge of telecommunications networks, including understanding interconnections between providers, and has used compromised servers to launch intrusions into providers in other regions. The threat actor has primarily targeted Asia and Africa and highly likely engages in targeted intrusions to support intelligence collection. The threat actor combines custom malware, publicly available tools, and proxy software to route C2 communications through different network segments. Similarities between LIMINAL PANDA and the LightBasin activity cluster, active since at least 2016, were identified.