Weekly Cyber Round-up

Phishing campaign leverages Google Docs to target telecommunications and financial sectors

In late October 2024, EclecticIQ researchers discovered a phishing campaign targeting the telecommunications and financial sectors. The campaign leverages Google Docs to deliver phishing links that redirect victims to fake login pages hosted on Weebly that impersonate targeted brands, such as AT&T. The campaign also likely targets security professionals through PICUS-themed pages hosted on Google Docs. To bypass multi-factor authentication (MFA), the threat actors use MFA prompts that mimic legitimate MFA workflows or the SIM swapping technique. The phishing pages were found to be embedded with legitimate tracking tools, such as Snowplow Analytics and Google Analytics, to monitor victim engagement.

Earth Estries targets critical industries with new MASOL RAT and GHOSTSPIDER backdoors

Since 2023, Trend Micro researchers have observed the Chinese advanced persistent threat (APT) actor, Earth Estries, targeting critical industries such as telecommunications and government agencies in the United States, the Asia-pacific region, the Middle East, and South Africa. For initial access, the group exploits server-based n-day vulnerabilities to target public-facing servers. After gaining access, the group has been observed leveraging living-off-the-land binaries for lateral movement and deploying malware such as SNAPPYBEE and DEMODEX, as well as new backdoors, dubbed MASOL RAT and GHOSTSPIDER. Earth Estries’ operations often overlap with other known Chinese APT groups, indicating the possible use of shared tools from malware-as-a-service providers.

Threat actor Matrix targets IoT devices to create DDoS botnet

Aqua Security researchers identified an ongoing, widespread distributed denial-of-service (DDoS) campaign that is attributed to the threat actor, Matrix. The threat actor targets a range of internet-connected devices, including internet of things (IoT) devices, cameras, routers, DVRs, and enterprise systems, primarily gaining initial access through brute-force attacks and the exploitation of known vulnerabilities. Once compromised, the devices are incorporated into a larger botnet. Matrix relies on a range of publicly available scripts and tools, ultimately deploying the Mirai botnet alongside other DDoS-related programs on compromised devices, including PyBot, PYnet, DiscordGo, and The Homo Network. The threat actor has also set up a Telegram bot, named Kraken Autobuy, which sells DDoS attack services targeting Layer 4 and Layer 7.

Malware abuses Avast Anti-Rootkit driver to terminate security processes

Trellix researchers identified a malicious campaign that involves malware dropping and abusing a legitimate Avast Anti-Rootkit driver to terminate security processes, disable protective software, and take control of infected devices. After initially dropping the legitimate driver, the malware uses Service Control to create a service that registers the driver for further actions. Following this, the malware gains kernel-level access to the system, providing it with the ability to terminate critical processes and take complete control.