Weekly Cyber Round-up

Emulated Linux environment used to backdoor Windows systems 

Securonix researchers observed a new phishing campaign, dubbed CRON#TRAP, that uses malicious shortcut files to deliver a custom Linux environment emulated through QEMU. The emulated Linux instance, identified as Tiny Core Linux, comes pre-configured with a backdoor that automatically connects to the attacker’s C2 server via websockets. The initial infection is likely via a phishing email using a survey lure that contains a link to download a large ZIP file. A PowerShell command is used to start the infection chain that leads to the emulated Linux environment, enabling the attackers to evade antivirus solutions. The backdoor, a Chisel binary, is a tunneling tool commonly used for passing data covertly through firewalls.

Storm-0940 targets Microsoft customers with password spraying attacks

Since August 2023, Microsoft researchers have observed the Chinese threat actor Storm-0940 stealing credentials from Microsoft customers via highly evasive password spraying attacks. The source of the attacks has been linked to a network of compromised small office and home office routers, primarily TP-Link routers, tracked as ‘CovertNetwork-1658’. Storm-0940 has been active since at least 2021 and is known for targeting organisations in North America and Europe, including think tanks, government organisations, non-governmental organisations, defence industrial base, and more. The threat actors are believed to initially exploit a vulnerability in targeted routers to gain remote code execution capability, though the specific exploit is currently unknown. Upon gaining access to the vulnerable routers, a custom malware is deployed that allows remote access to the devices over Telnet.

Rhadamanthys delivered via copyright infringement lures in ongoing phishing campaign

Check Point researchers observed a new large-scale spear phishing campaign, dubbed CopyRh(ight)adamantys, that is delivering the latest version of Rhadamanthys stealer. The campaign targets users in various regions, including the United States, Europe, East Asia, and South America, claiming copyright infringement on their Facebook pages. The campaign has been ongoing since at least July 2024. The phishing emails are typically sent from Gmail accounts and impersonate dozens of companies, adapting the impersonated company and language depending on the target. Almost 70% of the impersonated companies are from the technology or entertainment sectors. The emails contain an archive file that triggers the infection via DLL sideloading, while also displaying a decoy Adobe ESPS or PDF file.