Weekly Cyber Round-up

Winnti APT targets Japanese organisations with updated version of Winnti malware

In March 2024, LAC Watch researchers observed a campaign, attributed to the Winnti advanced persistent threat (APT) actor, that targeted Japanese organisations in the manufacturing, materials, and energy sectors. The campaign, dubbed RevivalStone, employed a novel version of the Winnti malware that has enhanced capabilities and leverages sophisticated evasion techniques. The campaign typically began with the exploitation of SQL injection vulnerabilities in web-facing enterprise resource planning software. The threat actor also deployed webshells such as China Chopper, Behinder, and ‘sqlmap file uploader’ to gain initial access, perform reconnaissance, harvest credentials, and move laterally. 

Lazarus Group uses malicious npm packages to target developers as part of supply chain attack

SecurityScorecard researchers identified a new campaign, dubbed Operation Marstech Mayhem, by the North Korean threat actor, Lazarus Group. The campaign targets developers with malicious npm packages that contain a new advanced implant, dubbed Marstech1. The malware aims to compromise software developers and cryptocurrency wallets. Lazarus Group uses fake GitHub repositories, advertised via LinkedIn and Discord, to host legitimate-looking projects that contain obfuscated JavaScript payloads that serve as a loader. The loader fetches additional payloads based on the victim’s system configuration, with the final payload used to exfiltrate cryptocurrency wallet data and authentication credentials.

Phishing campaign uses fake Microsoft login page to install fake Adobe Drive X app

Cofense researchers discovered a phishing campaign that uses a legitimate Microsoft 365 login page to trick users into installing a malicious ‘Adobe Drive X’ application. The attack begins with a phishing email disguised as an Office 365 password reset request, which contains a link that redirects users to the legitimate Microsoft authentication page. Upon accessing the authentication page, users are asked to enter their credentials and grant permissions to the Adobe Drive X app. If the user clicks the ‘Accept’ option when prompted to install the malicious Adobe application, they are redirected a credential phishing page disguised as a fake Microsoft login page.

Phishing campaign targets Turkish aerospace and defence sectors with Snake Keylogger

Malwation researchers identified a phishing campaign targeting Turkish enterprises in the defence and aerospace sectors with a variant of the Snake Keylogger infostealer. The attackers impersonate Turkish Aerospace Industries to deliver the phishing emails under the guise of contractual agreements. Snake Keylogger uses PowerShell to add itself to the Windows Defender exclusion list and performs anti-virtual machine and other anti-detection techniques. The malware also uses scheduled tasks for auto-execution to harvest sensitive data, such as credentials, cookies, and financial information from a wide range of browsers and email clients. Stolen data is sent through communication channels specified by the threat actor, such as Telegram, Discord, FTP, or SMTP.