Weekly Cyber Round-up

Suspected Chinese espionage campaign targets organisations in Southeast Asia

Symantec researchers observed an ongoing espionage campaign, active since October 2023, targeting high-profile organisations across Southeast Asia. The attackers leverage both open-source and living-off-the-land tools for the purpose of intelligence gathering. Between June and August 2024, the attackers compromised four machines on an organisation’s network. The attack began with a malicious PowerShell command altering the registry, then used an Impacket-based remote access tool to execute additional malicious commands. The threat actors also employed keyloggers, password protectors, and reverse proxy tools, including Rakshasa, Stowaway, and ReverseSSH to maintain persistence, along with DLL sideloading to intercept login credentials. Multiple tools used in the campaign have links to several China-based threat actors, such as Earth Baku.

Gamaredon uses BoneSpy and PlainGnome spyware to target former Soviet states

Lookout researchers identified two Android spyware families, dubbed BoneSpy and PlainGnome, that target former Soviet states, focusing on Russian-speaking victims. Both spyware are attributed to the Russian threat actor, Gamaredon, and are designed to collect sensitive data such as SMS messages, call logs, and more. PlainGnome functions as a dropper for a surveillance payload, whereas BoneSpy is deployed as a standalone application. BoneSpy showed evidence of continuous development between January and October 2022, after which samples started using consistent code structure and lure theming. The malware is primarily distributed through trojanised, functional Telegram applications titled as ‘Beta’ versions. PlainGnome was first active in 2024 and is distributed using similar Telegram lures to BoneSpy.

Suspected Earth Koshchei rogue RDP campaign targets multiple sectors

In October 2024, Trend Micro researchers observed a large-scale rogue RDP campaign targeting high-profile sectors. The attack used an RDP relay, a rogue RDP server, and a malicious RDP configuration file, risking potential data leakage and malware installation. Preparations for the campaign took place from August to October 2024, culminating in 200 spear phishing emails sent on October 22nd, 2024, to governments, armed forces, think tanks, academic researchers, and Ukrainian targets. The emails lured recipients into using a rogue RDP configuration file, which connected their systems to a foreign RDP server. The attackers also employed anonymisation layers to evade detection and red team tools, such as PyRDP, for espionage and data exfiltration. The campaign is attributed to Earth Koshchei with medium confidence.

Phishing campaign abuses HubSpot to target Microsoft Azure accounts of European organisations

In June 2024, Palo Alto Networks Unit 42 researchers identified a phishing campaign targeting at least 20,000 users across European automotive, chemical, and industrial compound manufacturing companies. The campaign abuses HubSpot to redirect victims to credential-harvesting pages, with the ultimate aim of taking over a target’s Microsoft Azure cloud infrastructure. It was still active as of September 2024. The campaign involves supposed Docusign PDFs sent via phishing emails containing HubSpot Free Form Builder links. At least 17 working Free Forms were identified, which were used to redirect victims to different actor-controlled domains. Each of the Free Forms contained a similar Microsoft Outlook Web App landing page. HubSpot’s own infrastructure was not compromised, nor were the links sent via HubSpot infrastructure.