Weekly Cyber Round-up

Lazarus Group updates its BeaverTail malware capabilities and distribution methods

In mid-August 2024, Group-IB researchers identified new methods of distribution and a new Python version of Lazarus Group’s BeaverTail malware. The new version boasts new features like establishing persistence and configuring AnyDesk. It also fetches several Python scripts, collectively dubbed CivetQ, that function as a backdoor, keylogger, and infostealer. BeaverTail was initially observed being distributed via fake job interview files on LinkedIn, but Lazarus Group has since been observed also using other job search platforms to target victims. The group typically asks to move conversations to Telegram, where victims are asked to download a fake Windows video conferencing application or node.js files as part of the interview process. Lazarus Group has also expanded its targeting from just cryptocurrency-related repositories by injecting malicious JavaScript into gaming-related repositories.

SLOW#TEMPEST campaign targets Chinese-speaking users with Cobalt Strike

Securonix researchers identified an ongoing campaign, dubbed SLOW#TEMPEST, that is targeting Chinese-speaking users with Cobalt Strike. The payload is delivered via a LNK file within a ZIP file, likely distributed via phishing emails. Based on the language used in the lures, the researchers believe the campaign may be targeted at Chinese related businesses or government sectors. In some cases, the ZIP file is password protected, while the LNK file masquerades as a Microsoft Word file to further evade detection. It contains a DLL file and a legitimate signed executable by Microsoft, with DLL sideloading used to deliver Cobalt Strike.

Suspected espionage campaign delivers Voldemort malware

In August 2024, Proofpoint researchers identified a suspected espionage campaign delivering a new custom malware, dubbed Voldemort. The campaign began on August 5th, 2024, and uses messages claiming to be from tax authorities from governments in the United States, the UK, France, Germany, Italy, India, and Japan. The threat actor targeted 18 different sectors, with insurance companies making up nearly a quarter of the targeted organisations. Voldemort is written in C, can gather information and drop additional payloads, including Cobalt Strike. It is executed by using a CiscoCollabHost executable that is vulnerable to DLL hijacking. The researchers note that its attack chain has unusual, customised functionality, such as the use of Google Sheets for C2 communication and a saved search file on an external share.

New PyPI hijacking technique exploited in the wild 

JFrog researchers identified a new PyPI supply chain attack technique, dubbed Revival Hjiack, being exploited in the wild to hijack software packages. The technique involves manipulating the option to re-register packages once they have been removed from PyPI’s index by the original owner. The researchers warn that the method could be used to hijack 22,000 existing PyPI packages, possibly leading to hundreds of thousands of malicious package downloads.