Weekly Cyber Round-up

Threat actors target manufacturing industry with Lumma Stealer and Amadey Bot

Cyble researchers identified a multi-stage campaign involving an LNK file disguised as a PDF file to target the manufacturing industry. The attack chain leverages DLL sideloading and IDATLoader to deploy the Lumma Stealer and Amadey Bot, enabling the attacker to gain control and exfiltrate sensitive information from the victim’s machine. While the initial infection vector is unknown, the attack likely begins with a spear phishing email prompting the recipient to click on a link that leads to an LNK shortcut file disguised as a PDF document. Once executed, the LNK file triggers a command to launch multiple living-off-the-land binaries, such as an SSH, PowerShell, and mshta, to bypass security measures and remotely execute the next-stage payload, Lumma and Amadey.

RedLine stealer campaign targets Russian businesses via pirated software

Kaspersky researchers observed an ongoing RedLine infostealer campaign, active since January 2024, targeting Russian businesses using pirated corporate software. The threat actors target business process automation users by distributing a malicious version of the HPDxLIB activator that uses a self-signed certificate. The activator contains RedLine stealer, which is obfuscated using .NET Reactor and contains malicious code that is compressed and encrypted in multiple layers. The threat actors distribute the malicious activators via specialised Russian business ownership and accounting forums, often providing instructions on disabling security software to run the activator. The attackers then trick users into replacing a legitimate DLL library with a malicious one included in the activator, which loads a malicious library and runs RedLine stealer.

IOCONTROL malware targets IoT and OT devices in Israel and the US

Claroty researchers detailed IOCONTROL, a custom-built internet of things (IoT) and operational technology (OT) malware used by Iran-affiliated threat actors to target Israel and United States-based IoT and OT devices. Devices affected by the malware include IP cameras, routers, PLCs, HMIs, firewalls, and more. Impacted vendors include Baicells, D-Link, and Hikvision, among others. The malware has most recently been used by CyberAv3ngers, who is believed to be part of the Islamic Revolutionary Guard Corps Cyber Electronic Command. One of their attack waves specifically targeted Orpak and Gasboy fuel management systems, resulting in the compromise of about 200 gas stations in Israel and the US.

Global phishing campaign targets multiple industries to steal login credentials

Since July 2024, Group-IB researchers observed an ongoing email phishing campaign targeting the employees and associates of more than 30 businesses and organisations from 15 jurisdictions worldwide. More than 200 phishing links have been distributed to the victims as part of a scheme designed to obtain their login credentials. Targeted industries include manufacturing, government sectors, aerospace, finance, energy, telecommunications, and fashion. The campaign begins with phishing links that mimic trusted platforms used for document management and electronic signatures, such as Adobe and DocuSign, and prompt the recipients to click on a link to view and sign a document. The embedded document pretends to deliver an important PDF message impersonating Adobe InDesign, but instead includes a link that redirects victims to a phishing page.