Weekly Cyber Round-up

Premium Panel phishing kit used to target companies in Europe

Intrinsec researchers detailed the ‘Premium Panel’ phishing toolkit, which has been used in multiple campaigns for at least two years to target renown companies in various industries, primarily banking and logistics. Threat actors using the tool have primarily targeted Western companies, with exceptions observed in Saudi Arabia, Israel, South Africa, Taiwan, Qatar, and Guatemala. Threat actors used either compromised legitimate domains to host phishing pages, used temporary or free domains, or registered domains spoofing the target brand. Some Premium Panel users have also set up Telegram bots to receive notifications when a victim visits a phishing domain. Logging into the ‘Live Control Panel’ page also provides users with the ability to restrict the phishing domain to mobile users only, restrict access to the phishing domain entirely, and search for a victim IP address. On April 23rd, 2024, the toolkit was mentioned in a Facebook group named ‘ProDefence’. 

Large-scale phishing campaign impersonating USPS uses new technique to deliver malicious PDFs

Zimperium researchers discovered a new phishing campaign impersonating the United States Postal Service (USPS) to target mobile phone users. The campaign involves a new obfuscation method to deliver malicious PDF files by embedding a malicious URL in a text message without using the standard ‘/URI tag’, making it more challenging to extract URLs during analysis. The PDFs are designed to steal credentials and compromise data, with over 20 malicious PDF files and 630 phishing pages identified as part of the campaign. The text messages urge users to click on the PDF file link to update their address information, which redirects them to a USPS phishing page. An analysis of the phishing pages revealed multilingual support, suggesting the attacker may be able to target a wide range of countries and may be using a phishing kit. 

Fake XWorm RAT builder used to infect users with infostealer

CloudSEK researchers observed a trojanised version of the XWorm RAT builder being disseminated online, mainly via GitHub. The malicious builder appears to be specifically targeting script kiddies new to cybersecurity, with over 18,459 devices compromised to date. The malware is capable of stealing sensitive data such as browser credentials, Discord tokens, Telegram data, and system information. It uses Telegram as its C2 infrastructure, leveraging bot tokens and API calls to issue commands. The researchers discovered the malware’s ‘kill switch’ feature, enabling them to disrupt operations on active devices. 

New TorNet backdoor delivered in campaign targeting Poland and Germany

Cisco Talos researchers observed an ongoing financially motivated campaign, active since at least July 2024, mainly targeting Poland and Germany. The campaign delivers various payloads, including Agent Tesla, Snake Keylogger, and a newly identified backdoor, dubbed TorNet. The campaign uses phishing emails impersonating financial institutions or manufacturing and logistics companies as the initial infection vector. The emails claim to be money transfer confirmations or order receipts, respectively, with an attached TAR archive. Unzipping the archive file leads to a .NET loader being run, which downloads PureCrypter from a compromised staging server, with PureCrypter used to drop and run the TorNet backdoor.