Weekly Cyber Round-up

TaxOff group targets Russian government agencies with Trinper backdoor

In Q3 2024, Positive Technologies researchers discovered a new threat actor, dubbed TaxOff, targeting Russian government agencies. The group used legal and finance-related phishing emails as the initial infection vector, which led to the deployment of a C++-based backdoor, dubbed Trinper. The main goal was espionage and gaining a foothold to conduct further attacks. One of the observed emails had a link to Yandex Disk and contained a shortcut used to start the Trinper backdoor, the Trinper backdoor itself, a merged encrypted RAR archive with trimmed headers, and a phishing form. The attackers also used the Spravki BK software to distribute Trinper, with the software also previously used to spread the Konni backdoor.

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT to targets in Russia

Kaspersky researchers identified a new campaign, dubbed Horns&Hooves, which aims to deliver the NetSupport remote access trojan (RAT) and BurnsRAT to private users, retailers, and service businesses primarily located in Russia. The delivery of the trojans is assessed to be an intermediate link in the overall attack chain, with NetSupportRAT being observed delivering further infostealer payloads such as Rhadamanthys and Meduza. The campaign has been active since March 2023 and has impacted more than 1,000 victims. The attacks employ phishing emails to deliver a ZIP archive containing malicious JavaScript. The script files are disguised as requests and bids from potential customers and partners, with the attackers also adding various archive documents related to the organisation or individual being impersonated in some cases.The researchers assess with high certainty that the threat actor TA569 is responsible for the campaign.

SmokeLoader deployed in attacks targeting multiple sectors in Taiwan

In September 2024, Fortinet researchers observed a campaign delivering SmokeLoader to companies in Taiwan, with targeted sectors including manufacturing, healthcare, information technology, and more. Phishing emails that use native words and phrases are employed as an initial infection vector. The emails contain an attached Microsoft Excel file that exploits CVE-2017-0199 and CVE-2017-11882 to drop AndeLoader, which in turn deploys SmokeLoader. SmokeLoader consists of a stager and a main module, with the stager’s main purpose being to decrypt, decompress, and inject the main module into the explorer executable process. SmokeLoader carries out the resulting attack itself by downloading several plugins that allow it to steal login and FTP credentials, email addresses, cookies, and more from web browsers, Microsoft Outlook, Mozilla Thunderbird, FileZilla, and WinSCP.

Secret Blizzard hijacks Storm-0156 infrastructure to attack compromised networks

Lumen and Microsoft researchers identified the Russian threat actor Secret Blizzard hijacking infrastructure belonging to the Pakistani threat actor, Storm-0156, to launch attacks on already compromised networks, including Afghan and Indian government organisations. Since December 2022, Secret Blizzard has successfully infiltrated 33 separate C2 nodes used by Storm-0156, and used the tools and infrastructure of at least six other threat actors since 2017. Secret Blizzard leveraged the pre-existing access to deploy a TinyTurla backdoor variant, as well as new malware, dubbed TwoDash, MiniPocket, and Statuezy. By mid-2024, Secret Blizzard also expanded their activities to include the use of Wainscot and CrimsonRAT, which they appropriated from the workstations of Pakistani-based operators. In the attacks targeting India, Secret Blizzard appeared to avoid direct deployment via Storm-0156 backdoors, unlike the attacks targeting Afghanistan.