Weekly Cyber Round-up

North American transportation and logistics firms targeted in malware campaign

Since May 2024, Proofpoint researchers observed a cluster of activity targeting transportation and logistics companies in North America to deliver various malware payloads. Between May and July 2024, the attackers primarily delivered Lumma Stealer, StealC, or NetSupport. In August 2024, they shifted tactics, using new infrastructure and the ‘ClickFix’ technique to deliver malware, including DanaBot and Arechclient2. After compromising legitimate email accounts, the attackers inject malicious content into ongoing conversations to deliver the malware, including via Google Drive URLs or attachments. Campaigns using the ClickFix technique guide users through multiple steps to copy, paste, and run a Base64-encoded PowerShell script that downloads an MSI file to load DanaBot.

UNC1860 targets Middle East networks with passive implants designed for stealth

Mandiant researchers analysed the Iranian state-sponsored threat actor, UNC1860, who is assessed to likely be an initial access provider that enables operations targeting government and telecommunications spaces in the Middle East. UNC1860 uses specialised tooling and passive backdoors to gain persistent access to high-priority networks. UNC1860’s tooling includes the TEMPLEPLAY and VIROGREEN GUI-operated malware controllers. TEMPLEPLAY is used as a controller for the TEMPLEDOOR backdoor, whilst VIROGREEN is designed to exploit vulnerable SharePoint servers using CVE-2019-0604. UNC1860’s tradecraft and targeting overlaps with Shrouded Snooper, Scarred Manticore, and Storm-0861.The researchers note that APT34 and UNC1860 have both been observed operating within the same victim environments, possibly sharing tools and access.

SloppyLemming abuses cloud service providers to target entities in Asia 

Cloudflare researchers identified the threat actor SloppyLemming abusing cloud service providers to conduct extensive operations that target government, defence, energy, telecommunications, and technology entities in Pakistan, as well as in Sri Lanka, Bangladesh, and China. The activity was first observed in late 2022 and remains ongoing. SloppyLemming uses a custom-built tool, named CloudPhish, to create a malicious Cloudflare Worker that handles credential logging logic and the exfiltration of victim credentials. The threat actor ultimately aims to gain access to targeted email accounts within organisations that provide intelligence value to them. As an initial infection vector, SloppyLemming uses spear phishing emails that have redirected victims to both credential harvesting pages and a scam website.

Phishing campaign targets ICICI Bank users with malicious app and website 

Security researcher Rakesh Krishnan discovered a phishing campaign using a malicious host mimicking ICICI Bank and a malicious app disguised as ICICI Helpdesk. The malicious domain was registered on August 22nd, 2024, hosted under Hostinger, and has been tracked to an ASN location in Cyprus. The ASN has previously been used by TA557 to host PikaBot and has also hosted malware such as GuLoader, AgentTesla, and NetSupportRAT. The malicious app has been operational since August 2024 but has not yet been found in the wild. More than 500,000 downloads were observed on the Downloads Page, though Krishnan noted this could be an inflated number to trick users into installing the app.