Threat Intelligence Report April 25 - May 1 2023

LeftHook Stealer malware is a dangerous computer virus that specialises in stealing sensitive information from infected systems. This type of malware can enter a computer system through phishing emails or malicious links on compromised websites. Once installed, the malware runs undetected in the background and silently collects valuable data such as login credentials, banking details, and personal information. LeftHook Stealer is known for its advanced techniques, including its ability to evade detection by antivirus software and the use of encryption to protect stolen data. It is essential to keep software and security systems up-to-date and to use strong and unique passwords to prevent the infiltration of LeftHook Stealer and other similar malware.

The LimeRAT malware is a sophisticated and dangerous threat to computer security, with the ability to capture sensitive information and execute unauthorised commands on infected systems. A detailed analysis of the malware conducted by cybersecurity experts reveals its complex structure and the various techniques it employs to evade detection and compromise target systems. LimeRAT uses a multi-stage infection process, making it difficult to detect and remove. Its command-and-control infrastructure is also highly resilient and difficult to take down. Organisations and individuals are advised to take proactive measures to protect themselves against this and other emerging malware threats.

CVE-2022-47966 is a critical vulnerability that affects Zoho ManageEngine versions before 14.3 build 14330. The vulnerability in Zoho ManageEngine’s SAML authentication feature occurs due to improper validation of XML signatures in SAML assertions. Specifically, the vulnerability is due to using an insecure XSLT (Extensible Stylesheet Language Transformations) processor in the signature validation process. An attacker can exploit this vulnerability by crafting a malicious SAML assertion that includes a specially crafted XSLT stylesheet that triggers the vulnerable XSLT processor, allowing the attacker to execute arbitrary code on the affected system.

It has been observed that a Linux malware developed with Shc has been installing a CoinMiner. Shc is an abbreviation for Shell Script Compiler and is responsible for converting Bash shell scripts into an ELF (Executable and Linkable Format). The Shc data section contains the original Bash shell script encoded with the Alleged RC4 algorithm. When it is executed afterwards, the same ARC4 algorithm is used to decode the original script, and the decoded script commands are executed.

Atomic MacOS Stealer (AMOS) is a new information-stealer that has been discovered being advertised in Telegram channels. It is designed to steal sensitive information from MacOS machines. It is capable of collecting Keychain passwords, system information, files and documents, as well as, crypto wallets. The threat actor also provides additional services for AMOS such as a web panel for managing the infected machines among others for a monthly subscription.

Red Piranha proactively gathers information about organisations impacted by ransomware attacks through various channels, including the Dark Web. In the past week, our team identified a total of 94 new ransomware victims from 18 distinct industries across 34 countries worldwide. This highlights the global reach and indiscriminate nature of ransomware attacks, which can affect organisations of all sizes and sectors.

LockBit 3.0, a specific ransomware, has affected the largest number of new victims (35) spread across various countries. Alphv and Royal groups follow closely with each hitting 28 and 05 new victims respectively. Below are the victim counts (%) for these ransomware groups and a few others.

When we examine the victims by country out of 34 countries around the world, we can conclude that the USA was once again the most ransomware-affected country, with a total of 36 new victims reported last week. The list below displays the number (%) of new ransomware victims per country.

      


After conducting additional research, we found that ransomware has impacted 18 industries globally. Last week, the Manufacturing and Retail sectors were hit particularly hard, with the loss of 21 and 13 businesses in each sector respectively. The table below presents the most recent ransomware victims sorted by industry.