Threat Intelligence Report January 10 - January 16 2023

Threat name:

LummaC2 Stealer

Like the other stealer malware, LummaC2 Stealer has the ability to steal sensitive information from the victim's computer as well as their operating system. This Stealer can gather data from web browsers and target 2FA extensions and cryptographic wallets. Login credentials, personally identifiable information (PII), and financial information are just a few examples of the extra data kept on web browsers that can also be used to steal by the LummaC2 Stealer. Threat actors can use the stolen data for making money: they may sell the stolen data to other threat actors, or they can use it to steal cryptocurrency from the victim's wallets.

Turla Malware

It has been observed that the suspected Turla malware is targeting Ukrainian entities since the onset of the invasion. The campaign’s operational tactics appear consistent with Turla’s considerations for planning and advantageous positioning to achieve initial access to the victim systems, as the group has leveraged USBs and conducted extensive victim profiling in the past.

The extensive profiling achieved since January possibly allowed the group to select specific victim systems and tailor their follow-on exploitation efforts to gather and exfiltrate information of strategic importance to inform Russian priorities.

SugarCRM Auth Bypass

An Auth Bypass and RCE exploit has been publicly disclosed by a security researcher that affects SugarCRM's Sell, Serve, Enterprise, Professional, and Ultimate software solutions. The vulnerability relies on a missing authentication check in the loadUser() method of one of SugarCRM's components. Two hotfix patches have been released by SugarCRM which are automatically deployed on SugarCRM's cloud and managed hosting instances. The patches are also available for download for instances outside of SugarCloud and SugarCRM-managed hosting. Red Piranha's Crystal Eye have deployed rules to detect these exploit attempts.

Attempted-user

BlindEagle APT

Ongoing campaigns by a threat group that usually targets countries from South America have been observed. Their usual tactic is to send phishing emails pretending to be from the government. These emails contain malicious documents or links where the recipients have to download a file. The malware within these documents is revealed to be QuasarRAT. QuasarRAT is an open-source trojan that is easily publicly available from multiple sources like Github. It leverages PowerShell, Python and 'Living-off-the-land' binaries.

Ginp Malware

The Ginp mobile banking malware, which emerged in late 2019, is one of the top most prevalent Android banking malware families today. It started as an SMS stealer and rapidly evolved into one of the most advanced actors in the financial fraud landscape. Ginp has primarily targeted Spanish banks, but recent evidence suggests the malware has changed or may change its targeting strategy in the near future to focus on Turkey. New Ginp overlay pages are intended for overlay attacks on mobile devices residing on the malware’s command-and-control (C&C) servers. These overlay pages are spoofs of legitimate banking pages, meant to deceive mobile device users into sharing confidential banking and other information. Several of these fake overlays mimic banks in Turkey, suggesting that malware operators intend to use these pages in future campaigns to target customers of Turkish banks.

Linux.Backdoor.WordPressExploit.1

Red Piranha regularly collects information about organizations hit by ransomware from different sources including the Dark Web. During the previous week, Red Piranha identified a total of 49 new ransomware victim organisations from 17 different countries all over the world.

One particular ransomware group named LockBit3.0 tallied the greatest number of new victims (14), the locations of which are spread across different countries. This is followed by AlphV group 10 new victims. Victim counts these ransomware groups, and a few others are listed below.

If we look at the victims as per the country, we can say that the USA has once again become the most affected country by ransomware groups where a total of 18 new victims were reported last week followed by the UK with 9 new victims reported. The number of new ransomware victims per country is listed below: