Threat Intelligence Report March 7 - March 13 2023

ImBetter Stealer is a type of malware created specifically to extract confidential information from computer systems and internet browsers. This information includes sensitive data like Login credentials, Cookies, User profiles, and Wallet extensions. The use of this malware can be particularly risky as it can allow cybercriminals to gain unauthorized access to victims' online accounts and crypto wallets, leading to the loss of valuable digital assets or personal information.

SYS01 Stealer has been observed targeting critical government infrastructure employees, manufacturing companies, and other industries. The attackers behind this campaign are focusing on Facebook business accounts, utilizing Google ads and fake Facebook profiles to promote content such as games, adult material, and pirated software. These tactics are aimed at enticing victims to download a malicious file. Once downloaded, the malware is designed to steal sensitive information, including login credentials, cookies, as well as Facebook ad and business account data.

ParallaxRAT is a malware known to be distributed through spam and phishing emails. Like any other remote access trojan, it is capable of stealing credentials, keylogging, and completely taking over a victim's computer. It has been observed lately that this malware is being used to target cryptocurrency organisations.

Hiatus is a remote access trojan targeting routers and network devices. It targets enterprise routers and where it deploys its malicious binaries. Once a device is infected, the threat actor converts the device into a proxy. It also monitors traffic on ports that are associated with email and file transfer.

Blind Eagle, also known as APT-C-36 has recently been observed using an advanced toolset comprising Meterpreter payloads that are being delivered by spear phishing attachments. The emails generally include a URL redirecting to a PDF file which in turn deploys malware on the targeted system, effectively launching the infection chain. A malicious RAT is installed on the targeted machine, enabling the threat actor to access and run commands on the said machine at any point in time they desire to do so.

MQsTTang is a barebones backdoor that allows the attacker to execute arbitrary commands on a victim’s machine and get the output. Even so, it does present some interesting characteristics. Chief among these is its use of the MQTT protocol for C&C communication. MQTT is typically used for communication between IoT devices and controllers, and the protocol hasn’t been used in many publicly documented malware families.

Red Piranha proactively gathers information about organisations impacted by ransomware attacks through various channels, including the Dark Web. In the past week, our team identified a total of 71 new ransomware victims from 19 distinct industries across 26 countries worldwide. This highlights the global reach and indiscriminate nature of ransomware attacks, which can affect organisations of all sizes and sectors.

Royal, a specific ransomware, has affected the largest number of new victims (17) spread across various countries. LockBit 3.0 and AlphV groups follow closely with each hitting 13 and 11 new victims respectively. Below are the victim counts in per cent for these ransomware groups and a few others.

 
When we examine the victims by country out of 26 countries around the world, we can conclude that the USA was once again the most ransomware-affected country, with a total of 32 new victims reported last week. The list below displays the number (%) of new ransomware victims per country.

      

After conducting additional research, we found that ransomware has impacted 19 industries globally. Last week, the manufacturing and Retail sectors were hit particularly hard, with the loss of four businesses in each sector. The table below presents the count (%) of the most recent ransomware victims sorted by industry.