Threat Intelligence Report May 23 - May 29 2023

Delta Stealer is a type of malware that has gained attention in the cybersecurity landscape. It is an information-stealing Trojan designed to target users' sensitive data, such as login credentials, financial information, and cryptocurrency wallets. Delta Stealer has been observed leveraging the popular Rust programming language, making it an example of the growing adoption of Rust for malicious purposes. The malware's name, "Delta Stealer," stems from the fact that it was initially discovered and analysed by the cybersecurity firm, Kaspersky, in 2019. Since then, it has undergone several evolutions and updates to enhance its capabilities and evade detection by security software.

One notable characteristic of Delta Stealer is its use of GitHub Codespaces, a cloud-based development environment, to host and distribute its payload. This method allows the attackers to leverage the legitimate infrastructure provided by GitHub, making it more challenging for security solutions to identify and block the malware. The Delta Stealer primarily spreads through phishing campaigns, where unsuspecting users are tricked into downloading and executing malicious files. These files may be disguised as legitimate software installers, documents, or other enticing content. Once executed, Delta Stealer starts its operation by establishing communication with command-and-control (C&C) servers, enabling the attackers to remotely control the infected machines and exfiltrate stolen data.

The malware is capable of stealing various types of sensitive information from infected systems. This includes web browser credentials, email credentials, FTP client credentials, instant messenger login data, cryptocurrency wallets, and other stored data. Delta Stealer achieves this by employing techniques such as keylogging, capturing screenshots, and scanning the system for relevant files and configurations.

The Ruckus Wireless Admin Remote Code Execution Attempt, identified by the CVE-2023-25717 vulnerability, is a security issue that poses a significant risk to the Ruckus Wireless Admin interface. This vulnerability allows remote attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, and system compromise. Exploiting this vulnerability requires an attacker to send specially crafted requests to the vulnerable system, bypassing security measures and gaining control over the device. To mitigate the risk, it is crucial for organisations using Ruckus Wireless Admin to apply the necessary patches and updates provided by the vendor promptly.

A new, previously unidentified remote access trojan (RAT) has been noticed within an Android screen recording app, available for download on the Google Play Store and already gained more than thousands of installations. The ‘iRecorder – Screen Recorder’ app, initially introduced in 2021, was potentially compromised through a malicious update in 2022. The threat actor utilized its name to deceive users by requesting audio recording and file access permissions under the guise of a legitimate screen recording application. The RAT is based on an open-source Android RAT known as AhMyth.

A new RAT, unlike others, has been observed to be active in the banking sector. Vultur is prone to using screen recording based on VNC to obtain all the PII (Personal Identifiable Information). After installation on the target, the dropper uses advanced evasion techniques, including steganography, file deletion and code obfuscation, in addition to multiple checks before downloading the malware. Once it has been downloaded the trojan gives a threat actor a clear view of everything that is happening on the compromised device.

Red Piranha proactively gathers information about organisations impacted by ransomware attacks through various channels, including the Dark Web. In the past week, our team identified a total of 141 new ransomware victims from 21 distinct industries across 32 countries worldwide. This highlights the global reach and indiscriminate nature of ransomware attacks, which can affect organisations of all sizes and sectors.

When we examine the victims by country out of 32 countries around the world, we can conclude that the USA was once again the most ransomware-affected country, with a total of 69 new victims reported last week. The list below displays the number (%) of new ransomware victims per country.

      


After conducting additional research, we found that ransomware has impacted 21 industries globally. Last week, the Manufacturing and Business Services sectors were hit particularly hard, with the loss of 25 and 23 businesses in each sector respectively. The table below presents the most recent ransomware victims sorted by industry.