Table of Contents

Cybersecurity Incidents

• Krypton Alert: Akira Ransomware Targets Amino Transport 
  

• Threat Actors Use Social Engineering to Push PowerShell Scripts as Windows Error Fix
  
• Vulnerabilities Identified in iOS and macOS Dependency Manager CocoaPods 

• Social Engineering Threats Emerge in Aftermath of CrowdStrike Outages

• Void Banshee Threat Group Exploits Zero-Day Flaw in Microsoft Browser Engine

Recommendations

NMFTA On The Road

Industry News

#NMFTACyber On Demand

Threat Actors Use Social Engineering to Push PowerShell Scripts as Windows Error Fix 

In late June 2024, reports began to emerge that threat actors were exploiting a previously identified vulnerability in Windows in order to covertly deploy a PowerShell script on unsuspecting users' machines. The vulnerability was identified as error 0x80070643- ERROR_INSTALL_FAILURE. The cause of the error message originated in a security update released by Microsoft in January 2024 to fix a BitLocker encryption bypass flaw tracked as CVE-2024-20666. BitLocker is a security feature on Windows devices that provides encryption security to devices that have been stolen, lost, or inappropriately decommissioned. Upon the update’s release, many Windows users encountered the 0x80070643 error, indicating a problem installing the update. This identification was incorrect on the part of Windows as the actual error should have been identified as BS_E_INSUFFICIENT_DISK_SPACE. The issue was related to the Windows Recovery Environment (WinRE) partition and concerned the amount of space available for the update. The update requires that the WinRE partition have 250 megabytes of free space, and if not, the user must manually create more space or the update will not be installed. 

As a result of the misidentified error, Windows users began to look up how to fix error 0x8007043. Threat actors picked up on the issue and began to create scams related to fixing the error message. Scams included YouTube videos and fake IT websites all promoting various “fixes” to the 0x8007043 error that would result in the execution of a malicious PowerShell script and the downloaded malware onto the victims device. The script operates by connecting to a remote server to download another PowerShell script that installs the Vidar information stealing malware onto the compromised device. Following the download, the script would display a message that the download was successful and then restart the device, subsequently launching the malware into effect. The Vidar malware would then extract saved credentials, credit cards, cookies, browsing history, as well as, in some cases, cryptocurrency wallets, text files, and Authy 2FA authenticator databases. Vidar can also take screenshots of the desktop it infects.

The use of social engineering techniques in this instance displays the versatile skill set exhibited by some threat actors. Not only is technical skill involved in the deployment of this Vidar malware, but the threat actors also need some degree of social skill. The ability to create convincing social media content or trustworthy sites that people engage with and use is an example of the acumen some threat actors have that is often not attributed to cyber criminals. Other examples include email phishing attacks where a malicious actor creates an email that convinces the victim to interact with a link that deploys malware into their system, and crypto scammers who are charismatic enough to defraud would-be investors on social media. These are common examples of threat actors utilizing social engineering skills to trick victims into creating an avenue for system entry. 

Incidents such as this also have the potential to beget more cyberattacks. The information that the Vidar malware extracts can be utilized in brute force attacks with login credentials, provide an avenue for ransomware to be deployed using the same exploit, result in identity theft through stored personal information, and more. Healthy suspicion of alternative fixes from non-accredited sources can provide protection from threat actors taking advantage of an exploit a user may be unaware of. 

Vulnerabilities Identified in iOS and macOS Dependency Manager CocoaPods 

On July 1, 2024, multiple vulnerabilities were publicly revealed in the dependency manager system CocoaPods, which is a critical system used by iOS and macOS devices, that could allow for a threat actor to launch supply chain attacks. The discovery comprised three vulnerabilities—CVE-2024-38368, CVE-2024-38366, and CVE-2024-38367—that could grant a threat actor access to and control over “pods,” which are packages that CocoaPods uses to specify files and describe packages. These files contain extensive metadata information detailing the various elements integral to a desktop or mobile application’s ability to integrate within the various operating systems within Apple’s ecosystem. The first vulnerability, CVE-2024-38368, allows for a threat actor to hijack unused pods that have been publicly listed in the documentation and terms of service associated with various applications, and an attacker could subsequently modify these pods or inject malicious scripts into them. 

The second vulnerability, CVE-2024-38366, could allow for a threat actor to launch remote code execution (RCE) attacks through CocoaPods’ authentication server and could result in a complete removal of session tokens or disruption to all server access associated with the targeted pod. The third vulnerability, CVE-2024-38367, similarly targets the CocoaPods authentication protocols and could allow for a threat actor to infiltrate an existing session and compromise the CocoaPods trunk account. Each of these three vulnerabilities could ultimately result in supply chain attacks affecting all users of a targeted app. 

The most significant risks that the CocoaPods vulnerabilities demonstrate emerge from the use of third-party software products in such a way as to remove the ability of a company to monitor its own IT systems and associated operations for breaches or vulnerabilities. Supply chain attacks are continually one of the most significant cybersecurity threats given that their mitigation lies primarily outside an organization’s control. There is no evidence to indicate that the CocoaPods vulnerabilities have been exploited or even identified outside of the July 1 reports, and no campaigns have been observed to be exploiting them at this time. Nevertheless, their discovery on critical systems on Apple devices demonstrates the risks and dangers associated with threat actors exploiting these vulnerabilities. 

Social Engineering Threats Emerge in Aftermath of CrowdStrike Outages 

Following the Microsoft Windows outage that occurred on July 19, 2024, analysts identified an increase in social engineering campaigns targeting CrowdStrike and Microsoft customers. Millions of Microsoft Windows users experienced service disruptions and internet outages due to a code error in a CrowdStrike software update, causing mass confusion. CrowdStrike is a cybersecurity company that provides services to the tech community including Microsoft. The software update was meant to enhance CrowdStrike’s Falcon sensor security software, however a logic error affecting Windows host versions 7.11 and above triggered a crash. 

Following this Windows outage, CrowdStrike advised customers to verify that they are communicating with legitimate representatives through official channels since "adversaries and bad actors will try to exploit events like this." This message was published due to an observed increase in attempts at threat actors impersonating CrowdStrike technical services. For example, a malware campaign targeting BBVA bank customers was identified that offered a fake CrowdStrike hotfix update that installed the Remcos Remote Access Trojan (RAT). The Ramcos RAT is used to fully control and monitor Windows computers once the computer is infected. The fake hotfix was promoted through a phishing site that pretended to be a BBVA Intranet portal. Many businesses also received fraudulent CrowdStrike phishing emails directing users to click on links to fix the outage issue, thereby granting the threat actor access to the systems of those who interacted with the link. 

It is not uncommon for threat actors to take advantage of confusion and uncertainty generated by large scale outages. For example, many threat actors sought to capitalize on the AT&T outage that occurred on February 22, 2024 by claiming the event was a hack to increase confusion and fear over a possible breach, thus increasing the possibility that desperate individuals would fall for social engineering scams. When these kinds of events occur with such large profile companies, customers begin to seek ways to fix the problem on their own; often through internet searches where threat actors create fraudulent websites that claim to provide IT services. If a threat actor is skilled enough in social engineering techniques they may send a phishing email disguised as the subject company. 

The threat actor would then apologize for the mistake and offer a patch or downloadable file that would fix the issue, when in reality the link or downloadable file is malware designed to infiltrate the target's system. Social engineering is the predominant way threat actors access target systems, and internet crashes caused by major company outages will inevitably happen in the future. The combination of these realities establishes the critical need that, when attempting to fix a technical issue, customers communicate only and directly with the primary company or accredited IT services. Whenever an outage occurs or an unfamiliar email is received in an inbox users should always verify the validity of any message and avoid clicking on provided links to prevent socially adept threat actors from capitalizing on the confusion caused by outages. 

Void Banshee Threat Group Exploits Zero-Day Flaw in Microsoft Browser Engine 

An advanced persistent threat (APT) group tracked as “Void Banshee” was found to have been exploiting a Microsoft zero-day vulnerability in conjunction with sophisticated phishing attacks. Specifically, this flaw is in the Microsoft MHTML browser engine used to deliver an information stealer malware known as “Atlantida.” The current campaign being conducted by the Void Banshee threat cluster is unique, in that it is using the now-defunct Internet Explorer (IE) browser as an initial attack vector. The Void Banshee actor is running and executing files and websites through the disabled IE process by exploiting CVE-2024-38112 through MSHTML. By using specially crafted .URL files that contained the MHTML protocol handler and the x-usc! directive, Void Banshee is able to access and run HTML Application (HTA) files directly through the disabled IE process. 

The group’s attack chains involve the use of spear-phishing emails embedding links to ZIP archive files hosted on file-sharing sites, which contain URL files that exploit CVE-2024-38112 to redirect the victim to a compromised site hosting a malicious HTML Application (HTA). The Void Banshee campaign also lures victims via zip archives containing malicious files disguised as book PDFs that are disseminated via legitimate cloud-sharing websites, Discord servers, and online libraries, among others. This is a typical TTP used by the group, which tends to target victims both for information stealing operations and financial gain. The CVE-2024-38112 vulnerability was remediated as part of Microsoft’s July 2024 Patch Tuesday. As of this patch cycle, Microsoft has unregistered the MHTML handler from Internet Explorer. 

Microsoft officially ended support for IE on June 15, 2022, and IE has been officially disabled through subsequent versions of Windows 10, including all versions of Windows 11. However, disabled does not mean that IE has been deleted from systems. The remnants of IE still exist on the current Windows system, although it is not accessible to the average user. This also means that IE does not receive any patches or security updates, which works to the threat actor’s advantage. Despite the fact that users can no longer access Internet Explorer, cybercriminals can still exploit residual MS Windows components such as IE on their machines to infect individuals and organizations with ransomware, backdoors, or as a gateway to deploy other types of malware. 

The capability of APT groups, such as Void Banshee, to leverage disabled services such as IE represents a considerable risk to organizations globally. Since services like IE have a broad attack surface and no longer receive updates, they pose a grave security threat to Windows users. Additionally, the ability of threat actors to manipulate unsupported and disabled system services to bypass modern web sandboxes, such as IE mode for Microsoft Edge, underscores an ongoing industry concern. 

Implement strong security measures. This includes using firewalls, antivirus software, and data encryption to protect your systems from unauthorized access. You should also regularly update your software and patch vulnerabilities.