Table of Contents

• BianLian Ransomware Targets Oil and Gas Transportation Firm
• Medusa Ransomware Targets Visasat
  
• Cactus Ransomware Gang Targets FBT Inc. in California
  
• Cyber Forum User Seeking Freight Brokerage Accounts Access
  

• New CryptoJacking Campaign Commando Cat Exposes Vulnerabilities in Docker Remote API
• Threat Actors Deploy Hijack Loader Malware in Attacks Using Free Software Lures
  

• Scattered Spider Hacking Collective Targets Data Used in SaaS Environments
• Mirai-like Botnet Takes Advantage of Vulnerabilities in EOL Zyxel Software

Recommendations

NMFTA On The Road

Industry News

#NMFTACyber On Demand

New CryptoJacking Campaign Commando Cat Exposes Vulnerabilities in Docker Remote API

A new cryptojacking attack campaign known as Commando Cat has been exposing vulnerabilities in docker remote application programming interface (API) servers to deploy crypto currency miners. The campaign, active since the beginning of 2024, involves deploying containers, which are static files that include executable code. The containers are composed of system libraries, tools, platform settings, and software programs, generated through the publicly available Commando Project on GitHub. The project creates docker images, which are templates for the creation of containers. The attackers use this program to create a cmd.cat/chattr docker image container with executable code that retrieves the malware payload from the attacker’s own command-and-control (C2) infrastructure.

To gain initial access, the attacker deploys what appears to be a harmless docker image into the target system and then uses a change root (chroot) command to deploy the payload into the target system and curl/wget to download the malicious code in order to bind it to the host system. This grants the attacker unrestricted access to the host’s system, where it can deploy its cryptojacking script.

The Commando Cat attack campaign exposes vulnerabilities in docker remote API servers as the generated docker images utilized in the attack can bypass security systems and deploy malware undetected. Additionally, the open-source nature of the docker images makes the process accessible for malicious actors. While the process is currently being utilized in cryptojacking schemes to steal central processing unit (CPU) power, the TTPs of gaining access to host systems to execute scripts, as used in the Commando Cat campaign, has the potential to be used in other forms of cyber attacks. Given its open-source quality, malicious actors will likely continue to develop this exploit if new container security features are not released to combat the tactics used during the Command Cat campaign. 

Threat Actors Deploy Hijack Loader Malware in Attacks Using Free Software Lures

Multiple threat actors were reported to be coercing unsuspecting victims to download free or illegal versions of commercial software to deliver a malware loader called “Hijack Loader” (AKA DOILoader & IDAT Loader), which subsequently deploys an information stealer known as “Vidar Stealer.” The Vidar info-stealer is commonly delivered through phishing campaigns and sites advertising cracked software. The malware itself comes with a wide range of capabilities to harvest sensitive information from infected hosts. Vidar has also been observed to be distributed via rogue Google Ads and an additional malware loader dubbed “Bumblebee.” What makes the campaign especially noteworthy is the use of dynamic-link library (DLL) side-loading techniques to stealthily launch Hijack Loaderm, which then acts as a conduit to drop Vidar Stealer by means of an AutoIt script.

In addition to using Vidar Stealer to hijack sensitive credentials from web browsers, the attack chain leverages additional payloads to deploy a cryptocurrency miner on the compromised host. The campaign coerces victims who land on a spoofed website into manually executing a PowerShell script to address a supposed issue with viewing web pages. The PowerShell script then serves as a launchpad for Hijack Loader, which subsequently delivers the Vidar Stealer malware.

Hijack Loader was first identified in the summer of 2023, and provides threat actors a variety of loading options for deploying second stage malicious payloads onto compromised networks, including Amadey, Lumma Stealer, Racoon Stealer v2, and Remcos RAT. In addition, Hijack Loader is now equipped with new detection and analysis evasion capabilities, which further enhance its effectiveness. Vidar is a commercial information stealer that was initially identified in 2018, and is an extremely dangerous malware that steals information and cryptocurrency from infected users. On its official website, Vidar is available for purchase based on the malware-as-a-service (MaaS) business model for a price of anywhere between $130 and $750, depending on the terms and length of the subscription.

However, a scaled-down version of the malware can be obtained for $250. Customers also have the flexibility to personalize some of the tool’s features, such as the types of information to be targeted. Vidar is specifically designed to steal browser histories, cookies, credentials, cryptocurrency wallets, and two-factor authentication (2FA) software data. The continued success of tools such as Vidar and their demonstrated use in deploying later-stage payloads reiterates the threat associated with MaaS programs, as they allow for less sophisticated threat actors to perpetrate their own cyber attack campaigns and offer an even wider range of threat actors access to compromised networks.

Scattered Spider Hacking Collective Targets Data Used in SaaS Environments

On June 20, 2024, analysts identified reports that a hacking collective tracked as Scattered Spider has recently transitioned to a TTP of targeting cloud-based enterprise data repositories used in software-as-a-service (SaaS) application environments. Scattered Spider is targeting cloud-based data warehouse facilities using stolen credentials obtained from multiple infostealer malware infections. These involve the use of hijacked credentials to access SaaS applications protected by single sign-on providers. Scattered Spider exfiltrates the files through the use of various cloud synchronization utilities, such as Airbyte and Fivetran, to transfer data from cloud-hosted data sources to external attacker-owned cloud storage resources, such as S3 buckets. These applications only require credentials and a path to the resources to sync the data to an external source automatically, often without the need for a subscription or expensive costs.

The Scattered Spider hacktivist collective is assessed as some type of offshoot or splinter group of a larger cohort of online cyber criminals that has dubbed itself "the Community," or "the Com.” It primarily operates in the United States and other Western countries, and has breached dozens of American organizations and their downstream third-party supply chains. Scattered Spider is a financially driven threat actor, and is primarily known for its SIM-swapping tactics and highly sophisticated credential-phishing skills. These include calling into enterprise help desks and resetting Okta credentials to take over accounts, notably using these TTPs to targeting the MGM and Caesars Entertainment resorts in Las Vegas, NV, in September 2023.

Scattered Spider’s current campaign underscores the corresponding vulnerabilities of storing large amounts of sensitive data on SaaS-hosted applications. When using SaaS, organizations face an increased risk of user account compromise. This risk is partly related to SaaS accounts being directly exposed to the Internet. Also, geographic restrictions are not a major factor in SaaS services, enabling brute force and other types of credential-based attacks to originate from any geographic location.

Mirai-like Botnet Takes Advantage of Vulnerabilities in EOL Zyxel Software

Throughout June 2024, indications that a Mirai-like botnet had attacked end of life (EOL) Zyxel network-attached storage (NAS) devices were identified. A botnet is a group of internet connected devices infected with malicious software that can be used in a number of different forms of cyberattacks. Mirai is a form of malware that infects devices that run on ARC processors, turning them into a network of remotely controlled bots. The Mirai botnet works by scanning the internet for ARC processors, which run on a stripped-down version of the Linux operating systems and infecting those devices. Its main purpose is to launch distributed denial-of-service (DDoS) attacks like those committed by hacktivist groups to briefly shut down the systems of targeted entities.

The Mirai-like botnet shares some characteristics with the original Mirai botnet but does not share the exact same code base. The identified botnet has an updated arsenal of exploits. The Mirai-like botnet exploited a vulnerability known as CVE-2024-29972, which is a critical bug identified in early June 2024 with a 9.8 out of 10 severity rating. The bug affected Zyxel NAS326 and NAS542 devices. The vulnerability is known as a command injection flaw, which allows an attacker to relay malicious code through an application to another system. In this instance, the malicious actor can execute commands on the affected devices by bypassing the Zyxel authenticator and opening up a backdoor into the device. Zyxel released a patch for this exploit at the same time that the exploit was publicly identified.

This exploit exposes vulnerabilities in EOL devices that malicious actors commonly target. In many cases, EOL devices are not given patches when exploits are identified, as their systems are no longer supported. This particular case is an exception due to the severity of the vulnerability. A common way malicious actors gain entry into a network is through out-of-date applications on target computers that contain unpatched exploits on unsupported systems. These vulnerabilities are especially potent on NAS devices, which can grant malicious actors access to entire connected networks.

NAS devices are regular targets of cyberattacks, specifically ransomware attacks, due to their cloud based storage capability, minimal security features, and its status as an Internet of Things (IoT) device connected to a main system. These aspects can provide an avenue for undetected entry and maintained persistence. NAS devices are vulnerable to many forms of malware and cyberattacks, including ransomware, DDoS, and information exfiltration. Due to the wide range of vulnerabilities and versatility of application access, it is critical to keep devices and applications up to date to avoid providing additional exploits to malicious actors probing into targeted systems.

Implement strong security measures. This includes using firewalls, antivirus software, and data encryption to protect your systems from unauthorized access. You should also regularly update your software and patch vulnerabilities.