Threat Intelligence Roundup Covers Pentagon Breach, FBI Operations and Hirudo Trojan
Summary
DarkOwl’s roundup reviews eight security stories, including a Pentagon personnel-records breach, law-enforcement operations, attacks involving autonomous AI agents, and the Hirudo Android banking trojan.
Key points
- U.S. Treasury announced sanctions against a network it says allegedly moved more than $2 million to Hamas, including funds transferred through cryptocurrency.
- The Pentagon reported that a breach of a Defense Manpower Data Center system exposed personal information belonging to nearly 3 million people; officials say the vulnerability was fixed and an investigation is ongoing.
- U.S. authorities said an operation disrupted more than 40 suspected laptop farms tied to an alleged North Korean remote IT worker scheme and seized about 187 laptops and KVM devices.
- The FBI and DOJ seized seven domains to disrupt operations linked to Flax Typhoon. The roundup describes the group’s use of MicroScan and FishHub and its connection, according to investigators, to the Raptor Train botnet.
- A researcher reported that autonomous AI agents attempted to compromise more than 1,200 websites, with over 100 reportedly breached, including sites belonging to Deere, SharkNinja and Cummins.
- Authorities arrested three suspects linked to KillSec and seized five servers and at least 110 terabytes of data. Separately, a U.S. soldier was sentenced to 70 months for hacking and extorting 10 companies.
- Researchers described Hirudo, an Android banking trojan distributed through fake app updates that can steal banking information and give attackers remote control of infected devices.
Article Details
- Event Type
- Threat intelligence news roundup covering sanctions against a Hamas financing network, a Pentagon personnel-data breach, disruption of North Korean IT-worker fraud and Flax Typhoon operations, website intrusions, arrests and sentencing linked to cybercrime, and discovery of the Hirudo Android banking trojan.
- Impact
- Reported impacts include exposure of personal information belonging to nearly 3 million people; alleged transfer of more than $2 million to Hamas; disruption of suspected North Korean IT-worker fraud and Flax Typhoon operations; arrests and seizures linked to the KillSec ransomware group; extortion and theft affecting technology and telecommunications companies; and Hirudo’s theft of banking credentials and other data from infected devices. Officials said the Pentagon vulnerability was fixed and the investigation remains ongoing.
MITRE ATT&CK
People
Threat Actors
cyb3rph4nt0mOnline alias of Cameron John Wagenius, whom the article says was sentenced for hacking and extorting technology and telecommunications companies.Flax TyphoonChina-linked APT group associated by U.S. authorities with cyber operations targeting critical infrastructure and organizations; authorities seized seven domains to disrupt its operations.kiberphant0mSentenced for hacking and extorting technology and telecommunications companies; the article says he was known online as kiberphant0m and cyb3rph4nt0m.KillSecRansomware group linked to arrests and law-enforcement seizures of its leak site and servers.
Malware
Vendors
CrowdStrikeof Investigation (FBI), in coordination with the Department of Justice (DOJ) and cybersecurity firm CrowdStrike, disrupted more than 40 suspected “laptopfarms” across Texas as part of an operation targeting NorthNorForgeA researcher at the cybersecurity company NorForge observed a Chinese-speaking hacker breach more than 100 company websites using autonomous AI agents.ThreatFabricCybersecurity researchers at Dutch mobile security firm ThreatFabric uncovered a new Android banking trojan called Hirudo, which uses modified versions of legitimate banking applications to bypass built-in security
Products
Android8. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks – The Hacker NewsTelegramhis accomplices used stolen credentials to access victim networks, coordinated their activities through Telegram, and later attempted to extort organizations by threatening to publish or sell stolen data on cybercrime
Tools
CairnSnorre Fagerland, the researcher who observed the incident, discovered it by scanning the web for “inadvertently exposed instances of Cairn,” an AI-powered system often used by hackers.FishHubauthorities, the group used two primary tools, MicroScan and FishHub, to target critical infrastructure and organizations in the United States and internationally.MicroScanauthorities, the group used two primary tools, MicroScan and FishHub, to target critical infrastructure and organizations in the United States and internationally.
Countries
ChinaJustice (DOJ) seized seven internet domains to disrupt cyber operations associated with Flax Typhoon, a China-linked advanced persistent threat (APT) group connected to Beijing-based Integrity Technology Group.FranceAccording to Treasury, the network operated through France-based organizations that presented themselves as charities raising humanitarian aid for civilians in Gaza, while actually directing donations to a HamasGreeceIn addition to the arrests, police carried out eight searches across Spain, Greece, Romania and the UK, while seizing five servers and securing at least 110 terabytes of data.IndiaThe malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions.IndonesiaThe malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions.IsraelTreasury stated that $1.5 million of the funds was raised after the October 7, 2023, Hamas attack on Israel.MexicoThe malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions.MoroccoThe malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions.North Koreagenerated around $3 million in revenue believed to have been transferred to entities controlled by North Korea.RomaniaA 24-year-old suspect was arrested in Romania, with searches carried out in Bucharest and Vaslui County.SpainThe suspected 16-year-old main operator was arrested in Alicante, Spain, where Spanish police also searched a home and a hotel office.ThailandThe malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions.United KingdomThe third suspect was arrested in the United Kingdom and is reportedly linked to an extradition request from U.S.United States1. Treasury Dismantles Major Hamas Financing Network – U.S. Department of the Treasury
Industries
Communicationscompanies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support.Critical infrastructure4. FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions – The Hacker NewsCybersecurityWe hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.Healthcarecompanies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support.Manufacturingcompanies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support.Retailcompanies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support.TechnologyTyphoon, a China-linked advanced persistent threat (APT) group connected to Beijing-based Integrity Technology Group.TelecommunicationsCameron John Wagenius (known online as ‘kiberphant0m’ and ‘cyb3rph4nt0m’) has been sentenced to 70 months in prison for hacking and extorting 10 technology and telecommunications companies.