Taiwan Arrests Student Accused of Rail Network Hacking; PamDOORa Linux Backdoor Emerges
Summary
The roundup covers a student detained over alleged rail-network interference, campaigns targeting drone-sector attendees and gaming-platform users, the marketed PamDOORa Linux backdoor, and guidance for removing Firestarter from Cisco firewalls.
Key points
- Taiwan detained a student accused of cloning TETRA radio signals to send fake emergency alerts to the high-speed rail control center and force trains to stop.
- Operation Silent Rotor targeted Eurasian drone-industry participants with spear-phishing emails disguised as Russian aviation information orders.
- ScarCruft reportedly trojanized Windows update files and Android game packages to deploy the BirdCall backdoor against users in China's Yanbian region.
- A threat actor known as darkworm is marketing PamDOORa, a Linux PAM backdoor advertised as enabling persistent SSH access and plaintext credential theft.
- Eclypsium reported that the ArcaneDoor group’s Firestarter implant can persist on Cisco firewalls after firmware patches; a hard power cycle is required to remove it.
- Cisco Talos identified malware using Microsoft Phone Link to collect OTPs and SMS messages from synchronized SQLite databases.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering proposed federal vulnerability-remediation deadlines, malware and espionage campaigns, cybercrime prosecutions, a train-network intrusion, and a potential CISA leadership change.
- Impact
- Reported activity includes OTP and SMS theft, surveillance and data exfiltration, persistent access to Cisco firewalls, and malware-enabled ATM theft. A Taiwan rail intrusion allegedly caused several trains to stop. Separate criminal cases involved nearly $300,000 stolen from banks and North Korean IT workers’ reported infiltration of nearly 70 US companies for $1.2 million. Federal officials are proposing a three-day remediation window for critical vulnerabilities.
MITRE ATT&CK
People
Threat Actors
APT37The article attributes a targeted surveillance campaign in China’s Yanbian region to ScarCruft, including trojanized game packages and deployment of the BirdCall backdoor.ArcaneDoorThe article says this cyber espionage group is using the Firestarter implant to compromise Cisco firewalls and maintain persistence.darkwormIdentified as the threat actor marketing PamDOORa source code, a backdoor designed to maintain SSH access and harvest plaintext credentials.David Jose Gomez CegarraSentenced for his role in an ATM jackpotting operation that installed malware on ATM hard drives and stole nearly $300,000 from banks.Erick Ntekereze PrinceSentenced for enabling North Korean IT workers to access nearly 70 US companies; the article says he hosted corporate laptops and installed unauthorized remote-access software.Matthew Isaac KnootSentenced for enabling North Korean IT workers to access nearly 70 US companies; the article says he hosted corporate laptops and installed unauthorized remote-access software.
Malware
BirdCallBy trojanizing Windows update files and Android game packages, the group deployed the BirdCall backdoor to exfiltrate personal documents and record audio from victim devices.FIRESTARTERHard power cycles required to eradicate Firestarter implant from Cisco firewalls PamDOORaNew Linux backdoor PamDOORa
Vendors
CiscoCisco Talos has identified a modular malware campaign featuring the CloudZ remote access tool and a new plugin named Pheno.MicrosoftThis threat intercepts one-time passwords and SMS messages by targeting the Microsoft Phone Link application to extract data from synchronized SQLite databases on the host PC.
Products
AndroidBy trojanizing Windows update files and Android game packages, the group deployed the BirdCall backdoor to exfiltrate personal documents and record audio from victim devices.Cisco firewallsHard power cycles required to eradicate Firestarter implant from Cisco firewalls Microsoft WindowsMalware leverages Windows Phone Link to steal OTPsPhone LinkMalware leverages Windows Phone Link to steal OTPsPluggable Authentication Module (PAM)A threat actor known as ‘darkworm’ is marketing the source code for PamDOORa, a sophisticated post-exploitation tool designed to compromise the Linux Pluggable Authentication Module (PAM) stack.
Tools
Countries
ChinaThe North Korea-linked threat actor ScarCruft conducted targeted surveillance against users in the Yanbian region of China by compromising a video game platform used by ethnic Koreans living there.North KoreaThe North Korea-linked threat actor ScarCruft conducted targeted surveillance against users in the Yanbian region of China by compromising a video game platform used by ethnic Koreans living there.TaiwanTrain hacker arrested in TaiwanUnited StatesUS government targets 72-hour patch cycles